Subject: New Install question

From: Jeff Donovan <[email-masked]>
Date: Fri, 23 Feb 2001 11:23:50 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Greetings

I am Installing fwtk on a BSDi 4.2 system. My question is concerning 
IP forwarding.

Currently the system I have running is forwarding packets between the 
2 interfaces( ef0 & we0 ). I read that ip forwarding should be turned 
OFF.

does FWTK take care of forwarding the packets or allowing packets to 
pass through to each interface? if yes what is the process that 
handles that?

TIA

--jeff
-- 
------------------------------------------------------------------------
Jeff Donovan                    Network Analyst
Bethlehem Area School District  Information & Communication Technologies
Bethlehem, PA  18020            (610) 807-5571  [email-masked]

---

From: Ted Keller <[email-masked]>
Date: Fri, 23 Feb 2001 12:52:11 -0500 (EST)

Jeff,

The tool kit is a application proxy based firewall.  Individual session
packets are accepted by the proxy - validated - then retransmitted to the
remote computer.  Since it is application proxy based - users must make
connections to the firewall based proxies - authenticate to them - then
request connection to the remote system.  Direct access to the remote
system is not possible.

ted keller

---

From: Rick Murphy <[email-masked]>
Date: Fri, 23 Feb 2001 13:26:36 -0500

At 11:23 AM 2/23/01 -0500, Jeff Donovan wrote:
>does FWTK take care of forwarding the packets or allowing packets to pass 
>through to each interface? if yes what is the process that handles that?

You disable IP forwarding. For any traffic that you want to let through the 
firewall, you use a proxy that determines whether or not to permit the 
traffic. If you enable forwarding, the proxies will never see the traffic 
and you'll be unprotected.
         -Rick

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Thu, 22 Feb 2001 13:09:34 -0600

> 2 interfaces( ef0 & we0 ). I read that ip forwarding should be turned

Yes, You must turn IP forwarding off, since FWTK is an application
level firewall, so it does not block packets  at the level of IP.

> pass through to each interface? if yes what is the process that

In case you want to implement a packet level firewall, you must use
IPChains,
but it's more secure to use FWTK.

Luis

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 23 Feb 2001 15:38:26 -0500

> pass through to each interface? if yes what is the process that 

Absolutely not.  IP forwarding is not secure, and is strongly
discouraged.  [Unfortunately, it's the only way some things will work,
especially UDP services and what Microsoft laughably calls protocols.]

The FWTK is exclusively a set of TCP-service proxies.  Each proxy STOPS
the IP flow for its service.  It initiates a new IP flow with the
resource that the internal user wants to use, and mediates the
transaction.  At no time does any IP flow from inside to outside or
back again.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Michel Bardiaux <[email-masked]>
Date: Sat, 24 Feb 2001 15:23:20 +0100

> but it's more secure to use FWTK.
In another recent thread it was pointed out that to pass HTTP from the
Internet to a web server, one should use plug-gw, *not* http-gw. Since
plug-gw is wholly unaware of stream contents, I don't think it would be
any more secure than ipchains, and ipchains is going to be a lot faster!

Greetings.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Jeff Donovan <[email-masked]>
Date: Mon, 26 Feb 2001 08:27:09 -0500

Greetings,
Ok, since I have to turn IP forwarding "off", how does the data get 
from port A to Port B without some type of forwarding mechanism?

here is what I am working with;

----ntwk A-----portA{ bsdi4.2 }portB----netwk B

This machine was using IP forwarding, and IPFW. I wanted to try FWTK 
as a firewall to either allow services or deny them.

Will FWTK work for what I want to do?

--jeff

>(snip)

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 26 Feb 2001 13:05:40 -0500

> Will FWTK work for what I want to do?

As most responders said,

> >transaction.  At no time does any IP flow from inside to outside or

Let's take Web for example.  Set up Navigator with a proxy of whatever
you call your FWTK machine, port 80, no-proxy list including your Web
server.  When you go to browse:

Local Web server:
	Navigator calls DNS to resolve Web server's name to IP address
	Navigator connects to Web server
	Navigator sends GET to Web server
	Navigator receives HTML back from Web server

External Web server:
	Navigator calls DNS to resolve Proxy's name to IP address
	Navigator connects to Proxy
	Navigator sends GET that includes remote Web server's name, to
		the Proxy server
	Proxy calls DNS to resolve Web server's name to IP address
	Proxy connects to external Web server
	Proxy sends GET to external Web server
	Proxy receives HTML back from external Web server
	Navigator receives HTML back from Proxy

It is important to note that the IP packet that travels between
external site and firewall proxy is NOT the same IP packet that travels
between the internal client and the firewall proxy.  Both connections
TERMINATE at the firewall proxy.  The DATA is taken out of one IP
stream and put into the other.  The external sites see the existence of
no machine but the single proxy server.