Firewall Setup on RH 9

Firewall Setup on RH 9

[Christo Bezuidenhout]

[-- Attachment #1: Type: text/plain, Size: 574 bytes --]

I need to do the following.
 
1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2
is connected to my PPP0 interface for internet access. I need to add
NIC3 which will be second Private Network.
 
2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. 
NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to
Connect to NIC1 's network
 
I have my network already setup as in 1 above and it working very well.
I'm using iptables to get this running. 
 
Please mail me offline if more info needed or with a suggestion
 
Christo

[-- Attachment #2: Type: text/html, Size: 2046 bytes --]

Firewall Setup on RH 9

[Christo Bezuidenhout]

[-- Attachment #1: Type: text/plain, Size: 574 bytes --]

I need to do the following.
 
1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2
is connected to my PPP0 interface for internet access. I need to add
NIC3 which will be second Private Network.
 
2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. 
NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to
Connect to NIC1 's network
 
I have my network already setup as in 1 above and it working very well.
I'm using iptables to get this running. 
 
Please mail me offline if more info needed or with a suggestion
 
Christo

[-- Attachment #2: Type: text/html, Size: 2046 bytes --]

RE: Firewall Setup on RH 9

[Michael K]

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christo
Bezuidenhout
Sent: Thursday, July 03, 2003 8:38 AM
To: netfilter@lists.netfilter.org
Subject: Firewall Setup on RH 9


I need to do the following.

1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2
is connected to my PPP0 interface for internet access. I need to add
NIC3 which will be second Private Network.

2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. 
NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to
Connect to NIC1 's network

I have my network already setup as in 1 above and it working very well.
I'm using iptables to get this running. 

Please mail me offline if more info needed or with a suggestion

Christo 

Perhaps something like this.

NIC1=eth0
NIC2=ppp0
NIC3=eth1

modprobe ip_nat_ftp
 
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow everything out to $NIC2
iptables -A FORWARD -o $NIC2 -j ACCEPT
#Accept only connections from $NIC1 to $NIC3
iptables -A FORWARD -i $NIC1 -o $NIC3 -j ACCEPT

iptables -t nat -A POSTROUTING -o $NIC2 -j MASQUERADE
sysctl -w net.ipv4.ip_forward=1


/Klintan

Re: Firewall Setup on RH 9

[Michal Kepien]

>2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. 
>NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to
>Connect to NIC1 's network

NIC1 ---> eth0
NIC2 ---> eth1
NIC3 ---> eth2

NIC1's NETWORK: 192.168.0.0
NIC3's NETWORK: 192.168.1.0

NIC2's IP (external): 123.45.67.89 (an example - replace with real)

---START firewall-rules---
#!/bin/bash

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Flush all rules, user chains and packet counters
iptables -F
iptables -X
iptables -Z

# Set default policies to DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Create a custom chain, which will handle suspicious packets
iptables -N drop-and-log
iptables -A drop-and-log -j LOG --log-level info
iptables -A drop-and-log -j REJECT

# Enable loopback traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

######## INPUT rules ########
# First, deny packets from NIC3 to NIC1
iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 192.168.0.0/24 -j DROP

# Then, enable all other packets (needed for Internet access)
iptables -A INPUT -i eth0 -s 192.168.0.0/24 -d 0.0.0.0/0 -j ACCEPT
iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 0.0.0.0/0 -j ACCEPT

# Next, protect from IP spoofing
iptables -A INPUT -i eth1 -s 192.168.0.0/24 -d 0.0.0.0/0 -j
drop-and-log
iptables -A INPUT -i eth1 -s 192.168.1.0/24 -d 0.0.0.0/0 -j
drop-and-log

# Also, accept packets from the Internet
iptables -A INPUT -i eth1 -s 0.0.0.0/0 -d 0.0.0.0/0 -m state --state
ESTABLISHED,RELATED -j ACCEPT

# Finally, log everything else (and drop it)
iptables -A INPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j drop-and-log

######## OUTPUT rules ########
# We don't need to deny the packets from NIC3 to NIC1 once more as
# every packet goes through the INPUT chain _first_

# Accept re-masqueraded packets for both networks
iptables -A OUTPUT -o eth0 -s 0.0.0.0/0 -d 192.168.0.0/24 -j ACCEPT
iptables -A OUTPUT -o eth2 -s 0.0.0.0/0 -d 192.168.1.0/24 -j ACCEPT

