1. Management Information BASE (MIB) specifies variables the network elements maintain.
2. A set of common structures and a way to reference the variables in the database.
3. The protocol used to communicate between the manager and the network element agent which is SNMP.

1. The devices on the network are polled by management stations.
2. Devices send alerts to SNMP management stations. The public community may be added to the alert list so all management stations will receive the alert.

• Baseline - A report outlining the state of the network.
• Trap - An alert that is sent to a management station by agents.
• Agent - A program at devices that can be set to watch for some event and send a trap message to a management station if the event occurs. 

SNMP Communities

• Write = private
• Read = public 

SNMP Communities

• Write = private
• Read = public

SNMP Security

• Send Authentication Trap - When a device receives an authentication that fails, a trap is sent to a management station.

• Accepted Community Names - Only requests from computers in the list of community names will be accepted.
• Accept SNMP Packets from Any Host - This is checked by default. Setting specific hosts will increase security.
• Only Accept SNMP Packets from These Hosts - Only requests from hosts on the list of IP addresses are accepted. Use IP, or IPX address or host name to identify the host.

SNMP Message Types

1. Version of SNMP
2. Community - A clear text password character string
3. PDU type
4. Request ID - Used to associate the request with the response. For PDU 0-2, it is set by the manager.
5. error status - An integer sent by the agent to identify an error condition

   Error	Name	Description
   0	no error	OK
   1	too big	Reply does not fit into one message
   2	no such name	The variable specified does not exist
   3	bad value	Invalid value specified in a set request.
   4	read only	The variable to be changed is read only.
   5	general error	General error

6. error index - Specifies which variable was in error when an error occurred. It is an integer offset.
7. name - The name of the variable (being set or read).
8. value - The value of the variable (being set or read)
9. any other names and values to get/set 

1. PDU type
2. Enterprise - The agents OBJECT IDENTIFIER or system objects ID. Falls under a node in the MIB tree.
3. agent addr - The IP address of the agent.
4. Trap type - Identifies the type of event being reported.

   Trap Type	Name	Description
   0	cold start	Agent is booting
   1	warm start	Agent is rebooting
   2	link down	An interface has gone down
   3	link up	An interface has come up
   4	authentification failure	An invalid community (password) was received in a message.
   5	egp neighbor loss	An EGP peer has gone down.
   6	enterprise specific	Look in the enterprise code for information on the trap

5. Specific code - Must be 0.
6. Time stamp - The time in 1/100ths of seconds since the agent initialized.
7. name
8. Value
9. Any other names and values

• INTEGER - Some have minimum and maximum values.
• OCTET STRING - The number of bytes in the string is before the string.
• DISPLAY STRING - Each byte must be an ASCII value
• OBJECT IDENTIFIER - Specifies a data type allocated by an organization with responsibility for a group of identifiers. A sequence of integers separated by decimals which follow a tree structure.
• NULL - Used as the value of all variables in a get request.
• IpAddress - A 4 byte long OCTET STRING. One byte for each byte of the IP address.
• PhysAddress - A 6 byte octet string specifying an ethernet or hardware address.
• Counter - A 32 bit unsigned integer
• GaugeAn unsigned 32 bit integer with a value that can increase or decrease but wont fall below a minimum or exceed a maximum.
• TimeTicks - Time counter. Counts in 1/100 of seconds.
• SEQUENCE - Similar to a programming structure with entries of type IPAddress called udpLocalAddress and type INTEGER called udpLocalPort.
• SEQUENCE OF - An array with elements with one type.

