Konzeption und Umsetzung einer Firewall mit nutzerindividuell einstellbaren Regeln mit IPTables unter Linux. Erfassung des Netztraffics aller Nutzer und Vorbereitung zur dynamischen Bandbreitenbeschränkung des Netztraffics der einzelnen Nutzer.

Der vorliegende Vortrag gibt einen Ueberblick ueber den neuen Kernel-Firewall von Linux 2.4, das Netfilter/iptables System. Es werden die Moeglichkeiten des neuen Systems erlaeutert sowie die Vergleiche mit den Vorgaengern praesentiert.

This thesis deals with filtering selected DDoS attacks on denial of the service. The the toretical part deals with the problems of general mechanisms used for DDoS attacks, defense mechanisms and mechanisms of detection and filtration. The practical part deals with the filtering of attacks using the iptables and IPS Suricata firewall on the Linux operating system in an experimental workplace using a network traffic generator to verify its functionality and performance, including the statistical processing of output data from filter tools using the Elasticsearch database.

This thesis is focused on the possibility of better networking security operating system GNU/Linux with an appropriate set of rules Netfilter. There was established a program to allow easy configuration of rules for IP Address versions 4 and 6. This program not only allows to set individual rules, but also interfere with the newly required service and decide, how it will be further worked with. The first is the theoretical part describes the network communication with the model TCP/IP, the following is the introduction of Netfilter and outlining the local security. The practical part describes the various technologies and methods used for programming. The result of this work is easy to use program to set firewall rules for IP Address versions 6 with the possibility of deciding on the new established network traffic. The program is designed for new users of the operating system, who want to better secure their computer without the knowledge of Netfilter.

Firewalls are one of the essential tools to secure any network. IPtables has been the defacto firewall in all Linux systems, and the developers behind IPtables are alsoresponsible for its intended replacement, NFtables. Both IPtables and NFtables arefirewalls developed to filter packets. Some services are heavily dependent on lowlatency transport of packets, such as VoIP, cloud gaming, storage area networks andstock trading. This work is aiming to compare the latency between the selectedfirewalls while under generated network load. The network traffic is generated byiPerf and the latency is measured by using ping. The measurement of the latency isdone on ping packets between two dedicated hosts, one on either side of the firewall.The measurement was done on two configurations one with regular forwarding andanother with PAT (Port Address Translation). Both configurations are measured whileunder network load and while not under network load. Each test is repeated ten timesto increase the statistical power behind the conclusion. The results gathered in theexperiment resulted in NFtables being the firewall with overall lower latency bothwhile under network load and not under network load. / Brandväggen är ett av de viktigaste verktygen för att säkra upp nätverk. IPtables harvarit den främst använda brandväggen i alla Linux-system och utvecklarna bakomIPtables är också ansvariga för den avsedda ersättaren, NFtables. Både IPtables ochNFtables är brandväggar som utvecklats för att filtrera paket. Vissa tjänster är starktberoende av att paket som skickas anländer med låg latens. Tjänster som VoIP, cloudgaming, lagringsnät och aktiehandel. Detta arbete syftar till att jämföra latensenmellan de valda brandväggarna under en genererad nätverkslast. Nätverkslastengenereras av iPerf och latensen mäts med hjälp av ping. Mätningen av latensen görs påpingpaketen mellan två dedikerade värdar, en på vardera sida av brandväggen.Mätningen gjordes på två olika konfigurationer, en med vidarebefordran och en annanmed portadressöversättning (eng. PAT, Port Address Translation). Bådakonfigurationerna mäts både under nätverksbelastning och utan nätverksbelastning.Varje test upprepas tio gånger för att öka den statistiska signifikansen bakomslutsatsen. Resultaten som samlats in i experimentet visade att NFtables varbrandväggen med generell lägre latens både under last och inte under last.

This master's thesis is meant to provide techniques in designing and building a standalone packet filtering firewall in Linux machines, mainly for small sites who don’t give much service to Internet users. It deals with attenuating the effect of the most common types of attacks using iptables. It guides how to design, implement, run, and maintain Firewall. Techniques for continuously monitoring attacks is attempted. It also give a historical, architectural and technical overview of firewalls and security attacks.

The diploma thesis addresses facility of QoS control with GNU/Linux tools iptables and iproute. An attention is focused especially on HTB and HFSC traffic shaping methods with regard to utilization in wireless networks. The paper also includes a simulation of ensuring QoS in wireless network with 802.11e amendment.

Konzeption und Umsetzung einer Firewall mit nutzerindividuell einstellbaren Regeln mit IPTables unter Linux. Erfassung des Netztraffics aller Nutzer und Vorbereitung zur dynamischen Bandbreitenbeschränkung des Netztraffics der einzelnen Nutzer.

The diploma thesis focuses on design of university firewall on Cisco platform. The design deals with important functionalities, which are used in the current solution. These include routing, network address translation, access control lists, VPN. The thesis furher deals with dynamic insertion rules, which are generated based on traffic analysis by Flowmon probe and its ADS module. The new design is implemented in a testing environment and its funcionality is verified. The thesis will serve like feasibility study for final implementation in the production MENDELU network.

Extended Berkeley Packet Filter (eBPF) is an instruction set and an execution environment inside the Linux kernel. eBPF improves flexibility for data processing and is realized via a virtual machine featuring both a Just-In-Time (JIT) compiler and an interpreter running in the kernel. It executes custom eBPF programs supplied by the user, effectively moving kernel functionality into user space. eBPF has received widespread adoption by companies such as Facebook, Netflix, and academia for a wide range of application domains. eBPF can be used to program the eXpress DataPath (XDP), a kernel network layer that processes packets closer to the NetworkInterface Card (NIC) for fast packet processing. In this thesis, eBPF with XDP, and Iptables, are considered as a Network function(NF), implemented in a Virtual Machine (VM) for packet filtering. The traffic source(source VM) and traffic sink (destination VM) are present in the same subnet. The aim of this thesis is, to understand and investigate the implementation of NFs inVMs and to analyze performance metrics. In VirtualBox, VMs are created to implement the NFs. The results are obtained for the measurements that are essential for the performance evaluation of the NFs, and presented in graphs.