Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
About the Author
About the Reviewer
Preface
Index

Example 2: A Typical Small ISP


The term "typical" might not be so appropriate when talking about small ISPs. We have met a lot of network administrators and we seen a lot of small ISPs, and they all had different configurations.

The network we are going to build in this example is not specific to any provider but rather a general one. These types of networks exist in generally with a few modifications.

The network has more security breakpoints than the previous network; so we'll have more complex and complicated firewalls.

The Network

Let's take the following network as an example:

This is a small ISP that has one internet connection, an access network, a server farm, and the internal departments. This ISP uses Linux routers and servers.

The connection from the provider comes in one interface of the Linux core router. Usually, the core router should be a very stable and powerful machine because it needs to have a few network interfaces through which a significant amount of data is passed....