El documento describe las funciones de una pasarela y un cortafuegos. Una pasarela conecta dos redes y realiza la conversión de protocolos entre ellas, permitiendo que las máquinas de una red local accedan a una red exterior como Internet a través de operaciones de traducción de direcciones IP. Un cortafuegos controla el tráfico de entrada y salida de una red para prevenir comunicaciones prohibidas según las políticas de seguridad.

1. Configuración de Firewalls y Pasarelas para Internet

2. Índice de contenidos Introducción Pasarelas Firewalls Bridging

6. Muchas opciones

7. Galnix

8. Galnix

10. Introducción La idea principal de un cortafuegos es crear un punto de control de la entrada y salida de tráfico de una red. eth0 eth1 IN IN OUT OUT OUT OUT

38. Pasarelas - configuración

39. Pasarelas - configuración

40. Pasarelas - configuración

41. Pasarelas - configuración

48. Firewalling

75. Bridging - Introducción

78. Bridging - Switch

79. Bridging - Switch

81. # brctl commands: addbr <bridge> add bridge (1) addif <bridge> <device> add interface to bridge (2) delbr <bridge> delete bridge (3) delif <bridge> <device> delete interface from bridge (4) show show a list of bridges (5) showbr <bridge> show bridge info (6) showmacs <bridge> show a list of mac addrs (7) setageing <bridge> <time> set ageing time (8) setbridgeprio <bridge> <prio> set bridge priority (9) setfd <bridge> <time> set bridge forward delay (10) setgcint <bridge> <time> set garbage collection interval (11) sethello <bridge> <time> set hello time (12) setmaxage <bridge> <time> set max message age (13) setpathcost <bridge> <port> <cost> set path cost (14) setportprio <bridge> <port> <prio> set port priority (15) stp <bridge> <state> {dis,en}able stp (16) Bridging - Comandos

82. # brctl addbr mibridge1 # brctl stp mibridge1 off -> desabilitar opción spanning tree protocol # ifconfig eth0 down -> bajamos la interfaz para borrar configuraciones # ifconfig eth0 0.0.0.0 up -arp -> habilitamos interfaz modo promiscuo # ifconfig eth1 down # ifconfig eth1 0.0.0.0 up -arp # brctl addif mibridge1 eth0 -> añadimos interfaces al bridge # brctl addif mibridge1 eth1 -> añadimos interfaces al bridge # ifconfig mibridge1 0.0.0.0 up -arp # brctl show bridge name bridge id stp enabled interfaces mibridge1 8000.00105ade368a no eth0 eth1 Bridging - Comandos

83. mibridge1 Link encap:Ethernet HWaddr 00:10:5A:DE:36:8A UP BROADCAST RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:29431886 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2292971244 (2.1 GiB) TX bytes:0 (0.0 b) eth0 Link encap:Ethernet HWaddr 00:E0:7D:9A:77:EB UP BROADCAST RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:1177453418 errors:89 dropped:747 overruns:67 frame:0 TX packets:803197123 errors:0 dropped:0 overruns:8 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2253367088 (2.0 GiB) TX bytes:2649549007 (2.4 GiB) Interrupt:10 Base address:0x6500 eth1 Link encap:Ethernet HWaddr 00:10:5A:DE:36:8A UP BROADCAST RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:803504797 errors:0 dropped:0 overruns:37 frame:0 TX packets:1161554958 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2691578187 (2.5 GiB) TX bytes:3973246327 (3.7 GiB) Interrupt:9 Base address:0x6600 eth2 Link encap:Ethernet HWaddr 00:10:4B:50:AD:16 inet addr:193.147.87.182 Bcast:193.147.87.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:21430860 errors:0 dropped:0 overruns:0 frame:0 TX packets:55023 errors:0 dropped:0 overruns:0 carrier:1 collisions:180 txqueuelen:1000 RX bytes:1517793836 (1.4 GiB) TX bytes:9440840 (9.0 MiB) Interrupt:11 Base address:0x6700 Bridging - Comandos

84. # brctl showbr mybridge1 mybridge1 bridge id 8000.00105ade368a designated root 8000.00105ade368a root port 0 path cost 0 max age 4.00 bridge max age 4.00 hello time 1.00 bridge hello time 1.00 forward delay 4.00 bridge forward delay 4.00 ageing time 300.00 gc interval 4.00 hello timer 0.84 tcn timer 0.00 topology change timer 0.00 gc timer 1.84 flags eth0 (1) port id 8001 state forwarding designated root 0000.0800062815f6 path cost 100 designated bridge 0000.0800062815f6 message age timer 0.00 designated port 8001 forward delay timer 0.00 designated cost 0 hold timer 0.84 flags eth1 (2) port id 8002 state forwarding designated root 0000.0800062815f6 path cost 100 designated bridge 0000.0800062815f6 message age timer 0.00 designated port 8002 forward delay timer 0.00 designated cost 0 hold timer 0.84 flags Bridging - Comandos

85. # brctl showmacs mibridge1 port no mac addr is local? ageing timer 1 00:10:4b:b6:c6:e4 no 119.25 1 00:50:04:43:82:85 no 0.00 1 00:50:da:45:45:b1 no 76.75 1 00:a0:24:d0:4c:d6 yes 0.00 1 00:a0:24:f0:22:71 no 5.81 1 08:00:09:b5:dc:41 no 22.22 1 08:00:09:fb:39:a1 no 27.24 1 08:00:09:fc:92:2c no 53.13 4 08:00:09:fc:d2:11 yes 0.00 1 08:00:09:fd:23:88 no 230.42 1 08:00:09:fe:0d:6f no 144.55 Bridging - Comandos

86. #Indicación de las tarjetas de red físicas $PROG -A FORWARD -m physdev --physdev-in eth0 --physdev-out eth1 -j &quot;FW-int->lan&quot; #Indicación de las tarjetas de red físicas $PROG -A FORWARD -m physdev --physdev-in eth1 --physdev-out eth0 -j &quot;FW-lan->int&quot; #Indicación de las tarjetas de red físicas $PROG -A FORWARD -m physdev --physdev-in eth1 --physdev-out eth1 -j &quot;FW-lan->lan&quot; Bridging - Netfilter