Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By : Lucian Gheorghe
Book Image

Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter

By: Lucian Gheorghe

Overview of this book

Firewalls are used to protect your network from the outside world. Using a Linux firewall, you can do a lot more than just filtering packets. This book shows you how to implement Linux firewalls and Quality of Service using practical examples from very small to very large networks. After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.
Table of Contents (14 chapters)
Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and L7-filter
Credits
About the Author
About the Reviewer
Preface
Index

Linux as Router for a Typical Small to Medium Company


In a typical small to medium business, using Linux as a router has a number of advantages, including low cost and flexibility; also, a Linux router can be used to do a lot more than just routing.

Let's analyze the following example of a typical small to medium company:

Setting Up the Router

The network above is built for a small to medium company with sales, accounting, executive, and IT departments as illustrated in the diagram.

For easy understanding of the network, we've placed three switches belonging to three separate networks, one for the sales and accounting departments, one for the executive offices, and one for the IT department. Usually, a managed switch is used in this case to create three separate VLANS.

What we have here in this network is:

  • A broadband internet connection. The provider assigned us the IP 1.1.1.1 for our router and routed the class C network 1.1.2.0/24 through our router's IP address (1.1.1.1). The modem is inserted...