38.3 Firewalling Basics
Firewall is probably the term most widely used to
describe a mechanism that provides and manages a link between networks while
also controlling the data flow between them. Strictly speaking, the mechanism
described in this section is called a packet filter. A
packet filter regulates the data flow according to certain criteria, such as
protocols, ports, and IP addresses. This allows you to block packets that,
according to their addresses, are not supposed to reach your
network.
To allow public access to your Web server, for example,
explicitly open the corresponding port. However, a packet filter does not
scan the contents of packets with legitimate addresses, such as those
directed to your Web server. For example, if incoming packets were
intended to compromise a CGI program on your Web server, the packet filter
would still let them through.
A more effective but more complex mechanism is the combination of several
types of systems, such as a packet filter interacting with an application
gateway or proxy. In this case, the packet filter rejects any packets
destined for disabled ports. Only packets directed to the application gateway
are accepted. This gateway or proxy pretends to be the actual client of the
server. In a sense, such a proxy could be considered a masquerading host on
the protocol level used by the application. One example for such a proxy is
Squid, an HTTP proxy server. To use
Squid, the browser must be configured to
communicate via the proxy. Any HTTP pages requested are served from the
proxy cache and pages not found in the cache are fetched from the Internet by
the proxy. As another example, the SUSE
proxy-suite (proxy-suite) provides a proxy for the FTP
protocol.
The following section focuses on the packet filter that comes with
SUSE Linux Enterprise. For further information about packet filtering and firewalling,
read the Firewall HOWTO included in the howto
package. If this package is installed, read the HOWTO with
less /usr/share/doc/howto/en/txt/Firewall-HOWTO.gz.