-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jan 04, 2017 at 10:54:53AM -0600, Richard Owlett wrote: > I'm searching for an introduction to iptables that leads me to > answers to the questions *I* have. I've got a flock of links I'm > working thru.
Take your time... > In the meantime I have a few questions. > > One of the links led to _Securing Debian Manual_ and in particular > "Appendix F - Security update protected by a firewall" > {https://www.debian.org/doc/manuals/securing-debian-howto/ap-fw-security-update.en.html} > > I follow the description as far as it goes - i.e. access is limited > to a specific URL. Aside of the (very valid) remarks by Dan, here a few points: (a) firewall rules concern (mainly) themselves with network things, that is, hosts and ports (to follow the -- rushed example in your reference, security.debian.org and 80, typically for HTTP or 443, typically for https. Saying that you "limit access to a specific URL" is most probably an error which comes from mixing up layers which don't belong together. (b) if you want good understanding on what firewall rules do, I'd recommend (at least) skimming a good networking book and trying to work through an example of how, e.g. one HTTP transaction (any other simple protocol might do) works, so you can "see" where the several parts of the URL fit in. Although a bit heavy, I can sincerely recommend "TCP/IP Illustrated" by Richard W. Stevens. > QUESTION 1 > What happens if the URL is not "security.debian.org" but my bank. > I assume that there is no problem with links within the same domain. > I DO know however that the site gets information from other sites to > handle my requests. From what I can follow they are JavaScripts > applets(right word) to display information. What would happen? Point above is relevant here: the host/port part of the URL terminates at http://www.yourbank.com So with firewall rules you can typically restrict wholesale for any URL which starts like this. Whatever (possibly insecure) Javascript comes through the connection is something the firewall rules are not concerned with (and how should they? they run in-kernel, and if you use encryption, something your bank better does, only your client (i.e. the browser) and the bank's web server should be able to read what's going on (otherwise you'd have a "man in the middle", something nobody using encryption really wants to have [1])). > Because of my my uncertainties intend to have a "sandboxed" install. > The associated partition will have only Debian and the browser. But you pointed out one of the big vulnerable spots these days: a browser (especially when it has dubious plugins. Adobe, I'm looking at you!). > Question 2 > There will be a separate install of Debian that I will use for > "everything else". Can the iptables of that install be set to allow > access to any domain *EXCEPT* my bank's? The goal being minimization > of "operator error". If your "sandboxed" install is setup to use your "everything else" install (which you consider reasonably secure, I take) as a router, then yes, you can tweak your mothership's iptables rules (forwarding) to keep your sandbox to see your bank's host (note the somewhat more restricted verbiage). > Question 3 > Is there a simple minded tool that I could enter the show in the > example in "Appendix F". Sorry, couldn't parse this question. Regards [1] Except for debugging purposes. Promised. - -- t > TIA > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlhtOTwACgkQBcgs9XrR2kYzPwCeIUTtlm4AFUmLzOaSSiwH11jk gRUAnRBVWlR9N5efCvxROCbXD4UG+YLE =KiTH -----END PGP SIGNATURE-----