[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: firewall question



On Tue, Sep 11, 2001, Adi Stav wrote about "Re: firewall question":
> On Tue, Sep 11, 2001 at 09:12:44AM +0200, Ishai Parasol wrote:
> > Hi
> > 
> > A basic question about firewall: If I'm running a firewall and a gateway and
> > a server (web, mail, etc.) on the same box are the firewall's rules apllying
> > only to the other computers in the network or they're also good for the
> > firewall's box itself ?
> 
> The answer would depend -- at least in ipchains, you can set up 
> filtering rules for incoming, forwarded and outgoing packets. You 

Actually, in ipchains you usually set up "input" and "output" chains, and
these protect both the packets coming to or going from the firewall machines,
and the ones forwarded to other machines. There is typically no reason to
put any rule on the "forward" chain itself. In such a typical setup, the
same packet filtering rules affect all packets: whether they are destined to
the firewall machine or to other machines on the network.

In iptables the situation is different: the FORWARD chain is completely
seperate from the INPUT/OUTPUT chains, and a packet goes through only one
of them; This means the firewalling rules for forwarded packets are completely
seperate from the rules affecting packets to/from the firewall machine
itself. If you want them to be the same rules you'll need to either copy
them twice, or (better) make your own custom chains and link the other
chains to them.

-- 
Nadav Har'El                        |       Tuesday, Sep 11 2001, 23 Elul 5761
nyh@math.technion.ac.il             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Life's a bitch, but god forbid the bitch
http://nadav.harel.org.il           |divorce me -- Nas

=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il