IP
filtering is simply a mechanism that decides which types of IP packets will be
processed normally and which will be dropped or rejected. By dropped we mean that the packet is deleted and
completely ignored, as if it had never been received. By rejected we mean that the firewall sends an ICMP
response to the sender indicating a reason why the packet was rejected. You can
apply many different sorts of criteria to determine which packets you wish to
filter. Some examples of these are:
-
Port number (for TCP/UPD)
-
Packet source address: where it came from
-
Packet destination address: where it is going to
It is important to understand at this point
that IP filtering is a network layer facility. This means that it doesn't
understand anything about the application using the network connections, only
about the connections themselves. For example, you may deny users access to your
internal network on the default Telnet port, but if you rely on IP filtering
alone, you can't stop them from using the Telnet program with a port that you do
allow to pass through your firewall. You can prevent this sort of problem by
using proxy servers for each service that you allow across your firewall. The
proxy servers understand the application that they were designed to proxy and
can therefore prevent abuses, such as using the Telnet program to get past a
firewall by using the World Wide Web port. If your firewall supports a World
Wide Web proxy, outbound Telnet connections on the HTTP port will always be
answered by the proxy and will allow only HTTP requests to pass.
The IP filtering rule set is made up of many combinations of
the criteria listed previously. For example, let's imagine that you wanted to
allow World Wide Web users within the Virtual Brewery network to have no access
to the Internet except to use other sites' web servers. You would configure your
firewall to allow forwarding of the following:
-
Packets with a source address on Virtual Brewery network, a destination address of anywhere, and with a destination port of 80 (WWW)
-
Packets with a destination address of Virtual Brewery network and a source port of 80 (WWW) from a source address of anywhere
Note that we've used two rules here. We have to allow our data
to go out, but also the corresponding reply data to come back in. In practice,
as we'll see in the chapter on IP masquerade and Network Address Translation