Message

From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Christo Bezuidenhout" Subject: Firewall Setup on RH 9 Date: Thu, 3 Jul 2003 08:37:39 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <015201c3412d$992c0ac0$660210ac@christo> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0153_01C3413E.5CB66160" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0153_01C3413E.5CB66160 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I need to do the following. 1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2 is connected to my PPP0 interface for internet access. I need to add NIC3 which will be second Private Network. 2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to Connect to NIC1 's network I have my network already setup as in 1 above and it working very well. I'm using iptables to get this running. Please mail me offline if more info needed or with a suggestion Christo ------=_NextPart_000_0153_01C3413E.5CB66160 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message

I need=20 to do the following.

1. I=20 have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2 is = connected=20 to my PPP0 interface for internet access. I need to add NIC3 which will = be=20 second Private Network.

2.=20 Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet.=20

NIC1=20 Should be able to connect to NIC3 but NIC3 must not be ABLE to Connect = to NIC1=20 's network

I have=20 my network already setup as in 1 above and it working very well. I'm = using=20 iptables to get this running.

Please=20 mail me offline if more info needed or with a = suggestion

Christo

------=_NextPart_000_0153_01C3413E.5CB66160-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael K" Subject: RE: Firewall Setup on RH 9 Date: Thu, 3 Jul 2003 10:07:24 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000201c3413a$23328d50$c800a8c0@klintan.local> References: <015201c3412d$992c0ac0$660210ac@christo> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <015201c3412d$992c0ac0$660210ac@christo> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Christo Bezuidenhout Sent: Thursday, July 03, 2003 8:38 AM To: netfilter@lists.netfilter.org Subject: Firewall Setup on RH 9 I need to do the following. 1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2 is connected to my PPP0 interface for internet access. I need to add NIC3 which will be second Private Network. 2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to Connect to NIC1 's network I have my network already setup as in 1 above and it working very well. I'm using iptables to get this running. Please mail me offline if more info needed or with a suggestion Christo Perhaps something like this. NIC1=eth0 NIC2=ppp0 NIC3=eth1 modprobe ip_nat_ftp iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #Allow everything out to $NIC2 iptables -A FORWARD -o $NIC2 -j ACCEPT #Accept only connections from $NIC1 to $NIC3 iptables -A FORWARD -i $NIC1 -o $NIC3 -j ACCEPT iptables -t nat -A POSTROUTING -o $NIC2 -j MASQUERADE sysctl -w net.ipv4.ip_forward=1 /Klintan From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Christo Bezuidenhout" Subject: Firewall Setup on RH 9 Date: Tue, 1 Jul 2003 10:04:13 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <016201c33fa7$5c755eb0$660210ac@christo> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0163_01C33FB8.1FFE2EB0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0163_01C33FB8.1FFE2EB0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I need to do the following. 1. I have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2 is connected to my PPP0 interface for internet access. I need to add NIC3 which will be second Private Network. 2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to Connect to NIC1 's network I have my network already setup as in 1 above and it working very well. I'm using iptables to get this running. Please mail me offline if more info needed or with a suggestion Christo ------=_NextPart_000_0163_01C33FB8.1FFE2EB0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message

I need=20 to do the following.

1. I=20 have a Redhat 9 Box with Two nics. NIC1 is my Private Network. NIC2 is = connected=20 to my PPP0 interface for internet access. I need to add NIC3 which will = be=20 second Private Network.

2.=20 Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet.=20

NIC1=20 Should be able to connect to NIC3 but NIC3 must not be ABLE to Connect = to NIC1=20 's network

I have=20 my network already setup as in 1 above and it working very well. I'm = using=20 iptables to get this running.

