34 Protecting Yourself

with a Firewall

Technique

Save Time By

Installing an intruderproof firewall

Preserving network resources and limiting exposure to nasty viruses by limiting Internet access

Keeping a tight firewall but allowing SSH access

Agood firewall is important to any network because it’s your first line of defense against intruders. Obviously, if your system has no contact with the outside world (either via the Web or by modem),

you don’t need a firewall. If your system does have contact with the Web, you should consider screening what comes through your network interfaces.

Network information travels in packets — groups of data that are encased in layers of envelopes. Each layer of the packet contains a different kind of information about the data within the packet. The outermost layer contains information about the hardware that the packet is coming from. The next layer within contains the IP address for the source and the destination. Inside that envelope is the TCP information — the port numbers and sequence numbers of both the source and destination machines. At the heart of the packet is the packet payload — the real data that you’re interested in.

A good firewall can filter the incoming or outgoing packets based on the information contained in any of the envelope layers. Because the envelopes are nested within one another, if you toss the outer envelope, the inner envelopes go with it, and the data never reaches your application.

In this technique, we show you ways to set up a firewall that’s tight enough to protect your system, but loose enough to allow useful data in and out. You’ll save time with a safer system that gives everyone the access they need to get their jobs done.

Finding Your Firewall

Starting with kernel version 2.4, most Linux distributions include a sophisticated packet filtering package called netfilter. You can use netfilter to build firewalls, perform network address translation (NAT), perform port translation, and alter network packets as they traverse your

230 Technique 34: Protecting Yourself with a Firewall

system. netfilter is part of the Linux kernel — you can configure netfilter with the iptables command. Notice that we said that you can configure netfilter with the iptables command, not that you should. Creating a firewall by typing in a bunch of iptables commands is something best left to the propeller heads.

Instead, you should use a firewall builder. A firewall builder is a tool that (usually) asks you a series of questions about how you use your computer and then runs a sequence of iptables commands on your behalf. A good firewall builder will store your choices in a set of one or more configuration files and then arrange for the corresponding iptables commands to execute each time you boot your computer.

You can find a variety of firewall builders on the Web. Some are designed to create a simple firewall as quickly as possible; others are less friendly, but give you more control over the security of your system. SuSE, Mandrake, and Fedora each come with a firewall builder (and they’re all different).

Setting up a simple firewall in Mandrake Linux

In keeping with Mandrake’s reputation for simplicity, drakfirewall (the Mandrake firewall builder) makes it very easy to configure a simple firewall. To run the Mandrake firewall builder, follow these steps:

1. Open the main menu and choose System Configuration Configure your computer.

The Mandrake Control Center opens.

2. Choose Security Firewall.

The drakfirewall configuration editor opens, as shown in Figure 34-1.

3. Use the check boxes to configure your firewall.

Start out by clearing each check box — that will lock your system down so that outsiders can’t get through your firewall. Then, check each

service that you want to provide to the outside world. For example, if you want to log in to your computer from another system, select the SSH Server check box. If you’re running an Apache Web server, select the Web Server check box.

• Figure 34-1: The Mandrake Firewall Builder.

If you need to temporarily disable your firewall, select the Everything (No Firewall) check box — drakfirewall is kind enough to remember your original settings so that you can restore your firewall again later.

4. When you’re finished, click OK to save your changes.

When you save your changes, drakfirewall saves your choices to a set of configuration files in the /etc/shorewall directory and executes a sequence of iptables commands that configures netfilter according to your preferences.

Mandrake Linux actually uses two firewall builders, one layered atop the other. drakfirewall (the tool we just described) is a very high-level firewall builder — it’s very simple, but not very flexible. Under the hood, drakfirewall drives another firewall builder called Shorewall. You can find more information about Shorewall at www.shorewall.net.

Finding Your Firewall 231

Setting up a simple firewall in Fedora Linux

When you installed Fedora, you ran a program called system-config-security. You might not have even noticed it — it’s part of the installation script, and goes by with just a quick question or two. At installation time, it created a firewall and firewall rules for you. You may have chosen not to install a firewall at that time; if that’s the case, you have no firewall rules in place.

If you chose not to install a firewall when you installed Fedora, you can change your mind later. The same configuration tool that runs during the install procedure will create (or remove) simple firewall rules. To run Fedora’s firewall builder, follow these steps:

1. Open the Main Menu and choose System Settings Security Level.

You’re prompted for the root password.

2. Enter the root password and click OK.

If you have a terminal window open and superuser privileges, you can start the configuration tool by entering system-config- securitylevel at the command line.

The Security Level Configuration dialog opens. This dialog is similar to the firewall information window you saw at installation time.

3. From the Security Level drop-down list, select

Enable Firewall.

If you disable the firewall, any custom rules you’ve created are lost.

4. To create the most robust firewall possible, enable the firewall with no trusted services or trusted devices.

That is, deselect all the check boxes, as shown in Figure 34-2.

The best way to build a robust firewall is to disallow all traffic, and then relax the restrictions to allow data to flow. It’s easier to recognize your friends one at a time.

• Figure 34-2: A very secure firewall.

If you have multiple network cards listed in the Trusted Devices frame, you can trust devices that connect to your own network, but don’t trust the devices that connect to the outside world. That way, the devices within your network can access the machine via SSH or Telnet, but the outside world can’t get in.

5. Click the OK button to continue.

A pop-up opens, warning you that if you continue, you’ll change the existing firewall configuration.

6. Click Yes to continue.

232 Technique 34: Protecting Yourself with a Firewall

Setting up a simple firewall in SuSE Linux

The crew at SuSE have put a lot of work into their firewall builder (called SuSE Firewall2), making it powerful and easy to use. Like the Mandrake and Fedora firewall builders, SuSE Firewall2 stores your preferences in a configuration file (/etc/sysconfig/ SUSEfirewall2) and executes a series of iptables commands when you apply your changes.

To run the SuSE firewall builder, follow these steps:

1. Open the main menu and choose System YaST.

The YaST Control Center appears.

2. Click Security and Users (in the left-hand pane), and then click Firewall.

The SuSE Firewall2 window appears, as shown in Figure 34-3.

•Figure 34-3: The SuSE firewall builder (Step 1).

3.Choose your external interface from the dropdown list.

The external interface is the network interface connected to the outside world (the Internet).

4. If your computer has two network adapters,

SuSE assumes the second interface is connected to a local (internal) network — choose the internal interface from the drop-down list.

5. Click Next to move to the next step.

The Services list appears, as shown in Figure 34-4.

•Figure 34-4: The SuSE firewall builder (Step 2).

6.Use the check boxes to configure your firewall.

Start out by clearing each check box — that will lock your system down so that outsiders can’t get through your firewall. Then, select each service that you want to provide to the outside world. For example, if you want to log in to your computer from another system, select the Secure Shell (ssh) check box. If you’re running an Apache Web server, select the HTTP check box and the HTTP with SSL (https) check box.

If you need to allow other services through your firewall, click the Expert button and list the service names (or port numbers) in the text box provided.

7.Click Next to move to the next step.

The Features dialog appears (see Figure 34-5).