Next Previous Contents

8. The logic of firewalling with linuxconf

The firewalling in Linux is highly flexible and can be very complicate. Linuxconf is proposing a simple logic that simplify the composition of the firewalling rule. While this logic helps creates and maintains basic firewall, some configuration may not be created with linuxconf. Here is the logic

8.1 Positive logic

When you activate one of the 3 firewalling systems (input, forward, output), Linuxconf will set the default policy to deny. All rules you enter are indeed holes or openings in the firewall. If you enter no rule, then your machine will be pretty isolated, answering to nothing.

8.2 A pre-cooked firewall solution

Here is an example for a simple network. Mostly, you have eth0 pointing to the local network. Nothing must be reachable from the outside on this network. eth1 points to a router on the Internet.

Blocking rules: accepting all icmp packet

        Protocol                icmp
                        -----------From---------------
        Host or Network 0.0.0.0
        Netmask         
        Port range
        Other ports
        Interface               eth1
                        -----------To-----------------
        Host or Network eth1
        Netmask
        Port range
        Other ports
        Interface       Any
        

Blocking rules: accepting only DNS packet

Ultimatly only port

        Protocol                udp
                        -----------From---------------
        Host or Network 0.0.0.0
        Netmask         0.0.0.0
        Port range
        Other ports
        Interface               eth1
                        -----------To-----------------
        Host or Network eth1
        Netmask
        Port range
        Other ports
        Interface       Any
        


Next Previous Contents