lkml.org 
[lkml]   [1999]   [Apr]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.2.5 kernel/routing/firewalling

On Tue, 13 Apr 1999, T. S. Horsnell wrote:

> Date: Tue, 13 Apr 1999 14:47:06 +0100 (BST)
> From: T. S. Horsnell <tsh@mrc-lmb.cam.ac.uk>
> To: kernel <linux-kernel@vger.rutgers.edu>
> Subject: 2.2.5 kernel/routing/firewalling
>
> I'm hoping to set up a linux/ipchains firewall on a dedicated
> machine (no proxy/masquerading etc) but I dont want this
> machine to have to be my default router. My lab is on a
> branch of a campus ethernet which provides routing to the
> internet and all I want to do is apply filters to the stuff between
> my lab and the campus, see diag.

I'm not quite sure if bridging works with ipchains. If you want to
establish transparent application proxies instead of packet filtering
alone then there is no way to design the box as a routing firewall, not a
bridging firewall.
In that case the firewall has to be the default router for your lab
LAN. If your lab is large (> 20 PCs) then it would be a good decision to
establish DCHP for the lab (look at ISCs web site) at the time you change
the route. Furthermore the firewall has to get the static routes and the
router(s) of the uni campus has/have to get a new route to your lab.

The other way to work with (even I haven't done that) is to route
the traffic from eth0 to tap0 and from eth1 to tap1 and to deal with
ethertap devices. Then you can establish a stateful inspection of packets.
But be warned - that's very hard work and academic merites to get.

If you succeed with a bridging firewall, please let me know.
That's a very interesting special case.

I know that NAI (former McAfee) had/has(?) a solution named WebShield,
based on a Linux 2.0.33 kernel with bridging interfaces. But they didn't
do packet filtering, they filtered HTTP, FTP and SMTP. At CeBIT'99 I heard
from a NAI rep. that this project had been cancelled.

Regards

Frank

Dipl.-Inform. Frank Bernard phone : +49 69 477169
Ellerstr. 11 fax : +49 69 47885616
60389 Frankfurt handy : +49 179 6900088
Germany email : frankb@ipf.de
www : http://www.linux-firewall.de
>
>
> Uni Campus
> (Class B) __________
> ------------------------|----------| My f/wall|-------My lab ethernet
> | (part of uni class B)
> -----------------
> | Uni routers |
> | which are also |
> | my default rtrs|
>
> My proposed firewall box has a pair of ethernet adapters, but how do I get
> traffic to be transferred from one to the other (after passing the
> ipchains filter checks) without involving routing?
> I have seen a suggestion (HOWTO/mini/Bridge) to turn the f/w machine
> into a bridge (compile a kernel with BRIDGING enabled) and then
> put both adapters into promiscuous mode. Will this do the trick?
> At what point in the networking does the firewall filtering get
> applied. Is it to every packet as it comes in/goes out of the
> ethernet adapters or is it during the routing process?
> I've looked at many HOW-TO's, the O'Reilly 'Linux device-driver' book
> and the 2.2.5 source, but I cant get a feel for the way the
> components of the networking code interact, and so I dont know whether
> what I want to do is even possible.
> Also, I just read in the LRP FAQ that the 3Com Vortex and Boomerang cards
> are bad news. Of course, I have one of each in my proposed system...
>
>
> TIA
> Terry.
>
>
>
> Terry Horsnell (tsh@mrc-lmb.cam.ac.uk)
> Computer Manager
> Medical Research Council
> Lab of Molecular Biology
> Hills Road
> CAMBRIDGE CB2 2QH
> U.K.
>
>
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.066 / U:1.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site