Firewall
From DD-WRT Wiki
Revision as of 17:36, 16 May 2010 (edit) Glenn (Talk | contribs) (→NAT - Network address Translation - corr) ← Previous diff |
Revision as of 17:37, 16 May 2010 (edit) (undo) Glenn (Talk | contribs) (→NAT - Network address Translation - +heading) Next diff → |
||
Line 20: | Line 20: | ||
Due to IPv4 address shortage, the internet society began to use NAT, and therefore the firewall also need to be NAT aware. | Due to IPv4 address shortage, the internet society began to use NAT, and therefore the firewall also need to be NAT aware. | ||
+ | ====NAT incompatible protocols==== | ||
A real problem with NAT is when more than one inside clients (e.g. C1, C2) connect to the same outside server ip address (S) and the traffic is not tcp and udp. When an outside packet arrive at the NAT device it can not deduce which client to send it to. Here are examples of protocols that has problem: | A real problem with NAT is when more than one inside clients (e.g. C1, C2) connect to the same outside server ip address (S) and the traffic is not tcp and udp. When an outside packet arrive at the NAT device it can not deduce which client to send it to. Here are examples of protocols that has problem: | ||
*[[wikipedia:IPsec|IPsec]] (over [[wikipedia:List_of_IP_protocol_numbers|IP protocol]] 51) | *[[wikipedia:IPsec|IPsec]] (over [[wikipedia:List_of_IP_protocol_numbers|IP protocol]] 51) |
Revision as of 17:37, 16 May 2010
The purpose of the firewall is to moderate traffic and/or log it. Most firewall are made for moderating ip traffic and are called ip firewalls.
The simplest ip firewall has two physical interfaces normally referred to as inside (LAN) and outside (WAN, the internet). It has two main access control lists e.g. named inside2outside and outside2inside.
Contents |
Packet filter firewall
The simplest ip firewall - a packet filter firewall - can pass packet by packet or drop them based on:
- source ip address
- destination ip address
- If tcp or udp:
- source tcp/udp port
- destination tcp/udp port
Statefull firewall
The better ip firewall - a statefull firewall - can pass packet by packet - and if possible (e.g. tcp and údp) track the connection. A statefull firewall can additionally moderate trackable traffic by:
- number of connections per (src/dst) ip address
- number of connections per interface
- number of connections attempt - "SYN"-attacks, packet storms
NAT - Network address Translation
Due to IPv4 address shortage, the internet society began to use NAT, and therefore the firewall also need to be NAT aware.
NAT incompatible protocols
A real problem with NAT is when more than one inside clients (e.g. C1, C2) connect to the same outside server ip address (S) and the traffic is not tcp and udp. When an outside packet arrive at the NAT device it can not deduce which client to send it to. Here are examples of protocols that has problem:
- IPsec (over IP protocol 51)
- PPTP (over IP protocol 47)
- L2TP (over IP protocol 50)
Even if the traffic is unencrypted it can not be deduced where to NAT an incoming outside packet if more than one inside client uses the same protocol to the same outside ip address. UDP and TCP are special because they have 65536 possible src and dst ports that can help tracking.
Difficult protocols
Some protocols can port jump and create connections one or both ways "at will". A firewall that can moderate that kind of traffic, need to inspect the traffic stream. To do that a firewall must have proxies.
Some examples of protocols that can port jump and create additional connections are:
- FTP
- Media streams (Media Player, iTunes...):
- RTSP
- Realmedia
- Conferencing
- VoIP, IP telephony:
- H323
- SIP
- Some gaming protocols
DD-WRT
Your network device typically has more than two interfaces. DD-WRT has a statefull firewall, NAT, proxy functionality via netfilter with among others iptables.
The default internal device network has two networks (non-802.11n example!):
- vlan0(built-in hardware switch) software-bridged with eth1(wireless access point) - LAN private ip subnet 192.168.1.0/24 and ip configurations are leased out by a DHCP server.
- vlan1 - WAN with some ip address normally acquired via a DHCP client.
There is a default ip firewall with NAT between vlan0 and vlan1 on non-802.11n network devices.
See also
- DD-WRT Firewall Example
- iptables commands (written for DD-WRT)
External links
- Firewall Generic and short: Purpose and processes.
- sns.ias.edu: Iptables
- IPTABLES - An Overview
- Kernel space structure - simple packet journey through kernel - Please note that the left and right upper red arrows together, is the input and output of your router box physical or logical network interface (bridge=switch - or port). The local interface packet might be vlan tagged. The five blue balls represent the default firewall chains hook points. The "local process" is in your router box - e.g. remote management (WEB server, Telnet or SSH server), Samba server, PPPoE client, DHCP server(s) or client and so on.
- IPTABLES - An Overview
- wikipedia:Netfilter
- interhack.net: Internet Firewalls: Frequently Asked Questions Good.
- Web archive backup (be patient): Kernel Packet Traveling Diagram Quote: "...On the LARTC mailing list, there was a long discussion about how a packet is handled by the kernel. Finally, there was a post by Leonardo Balliache that I copied onto this page. I hope this helps people to better understand how it all works....", Good ASCII drawing of the ethernet/ip packet journey through the Linux Kernel. Simplify the drawing for yourself, if you do not use some of the processes.
- Another good drawing of the ethernet/ip packet journey through the Linux Kernel with some actions written
- Iptables-tutorial - e.g. on-line:
- Iptables Tutorial, Oskar Andreasson Good and very thorough.
- Ipsysctl-tutorial - e.g. on-line:
- Ipsysctl tutorial, Oskar Andreasson, Good and very thorough.
- sans.org: SANS InfoSec Reading Room - Firewalls & Perimeter Protection notably:
- My Firewall Page - "A Firewall is a concept..." Quote: "...Generic Packet-Filter Ruleset...Keep in mind that these hints are for a single workstation-computer connected to the Internet..."
- Firewall Knowledgebase notably:
- DD-WRT Specific IPTables Info
- OpenWRT Advanced Firewall