Linux firewall facilities
for kernel-level packet screening

Jos Vos <jos@xos.nl>
Willy Konijnenberg <willy@xos.nl>

X/OS Experts in Open Systems BV
Kruislaan 419
1098 VA Amsterdam
The Netherlands

Last updated: November 18, 1996

Abstract:

The freely available Linux operating system includes a number of facilities for efficient kernel-level IP packet filtering and screening. The acceptance and forwarding of IP packets can be regulated by specifying filter rules, using packet and network device characteristics, such as IP addresses, port numbers, IP flags, and incoming or outgoing interfaces. Linux also provides support for transparent proxy servers by means of packet redirection, which is implemented as part of the IP firewall module and can be configured using a similar set of rules. Transparent here means that use of such a proxy server does not require any changes for users or application software. Finally, Linux can masquerade forwarded packets, so that it looks like all packets come from the Linux host.

 
• Introduction
• IP packet filtering
• Kernel filtering scheme
• Managing firewall filters
• Transparent proxying
• Masquerading
• IP traffic accounting
• A real-life example
• Future directions
• Complete firewalls based on Linux
• References