Configuring Your Firewall

Always use a hardware-based or software-based firewall on computers connected to the Internet. Fedora includes a graphical firewall configuration client named system-config-securitylevel, along with a console-based firewall client named lokkit. Use these tools to implement selective or restrictive policies regarding access to your computer or LAN.

Start the lokkit command from a console or terminal window. You must run this command as root; otherwise, you will see an error message like this:

$ /usr/sbin/lokkit ERROR - You must be root to run lokkit.

Use the su command to run lokkit like this:

$ su -c "/usr/sbin/lokkit"

After you press Enter, you see a dialog as shown in Figure 34.1. Press the Tab key to navigate to enable or disable firewalling. You can also customize your firewall settings to allow specific protocols access through a port and to designate an ethernet interface for firewalling if multiple NICs are installed. Note that you can also use a graphical interface version of lokkit by running the gnome-lokkit client during an X session.

Figure 34.1. Fedora's lokkit command quickly generates firewall rules in memory for Linux.

Using system-config-securitylevel is a fast and easy way to implement a simple packet-filtering ruleset with filtering rules used to accept or reject TCP and UDP packets flowing through your host's ethernet or designated device, such as eth0 or ppp0. The rules are created on-the-fly and implemented immediately in memory using iptables.

Start system-config-securitylevel from the System Settings menu's Security level menu item. You are prompted for the root password and the client's window then appears. Figure 34.2 shows firewalling enabled for the eth0 ethernet device, allowing incoming secure shell and HTTP requests.

Figure 34.2. Fedora's system-config-securitylevel client can also be used to quickly generate and implement standard or simple custom firewall rules for Linux.

Fedora and Firewalling

Fedora also supports the olderbut still popularipchains packet-filtering software, which can be used to construct effective firewalling rules on Linux firewalls, gateways, servers, and workstations. Linux also supports the more capable iptables, or NetFilter system, which offers additional controls and logging facilities used to build filtering rulesets, or filtering instructions.

Unfortunately, Fedora does not include any command-line or graphical interface utilities you can use to build, save, and test complex iptables rulesets, usually implemented as shell scripts. You need to do this if you want to control outgoing as well as incoming packets. However, you can write your own using a text editor such as vi. Many experienced Linux users hand-tune rulesets for specific applications in advanced network situations, such as development of routing rules.

For a good overview and all the details about using iptables for a variety of gateway and firewall systems, read Robert L. Ziegler's excellent book, Linux Firewalls, Second Edition, available from New Riders. You can also browse to his site at http://www.linux-firewall-tools.com/linux/firewall/index.html, which offers a graphical, web-based firewall design and construction tool you can use to quickly build a custom ipchains-based ruleset file.

You can use Fedora to create a custom firewall, perhaps supporting IP masquerading (also known as NAT) by using either ipchains or iptables. You'll find two sample scripts under the /usr/share/doc/rp-pppoe/configs directory; these are used when connecting to the Internet using a digital subscriber line (DSL).