Đang chuẩn bị liên kết để tải về tài liệu:
Lecture notes on Computer and network security: Lecture 18 - Avinash Kak

Lecture 18, packet filtering firewalls (Linux). The goals of this chapter are: Packet-filtering vs. proxy-server firewalls; the four iptables supported by the Linux kernel: filter, nat, mangle, and raw; creating and installing new firewall rules; structure of the filter table, connection tracking and extension modules, designing your own filtering firewall. | Lecture 18: Packet Filtering Firewalls (Linux) Lecture Notes on “Computer and Network Security” by Avi Kak (kak@purdue.edu) March 23, 2016 12:02 Noon c 2016 Avinash Kak, Purdue University Goals: • Packet-filtering vs. proxy-server firewalls • The four iptables supported by the Linux kernel: filter, nat, mangle, and raw • Creating and installing new firewall rules • Structure of the filter table • Connection tracking and extension modules • Designing your own filtering firewall CONTENTS Section Title Page 18.1 Firewalls in General 3 18.2 A “Demo” to Motivate You to Use Iptables 6 18.3 The Four Tables Maintained by the Linux Kernel for Packet Processing 14 18.4 How Packets are Processed by the filter Table 17 18.5 To See if iptables is Installed and Running 20 18.6 Structure of the filter Table 23 18.7 Structure of the nat Table 31 18.8 Structure of the mangle Table 34 18.9 Structure of the raw Table 36 18.10 What about the fact that the different tables contain similarly named chains? 37 18.11 How the Tables are Actually Created 39 18.12 Connection Tracking by iptables and the Extension Modules 47 18.13 Using iptables for Port Forwarding 52 18.14 Using Logging with iptables 54 18.15 Saving and Restoring Your Firewall 56 18.16 A Case Study: Designing iptables for a New LAN 61 18.17 Homework Problems 65 2 Computer and Network Security by Avi Kak Lecture 18 18.1: FIREWALLS IN GENERAL • Two primary types of firewalls are – packet filtering firewalls – proxy-server firewalls Sometimes both are employed to protect a network. A single computer may serve both roles. • A proxy-server firewall handles various network services itself rather then passing them straight through. What exactly that means will be explained in the lecture on proxy server firewalls. • Packet filtering firewalls, on the other hand, take advantage of the fact that direct support for TCP/IP is built into the kernels of all major operating systems now. When a