build:firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
build:firewall [2005/12/08 01:02] 70.237.137.56 Fixed typo, added comment section. (CMB) |
build:firewall [2009/08/03 16:18] (current) 167.206.189.6 |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Firewall ====== | ====== Firewall ====== | ||
| - | We originally went with PCX Firewall on our test/development server, as James Pattie was most familiar with it. When we built the production servers, we decided to go with something more standard, so that others would be able to work with it later, if James isn't around. (And he wasn't around when we built the production servers.) So we decided to go with Shorewall. Shorewall also has the advantage that we don't need to provide the IP addresses of the system -- it determines them dynamically. So when we change IP addresses, we don't have to re-configure the firewall. | + | We originally went with [[http://pcxfirewall.sourceforge.net/|PCX Firewall]] on our test/development server, as James Pattie was most familiar with it. When we built the production servers, we decided to go with something more standard, so that others would be able to work with it later, if James isn't around. (And he wasn't around when we built the production servers.) So we decided to go with [[http://www.shorewall.net/|Shorewall]]. Shorewall also has the advantage that we don't need to provide the IP addresses of the system -- it determines them dynamically. So when we change IP addresses, we don't have to re-configure the firewall. |
| + | |||
| + | We currently aren't running a firewall on bock. Solaris 10 ships with IPF, but it has suffered from throughput problems, so we're leaving it off. | ||
| ===== Requirements ===== | ===== Requirements ===== | ||
| - | Shorewall doesn't seem to have any requirements, except perhaps a working network stack. | + | Shorewall doesn't seem to have any requirements, except ''iptables'', ''iproute'', and ''libatm1''. |
| + | <code rootshell> | ||
| + | apt-get install iproute iproute-doc libatm1 | ||
| + | </code> | ||
| All we want from the firewall is basic host protection. (We don't do any routing, so we don't need to worry about packets going **through** the system.) We want to allow all outbound connections, and allow inbound connections to only the following ports: | All we want from the firewall is basic host protection. (We don't do any routing, so we don't need to worry about packets going **through** the system.) We want to allow all outbound connections, and allow inbound connections to only the following ports: | ||
| * 22 -- SSH | * 22 -- SSH | ||
| - | * 25 -- SMTP | + | * 25 -- SMTP (Bud only) |
| + | * 53 -- DNS (Bud only) | ||
| * 80 -- HTTP | * 80 -- HTTP | ||
| - | * 110 -- POP | + | * 110 -- POP (Bud only) |
| - | * 143 -- IMAP | + | * 123 -- NTP (UDP) |
| + | * 143 -- IMAP (Bud only) | ||
| * 443 -- HTTPS | * 443 -- HTTPS | ||
| - | * 993 -- IMAPS | + | * 993 -- IMAPS (Bud only) |
| - | * 995 -- POPS | + | * 995 -- POPS (Bud only) |
| - | * 10000 -- Webmin (HTTPS) | + | |
| ===== Installation ===== | ===== Installation ===== | ||
| Install shorewall (and its documentation): | Install shorewall (and its documentation): | ||
| - | apt-get install shorewall shorewall-doc | + | <code rootshell> |
| + | apt-get install shorewall shorewall-doc | ||
| + | </code> | ||
| ===== Configuration ===== | ===== Configuration ===== | ||
| - | In /etc/default/shorewall, set shorewall to run by changing this line: | + | In ''/etc/default/shorewall'', set shorewall to run by changing the ''startup'' line: |
| - | startup=1 | + | <code rootshell> |
| + | sed -i -e 's/startup=0/startup=1/' /etc/default/shorewall | ||
| + | </code> | ||
| Install default config files for systems with one interface: | Install default config files for systems with one interface: | ||
| - | cd /tmp | + | <code rootshell> |
| - | tar xfz /usr/share/doc/shorewall-doc/examples/one-interface.tgz | + | cp -a /usr/share/doc/shorewall/examples/one-interface/* /etc/shorewall/ |
| - | cp one-interface/* /etc/shorewall/ | + | cd /etc/shorewall/ |
| + | gunzip *.gz | ||
| + | </code> | ||
| - | In /etc/shorewall/shorewall.conf, set some configuration options: | + | If the system has more than one interface, see the other directories of examples. |
