Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 188 / 450

15.4 SuSEfirewall2
SuSEfirewall2 is a script that reads the variables set in
/etc/sysconfig/
SuSEfirewall2
to generate a set of iptables rules. It defines three security zones,
although only the first and the second one are considered in the following sample con-
figuration:
External Zone
Given that there is no way to control what is happening on the external network,
the host needs to be protected from it. In most cases, the external network is the
Internet, but it could be another insecure network, such as a WLAN.
Internal Zone
This refers to the private network, in most cases the LAN. If the hosts on this net-
work use IP addresses from the private range (see Section “Netmasks and Routing”
(Chapter 18, Basic Networking, ↑Administration Guide)), enable network address
translation (NAT), so hosts on the internal network can access the external one.
Demilitarized Zone (DMZ)
While hosts located in this zone can be reached both from the external and the in-
ternal network, they cannot access the internal network themselves. This setup can
be used to put an additional line of defense in front of the internal network, because
the DMZ systems are isolated from the internal network.
Any kind of network traffic not explicitly allowed by the filtering rule set is suppressed
by iptables. Therefore, each of the interfaces with incoming traffic must be placed into
one of the three zones. For each of the zones, define the services or protocols allowed.
The rule set is only applied to packets originating from remote hosts. Locally generated
packets are not captured by the firewall.
The configuration can be performed with YaST (see Section 15.4.1, “Configuring the
Firewall with YaST” (page 175)). It can also be made manually in the file
/etc/
sysconfig/SuSEfirewall2
, which is well commented. Additionally, a number
of example scenarios are available in
/usr/share/doc/packages/
SuSEfirewall2/EXAMPLES
.
174 Security Guide