Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225859 > unrolled thread

firewalls

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  firewalls mick crane <mick.crane@gmail.com> - 2020-08-05 01:00 +0200
    Re: firewalls deloptes <deloptes@gmail.com> - 2020-08-05 01:30 +0200
    Re: firewalls Dan Ritter <dsr@randomstring.org> - 2020-08-05 02:00 +0200
      Re: firewalls riveravaldez <riveravaldezmail@gmail.com> - 2020-08-05 04:00 +0200
        Re: firewalls Andrei POPESCU <andreimpopescu@gmail.com> - 2020-08-05 10:10 +0200
        Re: firewalls Dan Ritter <dsr@randomstring.org> - 2020-08-05 13:20 +0200
          Re: firewalls Reco <recoverym4n@enotuniq.net> - 2020-08-05 13:20 +0200
          Re: firewalls deloptes <deloptes@gmail.com> - 2020-08-05 13:30 +0200
            Re: firewalls Kenneth Parker <sea7kenp@gmail.com> - 2020-08-05 13:50 +0200
      Re: firewalls mick crane <mick.crane@gmail.com> - 2020-08-05 08:50 +0200

#225859 — firewalls

I've never really understood firewalls. I think the idea is that they 
don't let anything in that wasn't requested but if you go on a website 
there are so many hundreds of scripts looking at this and that who knows 
what happens.

mick

-- 
Key ID    4BFEBB31

[toc] | [next] | [standalone]

#225860

mick crane wrote:

> I've never really understood firewalls. I think the idea is that they
> don't let anything in that wasn't requested but if you go on a website
> there are so many hundreds of scripts looking at this and that who knows
> what happens.

this is a good point :) especially with a browser that has audio and
probably video hook up and running :D

[toc] | [prev] | [next] | [standalone]

#225861

mick crane wrote: 
> I've never really understood firewalls. I think the idea is that they don't
> let anything in that wasn't requested but if you go on a website there are
> so many hundreds of scripts looking at this and that who knows what happens.

I notice you didn't ask a question, but I'll answer it anyway.

Near the bottom of the stack of networking is a link layer. For
ethernet and related protocols, that means that there's an
address for each interface -- ethernet calls it the MAC address.

If you build a firewall to intercept at this level, you can stop
traffic from specific local sources. That's it. There are
situations where we do this -- layer 2 firewalling -- but they
aren't very common. 

The next layer up, called layer 3, is IP addressing. IP
connections involve IP addresses and IP subprotocols: UDP, TCP,
and so forth. This is where most firewalls operate. An L3
firewall usually starts with a generic directive to drop all
traffic that it doesn't specifically allow, and then has a list
of what to allow to each or all addresses being protected.

So: you can stop all DNS traffic from Cloudflare, but you can't
drop JavaScript embedded in a web page from Google.

To do that, you need what is generically called an
application-layer firewall, and those are usually set up on
individual machines -- though they don't have to be -- and are
frequently supplied with extensive, rapidly-updated block lists.

Some of them you even run *inside* your web browser: uBlock
Origin, for example. Highly recommended.

-dsr-

P.S. you may be wondering why the numbering goes 2, 3,
"application". This is because:

a) the OSI 7-layer model doesn't actually represent real
   networks in this universe
b) everything above layer 3 is kind of squishy
c) most firewalls are actually reflecting the owner's policies
in layers 8 and 9 of the 7-layer model: religion and politics.

[toc] | [prev] | [next] | [standalone]

