A drop-in firewall

A drop-in firewall

[Stephen Satchell]

Background:  I used to be an audio engineer, and got used to the idea that 
a properly-designed and -maintained sound chain meant that each block was 
designed to "drop in" such that a failure of any component could be 
bypassed simply by patching around it.

Situation:  I have a series of Windows boxes that were infected with MS 
Blaster and SoBig.  The net result was that my network of 200 computers was 
completely brought to its knees when these Windows boxes started doing 
their thing.  I don't control the Windows boxes (co-lo situation).

Desired solution:  "Drop" a Linux box between the Windows boxes and the 
rest of the internal network.  Use IPTABLES to ensure that the Windows 
boxes can't do anything nasty to the rest of the systems in the room, 
without impairing access to the rest of the Internet.

SOLUTION 1:  Use the experimental ROUTE target:
      Public-network interface has the addresses of all Windows boxes on 
the protected network.  Design rules that take packets destined for those 
boxes and route them instead to the protected-network port.  Bypass the 
routing table completely.
     Protected-network interface has the address of the site 
gateway.  Design a rule that takes packets destined for the gateway and 
route them instead to the public network interface.  Bypass the routing 
table completely.
     Use regular FILTER FORWARD rules to impose access rules on the local /24s.

SOLUTION 2:  Use MARK target
     How does this work?  Google doesn't bring up any usable 
discussion.  Pointers?

What makes solution 1 not very usable is that Red Hat doesn't include the 
ROUTE target in its distributions.  Attempts to use Patch-o-Matic haven't 
worked with Red Hat kernel source.  I'm going to try vanilla 2.4.22 from 
linux.org to see if I have better results with that.

Is there any other way to do a drop-in firewall?

OK, you ask, why a "drop-in"?  Because the usual methods require the 
customer boxes to be renumbered, and I don't have access to the guts of the 
customer boxes.  The other standard method requires our Cisco 7500 be 
updated with a route, and the network manager is scared to make the 
change.  "Why can't you just do it all in the Linux box?" he asks?

The other issue is that some of our support technicians don't know how to 
do anything with the routers, so if the firewall fails the ass-wipes can't 
just patch around it and have the customer box "just work".

Hints?  Pointers?  Is there a FAQ in the house?

Satch

Re: A drop-in firewall

[Ralf Spenneberg]

Am Son, 2003-08-31 um 05.25 schrieb Stephen Satchell:
> Background:  I used to be an audio engineer, and got used to the idea that 
> a properly-designed and -maintained sound chain meant that each block was 
> designed to "drop in" such that a failure of any component could be 
> bypassed simply by patching around it.
Use a bridging firewall.

http://www.spenneberg.com/talks/linux-kongress2002/ralf-spenneberg.bridgewall.pdf

That does everything you want.

Cheers,

Ralf
> 
> Situation:  I have a series of Windows boxes that were infected with MS 
> Blaster and SoBig.  The net result was that my network of 200 computers was 
> completely brought to its knees when these Windows boxes started doing 
> their thing.  I don't control the Windows boxes (co-lo situation).
> 
> Desired solution:  "Drop" a Linux box between the Windows boxes and the 
> rest of the internal network.  Use IPTABLES to ensure that the Windows 
> boxes can't do anything nasty to the rest of the systems in the room, 
> without impairing access to the rest of the Internet.
> 
> SOLUTION 1:  Use the experimental ROUTE target:
>       Public-network interface has the addresses of all Windows boxes on 
> the protected network.  Design rules that take packets destined for those 
> boxes and route them instead to the protected-network port.  Bypass the 
> routing table completely.
>      Protected-network interface has the address of the site 
> gateway.  Design a rule that takes packets destined for the gateway and 
> route them instead to the public network interface.  Bypass the routing 
> table completely.
>      Use regular FILTER FORWARD rules to impose access rules on the local /24s.
> 
> SOLUTION 2:  Use MARK target
>      How does this work?  Google doesn't bring up any usable 
> discussion.  Pointers?
> 
> What makes solution 1 not very usable is that Red Hat doesn't include the 
> ROUTE target in its distributions.  Attempts to use Patch-o-Matic haven't 
> worked with Red Hat kernel source.  I'm going to try vanilla 2.4.22 from 
> linux.org to see if I have better results with that.
> 
> Is there any other way to do a drop-in firewall?
> 
> OK, you ask, why a "drop-in"?  Because the usual methods require the 
> customer boxes to be renumbered, and I don't have access to the guts of the 
> customer boxes.  The other standard method requires our Cisco 7500 be 
> updated with a route, and the network manager is scared to make the 
> change.  "Why can't you just do it all in the Linux box?" he asks?
> 
> The other issue is that some of our support technicians don't know how to 
> do anything with the routers, so if the firewall fails the ass-wipes can't 
> just patch around it and have the customer box "just work".
> 
> Hints?  Pointers?  Is there a FAQ in the house?
> 
> Satch
-- 
Ralf Spenneberg
RHCE, RHCX

Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org

Re: A drop-in firewall

[Arnt Karlsen]

On Sat, 30 Aug 2003 20:25:59 -0700, 
Stephen Satchell <list@fluent2.pyramid.net> wrote in message 
<5.2.1.1.0.20030830201439.01072380@fluent2.pyramid.net>:

..http://ipcop.org/ ,  needs its own box.

..http://shorewall/ , needs a box with linux, I ran mine on RH-7.3, 
and it had webmin and some wifi stuff too, it was a stopgap AP.

..both uses iptables for the firewalling.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: A drop-in firewall

[Gavin Hamill]

lOn Sunday 31 August 2003 04:25, Stephen Satchell wrote:

> Desired solution:  "Drop" a Linux box between the Windows boxes and the
> rest of the internal network.  Use IPTABLES to ensure that the Windows
> boxes can't do anything nasty to the rest of the systems in the room,
> without impairing access to the rest of the Internet.

What you want to do is perfectly common and perfectly achievable... However, 
can I suggest an alternative route? 

Check out the Linux bridge-filter patch which allows you to apply iptables 
rules whilst running a machine as a bridge - i.e. your eth0 and eth1 become a 
single 'br0' for management purposes..

The joy of this is that you CAN literally just drop the box in between your 
LAN and WAN, and you need not change ANY default gateway settings on either 
the routers or the Windows boxes.

I've been using an old P233 as a bridge-firewall for a client LAN of 50 
machines with 2Mbps upstream bandwidth, and the thing never misses a beat, 
and loadavg is usually below 0.05 

http://ebtables.sf.net/

and specifically http://ebtables.sourceforge.net/download.html

Cheers,
Gavin.