Local: Firewalling

Linux: Firewalling - Kernel 2.4.x

Version: 0.05 from 2001-09-22
Copyright 2001 by Peter Bieringer <pb@bieringer.de>, original site of publishing: http://www.bieringer.de/linux/firewall/
Unlimited non-commercial distribution of this document in its entirety is encouraged - please contact the author prior to commercial publication.

Suggestions, comments and improvements are welcome!

Warning: The given script are perhaps not free of bugs and therefore I can give no warranty for protection - check system with nmap from all sides to verify protection!

Common hints
Firewalling Linux 2.4 using netfilter to build an IPv4 firewall
Firewalling Linux 2.4 using netfilter6 to build an IPv6 firewall
List of links
Related credits

Changes to

0.05 [2001-09-22]: spelling fixes, minor add-ons
0.04 [2001-06-05]: further improvements
0.03 [2001-05-25]: Initial copy from 2.2 version

Common hints

ip_local_port_range

There are 2 issues which are important to know

In difference to the kernel 2.2.x behavior, the range is changed automagically by the kernel on TCP init (net/ipv4/tcp.c):

Available physical memory < 128 MByte: 1024, 4999
Available physical memory > 128 MByte: 32768, 60999 (61000)

This range is also valid for IPv6

netfilter - IPv4 firewalling

Differences to kernel 2.2.x (ipchains)

More predefined chains, NAT (masquerading) is separated from filter lists
Stateful packet filtering possible using the feature "connection tracking"

More information coming next.

netfilter6 - IPv6 firewalling

This howto is moved to the Linux-IPv6-HowTo Part 8.

List of links

Netfilter homepage

http://netfilter.filewatcher.org/

Credits to

Linux kernel and netfilter developers

Your connection is via: IPv4
Your address: 18.97.14.89

www.bieringer.de
is maintained by
webmaster at bieringer dot de
(Impressum)