book

Troubleshooting Linux® Firewalls

Name: Troubleshooting Linux® Firewalls
ISBN: 0321227239

by Michael Shinn, Scott Shinn

December 2004

Intermediate to advanced

384 pages

8h 31m

English

Addison-Wesley Professional

Read now

Unlock full access

Copyright
I. Getting Started
1. Introduction
Why We Wrote This BookHow This Book Is OrganizedGoals of This BookThe Methodical Approach and the Need for a MethodologyFirewalls, Security, and Risk ManagementHow to Think About Risk ManagementComputer Security PrinciplesFirewall Recommendations and DefinitionsWhy Do I Need a Firewall?Do I Need More Than a Firewall?What Kinds of Firewalls Are There?Firewall TypesThe Myth of “Trustworthy” or “Secure” SoftwareKnow Your VulnerabilitiesCreating Security PoliciesTrainingDefense in DepthSummary
2. Getting Started
Risk ManagementBasic Elements of Risk ManagementSeven Steps to Managing RiskPhase I: AnalyzeInventoryQuantify the Value of the AssetThreat AnalysisDown Stream LiabilityPhase II: DocumentCreate Your PlanDefense in DepthHolisticCreate a Security PolicyCreate Security ProceduresPhase III: Secure the EnterpriseImplement PoliciesImplement ProceduresDeploy Security Technology and Counter MeasuresSecuring the Firewall ItselfIsolating AssetsFilteringIngress/Egress FilteringPhase IV: Implement MonitoringPhase V: TestPhase VI: IntegratePhase VII: ImproveSummary
3. Local Firewall Security
The Importance of Keeping Your Software Up to DateYumRed CarpetUp2DateEmergeApt-GetOver Reliance on PatchingTurning Off ServicesUsing TCP Wrappers and Firewall RulesRunning Services with Least PrivilegeRestricting the File SystemSecurity Tools to InstallLog Monitoring ToolsNetwork Intrusion DetectionHost Intrusion DetectionTigerrkhunterchkrootkitTitansamhaintripwireAideRemote LoggingCorrectly Configure the Software You Are UsingUse a Hardened KernelOther Hardening StepsSummary
4. Troubleshooting Methodology
Problem Solving MethodologyRecognize, Define, and Isolate the ProblemGather FactsDefine What the “End State” Should BeDevelop Possible Solutions and Create an Action PlanAnalyze and Compare Possible SolutionsSelect and Implement the SolutionCritically Analyze the Solution for EffectivenessRepeat the Process Until You Resolve the ProblemFinding the Answers or...Why Search Engines Are Your FriendWebsitesSummary
II. Tools and Internals
5. The OSI Model: Start from the Beginning
Internet Protocols at a GlanceUnderstanding the Internet Protocol (IP)What an IP Packet Looks LikeUnderstanding ICMPWhat an ICMP Message Looks LikeUnderstanding TCPReliabilityFull Duplex and MultiplexingFlow ControlCongestion ControlHow TCP Connections Are EstablishedHow TCP Connections Are ClosedTCP CLOSETCP ABORTUnderstanding UDPTroubleshooting with this Perspective in MindLayer 1: Test To Make Sure You Have Physical ConnectivityLayer 2: Test Your DriverLayer 3: Test IP LayerLayer 4: Test the TCP LayerLayer 5: Test the Session LayerLayer 6: Test the Presentation LayerLayer 7: Test the Application LayerSummary
6. netfilter and iptables Overview
How netfilter WorksHow netfilter Parses RulesPacket Sent to Service Running on Firewall from Remote Host (INPUT) Steps:Packet Sent by Firewall from a Local Process to a Remote System (OUTPUT)Packet Our Firewall Is Forwarding for Some Other Host to Some Host (FORWARD)Putting It All TogetherNetfilter StatesWhat about Fragmentation?Taking a Closer Look at the State EngineBreaking Down Some ExamplesSummary
7. Using iptables
Proper iptables SyntaxExamples of How the Connection Tracking Engine WorksUDPTCPApplying What Has Been Covered So Far by Implementing Good RulesSetting Up an Example FirewallKernel Optionsiptables ModulesFirewall RulesQuality of Service RulesPort Scan RulesBad Flag RulesBad IP Options RulesSmall Packets and Rules to Deal with ThemRules to Detect Data in Packets Using the String ModuleInvalid Packets and Rules to Drop ThemA Quick Word on FragmentsSYN FloodsPolite RulesOdd Port Detection and Rules to Deny Connections to ThemSilently Drop Packets You Don’t Care AboutEnforcement RulesIP Spoofing RulesEgress FilteringSend TCP Reset for AUTH ConnectionsPlaying Around with TTL ValuesState Tracking RulesSTEALTH RulesShunning Bad GuysACCEPT RulesSummary

