Re: Firewall with only one NIC

[Kevin Colby <kevinc grainsystems com>]

Stephen Torri wrote:
> 
> I was wary about doing this because of what I believe would be true.
> That is the packets are already at their destination and so does a
> firewall really work.

The packets have reached their destination address, but the kernel
has not yet allowed their contents to be processed until they clear
the IP Chains rules.  The firewall does work.  Nothing magic happens
just because the packets have reached the NIC.

> It would be interesting if there could be a guard added to all
> incoming packets.  The packets would come in from the network,
> hit the guard (who runs firewall rules against them) and either
> allows them transport or drops them.  Packets going out have to
> do the same thing. No packets could circumvent the guard.

Yes.  We have such a thing and call it IP Chains.

	- Kevin Colby
	  kevinc grainsystems com