Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 04-08-2006 Installation Manual page 804

tion 44.4.1, "Configuring the Firewall with YaST"
be found in /etc/sysconfig/SuSEfirewall2. The configuration file consists
of well-documented entries. To set a transparent proxy, you must configure several
firewall options:
• Device pointing to the Internet: FW_DEV_EXT="eth1"
• Device pointing to the network: FW_DEV_INT="eth0"
Define ports and services (see /etc/services) on the firewall that are accessed
from untrusted (external) networks such as the Internet. In this example, only Web
services are offered to the outside:
FW_SERVICES_EXT_TCP="www"
Define ports or services (see /etc/services) on the firewall that are accessed from
the secure (internal) network, both via TCP and UDP:
FW_SERVICES_INT_TCP="domain www 3128"
FW_SERVICES_INT_UDP="domain"
This allows accessing Web services and Squid (whose default port is 3128). The service
"domain" stands for DNS (domain name service). This service is commonly used.
Otherwise, simply take it out of the above entries and set the following option to no:
FW_SERVICE_DNS="yes"
The most important option is option number 15:
Example 42.1 Firewall Configuration: Option 15
# 15.)
# Which accesses to services should be redirected to a local port
# on the firewall machine?
#
# This can be used to force all internal users to surf via your
# Squid proxy, or transparently redirect incoming Web traffic to
# a secure Web server.
#
# Choice: leave empty or use the following explained syntax of
# redirecting rules, separated with spaces.
# A redirecting rule consists of 1) source IP/net,
# 2) destination IP/net, 3) original destination port and
# 4) local port to redirect the traffic to, separated by a colon,
# e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080"
804 Installation and Administration
(page 834). Its configuration file can