Re: [SLE] Firewall zones

On Tuesday 26 September 2006 5:01 pm, Theo v. Werkhoven wrote:
Mon, 25 Sep 2006, by abrahams@xxxxxxx:
I want to configure the SuSE firewall so that communication within my LAN
is uninhibited but communication outside the LAN is fully protected.
Looking at the firewall configuration in Yast, I see that the external
zone is protected but the internal zone is not. However, I don't see how
to specify that the internal zone consists of hosts with addresses
192.168.0.x. This would seem to be a pretty common requirement.

Please be more specific about your setup. Do you have a network-card
with an alias IP address or something?

My network card is assigned its IP address by the router using DHCP.
Incoming traffic is processed using Network Address Translation. I have
several Linux machines with this setup, each cabled to the router.

It appears that the firewall configurator can specify that an interface
is external or internal, but I have only one interface (network card).
It connects to the LAN and to the router; the router in turn talks to the
world. It's a very common setup.

I should have phrased this better. The network card is cabled to the router,
which on its external side is cabled to a broadband modem.

Perhaps, but that doesn't make it the best setup.
Having your LAN systems on the same segment and IP range as the
"firewall" means that there's nothing between the Internet and the
'other' systems, except the router's rules for port-forwarding etc.

The router (a standard D-Link 4-porter) has an internal net address of
192.168.0.1 and assigns the computers on the LAN addresses of the form
192.168.0.x. Seen externally, it has an IP address assigned by Comcast, my
broadband provider, also using DHCP, which Comcast requires.

All the systems on the LAN are supposed to have the same firewall protection,
using SuSE firewall (or in some cases the Windows firewall). So each machine
has two levels of protection: the router, which itself provides pretty good
protection, and the firewall on the individual machine. The main weakness of
the router firewall is that it doesn't filter outgoing packets, only incoming
ones.

If you want to have a better protection I'd look for a "real" router, that
can be configured for multiple LAN IP ranges, or setup the Linux
machine as such.

I'd settle for any degree of protection as long as I can share files with
other machines on the LAN. Sharing could be either with NFS or with Samba.

Thanks for your help.

Paul

--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-help@xxxxxxxx
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-faq@xxxxxxxx

Relevant Pages

  • Re: Just venting (totally OT)
    ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... not visiting dodgy Websites. ... The protection that it does supply is also provided by ...
    (uk.people.support.depression)
  • Re: Just venting (totally OT)
    ... how long it plays for because it's all been ripped on to hard disc ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... The protection that it does supply is also provided by ...
    (uk.people.support.depression)
  • Re: Just venting (totally OT)
    ... long it plays for because it's all been ripped on to hard disc so it ... I'm paranoid about opening up my firewall "just in case..." ... having the protection of a router, not opening dodgy emails, and not ... The protection that it does supply is also provided by your router ...
    (uk.people.support.depression)
  • Re: Just venting (totally OT)
    ... that's yer basic rock solid protection that makes a firewall pretty much ... hidden behind a router. ... left to passive traps like viruses and spyware. ... It's another level of protection which doesn't duplicate what you've ...
    (uk.people.support.depression)
  • Re: How to stealth against ping/echo requests?
    ... I just started using the Online-Armor firewall. ... Some ports are even open. ... Are you behind a router? ... Every time it founds a new LAN, it asks if you want to trust it ...
    (comp.security.firewalls)