Table of Contents
Advertisement
As mentioned, whenever one of the LAN hosts sends a packet destined for an Internet
address, it goes to the default router. However, the router must be configured before it
can forward such packets. For security reasons, this is not enabled in a default installa-
tion. To enable it, set the variable IP_FORWARD in the file /etc/sysconfig/
sysctl to IP_FORWARD=yes.
The target host of the connection can see your router, but knows nothing about the host
in your internal network where the packets originated. This is why the technique is
called masquerading. Because of the address translation, the router is the first destination
of any reply packets. The router must identify these incoming packets and translate
their target addresses, so packets can be forwarded to the correct host in the local net-
work.
With the routing of inbound traffic depending on the masquerading table, there is no
way to open a connection to an internal host from the outside. For such a connection,
there would be no entry in the table. In addition, any connection already established
has a status entry assigned to it in the table, so the entry cannot be used by another
connection.
As a consequence of all this, you might experience some problems with a number of
application protocols, such as ICQ, cucme, IRC (DCC, CTCP), and FTP (in PORT
mode). Web browsers, the standard FTP program, and many other programs use the
PASV mode. This passive mode is much less problematic as far as packet filtering and
masquerading are concerned.
43.3 Firewalling Basics
Firewall is probably the term most widely used to describe a mechanism that provides
and manages a link between networks while also controlling the data flow between
them. Strictly speaking, the mechanism described in this section is called a packet filter.
A packet filter regulates the data flow according to certain criteria, such as protocols,
ports, and IP addresses. This allows you to block packets that, according to their ad-
dresses, are not supposed to reach your network. To allow public access to your Web
server, for example, explicitly open the corresponding port. However, a packet filter
does not scan the contents of packets with legitimate addresses, such as those directed
to your Web server. For example, if incoming packets were intended to compromise a
CGI program on your Web server, the packet filter would still let them through.
820
Installation and Administration
Advertisement
Table of Contents
Troubleshooting
