Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.

Related Content you might be interested in

Current Title:

Small book image
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter
Lucian Gheorghe
Oct, 2006 | 0 hours 0 minutes
No titles found
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
Credits
About the Author
About the Author
About the Reviewer
About the Reviewer
Preface
Preface
Free Chapter
1
Networking Fundamentals
Networking Fundamentals
The OSI Model
The TCP/IP Model
OSI versus TCP/IP
IP Addressing, IP Subnetting, and IP Supernetting
How the Internet Works
Summary
2
Security Threats
Security Threats
Layer 1 Security Threats
Layer 2 Security Threats
Layer 3 Security Threats
Layer 4 Security Threats
Layer 5, 6, and 7 Security Threats
Summary
3
Prerequisites: netfilter and iproute2
Prerequisites: netfilter and iproute2
netfilter/iptables
iproute2 and Traffic Control
Summary
4
NAT and Packet Mangling with iptables
NAT and Packet Mangling with iptables
A Short Introduction to NAT and PAT (NAPT)
NAT Using iptables
Packet Mangling with iptables
Summary
5
Layer 7 Filtering
Layer 7 Filtering
When to Use L7-filter
How Does L7-filter Work?
Installing L7-filter
L7-filter Applications
IPP2P: A P2P Match Option
IPP2P versus L7-filter
Summary
6
Small Networks Case Studies
Small Networks Case Studies
Linux as SOHO Router
Linux as Router for a Typical Small to Medium Company
Summary
7
Medium Networks Case Studies
Medium Networks Case Studies
Example 1: A Company with Remote Locations
Example 2: A Typical Small ISP
Summary
8
Large Networks Case Studies
Large Networks Case Studies
Thinking Large, Thinking Layered Models
A Real Large Network Example
Summary
Index
Index

A Short Introduction to NAT and PAT (NAPT)

According to the way TCP/IP works, in order for hosts to communicate on the Internet, each must have a unique IP address.

However, due to the shortage of public IP addresses available, it is necessary to use one IP address for many hosts using NAT.

Network Address Translation is a way to translate one IP address into another. This implies a NAT router (Linux in our case) that rewrites the source or destination IP of a device behind the NAT router.

There are many small boxes called SOHO routers or NAT routers that can be used to perform NAT for a small private LAN. They are cheap and usually you can just plug them in and everything works. If you have already used one, you will see that there are many things you can do with Linux.

To explain NAT in more detail, let's take a look at the following diagram:

We have a Linux router with one Internet connection and a public IP address—1.1.1.1. We can use whatever IP addresses we want from the private IP segments...

Previous Section
End of Section 2
Next Section