howto set up a virtual firewall?

howto set up a virtual firewall?

[Kurt Neufeld]

Hey there,

I've search high and low but can't find an answer to my problem and I 
find it hard to believe that I'm the only person that wants to do this.

I would like to setup a virtual machine that is my firewall. So far I've 
got Shorewall setup in a virtual machine and the

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

howto set up a virtual firewall?

[Kurt Neufeld]

Hey there,

I've searched high and low but can't find an answer to my problem and I
find it hard to believe that I'm the only person that wants to do this.

I would like to setup a virtual machine that is my firewall. So far I've
got Shorewall setup in a virtual machine and the "internal" nic works 
and I can ping the host and vice versa.

However, I can't figure out the "external" nic. I've setup bridging on 
my hosts eth0 (currently my internet facing nic) but if I understand

3. public bridge from http://kvm.qumranet.com/kvmwiki/Networking then I 
have to have an ip address on my host? That would defeat the purpose of 
the virtual firewall.

So what I want is to have the virtual machine have "complete" control of 
the external nic (not configured, no ip addr on host), the internal nic 
can either be on a virtual network or bridged internally, either works 
for me.

Current config at end.

Thanks for any assistance,
Kurt

ps - sorry for the previous incomplete post

<domain type='kvm'>
   <name>fw</name>
   <uuid>76bfb29c-ebd8-7d25-6009-0874d8cca460</uuid>
   <memory>262144</memory>
   <currentMemory>262144</currentMemory>
   <vcpu>1</vcpu>
   <os>
     <type>hvm</type>
     <boot dev='hd'/>
   </os>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>
   <on_crash>destroy</on_crash>
   <devices>
     <emulator>/usr/bin/qemu-kvm</emulator>
     <disk type='block' device='disk'>
       <source dev='/dev/lvm-1/vm-fw'/>
       <target dev='hda'/>
     </disk>
     <disk type='file' device='cdrom'>
       <source file='/tmp/smoothwall-express-3.0-x86_64.iso'/>
       <target dev='hdc'/>
       <readonly/>
     </disk>
     <interface type='bridge'>
       <mac address='00:50:04:7f:b5:a3'/>
       <source bridge='br0'/>
     </interface>
     <interface type='network'>
       <mac address='00:16:3e:06:8c:10'/>
       <source network='virtnet'/>
     </interface>
     <input type='mouse' bus='ps2'/>
     <graphics type='vnc' port='-1' listen='127.0.0.1'/>
   </devices>
</domain>

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: howto set up a virtual firewall?

[Avi Kivity]

Kurt Neufeld wrote:
> Hey there,
>
> I've searched high and low but can't find an answer to my problem and I
> find it hard to believe that I'm the only person that wants to do this.
>
> I would like to setup a virtual machine that is my firewall. So far I've
> got Shorewall setup in a virtual machine and the "internal" nic works 
> and I can ping the host and vice versa.
>
> However, I can't figure out the "external" nic. I've setup bridging on 
> my hosts eth0 (currently my internet facing nic) but if I understand
>
> 3. public bridge from http://kvm.qumranet.com/kvmwiki/Networking then I 
> have to have an ip address on my host? That would defeat the purpose of 
> the virtual firewall.
>
> So what I want is to have the virtual machine have "complete" control of 
> the external nic (not configured, no ip addr on host), the internal nic 
> can either be on a virtual network or bridged internally, either works 
> for me.
>   

Assuming you have eth0 on the host, tap0 on the host visible as eth0 in 
the guest, and tap1 in the host visible as eth1 in the guest, you can 
add a bridge between eth0 and tap0, and use tap1 as the nic in the host 
for IP (e.g. run 'dhclient tap1' to obtain an internal IP address).


-- 
Any sufficiently difficult bug is indistinguishable from a feature.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: howto set up a virtual firewall?

[Javier Guerra]

On 2/20/08, Avi Kivity <avi@qumranet.com> wrote:
> Assuming you have eth0 on the host, tap0 on the host visible as eth0 in
>  the guest, and tap1 in the host visible as eth1 in the guest, you can
>  add a bridge between eth0 and tap0, and use tap1 as the nic in the host
>  for IP (e.g. run 'dhclient tap1' to obtain an internal IP address).

note that if you do that, there's no need to set IP address on the host's eth0

check the Xen maillist archive; this kind of setup is common there,
but they use some heavy iface renaming to make it look more 'normal'
(but a lot harder to initially grok)



-- 
Javier

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: howto set up a virtual firewall?

