Basics of firewalls
Every new Linux user will at some point start wondering about installing a firewall. Eventually everyone also runs across the concept of iptables. Early on, one might not know what iptables means, or even have heard the term. This is quite a disappointing considering how important good iptables management is to tight security in a Linux networking environment.
I’m going to assume you’ve heard of a firewall and have some vague notion of what that means in relation to computers and networking. Just in case; a firewall basically provides and enforces rules for allowing or denying network access on specific ports, from or to specific networked computers. Most Windows users, think of Windows Firewall, ZoneAlarm, Norton Firewall, or what is refferred to as a “hardware firewall”, such as the many router appliances that can be purchased from a electronics vendor.
Windows Firewall and ZoneAlarm are sometimes called “software firewalls”, are in fact little different in concept from hardware firewalls. The biggest difference between the concept is the security that each provides. Because the software firewall is on the local system, it provides a reduced security potential: by the time unauthorized traffic touches the software firewall, it has already touched the system you’re trying to protect. That doesn’t mean you shouldn’t use them, however; it’s just an extra layer of security, and used properly it can enhance the overall security of your network. You should never, ever consider it a substitute for a separate hardware firewall.
Applications like the Windows Firewall and ZoneAlarm are really pretty low quality, as firewalls go. Even ZoneAlarm Pro is not that great as a firewall. Norton Firewall is better in some ways than the above, in that it is capable of providing better security, and worse in others, in that it is difficult to configure, hides much of what it’s doing even worse than ZoneAlarm, and in general has the potential to seriously mess things up without ever giving a hint to the user aside from “Oh, it’s probably Norton again.”
Ultimately, the major problem with all of these popular software firewalls on Windows systems is that they do not operate at a low enough level to provide really significant security. There are a couple of firewall applications for Windows that do provide a more fundamental firewalling capability, making use of Windows kernel socket APIs, but the Windows OS design and driver APIs provide for potential “leakage” that even these Windows socket-layer firewalls (such as the iSafer Winsock Firewall) can be worked around by a clever security cracker, depending on the sort of hardware you’re using for network connectivity, what drivers you’re using, and so on.
Ultimately, the problem with these Windows-based firewalls is that they’re software that sits on top of the OS trying to get the OS to relinquish control of network packet control earlier than it really wants to so that the traffic can be filtered effectively.
Free UNIX firewalls
Free versions of UNIX tend to have a much better packet filtering model. Linux, for instance, has the netfilter project, which works on kernel-integrated network traffic filtering. The management system for that, which handles filtering rules for netfilter to apply and enforce, is called iptables. The OpenBSD analog to iptables, meanwhile, is called pf, and there are a number of cited advantages and disadvantages to each in comparison to the other.
In any case, it happens that iptables and pf both work extremely well as firewalling systems. While I haven’t done an exhaustive survey, I’d say that probably at least half of the little hardware firewalls you run across in retail electronics outlets are in fact running a stripped-down embedded Linux kernel with netfilter, some running iptables and some running some wacky hybrid thing that replaces iptables just to make everything work differently somehow—probably to frustrate the efforts of people who would like to have more hands-on control of how the router/firewall appliance is working behind the scenes. Regardless, if you’ve used a store-bought router/firewall appliance, there’s a reasonable chance you’ve used something running iptables for firewalling, even if you’ve never installed Linux on anything.
Because of the open, modular design of Linux (and other free versions of UNIX, for that matter), kernel-integrated network packet filtering can be easily implemented and has improved over the years. This allows for a very close marriage of the firewalling capability of such OSes with the network interface itself, providing a basically impenetrable security model, in theory.
In theory, of course, theory and practice are the same; in practice, they are not. The security you can get from this security model, in practice, depends on your ability to effectively define firewall rules and the flexibility and functionality of the filtering rules management system—in this case, iptables.
There was a predecessor to iptables called ipchains. From what I’ve seen thus far, it looks like ipchains differed from iptables mostly in that it was a little more difficult to configure and manage, and in that it was stateless, whereas iptables is stateful. That means is that iptables can actually apply firewall rules based on the current state of network traffic: rules can exist that depend upon the amount of traffic you’re receiving on a specific port, for instance, rather than simply blocking or opening that port across the board. This makes iptables much, much more useful for ensuring system security than ipchains. Interestingly enough, ZoneAlarm is also stateful in a very limited fashion, but its statefulness is largely unconfigurable and the benefits of its stateful operation can be circumvented by automated scripting, if the person writing the scripts knows what he or she is doing.
Firewalls…..have a good day!
Home
Subscribe
Feb 9, 2010 
No Comments 
Configuring Ubuntu, F.A.Q.'s, How to, How To's, Linux, Ubuntu, Ubuntu Commands, Ubuntu Firewall, Ubuntu Server, ubuntu terminal commands
