The term firewall comes from automobile mechanics; cars include something called a firewall to prevent fires and explosions in the engine from easily reaching the inside of the car, where they can hurt people.
In the same way, a network firewall prevents computers on the internet (where virtual fires, explosions and breakdowns are common) from reaching computers on your local network, where they can do damage.
Your NetWinder uses the advanced Linux kernel for its firewall features. The Linux firewall is very powerful, and has a wide variety of options that allow you to restrict outsiders from getting in or insiders from getting out. You can limit people's access based on their computer's address, or based on particular services (such as e-mail or the web).
WARNING |
Because the Linux firewall is so powerful, it can be difficult and confusing to configure. You can also easily lock out your workstation from the web-based configuration; if you do that, you will need to attach a keyboard and monitor to your NetWinder to repair the problem. See the chapter called Recovering from Emergencies if this happens. Because of these problems, you should avoid changing your NetWinder's firewall unless you have a good reason. The default settings are sufficiently secure for most sites. |
When you click Firewall from the Network configuration page, you will see a page that looks like this:
Before we actually make any firewall settings, let's look at some background information.
The Linux firewall included in your NetWinder uses a three-stage process to decide whether or not a network packet will be allowed to pass through the firewall. Each of these stages is called a "chain."
The three firewall chains are as follows:
Input firewall. When any packet first arrives at your NetWinder, it passes through the Input firewall. By restricting connections at this level, you can prevent users from accessing particular services on your NetWinder, or throw away packets that are clearly "spoofed" (such as 192.168.x.x packets coming from the internet).
Usually, if you want to block a connection, the In-put firewall is the place to do it, because it throws the connection away before it has a chance to reach any other parts of the NetWinder.
Requests generated from the NetWinder itself do not pass through the Input firewall; however, they do pass through the Output firewall. On the other hand, responses to the NetWinder's requests will pass through the Input firewall on the way back, which is usually enough to block them.
Forward firewall. When the Netwinder is acting as a router (that is, you have said Yes to Packet Forwarding in the Ethernet Settings), you can choose who is allowed to route through your NetWinder using the Forward firewall.
For example, you can say that users on the local network are allowed to use your NetWinder to reach the web server port on remote internet sites, but no other services; or, you can block access to certain sites altogether.
The Forward firewall also allows you to configure a feature called IP Masquerading (also known as NAT, or Network Address Translation) for particu-lar sites. For example, you can specify that all hosts on your local network can access the internet through your NetWinder, but that they will all appear to have the NetWinder's IP address. This allows you to share a single modem connection between all the computers on your network, for example. It also increases security. This feature is en-abled by default on the NetWinder OfficeServer.
Usually, the forwarding rules are fairly simple: you want to enable masquerading for local sites, and not for outside sites. To block individual connections, you'll usually use the Input firewall.
If your NetWinder is not acting as a router, the Forward firewall is not used.
Output firewall. Before the NetWinder sends out any network packets, no matter where they came from, it checks them against the Output firewall. This can be used to block messages from your NetWinder from going to undesired places, or to prevent NetWinder from contacting certain other hosts on the internet by accident.
The Output firewall chain is usually left empty, because almost all firewall work can be easily done with the Input and Forward firewalls.
The next thing to learn about firewalls is the four different policies that you can apply when forming firewall rules.
Each firewall chain consists of a sequence of rules, evaluated from top to bottom, that match different kinds of network packets. Each rule has a policy that specifies how the firewall should treat a packet that matches this rule. If none of the rules matches a particular packet, the default policy will be applied instead.
There are three policies that can be applied in any of the three chains (input, output and forwarding)::
Most people consider using the Deny policy rude. However, if you deny all types of connections except the ones you really want, your NetWinder will look almost completely invisible to the internet, which may discourage people from trying to break in. On the other hand, this can be very confusing to technicians who are legitimately trying to resolve network problems. Unless you have a good reason, you should avoid using the Deny policy.
When a forwarded packet matches a Masq rule, your NetWinder will perform a 'magical' operation that relabels the connection as if it were originating at the NetWinder. As far as the remote side is concerned, the NetWinder is making a request. When the response comes back, it will be automatically relabelled again, so that the original requester isn't aware that anything special has happened.
This is useful for three reasons:
However, with masquerading, you can use this single address for every computer on your local network, so that each computer can access the internet through the same modem connection at the same time. Because your NetWinder does its magic, you don't need any special support from your ISP.
However, that technique caused trouble: usually, the addresses that you obtained were owned by your particular ISP, so switching from one ISP to another was a painful experience. Also, there are only a limited number of IP addresses on the internet, so it can be difficult to find enough addresses in a single set for your entire organization.
Masquerading allows you to use whatever addresses you want on your local network, without negotiating with your ISP. Your ISP assigns your NetWinder only one address, which the NetWinder discovers automatically when the modem connects.
If you use masquerading, outsiders will never see the addresses of your local workstations; they only see the address of the NetWinder itself.
If masquerading is configured correctly, an outsider will first need to break into your NetWinder before even beginning to attack other computers on your network.
As with the other Forward firewall rules, masquerading doesn't work unless you have enabled Packet forwarding under Ethernet Settings.
WARNING |
If you are not an advanced user, we suggest leaving the firewall settings as they are. The default settings ensure sufficient security. By creating firewall rules, you have the ability to block access from your own computer to the web-based configuration. If you do that, the only way to recover is to attach a keyboard and monitor to your NetWinder, and fix it from the console. |
If you click the words Add a new rule under any of the three firewall chains, you'll see a screen that looks like this:
The options are as follows:
Policy. This defines how a packet will be handled if it matches this rule. We described the different policies above, in the sections called Standard Firewall Policies and The Masquerading Policy.
Source IP address. If a packet does not come from this address, it will not match the rule. Leave this blank if you want to match packets from any address.
Source netmask. The source IP address can refer to an entire IP subnetwork. For example, if the source address is 192.168.42.0 and the subnet is 255.255.255.0, then the rule will match packets from any computer on the 192.168.42.x network. If you leave the source IP address blank, you should leave this entry blank as well. If you supply the source IP address and leave the netmask blank, only the exact address that you specify will be matched; not a whole network of addresses.
Source ports. If a packet does not come from this range of ports, it will not match the rule. You can specify either a single port number (e.g. 80) or a range (e.g. 1:1024). If you leave this blank, any port number will match. If you specify the port number you must use either TCP or UDP in the Protocol field below.
Destination address/netmask/ports. These work like the Source address, netmask, and ports, except they match the packet's target instead of its source.
Protocol. This is one of TCP, UDP, ICMP, IGMP, GGP, PUP, IDP, Raw, or All.
Interface. You can use this to specify that only packets arriving (or, for the Output firewall, departing) on a particular network interface will match. This is often more reliable than specifying only the source or destination address. For example, you can choose to allow forwarding from eth1 to eth0, rather than entering subnet addresses.
Click the Save button when you have finished entering the above information. After you finish making changes, you can choose to make them permanent. A screen summarizing your changes will appear and ask you to confirm them. This is your last chance to abort the changes, which may accidentally cause your workstation to be blocked from the NetWinder. Once you confirm the changes, the new firewall rules will be activated.