Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.

Related Content you might be interested in

Current Title:

Small book image
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter
Lucian Gheorghe
Oct, 2006 | 0 hours 0 minutes
No titles found
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
Credits
About the Author
About the Author
About the Reviewer
About the Reviewer
Preface
Preface
Free Chapter
1
Networking Fundamentals
Networking Fundamentals
The OSI Model
The TCP/IP Model
OSI versus TCP/IP
IP Addressing, IP Subnetting, and IP Supernetting
How the Internet Works
Summary
2
Security Threats
Security Threats
Layer 1 Security Threats
Layer 2 Security Threats
Layer 3 Security Threats
Layer 4 Security Threats
Layer 5, 6, and 7 Security Threats
Summary
3
Prerequisites: netfilter and iproute2
Prerequisites: netfilter and iproute2
netfilter/iptables
iproute2 and Traffic Control
Summary
4
NAT and Packet Mangling with iptables
NAT and Packet Mangling with iptables
A Short Introduction to NAT and PAT (NAPT)
NAT Using iptables
Packet Mangling with iptables
Summary
5
Layer 7 Filtering
Layer 7 Filtering
When to Use L7-filter
How Does L7-filter Work?
Installing L7-filter
L7-filter Applications
IPP2P: A P2P Match Option
IPP2P versus L7-filter
Summary
6
Small Networks Case Studies
Small Networks Case Studies
Linux as SOHO Router
Linux as Router for a Typical Small to Medium Company
Summary
7
Medium Networks Case Studies
Medium Networks Case Studies
Example 1: A Company with Remote Locations
Example 2: A Typical Small ISP
Summary
8
Large Networks Case Studies
Large Networks Case Studies
Thinking Large, Thinking Layered Models
A Real Large Network Example
Summary
Index
Index

Chapter 5. Layer 7 Filtering

In Chapter 1 of this book, we presented the OSI and TCP/IP networking models. As we saw there, even if the TCP/IP model has the widest usage, the reference model is OSI.

Let's have a look at the TCP/IP and OSI models again:

At Layer 7 of the OSI model, we find Application (HTTP, FTP, SSH, etc.). As you can see from the picture above, TCP/IP compacted OSI Layers 7, 6, and 5 into one Layer, TCP/IP Layer 4 (Application), which has the same name, but different functionality.

Filtering and prioritizing traffic from some applications can be very easy and very hard at the same time. Normally, we would filter/prioritize web traffic by matching TCP packets with source or destination port 80, which is the standard HTTP port. However, web servers can be configured to use any port; so our filters/prioritizations won't work for that particular traffic.

Another big problem network administrators have is filtering traffic belonging to P2P (peer to peer) applications like Kazaa...

Previous Section
End of Section 1
Next Section