The MIB data structure RFC 1213

1. system
   1. sysDesc (DisplayString) - Description of entity
   2. sysObjectID (ObjectID) - Vendors ID in the subtree (1.3.6.1.4.1.
   3. sysUPTime (Timer) - Time the system has been up
   4. sysContact (DisplayString) - Name of contact person
   5. sysName (DisplayString) - Domain name of the element such as mymachine.mycompany.com
   6. sysLocation (DisplayString) - Physical location of the element.
   7. sysServices 0x1-physical, 0x02-datalink, 0x04-internet, 0x08 end to end, 0x40-application. If the bit is set the service is provided
2. interfaces
   1. ifNumber (INTEGER) - Number of network interfaces
   2. ifTable (table)
      1. ifIndex
      2. ifDescr - Description of interface
      3. ifType - 6=ethernet, 7=802.3 ethernet, 9=802.5 token ring, 23 = PPP, 28=SLIP
      4. ifMtu
      5. ifSpeed - Bits/second
      6. ifPhysAddress
      7. ifAdminStatus - Desired state of interface 1=up, 2=down, 3=testing
      8. ifOperStatus - Current state of interface 1=up, 2=down, 3=testing
      9. ifLastchange
      10. ifInOctets - Total bytes received
      11. ifInUcastPkts
      12. ifInNUcastPkts
      13. ifInDiscards
      14. ifInErrors
      15. ifInUnknownProtos
      16. ifOutOctets
      17. ifOutUcastPkts
      18. ifOutNUcastPkts
      19. ifOutDiscards
      20. ifOutErrors
      21. ifOutQLen
      22. ifSpecific
3. at - Address translation group
   1. atIfIndex (INTEGER) - Interface number
   2. atPhysAddress (PhyAddress)
   3. atNetAddress (NetworkAddress) - IP address
4. ip
   1. ipForwarding
   2. ipDefaultTTL (INTEGER)
   3. ipInReceives (counter)
   4. ipInHdrErrors (counter)
   5. ipInAddrErrors (counter)
   6. ipForwDatagrams (counter)
   7. ipInUnknownProtos (counter)
   8. ipInDiscards (counter)
   9. ipInDelivers (counter)
   10. ipOutRequests (counter)
   11. ipOutDiscards (counter)
   12. ipOutNoRoutes (INTEGER)
   13. ipReasmTimeout (counter)
   14. ipReasmReqds (counter) - Number of IP fragments received that need to be reassembled.
   15. ipReasmOKs (counter)
   16. ipReasmFails (counter)
   17. ipFragOKs (counter)
   18. ipFragFails (counter)
   19. ipFragCreates (counter)
   20. ipRoutingDiscards (counter)
   21. ipAddrTable (table)
       1. ipAddrEntry (index)
          1. ipAdEntAddr
          2. ipAdEntIfIndex
          3. ipAdEntNetMask
          4. ipAdEntBcastAddr
          5. ipAdEntReasmMaxSize
5. icmp
6. tcp
7. udp
   1. udpInDatagrams (counter) - UDP datagrams delivered to user processes.
   2. udpNoPorts (counter) - UDP datagrams which were not received at the port since there was no application to receive it.
   3. udpInErrors (counter) - Number of UDP datagrams not delivered for reasons other than no applications available to receive them.
   4. udpOutDatagrams (counter) - Number of UDP datagrams sent.
   5. udpTable (table)
      1. udpEntry - Specifies the table entry number
         1. udpLocalAddress
         2. udpLocalPort

• MUA - Mail users agent. This is the program a user will use to type e-mail. It usually incorporates an editor for support. The user types the mail and it is passed to the sending MTA.
• MTA - Message transfer agent is used to pass mail from the sending machine to the receiving machine. There is a MTA program running on both the sending and receiving machine. Sendmail is a MTA.
• LDA - Local delivery agent on the receiving machine receives the mail from its MTA. This program is usually procmail.
• Mail notifier - This program notifies the recipient that they have mail. Normally this requires two programs, biff and comsat. Biff allows the administrator or user to turn on comsat service.

• Directory services - A list of users on a system. Microsoft provides a Global Address List and a Personal Address Book.
• Post Office - This is where the messages are stored. 

Mail Protocols

• SMTP - Simple Mail Transport Protocol is used on the internet, it is not a transport layer protocol but is an application layer protocol.
• POP3 - Post Office Protocol version 3 is used by clients to access an internet mail server to get mail. It is not a transport layer protocol.
• IMAP4 - Internet Mail Access Protocol version 4 is the replacement for POP3.
• MIME - Multipurpose Internet Mail Extension is the protocol that defines the way files are attached to SMTP messages.
• X.400 - International Telecommunication Union standard defines transfer protocols for sending mail between mail servers.
• MHS - Message Handling Service by Novell is used for mail on Netware networks. 

