Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 191 / 450

15.4.2 Configuring Manually
The following paragraphs provide step-by-step instructions for a successful configura-
tion. Each configuration item is marked as to whether it is relevant to firewalling or
masquerading. Use port range (for example,
500:510
) whenever appropriate. Aspects
related to the DMZ (demilitarized zone) as mentioned in the configuration file are not
covered here. They are applicable only to a more complex network infrastructure found
in larger organizations (corporate networks), which require extensive configuration and
in-depth knowledge about the subject.
First, use the YaST module System Services (Runlevel) to enable SuSEfirewall2 in
your runlevel (3 or 5 most likely). It sets the symlinks for the SuSEfirewall2_* scripts
in the
/etc/init.d/rc?.d/
directories.
FW_DEV_EXT
(firewall, masquerading)
The device linked to the Internet. For a modem connection, enter
ppp0
. For an
ISDN link, use
ippp0
. DSL connections use
dsl0
. Specify
auto
to use the in-
terface that corresponds to the default route.
FW_DEV_INT
(firewall, masquerading)
The device linked to the internal, private network (such as
eth0
). Leave this blank
if there is no internal network and the firewall protects only the host on which it
runs.
FW_ROUTE
(firewall, masquerading)
If you need the masquerading function, set this to
yes
. Your internal hosts will
not be visible to the outside, because their private network addresses (e.g.,
192.168.x.x
) are ignored by Internet routers.
For a firewall without masquerading, only set this to
yes
if you want to allow access
to the internal network. Your internal hosts need to use officially registered IP ad-
dresses in this case. Normally, however, you should not allow access to your internal
network from the outside.
FW_MASQUERADE
(masquerading)
Set this to
yes
if you need the masquerading function. This provides a virtually
direct connection to the Internet for the internal hosts. It is more secure to have a
proxy server between the hosts of the internal network and the Internet. Masquerad-
ing is not needed for services a proxy server provides.
Masquerading and Firewalls 177