User Tools

Site Tools


build:firewall

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
build:firewall [2005/03/06 00:42]
24.217.122.10 Place holder for pw
build:firewall [2009/08/03 16:18] (current)
167.206.189.6
Line 1: Line 1:
 ====== Firewall ====== ====== Firewall ======
  
-The firewall was constructed ​with the PCXFirewall Toolkit available here: +We originally went with [[http://​pcxfirewall.sourceforge.net/​|PCX Firewall]] on our test/​development server, as James Pattie was most familiar with it. When we built the production servers, we decided ​to go with something more standard, so that others would be able to work with it laterif James isn't around(And he wasn't around when we built the production servers.) So we decided to go with [[http://​www.shorewall.net/​|Shorewall]]. Shorewall also has the advantage ​that we don't need to provide the IP addresses of the system -- it determines them dynamically. So when we change IP addresses, we don't have to re-configure the firewall.
- http://​pcxfirewall.sourceforge.net/ ​ +
-After determining list of services ​to be offereda list of open ports was createdThe following list enumerates ​that list.+
  
-===== Open Ports =====+We currently aren't running a firewall on bock. Solaris 10 ships with IPF, but it has suffered from throughput problems, so we're leaving it off.
  
 +===== Requirements =====
  
-  *  22 -- SSH +Shorewall doesn'​t seem to have any requirements,​ except ''​iptables'',​ ''​iproute'',​ and ''​libatm1''​. 
-  ​* ​ 25 -- SMTP +<code rootshell>​ 
-  ​* ​ 80 -- http +apt-get install iproute iproute-doc libatm1 
-  * 110 -- pop3 +</code>
-  * 143 -- imap2 +
-  * 443 -- https +
-  * <​del>​992 -- telnets</del> +
-  * 993 -- imaps +
-  * 995 -- pop3s+
  
 +All we want from the firewall is basic host protection. (We don't do any routing, so we don't need to worry about packets going **through** the system.) We want to allow all outbound connections,​ and allow inbound connections to only the following ports:
  
-----+  *  22 -- SSH 
 +  *  25 -- SMTP (Bud only) 
 +  *  53 -- DNS (Bud only) 
 +  *  80 -- HTTP 
 +  * 110 -- POP (Bud only) 
 +  * 123 -- NTP (UDP) 
 +  * 143 -- IMAP (Bud only) 
 +  * 443 -- HTTPS 
 +  * 993 -- IMAPS (Bud only) 
 +  * 995 -- POPS (Bud only)
  
-===== Access ​=====+===== Installation ​=====
  
-Admin instructions on how to access PCXFirewall +Install shorewall (and its documentation):​ 
----- +<code rootshell>​ 
-https://​63.252.5.3/​pcxfirewall +apt-get install shorewall shorewall-doc 
-----+</code> 
 +===== Configuration =====
  
-username ​-- admin+In ''/​etc/​default/​shorewall'',​ set shorewall to run by changing the ''​startup''​ line: 
 +<code rootshell>​ 
 +sed --e '​s/​startup=0/​startup=1/'​ /​etc/​default/​shorewall 
 +</​code>​
  
-Firewall Config ​-- budlight1+Install default config files for systems with one interface:​ 
 +<code rootshell>​ 
 +cp -a /​usr/​share/​doc/​shorewall/​examples/​one-interface/* /​etc/​shorewall/​ 
 +cd /​etc/​shorewall/​ 
 +gunzip *.gz 
 +</​code>​
  
-===== Budlight1 Definition =====+If the system has more than one interface, see the other directories of examples.
  
-==== Config ====+In ''/​etc/​shorewall/​shorewall.conf'',​ set some configuration options. Change the following lines: 
 +<​file>​ 
 +LOGFILE=/​var/​log/​shorewall.log 
 +LOGRATE=10/minute 
 +LOGBURST=
 +</​file>​
  
-**Config Options**+Edit ''/​etc/​shorewall/​rules''​ to add some rules to allow various ports inbound: 
 +<​file>​ 
 +ACCEPT net $FW tcp 22 
 +ACCEPT net $FW tcp 25 
 +ACCEPT net $FW tcp 53 
 +ACCEPT net $FW udp 53 
 +ACCEPT net $FW tcp 80 
 +ACCEPT net $FW tcp 110 
 +ACCEPT net $FW udp 123 
 +ACCEPT net $FW tcp 143 
 +ACCEPT net $FW tcp 443 
 +ACCEPT net $FW tcp 993 
 +ACCEPT net $FW tcp 995 
 +</​file>​
  
