Editing the Rules with Webmin 233

•Figure 34-5: The SuSE firewall builder (Step 3).

8.Select the features that you want, or simply accept the default values.

We recommend that you select the Allow Traceroute and the Protect All Running Services check boxes. If you’re sharing your external interface with other machines (in other words, if your computer is acting as a gateway for an internal network), you should also select the

Forward Traffic and Do Masquerading check box.

The text box on the left side of the window explains each option in more detail.

9.Click Next to move to the last step.

The Logging Options window appears, as shown in Figure 34-6.

10.Select the logging and debugging options that you want.

We recommend accepting the default values. After your firewall has been in place for a while and you’re satisfied that it is working properly, you can disable all firewall logging to conserve disk space.

11. Click Next, and then click Continue to save your changes and (re)start the firewall.

• Figure 34-6: The SuSE firewall builder (Step 4).

When you save your changes, SuSE Firewall2 executes a whole slew of iptables commands to tell netfilter about your choices.

Editing the Rules with Webmin

After you’ve configured your firewall with a friendly firewall builder, you may want to fine-tune netfilter to better fit your needs. If you’re running Mandrake or Fedora Linux, the graphical firewall builders don’t give you many options. SuSE Firewall2 is a bit more powerful, but it was really designed to be simple, not flexible. Relax, you don’t have to hit the command line.

The quickest and easiest way to tweak your firewall rules is with a system administration tool called Webmin. With Webmin, you can perform tasks such as configuring servers, managing users and groups, arranging backups, and scheduling cron jobs, all from within your favorite browser. If you prefer, you can use Webmin to do many of the tasks that are handled by Mandrake, SuSE, and Fedora administration tools. Many third-party modules are also available to expand on Webmin’s basic capabilities.

234 Technique 34: Protecting Yourself with a Firewall

We really like Webmin. Go to www.webmin.com when you have some free time, and check it out. Getting familiar with Webmin can be a real timesaver.

Technique 17 gives detailed instructions about downloading and installing Webmin. If you haven’t already installed Webmin, see Technique 17 for more information.

Starting a Webmin session

With Webmin installed, start a Webmin session:

1. Open a browser and go to http://localhost:10000.

Webmin opens, displaying a login window, as shown in Figure 34-7.

• Figure 34-7: The Webmin login window.

2. Enter root in the Username field, and the root password in the Password field. Click Login to continue.

Unless you trust everyone who has access to your desktop, we don’t recommend clicking the Remember Login Permanently box.

Webmin allows access to some sensitive parts of your system.

The opening window of Webmin is displayed, as shown in Figure 34-8. From this window, move from page to page by clicking the round buttons (labeled System, Servers, Networking, and so on) across the top. Each page provides tools to manage different aspects of your system.

• Figure 34-8: The Webmin main window.

Reading the rules with Webmin

You can see and manage your firewall rules from the Networking tools page in Webmin. Just click Linux Firewall.

If you’re running Fedora Linux, Webmin knows how to read the firewall rules created by Fedora’s firewall builder — any changes you make through Webmin will appear the next time you run system-configure- securitylevel.

If you’re running Mandrake Linux, Webmin will offer to convert your Shorewall configuration files to the more standard Webmin format (if you choose to convert, any changes you make through Webmin will be discarded when you switch back to the Shorewall configurator). If you prefer to keep Shorewall in place, you can use Webmin’s Shorewall Firewall module instead of the Linux Firewall module.

Editing the Rules with Webmin 235

The SuSE firewall builder stores its configuration information in a format that Webmin’s Linux Firewall module can’t directly read — to use the Linux Firewall module on a SuSE computer, click Module Config (near the top of the page) and select Directly Edit firewall rules instead of savefile. Webmin will interrogate the running kernel to discover the firewall rules you have in place. After you’ve made any necessary changes, use the iptables-save command (at the command-line) to create a savefile — see man iptables-save for more information.

In this section, we show you how to read (and modify) firewall rules as they appear in Webmin’s Linux Firewall module. We use a firewall generated by Fedora’s system-config-securitylevel as an example.

