Firewall programming

Take a look at this site:

http://www.netfilter.org/

Here you can find information regarding firewall setup. That is what 'firewall programming' usually means. The firewall is not the application that runs (like iptables), but the script that determines what is good and what is bad traffic.


If you meant writing your own packet filter, you should take a look at this site:

http://winpcap.polito.it/

In my case the last is the most relevant - however I am targeting a linux platform. I know that I'm reinventing the wheel here, but its as much part of a learning process as a production.

I was going to suggest looking into LSP, but that's for Windows.

on a very generalized level a firewall listens on all ports and then sends to the internal network only those packets which meet the requirements as set by the user. at the simplest level you can make a port filter and only allow traffic through that comes to certain ports. the easiest way to do a firewall would be as a seperate machine. As a naive implementation you could do something like set up listeners on all ports on the machine and then just relay the "good" ports to the internal network. you'd need 2 ethernet cards: the listener and the internal network broadcaster. later on you could delve into more in-depth packet filtering.

if you're doing a software firewall that would run on a user's machine it'd probably have to be a driver level program. my guess would be that you'd hook into the TCP/IP stack and intercept all net traffic before it gets to whoever is bound to each port internally. then you'd essentially do the same logic as above and relay through the stack only those packets that meet the correct criteria.

as you can tell i'm not up on the specifics of firewall implementation. give google a try. :)

-me

Opening up 65K listen sockets doesn't sound like a good idea to me...

Toolmaker

Um... iptables.

If you want to write your own firewall code for Linux (i.e. replace the Linux iptables code) you'll want to look into the Linux kernel sources. You'll have to get pretty dirty and low-level to do this; it's definitely a non-trivial task.

Having given sufficient warning, the way iptables works is as a set of netfilter hooks. You could use netfilter and write your own set of hooks in order to process packets and accept/deny/drop/whatever.

cheers
sam