| - | LOGFILE=/var/log/shorewall.log | + | |
| - | LOGRATE=10/minute | + | |
| - | LOGBURST=5 | + | |
| - | IPTABLES=/sbin/iptables | + | |
| - | Edit /etc/shorewall/rules to add some rules to allow various ports inbound: | + | In ''/etc/shorewall/shorewall.conf'', set some configuration options. Change the following lines: |
| - | ACCEPT net fw tcp 22 | + | <file> |
| - | ACCEPT net fw tcp 25 | + | LOGFILE=/var/log/shorewall.log |
| - | ACCEPT net fw tcp 80 | + | LOGRATE=10/minute |
| - | ACCEPT net fw tcp 110 | + | LOGBURST=5 |
| - | ACCEPT net fw tcp 143 | + | </file> |
| - | ACCEPT net fw tcp 443 | + | |
| - | ACCEPT net fw tcp 993 | + | Edit ''/etc/shorewall/rules'' to add some rules to allow various ports inbound: |
| - | ACCEPT net fw tcp 995 | + | <file> |
| - | ACCEPT net fw tcp 10000 | + | ACCEPT net $FW tcp 22 |
| + | ACCEPT net $FW tcp 25 | ||
| + | ACCEPT net $FW tcp 53 | ||
| + | ACCEPT net $FW udp 53 | ||
| + | ACCEPT net $FW tcp 80 | ||
| + | ACCEPT net $FW tcp 110 | ||
| + | ACCEPT net $FW udp 123 | ||
| + | ACCEPT net $FW tcp 143 | ||
| + | ACCEPT net $FW tcp 443 | ||
| + | ACCEPT net $FW tcp 993 | ||
| + | ACCEPT net $FW tcp 995 | ||
| + | </file> | ||
| + | |||
| + | If the system has more than one interface, duplicate the same rules for each interface unless there is a reason to not do that. In that case, document the purpose and restrictions for each interface, and why the rules are different. | ||
| ===== Startup ===== | ===== Startup ===== | ||
| Start shorewall: | Start shorewall: | ||
| - | touch /var/log/shorewall.log | + | <code rootshell> |
| - | /etc/init.d/shorewall start | + | touch /var/log/shorewall.log |
| + | /etc/init.d/shorewall start | ||
| + | </code> | ||
| ===== Testing ===== | ===== Testing ===== | ||
| To check whether Shorewall is running, check what IP Tables are configured: | To check whether Shorewall is running, check what IP Tables are configured: | ||
| - | iptables -L -vn | + | <code rootshell> |
| + | iptables -L -vn | ||
| + | </code> | ||
| This should show a large number of tables. | This should show a large number of tables. | ||
| - | If Shorewall is not running, check the /var/log/shorewall-init.log file for details. | + | If Shorewall is not running, check the ''/var/log/shorewall-init.log'' file for details. |
| - | + | ||
| - | + | ||
| - | ===== PCX Firewall ===== | + | |
| - | + | ||
| - | The firewall was (originally) constructed with the PCXFirewall Toolkit available here: | + | |
| - | http://pcxfirewall.sourceforge.net/ | + | |
| - | After determining list of services to be offered, a list of open ports was created. The following list enumerates that list. | + | |
| - | + | ||
| - | Admin instructions on how to access PCXFirewall | + | |
| - | https://63.252.5.3/pcxfirewall/ | + | |
| - | + | ||
| - | username -- admin | + | |
| - | + | ||
| - | Firewall Config -- budlight1 | + | |
| - | + | ||
| - | ==== Budlight1 Definition ==== | + | |
| - | + | ||
| - | ==== Config ==== | + | |
| - | + | ||
| - | **Config Options** | + | |
| - | + | ||
| - | * Network Command -- ifconfig | + | |
| - | * Mangle Rules -- Enabled | + | |
| - | + | ||
| - | **Validity Check:** | + | |
| - | + | ||
| - | * TCP Flags -- on | + | |
| - | * ECN Enabled -- off | + | |
| - | * Unclean -- off | + | |
| - | * Kernel Type -- modular | + | |
| - | + | ||
| - | **Zones:** | + | |
| - | + | ||
| - | * internal Zone Enabled -- off | + | |
| - | * ipsec Zone Enabled -- off | + | |
| - | * dmz Zone Enabled -- off | + | |
| - | * dialin Zone Enabled -- off | + | |
| - | * Bridge Support Enabled -- off | + | |
| - | * Snort-Inline Support Enabled -- off | + | |
| - | + | ||
| - | + | ||
| - | **Special Protocol Modules:** | + | |
| - | + | ||
| - | * ftp Enabled -- on | + | |
| - | * ftp Params -- none | + | |
| - | * irc Enabled -- off | + | |
| - | * irc Params -- none | + | |
| - | + | ||
| - | **Rate Limit:** | + | |
| - | + | ||
| - | * Tainted Packets Log Rate -- 20 / minute | + | |
| - | * Reserved Packets Log Rate -- 20 / minute | + | |
| - | * Default Policy Packets Log Rate -- 30 / minute | + | |
| - | * Reject Packets Log Rate -- 30 / minute | + | |
| - | * Normal Packets Log Rate -- 30 / minute | + | |
| - | * ICMP Packets Allow Rate -- 30 / minute | + | |
