Re: firewall bridge , Vlan ?

Re: firewall bridge , Vlan ?

[loong]

no,

i don wan install firewall need a hub.
becouse netsreen or other firewall don no need hug when they put few server
behind the firewall..

i don no how to do this.. you have any idea?

loong



----- Original Message ----- 
From: "George Vieira" <georgev@citadelcomputer.com.au>
To: "loong" <loong@eads.com.my>
Sent: Monday, June 09, 2003 12:51 PM
Subject: RE: firewall bridge , Vlan ?


> Yeah you can do that with multiple NICs but what's the reason for this? Is
it to seperate the webservers from each other so that they can't see the
other webservers?
>
>
> -----Original Message----- 
> From: loong [mailto:loong@eads.com.my]
> Sent: Mon 09-Jun-03 1:46 PM
> To: netfilter@lists.netfilter.org
> Cc:
> Subject: firewall bridge , Vlan ?
>
>
> hi
>
> is there anywhere install bridge firewall and install vlan
> http://www.candelatech.com/~greear/vlan.html
>
>
> so that my firewall can run like netscreen without using  hug or switch to
my webserver.
>
> currently is
> internet -- > eth0 firewall   eth1 -- >   hub ------> webserver 1
>                                                      ------> webserver 2
>
> is that anywhere i install few network card in my firewall then
>
> internet --->    eth0    firewall   eth1 ---->    webserver 1
>                                                      eth2 ----->
webserver 2
>                                                      eth3 ----->
webserver 3
>
>
> thanks
>
> loong
>
>
>
>
>
>
>
>
>
>
> ----- Original Message ----- 
> From: John Paul <mailto:john@pinoylinux.sytes.net>
> To: George Vieira <mailto:georgev@citadelcomputer.com.au>  ;
netfilter@lists.netfilter.org
> Sent: Monday, June 09, 2003 11:35 AM
> Subject: Re: Problem Found! - Firewall Rule
>
> Thanks George. I have modified my network to (10.10.0.0/24).
>
> Now, I'am able to ping the machines inside the network after connected to
the VPN. The problem now is, I'm not able to map/see machines in Network
Neighborhood except the VPN server.
>
> Any clue?
>
>
>
> ----- Original Message ----- 
> From: George Vieira <mailto:georgev@citadelcomputer.com.au>
> To: John Paul <mailto:john@pinoylinux.sytes.net>  ;
netfilter@lists.netfilter.org
> Sent: Friday, June 06, 2003 8:56 AM
> Subject: RE: Problem Found! - Firewall Rule
>
> Your local IP is the same as the remote networks IP.. so how is the local
machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?
>
> The only way I know is to proxyarp the ppp device that the vpn is running
on.. I'm assuming it's PPTP so you could try this command when the VPN comes
up :
> echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp
>
> and this must be done on the VPN server too..
> I've never done it this way with a VPN.. but you can only try it..
>
> I'm surprised that anything really works properly the way you've done it
because the firewall has 2 network devices with the same IP range.
>
> Thanks,
>
>
> ____________________________________________
> George Vieira
> Citadel Computer Systems Pty Ltd Systems Manager georgev AT
citadelcomputer DOT com DOT au
> Citadel Computer Systems Pty Ltd
> Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698
<http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
<http://www.citadelcomputer.com.au/>
>
>
> -----Original Message-----
> From: John Paul [mailto:john@pinoylinux.sytes.net]
> Sent: Friday, June 06, 2003 9:56 AM
> To: netfilter@lists.netfilter.org
> Subject: Problem Found! - Firewall Rule
>
>
>
> Hello Folks, its me again :(
>
> Below is my config. My problem is, I can connect to VPN but for some
reason, I cannot see machines inside the network after being connected. Can
somebody give me the simpliest firewall rule on this? just for me to see the
machines inside the network.
>
> Thanks!
> /JP
>
>
>

RE: Problem Found! - Firewall Rule

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 1446 bytes --]

Your local IP is the same as the remote networks IP.. so how is the local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?
 
