Chapter 4: The Linux Firewall
Linux has almost always had an integrated firewall available for use by administrators. With the native firewall tools, you can craft a traditional perimeter firewall with address translation or a proxy server. These aren't, however, typical use cases in a modern data center. The typical use cases for host firewalls in modern infrastructure are as follows:
- Inbound access controls, to limit access to administrative interfaces
- Inbound access controls, to restrict access to other installed services
- Logging of accesses for any subsequent incident response, after a security exposure, breach, or another incident
While egress filtering (outbound access controls) is certainly recommended, this is more often implemented at network perimeters – on firewalls and routers between VLANs or facing less-trusted networks such as the public internet.
In this chapter, we'll focus on implementing a set of rules that govern access...