Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
About the Author
About the Reviewer
Preface
Index

A Real Large Network Example


The network we are going to present here is actually working in real life. Of course, we will replace the real IP addresses of the routers and servers.

The network is deployed at a large provider of Internet and IP telephony services. The point is to understand how packets flow through the network, to identify the security breakpoints, and build proper firewalls for the network.

We will present here only the important parts of the network as it is.

Let's start by looking at the network architecture and explain how the network is built and what's in the network.

A Brief Network Overview

The core of the network is represented in the following figure:

Core-1 is a router that has one FastEthernet connection to an ISP from which we buy 34Mbps of internet services. It is located in the main datacenter of this company and has a fiber optic connection at 100Mbps to Core-2 located in another datacenter. Core-1 also has a fiber optic connection at 1000Mbps (1Gbps) to Core-3...