The only way I know is to proxyarp the ppp device that the vpn is running on.. I'm assuming it's PPTP so you could try this command when the VPN comes up :
echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp
 
and this must be done on the VPN server too..
I've never done it this way with a VPN.. but you can only try it..
 
I'm surprised that anything really works properly the way you've done it because the firewall has 2 network devices with the same IP range.

Thanks,

 
____________________________________________
George Vieira
Citadel Computer Systems Pty Ltd Systems Manager georgev AT citadelcomputer DOT com DOT au 
Citadel Computer Systems Pty Ltd
Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698  <http://www.citadelcomputer.com.au/> http://www.citadelcomputer.com.au
 
 
-----Original Message-----
From: John Paul [mailto:john@pinoylinux.sytes.net]
Sent: Friday, June 06, 2003 9:56 AM
To: netfilter@lists.netfilter.org
Subject: Problem Found! - Firewall Rule


Hello Folks, its me again :(
 
Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.
 
Thanks!
/JP
 

[-- Attachment #2: Type: text/html, Size: 5483 bytes --]

Re: Problem Found! - Firewall Rule

[John Paul]

[-- Attachment #1: Type: text/plain, Size: 1904 bytes --]

Thanks George. I have modified my network to (10.10.0.0/24). 

Now, I'am able to ping the machines inside the network after connected to the VPN. The problem now is, I'm not able to map/see machines in Network Neighborhood except the VPN server.

Any clue?       


  ----- Original Message ----- 
  From: George Vieira 
  To: John Paul ; netfilter@lists.netfilter.org 
  Sent: Friday, June 06, 2003 8:56 AM
  Subject: RE: Problem Found! - Firewall Rule


  Your local IP is the same as the remote networks IP.. so how is the local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?

  The only way I know is to proxyarp the ppp device that the vpn is running on.. I'm assuming it's PPTP so you could try this command when the VPN comes up :
  echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp

  and this must be done on the VPN server too..
  I've never done it this way with a VPN.. but you can only try it..

  I'm surprised that anything really works properly the way you've done it because the firewall has 2 network devices with the same IP range.
  Thanks,


  ____________________________________________
  George Vieira
  Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT au
  Citadel Computer Systems Pty Ltd
  Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au


  -----Original Message-----
  From: John Paul [mailto:john@pinoylinux.sytes.net]
  Sent: Friday, June 06, 2003 9:56 AM
  To: netfilter@lists.netfilter.org
  Subject: Problem Found! - Firewall Rule


  Hello Folks, its me again :(

  Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.

  Thanks!
  /JP


[-- Attachment #2: Type: text/html, Size: 7210 bytes --]

firewall bridge , Vlan ?

[loong]

[-- Attachment #1: Type: text/plain, Size: 2851 bytes --]

hi

is there anywhere install bridge firewall and install vlan
http://www.candelatech.com/~greear/vlan.html


so that my firewall can run like netscreen without using  hug or switch to my webserver.

currently is
internet -- > eth0 firewall   eth1 -- >   hub ------> webserver 1
                                                     ------> webserver 2

is that anywhere i install few network card in my firewall then

internet --->    eth0    firewall   eth1 ---->    webserver 1
                                                     eth2 ----->   webserver 2
                                                     eth3 ----->  webserver 3


thanks

loong









  ----- Original Message ----- 
  From: John Paul 
  To: George Vieira ; netfilter@lists.netfilter.org 
  Sent: Monday, June 09, 2003 11:35 AM
  Subject: Re: Problem Found! - Firewall Rule


  Thanks George. I have modified my network to (10.10.0.0/24). 

  Now, I'am able to ping the machines inside the network after connected to the VPN. The problem now is, I'm not able to map/see machines in Network Neighborhood except the VPN server.

  Any clue?       