| - | + | ||
| - | **Logging:** | + | |
| - | + | ||
| - | * Log Prefix -- FW | + | |
| - | * Log Level -- debug | + | |
| - | + | ||
| - | **Dynamic Interfaces:** | + | |
| - | + | ||
| - | * Dynamic Interfaces Mode -- ignoreIP | + | |
| - | + | ||
| - | ==== Networks ==== | + | |
| - | + | ||
| - | * Index -- 0 | + | |
| - | * Host -- budlight | + | |
| - | * Type -- normal | + | |
| - | * Active -- true | + | |
| - | * Comment -- external network/lan | + | |
| - | + | ||
| - | ==== Reserved External Networks ==== | + | |
| - | + | ||
| - | ^Index^Host^LimitTo^Active^Comment^ | + | |
| - | |10.0.0.0/8 | | |false |Class A| | + | |
| - | | 192.168.0.0/16 | | |false |Class C| | + | |
| - | | 127.0.0.0/8 | | |true |Local machine| | + | |
| - | | 172.16.0.0/12 | | |false |Class B| | + | |
| - | | 224.0.0.0/4 | | |false |Class D Multicast| | + | |
| - | | 240.0.0.0/5 | | |true |Class E Reserved| | + | |
| - | | 0.0.0.0/8 | | |false |Illegal except for DHCP| | + | |
| - | | 169.254.0.0/16 | | |true |Link Local Networks| | + | |
| - | | 192.0.2.0/24 | | |false |TEST-NET| | + | |
| - | + | ||
| - | ==== Zones ==== | + | |
| - | + | ||
| - | * Alias -- external | + | |
| - | * Interface -- eth0 | + | |
| - | * IP Address -- 63.252.5.3 | + | |
| - | * IPSec -- false | + | |
| - | * IPSec LimitFrom -- | + | |
| - | * Network -- budlight | + | |
| - | * Proxy Arp -- false | + | |
| - | * Active -- true | + | |
| - | * Comment -- This is configured for a LAN server, not a WAN. | + | |
| - | + | ||
| - | ==== Services ==== | + | |
| - | + | ||
| - | Existing services were left as preconfigured. | + | |
| - | + | ||
| - | Added : POP3s | + | |
| - | * Protocol -- tcp | + | |
| - | * d-port -- 995 | + | |
| - | * s-port -- any | + | |
| - | * icmp type -- | + | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | ==== Paths ==== | + | |
| - | === ServiceGroups === | + | |
| - | + | ||
| - | + | ||
| - | ^ in ^ out ^ ip ^ source ^ dest ^ action ^ service ^ active ^ | + | |
| - | | | | | | | | **firewallToExternal**| | | + | |
| - | | |* | |ALL |ALL |ACCEPT| DNS, SSH, IDENT, SMTP, ICMP, TRACEROUTE, SQUID, HTTP, FTP, BOOTP, NTP, RSYNC |true| | + | |
| - | | | | | | | | **externalToFirewall**| | | + | |
| - | |*| | |ALL |ALL |ACCEPT |SSH, SMTP, POP3, IMAP, ICMP-limited, HTTP, HTTPS, BOOTP, IMAPS, POP3S|true| | + | |
| - | |*| | |ALL |ALL |Reject |IDENT |true| | + | |
| - | |external| | |ALL |ALL |Drop No Log |SMB |true| | + | |
| - | |external| | |ALL |ALL |ACCEPT |Webmin |true| | + | |
| - | | | | | | | | **externalBroadcast**| | | + | |
| - | |*| | |ALL |ALL |ACCEPT |BOOTP |true| | + | |
| - | + | ||
| - | ==== Installation ==== | + | |
| - | get this from PCXFirewall instructions and put here | + | |
| - | + | ||
| - | ==== System Changes ==== | + | |
| - | //Please post changes here in the format of: [H4] date|your name [/H4] [CR]description of chages made// | + | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | === March 5 2005 | Carl Fitch === | + | |
| - | Added Path to allow Webmin access. This was added as a seperate path to allow an easier way to turn the path on or off as needed. | + | |
| - | + | ||
| - | + | ||
| - | === Feburary 19 2005 | James Pattie, Carl Fitch === | + | |
| - | + | ||
| - | The initial installation | + | |
| - | === March 5 2005 | Carl Fitch === | + | |
| - | Changed Zone "external" to current static IP address | + | |
| ===== TODO ===== | ===== TODO ===== | ||
| - | Remove info regarding PCX Firewall. | + | Can we restrict some ports to the local subnet? |
| Determine if our port list is correct for what we need open. We might want to open up additional ports for LMTP, SMTP w/ SSL, and SMTP w/ forced STARTTLS. Perhaps Squid caching and Rsync as well. We might want to remove Webmin and some of the other ports. | Determine if our port list is correct for what we need open. We might want to open up additional ports for LMTP, SMTP w/ SSL, and SMTP w/ forced STARTTLS. Perhaps Squid caching and Rsync as well. We might want to remove Webmin and some of the other ports. | ||
| Line 227: | Line 108: | ||
| ===== Comments ===== | ===== Comments ===== | ||
| - | |||
build/firewall.1134025342.txt.gz · Last modified: 2006/01/16 18:44 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