8. A Tour of Our Collective Toolbox
Old FaithfulSniffersAnalyzing Traffic UtilizationNetwork Traffic AnalyzersUseful Control ToolsNetwork ProbesProbing ToolsFirewall Management and Rule BuildingSummary
9. Diagnostics
Diagnostic LoggingScripts To Do This for YouThe catch all Logging RuleThe iptables Trace PatchChecking the NetworkUsing a Sniffer to Diagnose Firewall ProblemsMemory Load DiagnosticsSummary
III. Diagnostics
10. Testing Your Firewall Rules (for Security!)
Inside->Out Testing with nmap and iplogInterpreting the Output from an Inside->Out ScanTesting from the Outside->InReading Output from nmapTesting your Firewall with fragrouterVLANsSummary
11. Layer 2/Inline Filtering
Common QuestionsTools Discussed in this ChapterBuilding an Inline Transparent Bridging Firewall with ebtables (Stealth Firewalls)Filtering on MAC Address Bound to a Specific IP Address with ebtablesFiltering Out Specific Ports with ebtablesBuilding an Inline Transparent Bridging Firewall with iptables (Stealth Firewalls)MAC Address Filtering with iptablesDHCP Filtering with ebtablesSummary
12. NAT (Network Address Translation) and IP Forwarding
Common Questions about Linux NATTools/Methods Discussed in this ChapterDiagnostic LoggingViewing NAT Connections with netstat-natListing Current NAT Entries with iptablesListing Current NAT and Rule Packet CountersForward: A Basic Masquerading FirewallForward: A Basic SNAT FirewallForward: A Basic DMZTroubleshooting: Internal Systems Cannot Communicate with External Systems—Packets Do Not Pass in or Out of the FirewallCorrective ActionsTroubleshooting: Internal Systems Can Communicate with External Systems—DMZ Systems Cannot Be Reached from the OutsideCorrective ActionsInternal Systems Can Communicate to External Systems Except to a Small Percentage of SystemsInternal Systems Can Communicate with External Systems, but only with Small Packets—Large File Transfers FailSummary
13. General IP (Layer 3/Layer 4)
Common QuestionInbound: Creating a Rule for a New TCP ServiceInbound: Allowing SSH to a Local SystemForward: SSH to Another SystemSSH: Connections TimeoutTelnet: Forwarding Telnet Connections to Other SystemsMySQL: Allowing MySQL ConnectionsSummary
14. SMTP (e-mail)
Common QuestionsTools Discussed in this ChapterAllowing SMTP to/from Your FirewallsForwarding SMTP to an Internal Mail ServerForcing Your Mail Server Traffic to Use a Specific IP Address with an SNAT RuleBlocking Internal Users from Sending Mail Through Your FirewallAccept Only SMTP Connections from Specific Hosts (ISP)SMTP Server Timeouts/Failures/Numerous ProcessesSmall e-Mail Send/Receive Correctly—Large e-Mail Messages Do NotSummary
15. Web Services (Web Servers and Web Proxies)
Common QuestionsTools Discussed in this ChapterInbound: Running a Local Web Server (Basic Rules)Inbound: Filter: Incoming Web to Specific HostsForward: Redirect Local Port 80 to Local Port 8080Forwarding Connections from the Firewall to an Internal Web ServerForward: To Multiple Internal ServersForward: To a Remote Server on the InternetForward: Filtering Access to a Forwarded ServerOutbound: Some Websites are Inaccessible (ECN)Outbound: Block Clients from Accessing WebsitesTransparent Proxy Servers (squid) on Outbound Web TrafficSummary
16. File Services (NFS and FTP)
Tools Discussed in this ChapterNFS: Cannot Get NFS Traffic to Traverse a NAT or IP Forwarding FirewallFTP Inbound: Running a Local FTP Server (Basic Rules)FTP Inbound: Restricting Access with Firewall RulesFTP Inbound: Redirecting FTP Connections to Another Port on the ServerFTP Forward: Forwarding to an FTP Server Behind the Firewall on a DMZ SegmentFTP Forward: Forwarding to Multiple FTP Servers Behind the Firewall on a DMZ SegmentFTP Forward: From One Internet Server to Another Internet ServerFTP Forward: Restricting FTP Access to a Forwarded ServerFTP Outbound: Connections are Established, but Directories Cannot Be Listed, and Files Cannot Be DownloadedSummary
17. Instant Messaging
Common Questions/ProblemsTools Discussed in This ChapterNetMeeting and GnomeMeetingConnecting to a Remote NetMeeting/GnomeMeeting Client from Behind an iptables Firewall (Outbound Calls Only)Connecting to a NetMeeting/GnomeMeeting Client Behind a netfilter/iptables Firewall (Inbound/Outbound Calls)Directly from the GnomeMeeting Website’s DocumentationBlocking Outbound NetMeeting/GnomeMeeting TrafficMSN MessengerConnecting to Other MSN UsersBlocking MSN Messenger Traffic at the FirewallYahoo MessengerConnecting to Yahoo MessengerBlocking Yahoo Messenger TrafficAOL Instant Messenger (AIM)Connecting to AIMBlocking AOL Instant Messenger TrafficICQConnecting to ICQBlocking ICQSummaryRecalling Our Methodology
18. DNS/DHCP
Common QuestionsTools Discussed in this ChapterForwarding DNS Queries to an Upstream/Remote DNS ServerDNS Lookups Fail: Internal Hosts Communicating to an External NameserverDNS Lookups Fail: Short DNS Name Lookups Work—Long Name Lookups Do NotDNS Lookups Fail: Nameserver Running on the FirewallDNS Lookups Fail: Nameserver Running on the Internal and/or DMZ NetworkMisleading rDNS Issue: New Mail, or FTP Connections to Remote Systems Take 30 Seconds or More to StartDHCP: Dynamically Updating Firewall Rules with the IP ChangesBlocking Outbound DHCPDHCP: Two Addresses on One External InterfaceDHCP: Redirect DHCP Requests to DMZSummary
19. Virtual Private Networks
Things to Consider with IPSECCommon Questions/ProblemsTools Discussed in this ChapterIPSEC: Internal Systems—Behind a NAT/MASQ Firewall Cannot Connect to an External IPSEC ServerIPSEC: Firewall Cannot Establish IPSEC VPNsIPSEC: Firewall Can Establish Connections to a Remote VPN Server, but Traffic Does not Route Correctly Inside the VPNPPTP: Cannot Establish PPTP Connections Through the FirewallRunning a PPTP Server Behind a NAT FirewallPPTP: Firewall Cannot Establish PPTP VPNsPPTP: Firewall Can Establish Connections to a Remote VPN Server, but Traffic Does not Route Correctly Inside the VPNUsing a free/openswan VPN to Secure a Wireless NetworkSummary

