Linux Firewalling...opinions desired....

Toggle sidebar Toggle sidebar
N

Need4Speed

Diamond Member
Dec 27, 1999
5,383
0
0
I'll start with my current setup:

Cable Mode -- Netgear RT311 NAT Router -- switches -- Several Linux Macines (Caching DNS & local DNS Server, Mail, HTTP) and a couple workstations

I've been toying with pulling the netgear out and replacing it with an iptables box of somekind. I know there are a ton of drop inplace nix firewall,s but I prefer the challange of learing it myself. I'll more than likely use debian for the firewall.

I know that I want a trusted and untrusted (DMZ for servers) zone behind the firewall. Being that I already have a router, I could set someting like this up:

Netgear -- Switch (setup dmz here) -- attach firewall here --- switch --- workstations.

This way I could use a plain old 2 nic iptables config.

or should I use a three nic firewall and not bother using the netgear router? If i decide to use the 3 nic version, how can I still allow my local workstations to send and retrieve mail through the DMZ?

Is the three nic version more difficult to configure? any advice would be appreciated.
 
B

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0
Honestly, learning iptables was very very hard for me, in fact I pretty much never learned it very well. It is very difficult for me to read. ipf, pf, and ipfw are all much, much nicer in syntax, IMO, but then again I don't know if you want to run a BSD.
 
N

Need4Speed

Diamond Member
Dec 27, 1999
5,383
0
0
is bsd that much easier for firewalling? id be willing to run whatever i need to...id rather run bsd and understand it 100% then iptables and leave a hole open
 
B

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0
ipf syntax:

pass in quick on xl0 proto udp from any to 20.20.20.2/32 port=53 keep state
pass in quick on xl0 proto tcp from any to 20.20.20.2/32 port=53 flags S keep state
pass in quick on xl0 proto tcp from any to 20.20.20.3/32 port=25 flags S keep state
pass in quick on xl0 proto tcp from any to 20.20.20.7/32 port=80 flags S keep state

iptables syntax:

/sbin/iptables -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
/sbin/iptables -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT
/sbin/iptables -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT
/sbin/iptables -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT

Just some snippets I grabbed on google, feel free to look for more. A lot of people use iptables and like it just fine, but I grew a very strong distaste for it. Just MO though.
 
S

Soybomb

Diamond Member
Jun 30, 2000
9,506
2
81
I agree with bbwf, I use to do ipchains and iptables, now I use freebsd with ipf and I think I was dumb for not doing it this way all along.

Some sample IPF rules:
block in quick on xl0 from 192.168.0.0/16 to any #RFC 1918 Private IP
block in quick on xl0 from 172.16.0.0/12 to any #RFC 1918 Private IP
block in quick on xl0 from 10.0.0.0/8 to any #RFC 1918 Private IP
pass in quick proto icmp from any to any icmp-type 0
pass in quick on xl0 proto tcp from any to asok/32 port = 80 flags S keep state keep frags

I can't even remember what that would like like in iptables...thankfully ;)
 
cleverhandle

cleverhandle

Diamond Member
Dec 17, 2001
3,566
3
81
While I love Linux for many things, I really like OpenBSD's PF for firewalls. If you haven't looked into that, I'd highly recommend it. The concepts are identical, so the following applies either way. Also, you don't specify what your IP addressing situation is. I'm assuming that you've got one public IP on the external interface of the Netgear, and everything is NAT'ed to private space inside. If not, that could change things considerably.

Your first example is

Netgear Router --> Switch (DMZ) --> Firewall --> Switch --> LAN

You say this would get you both a trusted and untrusted zone behind the firewall, but this is not true. Anything on the DMZ switch, while still NAT'ed, is not being filtered by the firewall. Maybe I'm misunderstanding you, though. In any event, you could set things up according to the above diagram. As far as routing goes, it would be easiest if the firewall were a bridge - no IP addresses, just passing traffic across the interfaces and filtering. The downside is that you need either a real console or a serial console to admin the box - you can't SSH to a box with no IP address. However, a better setup IMO would be...

Netgear Router --> Firewall (Bridge) --> Switch --> LAN/DMZ

That lets you filter traffic to the public machines. Even if their servers, there's no reason to let every single packet hit them unless there's no other choice (like with a passive FTP server, maybe). Give the servers static IP's outside the DHCP range, and give those IP's different rules than the workstations. Except for the lack of SSH, this is a pretty nice setup - easy to write rules for, and quite flexible in what it can do. For example, you can have a server offer internal-only services by blocking those services on the firewall, since LAN traffic won't pass through the firewall at all. As a variant of the above, you could set up the firewall as a NAT router and DHCP server instead of a bridge - then you configure the Netgear to pass everything through to the firewall and let it sort things out. That a bit more configuration, but gives you an IP for the firewall and full control over DHCP.

As you mention, you could probably ditch the Netgear altogether - I don't know cable modems, but I assume you can hook it direct to a machine, and get a public IP on that interface via PPPoE or DHCP? If so, then you could do...

