Firewalling Basics - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

As a consequence of all this, you might experience some problems with a number of
application protocols, such as ICQ, cucme, IRC (DCC, CTCP), and FTP (in PORT
mode). Web browsers, the standard FTP program, and many other programs use the
PASV mode. This passive mode is much less problematic as far as packet filtering and
masquerading are concerned.

15.3 Firewalling Basics

Firewall is probably the term most widely used to describe a mechanism that provides
and manages a link between networks while also controlling the data flow between
them. Strictly speaking, the mechanism described in this section is called a packet filter.
A packet filter regulates the data flow according to certain criteria, such as protocols,
ports, and IP addresses. This allows you to block packets that, according to their ad-
dresses, are not supposed to reach your network. To allow public access to your Web
server, for example, explicitly open the corresponding port. However, a packet filter
does not scan the contents of packets with legitimate addresses, such as those directed
to your Web server. For example, if incoming packets were intended to compromise a
CGI program on your Web server, the packet filter would still let them through.
A more effective but more complex mechanism is the combination of several types of
systems, such as a packet filter interacting with an application gateway or proxy. In
this case, the packet filter rejects any packets destined for disabled ports. Only packets
directed to the application gateway are accepted. This gateway or proxy pretends to be
the actual client of the server. In a sense, such a proxy could be considered a masquerad-
ing host on the protocol level used by the application. One example for such a proxy
is Squid, an HTTP proxy server. To use Squid, the browser must be configured to
communicate via the proxy. Any HTTP pages requested are served from the proxy
cache and pages not found in the cache are fetched from the Internet by the proxy. As
another example, the SUSE proxy suite (proxy-suite) provides a proxy for the FTP
protocol.
The following section focuses on the packet filter that comes with SUSE Linux Enter-
prise Desktop. For further information about packet filtering and firewalling, read the
Firewall HOWTO included in the howto package. If this package is installed, read the
HOWTO with
less /usr/share/doc/howto/en/txt/Firewall-HOWTO.gz
Masquerading and Firewalls 135