Linux Firewalls

Bob Ziegler graduated from the University of Wisconsin-Madison with an undergraduate degree in psychology, following near-completions in both German and philosophy. After taking educational and career trips in several directions, he decided to make his hobby his career and earned a master's degree in computer science, also from the University of Wisconsin-Madison. Out of school, Bob became one of a team of two UNIX operating system developers working for a company developing a mini-supercomputer. He developed a multiprocessor version of BSD 4.3 UNIX as a side project to the team's ongoing uniprocessor development efforts. Since then, he has worked as a UNIX operating system kernel developer for R&D companies in the Boston area. The advent of Linux and consumer access to 24/7 Internet connectivity gave Bob the keys to a dream he'd had since 1982 -- to have his own UNIX server and LAN at home. What began as a pragmatic effort to make his system secure on the Internet quickly grew into a passion for the home UNIX user. He offers free, web-based Linux firewall design services to the public, as well as a popular firewall and LAN FAQ to help people quickly get their Linux systems set up securely. Bob most recently functioned as a firewall architect at Nokia, collaborating wiht several groups in Massachusetts, California, and Finland. Carl B. Constantine has workin the computer industry for many years. He's been a programmer, consultant, technical writer, troubleshooter, and anything else he could get his paws into. Carl lives in beautiful Victoria, British Columbia, Canada, with his wife, Terry, and four children, Rebekah, 6, Emily, 4, Matthew, 2, and Joshua, 6 months. Carl is a programmer analyst/UNIX system administrator for the Department of Computer Science at the University of Victoria, in Victoria, British Columbia, Canada.

(NOTE: All chapters conclude with a Summary.)I. PACKET FILTERING AND BASIC SECURITY MEASURES.

1. Preliminary Concepts Underlying Packet-Filtering Firewalls.


The TCP/IP Reference Networking Model. IP Addresses. Routing: Getting a Packet from Here to There. Service Ports: The Door to the Programs on Your System. Packets: IP Network Messages.

2. Packet-Filtering Concepts.


A Packet-Filtering Firewall. Choosing a Default Packet-Filtering Policy. Rejecting Versus Denying a Packet. Filtering Incoming Packets. Filtering Outgoing Packets. Private versus Public Network Services.

3. iptables: The Linux Firewall Administration Program.


Differences Between IPFW and Netfilter Firewall Mechanisms. iptables Features. iptables Syntax.

4. Building and Installing a Standalone Firewall.


iptables: The Linux Firewall Administration Program. Initializing the Firewall. Protecting Services on Assigned Unprivileged Ports. Enabling Basic, Required Internet Services. Enabling Common TCP Services. Enabling Common UDP Services. Filtering ICMP Control and Status Messages. Logging Dropped Incoming Packets. Logging Dropped Outgoing Packets. Denying Access to Problem Sites Up Front. Installing the Firewall.

II. ADVANCED ISSUES, MULTIPLE FIREWALLS, AND PERIMETER NETWORKS.

5. Firewall Optimization.


Rule Organization. User-Defined Chains. Optimized Example. What Did Optimization Buy?

6. Packet Forwarding.


The Limitations of a Standalone Firewall. Basic Gateway Firewall Setups. LAN Security Issues. Configuration Options for a Trusted Home LAN. Configuration Options for a Larger or Less Trusted LAN. A Formal Screened-Subnet Firewall. Converting the Gateway from Local Services to Forwarding.

7. NAT-Network Address Translation.


The Conceptual Background of NAT. iptables NAT Semantics. Examples of SNAT and Private LANs. Examples of DNAT, LANs, and Proxies.

8. Debugging the Firewall Rules.


General Firewall-Development Tips. Listing the Firewall Rules. Checking the Input, Output, and Forwarding Rules. Checking for Open Ports. Debugging SSH: A Real-Life Example.

III. SYSTEM-LEVEL SECURITY AND MONITORING.

9. Verifying That the System Is Running as You Expect.


Checking the Network Interfaces with ifconfig. Checking the Network Connection with ping. Checking Network Processes with netstat. Checking a Process Bound to a Particular Port with fuser. Checking All Processes with ps -ax. Interpreting the System Logs.

10. Issues at the UNIX System Administration Level.


Authentication: Verifying Identity. Authorization: Defining Access Rights to Identities. Server-Specific Configuration. SOCKS: An Application-Level Proxy Firewall. Miscellaneous System Accounts in /etc/passwd, /etc/shadow, and /etc/group. Setting Your PATH Variable. /etc/issue.net. Remote Logging. Keeping Current with Software Upgrades.

11. Secure Shell (SSH).


Installing SSH. Generating SSH Keys. Using SSH. Customizing Your SSH Configuration. Secure Copy (scp).

12. Tripwire.


Tripwire Overview. Installing Tripwire. Looking at How Tripwire Works. Configuring Tripwire. Using Tripwire. Tripwire Tips and Tricks.

13. Intrusion Detection and Incident Reporting Software.


Intrusion-Detection Software. Symptoms Suggesting That the System Might Be Compromised. What to Do if Your System Is Compromised. Incident Reporting.

IV. APPENDIXES.

Appendix A. Security Resources.


Security Information Sources. Software Collections. Security Tools. Firewall Tools. Reference Papers and FAQs. General Web Sites. Books.

Appendix B. Firewall Examples and Support Scripts.


iptables Firewall for a Standalone System from Chapter 4. Optimized iptables Firewall from Chapter 5. iptables Firewall for a Choke Firewall from Chapter 6. Special Purpose Support Scripts. DHCP and pump: Firewall Support with a Dynamic IP Address and Name Servers.

Appendix C. VPN.


Overview of Virtual Private Networks (VPN). Types of VPN. VPN Protocols. Linux and VPN Products. VPN Configurations. Connecting Networks. VPN and Firewalls.

Appendix D. Glossary.
Index.