A private street with one front door
Imagine a street of houses with private numbers: 1, 2, 3. Letters from outside cannot use those numbers. They are all sent to one front door, and a clerk sorts them.
A gateway works like that clerk. It also has a list of rules saying who may come in.
Today you set up both.
Key words
| Word | What it means |
|---|---|
| Firewall | a device or program that allows or blocks traffic by rules |
| Port | a number that says which service on a computer the traffic is for |
| Protocol | an agreed set of rules for sending data |
| NAT | network address translation: changing addresses as traffic passes a gateway |
| Masquerade | NAT where private addresses are swapped for the gateway's own |
| Port forwarding | sending outside traffic for one port to a device inside |
| Gateway | the device between a private network and the outside |
| Load balancer | a device that shares requests between servers |
| Private address | an address used inside a network, not on the open internet |
| DNS | a service that turns a name into an address |
| Packet | a small piece of data sent over a network |
| Network | computers and devices joined so they can share data |
| IP address | the number that identifies a device on a network |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can choose ports and protocols for a firewall, apply a rule, set up address translation and port forwarding, and test them.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Ports and protocols you will meet
| Port | Protocol | What it is for | Allow it when |
|---|---|---|---|
| 80 | HTTP over TCP | Web pages, not encrypted | You run a public web page |
| 443 | HTTPS over TCP | Web pages, encrypted | You run any web site |
| 22 | SSH over TCP | Secure remote command line | Staff manage a server remotely |
| 53 | DNS over UDP and TCP | Turning names into addresses | Devices need to look up names |
| 67 and 68 | DHCP over UDP | Giving out addresses | Only inside the network that gives them |
| 25 | SMTP over TCP | Sending email between servers | You run a mail server |
The cells students fill in are left blank in this preview.
The rule that is already there
The gateway starts with a short firewall. The rule list says: drop everything that is passing through, except replies and anything that starts inside the LAN.
That is the safe way to build a firewall. Block first, then allow only what you need.
Press Start the lab. Then ask the outside server for its page from the LAN.
Ask the outside server for a page
sudo ip netns exec lan curl -s --noproxy '*' -m 3 http://203.0.113.2:8000/A command for the lesson’s lab terminal. It is shown here and not run.