Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
About the Author
About the Reviewer
Preface
Index

Example 1: A Company with Remote Locations


The following example is from a real application. It's about a hypermarket having the headquarters in one location, one store in the same city, and several stores in other cities.

The hypermarket has an application that uses MSSQL databases in each location. The remote database contains details on stocks and personnel, and needs to replicate with the headquarters database every day at closing hours. Replication is needed for stock details update, as the checkout devices query the database for prices and update stocks so that the headquarters database has all info on daily sales, and available stocks in every store. The application is developed by a third party software company that also does database administration and remote storage; so it needs access to all databases in every store.

All locations have IP Analog Telephone Adapters (IP phones in the diagram that follows) with subscriptions at the main provider (the HQ provider). In this example...