Firewall with only one eth0 device: possible?

Firewall with only one eth0 device: possible?

[Roman]

Hi,

I have an embedded system running uclinux with just one ethernet device 
and wonder whether or not I can build a firewall in combination with a 
switch (VLAN support, not WLAN).

How I thought it could work is the following:

Configure the eth0 device with an ip and network mask.
Configure the eth0:0 alias device with an ip and network mask different 
from eth0.
Use a switch with VLAN support.
Connect the eth0 linux device to port B of the switch; switch port A 
will then be one side of the firewall and port C the other side.
Configure the switch (VLAN) in a manner so all the incoming traffic on 
switch port A will be routed to port B and all the incoming traffic on 
port B will be routed to port C and back to port A.
Finally everything that enters port C will be routed to port B.


The question about all this is: Will the traffic be filtered between 
eth0 and eth0:0 as if there were two physical devices eth0 and eth1?

Thanks for any remarks on that.

roman


PS.: I know, this is an unusual way to build a firewall, but I simply 
can not change the hardware. For everyone who thinks, it is insecure 
because of none existing  physical separation: please forgive me.

Re: Firewall with only one eth0 device: possible?

[Taylor, Grant]

> I have an embedded system running uclinux with just one ethernet device
> and wonder whether or not I can build a firewall in combination with a
> switch (VLAN support, not WLAN).
> 
> How I thought it could work is the following:
> 
> Configure the eth0 device with an ip and network mask.
> Configure the eth0:0 alias device with an ip and network mask different
> from eth0.
> Use a switch with VLAN support.
> Connect the eth0 linux device to port B of the switch; switch port A
> will then be one side of the firewall and port C the other side.
> Configure the switch (VLAN) in a manner so all the incoming traffic on
> switch port A will be routed to port B and all the incoming traffic on
> port B will be routed to port C and back to port A.
> Finally everything that enters port C will be routed to port B.

You are close to what you need, but not quite there.  Rather than looking at aliased interfaces you need to add support for 802.1q VLAN tagging in the kernel and install VLAN tools (vconfig) on the router.  Once you have done that you will end up creating a VLAN tagged interface named eth0.1 (presuming the VLAN ID is 1) and eth0.2.  Note the "." (period) not the ":" (colon) as this denotes the difference between an alias and a VLAN interface.  You will then bring up your eth0 (raw) interface with out an IP address via "ifconfig eth0 0.0.0.0".  After your raw ethernet interface is up you will need to create your VLAN interfaces via (if memory and reference serves as it's been 6+ months...):

vconfig add eth0 1
vconfig add eth0 2

Now you will be able to assign IPs as you wish to eth0.1 and eth0.2 as you normally would, you can also firewall across two different devices as you normally would.  All you need to do on the managed switch is establish an 802.1q trunk on the switch port ("B" in your statement) connected to the server / router.  Establish a VLAN with a VID (VLAN ID) of 1 between ports "A" and "B" and a VLAN with a VID of 2 between ports "B" and "C".

> The question about all this is: Will the traffic be filtered between
> eth0 and eth0:0 as if there were two physical devices eth0 and eth1?

If you do what I have suggested things should work for you.  I have dome something very similar to this on a router at one of my client's.  I say similar because there were two (internal) LANs and 8 (no that is not a typo) cable modems that had to be connected to.  I did all of this with two ports on the router connected to a layer 2 managed switch, one was connected via a VLAN trunk to the various cable modems and the other was connected via a VLAN trunk to the two LANs.  In hind site I would have rather hooked all of the cable modems and LANs to one VLAN trunk and established the other as a backup either by STP or bonding.  STP would have worked with a 30 second down time for STP to realize what's going on, where as I think bonding would have taken over much quicker.

> Thanks for any remarks on that.

No problem.

> PS.: I know, this is an unusual way to build a firewall, but I simply
> can not change the hardware. For everyone who thinks, it is insecure
> because of none existing  physical separation: please forgive me.

You will have a pseudo physical, all be it via logical VLAN tags, separation so this should be a non issue.

As usual any comments or question are welcome.



Grant. . . .

Re: Re: Firewall with only one eth0 device: possible?

[Roman]

Thanks for the hint, Grant

I found some documentation on that in the datasheet of realtek 8309 
switch controller and on a support page of zyxel.
The realtek datasheet says that there are 4 tag/untag modes in that chip 
but does not tell you when the tagging or untagging is done (ingress or 
egress?)
On zyxel support page was stated that tagging will be done on ingress an 
untagging on egress if any tag changing is done at all. The zyxel 
approach sound good to me.

I hope all switch conntroller manufacturer implemented the IEEE 802.1q 
standard the same way. I do not know how much freedom there is the 
interpret 802.1q in different ways.

Do you or someone know what happens if tagged ethernet frames leave the 
switch ports A (VLAN1) and C (VLAN2, port B was the path to the uClinux 
eth0.1 /eth0.2) and VLAN unaware clients are hooked to this network 
segment? Will they cope with the VLAN frames and understand them? Or 
will they confuse the unaware devices and get dropped?

Thanks for any further advice


Roman

Re: Firewall with only one eth0 device: possible?

[Taylor, Grant]

Roman wrote:
> Thanks for the hint, Grant
> 
> I found some documentation on that in the datasheet of realtek 8309
> switch controller and on a support page of zyxel.
> The realtek datasheet says that there are 4 tag/untag modes in that chip
> but does not tell you when the tagging or untagging is done (ingress or
> egress?)
> On zyxel support page was stated that tagging will be done on ingress an
> untagging on egress if any tag changing is done at all. The zyxel
> approach sound good to me.
> 
> I hope all switch conntroller manufacturer implemented the IEEE 802.1q
> standard the same way. I do not know how much freedom there is the
> interpret 802.1q in different ways.
> 
> Do you or someone know what happens if tagged ethernet frames leave the
> switch ports A (VLAN1) and C (VLAN2, port B was the path to the uClinux
> eth0.1 /eth0.2) and VLAN unaware clients are hooked to this network
> segment? Will they cope with the VLAN frames and understand them? Or
> will they confuse the unaware devices and get dropped?

I think what you are asking about is covered under what is called egress filtering.  The way that I configured my switch (D-Link DES-3226L (worked great)) was to establish an 802.1q trunk (implies VLAN tagging) on the switch port(s) that connected to the router. I used egress filtering on all the other ports to tell the switch to NOT send 802.1q tags on any traffic leaving so as to prevent confusion to devices that don't know a thing about 802.1q VLANs.  Basically every port on the switch belongs to one VLAN, except the port(s) that connect to the router, and have been configured to send basic ethernet frames just like you would get out of a $15 hub.  The 802.1q trunked port(s), by the very nature of the trunking, will send (802.1q) VLAN tags in the ethernet frame header to indicate which VLAN the ethernet frame is from.  Your router will then receive these frames with the 802.1q and kno
 w which interface to send them to (eth0.1 or eth0.2).

I hope this helps you and answers some questions.  If you need more help I'd be glad to do so.  F.y.i. I do not have access to the DES-3226L to look at the config any more so I can't get you a copy, but I could help you regenerate one from scratch if need be.  I can play with VLAN tagging on my home router with a Cisco Catalyst 5000 at the house thus I can help you get your vconfig script correct.



Grant. . . .