Firewalls are a good thing, but they're not enough anymore. Ports don't define traffic anymore, we must have a look at the applicative level to enforce policies and block malicious traffic efficiently. Here I present how I set up one of the open source leaders, Suricata.
When you have a limited trust in your ISP and don't know how far he can (or wants to) enter your network from the modem, you're like me and end up settings up your own router behind this modem. This article starts this story with an IPv4-only router.