Chapter 9. TCP/IP Firewall
- Table of Contents
- 9.1. Methods of Attack
- 9.2. What Is a Firewall?
- 9.3. What Is IP Filtering?
- 9.4. Setting Up Linux for Firewalling
- 9.4.1. Kernel Configured with IP Firewall
- 9.4.2. The ipfwadm Utility
- 9.4.3. The ipchains Utility
- 9.4.4. The iptables Utility
- 9.5. Three Ways We Can Do Filtering
- 9.6. Original IP Firewall (2.0 Kernels)
- 9.6.1. Using ipfwadm
- 9.6.2. A More Complex Example
- 9.6.3. Summary of ipfwadm Arguments
- 9.7. IP Firewall Chains (2.2 Kernels)
- 9.7.1. Using ipchains
- 9.7.2. ipchains Command Syntax
- 9.7.3. Our Naïve Example Revisited
- 9.7.4. Listing Our Rules with ipchains
- 9.7.5. Making Good Use of Chains
- 9.8. Netfilter and IP Tables (2.4 Kernels)
- 9.9. TOS Bit Manipulation
- 9.10. Testing a Firewall Configuration
- 9.11. A Sample Firewall Configuration
Security is increasingly important for companies and individuals alike. The Internet has provided them with a powerful tool to distribute information about themselves and obtain information from others, but it has also exposed them to dangers that they have previously been exempt from. Computer crime, information theft, and malicious damage are all potential dangers.
An unauthorized and unscrupulous person who gains access to a computer system may guess system passwords or exploit the bugs and idiosyncratic behavior of certain programs to obtain a working account on that machine. Once they are able to log in to the machine, they may have access to information that may be damaging, such as commercially sensitive information like marketing plans, new project details, or customer information databases. Damaging or modifying this type of data can cause severe setbacks to the company.
The safest way to avoid such widespread damage is to prevent unauthorized people from gaining network access to the machine. This is where firewalls come in.
 | Constructing secure firewalls is an art. It involves a good understanding of technology, but equally important, it requires an understanding of the philosophy behind firewall designs. We won't cover everything you need to know in this book; we strongly recommend you do some additional research before trusting any particular firewall design, including any we present here. |
There is enough material on firewall configuration and design to fill a whole book, and indeed there are some good resources that you might like to read to expand your knowledge on the subject. Two of these are:
- Building Internet Firewalls
by D. Chapman and E. Zwicky (O'Reilly). A guide explaining how to design and install firewalls for Unix, Linux, and Windows NT, and how to configure Internet services to work with the firewalls.
- Firewalls and Internet Security
by W. Cheswick and S. Bellovin (Addison Wesley). This book covers the philosophy of firewall design and implementation.
We will focus on the Linux-specific technical issues in this chapter. Later we will present a sample firewall configuration that should serve as a useful starting point in your own configuration, but as with all security-related matters, trust no one. Double check the design, make sure you understand it, and then modify it to suit your requirements. To be safe, be sure.