Designing and Implementing Linux Firewalls with QoS using netfilter, iproute2, NAT and L7-filter

Designing and Implementing Linux Firewalls with QoS using netfilter, iproute2, NAT and L7-filter
by Lucian Gheorghe (Author)

# Paperback: 288 pages
# Publisher: Packt Publishing (October 31, 2006)
# Language: English
# ISBN-10: 1904811655
# ISBN-13: 978-1904811657
Product Description

Learn how to secure your system and implement QoS using real-world scenarios for networks of all sizes using this unique book. The book covers:
Implementing Packet filtering, NAT, bandwidth shaping, packet prioritization using netfilter/iptables, iproute2, Class Based Queuing (CBQ) and Hierarchical Token Bucket (HTB)
Designing and implementing 5 real-world firewalls and QoS scenarios ranging from small SOHO offices to a large Learn how to secure your system and implement QoS using real-world scenarios for networks of all sizes using this unique book. The book covers:
Implementing Packet filtering, NAT, bandwidth shaping, packet prioritization using netfilter/iptables, iproute2, Class Based Queuing (CBQ) and Hierarchical Token Bucket (HTB)
Designing and implementing 5 real-world firewalls and QoS scenarios ranging from small SOHO offices to a large scale ISP network that spans many cities
Building intelligent networks by marking, queuing, and prioritizing different types of trafficThis practical guide teaches you how to implement effective network protection by using your own customized firewall solution. Based on extensive practical experience, this book distills a unique set of scenario based scripts and guidelines for a proven firewall solution, into one succinct and precise book.

After giving us a background of network security, the book moves on to explain the basic technologies we will work with, namely netfilter, iproute2, NAT and l7-filter. These form the crux of building Linux firewalls and QOS. The later part of the book covers 5 real-world networks for which we design the security policies, build the firewall, setup the script, and verify our installation.Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples.

Chapter 1 is a brief introduction to networking concepts. It covers OSI and TCP/IP networking models with explanations on their layers, TCP and UDP as Layer 4 protocols and then rounds off the chapter with a discussion on IP addresses, Subnetting, and Supernetting.

Chapter 2 discusses possible security threats and vulnerabilities found at each of the OSI layers. The goal here is to understand where and how these threats can affect us and to stay protected from attackers. It then rounds off the discussion by sketching out the basic steps required to protect the services that run on our system.

Chapter 3 introduces two tools needed to build Linux firewalls and QoS. We first learn the workings of netfilter, which is a packet filtering framework, and implement what we have learnt to build a basic firewall for a Linux workstation. We then see how to perform advanced routing and traffic shaping using the IP and TC tools provided by the iproute2 package. The chapter ends with another example scenario where we implement the concepts learnt in the chapter.

Chapter 4 discusses NAT, the types of NAT, how they work and how they can be implemented with Linux by giving practical examples. It also describe packet mangling, when to use it, and why to use it.

Chapter 5 covers layer 7 filtering in detail. We see how to install the l7-filter package, apply the necessary Linux kernel and ip table patches, and test our installation. We then learn the different applications of l7-filter and see how to put them to practical use. We will also see how to install and use IPP2P, which is an alternative to the l7-filter package but only for P2P traffic, and finally we set up a test between the two packages.

Chapter 6 raises two very popular scenarios, for which we design, implement, and test firewalls and a small QoS configuration. In the first scenario, we configure Linux as a SOHO router.

Chapter 7 covers the design of a firewall system for a hypermarket having the headquarters in one location, one store in the same city and several stores in other cities. The hypermarket has an application that uses MSSQL databases in each location which is replicated at the headquarters.

Chapter 8 covers the design of a three-layered network deployed at a large provider of Internet and IP telephony services, the three layers being Core, Distribution and Access. It explains network configuration first on the core and distribution levels and then moves on to building firewalls. The huge size of the network also means that there is a need to tackle newer security threats. As seen in the figure we have 4 Cores running BGP under Zebra and each one peculiar in its own way.

Throughout the book, the author draws on his experience to offer the reader valuable advice on the best practices. Providing only necessary theoretical background, the book takes a practical approach, presenting case studies and plenty of illustrative examples. This book is aimed at Linux Network administrators with some understanding of Linux security threats and issues, or any one interested in securing their systems behind a firewall. Basic knowledge of Linux is presumed but other than that this book shows you how to do the rest, from configuring your system to dealing with security breaches.

About the Author
Lucian Gheorghe has just joined the Global NOC of Interoute, Europe’s largest voice and data network provider. Before Interoute, he was working as a senior network engineer for Globtel Internet, a significant Internet and Telephony Services Provider to the Romanian market He has been working with Linux for more than 8 years putting a strong accent on security for protecting vital data from hackers and ensuring good quality services for internet customers. Moving to VoIP services he had to focus even more on security as sensitive billing data is most often stored on servers with public IP addresses. He has been studying QoS implementations on Linux to build different types of services for IP customers and also to deliver good quality for them and for VoIP over the public internet. Lucian has also been programming with Perl, PHP and Smarty for over 5 years mostly developing in-house management interfaces for IP and VoIP services.

Popularity: 14% [?]

Note: We do not host these ebook files. If you have any complaint of copyright, please comment or contact us. We'll remove the download link immediatly!

• Camino al xito EPM
• Alineamiento Estratgico
• Excelencia en la gestin de conduccin, paso a paso

We are pleased to offer you this exciting, new, and entirely free professional resource. Visit our Free Industry resource center today to browse our selection of 600+ complimentary Industry magazines, white papers, webinars, podcasts, and more.
Download Links:
Link1
Depositfiles
Tools to Download Faster
TweetBucks, Linkbee

Related eBooks - Up | Down