Directory Services

• Lightweight Directory Access Protocol (LDAP)
• X.500 - This is a recommendation outlining how an organization can share objects and names on a large network. It is hierarchical similar to DNS, defining domains consisting of organizations, divisions, departments, and workgroups. The domains provide information about the users and available resources on that domain, This X.500 system is like a directory. Its recommendation comes from the International Telegraph and Telephone Consultative Committee (CCITT)

Mail API

• MAPI - Microsoft's Messaging API which is incorporated throughout Microsoft's office products supports mail at the application level
• VIM - Vendor-Independent Messaging protocol from Lotus is supported by many vendors exclusive of Microsoft.

1. Envelope - Includes recipient and sender addresses using the MAIL and RCPT commands.
2. Headers - Each header has a name followed by a colon and its value. Some headers are From, Date, Reply To, Received, Message ID, To, and Subject.
3. Body - The contents of the message sent in 7 bit ASCII code.

• HELO - Sent by client with domain name such as mymachine.mycompany.com.
• MAIL - From <myself@mymachine.mycompany.com>
• RCPT - To <myfriend@theirmachine.theirorg.org>
• DATA - Sends the contents of the message. The headers are sent, then a blank line, then the message body is sent. A line with "." and no other characters indicates the end of the message.
• QUIT

dept1.mycompany.com.  IN  MX  5  mail.mycompany.com.  
dept1.mycompany.com.  IN  MX  10  mail1.mycompany.com.  
dept1.mycompany.com.  IN  MX  15  mail2.mycompany.com. 

1. The first time a process on a host joins a multicast group, the host will send an IGMP report. This means that every time the host needs to receive messages from a new group to support its processes, it will send a report.
2. Multicast routers will send IGMP queries regularly to determine whether any hosts are running processes that belong to any groups. The group address of the query is set to 0, the TTL field is set to 1, and the destination IP address is 224.0.0.1 which is the all hosts group address which address all the multicast capable routers and hosts on a network.
3. A host sends one IGMP response for each group that contains one or more processes. The router expects one response from each host for each group that one or more of its processes require access to.
4. A host does not send a report when its last process leaves a group (when the group access is no longer required by a process). The multicast router relies on query responses to update this information.

1. Bits 0 to 3 - IGMP version number
2. Bits 4 to 7 - IGMP type. 1=query sent by a multicast router. 2 is a response sent by a host.
3. Bits 8 to 15 - unused
4. Bits 16 to 31 - Checksum
5. The last 4 bytes - 32 bit group address which is the same as the class D IP address.

1. Unicast - A transmission to a single interface card.
2. Multicast - A transmission to a group of interface cards on the network.
3. Broadcast - A transmission to all interface cards on the network. RFC 919 and 922 describe IP broadcast datagrams.
   • Limited Broadcast - Sent to all NICs on the some network segment as the source NIC. It is represented with the 255.255.255.255 TCP/IP address. This broadcast is not forwarded by routers so will only appear on one network segment.
   • Direct broadcast - Sent to all hosts on a network. Routers may be configured to forward directed broadcasts on large networks. For network 192.168.0.0, the broadcast is 192.168.255.255.

Broadcasting

1. ARP on IP
2. DHCP on IP
3. Routing table updates. Broadcasts sent by routers with routing table updates to other routers. 

1. The IP limited broadcast address is 255.255.255.255. This broadcast is not forwarded by a router.
2. A broadcast directed to a network has a form of x.255.255.255 where x is the address of a Class A network. This broadcast may be forwarded depending on the router program.
3. A broadcast sent to all subnetworks. If the broadcast is 10.1.255.255 on network 10.1.0.0 and the network is subnetted with multiple networks 10.1.x.0, then the broadcast is a broadcast to all subnetworks.
4. A broadcast sent to a subnet in the form 10.1.1.255 is a subnet broadcast if the subnet mask is 255.255.255.0.

