Management of bridged iptables

Management of bridged iptables

[traef06]

I've been scouring Google searches looking for an answer. If this is the wrong forum, please forgive me.

I want to be able to setup iptables and I guess ebtables for a bridged firewall. My problem is that I also need to be able
to manage this remotely like with ssh or something.

How do I do this and still be able to maintain a "stealthy" firewall?

Thank you in advance for any help.

Thomas J. Raef
e-Based Security, Inc.
"You're either hardened, or you're hacked!"

RE: Management of bridged iptables

[Rob Sterenborg]

Symantec Mail Security replaced Message Body with this text message.  The original text contained prohibited content and was quarantined.

ID:MS_LEU1::SYQ450da5c3 


********* DISCLAIMER ********* 
De informatie in dit E-mail bericht is uitsluitend bestemd voor de geadresseerde. Verstrekking aan en gebruik door anderen is niet toegestaan.
Door de elektronische verzending van het bericht kunnen er geen rechten worden ontleend aan de informatie. TTP staat niet in voor de juiste en volledige overbrenging van de inhoud van een verzonden E-mail, noch voor tijdige ontvangst daarvan. 

Re: Management of bridged iptables

[Mohamed Eldesoky]

You can give the firewall an IP address, on any interface, whether
part of the bridge or not part of the bridge.
This will still keep the firewall stealthy (not shown in traceroutes),
as that IP is not a gateway for any server !!

On 4/26/05, traef06@ebasedsecurity.com <traef06@ebasedsecurity.com> wrote:
> I've been scouring Google searches looking for an answer. If this is the wrong forum, please forgive me.
> 
> I want to be able to setup iptables and I guess ebtables for a bridged firewall. My problem is that I also need to be able
> to manage this remotely like with ssh or something.
> 
> How do I do this and still be able to maintain a "stealthy" firewall?
> 
> Thank you in advance for any help.
> 
> Thomas J. Raef
> e-Based Security, Inc.
> "You're either hardened, or you're hacked!"
> 
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: Management of bridged iptables

[traef06]

Thank you.

So, just for my clarification, if I have eth0 (outside interface) and eth1 as my internal interface and they both
are used to form br0, I could assign eth0 an external IP address so that I can ssh into the box for management?

Am I following his correctly?

Then can I also assign eth1 an internal IP address so that I can manage it from within as well? This won't harm the bridge
interface br0?

Thank you in advance for all your assistance.


Thomas J. Raef
e-Based Security, Inc.
"You're either hardened, or you're hacked!" 

-------- Original Message --------
> From: Mohamed Eldesoky <eldesoky.lists@gmail.com>
> Sent: Tuesday, April 26, 2005 3:32 AM
> To: traef06@ebasedsecurity.com
> Subject: Re: Management of bridged iptables
> 
> You can give the firewall an IP address, on any interface, whether
> part of the bridge or not part of the bridge.
> This will still keep the firewall stealthy (not shown in traceroutes),
> as that IP is not a gateway for any server !!
> 
> On 4/26/05, traef06@ebasedsecurity.com <traef06@ebasedsecurity.com> wrote:
> > I've been scouring Google searches looking for an answer. If this is the wrong forum, please forgive me.
> > 
> > I want to be able to setup iptables and I guess ebtables for a bridged firewall. My problem is that I also need to be able
> > to manage this remotely like with ssh or something.
> > 
> > How do I do this and still be able to maintain a "stealthy" firewall?
> > 
> > Thank you in advance for any help.
> > 
> > Thomas J. Raef
> > e-Based Security, Inc.
> > "You're either hardened, or you're hacked!"
> > 
> > 
> 
> 
> -- 
> Mohamed Eldesoky
> www.eldesoky.net
> RHCE 

Re: Management of bridged iptables

[Mohamed Eldesoky]

Why don't you give the br0 an IP !!?


On 4/27/05, traef06@ebasedsecurity.com <traef06@ebasedsecurity.com> wrote:
> Thank you.
> 
> So, just for my clarification, if I have eth0 (outside interface) and eth1 as my internal interface and they both
> are used to form br0, I could assign eth0 an external IP address so that I can ssh into the box for management?
> 
> Am I following his correctly?
> 
> Then can I also assign eth1 an internal IP address so that I can manage it from within as well? This won't harm the bridge
> interface br0?
> 
> Thank you in advance for all your assistance.
> 
> 
> Thomas J. Raef
> e-Based Security, Inc.
> "You're either hardened, or you're hacked!"
> 
> -------- Original Message --------
> > From: Mohamed Eldesoky <eldesoky.lists@gmail.com>
> > Sent: Tuesday, April 26, 2005 3:32 AM
> > To: traef06@ebasedsecurity.com
> > Subject: Re: Management of bridged iptables
> >
> > You can give the firewall an IP address, on any interface, whether
> > part of the bridge or not part of the bridge.
> > This will still keep the firewall stealthy (not shown in traceroutes),
> > as that IP is not a gateway for any server !!
> >
> > On 4/26/05, traef06@ebasedsecurity.com <traef06@ebasedsecurity.com> wrote:
> > > I've been scouring Google searches looking for an answer. If this is the wrong forum, please forgive me.
> > >
> > > I want to be able to setup iptables and I guess ebtables for a bridged firewall. My problem is that I also need to be able
> > > to manage this remotely like with ssh or something.
> > >
> > > How do I do this and still be able to maintain a "stealthy" firewall?
> > >
> > > Thank you in advance for any help.
> > >
> > > Thomas J. Raef
> > > e-Based Security, Inc.
> > > "You're either hardened, or you're hacked!"
> > >
> > >
> >
> >
> > --
> > Mohamed Eldesoky
> > www.eldesoky.net
> > RHCE
> 
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: Management of bridged iptables

[Taylor, Grant]

> Why don't you give the br0 an IP !!?

If you are wanting an IP address that you can connect to to be able to manage a device that is functioning as a firewall router you quite often want to be able to access it from both sides of the router even when things are not functioning.  Thus it is quite common to have an external IP on the external interface and an internal IP on the internal interface.  This will allow you to connect to the firewall and manage it no matter what the state of the forwarding and / or bridging.



Grant. . . .