(Note that there are many possible ways to set up a firewall; this document discusses only the most common approaches.)
If you've got a firewall, one of three things is probably true:
If the last possibility is true, then you'll be unable to access any Web site outside of your firewall. You must install (or have your system administrator install) proxy servers, or you must set up a packet-filtering router.
The idea behind a proxy-server-based firewall is to break the IP connection between the Internet and the internal network. Such a firewall system (called a "dual-homed host" or a "dual-homed gateway") has two separate network connections. A proxy server (such as sockd) takes in packets received by both connections and decides whether to send them on to the other side of the firewall.
In the SOCKS system, there's a single proxy server (sockd) that runs on the firewall host. Any application running on an internal host that needs to reach the Internet must be specially modified ("SOCKSified") to be SOCKS-aware. (Netscape Navigator has already been made SOCKS-aware.)
In a small homogeneous environment with only a few applications that need to reach outside the firewall, this is a workable solution. Unfortunately, in a large heterogeneous environment, the SOCKS approach requires a separate SOCKS-aware version of each application for each operating system. Thus, you might need to have separate SOCKS-aware versions of ftp, telnet, finger, an IRC client, and Netscape Navigator for each of several different brands of UNIX, not to mention any PCs that might be part of your internal network. This approach is a system administrator's nightmare in such a network.
You can obtain the sockd proxy server by anonymous ftp from various sites; download the SOCKS FAQ for information about SOCKS and how to get it. (Note that you can only use this link if you're already connected to the Internet.)
(Silicon Graphics® makes no warranty or representation regarding SOCKS software.)
The TIS Internet Firewall Toolkit provides a separate proxy server on the firewall host for each application, rather than a single proxy server for all applications. The applications themselves don't need to be modified; the users of internal hosts can use the same software they would use without a firewall. Each proxy server is fairly small and relatively easy to understand, though not necessarily easy to compile.
TIS provides source code for its Internet Firewall Toolkit for free; if you're an experienced administrator, you can go ahead and get this software from TIS. That company also provides a commercial pre-compiled version of the Toolkit, known as Gauntlet(TM), with full customer support. Unfortunately there's no Makefile for the free version of the Toolkit for Silicon Graphics systems as yet, so setting up the Toolkit on your firewall may be difficult.
(Silicon Graphics is not affiliated with TIS and makes no warranty or representation regarding any TIS product.)
This approach involves attaching a screening router to your internal network, with one connection to the Internet and another to your internal network. Security on such a system takes the form of an elaborate table specifying which packets should be routed through to the other side of the router. It's very difficult to specify the correct routing rules for such a table, and if you make a mistake you leave holes in your security; so this is not a recommended approach unless you're a very experienced system administrator. Screening routers aren't set up to allow proxies or authentication.
Combining a screening router with a dual-homed host can provide better security than either individual approach; even if you already have a screening router, you may want to consider adding proxy-server software. Among other security features, proxy servers prevent the IP spoofing problem that can breach security in a screening-router-only firewall.