Table of Contents
Advertisement
All services, ports, and protocols that have been allowed are listed in this summary. To
modify the configuration, use Back. Press Accept to save your configuration.
43.4.2 Configuring Manually
The following paragraphs provide step-by-step instructions for a successful configura-
tion. Each configuration item is marked as to whether it is relevant to firewalling or
masquerading. Aspects related to the DMZ (demilitarized zone) as mentioned in the
configuration file are not covered here. They are applicable only to a more complex
network infrastructure found in larger organizations (corporate networks), which require
extensive configuration and in-depth knowledge about the subject.
First, use the YaST module System Services (Runlevel) to enable SuSEfirewall2 in
your runlevel (3 or 5 most likely). It sets the symlinks for the SuSEfirewall2_* scripts
in the /etc/init.d/rc?.d/ directories.
FW_DEV_EXT (firewall, masquerading)
The device linked to the Internet. For a modem connection, enter ppp0. For an
ISDN link, use ippp0. DSL connections use dsl0. Specify auto to use the in-
terface that corresponds to the default route.
FW_DEV_INT (firewall, masquerading)
The device linked to the internal, private network (such as eth0). Leave this blank
if there is no internal network and the firewall protects only the host on which it
runs.
FW_ROUTE (firewall, masquerading)
If you need the masquerading function, set this to yes. Your internal hosts will
not be visible to the outside, because their private network addresses (e.g.,
192.168.x.x) are ignored by Internet routers.
For a firewall without masquerading, only set this to yes if you want to allow access
to the internal network. Your internal hosts need to use officially registered IP ad-
dresses in this case. Normally, however, you should not allow access to your internal
network from the outside.
FW_MASQUERADE (masquerading)
Set this to yes if you need the masquerading function. This provides a virtually
direct connection to the Internet for the internal hosts. It is more secure to have a
824
Installation and Administration
Advertisement
Table of Contents
Troubleshooting