Modem --> Firewall (Router, NAT, DHCP) --> Switch --> LAN

That would be a simpler version of the variant mentioned above. This is just a bit more complicated than the bridging scenarios to set up, and would be the most flexible and powerful in your situation. Unless you've got multiple public IP's, I don't see why you would need a three legged firewall. Any traffic you would distinguish by interface could be identified by IP just as well, provided your servers have static (private) IP's. You would only need a third interface if you needed to split traffic between public IP's and private NAT space.
 
skyking

skyking

Lifer
Nov 21, 2001
22,575
5,645
146
allow log logamount 100 tcp from any 3783 to any via ed0
deny ip from any to 192.0.2.0/24via ed0
allow log logamount 100 tcp from 24.24.24.24 to any 22 in recv ed0

Those are some examples of rc.firewall.dynip in FreeBSD's IPFW
Changes made there require a reboot to take affect.

You can open ports on the fly without booting, AND edit rc.firewall.dynip, and at the next boot, the changes will be permanent.

For adding a rule or opening a port without a reboot:
ipfw add <some number here> allow log logamount 100 tcp from 24.24.24.24 to any 22 in recv ed0 setup
I find it very straightforward to use, especially when using yy p in VI. I can do the instant change in ipfw add so someone can log in, then I go to rc.firewall.dynip and make it permanent if i wish.
 
N

Need4Speed

Diamond Member
Dec 27, 1999
5,383
0
0
well, sounds like bsd it is...ill have to do some reading up on this over the next couple days.. :)
 
B

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0
Originally posted by: skyking
allow log logamount 100 tcp from any 3783 to any via ed0
deny ip from any to 192.0.2.0/24via ed0
allow log logamount 100 tcp from 24.24.24.24 to any 22 in recv ed0

Those are some examples of rc.firewall.dynip in FreeBSD's IPFW
Changes made there require a reboot to take affect.
Click to expand...
You sure about that?
You can open ports on the fly without booting, AND edit rc.firewall.dynip, and at the next boot, the changes will be permanent.

For adding a rule or opening a port without a reboot:
ipfw add <some number here> allow log logamount 100 tcp from 24.24.24.24 to any 22 in recv ed0 setup
I find it very straightforward to use, especially when using yy p in VI. I can do the instant change in ipfw add so someone can log in, then I go to rc.firewall.dynip and make it permanent if i wish.
Click to expand...

There is *no* way to stop and restart ipfw? That can't be true.
 
skyking

skyking

Lifer
Nov 21, 2001
22,575
5,645
146
It is so deep in the kernel, there is no way to do it. I have looked into it, but it is really is not an issue. any temp changes can be handled with ipfw add, along with editing the rc.firewall.dynip file. It will do as you ask until next reboot, an continue to do so if you remember to edit the file accordingly.
 
B

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0
Originally posted by: skyking
It is so deep in the kernel, there is no way to do it. I have looked into it, but it is really is not an issue. any temp changes can be handled with ipfw add, along with editing the rc.firewall.dynip file.
Click to expand...

Damn, that is crazy. One more reason to use NetBSD and ipf :D :p
 
skyking

skyking

Lifer
Nov 21, 2001
22,575
5,645
146
Right, it is a bad thing for a firewall box to have it's primary function sooo integrated......
rolleye.gif
;)
I prefer the language to ipf, thank you:)
 
skyking

skyking

Lifer
Nov 21, 2001
22,575
5,645
146
i ran out of iiiiiiii's
it is edited now:)
It works for me, and the syntax of the config file looks more "plain language" to me. Proto, quick, keep state? what is up with that?
 
B

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0
Originally posted by: skyking
i ran out of iiiiiiii's
it is edited now:)
Click to expand...
Ah, my bad.

It works for me, and the syntax of the config file looks more "plain language" to me. Proto, quick, keep state? what is up with that?
Click to expand...
proto is protocol, quick means "finish matching at this rule" (vs matching the last rule that applies), keep state...keeps state. Dunno how to explain that one.
 
skyking

skyking

Lifer
Nov 21, 2001
22,575
5,645
146
There is no analog to it in IPFW, that is why I asked. I am going to try a multi-nic box, with 3 inside interfaces. Have you ever done one of those? I have a tulip 4 port nic i was going to try, and use it to subnet off wireless with only internet access, and one for the normal lan, and a server nic for http kinds of things.
 
Nothinman

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
That's what fwbuilder is for.

And if ipfw really needs an OS restart for changes things are f'd up, even OpenBSD has the pfctl command to test, reload, etc the pf.conf file.
 
Nothinman

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
but I prefer the challange of learing it myself. I'll more than likely use debian for the firewall.
Click to expand...

As much as I like Linux iptables annoys me, but if he's up for it more power to him.

Oh and fwbuilder produces really clean, commented scripts. It wouldn't be a bad place to start.
 
N

n0cmonkey

Elite Member
Jun 10, 2001
42,936
1
0
Originally posted by: skyking
There is no analog to it in IPFW, that is why I asked. I am going to try a multi-nic box, with 3 inside interfaces. Have you ever done one of those? I have a tulip 4 port nic i was going to try, and use it to subnet off wireless with only internet access, and one for the normal lan, and a server nic for http kinds of things.
Click to expand...

I currently have a 3 nic firewall machine at home. I have the outside nic, the "dmz" nic, and a wireless nic. It works just fine.
 
You must log in or register to reply here.

TRENDING THREADS

COMPANY
RESOURCES
FOLLOW
Top Bottom