Fire-walling and packets accounting Introduction 11.. TTaasskkss Most private network are not connected directly to the Internet for security reason. The machine acting as the router between the public and private network is called the firewall. The firewall is a car component protecting the passenger from any fire in the engine. The analogy with IP network come from the fact that the _I_n_t_e_r_n_e_t is a "hot" place, sometime too hot. It is a good idea to limit the impact of the _I_n_t_e_r_n_e_t on your private network. 22.. PPaacckkeett ffiilltteerriinngg Packet filtering allows your computer to drop or accept IP packets based on the following criteria: +o Origin. +o Destination. +o Interface on which it was received. Origin and Destination are qualified by: +o IP number. +o Port number. +o Protocol. 33.. BBiiddiirreeccttiioonnaall rruulleess The rules you are entering are bidirectional. In one screen, you qualify packet flowing from the origin to the destination and the reverse. This is why you are allowed to specify the interface twice. 44.. BBlloocckkiinngg rruulleess You can control the packet which are accepted by your computer when they get in. Blocking rules allow you to discard some packet a reception time. 55.. FFoorrwwaarrddiinngg rruulleess You can control the packet which are about to leave your computer. You can discard packet at delivery time. Most firewall can be implemented using blocking rules. One special case of forwarding rules are the masquerading rules. These are handled in the same user interface (A simple check-box). 66.. AAccttiivvaattiinngg rruulleess gglloobbaallllyy oorr sseelleeccttiivveellyy You can permanently deactivate a rule or all rules without erasing it. This is handy to first test the fire-walling capabilities and to establish "switch-able" policies. Each rule has a check box to activate it. One screen is provided to activate/deactivate all blocking rules and all forwarding rules at once. 77.. WWhheenn eevveerryytthhiinngg ggooeess wwrroonngg The fire-walling in _L_i_n_u_x may be deadly. An improper configuration may bring the station to its knee. One command that may save your day is netconf --resetfw This command deactivates all fire-walling rules. It does not affect the configuration, but only the working set. netconf --update will reactivate the rules. You may need to use those two commands to check out if a network malfunction is caused by your fire-walling rules or not. 88.. TThhee llooggiicc ooff ffiirreewwaalllliinngg wwiitthh lliinnuuxxccoonnff The firewalling in _L_i_n_u_x is highly flexible and can be very complicate. _L_i_n_u_x_c_o_n_f is proposing a simple logic that simplify the composition of the firewalling rule. While this logic helps creates and maintains basic firewall, some configuration may not be created with linuxconf. Here is the logic 88..11.. PPoossiittiivvee llooggiicc When you activate one of the 3 firewalling systems (input, forward, output), _L_i_n_u_x_c_o_n_f will set the default policy to _d_e_n_y. All rules you enter are indeed holes or openings in the firewall. If you enter no rule, then your machine will be pretty isolated, answering to nothing. 88..22.. AA pprree--ccooookkeedd ffiirreewwaallll ssoolluuttiioonn Here is an example for a simple network. Mostly, you have eth0 pointing to the local network. Nothing must be reachable from the outside on this network. eth1 points to a router on the Internet. 88..22..11.. BBlloocckkiinngg rruulleess:: aacccceeppttiinngg aallll iiccmmpp ppaacckkeett Protocol icmp -----------From--------------- Host or Network 0.0.0.0 Netmask Port range Other ports Interface eth1 -----------To----------------- Host or Network eth1 Netmask Port range Other ports Interface Any 88..22..22.. BBlloocckkiinngg rruulleess:: aacccceeppttiinngg oonnllyy DDNNSS ppaacckkeett Ultimatly only port Protocol udp -----------From--------------- Host or Network 0.0.0.0 Netmask 0.0.0.0 Port range Other ports Interface eth1 -----------To----------------- Host or Network eth1 Netmask Port range Other ports Interface Any 99.. SSttaattee ooff tthhee ffiirree--wwaalllliinngg ssuuppppoorrtt iinn LLiinnuuxxccoonnff Fire-walling is a hot topic these days and a black art. _L_i_n_u_x_c_o_n_f is trying to make this more affordable. The author is expecting many comments on this topic.