Multicasting

• Hierarchical Distance Vector Multicast Routing Protocol (HDVMRP)
• Multicast Border Gateway
• Protocol Independent Multicast

 

• 224.0.0.1 = All systems on the subnet
• 224.0.0.2 = All routers on the subnet
• 224.0.1.1 = Network time protocol (NTP)
• 224.0.0.9 = For RIPv2
• 224.0.1.2 = Silicon graphic's dogfight application

Network File System (NFS)

Remote Procedure Call (RPC)

program vers proto   port
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100011    1   udp    747  rquotad
    100011    2   udp    747  rquotad
    100005    1   udp    757  mountd
    100005    1   tcp    759  mountd
    100005    2   udp    762  mountd
    100005    2   tcp    764  mountd
    100003    2   udp   2049  nfs

1. BOOTP request. The client sends a BOOTP request from 0.0.0.0.68 to 255.255.255.255.67 with its ethernet address and number of second's fields filled in.
2. BOOTP reply. The server responds with the client's IP address, the server's IP address (it's own), and the IP address of a default gateway.
3. ARP request. The client issues an ARP to tell if the IP address it just received is being used. It uses 0.0.0.0 as it's own address
4. ARP request. The client waits 0.5 seconds and repeats the same ARP request.
5. ARP request. The client waits another 0.5 seconds and repeats the ARP request with it's own address as the senders address.
6. BOOTP request. The client waits 0.5 seconds and sends another BOOTP request with its own IP address in the IP header
7. BOOTP reply. The server sends the same BOOTP reply it sent the last time.
8. ARP request. The client outputs an ARP request for the server hardware address
9. ARP reply. The server replies with its own ethernet address.
10. TFTP read request. The client sends a TFTP read request asking for its specified boot file.

Purpose of VPN

1. Machine A will extract the IP packet.
2. Machine A will encrypt the packet.
3. Machine A will wrap the original IP packet in a new IP packet with destination address 201.47.98.101, which is machine C's true internet address.
4. Machine A will wrap the new IP packet in an ethernet packet and send it to the network.
5. The packet will be routed through the internet until it reaches machine C.
6. Machine C will extract the outer IP packet.
7. Machine C will determine that the IP packet contains another IP packet and extract it.
8. Machine C will decrypt the packet.
9. Machine C will examine the destination address of the inner IP packet, wrap it in an ethernet packet with the correct ethernet address, and send it to the internal network on its port 10.3.1.1. 

VPN tunneling Protocols

• L2F - Layer2 Forwarding, works at the link layer of the OSI model. It has no encryption. Being replaced by L2TP.
• PPTP - Point-to-Point Tunneling Protocol (RFC 2637) works at the link layer. No encryption or key management included in specifications.
• L2TP - Layer2 Tunneling Protocol. (RFC 2661) Combines features of L2F and PPTP and works at the link layer. No encryption or key management included in specifications.
• IPSec - Internet protocol security, developed by IETF, implemented at layer 3. it is a collection of security measures that address data privacy, integrity, authentication, and key management, in addition to tunneling. Does not cover key management.
• Socks - handled at the application layer 

VPN Security

• Authentification - Making sure the data is from where it is supposed to be from.
• Confidentiality - Keeping any third parties from reading or understanding the data.
• Data integrity - Being sure the data received was not changed by a third party and that it is correct.
• Access control - Keeping third parties without authorization from getting access to your data or network.

Managing user access rights and Key Management or Authentification Systems

1. RADIUS - Remote Authentication Dial-In User Service is used for dial in clients to connect to other computers or a network. It provides authentication and accounting when using PPTP or L2TP tunneling.
2. ISAKMP/Oakley - Internet Security Association and Key Management Protocol Authentication uses one of the following three attributes to authenticate users.
   1. Something you have such as a key.
   2. Something you know such as a secret.
   3. Something you are such as your fingerprint.
   More than one means of authentification is recommended for stronger security. 

