Just under construction , version 0.1, last update 2002/10/17

What is a firewall?

You have to ask yourself what do you want to accomplish with a firewall. Shure, you want to protect your local network. But what does this mean exactly? You want to protect the resources you have, your high valued data, and last but not least your reputatuion.

With resources I mean things like data, disk space, computation time etc. It is important to protect high valued data from being known by other people, from beeing changed or made unavailable. A firewall will help to increase security in these respects.

A firewall is a concept for the connection between a private and a public part of a network. It is able to do two things for you. First to log the data transfer between two parts of the net and second to retrict by a security policy what data can flow between these networks.

You can use the logs of the data transfer that happend generated by the firewall system to gather information about what normally happenes and what is unsual. With unsual I meant untypical data tranfer, portscans, not permittet connection attepts, invalid or non-conform data packages.

The restriction of data flow between two of more networks is done by analyzing data parameters like protocols, source- and destination-address, source- and destination-port (services people want to access are normally bound to specific and well known ports), protocol options (normally in the case of icmp and tcp) and, depending on the power of the firewall software, on many ohter useful things.

There are basically two technologies for firewalls: proxy systems (like the S.u.S.e. proxy suit or the TIS Firewall Toolkit or other proxies) and packet filters. Mostly there are used in combination. A proxy is nothing else than a configurable server software, that accepts/intercepts connections and act, instead of the clients, as the client for connections to services. For most clients the proxy is fully transperent.

In Linux the packet filter (firewall) is integrated into the kernel. The firewall rules are loaded into the kernel by a specific software. There are also scripts availible that can help you to define and generate rules that are suitable to you network environment.

The packet filter architecture differs with respect to it's strenth, it's abilities and the software used to fill it with rules greatly between the main kernel versions.

• Kernel 2.0 uses ipfwadm,
• Kernel 2.2 uses ipchains, and
• Kernel 2.4 uses iptables as a tool for setting up packet filtering rules at the kernel level.

I do not want to talk about differences between the linux packet filters. I only want to tell you shortly about what is new in the packet filter that is part of kernel 2.4. The new packet filter is now stateful and is modular. What does this mean?

Stateful means that the new linux packet filter is now able to keep track of connections. You can use this when defining your rule set. States are NEW, ESTABLISHED, and RELATED. In the section protection --> iptables I will explain these states in detail.

Modular means that the packet filtering system is built in a modular way. New modules, handlings things not integrated into the basic packet filtering system, can be loaded as a module into the kernel. There are yet some basic modules shipped with the current kernel. For example the module that keeps track about connections making the linux packet filtering system a stateful one. Together with the iptables-software, new modules are shipped. There is, for example, a new module for defining strings/pattern to search for in packages transfered through the packetfilter/firewall. So it is possible to implement basic intrusion detection functionality into the firewall.

back to top