 |
 |
|
 | ||
 | |||||
        | |||||
 =20
|
 |
By |
||||||||||||||||||||||||||||||||||||||
Features
|
Stay Current! |
|
Subscribe to our |
|
Subscribe to our |
|
Download our |
|
Download the |
|
Download the |
Packet Mangling:
Packet = mangling=20 is the ability to change or modify packets both before they are = routed and=20 after routing has been decided, specifically, the PREROUTING and=20 POSTROUTING subtables.=20Type of Service
One example of = packet=20 mangling is the ability to prioritize traffic from separate = queues,=20 changing the "Type of Service" value in the packet before it is = routed on=20 to its final destination.The Type of Service values can be one of the following:=20
- Minimize-Delay=20
- Maximize-Throughput=20
- Maximize-Reliability=20
- Minimize-Cost=20
- Normal-Service
# iptables -A PREROUTING -t mangle -p tcp --sport telnet \ -j TOS --set-tos Minimize-Delay # iptables -A PREROUTING -t mangle -p tcp --sport ftp \ -j TOS --set-tos Minimize-Delay # iptables -A PREROUTING -t mangle -p tcp --sport ftp-data \ -j TOS --set-tos Maximize-Throughput
Logging:
Netfilter improves on = previous=20 versions by providing the ability to restrict the rate of matches, = such as=20 for suppressing extensive log messages, for example when a host = makes a=20 number of connections in a predefined interval. This can help to = prevent=20 some types of denial of service attacks.The detailed logging that netfilter provides enables a firewall =
administrator to not only troubleshoot potential system problems, =
but also=20
to track a potential intrusion, and correlate it with other =
systems and=20
events. The example below shows how to reduce the number of =
packets=20
originating from the 192.168.1.1 host that are logged: # iptables -A INPUT -s 192.168.1.1 -m limit --limit =
1/second -j LOG
It is also possible to log messages at different log levels =
and with different prefix notes:
# iptables -A INPUT -s 192.168.1.1 -j LOG =
--log-prefix ' ##Router## '
This will log all traffic originating from the 192.168.1.1=20
host and prepend the string " ##Router## " to each entry. It =
produces the=20
following log output: Jan 28 23:18:42 magneto =
kernel: ##Router## IN=eth0 OUT==20
MAC=00:60:67:36:9b:c8:00:60:67:30:ac:e5:08:00 SRC=192.168.1.1=20
DST=192.168.1.206 LEN=312 TOS=0x10 PREC=0x00 TTL=64 ID=9189 =
DF=20
PROTO=TCP SPT=22 DPT=1023 WINDOW=32120 RES=0x00 ACK PSH =
URGP=0
Additionally, it also provides the ability to log packets=20
based on many other criteria. More information in logging in =
general (MAC=20
address, etc). A rule such as the following:
# iptables -I INPUT -m mac --mac-source =
00:60:67:30:AC:E5 -j LOG
produces log output similar to the following: Jan 28 23:15:19 magneto kernel: IN=eth0 OUT==20
MAC=00:60:67:36:9b:c8:00:60:67:30:ac:e5:08:00 SRC=192.168.1.1=20
DST=192.168.1.206 LEN=528 TOS=0x10 PREC=0x00 TTL=64 ID=7738 =
DF PROTO=TCP=20
SPT=22 DPT=1023 WINDOW=32120 RES=0x00 ACK PSH URGP=0=20
Jan 28 23:15:19 magneto kernel: IN=eth0 OUT==20
MAC=00:60:67:36:9b:c8:00:60:67:30:ac:e5:08:00 SRC=192.168.1.1=20
DST=192.168.1.206 LEN=528 TOS=0x10 PREC=0x00 TTL=64 ID=7738 =
DF PROTO=TCP=20
SPT=22 DPT=1023 WINDOW=32120 RES=0x00 ACK PSH URGP=0=20
|
Recent Features: |
|
|
|
|
|
|
|
Download the |
|
|
Final Notes:
In this = article we've=20 covered a majority of the new features available in the new = filtering code=20 available in the 2.4 kernel. There are a number of other changes = that make=20 using the packet mangling code easier than previous versions. = Previously,=20 the forward chain only had information on the outgoing interface, = making=20 it more difficult to determine where the packet came from. It's = now=20 possible to create packet filter rules independant of interface = address.It's no longer necessary to bind a rule with an interface. It's = now=20 possible to specify the "in" interface or the "out" interface for = basing=20 filtering decisions.
Ipchains and ipfwadm modules exist for backward compatibility = with the=20 old systems. Note that you can only have one loaded at a time. You = can't=20 have ipchains and some new iptables rules.
Acknowledgements:
I'd like to express thanks to Kevin = Fenzi, my=20 Security HOWTO co-author, and Harald Welte, author of much of the=20 documentation we have today on netfilter, for accuracy-checking my = document. Thanks to Benjamin Thomas for proofreading. Any errors = are=20 either due to transmission problems or fault of my own, though ;)
Related Resources:
Linux 2.4 Packet Filtering = HOWTOThis=20 document describes how to use iptables to filter out bad packets = for the=20 2.4 Linux kernels.
Linux 2.4 NAT HOWTO Netfilter Mailing list: SYN Cookies: Stateful inspection in action: What is a Stateful Inspection of a Firewall? Configure firewall logging and alert mechanisms Linux Network Address Translation Network Address Translation Whitepaper Setting up Squid as your caching proxy Proxy Internet Access With Squid High Performance Web Caching With Squid Network (In)Security Through IP Packet Filtering An Architectural Overview of UNIX Network Security Design the firewall system Linux Network Administrator's Guide: Chapter 9, TCP/IP=20
Firewall
This document describes how to do =
masquerading, transparent proxying, port forwarding, and other =
forms of=20
Network Address Translations with the 2.4 Linux Kernels.
Send a message to=20
netfilter-request@lists.samba.org with "subscribe" in the subject =
to=20
subscribe. Visit the netfilter web site for more information.
Cli=
ck to=20
subscribe
SYN cookies are particular choices of =
initial=20
TCP sequence numbers by TCP servers.
This document shows=20
graphically how Check Point's FW-1 works as a stateful packet=20
filter.
This is =
a short=20
document that describes the stateful inspection firewall.
This =
brief=20
CERT document describes the concepts behind firewall logging and =
its=20
importance.
This document =
describes the=20
various forms of address translation and implementations of it on=20
Linux.
http://linas.org/linux/load.html
This is a =
pretty good=20
document that describes how NAT works.
A document to =
get=20
started using the squid caching proxy server.
This squid document=20
describes how to configure logging and access control.
Performance =
tuning=20
squid.
One =
of the=20
original documents that describe some of the deficiencys with =
packet=20
filtering.
http://www.greatcircle.com/pkt_filtering.html
A =
somewhat=20
dated document now, but still does a great job of pointing out the =
risks=20
in network security.
A firewall document that =
discusses=20
topology, several types of firewall implementations, trade-off =
analysis=20
and more.
The full chapter of the NAG. Starts at the =
beginning and=20
provides several real-world packet filtering examples.
  |