Why We Wrote This Book

There are a lot of security booksbooks about risk management, cryptography, cracking, hacking, and writing better software, along with many firewall "cookbooks" and "bibles." We wrote this book because there are not many books out there that focus specifically on what to do when something goes wrong with your firewall or that explain how to fix errant firewalls. We wanted to put together a book that would combine the practical elements of fixing specific and common problems with Linux firewalls, along with how to figure out what might be causing a problem we might not have foreseen when we set out to write this book. In our exploration, we found that there was no book that did these things. Nothing existed that reduced all these disparate pieces of knowledge, the Tao of firewall security, the Zen of troubleshooting, and the nitty-gritty, step-by-step instructions to fix a problem. We hope you will agree that this book presents a simple and easy-to-follow methodology for solving problems, along with a practical manual that will give you the tools and the knowledge to fix some of the most common problems users experience when building and maintaining Linux-based firewalls.

When reading this book, realize that our intent is to first provide a methodology that can serve as the baseline for solving problems. We believe that having a good mindset is the most critical tool you can have at your disposal when addressing firewall issues. We cannot cover every possible problem, but we have combed our resources to provide as many common problems encountered with Linux netfilter-based firewalls and the solutions to those problems. We arrived at this list of common problems by researching all of the public Linux firewall mailing lists, by speaking with several large Linux customers, and by reflecting on our own experiences with Linux firewalls spanning over a decade of experience working with Linux. Hopefully we will have covered any problems you might have, but if not, we present our methodology for solving problems in Chapter 5, "The OSI Model: Start from the Beginning."

We have several goals in writing this book, but our chief intent is to make sure you can solve your firewall problems quickly and safely. Plans, strategies, and methodologies, while useful, are no replacement for cold, hard execution. With that intent in mind, this book is really two books. The first book teaches methods, concepts, and abstract ideas to help you learn how to diagnose a problem, to collect information about it, to arrive at a root cause, as well as what tools you can apply to that problem. The second book is a "grab it off the shelf," skim the Table of Contents, find the system/problem, flip to the appropriate page, follow the instructions, and fix the firewall type of book. We want to make sure you can pick this book up and flip to the troubleshooting chapters without having to read the entire book. We're all busy people, and we want to help younot create more work for you.

In short, this book seeks to make engineers into mechanics with a whole tool box full of tools, a shelf full of easy to read manuals, and a mind filled with the necessary knowledge and scientific thinking to fix any problem a firewall might have. If you don't want to take the time to fully understand the mechanics of a problem, it's possible we have the solution already documented in this book. If you want to understand more, you can read the first half of the book.