Please=20 mail me offline if more info needed or with a = suggestion

Christo

------=_NextPart_000_0163_01C33FB8.1FFE2EB0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michal Kepien Subject: Re: Firewall Setup on RH 9 Date: Fri, 04 Jul 2003 23:54:32 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <016201c33fa7$5c755eb0$660210ac@christo> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <016201c33fa7$5c755eb0$660210ac@christo> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Christo Bezuidenhout Cc: netfilter@lists.netfilter.org >2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet.=20 >NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to >Connect to NIC1 's network NIC1 ---> eth0 NIC2 ---> eth1 NIC3 ---> eth2 NIC1's NETWORK: 192.168.0.0 NIC3's NETWORK: 192.168.1.0 NIC2's IP (external): 123.45.67.89 (an example - replace with real) ---START firewall-rules--- #!/bin/bash # Enable forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Flush all rules, user chains and packet counters iptables -F iptables -X iptables -Z # Set default policies to DROP iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Create a custom chain, which will handle suspicious packets iptables -N drop-and-log iptables -A drop-and-log -j LOG --log-level info iptables -A drop-and-log -j REJECT # Enable loopback traffic iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ######## INPUT rules ######## # First, deny packets from NIC3 to NIC1 iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 192.168.0.0/24 -j DROP # Then, enable all other packets (needed for Internet access) iptables -A INPUT -i eth0 -s 192.168.0.0/24 -d 0.0.0.0/0 -j ACCEPT iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 0.0.0.0/0 -j ACCEPT # Next, protect from IP spoofing iptables -A INPUT -i eth1 -s 192.168.0.0/24 -d 0.0.0.0/0 -j drop-and-log iptables -A INPUT -i eth1 -s 192.168.1.0/24 -d 0.0.0.0/0 -j drop-and-log # Also, accept packets from the Internet iptables -A INPUT -i eth1 -s 0.0.0.0/0 -d 0.0.0.0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Finally, log everything else (and drop it) iptables -A INPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j drop-and-log ######## OUTPUT rules ######## # We don't need to deny the packets from NIC3 to NIC1 once more as # every packet goes through the INPUT chain _first_ # Accept re-masqueraded packets for both networks iptables -A OUTPUT -o eth0 -s 0.0.0.0/0 -d 192.168.0.0/24 -j ACCEPT iptables -A OUTPUT -o eth2 -s 0.0.0.0/0 -d 192.168.1.0/24 -j ACCEPT # Deny stuffed routing iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 192.168.0.0/24 -j drop-and-log iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 192.168.1.0/24 -j drop-and-log # Accept the packets going into the Internet iptables -A OUTPUT -o eth1 -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT # Log everything else (and drop it) iptables -A OUTPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j drop-and-log ######## FORWARD rules ######## # Enable incoming packets re-masquerading iptables -A FORWARD -i eth1 -o ! eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT # Enable outgoing packets masquerading iptables -A FORWARD -i ! eth1 -o eth1 -j ACCEPT # Log everything else (and drop it) iptables -A FORWARD -j drop-and-log # Configure the routing iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 123.45.67.89 ---END firewall-rules--- This should do it. I've tested the script and it didn't cause any errors, but this doesn't mean it _has to_ work as it is supposed to (I've got a different configuration and so I couldn't test it for real). Perhaps you may need to adjust the above script a bit for your specific configuration. I'm also only a human and may have forgotten something. Just run the script from anywhere (e.g. './firewall-rules') and the rules should be set. BTW - why is there no packet tester in iptables (like the 'ipchains -C' command)? This little thing was _so_ useful... Michal Kepien From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: Firewall Setup on RH 9 Date: 05 Jul 2003 01:35:24 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1057383324.2821.34.camel@alpha.newkirk.us> References: <016201c33fa7$5c755eb0$660210ac@christo> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Michal Kepien Cc: Christo Bezuidenhout , netfilter@lists.netfilter.org On Fri, 2003-07-04 at 17:54, Michal Kepien wrote: > >2. Both NIC1 and NIC3 Should be able to Connect VIA NIC2 to Internet. > >NIC1 Should be able to connect to NIC3 but NIC3 must not be ABLE to > >Connect to NIC1 's network > > NIC1 ---> eth0 > NIC2 ---> eth1 > NIC3 ---> eth2 > > NIC1's NETWORK: 192.168.0.0 > NIC3's NETWORK: 192.168.1.0 > # First, deny packets from NIC3 to NIC1 > iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 192.168.0.0/24 -j DROP This needs to be FORWARD chain, not INPUT. Since the traffic isn't destined for the firewall box itself, it goes to the FORWARD chain. > # Then, enable all other packets (needed for Internet access) > iptables -A INPUT -i eth0 -s 192.168.0.0/24 -d 0.0.0.0/0 -j ACCEPT > iptables -A INPUT -i eth2 -s 192.168.1.0/24 -d 0.0.0.0/0 -j ACCEPT Same here. All these rules do is allow those two subnets to access the box itself, not the internet. > ######## OUTPUT rules ######## > # We don't need to deny the packets from NIC3 to NIC1 once more as > # every packet goes through the INPUT chain _first_ > > # Accept re-masqueraded packets for both networks > iptables -A OUTPUT -o eth0 -s 0.0.0.0/0 -d 192.168.0.0/24 -j ACCEPT > iptables -A OUTPUT -o eth2 -s 0.0.0.0/0 -d 192.168.1.0/24 -j ACCEPT As above, this affects only traffic from the box itself, NOT forwarded traffic. > BTW - why is there no packet tester in iptables (like the 'ipchains > -C' command)? This little thing was _so_ useful... As I suspected from your misconception about forwarded traffic, you're an ipchains veteran... ;^) With iptables FORWARD traffic never touches the INPUT or OUTPUT chains, those are explicitly for INPUT and OUTPUT to and from the box itself. j From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michal Kepien Subject: Re: Firewall Setup on RH 9 Date: Sat, 05 Jul 2003 09:30:23 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <0gvcgvc3jjvjmlog4a49p0lgosd9g9702c@4ax.com> References: <016201c33fa7$5c755eb0$660210ac@christo> <1057383324.2821.34.camel@alpha.newkirk.us> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1057383324.2821.34.camel@alpha.newkirk.us> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Joel Newkirk Cc: netfilter@lists.netfilter.org >As I suspected from your misconception about forwarded traffic, you're=20 >an ipchains veteran... ;^) Wow, thanks for the 'veteran' part :D Actually, I'm quite a newbie up here, but you're right, I _was_ using ipchains as I was quite unaware that it isn't the up-to-date tool to administer IP MASQ. However, the scheme I included in the previous post was taken from the Linux IP Masquerade HOWTO: http://www.ibiblio.org/pub/Linux/docs/HOWTO/other-formats/html_single/IP-= Masquerade-HOWTO.html#RC.FIREWALL-2.4.X-STRONGER (quite long, sorry :) >With iptables FORWARD traffic never touches the INPUT or OUTPUT chains, >those are explicitly for INPUT and OUTPUT to and from the box itself. I'm using the configuration I presented in the post and it works OK. However, if you know an easier way to achieve the same goal, please let me know :) Below I attach my conception of packet traffic - it is taken from the Linux IPCHAINS HOWTO, so it may be _not_ up-to-date. If the way packets are treated changed in iptables, please tell me how. | ---------------------------------------------------------------- | | ACCEPT/ lo interface | | v REDIRECT _______ | |--> C --> S --> ______ --> D --> ~~~~~~~~ -->|forward|----> _______ -->=20 | h a |input | e {Routing } |Chain | |output = |ACCEPT | e n |Chain | m {Decision} |_______| --->|Chain | | c i |______| a ~~~~~~~~ | | ->|_______| | k t | s | | | | | =20 | s y | q | v | | | =20 | u | v e v DENY/ | | v =20 | m | DENY/ r Local Process REJECT | | DENY/ | | v REJECT a | | | REJECT | | DENY d --------------------- |=20 | v e ----------------------------- | DENY =20 (i had to include pipes at the left to cheat line wrapping) Michal Kepien From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: Firewall Setup on RH 9 Date: 05 Jul 2003 14:20:40 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1057429240.2823.156.camel@alpha.newkirk.us> References: <016201c33fa7$5c755eb0$660210ac@christo> <1057383324.2821.34.camel@alpha.newkirk.us> <0gvcgvc3jjvjmlog4a49p0lgosd9g9702c@4ax.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <0gvcgvc3jjvjmlog4a49p0lgosd9g9702c@4ax.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Michal Kepien Cc: netfilter@lists.netfilter.org On Sat, 2003-07-05 at 03:30, Michal Kepien wrote: > >With iptables FORWARD traffic never touches the INPUT or OUTPUT chains, > >those are explicitly for INPUT and OUTPUT to and from the box itself. > > I'm using the configuration I presented in the post and it works OK. > However, if you know an easier way to achieve the same goal, please > let me know :) # We'll consider eth2 the 'unsecure' LAN, and use ppp0 for external # (it could just as easily be eth0 or whatever) INTIF1 = eth1 INTIF2 = eth2 EXTIF = ppp0 INTIP1 = 192.168.0.0/24 INTIP2 = 192.168.1.0/24 EXTIP = a.b.c.d IPT = /sbin/iptables ADDFWD = "$IPT -A FORWARD" ADDIN = "$IPT -A INPUT $IPT -F $IPT -P INPUT DROP $IPT -P FORWARD DROP $ADDFWD -m state --state ESTABLISHED,RELATED -j ACCEPT $ADDFWD -i $INTIF1 -s $INTIP1 -j ACCEPT $ADDFWD -i $INTIF2 -s $INTIP2 -d !$INTIP1 -j ACCEPT $ADDFWD -i $INTIF2 -d $INTIP1 -j LOG --log-level debug --log-prefix "LAN2Prohib:" $ADDFWD -i $INTIF2 -s !$INTIP2 -j LOG --log-level debug --log-prefix "LAN2Spoof:" $ADDIN -m state --state ESTABLISHED,RELATED -j ACCEPT $ADDIN -i $INTIF1 -j ACCEPT $IPT -t nat -A POSTROUTING -o $EXTIF -p SNAT --to $EXTIP This will let LAN1 connect to LAN2, to the firewall box, or to the internet without restriction. It will let LAN2 connect ONLY to the internet (without restriction). It will let the firewall box connect to anything without restriction. Realistically this should be ACCEPTing only the required ports in FORWARD and INPUT, and possibly OUTPUT as well. Personally I prefer DROP policy on OUTPUT and explicit ACCEPT of only traffic I want outbound. As it stands it offers security from incursions from the internet or from LAN2, and 'masquerades' LAN1 and LAN2 behind the public IP. (be aware that iptables uses the target MASQUERADE to specify a particular form of SNAT where it automatically determines the IP of the outbound interface each time, used for dynamic IP setups.) > Below I attach my conception of packet traffic - it is taken from the > Linux IPCHAINS HOWTO, so it may be _not_ up-to-date. If the way > packets are treated changed in iptables, please tell me how. Essentially I already did... ;^) The best tutorial, including a nice diagram (in "Traversing of Tables and Chains"), is Oskar Andreasson's at http://iptables-tutorial.frozentux.net . There is a very different diagram, as well as my own firewall script (a rather complex script that actually IS a script, with multiple functions and parameters) at the minimalist, incomplete http://live.newkirk.us/netfilter/index.html . The short of it is that a packet is inbound, goes through nat-PREROUTING, then a routing decision is made: thisbox?->INPUT else->FORWARD. j