RuggedCom RX1100 ユーザーズマニュアル
Chapter 11 – Configuring The Firewall
Chapter 11 – Configuring The Firewall
Introduction
This chapter familiarizes the user with:
•
Enabling/Disabling The Firewall
•
Elements of Firewall design
•
How to configure the Firewall
•
Checking Firewall configuration
Firewall Fundamentals
Firewalls are software systems designed to prevent unauthorized access to or from
private networks. Firewalls are most often used to prevent unauthorized Internet
users from accessing private networks (intranets) connected to the Internet.
When the RuggedRouter firewall is used, the router serves a gateway machine
through which all messages entering or leaving the intranet pass. The router
examines each message and blocks those that do not meet the specified security
criteria. The router also acts as a proxy, preventing direct communication between
computers on the Internet and intranet. Proxy servers can filter the kinds of
communication that are allowed between two computers and perform address
translation.
private networks. Firewalls are most often used to prevent unauthorized Internet
users from accessing private networks (intranets) connected to the Internet.
When the RuggedRouter firewall is used, the router serves a gateway machine
through which all messages entering or leaving the intranet pass. The router
examines each message and blocks those that do not meet the specified security
criteria. The router also acts as a proxy, preventing direct communication between
computers on the Internet and intranet. Proxy servers can filter the kinds of
communication that are allowed between two computers and perform address
translation.
Stateless vs Stateful Firewalls
Firewalls fall into into two broad categories: stateless and stateful (session-based).
Stateless or “static” firewalls make decisions about a traffic without regard to the
history, simply opening a “hole” for the traffic's type (based upon TCP or UDP port
number). Stateless firewalling is a relatively simple affair, easily handling web and
email traffic. Stateless firewalls suffer from disadvantages, however. All holes
opened in the firewall always open, there is no opening and closing connections based
on outside criteria. Static IP filters offer no form of authentication.
Stateful firewalling adds considerable complexity the firewalling process by tracking
the state of each connection.
A stateful firewall also looks at each packet and apply tests, but the tests applied or
“rules” may be modified depending on packets that have already been processed.
This is called “connection tracking”. Stateful firewalls can also recognize that traffic
on connected sets of TCP/UDP ports is from a particular protocol and manage it as a
whole.
Stateless or “static” firewalls make decisions about a traffic without regard to the
history, simply opening a “hole” for the traffic's type (based upon TCP or UDP port
number). Stateless firewalling is a relatively simple affair, easily handling web and
email traffic. Stateless firewalls suffer from disadvantages, however. All holes
opened in the firewall always open, there is no opening and closing connections based
on outside criteria. Static IP filters offer no form of authentication.
Stateful firewalling adds considerable complexity the firewalling process by tracking
the state of each connection.
A stateful firewall also looks at each packet and apply tests, but the tests applied or
“rules” may be modified depending on packets that have already been processed.
This is called “connection tracking”. Stateful firewalls can also recognize that traffic
on connected sets of TCP/UDP ports is from a particular protocol and manage it as a
whole.
Linux® netfilter, iptables And The Shoreline Firewall
The RuggedRouter employs a stateful firewall system known as netfilter, a set of
loadable kernel modules that provides capabilities to allow session-based packet
examination. The netfilter system is an interface built into the Linux kernel that
allows the IP network stack to provide access to packets.
loadable kernel modules that provides capabilities to allow session-based packet
examination. The netfilter system is an interface built into the Linux kernel that
allows the IP network stack to provide access to packets.
RuggedCom 103