35. Firewall
ROX™ v2.2 User Guide
370
RuggedBackbone™ RX5000
35. Firewall
35.1. Firewall Fundamentals
Firewalls are software systems designed to prevent unauthorized access to or from private networks.
Firewalls are most often used to prevent unauthorized Internet users from accessing private networks
(intranets) connected to the Internet.
When the ROX™ firewall is used, the router serves as a gateway machine through which all messages
entering or leaving the intranet pass. The router examines each message and blocks those that do not
meet the specified security criteria. The router also acts as a proxy, preventing direct communication
between computers on the Internet and intranet. Proxy servers can filter the kinds of communication
that are allowed between two computers and perform address translation.
35.1.1. Stateless vs Stateful Firewalls
Firewalls fall into two broad categories: stateless and stateful (session-based).
Stateless or “static” firewalls make decisions about traffic without regard to traffic history; they simply
open a "hole" for the traffic’s type, based upon a TCP or UDP port number. Stateless firewalling
is relatively simple, easily handling web and email traffic. However, stateless firewalls have some
disadvantages. All holes opened in the firewall are always open, and connections are not opened or
closed based on outside criteria. Static IP filters offer no form of authentication.
Stateful firewalling adds considerable complexity to the firewalling process by tracking the state of each
connection.
A stateful firewall also looks at and tests each packet, and the tests or “rules” may be modified depending
on packets that have already been processed. This is called “connection tracking”. Stateful firewalls
can also recognize that traffic on connected sets of TCP/UDP ports is from a particular protocol and
manage it as a whole.
35.1.2. Linux® netfilter, iptables, and the Firewall
ROX™ employs a stateful firewall system known as netfilter, a subsystem of the Linux kernel that
provides the ability to examine IP packets on a per-session basis.
The netfilter system uses rulesets, which are collections of packet classification rules that determine
the outcome of the examination of a specific packet. The rules are defined by iptables, a generic table
structure syntax and utility program for the configuration and control of netfilter.
ROX™ implements an IP firewall using a structured user interface to configure iptables rules and netfilter
rulesets.
35.1.3. Network Address Translation
Network Address Translation (NAT) enables a LAN to use one set of IP addresses for internal traffic and
a second set for external traffic. The netfilter NAT function makes all necessary IP address translations
as traffic passes between the intranet and Internet. NAT is often referred to in Linux as IP Masquerading.
NAT itself provides a type of firewall by hiding internal IP addresses. More importantly, NAT enables a
network to use more internal IP addresses. Since they are used internally only, there is no possibility
of conflict with IP addresses used by other organizations. Typically, an internal network is configured
to use one or more of the reserved address blocks described in RFC1918:
IP Network/Mask
Address Range
10.0.0.0/8
10.0.0.0 - 10.255.255.255
172.16.0.0/12
172.16.0.0 - 172.31.255.255