VPN terms

• PPTP - Point to point tunneling protocol (RFC 2637)
• L2TP - Layer 2 tunneling protocol (RFC 2661)
• IPIP tunneling - Tunneling IP packets in IP packets.

• CIPE - Crypto IP Encapsulation
• SSL - Secure sockets layer
• IPSEC - Internet protocol security

• PAP - Password Authentification Protocol is a two way handshake protocol designed for use with PPP.
• CHAP - Challenge Handshake Authentication Protocol is a three way handshake protocol which is considered more secure than PAP.
• TACACS - Offers authentication, accounting, and authorization.
• S/Key - A one time password system, secure against replays. RFC 2289.

• SWAN - Secure wide area network
• PoPToP Point to point tunneling protocol server. 

Host Names

1. resolver
2. name server
3. database of resource records(RRs) 

Domain Name System

Structure and message format

• GOV - Government body.
• EDU - Educational body.
• INT - International organization
• NET - Networks
• COM - Commercial entity.
• MIL - U. S. Military.
• ORG - Any other organization not previously listed.

DNS Message format:

1. Domain name
2. Type - One of the RR codes listed below.
3. Class - Normally indicates internet data which is a 1.
4. Time to live field - The number of seconds the RR is saved by the client.
5. Resource data length specifies the amount of data. The data is dependent on its type such as CNAME, A, NS or others as shown in the table below. If the type is "A" the data is a 4 byte IP address. 

Usage and file formats

  If a domain name is not found when a query is made, the server may search for the name elsewhere and return the information to the requesting workstation, or return the address of a name server that the workstation can query to get more information. There are special servers on the Internet that provide guidance to all name servers. These are known as root name servers. They do not contain all information about every host on the Internet, but they do provide direction as to where domains are located (the IP address of the name server for the uppermost domain a server is requesting). The root name server is the starting point to find any domain on the Internet. 

Name Server Types

1. The primary master builds its database from files that were preconfigured on its hosts, called zone or database files. The name server reads these files and builds a database for the zone it is authoritative for.
2. Secondary masters can provide information to resolvers just like the primary masters, but they get their information from the primary. Any updates to the database are provided by the primary.
3. Caching name server - It gets all its answers to queries from other name servers and saves (caches) the answers. It is a non-authoritative server.

DNS Query Types

1. Recursive queries received by a server forces that server to find the information requested or post a message back to the querier that the information cannot be found.
2. Iterative queries allow the server to search for the information and pass back the best information it knows about. This is the type that is used between servers. Clients used the recursive query.
3. Reverse - The client provides the IP address and asks for the name. In other queries the name is provided, and the IP address is returned to the client. Reverse lookup entries for a network 192.168.100.0 is "100.168.192.in-addr arpa".

DNS Transport protocol

The DNS Database

• A - Host's IP address. Address record allowing a computer name to be translated into an IP address. Each computer must have this record for its IP address to be located. These names are not assigned for clients that have dynamically assigned IP addresses, but are a must for locating servers with static IP addresses.
• PTR - Host’s domain name, host identified by its IP address
• CNAME - Host’s canonical name allows additional names or aliases to be used to locate a computer.
• MX - Host’s or domain’s mail exchanger.
• NS - Host’s or domain’s name server(s).
• SOA - Indicates authority for the domain
• TXT - Generic text record
• SRV - Service location record
• RP - Responsible person
• HINFO - Host information record with CPU type and operating system.

DNS Files

• CACHE.DNS - The DNS Cache file. This file is used to resolve internet DNS queries. On Windows systems, it is located in the WINNTROOT\system32\DNS directory and is used to configure a DNS server to use a DNS server on the internet to resolve names not in the local domain. 

