荔园在线
荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: georgehill (清风浮云 人生), 信区: Linux
标 题: 3. So What's A Packet Filter?
发信站: BBS 荔园晨风站 (Thu Oct 12 12:35:06 2000), 转信
发信人: zixia (Do you zixia tonight), 信区: Linux
标 题: 3. So What's A Packet Filter?
发信站: BBS 水木清华站 (Wed Oct 11 01:17:06 2000) WWW-POST
Linux 2.4 Packet Filtering HOWTO: So What's A Packet Filter? (p1 of
3)
3. So What's A Packet Filter?
A packet filter is a piece of software which looks at the header of
packets as they pass through, and decides the fate of the entire packet.
It might decide to DROP the packet (i.e., discard the packet as if it had
never received it), ACCEPT the packet (i.e., let the packet go through),
or something more complicated.
LinUnder Linux, packet filtering is built into the kernel (as a kernelhere a
Ma
module, or built right in), and there are a few trickier things we can do
with packets, but the general principle of looking at the headers and
deciding the fate of the packet is still there.-------------------------
3.1 Why Would I Want to Packet Filter?there a Mailing List?
Control. Security. Watchfulness.
* Thanks to Filewatcher.
Control:ks to The Samba Team and SGI.
* Thanks to Jim Pick.
when you are using a Linux box to connect your internal network
to
For the another network (say, the Internet) you have an opportunity to
allow certain types of traffic, and disallow others. For example,
------the header of a packet contains the destination address of the--
packet, so you can prevent packets going to a certain part of the
Next Preoutside network. As another example, I use Netscape to access the
Dilbert archives. There are advertisements from doubleclick.net
on
the page, and Netscape wastes my time by cheerfully downloading
them. Telling the packet filter not to allow any packets to or
from the addresses owned by doubleclick.net solves that problem
(there are better ways of doing this though: see Junkbuster).
Security:
when your Linux box is the only thing between the chaos of the
Internet and your nice, orderly network, it's nice to know you
can
restrict what comes tromping in your door. For example, you might
allow anything to go out from your network, but you might be
worried about the well-known `Ping of Death' coming in
from
LinUnder Limalicious outsiders. As another example, you might not wanthere a
Ma
mo outsiders telnetting to your Linux box, even though all your o
with pacaccounts have passwords. Maybe you want (like most people) to be
an observer on the Internet, and not a server (willing or-------
otherwise). Simply don't let anyone connect in, by having the
3.1 packet filter reject incoming packets used to set up connections.
Watchfulness:
sometimes a badly configured machine on the local network will
decide to spew packets to the outside world. It's nice to tell
the
packet filter to let you know if anything abnormal occurs;
maybeto
you can do something about it, or maybe you're just curious by
nature. ple,
tination address of the--
3.2 How Do I Packet Filter Under Linux?ackets going to a certain part of the
example, I use Netscape to access the
Linux kernels have had packet filtering since the 1.1 series. The first
on
generation, based on ipfw from BSD, was ported by Alan Cox in late 1994.
This was enhanced by Jos Vos and others for Linux 2.0; the userspace tool
`ipfwadm' controlled the kernel filtering rules. In mid-1998, for Linux
2.2, I reworked the kernel quite heavily, with the help of Michaelr).
Neuling, and introduced the userspace tool `ipchains'. Finally, the
fourth-generation tool, `iptables', and another kernel rewrite occurred
in
mid-1999 for Linux 2.4. It is this iptables which this HOWTO concentrates
on.
n
You need a kernel which has the netfilter infrastructure in it: netfilter
is a general framework inside the Linux kernel which other things (such
as
the iptables module) can plug into. This means you need kernel 2.3.15 or
beyond, and answer `Y' to CONFIG_NETFILTER in the kernel configuration.
The tool iptables talks to the kernel and tells it what packets to
filter.
Unless you are a programmer, or overly curious, this is how you will
control the packet filtering.
iptables
The iptables tool inserts and deletes rules from the kernel's packet
filtering table. This means that whatever you set up, it will be lost
upon
reboot; see Making Rules Permanent for how to make sure they are
restored
Linthe next time Linux is booted. here a
Ma
mo o
iptables is a replacement for ipfwadm and ipchains: see Using ipchains
and
ipfwadm for how to painlessly avoid using iptables if you're using one of
those tools.
3.1
Making Rules Permanent
Your current firewall setup is stored in the kernel, and thus will be
lost
on reboot. Writing iptables-save and iptables-restore is on my TODO list.
When they exist, they'll be cool, I promise.
to
Meanwhile, put the command required to set up your rules in an
initialization script. Make sure you do something intelligent if one ofe,
the commands should fail (usually `exec /sbin/sulogin').address of the--
ackets going to a certain part of the
----------------------------------------------------------------------e
on
Next Previous Contents
--
带着一丝阳光、一缕微风，
还有我的理想，
开始我的旅途。
※ 来源:·BBS 荔园晨风站 bbs.szu.edu.cn·[FROM: 192.168.1.115]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接：深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店