[Kurt Neufeld]

Avi Kivity wrote:
> 
> Assuming you have eth0 on the host, tap0 on the host visible as eth0 in 
> the guest, and tap1 in the host visible as eth1 in the guest, you can 
> add a bridge between eth0 and tap0, and use tap1 as the nic in the host 
> for IP (e.g. run 'dhclient tap1' to obtain an internal IP address).

It turns out I did have everything correctly configured but it still 
doesn't work. The problem is that I cannot get a DHCP address on my vm.

I can see the DHCP Request packets going out and can see the Replies 
getting back to my physical card that I'm running tcpdump on. But for 
some reason the vm doesn't get/see them. The host has no iptables rules, 
all policies set to ACCEPT (yikes!).

I even tried 'echo 1 > /proc/sys/net/ipv4/conf/*/bootp_relay' but that 
didn't help.

If I configure the vm nic with a static address (the one that my host 
just gave up) then I can surf the net, even forward packets from my host 
machine that no longer has a public ip address. Unfortunately that is 
not an acceptable long term solution.

Some general questions, should br0 be up or down? What should my vm MAC 
be? The same as my physical card (peth) which is also the same as the 
bridge (br0)? The vnet0 does not match. (output later)

Somewhat related, I setup my internal nic as a bridge as well, but I 
can't get the vm to get a dhcp address there either. Can one member of a 
bridge get a dhcp address from another member of the bridge?

I'm running fedora 8 with kernel 2.6.23.15-137.fc8 if that makes any 
difference.

[root@xavier ~]
# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0050047fb5a3       no              peth0
                                                         vnet0
br1             8000.001617d8fc32       no              peth1
                                                         vnet1

br0 is external
br1 is internal

[root@xavier ~]
# ifconfig |grep HWaddr
br0       Link encap:Ethernet  HWaddr 00:50:04:7F:B5:A3
br1       Link encap:Ethernet  HWaddr 00:16:17:D8:FC:32
peth0     Link encap:Ethernet  HWaddr 00:50:04:7F:B5:A3
peth1     Link encap:Ethernet  HWaddr 00:16:17:D8:FC:32
vnet0     Link encap:Ethernet  HWaddr 00:FF:79:58:28:0F
vnet1     Link encap:Ethernet  HWaddr 00:FF:DB:40:5D:D2


Thanks for the replies, please keep them coming!

Kurt

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: howto set up a virtual firewall?

[Kurt Neufeld]

Kurt Neufeld <kneufeld <at> burgundywall.com> writes:
> 
> It turns out I did have everything correctly configured but it still 
> doesn't work. The problem is that I cannot get a DHCP address on my vm.

Almost correctly.

> Some general questions, should br0 be up or down? What should my vm MAC 
> be? The same as my physical card (peth) which is also the same as the 
> bridge (br0)? The vnet0 does not match. (output later)

br0 needs to be up. peth0 should have a different mac address. Found out this
breakthrough on a Xen page: http://wiki.xensource.com/xenwiki/XenNetworking

So I got it working and life is now good.

Here's my rc.local script (which will probably change slightly as I refine what
I'm trying accomplish).

rc.local:
	ifdown br0
	
	ip link set peth0 down
	ip link set peth0 address 00:ff:ff:ff:ff:00 arp off
	
	ifup peth0
	
	sleep 1
	
	ifup br0        # but with no ip address, new mac address
	
	route add default gw 192.168.5.254
	
	iptables -P FORWARD DROP
	iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
	
	service libvirtd start


::::::::::::::
ifcfg-br0
::::::::::::::
DEVICE=br0
BOOTPROTO=none
ONBOOT=yes
TYPE=bridge

MACADDR=fe:ff:ff:ff:ff:00 # doesn't work unfortunately

::::::::::::::
ifcfg-peth0
::::::::::::::
# 3Com Corporation 3c900B-TPO Etherlink XL [Cyclone]
DEVICE=peth0
HWADDR=00:50:04:7F:B5:A3
ONBOOT=yes
BRIDGE=br0


So over the weekend I got a virtual smoothwall firewall up and running and also
a virtual CentOS 5 mail and http server. I can now upgrade my "desktop" with
virtual impunity. 

Thanks team.

Kurt



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/