Example Files

mycompany.com.  IN SOA mymachine.mycompany.com. root.mymachine.mycompany.com. (
  1999112701           ; Serial number as date and two digit number YYMMDDXX
  10800                ; Refresh in seconds 28800=8H
  3600                 ; Retry in seconds 7200=2H
  604800               ; Expire 3600000=1 week
  86400 )              ; Minimum TTL 86400=24Hours
mycompany.com.                IN NS mymachine.mycompany.com.
mycompany.com.                IN MX  10  mailmachine.mycompany.com.
mymachine.mycompany.com.      IN A 10.1.0.100
mailmachine.mycompany.com.    IN A 10.1.0.4
george.mycompany.com.         IN A 10.1.3.16

1. The entries on this line are:
   1. mycompany.com. - Indicates this server is for the domain mycompany.com.
   2. IN - Indicates Internet Name.
   3. SOA - Indicates this server is the authority for its domain, mycompany.com.
   4. mymachine.mycompany.com. - The primary nameserver for this domain.
   5. root.mymachine.mycompany.com. - The person to contact for more information.
   The lines in the parenthesis, listed below, are for the secondary nameserver(s) which run as slave(s) to this one (since it is the master).
2. 1999112701 - Serial number - If less than master's SN, the slave will get a new copy of this file from the master.
3. 10800 - Refresh - The time in seconds between when the slave compares this file's SN with the master.
4. 3600 - Retry - The time the server should wait before asking again if the master fails to respond to a file update (SOA request).
5. 604800 - Expire - Time in seconds the slave server can respond even though it cannot get an updated zone file.
6. 86400 - TTL - The time to live (TTL) in seconds that a resolver will use data received from a nameserver before it will ask for the same data again.
7. This line is the nameserver resource record. There may be several of these if there are slave name servers.

   mycompany.com.                IN NS mymachine.mycompany.com.

   Add any slave server entries below this like:
   

   mycompany.com.                IN NS ournamesv1.mycompany.com.
   mycompany.com.                IN NS ournamesv2.mycompany.com.
   mycompany.com.                IN NS ournamesv3.mycompany.com.

8. This line indicates the mailserver record.

   mycompany.com.                IN MX  10  mailmachine.mycompany.com.

   There can be several mailservers. The numeric value on the line indicates the preference or precedence for the use of that mail server. A lower number indicates a higher preference. The range of values is from 0 to 65535. To enter more mailservers, enter a new line for each one similar to the nameserver entries above, but be sure to set the preferences value correctly, at different values for each mailserver.
   
9. The rest of the lines are the name to IP mappings for the machines in the organization. Note that the nameserver and mailserver are listed here with IP addresses along with any other server machines required for your network.

   mymachine.mycompany.com.      IN A 10.1.0.100
   mailmachine.mycompany.com.    IN A 10.1.0.4
   george.mycompany.com.         IN A 10.1.3.16

mymachine.mycompany.com  IN  CNAME  nameserver.mycompany.com.
george.mycompany.com  IN  CNAME  dataserver.mycompany.com.  
Linux1.mycompany.com  IN  CNAME  engserver.mycompany.com.  
Linux2.mycompany.com  IN  CNAME  mailserver.mycompany.com.  

mymachine.mycompany.com  IN  A  10.1.0.100  
    IN  A  10.1.1.100  

Types of Firewalls

1. Packet Filtering - Blocks selected network packets.
2. Circuit Level Relay - SOCKS is an example of this type of firewall. This type of proxy is not aware of applications but just cross links your connects to another outside connection. It can log activity, but not as detailed as an application proxy. It only works with TCP connections, and doesn't provide for user authentication.
3. Application Proxy Gateway - The users connect to the outside using the proxy. The proxy gets the information and returns it to the user. The proxy can record everything that is done. This type of proxy may require a user login to use it. Rules may be set to allow some functions of an application to be done and other functions denied. The "get" function may be allowed in the FTP application, but the "put" function may not. 

• Control outbound connections and data.
• Monitor outbound connections and data.
• Cache requested data which can increase system bandwidth performance and decrease the time it takes for other users to read the same data. 

• Provide for user authentication.
• Allow and deny application specific functions.
• Apply stronger authentication mechanisms to some applications. 

