Iptables
אני עכשיו קורא על איך זה עובד הנה מצאתי הסבר על איך זה עובד אבל זה די מבלבל אותי אני הבנתי הרבה מאוד מזה אבל אני לא ממש מבין את הכול בזה מישהו מוכן בבקשה להסביר בעיקרון איך זה עובד בבקשה? והאם ברגע שיש חבילה שהיא אסורה להכנס לרשת אז היא עוברת דרך FORWARD ונזרקת החוצה? או שהיא עוברת דרך FORWARD ויורדת למטה או שהיא יורדת למטה תמיד ... ואז נבדקת בINPUT? בקיצור אני די מבולבל שמישהו יתן פה איזה הסבר טוב שיבהיר לי את הכול תודה רבה רבה למי שיעזור אני חייב עזרה תודה ! 5. How Packets Traverse The Filters The kernel starts with three lists of rules; these lists are called firewall chains or just chains. The three chains are called INPUT, OUTPUT and FORWARD. This is very different from how the 2.0 and 2.2 kernels worked! For ASCII-art fans, the chains are arranged like so: _____ / -->[Routing ]--->|FORWARD|-------> [Decision] \_____/ ^ | | v ____ ___ / \ / \ |OUTPUT| |INPUT| \____/ \___/ ^ | | ----> Local Process ---- The three circles represent the three chains mentioned above. When a packet reaches a circle in the diagram, that chain is examined to decide the fate of the packet. If the chain says to DROP the packet, it is killed there, but if the chain says to ACCEPT the packet, it continues traversing the diagram. A chain is a checklist of rules. Each rule says `if the packet header looks like this, then here´s what to do with the packet´. If the rule doesn´t match the packet, then the next rule in the chain is consulted. Finally, if there are no more rules to consult, then the kernel looks at the chain policy to decide what to do. In a security-conscious system, this policy usually tells the kernel to DROP the packet. When a packet comes in (say, through the Ethernet card) the kernel first looks at the destination of the packet: this is called `routing´. If it´s destined for this box, the packet passes downwards in the diagram, to the INPUT chain. If it passes this, any processes waiting for that packet will receive it. Otherwise, if the kernel does not have forwarding enabled, or it doesn´t know how to forward the packet, the packet is dropped. If forwarding is enabled, and the packet is destined for another network interface (if you have another one), then the packet goes rightwards on our diagram to the FORWARD chain. If it is ACCEPTed, it will be sent out. Finally, a program running on the box can send network packets. These packets pass through the OUTPUT chain immediately: if it says ACCEPT, then the packet continues out to whatever interface it is destined for.
אני עכשיו קורא על איך זה עובד הנה מצאתי הסבר על איך זה עובד אבל זה די מבלבל אותי אני הבנתי הרבה מאוד מזה אבל אני לא ממש מבין את הכול בזה מישהו מוכן בבקשה להסביר בעיקרון איך זה עובד בבקשה? והאם ברגע שיש חבילה שהיא אסורה להכנס לרשת אז היא עוברת דרך FORWARD ונזרקת החוצה? או שהיא עוברת דרך FORWARD ויורדת למטה או שהיא יורדת למטה תמיד ... ואז נבדקת בINPUT? בקיצור אני די מבולבל שמישהו יתן פה איזה הסבר טוב שיבהיר לי את הכול תודה רבה רבה למי שיעזור אני חייב עזרה תודה ! 5. How Packets Traverse The Filters The kernel starts with three lists of rules; these lists are called firewall chains or just chains. The three chains are called INPUT, OUTPUT and FORWARD. This is very different from how the 2.0 and 2.2 kernels worked! For ASCII-art fans, the chains are arranged like so: _____ / -->[Routing ]--->|FORWARD|-------> [Decision] \_____/ ^ | | v ____ ___ / \ / \ |OUTPUT| |INPUT| \____/ \___/ ^ | | ----> Local Process ---- The three circles represent the three chains mentioned above. When a packet reaches a circle in the diagram, that chain is examined to decide the fate of the packet. If the chain says to DROP the packet, it is killed there, but if the chain says to ACCEPT the packet, it continues traversing the diagram. A chain is a checklist of rules. Each rule says `if the packet header looks like this, then here´s what to do with the packet´. If the rule doesn´t match the packet, then the next rule in the chain is consulted. Finally, if there are no more rules to consult, then the kernel looks at the chain policy to decide what to do. In a security-conscious system, this policy usually tells the kernel to DROP the packet. When a packet comes in (say, through the Ethernet card) the kernel first looks at the destination of the packet: this is called `routing´. If it´s destined for this box, the packet passes downwards in the diagram, to the INPUT chain. If it passes this, any processes waiting for that packet will receive it. Otherwise, if the kernel does not have forwarding enabled, or it doesn´t know how to forward the packet, the packet is dropped. If forwarding is enabled, and the packet is destined for another network interface (if you have another one), then the packet goes rightwards on our diagram to the FORWARD chain. If it is ACCEPTed, it will be sent out. Finally, a program running on the box can send network packets. These packets pass through the OUTPUT chain immediately: if it says ACCEPT, then the packet continues out to whatever interface it is destined for.
