Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.

Related Content you might be interested in

Current Title:

Small book image
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter
Lucian Gheorghe
Oct, 2006 | 0 hours 0 minutes
No titles found
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
Credits
About the Author
About the Author
About the Reviewer
About the Reviewer
Preface
Preface
Free Chapter
1
Networking Fundamentals
Networking Fundamentals
The OSI Model
The TCP/IP Model
OSI versus TCP/IP
IP Addressing, IP Subnetting, and IP Supernetting
How the Internet Works
Summary
2
Security Threats
Security Threats
Layer 1 Security Threats
Layer 2 Security Threats
Layer 3 Security Threats
Layer 4 Security Threats
Layer 5, 6, and 7 Security Threats
Summary
3
Prerequisites: netfilter and iproute2
Prerequisites: netfilter and iproute2
netfilter/iptables
iproute2 and Traffic Control
Summary
4
NAT and Packet Mangling with iptables
NAT and Packet Mangling with iptables
A Short Introduction to NAT and PAT (NAPT)
NAT Using iptables
Packet Mangling with iptables
Summary
5
Layer 7 Filtering
Layer 7 Filtering
When to Use L7-filter
How Does L7-filter Work?
Installing L7-filter
L7-filter Applications
IPP2P: A P2P Match Option
IPP2P versus L7-filter
Summary
6
Small Networks Case Studies
Small Networks Case Studies
Linux as SOHO Router
Linux as Router for a Typical Small to Medium Company
Summary
7
Medium Networks Case Studies
Medium Networks Case Studies
Example 1: A Company with Remote Locations
Example 2: A Typical Small ISP
Summary
8
Large Networks Case Studies
Large Networks Case Studies
Thinking Large, Thinking Layered Models
A Real Large Network Example
Summary
Index
Index

Packet Mangling with iptables

The term "mangling" might mislead people to conceive it as malicious—packet mangling is nothing like that at all. Packet mangling refers to the process of intentionally altering data in IP packet headers before or after the routing process.

Well, not all fields of the IP packet header can be modified in the mangle table, but that is not necessary.

Let's recall what an IP packet header looks like:

We have already discussed NAT, where we saw that we can "mangle" a packet by modifying the Source IP address and Destination IP address fields of the IP header. This mangling of packets is done only with NAT and is a part of the NAT process.

So, using the mangle table of netfilter we can modify the following two fields:

  • TOS: the 8 bit Type Of Service field

  • TTL: the 8 bit Time To Live field

iptables can also set a mark to IP packets that can be used internal by iproute2 for source routing and/or QoS with tc. This internal mark, called nfmark (netfilter mark), doesn't alter...

Previous Section
End of Section 4
Next Section