# Deny stuffed routing
iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 192.168.0.0/24 -j
drop-and-log
iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 192.168.1.0/24 -j
drop-and-log

# Accept the packets going into the Internet
iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT

# Log everything else (and drop it)
iptables -A OUTPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j drop-and-log

######## FORWARD rules ########
# Enable incoming packets re-masquerading
iptables -A FORWARD -i eth1 -o ! eth1 -m state --state
ESTABLISHED,RELATED -j ACCEPT

# Enable outgoing packets masquerading
iptables -A FORWARD -i ! eth1 -o eth1 -j ACCEPT

# Log everything else (and drop it)
iptables -A FORWARD -j drop-and-log

# Configure the routing
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 123.45.67.89

---END firewall-rules---

This should do it. I've tested the script and it didn't cause any
errors, but this doesn't mean it _has to_ work as it is supposed to
(I've got a different configuration and so I couldn't test it for
real). Perhaps you may need to adjust the above script a bit for your
specific configuration. I'm also only a human and may have forgotten
something.

Just run the script from anywhere (e.g. './firewall-rules') and the
rules should be set.

BTW - why is there no packet tester in iptables (like the 'ipchains
-C' command)? This little thing was _so_ useful...

Michal Kepien

Re: Firewall Setup on RH 9

[Joel Newkirk]

On Fri, 2003-07-04 at 17:54, Michal Kepien wrote:
> >2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. 
> >NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to
> >Connect to NIC1 's network
> 
> NIC1 ---> eth0
> NIC2 ---> eth1
> NIC3 ---> eth2
> 
> NIC1's NETWORK: 192.168.0.0
> NIC3's NETWORK: 192.168.1.0

> # First, deny packets from NIC3 to NIC1
> iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 192.168.0.0/24 -j DROP

This needs to be FORWARD chain, not INPUT.  Since the traffic isn't
destined for the firewall box itself, it goes to the FORWARD chain.


> # Then, enable all other packets (needed for Internet access)
> iptables -A INPUT -i eth0 -s 192.168.0.0/24 -d 0.0.0.0/0 -j ACCEPT
> iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 0.0.0.0/0 -j ACCEPT

Same here.  All these rules do is allow those two subnets to access the
box itself, not the internet.


> ######## OUTPUT rules ########
> # We don't need to deny the packets from NIC3 to NIC1 once more as
> # every packet goes through the INPUT chain _first_
> 
> # Accept re-masqueraded packets for both networks
> iptables -A OUTPUT -o eth0 -s 0.0.0.0/0 -d 192.168.0.0/24 -j ACCEPT
> iptables -A OUTPUT -o eth2 -s 0.0.0.0/0 -d 192.168.1.0/24 -j ACCEPT

As above, this affects only traffic from the box itself, NOT forwarded
traffic.


> BTW - why is there no packet tester in iptables (like the 'ipchains
> -C' command)? This little thing was _so_ useful...

As I suspected from your misconception about forwarded traffic, you're 
an ipchains veteran... ;^)  With iptables FORWARD traffic never touches
the INPUT or OUTPUT chains, those are explicitly for INPUT and OUTPUT
to and from the box itself.

j

Re: Firewall Setup on RH 9

[Michal Kepien]

>As I suspected from your misconception about forwarded traffic, you're 
>an ipchains veteran... ;^)

Wow, thanks for the 'veteran' part :D Actually, I'm quite a newbie up
here, but you're right, I _was_ using ipchains as I was quite unaware
that it isn't the up-to-date tool to administer IP MASQ. However, the
scheme I included in the previous post was taken from the Linux IP
Masquerade HOWTO:

http://www.ibiblio.org/pub/Linux/docs/HOWTO/other-formats/html_single/IP-Masquerade-HOWTO.html#RC.FIREWALL-2.4.X-STRONGER

(quite long, sorry :)

>With iptables FORWARD traffic never touches the INPUT or OUTPUT chains,
>those are explicitly for INPUT and OUTPUT to and from the box itself.

