Great Circle Associates logo

Building Internet Firewalls

First Edition (no longer available)

Second Edition released June 2000

First Edition (no longer available; Second Edition released June 2000)

Building Internet Firewalls cover by D. Brent Chapman and Elizabeth D. Zwicky

Published by O'Reilly & Associates
1st Edition September 1995
517 Pages
ISBN 1-56592-124-0

List price $32.95

The Networking CD Bookshelf Now also available on CD-ROM, along with 5 other top O'Reilly & Associates networking books, in The Networking CD Bookshelf

The package includes a CD-ROM with the complete text and graphics of these books, formatted in HTML, readable with any web browser, and fully searchable and cross-referenced:

As a bonus, a hardcopy version of DNS and BIND, 3rd Edition is also included.


Everyone is jumping on the Internet bandwagon, despite the fact that the security risks associated with connecting to the Internet have never been greater. This book is a practical guide to building firewalls on the Internet. It describes a variety of firewall approaches and architectures and discusses how you can build packet filtering and proxying solutions at your site. It also contains a full discussion of how to configure Internet services (e.g., FTP, SMTP, Telnet) to work with a firewall, as well as a complete list of resources, including the location of many publicly available firewall construction tools.

Key Points

The book is practical, not theoretical, unlike so many security books. It shows clearly what you need to decide and what you need to do to select and install a firewall.

The book is filled with diagrams that help make complex concepts easy to follow.

Although this book is aimed primarily at system administrators, Parts I and III of the book, which discuss Internet security risks, pros and cons of firewalls, and the development of security policies and responses to security incidents, are appropriate for managers and anyone who needs to make a business decision about the risks of getting connected to the Internet.


More than a million systems are now connected to the Internet, and something like 15 million people in 100 countries on all seven continents use Internet services. More than 100 million email messages are exchanged each day, along with countless files, documents, and audio and video images.

Everyone is jumping on the Internet bandwagon. Once a haven for academicians and scientists, the Net is now reaching large and small businesses, government at all levels, school children, and senior citizens. The commercial world is rushing headlong into doing business on the Internet, barely pausing while technologies and policies catch up with their desire to go online. But, too few of the seekers after Internet wisdom and riches consider whether their businesses will be safe on the Internet.

What kinds of security risks are posed by the Internet? Some risks have been around since the early days of networking -- password attacks (guessing them or cracking them via password dictionaries and cracking programs), denial of service, and exploiting known security holes. Some risks are newer and even more dangerous -- password sniffers, IP (Internet Protocol) forgery, and various types of hijacking attacks.

Firewalls are a very effective way to protect your system from these Internet security threats. Firewalls in computer networks keep damage on one part of the network (e.g., eavesdropping, a worm program, file damage) from spreading to the rest of the network. Without firewalls, network security problems can rage out of control, dragging more and more systems down.

What is a firewall? It's a hardware and/or software solution that restricts access from your internal network to the Internet -- and vice versa. A firewall may also be used to separate two or more parts of your local network (for example, protecting finance from R&D). The firewall is installed at the perimeter of the network, ordinarily where it connects to the Internet. You can think of a firewall as a checkpoint; all traffic, incoming and outgoing, is stopped at this point. Because it is, the firewall can make sure that it is acceptable. "Acceptable" means that whatever is passing through -- email, file transfers, remote logins, NFS mounts, etc. -- conforms to the security policy of the site.

Building Internet Firewalls  is a practical guide to building firewalls on the Internet. If your site is connected to the Internet, or if you're considering getting connected, you need this book. It describes a variety of firewall approaches and architectures and discusses how you can build packet filtering and proxying solutions at your site. It also contains a full discussion of how to configure Internet services (e.g., FTP, SMTP, Telnet) to work with a firewall. The book also includes complete list of resources, including the location of many publicly available firewall construction tools. The book is divided into four parts:

Part I discusses Internet threats, the benefits of firewalls, overall security strategies, and a summary of Internet services and their security risks.

Part II describes possible firewall designs and general terms and concepts, how to protect the bastion host in your firewall configuration, how to build proxying and packet filtering firewalls, and how to configure Internet services to operate with a firewall.

Part III describes how to maintain a firewall, develop a security policy, and respond to a security incident.

Part IV contains appendices consisting of a resource summary, a directory of how to find firewall toolkits and other security-related tools, and a detailed summary providing TCP/IP background information.


Primarily system administrators, although managers who are concerned about securing their systems or deciding whether to connect to the Internet will get a lot of general information from Parts I and III of this book.

Table of Contents

Foreword - by Ed DeHart (CERT Coordination Center)



In these dangerous times, firewalls should be at the very center of your security plans. . .  Chapman and Zwicky have written a book that will raise consciousness of, and competence in, Internet security to a new level. 
-- Ed DeHart, Technical Advisor at the Computer Emergency Response Team Coordination Center (CERT-CC)

By focusing on firewalls and how they provide network-wide protection from the outside world, this must-have book stands out from the crowd. . .  If you are building, buying, managing, or just considering a firewall, this is the book you want.
-- Steve Simmons, president of Inland Sea, former president of the System Administrators Guild (SAGE)

Building Internet Firewalls, by Brent Chapman and Elizabeth Zwicky, is a must have. ... Brent and Elizabeth have produced a genuinely practical volume limning a variety of approaches on a range of platforms. Not only is this book useful, it is readable. Unlike most technical volumes, which appear to have been written by a Martian with a dictionary, Building Internet Firewalls is literate. It contains comprehensible glosses of terms and three useful appendices. I could go on and on, but I'm sure that a real sys admin will do a long review of this. But it is a really fine job. ... Brent and Elizabeth deserve our collective thanks for their work.
-- Peter Salus, in his column The Bookworm in the December 1995 issue of ;login:, the newsletter of the USENIX Association.

About the Authors

D. Brent Chapman is a consultant in the San Francisco Bay Area, specializing in Internet firewalls. He has designed and built Internet firewall systems for a wide range of clients, using a variety of techniques and technologies. Before founding Great Circle Associates, he was operations manager for a financial services company, a world-renowned corporate research lab, a software engineering company, and a hardware engineering company. He holds a bachelor of science degree in electrical engineering and computer science from the University of California, Berkeley. He is the manager of the Firewalls Internet mailing list.  In his spare time, Brent is a volunteer search and rescue pilot, disaster relief pilot, and mission coordinator for the California Wing of the Civil Air Patrol (the civilian auxiliary of the United States Air Force).

Elizabeth D. Zwicky is a senior system administrator at Silicon Graphics and the president of SAGE (the System Administrators Guild). She has been doing large-scale UNIX system administration for 10 years and was a founding board member of both SAGE and BayLISA (the San Francisco Bay Area system administrators' group), as well as a non-voting member of the first board of the Australian system administration group, SAGE-AU. She has been involuntarily involved in Internet security since before the Internet worm. In her lighter moments, she is one of the few people who makes significant use of the "rand" function in PostScript, producing PostScript documents that are different every time they're printed.



Available at a discount from
Order your copy today!
Great Circle Associates, Inc.
2608 Buena Vista Ave.
Alameda, CA 94501 USA

Please report problems to Webmaster@GreatCircle.COM
Copyright © 2019 Great Circle Associates, Inc.
USA Toll Free: 877 GRT CRCL
(877 478 2725)
International: +1 415 861 3588
Fax: +1 415 552 2982

Search Internet Search