\section{FIAIF}
This section will describe the design goals of FIAIF, \textit{FIAIF is
an intelligent firewall}\cite{fiaif}, a tool to setup a firewall under
Linux.

\subsection{Design}
The idea behind FIAIF is that it is too hard to setup a complex, yet
secure firewall under Linux. Doing so requires deep insight into
building a firewall and complete understanding of the Linux
firewalling modules, Netfilter and iptables.  

The foremost requirement of FIAIF is that it should be secure and
easy to configure. If FIAIF is too difficult to configure, errors are
more likely to occur and an insecure firewall might result.

Also it is a requirement that FIAIF is expansible and
flexible. FIAIF should be able to handle both simple and complex network
configurations in an generic manner.

\subsubsection{Zones}
To satisfy extendability a new term, \textit{zones}, is introduced. 
A zone defines a network to which the firewall is connected, and
enables the administrator to setup different security policies for
each zone.\\

The security policies for each zone has been chosen to primarally
limit the traffic entering a zone, and not restricting network traffic
coming from machines within a zone. This has been chosen, as it
enables to administrator to add new zone definitions to an existing
configuration without having to modify the configuration of other
zones, to either allow or deny network communication.\\

On \figref{fig:zones} is an example of a network split into three zones:
\begin{description}
\item[External zone]: This zone defines the whole
  Internet. 
\item[Internal zone]: This zone defines all machines on a LAN. The
  primary function of the firewall is to protect machines on the LAN
  from unauthorised access from the Internet.
\item[Demilitarised zone]: A demilitarised zone defines a group of
  machines which runs services exposed to the Internet. Examples of
  these services es are: Login server, Web-server, Mail gateway etc.
  As users from the Internet can gain access to these server, very
  strict security must be in place, under the assumption that these
  services are not 100 percent secure\footnote{Practise has shown that
  no software is without bugs, and can in worst case, have bugs that allow
  users to gain control over the underlying operating system}.
\end{description}

\begin{figure}[!h]
\begin{center}
  \includegraphics[scale=0.25]{fig/zones}
\end{center}
\caption{\label{fig:zones}A network split into three zones}
\end{figure}

\subsubsection{Statefull firewalling}
As Linux supports statefull inspection of all packets entering and/or
leaving the firewall, configuration of a zone only concerns packets
with the \textit{NEW} state, as explained in \secref{sec:netfilter}.
Related and established packets are automatically accepted. The
reason for this design is that it allows a bi-directional
communication between two zones, even if one zone does not permit
communication entering from any zone, but only if the communication is
initiated from a trusted zone. The goal is to keep zone configuration
very simple. The dogma is: \textit{``If no communication must exist, do
  not allow it in the first place''}.

\subsubsection{Network address translation}
% This should go in a general section.
Apart from controlling the connections that can be established from one
zone to another, zones also control network address translation
(NAT). NAT is used to alter source and destination of IP
datagrams. 

\subsection{Implementation}
FIAIF is implemented as a shell script, using the \textit{Bourne again
shell}, BASH, interpreter. The reason for this language is, that it
allows a minimal installation of software on the firewall and is
platform independent. Other languages such as C++ or Java might have
been a better choice of language from a programmers point of view, but
introduces a list of problems when porting to other platforms. Java
requires a java virtual machine to be installed, and C++ would require
several dynamic libraries to be installed, which may not be desirable on
a firewall.

\section{Configuration}
FIAIF is controlled by multiple configuration files. When fiaif is
started, it reads the file \verb|/etc/fiaif/fiaif.conf|. This files
holds most global configuration directives, and references to
additional configuration files including zone configuration files.

\subsection{Zone specification}
In order for FIAIF to know which zone configuration files to use, each
zone name must be listed in FIAIF global configuration file, named
\verb|/etc/fiaif/fiaif.conf|. This file contains multiple global
configuration directives. In this file, a configuration directive
\verb|ZONE| should be set to a list of identifiers for all enabled
zones. These identifiers must match the name as specified in the
corrosponding zone configuration file. For each zone identifier,
\verb|<zone>|, a configuration directive specifying the name of the
configuration file must be present. The form of these configuration
directives are: \verb|CONF_<zone>=<file name>|. 

\paragraph{Example:}
\begin{verbatim}
ZONE="INT EXT"
CONF_INT='zone.int'
CONF_EXT='zone.ext'
\end{verbatim}
In the example above, two zones are enabled. The zones are named \verb|INT| and
\verb|EXT|. The configuration file for zone \verb|INT| is called
\verb|zone.int|, and the configuration file for zone \verb|EXT| is
called \verb|zone.ext|. It is important that the name specified within
the configuration files correspond to the identifier in the global
configuration file.

The next section will describe in detail how to setup a zone
configuration file. 