Packet Filtering Firewalls

Circuit Level Relay Firewall

Configuring a Proxy Server

• Ipchains soon to be replaced by netfilter (Packet filtering supported by the Linux kernel). It comes with Linux and is used to modify the kernel packet routing tables.
• SOCKS - Circuit Switching firewall. Normally doesn't come with Linux, but is free.
• Squid - A circuit switching proxy. Normally comes with Linux.
• Juniper Firewall Toolkit - A firewall toolkit product used to build a firewall. It uses transparent filtering, and is circuit switching. It is available as open source.
• The TIS Firewall Toolkit (FWTK). A toolkit that comes with application level proxies. The applications include Telnet, Rlogin, SMTP mail, FTP, http, and X windows. it can also perform as a transparent proxy for other services

Ipchains and Linux Packet filtering

• IPCHAINS-HOWTO
• Firewall-HOWTO
• IP-Masquerade-HOWTO 

1. Characteristics - Characteristics such as source address, destination address, protocol type (UDP, TCP, ICMP), and port numbers.
2. Instructions - Instructions are carried out if the rule characteristics match the data packet. 

1. Input - Regulates acceptance of incoming data packets.
2. Forward - Defines permissions to forward packets that have another host as a destination.
3. Output - Permissions for sending packets. 

• ACCEPT - Accept the data packet.
• REJECT - Drop and the packet but send a ICMP message indicating the packet was refused.
• DENY - Drop and ignore the packet.
• REDIRECT - Redirect to a local socket with input rules only even if the packet is for a remote host. This applies to TCP or UDP packets.
• MASQ - Sets up IP masquerading. Works on TCP or UDP packets.
• RETURN - The next rule in the previous calling chain is examined. 

• -N Create a new chain
• -X Delete an empty chain
• -L List the rules in the chain
• -P Change the policy for a chain
• -F Flush=Delete all the rules in a chain
• -Z Zero the packet and byte counters in all chains

• -A Append a new rule to a chain.
• -I Insert a new rule at some position in a chain.
• -R Replace a rule at some position in a chain.
• -D Delete a rule at some position in a chain.
• Options for masquerading:
  • -M with -L to list the currently masqueraded connection.
  • -M with -S to set the masquerading timeout values.

• -s Source
• -d Destination
• -p Protocol=tcp, upd, icmp, all or a name from /etc/protocols
• -j Jump target, Specifies the target of the rule. The target can be a user defined chain, but not the one this rule is in.
• -i Interface=Name of the interface the packet is received on or the interface where the packet will be sent
• -t Mask used to modify the type of service (TOS) field in the IP header. This option is followed by two values, the first one is and'ed with the TOS field, and the second is exclusive or'ed. The masks are eight bit hexadecimal values. An example of use is "ipchains -A output -p tcp -d 0.0.0.0/0 telnet -t 0x01 0x10" These bits are used to set priority. See the section on IP message formats.
• -f Fragment

Examples of the use of ipchains to allow various services

Using ipchains-save and ipchains-restore to make rules permanent

1. Type the command "ipchains-save > /etc/iprules.save".
2. Create the following script named "packetfw":

   #! /bin/sh
   # Packet filtering firewall script to be used turn the firewall on or off
    
   if [ -f /etc/iprules.save ]
   then
      case "$1" in
         start)
             echo -n "Turning on packet filtering firewall:"
             /sbin/ipchains-restore < /etc/iprules.save
             echo 1 > /proc/sys/net/ipv4/ip_forward
             echo "."
             ;;
          stop)
             echo -n "Turning off packet filtering:"
             echo 0 > /proc/sys/net/ipv4/ip_forward
             /sbin/ipchains -X
             /sbin/ipchains -F
             /sbin/ipchains -P input ACCEPT
             /sbin/ipchains -P output ACCEPT
             /sbin/ipchains -P forward ACCEPT
             echo "."
             ;;
          *)
             echo "Usage: /etc/init.d/packetfw {start|stop}"
             exit 1
             ;;
      esac
      exit 0
   else
      echo the /etc/iprules.save file does not exist.
      exit 1
   fi

