Baslinux mailing list

[Matrix Mole <matrixm AT sdf.lonestar.org>]

On Mon, 7 Jun 2004, James Miller wrote:

> Let us know how you get along with both these projects: I'd like to know
> if ppp does what you need and works more predictably than diald.  It would
> also be interesting to know what you end up using for a firewall.

Well, I took a look at the Linux-FIREWALL-How-To and it does a pretty good 
job of describing the way to setup Linux as a firewall system. From what 
I've read in it, Linux can be used as a firewall almost out of the box. 
You may ahve to recompile kernel (for ip-forwarding/ipMasqueradeing) but 
that type of stuff is still in my "Need to learn" category still.

Essentially though, (very basic breakdown coming here): You set up your 
network so that all traffic goes into the linux box. Then, the linux box 
is setup to not allow any traffic to go out to the internet. The linux box 
has two seperate IP addresses, one for inside the network (192.168.0.5 for 
example) and then the one for the internet (63.64.296.124 for example). If 
you have ipforwarding on, then anypacket that is suppsoed to go out to the 
internet, will instead be sent to the linux box, who will then forward it 
to the internet properly (this is my understanding of the concept at 
least, basically Linux with ipforwarding operates identical to Windows 
ICS). I may be totally off here, it seems more like I'm describing NAT as 
opposed to firewalling, since theres really nothing to do with port 
blocking at all in this setup. Anyway, if you want ot prevent internet 
traffic from getting to the local side of the linux box, then you have 
ipforwarding turned off, and install a proxy server on linux. So, I 
opbviouslly have a lot to learn still, but from this basic setup, if you 
have any server daemons running on the linux box, they would be wide open 
to the internet as well as your local network (telnet, ftp, etc). This 
doesn't seem like a very secure setup to try and use BL for without 
installing the shdadow.tgz package. So, I still have a lot to read, if for 
nothing else than the secure methods of blocking out and controlling the 
what data is allowed to connect to the linux box on what ports.

Just what I've learned so far. The Firewall How To can be found at 
tldp.org/docs.html along with quite a bit else obviously.

--
Matrix Mole
matrixm AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org
Running BasicLinux error free since May 15, 2004