|
|
netfilter
netfilter is a firewall, NAT and transparent proxy solution for SoL - Server optimized Linux.
It can be used to secure your LAN and give clients in your LAN access to the internet using a SoL gateway.
Traffic from the local clients can be filtered by ports and IPs.
Features
- Easy integration into SoL - Server optimized Linux
- XML firewall, NAT and transparent proxy rulesets.
- Integrated transparent proxy solution!
- Open Source (GPL)
- CISCO VPN CLIENT masquerade support (CVS Version!)
Download
The latest version of netfilter is 1.0
netfilter 1.0 package: netfilter_v1.0.tar.bz2
netfilter on freshmeat.net: http://freshmeat.net/projects/netfilter/
Installation
- Extract the tarball:
tar -yxvf netfilter_*
- Read the installation instructions:
less INSTALL
- Look at the configuration examples: less *.example
Feedback & Links
Example configuration
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE netfilter SYSTEM "netfilter.dtd">
<!-- eth0: external (internet) -->
<!-- eth1: internal (lan) 193.10.10.0/24-->
<netfilter>
<service id="1" sname="loopback" direction="IO">
<rule dev="lo"/>
</service>
<service id="2" sname="icmp" direction="IO">
<rule prot="icmp"/>
</service>
<service id="3" sname="ssh EXT" direction="IO">
<rule dev="eth1" prot="tcp" dport="22"/>
</service>
<service id="4" sname="domain EXT" direction="OUT">
<rule dev="eth1" prot="any" dport="53"/>
</service>
<service id="5" sname="www EXT" direction="IO">
<rule dev="eth1" prot="tcp" dport="80"/>
</service>
<service id="6" sname="ftp EXT" direction="IO">
<rule dev="eth1" prot="tcp" dport="20:21"/>
</service>
<service id="7" sname="ALL INT " direction="IO">
<rule dev="eth0" prot="any" dport="1:65535"/>
</service>
<service id="8" sname="ALL OUT " direction="OUT">
<rule dev="eth1" prot="any" dport="1:65535"/>
</service>
<nat id="1" sname="transperent web proxy" type="redirect">
<rule dev="eth0" source="10.1.1.0/24" prot="tcp" sport="80" dport="3128"/>
</nat>
<nat id="2" sname="Masquerading" type="masq">
<net ext="eth1" int="eth0" nm="10.1.1.0/24">
<rule id="1" prot="tcp" dport="21"/>
<rule id="2" prot="tcp" dport="25"/>
<rule id="3" prot="tcp" dport="80"/>
<rule id="4" prot="tcp" dport="110"/>
<rule id="5" prot="tcp" dport="443"/>
<rule id="6" prot="tcp" dport="143"/>
<rule id="7" prot="icmp"/>
</net>
</nat>
</netfilter>
|