#225863

On 8/4/20, Dan Ritter <dsr@randomstring.org> wrote:
> mick crane wrote:
>> I've never really understood firewalls. I think the idea is that they
>> don't
>> let anything in that wasn't requested but if you go on a website there
>> are
>> so many hundreds of scripts looking at this and that who knows what
>> happens.
>
> I notice you didn't ask a question, but I'll answer it anyway.
>
> Near the bottom of the stack of networking is a link layer. For
> ethernet and related protocols, that means that there's an
> address for each interface -- ethernet calls it the MAC address.
>
> If you build a firewall to intercept at this level, you can stop
> traffic from specific local sources. That's it. There are
> situations where we do this -- layer 2 firewalling -- but they
> aren't very common.
>
> The next layer up, called layer 3, is IP addressing. IP
> connections involve IP addresses and IP subprotocols: UDP, TCP,
> and so forth. This is where most firewalls operate. An L3
> firewall usually starts with a generic directive to drop all
> traffic that it doesn't specifically allow, and then has a list
> of what to allow to each or all addresses being protected.
>
> So: you can stop all DNS traffic from Cloudflare, but you can't
> drop JavaScript embedded in a web page from Google.
>
> To do that, you need what is generically called an
> application-layer firewall, and those are usually set up on
> individual machines -- though they don't have to be -- and are
> frequently supplied with extensive, rapidly-updated block lists.
>
> Some of them you even run *inside* your web browser: uBlock
> Origin, for example. Highly recommended.
>
> -dsr-
>
> P.S. you may be wondering why the numbering goes 2, 3,
> "application". This is because:
>
> a) the OSI 7-layer model doesn't actually represent real
>    networks in this universe
> b) everything above layer 3 is kind of squishy
> c) most firewalls are actually reflecting the owner's policies
> in layers 8 and 9 of the 7-layer model: religion and politics.

Thanks a lot, Dan.

That was extremely educative (and beautiful).

If I can ask: which is the situation, in this aspect, in a plain
plain/straightforward Debian (net)installation? Let's say: what's the
by-default setting of the system?

Regards

[toc] | [prev] | [next] | [standalone]

#225875

[Multipart message — attachments visible in raw view] — view raw

On Ma, 04 aug 20, 22:56:21, riveravaldez wrote:
> 
> If I can ask: which is the situation, in this aspect, in a plain
> plain/straightforward Debian (net)installation? Let's say: what's the
> by-default setting of the system?

There is no firewall configured by default in Debian.

The configuration between a typical "server" and a typical "client" 
system (desktop, laptop) is different enough to make it very difficult 
to come up with a useful default configuration.

Besides, one can also run services on a client system or use a server as 
client system, etc.

See also this discussion on -devel
https://lists.debian.org/debian-devel/2019/07/msg00332.html

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#225882

riveravaldez wrote: 
> 
> If I can ask: which is the situation, in this aspect, in a plain
> plain/straightforward Debian (net)installation? Let's say: what's the
> by-default setting of the system?


After install you have a powerful L3 firewall system available to
you, but not configured to block anything.

There are two command-line interfaces to it, iptables and
nftables. nftables is the newer interface, but iptables has more
documentation written.

You also have options to install other interfaces to the system.

-dsr-

[toc] | [prev] | [next] | [standalone]

#225883

	Hi.

On Wed, Aug 05, 2020 at 07:11:12AM -0400, Dan Ritter wrote:
> riveravaldez wrote: 
> > 
> > If I can ask: which is the situation, in this aspect, in a plain
> > plain/straightforward Debian (net)installation? Let's say: what's the
> > by-default setting of the system?
> 
> 
> After install you have a powerful L3 firewall system

A small nitpick - netfilter is L4, not L3, although it can be used as
such. netfilter is more than capable of matching IP-based transport
level protocols and their properties.

Reco

[toc] | [prev] | [next] | [standalone]

#225884

Dan Ritter wrote:

> After install you have a powerful L3 firewall system available to
> you, but not configured to block anything.
> 
> There are two command-line interfaces to it, iptables and
> nftables. nftables is the newer interface, but iptables has more
> documentation written.
> 
> You also have options to install other interfaces to the system.

I've been struggling with those for years and tried many tools ... at the
end I ended up with shorewall.

While most of the tools target a single host - perhaps desktop or notebook
computer. I also needed flexibility and simplicity configuring a firewall
with 3 interfaces (DMZ, intranet and internet). I must admit that shorewall
beat it all.

So while some distros like RedHat offer active firewall per default, Debian
gives you the choice what system you will choose to manage the firewall.

