To build a Linux IP firewall, it is necessary to have a kernel built
with IP firewall support and the appropriate configuration utility. In
all production kernels prior to the 2.2 series, you would use the
ipfwadm utility. The 2.2.x kernels marked the
release of the third generation of IP firewall for Linux called
IP Chains. IP chains use a program similar to
ipfwadm called ipchains. Linux
kernels 2.3.15 and later support the fourth generation of Linux IP
firewall called netfilter. The
netfilter code is the result of a large redesign
of the packet handling flow in Linux. The
netfilter is a multifaceted creature, providing
direct backward-compatible support for both ipfwadm
and ipchains as well as a new alternative command
called iptables. We'll talk about the differences
between the three in the next few sections.
The Linux kernel must be configured to support IP firewalling. There
isn't much more to it than selecting the appropriate options when
performing a make menuconfig of your
kernel.[1]
We described how to do this is in
Chapter 3”.
In 2.2 kernels you should select the following options:
Networking options --->
[*] Network firewalls
[*] TCP/IP networking
[*] IP: firewalling
[*] IP: firewall packet logging |
In kernels 2.4.0 and later you should select this option instead:
Networking options --->
[*] Network packet filtering (replaces ipchains)
IP: Netfilter Configuration --->
.
<M> Userspace queueing via NETLINK (EXPERIMENTAL)
<M> IP tables support (required for filtering/masq/NAT)
<M> limit match support
<M> MAC address match support
<M> netfilter MARK match support
<M> Multiple port match support
<M> TOS match support
<M> Connection state match support
<M> Unclean match support (EXPERIMENTAL)
<M> Owner match support (EXPERIMENTAL)
<M> Packet filtering
<M> REJECT target support
<M> MIRROR target support (EXPERIMENTAL)
.
<M> Packet mangling
<M> TOS target support
<M> MARK target support
<M> LOG target support
<M> ipchains (2.2-style) support
<M> ipfwadm (2.0-style) support
|
The ipfwadm (IP Firewall Administration) utility is the
tool used to build the firewall rules for all kernels prior to 2.2.0. Its
command syntax can be very confusing because it can do such a complicated
range of things, but we'll provide some common examples that will illustrate
the most important variations of these.
The ipfwadm utility is included in most
modern Linux distributions, but perhaps not by default. There may be a
specific software package for it that you have to install. If your
distribution does not include it, you can obtain the source package from
ftp.xos.nl in the
/pub/linux/ipfwadm/ directory, and compile it yourself.
Just as for the ipfwadm utility, the
ipchains utility can be somewhat baffling to use at first.
It provides all of the flexibility of ipfwadm with a
simplified command syntax, and additionally provides a “chaining” mechanism that allows you to manage multiple
rulesets and link them together. We'll cover rule chaining in a separate
section near the end of the chapter, because for most situations it is an
advanced concept.
The ipchains command appears in most Linux
distributions based on the 2.2 kernels. If you want to compile it
yourself, you can find the source package from its developer's site at
https://www.rustcorp.com/linux/ipchains/.
Included in the source package is a wrapper script called
ipfwadm-wrapper that mimics the
ipfwadm command, but actually invokes the
ipchains command. Migration of an existing firewall
configuration is much more painless with this addition.
The syntax of the iptables utility is quite similar to that
of the ipchains syntax. The changes are improvements and a
result of the tool being redesigned to be extensible through shared libraries.
Just as for ipchains, we'll present
iptables equivalents of the examples so you can compare
and contrast its syntax with the others.
The iptables utility is included in the
netfilter source package available at
https://www.samba.org/netfilter/. It will
also be included in any Linux distribution based on the 2.4 series kernels.
We'll talk a bit about netfilter's huge step forward in a section of its own later in this chapter.
