IP Filter Based Firewalls HOWTO

Brendan Conoboy <synk@swcp.com>
Erik Fichtner <emf@obfuscation.org>
Sat Sep 2 02:28:39 EDT 2000

Abstract: This document is intended to introduce a new user to the IP Filter firewalling package and, at the same time, teach the user some basic fundamentals of good firewall design.

• Introduction
• Disclaimer
• Copyright
• Where to obtain the important pieces
• Basic Firewalling
• Config File Dynamics, Order and Precedence
• Basic Rule Processing
• Controlling Rule Processing
• Basic filtering by IP address
• Controlling Your Interfaces
• Using IP Address and Interface Together
• Bi-Directional Filtering; The "out" Keyword
• Logging What Happens; The "log" Keyword
• Complete Bi-Directional Filtering By Interface
• Controlling Specific Protocols; The "proto" Keyword
• Filtering ICMP with the "icmp-type" Keyword; Merging Rulesets
• TCP and UDP Ports; The "port" Keyword
• Advanced Firewalling Introduction
• Rampant Paranoia; or The Default-Deny Stance
• Implicit Allow; The "keep state" Rule
• Stateful UDP
• Stateful ICMP
• FIN Scan Detection; "flags" Keyword, "keep frags" Keyword
• Responding To a Blocked Packet
• Fancy Logging Techniques
• Putting It All Together
• Improving Performance With Rule Groups
• "Fastroute"; The Keyword of Stealthiness
• NAT and Proxies
• Mapping Many Addresses Into One Address
• Mapping Many Addresses Into a Pool of Addresses
• One to One Mappings
• Spoofing Services
• Transparent Proxy Support; Redirection Made Useful
• Magic Hidden Within NAT; Application Proxies
• Loading and Manipulating Filter Rules; The ipf Utility
• Loading and Manipulating NAT Rules; The ipnat Utility
• Monitoring and Debugging
• The ipfstat utility
• The ipmon utility
• Keep State With Servers and Flags
• Coping With FTP
• Running an FTP Server
• Running an FTP Client
• Assorted Kernel Variables
• Fun with ipf!
• Localhost Filtering
• What Firewall? Transparent filtering
• Using Transparent Filtering to Fix Network Design Mistakes
• Drop-Safe Logging With dup-to and to
• The dup-to Method
• The to Method