tags:

views:

110

answers:

2

I am beginning work on an intelligent firewall but before I do that I need to understand clearly how a very basic firewall will work. Since me and my team is most comfortable in C we are going to use that.

Could someone give example of a very basic firewall written in C.

+4  A: 

Developing a correct firewall is no trivial task. You need a full understanding of the underlying operating system's network stack and of the various protocols at all layers of the OSI model.

The netfilter/iptables project, responsible for the most widely used packet filtering software for Linux, is open source, and should provide you with a good view of what goes into a firewall. It's certainly not in the "very basic" category, but I'd be wary of any firewall software the claimed to be "very basic."

James McNellis
I know its not trivial but a a most basic firewall that demonstrates packet filtering should exist.
AJ
@Ankit: not at all. (should exist) That's because TCP/IP is not basic.
EFraim
+1  A: 

Typically, most firewalls for Linux are a compilation of shell scripts that organize strings to be sent to the iptables, or sometimes ebtables command depending on if bridging is in play. Additionally, they make talk to the tc utility if traffic shaping is in use.

Shorewall is an example of such a firewall, but it does a lot more. It lets you set up various types of NATs, security around VPNs and more.

It looks like you want to do this completely in C. I would recommend obtaining the source to iptables and becoming intimately familiar with the ioctl hooks provided by its kernel counterpart. At that point, you'll be able to begin the process of writing your own wrappers that accomplish what you need to do.

NB: Root needs to be the user running your application, make sure you design for (or around) that.

Tim Post