It is matter of philosophy and I allow to speak for some of the users here,
that we really appreciate this philosophy of choice.

I don't know about Ubuntu, I would expect it would have a preconfigured
firewall and some kind of Gnome interface to it.

regards

[toc] | [prev] | [next] | [standalone]

#225885

[Multipart message — attachments visible in raw view] — view raw

On Wed, Aug 5, 2020, 7:22 AM deloptes <deloptes@gmail.com> wrote:

> Dan Ritter wrote:
>
> > After install you have a powerful L3 firewall system available to
> > you, but not configured to block anything.
> >
> > There are two command-line interfaces to it, iptables and
> > nftables. nftables is the newer interface, but iptables has more
> > documentation written.
> >
> > You also have options to install other interfaces to the system.
>
> I've been struggling with those for years and tried many tools ... at the
> end I ended up with shorewall.
>
> While most of the tools target a single host - perhaps desktop or notebook
> computer. I also needed flexibility and simplicity configuring a firewall
> with 3 interfaces (DMZ, intranet and internet). I must admit that shorewall
> beat it all.
>
> So while some distros like RedHat offer active firewall per default, Debian
> gives you the choice what system you will choose to manage the firewall.
>
> It is matter of philosophy and I allow to speak for some of the users here,
> that we really appreciate this philosophy of choice.
>
> I don't know about Ubuntu, I would expect it would have a preconfigured
> firewall and some kind of Gnome interface to it.
>

Ubuntu has a package, ufw (Uncomplicated Firewall), as a frontend to
iptables.  It is off, by default.

Along with Debian (and Devuan), I use Xubuntu, for xfce.  I have not tried
the "original" Gnome version of Ubuntu, though I run a Partition with
Buster Gnome.

Kenneth Parker

[toc] | [prev] | [next] | [standalone]

#225871

On 2020-08-05 00:51, Dan Ritter wrote:
> mick crane wrote:
>> I've never really understood firewalls. I think the idea is that they 
>> don't
>> let anything in that wasn't requested but if you go on a website there 
>> are
>> so many hundreds of scripts looking at this and that who knows what 
>> happens.
> 
> I notice you didn't ask a question, but I'll answer it anyway.
> 
> Near the bottom of the stack of networking is a link layer. For
> ethernet and related protocols, that means that there's an
> address for each interface -- ethernet calls it the MAC address.
> 
> If you build a firewall to intercept at this level, you can stop
> traffic from specific local sources. That's it. There are
> situations where we do this -- layer 2 firewalling -- but they
> aren't very common.
> 
> The next layer up, called layer 3, is IP addressing. IP
> connections involve IP addresses and IP subprotocols: UDP, TCP,
> and so forth. This is where most firewalls operate. An L3
> firewall usually starts with a generic directive to drop all
> traffic that it doesn't specifically allow, and then has a list
> of what to allow to each or all addresses being protected.
> 
> So: you can stop all DNS traffic from Cloudflare, but you can't
> drop JavaScript embedded in a web page from Google.
> 
> To do that, you need what is generically called an
> application-layer firewall, and those are usually set up on
> individual machines -- though they don't have to be -- and are
> frequently supplied with extensive, rapidly-updated block lists.
> 
> Some of them you even run *inside* your web browser: uBlock
> Origin, for example. Highly recommended.
> 
> -dsr-
> 
> P.S. you may be wondering why the numbering goes 2, 3,
> "application". This is because:
> 
> a) the OSI 7-layer model doesn't actually represent real
>    networks in this universe
> b) everything above layer 3 is kind of squishy
> c) most firewalls are actually reflecting the owner's policies
> in layers 8 and 9 of the 7-layer model: religion and politics.

thanks for that.
I dunno, have pfsense with community snort on it between me and the ISP 
router so I guess I'm OK with people having a go at the IP address but 
with the browser I imagine you can't filter every packet so somebody who 
doesn't really know what they are doing has to rely on whoever wrote the 
browser I suppose.

mick
-- 
Key ID    4BFEBB31

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web