33.3 Firewalling Basics
Firewall is probably the term most widely used to
describe a mechanism that provides and manages a link between networks
while also controlling the data flow between them. Strictly speaking, the
mechanism described in this section is called a packet
filter. A packet filter regulates the data flow according to
certain criteria, such as protocols, ports, and IP addresses. This allows
you to block packets that, according to their addresses, are not supposed
to reach your network. To allow public access to your Web server, for
example, explicitly open the corresponding port. However, a packet filter
does not scan the contents of packets with legitimate addresses, such as
those directed to your Web server. For example, if incoming packets were
intended to compromise a CGI program on your Web server, the packet
filter would still let them through.
A more effective but more complex mechanism is the combination of several
types of systems, such as a packet filter interacting with an application
gateway or proxy. In this case, the packet filter rejects any packets
destined for disabled ports. Only packets directed to the application
gateway are accepted. This gateway or proxy pretends to be the actual
client of the server. In a sense, such a proxy could be considered a
masquerading host on the protocol level used by the application. One
example for such a proxy is Squid, an HTTP proxy server. To use Squid,
the browser must be configured to communicate via the proxy. Any HTTP
pages requested are served from the proxy cache and pages not found in
the cache are fetched from the Internet by the proxy. As another example,
the SUSE proxy suite
(proxy-suite) provides a proxy
for the FTP protocol.
The following section focuses on the packet filter that comes with
openSUSE. For further information about packet filtering and
firewalling, read the Firewall HOWTO included in the
howto package. If this
package is installed, read the HOWTO with
less /usr/share/doc/howto/en/txt/Firewall-HOWTO.gz