\relax 
\@writefile{toc}{\contentsline {section}{\numberline {1}Preface}{1}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.1}Summary}{1}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.2}Prerequisites}{1}}
\@writefile{toc}{\contentsline {section}{\numberline {2}Introduction}{2}}
\@writefile{toc}{\contentsline {section}{\numberline {3}Firewalls}{3}}
\newlabel{firealls}{{3}{3}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Purpose of a firewall}{3}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Netfilter}{3}}
\newlabel{sec:netfilter}{{3.2}{3}}
\citation{andreasson}
\citation{netfilter}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.2.1}Setting up a Linux firewall}{4}}
\citation{fiaif}
\@writefile{toc}{\contentsline {section}{\numberline {4}FIAIF}{5}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Design}{5}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {4.1.1}Zones}{5}}
\newlabel{1@xvr}{{}{5}}
\newlabel{1@vr}{{}{5}}
\@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces A network split into three zones}}{6}}
\newlabel{fig:zones}{{1}{6}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {4.1.2}Statefull firewalling}{6}}
\newlabel{2@xvr}{{}{6}}
\newlabel{2@vr}{{}{6}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {4.1.3}Network address translation}{6}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Implementation}{6}}
\@writefile{toc}{\contentsline {section}{\numberline {5}Configuration}{7}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Zone specification}{7}}
\@writefile{toc}{\contentsline {paragraph}{Example:}{7}}
\@writefile{toc}{\contentsline {section}{\numberline {6}Configuring a zone}{7}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.1}Definitions}{7}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.2}Zone definition}{9}}
\@writefile{toc}{\contentsline {paragraph}{NAME}{9}}
\@writefile{toc}{\contentsline {paragraph}{DEV}{9}}
\@writefile{toc}{\contentsline {paragraph}{DYNAMIC}{10}}
\@writefile{toc}{\contentsline {paragraph}{DHCP\@uscore .SERVER}{10}}
\@writefile{toc}{\contentsline {paragraph}{GLOBAL}{10}}
\@writefile{toc}{\contentsline {paragraph}{IP}{10}}
\@writefile{toc}{\contentsline {paragraph}{NET}{10}}
\@writefile{toc}{\contentsline {paragraph}{MASK}{10}}
\@writefile{toc}{\contentsline {paragraph}{BCAST}{10}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.3}Zone access}{10}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.3.1}Input rules}{11}}
\@writefile{toc}{\contentsline {paragraph}{Example}{11}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.3.2}Output rules}{11}}
\@writefile{toc}{\contentsline {paragraph}{Example}{11}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.3.3}Forward rules}{11}}
\@writefile{toc}{\contentsline {paragraph}{Example}{12}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.3.4}Reply rules}{12}}
\@writefile{toc}{\contentsline {paragraph}{Example}{12}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.3.5}Limit rules}{12}}
\@writefile{toc}{\contentsline {paragraph}{Example}{13}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.4}Network address translation rules}{13}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.4.1}Redirect}{13}}
\@writefile{toc}{\contentsline {paragraph}{Example}{13}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.4.2}Masquerading/SNAT}{13}}
\@writefile{toc}{\contentsline {paragraph}{Example}{14}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.5}Miscellaneous rules}{14}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.5.1}Packet marking}{14}}
\@writefile{toc}{\contentsline {paragraph}{Example}{14}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.5.2}Traffic monitoring}{14}}
\@writefile{toc}{\contentsline {paragraph}{Example}{14}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.5.3}Denying communication to MAC addresses}{15}}
\@writefile{toc}{\contentsline {paragraph}{Example}{15}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.5.4}Denying communication to IP addresses}{15}}
\@writefile{toc}{\contentsline {paragraph}{Example}{15}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {6.5.5}Clearing ECN bits from packets}{15}}
\@writefile{toc}{\contentsline {paragraph}{Example}{16}}
\@writefile{toc}{\contentsline {section}{\numberline {7}Example setup}{16}}
\newlabel{3@xvr}{{}{16}}
\newlabel{3@vr}{{}{16}}
\@writefile{toc}{\contentsline {paragraph}{The default setup of the External zone}{16}}
\@writefile{toc}{\contentsline {paragraph}{The default setup of the internal zone}{16}}
\@writefile{toc}{\contentsline {paragraph}{The default setup of the demilitarized zone}{16}}
\citation{shorewall}
\citation{mnf}
\@writefile{toc}{\contentsline {section}{\numberline {8}Related work}{17}}
\citation{debian}
\@writefile{toc}{\contentsline {section}{\numberline {9}Status}{18}}
\@writefile{toc}{\contentsline {section}{\numberline {10}Further work}{18}}
\bibstyle{plain}
\bibdata{main}
\bibcite{debian}{1}
\bibcite{netfilter}{2}
\bibcite{shorewall}{3}
\bibcite{andreasson}{4}
\bibcite{fiaif}{5}
\bibcite{mnf}{6}
\@writefile{toc}{\contentsline {section}{\numberline {A}Usage}{20}}
\@writefile{toc}{\contentsline {section}{\numberline {B}Configuration files}{20}}
\newlabel{app:default}{{B}{20}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.1}fiaif.conf}{21}}
\newlabel{app:fiaif.conf}{{B.1}{21}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.2}reserved\_networks}{22}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.3}private\_networks}{23}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.4}type\_of\_services}{23}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.5}zone.ext}{23}}
\newlabel{app:zone.ext}{{B.5}{23}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.6}zone.int}{25}}
\newlabel{app:zone.int}{{B.6}{25}}
\@writefile{toc}{\contentsline {subsection}{\numberline {B.7}zone.dmz}{27}}
\newlabel{app:zone.dmz}{{B.7}{27}}