I'm using the configuration I presented in the post and it works OK.
However, if you know an easier way to achieve the same goal, please
let me know :)

Below I attach my conception of packet traffic - it is taken from the
Linux IPCHAINS HOWTO, so it may be _not_ up-to-date. If the way
packets are treated changed in iptables, please tell me how.

|        ----------------------------------------------------------------
|        |            ACCEPT/                              lo interface |
|        v           REDIRECT                  _______                  |
|--> C --> S --> ______ --> D --> ~~~~~~~~ -->|forward|----> _______ --> 
|    h     a    |input |    e    {Routing }   |Chain  |     |output |ACCEPT
|    e     n    |Chain |    m    {Decision}   |_______| --->|Chain  |
|    c     i    |______|    a     ~~~~~~~~        |     | ->|_______|
|    k     t       |        s       |             |     | |     |    
|    s     y       |        q       |             v     | |     |    
|    u     |       v        e       v            DENY/  | |     v    
|    m     |     DENY/      r   Local Process   REJECT  | |   DENY/
|    |     v    REJECT      a       |                   | |  REJECT
|    |   DENY               d       --------------------- | 
|    v                      e -----------------------------
|   DENY                              

(i had to include pipes at the left to cheat line wrapping)

Michal Kepien

Re: Firewall Setup on RH 9

[Joel Newkirk]

On Sat, 2003-07-05 at 03:30, Michal Kepien wrote:

> >With iptables FORWARD traffic never touches the INPUT or OUTPUT chains,
> >those are explicitly for INPUT and OUTPUT to and from the box itself.
> 
> I'm using the configuration I presented in the post and it works OK.
> However, if you know an easier way to achieve the same goal, please
> let me know :)

# We'll consider eth2 the 'unsecure' LAN, and use ppp0 for external
# (it could just as easily be eth0 or whatever)
INTIF1 = eth1
INTIF2 = eth2
EXTIF = ppp0
INTIP1 = 192.168.0.0/24
INTIP2 = 192.168.1.0/24
EXTIP = a.b.c.d
IPT = /sbin/iptables
ADDFWD = "$IPT -A FORWARD"
ADDIN = "$IPT -A INPUT

$IPT -F
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

$ADDFWD -m state --state ESTABLISHED,RELATED -j ACCEPT
$ADDFWD -i $INTIF1 -s $INTIP1 -j ACCEPT
$ADDFWD -i $INTIF2 -s $INTIP2 -d !$INTIP1 -j ACCEPT
$ADDFWD -i $INTIF2 -d $INTIP1 -j LOG --log-level debug --log-prefix
"LAN2Prohib:"
$ADDFWD -i $INTIF2 -s !$INTIP2 -j LOG --log-level debug --log-prefix
"LAN2Spoof:"

$ADDIN -m state --state ESTABLISHED,RELATED -j ACCEPT
$ADDIN -i $INTIF1 -j ACCEPT

$IPT -t nat -A POSTROUTING -o $EXTIF -p SNAT --to $EXTIP



This will let LAN1 connect to LAN2, to the firewall box, or to the
internet without restriction.  It will let LAN2 connect ONLY to the
internet (without restriction).  It will let the firewall box connect to
anything without restriction.

Realistically this should be ACCEPTing only the required ports in
FORWARD and INPUT, and possibly OUTPUT as well.  Personally I prefer
DROP policy on OUTPUT and explicit ACCEPT of only traffic I want
outbound.  As it stands it offers security from incursions from the
internet or from LAN2, and 'masquerades' LAN1 and LAN2 behind the public
IP.  (be aware that iptables uses the target MASQUERADE to specify a
particular form of SNAT where it automatically determines the IP of the
outbound interface each time, used for dynamic IP setups.)

> Below I attach my conception of packet traffic - it is taken from the
> Linux IPCHAINS HOWTO, so it may be _not_ up-to-date. If the way
> packets are treated changed in iptables, please tell me how.

Essentially I already did... ;^)  The best tutorial, including a nice
diagram (in "Traversing of Tables and Chains"), is Oskar Andreasson's at
http://iptables-tutorial.frozentux.net .  There is a very different
diagram, as well as my own firewall script (a rather complex script that
actually IS a script, with multiple functions and parameters) at the
minimalist, incomplete http://live.newkirk.us/netfilter/index.html . 
The short of it is that a packet is inbound, goes through
nat-PREROUTING, then a routing decision is made:  thisbox?->INPUT 
else->FORWARD.

j