IP Filter Based Firewalls HOWTO

              Brendan Conoboy 
            Erik Fichtner 


                Wed Dec 11 12:42:58 EST 2002

     Abstract:  This document is intended to introduce a new
     user to the IP Filter firewalling package and,  at  the
     same  time,  teach  the user some basic fundamentals of
     good firewall design.


1.  Introduction

     IP Filter is a great little firewall package.  It  does
just   about   everything  other  free  firewalls  (ipfwadm,
ipchains, ipfw) do, but it's also  portable  and  does  neat
stuff  the  others don't.  This document is intended to make
some cohesive sense of the  sparse  documentation  presently
available for ipfilter.  Futhermore, this document will also
serve as documentation for  syntatically  compatible  packet
filters  (notably  pf)  and, wherever applicable, will point
out any important  differences;  however  this  document  is
specifically  targeted at the rules language and syntax, and
is not intended to be platform specific.  Some prior  famil-
iarity  with  packet  filtering  will be useful, however too
much familiarity may make this  document  a  waste  of  your
time.   For  greater understanding of firewalls, the authors
recommend reading Building  Internet  Firewalls,  Chapman  &
Zwicky,  O'Reilly  and  Associates;  and TCP/IP Illustrated,
Volume 1, Stevens, Addison-Wesley.

• Introduction
• Disclaimer
• Copyright
• Where to obtain the important pieces
• Basic Firewalling
• Config File Dynamics, Order and Precedence
• Basic Rule Processing
• Controlling Rule Processing
• Basic filtering by IP address
• Controlling Your Interfaces
• Using IP Address and Interface Together
• Bi-Directional Filtering; The "out" Keyword
• Logging What Happens; The "log" Keyword
• Complete Bi-Directional Filtering By Interface
• Controlling Specific Protocols; The "proto" Keyword
• Filtering ICMP with the "icmp-type" Keyword; Merging Rulesets
• TCP and UDP Ports; The "port" Keyword
• Advanced Firewalling Introduction
• Rampant Paranoia; or The Default-Deny Stance
• Implicit Allow; The "keep state" Rule
• Stateful UDP
• Stateful ICMP
• FIN Scan Detection; "flags" Keyword, "keep frags" Keyword
• Responding To a Blocked Packet
• Fancy Logging Techniques
• Putting It All Together
• Improving Performance With Rule Groups
• "Fastroute"; The Keyword of Stealthiness
• NAT and Proxies
• Mapping Many Addresses Into One Address
• Mapping Many Addresses Into a Pool of Addresses
• One to One Mappings
• Policy NAT
• Spoofing Services
• Transparent Proxy Support; Redirection Made Useful
• Filtering Redirected Services
• Magic Hidden Within NAT; Application Proxies
• More Magic; Using NAT As a Load Balancer
• Loading and Manipulating Filter Rules; The ipf Utility
• Loading and Manipulating NAT Rules; The ipnat Utility
• Monitoring and Debugging
• The ipfstat utility
• The ipmon utility
• Keep State With Servers and Flags.
• Coping With FTP
• Running an FTP Server
• Running an FTP Client
• Assorted Kernel Variables
• Fun with ipf!
• Localhost Filtering
• What Firewall? Transparent filtering.
• Using Transparent Filtering to Fix Network Design Mistakes
• Drop-Safe Logging With dup-to and to.
• The dup-to Method
• The to Method
• Bogus Network Filtering, the ultimate in current anti-spoofing technology.