When you start the Linux Firewall module, the rules you established with the system-config-security level tool (see the section, “Setting up a simple firewall in Fedora Linux,” earlier in this technique) are shown in Figure 34-9.

The first rule set on the page displays the rules applied to incoming packets. If you’ve chosen the default setup for the firewall, the only rule in the set is to always run the chain RH-Firewall-1-INPUT (which we describe in a moment). You can add new rules to this chain with the Add Rule button or remove all the rules from the rule set with the Clear All Rules button.

The second rule set decides the fate of forwarded packets (packets routed through your computer). Again, the only action defined by default is to run the chain RH-Firewall-1-INPUT.

The third rule set displayed on the screen applies to outgoing packets. With the default firewall, no rules are applied to the outgoing packets — only incoming packets.

Near the bottom of the page, you see the rules that make up the RH-Firewall-1-INPUT chain, as shown in Figure 34-10. This chain is referred to by the

Incoming and Forwarded actions (at the top of the page). The rules in the RH-Firewall-1-INPUT chain control the flow of packets through the firewall.

• Figure 34-9: Webmin displays the firewall rules.

The Condition column lists the constraints that are placed on incoming packets, and the Action column dictates the actions taken when the conditions are met. When a network packet arrives at your computer, the firewall processes the packet using the rules in the RH-Firewall-1-INPUT chain.

Take a peek at the chain shown in Figure 34-10. The first rule states that a packet arriving at interface lo0 (which is the internal loopback interface that lets your computer talk to itself) should be accepted. As soon as a packet is accepted by the firewall, the rest of the rules are ignored.

If the packet isn’t arriving on inteface lo0, it’s coming from some other interface (like your Ethernet card) and the firewall moves on to the second rule. If the packet is an ICMP message, the firewall accepts it (ICMP is a low-level network management protocol that’s reasonably safe). The third and fourth rules accept packets belonging to protocols 50 and 51 (those are “next-generation” IPv6 network packets). The fifth rule states that incoming packets that are part of a previously established connection are okay.

236 Technique 34: Protecting Yourself with a Firewall

If a packet doesn’t satisfy any of the first five conditions, the firewall applies the final rule, which rejects all packets.

The default firewall rules are very secure — they allow just enough traffic to get through that your outbound network connections (like a Web browser) will still work.

• Figure 34-10: The chain of rules.

When a packet enters your network interface, Fedora gives the packet to each rule in the chain, in the sequence listed. Every inbound packet is evaluated according to the Condition listed in the first rule; if the packet satisfies the condition, Fedora takes the action specified in the Action column:

Do Nothing: Does nothing with the packet but continues testing with the chain

Accept: Accepts the packet into the network, ignoring the remaining rules

Drop: Destroys the packet with no relayed message to the other end of the connection

Reject: Rejects the packet, but notifies the other end of the connection

Userspace: Exports data to a userspace program that’s not part of the kernel (you can write your own filters by using Userspace rules)

Exit Chain: Exits the chain and returns to previous chain

Run Chain: Moves to another chain of rules

If a packet doesn’t meet the first condition, it’s tested against the next condition. If the packet meets that condition, it is subjected to the specified action or tested against the next rule in line. This testing continues until the packet is either accepted or rejected. By default, the last rule in the chain rejects any packets that are not accepted by earlier rules.

After you understand how the rules are set up in Webmin, you can feel free to change them. The next section explains how.

Changing the rules

Given that the default firewall rules are very secure, you may need to relax them a little to better suit your needs. For example, if you host a Web server on your computer, you may want to allow inbound traffic on TCP port 80 (the port typically used by Web browsers). If you’re hosting a Web server for internal use only (that is, you want other computers on your local network to access your server, but nobody else), you can allow inbound traffic on TCP port 80, but only if the packet originates on a nearby address.

Editing existing rules

You can change the actions taken for a condition by following these steps:

1. Start a Webmin session (see the earlier section,

“Starting a Webmin session”), click the Networking button, and then click Linux Firewall.

2. On the Linux Firewall page, scroll down to the

Action link in the table and click it.

The Edit Rule window opens, as shown in

Figure 34-11. You can change either the condition or action details for a rule from the Edit Rule window.