Overview

Covers Red Hat and SUSE

When something goes wrong with your Linux firewall, you need to fix it—right now. You don't have time for endless newsgroup searches, confusing man pages, emails to the developers... it's an emergency! One book brings together all the step-by-step solutions and proven problem-solving techniques you'll need when the time comes: Troubleshooting Linux® Firewalls.

Authors Michael Shinn and Scott Shinn are among the world's leading firewall experts; they've even been hired to protect computer security at the White House. In this book, they cover every area where Linux firewalls can go wrong: rules and filtering problems, Layer 2/3/4 issues, trouble with individual services, DNS/DHCP failures, even misconfigured VPNs. They also present an easy, start-to-finish troubleshooting methodology that'll help you identify even the newest or most obscure firewall problem fast—and solve it!

Inside, you will find in-depth information on the following areas:

What you must know about iptables and netfilter to troubleshoot and avoid problems

Using loggers, sniffers, and other tools to diagnose even the most obscure firewall problems

Making sure your firewall rules work the way they're supposed to

Resolving problems with Network Address Translation and IP Forwarding

Troubleshooting SMTP, Apache, Squid, NFS, FTP, instant messaging, and other Web-based services

Finding and fixing common problems with IPsec VPN configuration

Making your firewalls more failure-resistant: recommendations from the experts

If you depend on a Linux firewall, what will you do if it goes down? With Troubleshooting Linux® Firewalls, you can be confident that the solutions are right at hand—so you can sleep at night!

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0321227239Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills