# The &kappname; Handbook

## Introduction

&kappname; is a user friendly firewall generation and management utility for KDE running on Linux. It allows you to simply specify which network protocols should be allowed between which groups of computers without requiring you to have knowledge of port numbers or packets. &kappname; is built on top of Linux's `ipchains` and `iptables` packet filtering commands.

### What is a firewall and why do I need one?

A firewall is a software and/or hardware tool for defending a computer or network of computers, from attacks via the network performed by malicious or curious computer users. It protects by restricting what hostile computers are permitted to do to the protected computers. It does this by filtering and blocking the network communication between the protected computers and the Internet at large.

With the arrival of fast, permanent, 24 hour/7 day, internet connections for home users, your computer is now exposed to constant attacks from anywhere in the world. You may ask yourself "why would anyone want to break into my computer? I don't have anything important". Actually you do, even a home computer stores usernames and passwords for connecting to the internet, personal email, possibly financial information and perhaps even credit card information. Even without these things, your computer can be used as a stepping stone by malicious users (often called 'crackers') to attack other computers. The worst part of this is that these further attacks will look like they are coming from you!

For more introductory material about firewalls try the firewall article over at How Stuff Works.

### A Warning: No Silver Bullet Here

I will now try to explain the nature of computer security and how a firewall fits into the picture. The majority of security holes are quite simply caused by bad software. Security holes are not created by 'hackers' or 'crackers'. They merely find and exploit already existing flaws in software. Security holes are usually just bugs or flaws in software itself that can be taken advantage of for malicious purposes.

What a firewall does is try to put up a barrier with the bad guys on one side and your possibly vulnerable software and services on the other. It tries to stop attackers from gaining any kind of access to servers and software running on machines behind the firewall. With no access, attackers shouldn't be able to leverage flaws in the software you are running. Unfortunately this approach of protection by disconnection only goes so far because the whole point of having a network is to allow computers on the network to communicate with each other. Simply put, for the network to be useful you need to put 'holes' in the firewall to allow communication or access between the protected computers and the outside world. A firewall offers no protection from accesses that occur via 'holes' in the firewall. For example, if you are operating a web server that can be accessed from the outside, then the firewall will do nothing to protect you from attacks aimed at your webserver.

A firewall should be just a part of your approach to security, and not the whole thing. Here is a quick list of effective tips to greatly increase the system's security. This advice will also apply to other computer systems too:

- Number one. Make sure you get and install security fixes for the software you are using on your computer systems. The best way to stop attackers from exploiting flaws in the software you use, is to remove the flaws. Go to the website for the Linux distribution you are using and go to the security section or updates section regularly to see if security updates, patches, or bug fixes are available. Most modern Linux distributions these days also include tools for automatically checking for software updates. Learn about and use these tools.

- Don't install software that you don't need or use. This is especially true for network oriented software like servers and network client software. Most Linux distributions install an incrediable amount software by default. Most of it you won't need. Make sure you uninstall any unneeded software after installing a new Linux system. Another strategy is at install time to choose a 'minimumal' install if your distribution offers that choice, and then after the installation install any additional software that you may need.

- The maker of the Linux distribution that you are using will have a security announcement mailing list. Find it on thier web site and join it to hear about security fixes as soon as they become available.

- If a piece of software you are using has a bad security record and is still having security problems found in it, seriously consider changing to a better, safer alternative.

If you follow these tips, even without a firewall, your systems be about one hundred times more secure.

### Why use &kappname;

- Easy to use goal oriented user interface. You say what the firewall should do without having to explain all the details of how it should do it.

- Application protocol based. Unlike other tools, &kappname; does not require you to understand the ins and outs of IP packets and ports. &kappname; takes care of this for you. This also reduces the chances of configuration mistakes being made which are a prime source of security holes in computer systems.

- Doesn't just generate an initial firewall and forgets it. &kappname; is used to maintain and modify the firewall in place.

- Can be used in workstation and router configurations.

- Allows you to divide your network into groups of machines and control what network protocols are allowed between them.

- Works on the older Linux kernel 2.2 series `ipchains` firewall subsystem, and also on newer Linux kernel 2.4 netfilter/ `iptables` firewall subsystem.

- Takes advantage of advanced Linux kernel 2.4 features such as connection tracking and rate limited logging.

- Licensed under the terms of the GPL. Is Free and will remain Free.

## Using &kappname;

### Tutorial: Basic Configuration

In this tutorial I will explain some basic networking concepts and how to quickly setup &kappname; to protect a single workstation.

#### Starting &kappname;

First start up &kappname;. For recent Mandrake and Redhat systems there should be a &kappname; menu entry on the K menu under Configuration/Networking. You will then immediately be asked for the password for the 'root' user. This is required because &kappname; needs administrator access in order to modify the computer's networking sub-system.

Once &kappname; has opened it's window you will see that the user interface is divided across four tabs. For this tutorial we will ignore the the Zone, Logging and Advanced tabs and concentrate on the Protocol tab.

#### Basic Networking Concepts

(Skip this section if you understand network protocols and the "Client Server Model".)

Now I must explain what a protocol is. Computer networks are all about computers talking to other computers. And just like when talking to other person in the real world, it helps if you both agree to speak the same language, be it English, Dutch or Sign Language. The same thing applies to computers on networks. They need to agree on what language they are going to speak when talking to another computer. These 'languages' are know as network protocols. An important difference between human languages and network protocols is that protocols are usually only intended for one particular task, like moving files (for example, FTP, the File Transfer Protocol), fetching web pages (for example, HTTP, the HyperText Transmission Protocol) or chatting with other computer users (for example, IRC, Internet Relay Chat).

Attacks against computer systems across a network are performed by using and abusing protocols and the software that implements them. All too often the software implementing a protocol contains flaws that can be exploited by malicious people to gain access to a system, or to disrupt it.

One more important concept to understand about network protocols is the "Client Server Model". All network protocols involve at least two different parties communicating. Although each party is using the same protocol, quite often they will have different roles to play in that protocol. The most common model is where one party acts as a "client" while the other acts as a "server" who responds to requests from the "client". A very close analogy in the real world would be buying fries down at the local fast food restaurant. You and the person behind the counter would both be using English as the communication protocol, but in this situation you both have different roles. You would have the role of "client" while the person serving you would be acting as the "server", basically doing what the "client" requests. HTTP, the protocol used on the World Wide Web uses a the "Client Server Model". Your web browser acts as the client while the big web server at Slashdot or CNN acts as the server, delivering pages back to your browser when it asks for them.

#### Permitting DNS

(Skip the next paragraph is you know what DNS is.)

The Protocol tab is where you specify which protocols may be used between your computer and the internet. The "Domain Name System" protocol, commonly known as DNS, is a very important protocol. All machines on the internet have what is known as an IP address, which is just a number. You may have seen some before. They are often written as a "dotted quad" like "195.231.34.5" for example. An IP address is sort of like a telephone number, except that it's for identifying computers on the internet and not telephones. One problem with using IP addresses to identify machines is that it's not very human friendly. This is why "Domain Names" were invented. A "Domain Name" is just a human friendly name for a machine. Some examples of domain names are www.simonzone.com, www.cnn.com and dot.kde.org. But to use the internet your computer needs IP addresses, and not "domain names". This is where DNS comes in. It bridges the gap between "Domain Names" and IP addresses. It is a system for turning human friendly names like www.simonzone.com into computer friendly IP addresses. Machines on the internet known as DNS Servers do nothing except answer queries from other machines wanting to know what IP address matches which domain name. Much like how a telephone directory matches people's names and address to telephone numbers. By using a DNS server your computer knows what you are talking about when you ask for www.slashdot.org. Without DNS your web browser won't know where to find www.cnn.com, and ICQ chat client won't be able to find the chat network at icq.com either. Without DNS most other protocols don't work.

Lets go through the steps involved for permitting our computer to use the DNS protocol to communicate with DNS servers on the internet.

- Go to the Protocol tab.

- First make sure that Internet is selected in the Defined Network Zones: list. (It's at the top left corner in the window.) The list should have two entries, Internet and Local.

- Open the Network part of the list view control in the center of the window. It should expand to show more options and check boxes with entries like ICMP Redirect and DNS - Domain Name Server for example.

- To the right of the protocol list is a black box in the Local column. The box is a check box. Click on it until it shows a check mark (tick). The box has three states, unchecked, checked and crossed. Just repetitively click on it to cycle through the states.

Done. That is all you need to do to grant your machine permission to access DNS servers on the Internet. Your screen should look like the picture below.

Reading the protocol tab Reading the protocol tab

This illustration also summarises how to read all of the information presented on the Protocol tab. There is a lot of information packed into this one tab, but it is vital that you understand what it means so that you can avoid misconfiguration.

#### Protocol Organisation

Once we have DNS permitted we can move on to permitting other common protocols that we might want to use.

&kappname; supports many different network protocols. They are organised into categories to make it easier to find what you want. The different categories are:

- Chat - Protocols used by chat programs like IRC and ICQ.

- Data Serve - Protocols used by databases and other data sources like time servers for example.

- File Transfer - Protocols used to transfers files. HTTP for the Web and FTP are very good examples.

- Game - Protocols used by games for online multiplayer gaming.

- Interactive Session - Protocols used for working on or performing actions on a remote system. SSH Secure Shell, telnet and also RPC protocols are here.

- Mail - Protocols associated with delivering and moving email. SMTP and POP3 are under here.

- Media - Protocols used for delivering multimedia across the internet.

- Miscellaneous - Other protocols that really didn't fit under the other categories.

- Network - Protocols related to the operation of the network itself.

- User Defined - Protocols defined by the user on the Advanced tab appear here.

Naturally there is some overlap and some protocols could easily be placed under a different category than the end they are currently in.

Click on the name of a protocol to quickly get information about it. A description of the protocol will appear in the area in the lower left corner of the window.

#### Permitting Common Protocols

Here is a quick list of the most common protocols that you will probably want to permit.

- HTTP - Used on the World Wide Web to move web pages around. If you want to browse the web you will need this. It's in the File Transfer category.

- FTP - File Transfer Protocol. Used for uploading and downloading files. Also commonly used on the web too. If you have seen something like "ftp://" in the location bar on your web browser, then you have used FTP. FTP is in the File Transfer category.

- SMTP - Simple Mail Transport Protocol. Used for sending email around the internet. It's in the Mail category.

- POP3 - Post Office Protocol version 3. Commonly used for picking up and downloading email from a mailbox located at an ISP. It's in the Mail category.

Resist any temptation to permit all protocols. The more protocols you permit the weaker your firewall will be. The idea is to only permit the protocols you really need, and no more. Don't permit something just in case you might need it in the future. If you need to permit another protocol in the future then you can just come back to &kappname; and turn it on.

#### Applying your new Firewall

Changes made in &kappname; don't take effect immediately. To activate your changes you need to press the Apply button or the OK button. The Ok button will also quit the &kappname; once the firewall is in place. &kappname; will then set up the networking subsystem on your machine with your new firewall rules. Once you click on the Ok or Apply button a warning message appears to warn you that changing the system's firewall may disrupt existing network connections. Generally it is not a good idea to be doing anything important on your network, like an FTP download for example, when you Apply the firewall. After you click on the warning's OK button another popup window will appear, showing the firewall setup progress. If any errors occurred while setting up the firewall, they will be shown in the popup. Click on the OK button to exit the popup window.

Done! Your new firewall should now be in place and working. From now on whenever your system starts it will automatically be set up to use your firewall. &kappname; does not have to be constantly running to protect your computer. As your firewalling needs evolve you can just run &kappname; again and modify the configuration.

To see if your firewall is doing its job you can put it too a bit of a test. Go over to Gibson Research Corporation and head towards the "Shields Up!" area and ask it to "Test My Shields!" or "Probe My Ports!". It will then scan your machine and give you a report on what it found. Hopefully it should give you a very positive report.

### Tutorial: Using Zones

In this tutorial we will build on what we have learnt in the first tutorial and introduce the concept of Zones. Zones allow you to precisely control which protocols are permitted between different groups of computers.

#### Introducing Zones

In &kappname; a zone is just a bunch of IP addresses. You may recall that IP addresses are like telephone numbers for machines on the internet. A zone more or less specifies a group of computers. Once a zone has been created we can use the Protocol tab to specify which protocols computers in the zone may use.

For example. If we know that the people at evil.com are evil and can not be trusted, then we can restrict thier access to our computer by using zones. First we create a zone called "Bad Guys" and place evil.com in it. Next we go to the Protocol tab and make sure that no protocols are selected between the "Bad Guys" zone and the "Local" zone. (The Local zone represents the local machine). This way we can limit, or even completely block evil.com's access to our computer.

Placing the Bad Guys in a zone and firewalling them out Placing the Bad Guys in a zone and firewalling them out.

#### Editing Zones

Zones are specified and edited on the Zone tab. To the left of the Zone tab is the list of defined zones. &kappname; has two builtin zones that you can't change. They are Local and Internet. Local is a zone simply containing the local machine; the machine that &kappname; is running on. Internet corresponds to any IP address that's not in another zone. Put simply, if a IP address is not in another zone it is assumed to be in the Internet zone.

The information about the currently selected zone are displayed to the right of the zone list. Each zone has a name which is used on the Protocol tab and therefore should be kept fairly short. A more descriptive comment can also be given to a zone.

The list of IP addresses in a zone are shown in the Zone Addresses list.

Zones that the currently selected zone may communicate with, are listed in the Connection list located on the right side of the window.

The Zone tab. The Zone tab.

An IP address should only be in one zone at a time.

#### Creating a Demilitarised Zone

Let's put zones to work.

A good use of zones is to harden our firewall by setting up a "Demilitarised Zone" (DMZ). In network security a DMZ is a group of computers located between the internet and an organisation's internal computer network. Computers in the DMZ are exposed to the internet and usually performing tasks like serving web pages to public or handling email. Since these machines are exposed to the internet and constant attack from outside, thier access to the internal network is restricted. The idea is that if an attacker gains control of a machine in the DMZ, they won't automatically gain higher access to the organisation's internal computer network.

Even if you are not managing an internal network or a group of web or email servers, you probably do make use of a group of computers that could be considered to be in a DMZ. For this tutorial we will set up a DMZ containing the mail server you use for sending and receiving email.

Go to the Zone tab and click on the New Zone button to create a new zone. The new zone will appear in the zone list and will be called new zone. Go up to the Name text box and change new zone to say "DMZ". The name should be fairly short, but you may put a longer, more descriptive comment in the Comment text box.

On the right side of the window is the Connection list. It is just a group of check boxes that let you specify which other zones the currently selected zone is connected to. Put a tick in Local check box to indicate that the DMZ zone is connected to the Local zone. The combination of DMZ and Local zone will only be available on the Protocol tab when this check box is ticked. &kappname; will block all communication between zones that are not connected to each other.

Now move over to the Protocol tab and make sure that Protocols Served from Zone: is set to DMZ. In the protocol list below there is a column called Local. Open up the Mail group of protocols and tick POP2, POP3, and SMTP. POP3 is used to fetch mail from a mail box on a mail server. While SMTP is used for sending outgoing mail. By turning these on for Local we are saying that we want the local machine to be allowed to use these mail protocols with the machines in the DMZ zone.

If the machines in your DMZ are also web servers you may also want to turn on HTTP, FTP and some other common protocols.

Once you have finished configuring &kappname;, apply your changes with the Apply button and test your email program to see if you can still send and receive email.

### Tutorial: Router Configuration

So far we have only used &kappname; to protect a single workstation (i.e. the computer &kappname; is running on), but as many people know a computer running Linux can also act as a fantastic router for connecting multiple networks. In this tutorial we will go through how &kappname; can be used on a gateway machine to protect a LAN from the internet.

&kappname; only supports router configurations on machines running Linux kernel series 2.4 or later with `iptables`.

#### Anatomy of a typical LAN connected to the Internet

A typical router or gateway configuration with &kappname; running on the router machine. A typical router configuration with &kappname; running on the router machine.

The diagram above shows the network configuration of a typical LAN connected to the Internet via a Linux based system acting as a router. The LAN that we wish to protect is on the left side of the diagram. The internet is shown on the right side. All communication between the LAN and internet passes through the gateway machine which is marked by the dog. &kappname; runs on the gateway machine. The most important aspect of this setup from a security point of view is that all of the network traffic between the LAN and the internet passes through one machine: the gateway. This provides us with an obvious "choke point" that we can place the firewall on to filter the network traffic.

The diagram also shows the zones that we will setup in &kappname;.

#### "Repeat after me: &kappname; is a firewall"

There seems to be a bit of confusion surrounding the function of a firewall versus the task of packet routing. Firewalls act as network traffic filters. Filtering and blocking unwanted and dangerous network traffic. They are security devices. Features such as routing and IP masquerade are not primarily security devices. They are advanced networking features.

This misconception arose because in the past on Linux, before kernel series 2.4, the networking sub-system was such that it wasn't possible to separate advanced routing functionality from normal firewall functionality. This lead to firewall programs that also included direct support for advanced routing features such as IP masquerade and port forwarding for example.

&kappname; is a firewall and is not used for configuring networking features such as IP masquerade and routing. These networking features must be configured using a different program.

Guidedog is a user friendly utility for configuring advanced networking features and is designed to work along side &kappname;.

#### Configure Routing and Network Settings

Before we continue, you should go and configure the routing setup for your machine and confirm that it is routing/masquerading network traffic as expected. To make the task of debugging your gateway configuration easier, you can disable &kappname; by checking the Disable firewall checkbox on the Advanced tab and then applying the changes. This will allow you to test your routing setup separately without &kappname; blocking any test traffic.

I strongly recommend that you do not test your network setup while connected to a hostile network like the Internet. Attach a machine to the network card that you plan to connect to the internet and give it an IP address so that it can act as a pretend Internet.

#### Teaching &kappname; to Allow Traffic to/from your LAN

If you configured and tested your routing and network settings with &kappname; disabled, enable firewalling in &kappname; again and apply. If all is going well then you will find that your LAN is once again totally cut off from the internet. &kappname; has a fail-safe, "what is not explicitly permitted, is denied" design. What this means in this situation is that since &kappname; hasn't been told to allow traffic from your LAN out to the internet, or visa versa, it will assume that the traffic should be blocked. This is intended to make it easy to get a secure configuration (even if it is too secure) and difficult to have an insecure configuration.

The way we specify to &kappname; that computers on the LAN are allowed to access computers on the Internet is by using zones. We simply create a zone to hold the addresses of all of the computers on our LAN and then specify that this zone is connected to the Internet, and probably to the Local zone also, and then go to the Protocols tab and tick on whatever protocols should be allowed between the LAN and the Internet.

#### Step by Step

Go to the Zone tab and create a new zone and call it "LAN". In the Zone Addresses list enter the IP addresses of the computers on your LAN. The address list understands several notations for addresses and can also accept whole network blocks. If you are running an IP masqueraded network using the 192.168.1.0/255.255.255.0 private address space, you can enter the whole block into a single address line using 192.168.1.0/255.255.255.0 format or the shorter 192.168.1.0/24 format.

Next, go to the Connection list and tick Internet and Local to specify that your LAN zone should be connected to the Internet and Local zones.

Now, go to the Protocol tab and make sure that Protocols Served from Zone: is set to Internet. In the list of protocols below you should see a column of check boxes for the Local zone and another column for the LAN zone. Just like when we were turning on protocols for the local zone in the first tutorial, we can do the same for the LAN zone. Tick the list of protocols that machines in the LAN zone should be able to use with the Internet.

When you are ready, apply the changes and see if your machines on your LAN can access the internet. That's all there is to it.

### Important Notes

Here are some important notes concerning the use of some protocols.

#### Windows Networking (NETBIOS)

If your computer is connected to a LAN that you want to use NETBIOS on, there is a little extra you need to do to get things working smoothly. Basically, create a zone for your LAN, which you probably have done anyway, and make sure that the broadcast address of the LAN is is also in the list of zone addresses.

If you don't know what the broadcast address for your LAN is, the simplest way is to go to shell and run the command `/sbin/ifconfig`. You will see something similar to this:

    eth0      Link encap:Ethernet  HWaddr 00:50:FC:2A:AB:7A
              inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:0 errors:0 dropped:0 overruns:0 frame:0
              TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:100
              RX bytes:0 (0.0 b)  TX bytes:240 (240.0 b)
              Interrupt:10 Base address:0x4000

    lo        Link encap:Local Loopback
              inet addr:127.0.0.1  Mask:255.0.0.0
              UP LOOPBACK RUNNING  MTU:16436  Metric:1
              RX packets:992 errors:0 dropped:0 overruns:0 frame:0
              TX packets:992 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:76568 (74.7 Kb)  TX bytes:76568 (74.7 Kb)

This is a list of the network interfaces that your computer has. Your list will probably be different of course. The names of the network interfaces are listed on the left side. You need to go to one that corresponds to you LAN. It will typically be called `ethX`. It's also possible that you will have multiple `ethX` entries, especially if you also have cable internet access or ADSL. Once you have found the entry look for `Bcast:`. This is the broadcast address for the network connected to that network interface. Put this broadcast address in your LAN zone's list of IP addresses.

#### Nmap and Nessus Scanning

It is not possible to do effective scanning with nmap or nessus through, or from out of, a machine running &kappname;. The reason is that firewalls are designed to block the kind of unusual and "hostile looking" network traffic that these kinds of programs produce. A firewall can't distinguish between friendly scan traffic produced by you, and unwanted scan traffic produced by intruders, so it blocks both types.

#### Telstra BigPond Cable

People in Australia using Telstra's BigPond cable for internet access need to make sure that Telstra's `dce-server` machine is permitted to serve BigPond Cable Login to your local machine. This is needed for logging on to BigPond and also to allow the 'heartbeat' that BigPond uses to check that your machine is still online.

One thing you could do is create special zone for the important BigPond servers that also serve mail etc and then make sure that `dce-server` is entered in there, and then permit BigPond Cable Login protocol and whatever mail and web protocols you want, to be served from there.

#### X Window System

In X Window System the notion of client and server is a bit backwards. The server is considered to be the machine running the X server program and displaying the screen and accepting user input. While the client is considered to be the remote program whose user interface is being displayed on the X server.

What this means is that you need to make sure that X is permitted to be served from the zone containing the machine showing the X display (the X server), to the zone containing the machines that actually run your programs (the clients).

#### DHCP (Dynamic Host Configuration Protocol)

Go to dhcp for information about using DHCP with &kappname;.

#### Squid, Web proxies and ICP

If you are using a web cache/proxy like Squid and also want to peer and interact with other web caches, you may have to enable the ICP (Internet Cache Protocol, under the network section of the Protocol tab. Just enabling the Squid protocol will not enable ICP.

## Program Reference

### The Zone Tab

&kappname; is built around the concept of zones containing IP addresses, and then managing which network protocols are permited between the different zones. This tab is where zones and thier contents are managed.

The list of currently defined zones is on the left side of the tab under Defined Network Zones:. The properties of the currently selected zone are shown in the Zone Properties area. The New Zone and Delete Zone buttons in the bottom left corner of the tab create new zones or delete the currently selected zone.

There are two zones which are built-in and can not be modifed or deleted. They are called the Internet and Local zones. The Local zone automatically contains the IP addresses of the network interfaces for the machine that the firewall runs on. Note that the list of addresses in this zone are not actually shown in the window. The Internet zone automatically contains the IP addresses of anything that is not in another zone. It acts as the default zone holding addresses that are not in any other zone.

Each zone has a name that can be edited in the Name: text edit box. It is recommended that this be kept relatively brief. A longer comment can be entered for each zone in the Comment: text edit box.

#### Addresses

Each zone consists of a number of IP addresses. The Zone Addresses list holds the list of IP addresses for the currently selected zone. Addresses can be added to the list by using the New Address button. The currently selected address can be deleted using the Delete Address button. The text field next to Address:, allows you to edit the currently selected address.

Addresses and ranges of addresses can be specified in several ways:

- Numeric IP address (dotted quad). Whole networks can be specified by using a mask. Masks can be network masks (e.g. 255.255.255.0) or a plain number (e.g. 24). Some examples are: 123.34.56.78, 192.168.1.1/24 and 192.168.1.1/255.255.255.0 (the last two mean all the addresses from 192.168.1.1 to 192.168.1.255)

- Domain name. Only Fully Qualified Domain Names (FQDN) are allowed, something like .simonzone.com will not work. A complete name is required, like www.simonzone.com, for example.

#### Connection

The Connection list allows you to specify which other zones the currently selected zone is connected to. When a zone is connected to another zone, that particular combination will appear on the Protocol tab. If a combination is not selected here then it won't appear on the Protocol tab, and no communication will be permitted between the two zones.

### The Protocol Tab

The Protocol tab is used to specify which protocols are permitted between which combinations of zones.

To the left of the tab is the Defined Network Zones: list holding every zone currently defined. The Zone Properties area shows which protocols or services the currently selected zone is permitted to serve and to whom. We will refer to the currently selected zone as the serving zone.

The expandable list of protocols is organised into ten categories:

- Chat - Protocols used by chat programs like IRC and ICQ.

- Data Serve - Protocols used by databases and other data sources like time servers.

- File Transfer - Protocols used to tranfers files like HTTP for the Web and FTP.

- Game - Protocols used by games for online multiplayer gaming.

- Interactive Session - Protocols used for working on or performing actions on remote systems. SSH Secure Shell, telnet and RPC protocols are here.

- Mail - Protocols associated with delivering and moving email. SMTP and POP3 are here.

- Media - Protocols used for delivering multimedia across the internet in real time.

- Miscellaneous - Other protocols that really didn't fit under the other categories.

- Network - Protocols related to the direct operation of the network inself.

- User Defined - Protocols defined by the user on the "Advanced" tab show up here.

To the right of each protocol entry in the list is one or more columns of check boxes. Each zone that the serving zone is connected to has a column on check boxes. The name of the zone is at the top of the column. The zones/columns which appear here are determined by the Connection list on the Zone tab for the currently selected zone.

The check boxes have the following meanings:

- Clear - The protocol is not permitted. Clients in this zone may not start a connection to the serving zone using this protocol. For example, if "Web Servers" is the currently selected serving zone, and the HTTP (Web) protocol box is clear for the "Bad Guys" zone, then machines in the "Bad Guys" zone will not be allowed to access a web server running on a machine in the "Web Servers" zone. Any attempt will be completely ignored. Any incoming packets will be dropped.

- Checked/Ticked - The protocol is permitted. Clients in this zone may start a connection to the serving zone using this protocol. For example, if "Web Servers" is the currently selected serving zone, and the HTTP (Web) protocol box is ticked for the "Bad Guys" zone, then machines in the "Bad Guys" zone will be allowed to access a web server running on a machine in the "Web Servers" zone.

- Crossed - The protocol is not permitted and packets will be rejected instead of just dropped. When a packet is rejected an ICMP packet is sent back to the source to inform it that the packet was rejected by the firewall. For example, if "Web Servers" is the currently selected serving zone, and the HTTP (Web) protocol box is crossed for the "Bad Guys" zone, then machines in the "Bad Guys" zone will not be allowed to access a web server running on a machine in the "Web Servers" zone. But unlike when the check box is clear, any connection attempts will be rejected instead of ignored.

This information is summerised at the bottom of the tab in a concise key or legend showing each of the different check box states and meanings.

Rejecting a protocol is considered a more "friendly" way of blocking it's use, because the sender is immediately informed about what has happened. When a packet is quietly blocked by the firewall, the sender will not know and will have to wait and "time out" before realising that communication has failed.

Generally there is little reason to reject protocols instead of just having them dropped. If someone is trying to use a protocol that you didn't allow, then for safety's sake we should assume that they are hostile and therefore should not be helped. In this situation, dropping packets is better because it uses less network capacity and has the effect of making most port scanning software that an intruder may be using, run very slowly.

The only situation that you are likely to run into where rejecting a protocol is desirable, is with the "ident" protocol (located under the Network category).

#### Protocol Information

Information about a protocol is displayed on the botton left side of the tab. You can get information about any of the protocols in the list by clicking on it's title.

The following information about each protocol is available:

- Name - The name of the protocol. It's full name and also any acronym it may be known by.

- Description - A short description of what the protocol is used for.

- Security Risk - An estimate of the security risk that use of the protocol has. The risk ranges from low, medium, high or unknown.

- Network Usage - This is a description of how the protocol uses the network. It describes which connections, IP protocols and port ranges etc that the protocol uses to operate. This field is only shown if the Show Advanced Protocol Help checkbox on the Advanced tab is checked.

### The Logging Tab

The Logging tab holds many options for controlling what events are logged and how they are logged.

The Log blocked packets checkbox controls whether packets that are blocked by &kappname; are logged in the system log. A packet that is not part of a permitted protocol is by blocked by default. When this checkbox is ticked, blocked packets are logged.

The Log rejected packets checkbox controls whether packets that are rejected by &kappname; are logged in the system log. Protocols are marked to be rejected on the Protocol tab by putting a cross in their checkbox. When this checkbox is ticked, any rejected packets are logged.

The Log aborted TCP connections (half open scans) check box controls whether TCP connections that are forcefully terminated using a RST packet are logged. A port scanning technique know as "half-open" scanning uses RST packets to quickly abort an half open TCP connection in order to avoid detection. This can be done using `nmap`'s `-sS` option. By turning this option on you can detect and log when this happens. Unfortunately many web servers like to quickly terminate connections by using a RST packet. This can produce quite a lot of unwanted noise in your system logs. Therefore you may want to turn this option off. Also, this option only has effect when the firewall is used on a Linux kernel 2.4 machine in combination with `iptables`.

Packet logs are received by the `syslog`. Consult the `syslog` manual page for more information.

#### Rate Limiting

This group of options allows you to specify how &kappname; should limit the rate at which messages are placed in the system log. Rate Limited logging is intended to stop someone from performing a Denial of Service attack against your machine by flooding it with packets and trying to fill your system log files and disk space.

The Rate limit logging checkbox controls whether packet logging should be rate limited or not. It is recommended that this be left on.

The Rate widget allows you to specify the maximum average rate that packet log entries may be added to the system log. The rate may be specified in terms of the number of entries per second, minute, hour or day.

The Rate widget allows you to specify the average maximum logging rate. Packets to be logged often come in bursts of many packets in very quick succession. The Burst widget allows you to specify how many packets in a burst may be logged. Once the burst limit has been reached, the average logging rate is enforced.

For more information on exactly how this works, consult the `iptables` documentation and the Linux kernel source `/net/ipv4/netfilter/ipt_limit.c` file.

The Warn when limiting check box controls whether &kappname; should put warning messages in the system log when it has been forced to apply rate limiting to the packet log messages. When rate limiting is applied to packet log messages, only a limited number of messages appear in the log, while the rest are omitted. When you come to view the system log, it useful to know if packet log messages have been omitted due to rate limiting.

The Warning rate widget allows you to specify how often warning messages should be placed in the system log when rate limiting is being used.

The warning messages in the system log have the word `LIMITED` at the start of the line.

#### Logging Options

The Log IP Options checkbox controls whether the options field in the IP header of a packet should be included in a packet log message.

The Log TCP Options checkbox controls whether the options field in the TCP header of a packet should be included in a packet log message.

The Log TCP sequence numbers checkbox controls whether the TCP sequence number for a packet should be included in a packet log message.

The Logging Priority selector specifies the logging priority used when sending log messages to the system log. See the documentation for `syslog.conf` for more information.

### The Advanced Tab

The Advanced tab holds many miscellaneous advanced options. Here you can also set up your own simple protocols for opening a small hole through your firewall to support an ad hoc protocol. For example, accessing a remote administration web interface that is served from a non-standard port number.

When the Show advanced protocol help check box is ticked, extra information is given in the help text for protocols on the protocol tab. The extra information includes the what kinds of network connections the protocols uses.