    ----- Original Message ----- 
    From: George Vieira 
    To: John Paul ; netfilter@lists.netfilter.org 
    Sent: Friday, June 06, 2003 8:56 AM
    Subject: RE: Problem Found! - Firewall Rule


    Your local IP is the same as the remote networks IP.. so how is the local machine to know that 192.168.0.55 or 66 or 32 is on the VPN!?

    The only way I know is to proxyarp the ppp device that the vpn is running on.. I'm assuming it's PPTP so you could try this command when the VPN comes up :
    echo 1 > /proc/sys/net/ipv4/conf/$VPNDEV/proxy_arp

    and this must be done on the VPN server too..
    I've never done it this way with a VPN.. but you can only try it..

    I'm surprised that anything really works properly the way you've done it because the firewall has 2 network devices with the same IP range.
    Thanks,


    ____________________________________________
    George Vieira
    Citadel Computer Systems Pty LtdSystems Managergeorgev AT citadelcomputer DOT com DOT au
    Citadel Computer Systems Pty Ltd
    Phone : +61 2 9955 2644HelpDesk: +61 2 9955 2698http://www.citadelcomputer.com.au


    -----Original Message-----
    From: John Paul [mailto:john@pinoylinux.sytes.net]
    Sent: Friday, June 06, 2003 9:56 AM
    To: netfilter@lists.netfilter.org
    Subject: Problem Found! - Firewall Rule


    Hello Folks, its me again :(

    Below is my config. My problem is, I can connect to VPN but for some reason, I cannot see machines inside the network after being connected. Can somebody give me the simpliest firewall rule on this? just for me to see the machines inside the network.

    Thanks!
    /JP

[-- Attachment #2: Type: text/html, Size: 11103 bytes --]

Re: firewall bridge , Vlan ?

[Cedric Blancher]

Le lun 09/06/2003 à 05:46, loong a écrit :
> is there anywhere install bridge firewall and install vlan
> http://www.candelatech.com/~greear/vlan.html

This works very well.
 
> so that my firewall can run like netscreen without using  hug or
> switch to my webserver.

You'll still have to use at leat one switch.
 
> currently is
> internet -- > eth0 firewall   eth1 -- >   hub ------> webserver 1
>                                                      ------> webserver
> 2
>  
> is that anywhere i install few network card in my firewall then
>  
> internet --->    eth0    firewall   eth1 ---->    webserver 1
>                                                      eth2 ----->  
> webserver 2
>                                                      eth3 -----> 
> webserver 3

Your physical setup will be like this :

	Internet -> eth0/Firewall/eth1 -> switch -> Web1
						 -> Web2

You can also have :

	Firewall/eth0 -> switch -> Internet
				-> Web1
				-> Web2

But I don't recommand this setup as it relies too much on switch
security features.

So, you connect eth1 to your switch. This switch must support VLAN and
802.1q frame tagging. On the switch, configure the port connected to
eth0 as a 802.1q port (called trunk on Cisco). Now, affect one VLAN to
Web1 port, and another one to Web2 port, etc... Eth0's port will carry
all affected VLANs (see you switch documentation).

Now, on your firewall, use vconfig to create virtual interfaces
associated to each VLAN you want to see through the 802.1q link.

Suppose Web1 is on VLAN1, Web2 on VLAN2 :

	vconfig add eth0 1
	vconfig add eth0 2

This will create vlan0001 and vlan0002 interfaces trhough which you'll
see respectively Web1's traffic and Web2's traffic.

See vconfig man page for further information.

Now, this solution is very scalable as you can add as many VLAN as you
want on your switch. You just have to add them to the 802.1q link and
create proper interface on the firewall. Then you configure your routing
and filtering between those vlan* interfaces just you way you're use to
between physical ones (eth*). Note that eth1 will see 802.1q tagged
frames.

But beware to the fact that this kind of network separation directly
depends on your switch security. If one is able to gain access to the
switch or find a way to bypass it, you loose everything relying on
VLANs. See :

	http://www.arp-sk.org/doc/bh-us-02-convrey-switches.pdf

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE