Novell LINUX ENTERPRISE DESKTOP 10 SP2 - DEPLOYMENT GUIDE 08-05-2008 Deployment Manual page 753

External Zone
Given that there is no way to control what is happening on the external network,
the host needs to be protected from it. In most cases, the external network is the
Internet, but it could be another insecure network, such as a WLAN.
Internal Zone
This refers to the private network, in most cases the LAN. If the hosts on this net-
work use IP addresses from the private range (see
Routing" (page 599)), enable network address translation (NAT), so hosts on the
internal network can access the external one.
Demilitarized Zone (DMZ)
While hosts located in this zone can be reached both from the external and the in-
ternal network, they cannot access the internal network themselves. This setup can
be used to put an additional line of defense in front of the internal network, because
the DMZ systems are isolated from the internal network.
Any kind of network traffic not explicitly allowed by the filtering rule set is suppressed
by iptables. Therefore, each of the interfaces with incoming traffic must be placed into
one of the three zones. For each of the zones, define the services or protocols allowed.
The rule set is only applied to packets originating from remote hosts. Locally generated
packets are not captured by the firewall.
The configuration can be performed with YaST (see
Firewall with YaST"
sysconfig/SuSEfirewall2, which is well commented. Additionally, a number
of example scenarios are available in /usr/share/doc/packages/
SuSEfirewall2/EXAMPLES.
39.4.1 Configuring the Firewall with YaST
IMPORTANT: Automatic Firewall Configuration
After the installation, YaST automatically starts a firewall on all configured in-
terfaces. If a server is configured and activated on the system, YaST can modify
the automatically-generated firewall configuration with the options Open Ports
on Selected Interface in Firewall or Open Ports on Firewall in the server configu-
ration modules. Some server module dialogs include a Firewall Details button
(page 737)). It can also be made manually in the file /etc/
Section 30.1.2, "Netmasks and
Section 39.4.1, "Configuring the
Masquerading and Firewalls 737