What is the linux firewall module

In Linux, the firewall module refers to the information security system set up between the Internet and the corporate intranet, which monitors incoming and outgoing transmissions according to the company's predetermined policies; there are two firewalls in Linux, iptables and firewalld. iptables is closer to the original operation of data and has higher accuracy, while firewalld is easier to operate.

#The operating environment of this tutorial: linux7.3 system, Dell G3 computer.

What is the Linux firewall module

In the field of computer science, the firewall (Firewall) is an information security system set up between the Internet and the corporate intranet. It is monitored according to the company's predetermined policies. Transmissions to and from.

The firewall may be a dedicated network device or run on the host to inspect network transmission on each network interface. It is currently the most important network protection equipment. From a professional perspective, a firewall is a set of hardware or software that is located between two (or more) networks and implements inter-network access or control. ##There are two firewalls in Linux: iptables and firewalld

iptables: closer to the original operation of data, with higher accuracy
firewalld: easier Operation

Firewall classification

Logical level

From the logical level Generally speaking, firewalls can be roughly divided into host firewalls and network firewalls

Host firewalls: mainly protect a single host
Network firewalls: often Located at the network entrance or edge, it protects the network entrance and serves the local LAN behind the firewall.
The network firewall and the host firewall do not affect each other. It can be understood that the network firewall is responsible for the outside (collective ), the host firewall is responsible for the internal (personal)

Physical level

Physically speaking, firewalls can be divided into hardware firewalls and software firewalls

Hardware firewall: Some firewall functions are implemented at the hardware level, and other functions are implemented based on software, with high cost and high performance.
Software firewall: Application processing software logic runs on a universal The firewall on the platform has low cost and low performance

Function of the firewall

Intrusion detection function

One of the main functions of network firewall technology is the intrusion detection function, which mainly includes anti-port scanning, detection of denial of service tools, detection of CGI/IIS server intrusion, detection of Trojan or network worm attacks, and detection of buffers Functions such as overflow attacks can greatly reduce the intrusion of network threat factors and effectively block most network security attacks.

Network address translation function

Using firewall technology can effectively realize IP address translation of the internal network or external network, which can be divided into source address translation and destination address translation, that is, SNAT and NAT. SNAT is mainly used to hide the internal network structure to avoid illegal access and malicious attacks from the external network, effectively alleviating the shortage of address space, while DNAT is mainly used for external network hosts to access internal network hosts to avoid internal network attacks.

Audit monitoring function of network operations

Through this function, all operations and security information of system management can be effectively recorded, and information on network usage can be provided. Statistical data to facilitate computer network management for information tracking.

Strengthening network security services

Firewall technology management can realize centralized security management, and assemble the security system on the firewall, in the way of information access This enables the supervision of network information security.

Three tables and five links of the firewall
##Three tables: filter table, nat table, mangle table

The first table: filter table: puts the ip input output forward that passes through the kernel

The second table: nat table: puts the service input output that does not go through the kernel postrouting prerouting

The third table: backup table mangle: input output forward postrouting prerouting

Five chains: input, prerouting, forward, postrouting, output

Table function and kernel module

Five chains: input, prerouting, forward, postrouting, output

##INPUT and OUTPUT are both Including information that passes through the kernel and does not pass through the kernel

FORWARD is the routing and forwarding information that passes through the kernel

POSTROUTING is the information that does not pass through the kernel routing

PREROUTING is the information that does not pass through the kernel routing Previous information

Recommended learning:

Linux video tutorial

The above is the detailed content of What is the linux firewall module. For more information, please follow other related articles on the PHP Chinese website!