Tham khảo tài liệu 'wiley publishing suse linux 9 bible phần 9', ngoại ngữ, ngữ pháp tiếng anh phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | 482 Part IV Implementing Network Services in SUSE Linux The Linux firewalling as we said is packet filter-based. A packet filter will act upon a network packet dealing with the parameters that can be queried in the TCP IP headers. For example you can produce a rule that takes into consideration the source of the packet the source IP address the destination destination IP address the protocol for example TCP the port SSH and the TCP options SYN . Taking all of these into consideration you can define a rule that describes a very specific scenario for a network connection. Putting numerous rules together you can produce a very powerful firewall. With the introduction of i ptables we were given the godsend that was stateful firewalls. i ptables is something that most Linux administrators should know especially when you need to secure your network or individual machines from a network attack. They are relatively simple to use and extremely powerful when done correctly. All kudos to Rusty Russell the lead iptables developer for implementing this feature as it allowed us to produce tight firewalls with fewer rules. We will talk about stateful firewalls and what they do in this chapter as well as a few scenario-based iptables rules. Why Use a Firewall A firewall whether Linux-based or not should always be used to protect machines connected to the Internet. A firewall by its very nature is designed to control what can be accomplished over the network and it is very unlikely you want your 200 Windows machines to be connected to the Internet in full view of any malicious person that comes along and bare Windows machines on the Internet are like drops of blood in a 10-mile radius of a pack of sharks . Most people think that a firewall is there to stop crackers from the Internet but the fact of the matter is that your users are untrusted too. It is all well and good to trust your users when you have security checked them and have run psychoanalytical tests to see if they have a
