\section{Firewalls}\label{firealls}
This section will describe the purpose of a firewall and outline how
the Linux firewalling code works.

\subsection{Purpose of a firewall}
A firewall is usually placed in front of a group of machines and its
primary function is to control communication from and to this group of
machines. Communication between two machines over the Internet is a
stream of packets (datagrams) send in both directions.  The firewall
examines all packets that is about to be routed through the machine
and, based on a set of rules, determines if the packet is allowed to
pass through the machine or not. This functionality is often referred
as a \textit{packet filter}.

The secondary function of a firewall is to modify the packets passing
through the firewall. This is called \textit{Network address translation
  (NAT)}, as the modifications usually applies to either sender or
receiver information contained in the packets. NAT can for example be used to allow machines
without a public addressable Internet protocol (IP) number, to
access the Internet through a firewall, by using the IP-number of the
firewall as the sender identification. This is also called ip
masquerading, as it disguises the address of the machines behind the
firewall.

\subsection{Netfilter}\label{sec:netfilter}
The firewall implemented in Linux is called \textit{Netfilter}. 

Netfilter implements both a packet filter and NAT and is a statefull
firewall. Statefull firewalls differentiates from non-statefull
firewalls by having knowledge of the state of all connections made
though the firewall. A non-statefull firewall examines packets
individually, without knowledge of previous send packets and has, for
example, no information about which machine instantiated the
communication. This means that in order for machines behind a firewall
to be able to communicate fully with machine on the Internet, almost
all packets must be allowed though the firewall in both directions and
thus greatly degrading the security imposed by the firewall.

As said, a statefull firewall maintains a history of established
communication and defines a state for all connections. In Netfilter
possible states of a connection are:

\begin{description}
\item [New:] This state indicates, that the packet is part of a
  connection that has not been registered (seen) before. 

\item [Established:] This state indicates that the packet is part of
  an already established communication.
 
\item [Related:] This state indicates that the packet is related to an
  already established connection but not part hereof. This is useful
  for protocols that established new connections, such as passive ftp
  data streams and ICMP packets. 

\item [Invalid:] A packet marked invalid means that the packet is
  somehow malformed. Malformed packets are usually packets that does
  not confirm to effective RFC's.
\end{description}

By using these states, it is possible to create a very tight security
policy with only a small set of rules.

\subsubsection{Setting up a Linux firewall}
The most common way to define a firewall, is to have a list of rules
to be traversed for each packet hitting the firewall. A firewall rule
consists of a set of conditions and an action. If the conditions of a
rule is meet, then the action is executed on that packet. Usually the
action is either to accept or reject a packet, and is therefore
usually called the \textit{target} of a rule. Examples of conditions on
a rule is: the source address of a packet, the destination of a packet
etc.

The list\footnote{In Linux called a \textit{chain}} of rules is
traversed until the packet is either accepted or rejected, and
processing stops.  If no rules applies to the packet, the default policy
of the chain determines if the packet is accepted or rejected.

In Linux, the list of rules is maintained in the Linux kernel itself,
and a userspace program, \textit{iptables}, is used to manage rules.
As the placement of rules in the list is vital to the operation of the
firewall, it can be a non-trivial job to implement complex rule-sets
in Linux. For more information of iptables/Netfilter see
\cite{andreasson, netfilter}.

