Firewall Settings

The term firewall comes from automobile mechanics; cars include something called a firewall to prevent fires and explosions in the engine from easily reaching the inside of the car, where they can hurt people.

In the same way, a network firewall prevents computers on the internet (where virtual fires, explosions and breakdowns are common) from reaching computers on your local network, where they can do damage.

Your NetWinder uses the advanced Linux kernel for its firewall features. The Linux firewall is very powerful, and has a wide variety of options that allow you to restrict outsiders from getting in or insiders from getting out. You can limit people's access based on their computer's address, or based on particular services (such as e-mail or the web).

WARNING

Because the Linux firewall is so powerful, it can be difficult and confusing to configure. You can also easily lock out your workstation from the web-based configuration; if you do that, you will need to attach a keyboard and monitor to your NetWinder to repair the problem. See the chapter called Recovering from Emergencies if this happens.

Because of these problems, you should avoid changing your NetWinder's firewall unless you have a good reason. The default settings are sufficiently secure for most sites.

When you click Firewall from the Network configuration page, you will see a page that looks like this:

Before we actually make any firewall settings, let's look at some background information.

The Three Firewall Chains

The Linux firewall included in your NetWinder uses a three-stage process to decide whether or not a network packet will be allowed to pass through the firewall. Each of these stages is called a "chain."

The three firewall chains are as follows:

Standard Firewall Policies

The next thing to learn about firewalls is the four different policies that you can apply when forming firewall rules.

Each firewall chain consists of a sequence of rules, evaluated from top to bottom, that match different kinds of network packets. Each rule has a policy that specifies how the firewall should treat a packet that matches this rule. If none of the rules matches a particular packet, the default policy will be applied instead.

Primary Policies

There are three policies that can be applied in any of the three chains (input, output and forwarding)::

  1. Accept. This policy specifies that the chain should immediately accept a packet, and continue on its way. In the case of the Forward firewall, it will be sent through the Output firewall and along to its final destination.
  1. Reject. This means that the packet should be returned to the sender with an error message. Usually, when you want to block a connection, you will use the Reject policy.
  1. Deny. This means that the packet should be quietly discarded and no further action should be taken. If a packet matches a Deny rule, your NetWinder will act as if the packet simply didn't exist. Eventually, the requesting computer will give up with a "host not responding" or timeout message.

Most people consider using the Deny policy rude. However, if you deny all types of connections except the ones you really want, your NetWinder will look almost completely invisible to the internet, which may discourage people from trying to break in. On the other hand, this can be very confusing to technicians who are legitimately trying to resolve network problems. Unless you have a good reason, you should avoid using the Deny policy.

Secondary Policies (Forwarding)

  1. Redirect. This allows you to redirect incoming requests to another host on or off your network. This is almost never used.
  1. Masquerading (Masq). This type of policy can only be applied in the Forward firewall.

    When a forwarded packet matches a Masq rule, your NetWinder will perform a 'magical' operation that relabels the connection as if it were originating at the NetWinder. As far as the remote side is concerned, the NetWinder is making a request. When the response comes back, it will be automatically relabelled again, so that the original requester isn't aware that anything special has happened.

    This is useful for three reasons:

As with the other Forward firewall rules, masquerading doesn't work unless you have enabled Packet forwarding under Ethernet Settings.

Creating Firewall Rules

WARNING

If you are not an advanced user, we suggest leaving the firewall settings as they are. The default settings ensure sufficient security. By creating firewall rules, you have the ability to block access from your own computer to the web-based configuration. If you do that, the only way to recover is to attach a keyboard and monitor to your NetWinder, and fix it from the console.

If you click the words Add a new rule under any of the three firewall chains, you'll see a screen that looks like this:

The options are as follows:

Click the Save button when you have finished entering the above information. After you finish making changes, you can choose to make them permanent. A screen summarizing your changes will appear and ask you to confirm them. This is your last chance to abort the changes, which may accidentally cause your workstation to be blocked from the NetWinder. Once you confirm the changes, the new firewall rules will be activated.