لطفا منتظر باشید ...
7.3. What Is IP Filtering?
IP filtering is
simply a mechanism that decides which types of IP packets will be
processed normally and which will be dropped or rejected. By
dropped we mean that the packet is deleted and
completely ignored, as if it had never been received. By
rejected we mean that the firewall sends an ICMP
response to the sender indicating a reason why the packet was
rejected. You can apply many different sorts of criteria to determine
which packets you wish to filter. Some examples of these are:
- Protocol type:
TCP, UDP, ICMP, etc. - Port number (for TCP/UPD)
- Packet type: SYN/ACK, data, ICMP Echo
Request, etc. - Packet source address: where it came from
- Packet destination address: where it is going to
It is important to
understand at this point that IP filtering is a network layer
facility. This means that it doesn't understand
anything about the application using the network connections, only
about the connections themselves. For example, you may deny users
access to your internal network on the default Telnet port, but if
you rely on IP filtering alone, you can't stop them
from using the Telnet program with a port that you do allow to pass
through your firewall. You can prevent this sort of problem by using
proxy servers for each service that you allow across your firewall.
The proxy servers understand the application that they were designed
to proxy and can therefore prevent abuses, such as using the Telnet
program to get past a firewall by using the World Wide Web port. If
your firewall supports a World Wide Web proxy, outbound Telnet
connections on the HTTP port will always be answered by the proxy and
will allow only HTTP requests to pass. A large number of proxy-server
programs exist. Some are free software and many others are commercial
products. The Firewall and Proxy Server HOWTO
(available online at http://www.tldp.org/HOWTO/Firewall-HOWTOl)
discusses one popular set of these, but they are beyond the scope of
this book.The IP filtering rule set is made up of many combinations of the
criteria listed previously. For example, let's
imagine that you wanted to allow World Wide Web users within the
Virtual Brewery network to have no access to the Internet except to
use other sites' web servers. You would configure
your firewall to allow forwarding of the following:
- Packets with a source address on Virtual Brewery network, a
destination address of anywhere, and with a destination port of 80
(WWW) - Packets with a destination address of Virtual Brewery network and a
source port of 80 (WWW) from a source address of anywhere
Note that we've used two rules here. We have to
allow our data to go out, but also the corresponding reply data to
come back in. In practice, as we'll see in the
chapter on IP masquerade and Network Address Translation (Chapter 9), iptables
simplifies this and allows us to specify this in one
command.