3. Save the file in the /etc/rc.d/init.d directory.
4. In the /etc/rc.d/rc3.d and the /etc/rc.d/rc5.d directories make a symbolic link called S07packetfw to the /etc/rc.d/init.d/packetfw file with the command "ln -s /etc/rc.d/rc3/S07packetfw /etc/rc.d/init.d/packetfw". This applies to runlevel 3. Do the same for the runlevel 5 initialization directory. Note: You may need to use a different number than the "S07" string to number your link file. Look in your /etc/rc.d/rc3.d and /etc/rc.d/rc5.d directories to determine what number is available to give this file. Try to give it a number just below your network number file. On my system the S10network file is used to start my network. 

1. Be sure the kernel has support for IP masquerading.
2. Be sure modules needed for support are loaded into the kernel.
3. Set up the firewall rules.

• IPCHAINS-HOWTO
• Firewall-HOWTO
• IP-Masquerade-HOWTO

# rc.firewall - Initial SIMPLE IP Masquerade setup for 2.0.x kernels using IPFWADM
#
# Load all required IP MASQ modules
#
#   NOTE:  Only load the IP MASQ modules you need.  All current available IP MASQ modules
#          are shown below but are commented out from loading.

# Needed to initially load modules
#
/sbin/depmod -a

# Supports the proper masquerading of FTP file transfers using the PORT method
#
/sbin/modprobe ip_masq_ftp

# Supports the masquerading of RealAudio over UDP.  Without this module,
#  RealAudio WILL function but in TCP mode.  This can cause a reduction
#  in sound quality
#
#/sbin/modprobe ip_masq_raudio

# Supports the masquerading of IRC DCC file transfers
#
/sbin/modprobe ip_masq_irc

# Supports the masquerading of Quake and QuakeWorld by default.  This modules is
#   for for multiple users behind the Linux MASQ server.  If you are going to play
#   Quake I, II, and III, use the second example.
#
#Quake I / QuakeWorld (ports 26000 and 27000)
#/sbin/modprobe ip_masq_quake
#
#Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960)
# /sbin/modprobe ip_masq_quake ports=26000,27000,27910,27960

# Supports the masquerading of the CuSeeme video conferencing software
#
#/sbin/modprobe ip_masq_cuseeme

#Supports the masquerading of the VDO-live video conferencing software
#
#/sbin/modprobe ip_masq_vdolive

#CRITICAL:  Enable IP forwarding since it is disabled by default since
#
#           Redhat Users:  you may try changing the options in /etc/sysconfig/network from:
#
#                       FORWARD_IPV4=false
#                             to
#                       FORWARD_IPV4=true
#
echo "1" > /proc/sys/net/ipv4/ip_forward

# Dynamic IP users:
#
#   If you get your Internet IP address dynamically from SLIP, PPP, or DHCP, enable this following
#       option.  This enables dynamic-ip address hacking in IP MASQ, making the life
#       with DialD, PPPd, and similar programs much easier.
#
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

# MASQ timeouts
#
#   2 hrs timeout for TCP session timeouts
#  10 sec timeout for traffic after the TCP/IP "FIN" packet is received
#  160 sec timeout for UDP traffic (Important for MASQ'ed ICQ users)
#
/sbin/ipchains -M -S 7200 10 160

# DHCP:  For people who receive their external IP address from either DHCP or BOOTP
#        such as ADSL or Cablemodem users, it is necessary to use the following
#        before the deny command.  The "bootp_client_net_if_name" should be replaced
#        the name of the link that the DHCP/BOOTP server will put an address on to?
#        This will be something like "eth0", "eth1", etc.
#
#        This example is currently commented out.
#
#
/sbin/ipchains -A input -j ACCEPT -i eth1 -s 0/0 67 -d 0/0 68 -p udp

# Enable simple IP forwarding and Masquerading
#
#  NOTE:  The following is an example for an internal LAN address in the 192.168.0.x
#         network with a 255.255.255.0 or a "24" bit subnet mask.
#
#         Please change this network number and subnet mask to match your internal LAN setup
#
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -s 10.1.199.0/24 -j MASQ