1 / 13

Linux firewalls

Linux firewalls. Massimo Ianigro - CNR Area di Ricerca - Bari Massimo.Ianigro@area.ba.cnr.it. Introduzione ai firewalls. Esistono diverse tipologie di firewalls: Filtering firewalls: livello ‘network/transport’ Proxy servers: livello ‘application’ Application gateway (es. SQUID)

dean
Download Presentation

Linux firewalls

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Linux firewalls Massimo Ianigro - CNR Area di Ricerca - Bari Massimo.Ianigro@area.ba.cnr.it

  2. Introduzione ai firewalls Esistono diverse tipologie di firewalls: • Filtering firewalls: livello ‘network/transport’ • Proxy servers: livello ‘application’ • Application gateway (es. SQUID) • Socks proxy

  3. I meccanismi di packet filtering Application layer (server applicativi) Firewall TCP/UDP source/destination ports TCP connection state flags IP ICMP control codes Transport layer (TCP/UDP) Network layer (IP, ICMP) Data link layer (frame Ethernet,..) Physical layer

  4. Architetture tipiche Rete privata DMZ

  5. Utilizzare Linux • Pro: • free, sorgenti disponibili • Contro: • free, sorgenti disponibili

  6. Packet filtering in linux • IPFWADM: kernel v. 2.1.101 e antecedenti • IPCHAINS: kernel v. 2.1.102 e successive • NetFilter: kernel v. 2.3x e seguenti • ...

  7. IPchains Meccanismo di filtering basato sul concetto di ‘chains’: Input, Forward, Output Pacchetto IP ?????????…. Forward Input 10001011…. Output Esempio: ipchains -A input -p tcp -s 0/0 -d 194.119.200.100/32 www -j ACCEPT -l

  8. Ipchains (2) Supporta la funzionalità di ‘masquerading’ (per alcuni protocolli richiede moduli specifici nel kernel: irc, real-audio,…) Indirizzo IP del firewall: 194.119.200.2 LAN interna Rete esterna Pacchetto IP Forward Input 192.168.1.x…. 194.119.200.2 …. Output ipchains -A forward -s 192.168.1.0/24 -d 0/0 -j MASQ

  9. Ipchains (3) E’ opportuno adottare oltre alle regole di filtering anche altri accorgimenti. Esempio: abilitare l’IP forwarding & defragment echo “1” > /proc/sys/net/ipv4/ip_forward echo “1” > /proc/sys/net/ipv4/ip_always_defrag

  10. Ipchains (4) • Esistono strumenti per semplificare la definizione delle regole: • gfcc • firewall-config • fbuilder (lite) • FWctl

  11. Proxy servers • Applicazioni separate per ogni servizio per il quale si offre il servizio di proxy. Esempio: • SQUID (WWW) • BNC (IRC) • … • Agiscono a livello ‘application’

  12. Altri accorgimenti • Rimuovere i vari servizi da /etc/(x)inetd.conf • Abilitare l’accesso via SSH • Prevedere eventualmente servizi dedicati solo per le macchine delle reti interne (es. DNS) • Logging remoto • …

  13. Link utili • HOW-Tos: www.linuxdoc.org • Linux IPCHAINS-HOWTO • Linux IP Masquerade HOWTO • Firewall and Proxy Server HOWTO • Tools per la configurazione di ipchains: www.linux.org (security/admin/firewalls)

More Related