The Allow TCP timestamps check box lets you turn TCP timestamps on or off. Leaving TCP timestamps turned on makes it possible for outsiders to calculate how long your machine has been running since it was last booted. `nmap` `-O` can do this. Generally, unless you are connected to a high speed network connection chances are you have no good reason to have TCP timestamps turned on.

The Restore to factory defaults clears the firewall configuration and resets it back to how it was the first time &kappname; was run.

#### Local Dynamic Port Range

The two input fields next to Local Dynamic Port Range allow you to specify the range of port numbers used by the operating system for the source port of new out-going connections. When a connection is made to a port on an external machine, the source port of the connection is usually not specified by the application. It is left up to the operating system to choose a suitable free source port number. The local dynamic port range is just a range of port numbers that the operating system will use when looking for an available source port.

Generally, there is little reason to change this. It might only become important on machines that need to have an unusually high number of connections active at the same time.

#### DHCP (Dynamic Host Configuration Protocol)

If you are using DHCP to configure a network interface, then you will need to specify the name of the interface(s) in the Enable DHCP on interfaces: widget.

If you are running a DHCP server on a network interface, then you will need to specify the name of the interface(s) in the Enable DHCP server on interfaces: widget.

When entering multiple interface names, separate them using a comma ",".

#### Import/Export

Import and Export allow you to save the current configuration to a file, and read it back into &kappname; again. When you click on either of these buttons, a file dialog appears and you can choose the file to import from, or export to.

The Description text box allows you enter a short note about the current firewall configuration.

Export doesn't just export the current firewall configuration, it actually outputs an entire firewall script. The firewall script can then be moved onto another machine and manually installed and run.

#### User Defined Protocols

In addition to all the protocols that &kappname; supports, it is also possible to specify your own custom protocols.

In the middle of the User Defined Protocols group is the current list of user defined protocols. Use the New Protocol button to create a new blank protocol. The Delete Protocol button naturally deletes the currently selected user defined protocol.

After creating a new protocol you can give it a name using the Name text field. The Type widget lets you specify which IP protocol, TCP or UDP, your user defined protocol uses. With the Port widgets you can specifiy the port or range of ports on the server or remote machine that the protocol must connect to. For UDP protocols use the bidirectional check box to specify if the protocol is bidirectional and requires packets to travel in both directions. Once a user defined protocol has been specified here, it becomes available on the Protocol tab under the User Defined category. There it can be turned on or off just like any other built-in protocol.

This feature is intended for simple protocols where a server is just serving from a single TCP or UDP port. If you feel that you need to specify a more complex protocol, consider contacting the author so that direct support for it can be added in a future &kappname; release.

## Questions and Answers

&reporting.bugs; &updating.documentation;

Does &kappname; need to be running for it to protect my computer?

&kappname; provides a user friendly way of configuring your computer's built-in firewalling capabilities. &kappname; itself doesn't need to be running continously to protect your computer.

How can I see which ports a given protocol uses? or How can I see which ports a given protocol opens up?

Go to the Advanced tab and tick the checkbox at Show advanced protocol help. Now when you go back to the Protocol tab and click on the name of a protocol in the middle of the window, the protocol on the left side of the tab will show the information about the protocol and also what TCP/UDP ports it uses.

Why are my FTP/Mail/IRC connections slow?

Many mail and IRC servers, when connected to, use the "ident" protocol to try to find out the owner of the incoming connection, and don't respond to the incoming connection until they have tried "ident". This problem shows up, for example, as delays when connecting to mail servers. The connection will be made with the mail server, but there will be a noticeable delay before any mail is retrieved. This is because the server tries to make an "ident" connection back, but has wait and time out before realising that it won't work. The solution is to just make sure that "ident" is being rejected for connections coming from the zone containing the mail server.

## Credits and License

&kappname;

Program copyright 2000-2003 Simon Edwards simon@simonzone.com

Documentation copyright 2000-2003 Simon Edwards simon@simonzone.com

&underFDL; &underGPL;

Thanks go to the following people:

- J F Gratton (Help with a little bit of network code.)

- Joerg Buchland (Help with sorting out what /dev interface ISDN uses.)

- Ludovic Lange (Bug fixes, DHCP help.)

- Jason L. Buberel (Feedback, protocol info.)

- Carsten Pfeiffer (Feedback, help with KDE3)

- Gunner Poulsen (Danish translation)

- Adam Kreuschner (SuSE RPMs)

- Matthew Schick (Redhat RPMs)

- Daniele Medri (Italian translation)

- Stephan Johach (German translation)

- Pascal Billery Schneider (French translation)

- Anyone else who has provided help or bug reports or support.

## Installation

### How to obtain Guarddog

&kappname; can be found a http://www.simonzone.com/software/guarddog/.

&documentation.index;