Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 183 / 450

15
Masquerading and Firewalls
Whenever Linux is used in a networked environment, you can use the kernel functions
that allow the manipulation of network packets to maintain a separation between internal
and external network areas. The Linux netfilter framework provides the means to estab-
lish an effective firewall that keeps different networks apart. With the help of iptables—a
generic table structure for the definition of rule sets—precisely control the packets al-
lowed to pass a network interface. Such a packet filter can be set up quite easily with
the help of SuSEfirewall2 and the corresponding YaST module.
15.1 Packet Filtering with iptables
The components netfilter and iptables are responsible for the filtering and manipulation
of network packets as well as for network address translation (NAT). The filtering cri-
teria and any actions associated with them are stored in chains, which must be matched
one after another by individual network packets as they arrive. The chains to match are
stored in tables. The
iptables
command allows you to alter these tables and rule
sets.
The Linux kernel maintains three tables, each for a particular category of functions of
the packet filter:
filter
This table holds the bulk of the filter rules, because it implements the packet filtering
mechanism in the stricter sense, which determines whether packets are let through
(
ACCEPT
) or discarded (
DROP
), for example.
Masquerading and Firewalls 169