Table of Contents
Advertisement
RUGGEDCOM ROX II
CLI User Guide
Section 5.17.1
Firewall Concepts
The following sections describe some of the concepts important to the implementation of firewalls in
RUGGEDCOM ROX II:
•
Section 5.17.1.1, "Stateless vs. Stateful Firewalls"
•
Section 5.17.1.2, "Linux netfilter"
•
Section 5.17.1.3, "Network Address Translation"
•
Section 5.17.1.4, "Port Forwarding"
•
Section 5.17.1.5, "Protecting Against a SYN Flood Attack"
Section 5.17.1.1
Stateless vs. Stateful Firewalls
There are two types of firewalls: stateless and stateful.
Stateless or static firewalls make decisions about traffic without regard to traffic history. They simply open a path
for the traffic type based on a TCP or UDP port number. Stateless firewalls are relatively simple, easily handling
web and e-mail traffic. However, stateless firewalls have some disadvantages. All paths opened in the firewall are
always open, and connections are not opened or closed based on outside criteria. Static IP filters offer no form of
authentication.
Stateful or session-based firewalls add considerably more complexity to the firewalling process. They track the
state of each connection, look at and test each packet (connection tracking), and recognize and manage as a
whole traffic from a particular protocol that is on connected sets of TCP/UDP ports.
Section 5.17.1.2
Linux netfilter
Netfilter, a subsystem of the Linux kernel, is a stateful firewall that provides the ability to examine IP packets on a
per-session basis.
Netfilter uses rulesets, which are collections of packet classification rules that determine the outcome of the
examination of a specific packet. The rules are defined by iptables, a generic table structure syntax and utility
program for the configuration and control of netfilter.
ROX implements an IP firewall using a structured user interface to configure iptables rules and netfilter rulesets.
Section 5.17.1.3
Network Address Translation
Network Address Translation (NAT) enables a LAN to use one set of IP addresses for internal traffic and a
second set for external traffic. The netfilter NAT function makes all necessary IP address translations as traffic
passes between the Intranet and the Internet. NAT is often referred to in Linux as IP Masquerading.
NAT itself provides a type of firewall by hiding internal IP addresses. More importantly, NAT enables a network
to use more internal IP addresses. Since they are only used internally, there is no possibility of conflict with IP
addresses used by other organizations. Typically, an internal network is configured to use one or more of the
reserved address blocks described in RFC1918.
Firewall Concepts
Chapter 5
Setup and Configuration
269
Advertisement
Table of Contents
Troubleshooting
