I still don't understand why you think you need a firewall.
You don't need a firewall.
When there are no programs listening and reading information send through
network ports, it doesn't matter what information is send to your computer.
The information will just get ignored, wherever it's malicious or not. It
won't even be read.
Now, by default in Trisquel there are several programs (called "services")
that indeed listen and read messages send through network ports. These are
the:
OpenSSH server, used for remote access to your computer
CUPS server, used for access to printers
SMB server, used for file sharing with Windows operating systems
Dnsmasq server, used for something that has to do with DNS
When you type ss -ln you'll see all ports on which services listen on:
OpenSSH listens on port *:22
CUPS listens on port 127.0.0.1:631
SMB listens on ports *:139 and *:445
Dnsmasq listens on port 127.0.0.1:53
First, notice that CUPS and Dnsmasq ports start with 127.0.0.1. This means
that they will only listen on their ports, if the connection is send by your
computer. Messages from other computers will be ignored.
Then there are OpenSSH and SMB which ports start with *. This means that
they will listen to messages send by other computers. But that doesn't mean
your computer will get cracked. Those programs were written by many people
who understand and are concerned with computer security.
One thing you should keep in mind is, if someone knows your username,
password and IP-address, he may be able to access remotely your computer
through OpenSSH.
There's the possibility that there's might be a security hole in OpenSSH or
SMB. A hole of which only bad people know. If that concerns you, then you
should just stop those two services. You don't need a firewall.
I also stop CUPS, just because I don't use it. To stop those services, you
do:
echo "manual" | sudo tee /etc/init/cups.override
echo "manual" | sudo tee /etc/init/smbd.override
echo "manual" | sudo tee /etc/init/ssh.override
sudo stop cups
sudo stop smbd
sudo stop ssh
Now if you do ss -ln, you'll probably see only dnsmasg listening on port
127.0.0.1:54. I don't know if dnsmasg is useful for me. It dosn't listen to
other computers anyway, so I leave it be.
When I want to start SSH server, I do "sudo start ssh". When I finish, I do
"sudo stop ssh".
You concerns arise from you not understanding. I suggest you try to learn
how computers and GNU systems work. I suggest you website
http://codeschool.org/. There you'll find video lesson on programming,
operating systems and how computers work. The lessons that most closely
concern this topic are:
"Hardware and operating system basics"
"The Internet"
"Unix system calls"
