Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

32

|

Chapter 2: Designing Perimeter Networks

The Firewall

Naturally, you need to do more than create and populate a DMZ to build a strong

perimeter network. What ultimately distinguishes the DMZ from your internal net-

work is your firewall.

Your firewall (or firewalls) provides the first and last word as to which traffic may

enter and leave each of your networks. Although it’s a mistake to mentally elevate

firewalls to a panacea, which can lead to complacency and thus to bad security, it’s

imperative that your firewalls are carefully configured, diligently maintained, and

closely watched.

As I mentioned earlier, in-depth coverage of firewall architecture and specific

configuration procedures are beyond the scope of this chapter. What we will discuss

are some essential firewall concepts and some general principles of good firewall con-

struction.

Types of Firewall

In increasing order of strength, the three primary types of firewall are the simple

packet filter, the so-called “stateful” packet filter, and the application-layer proxy.

Most packaged firewall products use some combination of these three technologies.

Simple packet filters

Simple packet filters evaluate packets based solely on IP headers (Figure 2-5).

Accordingly, this is a relatively fast way to regulate traffic, but it is also ...