Moxa TC-6110-T-LX [38/117] Connection tracking

Moxa TC-6110-T-LX [38/117] Connection tracking
TC-6110 Linux User's Manual Managing Communications
3-20
Connection Tracking
A connection tracking system does not filter packets. The Netfilter connection tracking system monitors kernel
memory structures to keep track of the state of each connection; this means that it logs the protocol types,
port number pairs, and source and destination IP addresses, and associates that with various connection
states and timeout values. By being able to track connection states, it is possible to build much more powerful
and secure filtering rules.
There are four states that may be defined for a connection:
NEW
This is the state when a connection is just initiating: the firewall has only seen traffic in one direction (either
inbound or outbound) and if the packet is a valid one for initating a connection (i.e., a SYN packet for a TCP
request).
ESTABLISHED
This is used to describe a connection that has been successfully negotiated, and packet are being
exchanged in both directions.
RELATED
At the application layer there are some protocolslike FTP passive mode, for instancewhich are difficult
to track. FTP passive mode uses a wide range of ports, from 1024 to 65535, rather than just one; tracking
in this connections is much more difficult than simply tracking a connection across a single port (typically
port 20, in FTP). The connection tracking system defines an expectation, which is a connection that is
expected to happen in a set period of time, but that has a limited lifetime. Using helpers and expectations,
the Netfilter connection tracking system is able to track connections according to patterns by defining
master connections, and related connections.
INVALID
This is used to identify packets that do not follow the expected behavior of a connection. Sytems
administrators can set filters to drop them.
Policies: Setting Default Firewall Behavior
Netfilter policies set the default behavior for its built-in tables, and policies may only be set for Netfilter’s
built-in tables. This means that policies set the default behavior for all packets handled by the firewall: if a
packet arrives which no rule can process, Netfilter will default to the root policy set for that connection. Policies
may be set for every table and chain, which means that default policies may be independently set for inbound,
outbound, and forwarded packets.
The default policy for most firewalls should be an across-the-board drop all connections; after setting the
policies to drop all connections, administrators may then add exceptions to allow connections through on a
case-by-case basis. This section will only show you how to set the policies; o see how to write rules, look at the
section below, Writing Rulechains.
WARNING
Firewall rules are ony valid for the time the computer is on. If the system is reboo
ted, the rules will be
automatically flushed. To save a ruleset so that it loads on the next reboot, use the following command:
moxa@Moxa:~# /sbin/service iptables save
Setting Firewall Policies
moxa@Moxa:~# iptables [-t tables] [-P, --policy chain target] [Policy: ACCEPT, DROP,
ETC]
Command Arguments:
-P, --policy: This sets a default policy the firewall will enforce on a particular chain for a particular table.
Only built-in chains (i.e.: not user-defined) can have policies. Possible targets for policy enforcement are

Содержание

Похожие устройства

Скачать