-  * Network Command -- ifconfig +If the system has more than one interface, duplicate the same rules for each interface unless there is a reason to not do that.  In that case, document the purpose and restrictions for each interface, and why the rules are different.
-  * Mangle Rules -- Enabled+
  
-**Validity Check:**+===== Startup =====
  
-  * TCP Flags -- on +Start shorewall: 
-  * ECN Enabled -- off +<code rootshell>​ 
-  * Unclean -- off +touch /​var/​log/​shorewall.log 
-  * Kernel Type -- modular+/​etc/​init.d/​shorewall start 
 +</​code>​
  
-**Zones:**+===== Testing =====
  
-  * internal Zone Enabled -- off +To check whether Shorewall is running, check what IP Tables are configured: 
-  * ipsec Zone Enabled -- off +<code rootshell>​ 
-  * dmz Zone Enabled ​-- off +iptables ​--vn 
-  * dialin Zone Enabled -- off +</​code>​ 
-  * Bridge Support Enabled -- off +This should show a large number of tables.
-  * Snort-Inline Support Enabled -- off+
  
 +If Shorewall is not running, check the ''/​var/​log/​shorewall-init.log''​ file for details.
  
 +===== TODO =====
  
 +Can we restrict some ports to the local subnet?
  
-**Special Protocol Modules:**+Determine if our port list is correct for what we need open. We might want to open up additional ports for LMTP, SMTP w/ SSL, and SMTP w/ forced STARTTLS. Perhaps Squid caching and Rsync as well. We might want to remove Webmin and some of the other ports.
  
-  * ftp Enabled -- on +Is Shorewall configured to start on boot at the proper time? Is there a window of time where the network starts up (and there are services running) before Shorewall is protecting the system?
-  * ftp Params -- none +
-  * irc Enabled -- off +
-  * irc Params -- none+
  
-   +How can we back up our configuration on a regular basis?
-**Rate Limit:**+
  
-  * Tainted Packets Log Rate -- 20 / minute +How much ICMP do we block? How much do we want to block?
-  * Reserved Packets Log Rate -- 20 / minute +
-  * Default Policy Packets Log Rate -- 30 / minute +
-  * Reject Packets Log Rate -- 30 / minute +
-  * Normal Packets Log Rate -- 30 / minute +
-  * ICMP Packets Allow Rate -- 30 / minute+
  
-**Logging:​**+===== Credits =====
  
-  * Log Prefix ​-- FW +Shorewall was initially installed and configured by Jeff Muse on 2005-07-30. Craig Buchek assisted and documented.
-  * Log Level -- debug+
  
-**Dynamic Interfaces:​**+PCX Firewall was initially installed, configured, and documented on the test/​development system by James Pattie and Carl Fitch, 2005-02-19.
  
-  * Dynamic Interfaces Mode -- ignoreIP +===== Comments ​=====
- +
-==== Networks ​==== +
- +
-  * Index -- 0 +
-  * Host -- budlight +
-  * Type -- normal +
-  * Active -- true +
-  * Comment -- external network/​lan +
- +
-==== Reserved External Networks ==== +
- +
-^Index^Host^LimitTo^Active^Comment^ +
-|10.0.0.0/8 | | |false |Class A| +
-| 192.168.0.0/​16 | | |false |Class C| +
-| 127.0.0.0/8 | | |true  |Local machine| +
-| 172.16.0.0/​12 | | |false |Class B| +
-| 224.0.0.0/4 | | |false |Class D Multicast| +
-| 240.0.0.0/5 | | |true  |Class E Reserved| +
-| 0.0.0.0/8 | | |false |Illegal except for DHCP| +
-| 169.254.0.0/​16 | | |true  |Link Local Networks| +
-| 192.0.2.0/​24 | | |false |TEST-NET| +
- +
-==== Zones ==== +
- +
-  * Alias  -- external +
-  * Interface -- eth0 +
-  * IP Address -- 63.252.5.3 +
-  * IPSec -- false +
-  * IPSec LimitFrom --  +
-  * Network -- budlight +
-  * Proxy Arp -- false +
-  * Active -- true +
-  * Comment -- This is configured for a LAN server, not a WAN. +
- +
-==== Services ==== +
- +
-Existing services were left as preconfigured.  +
- +
-Added : POP3s +
-  * Protocol -- tcp +
-  * d-port -- 995 +
-  * s-port -- any +
-  * icmp type --  +
-  +
-  +
- +
-==== Paths ==== +
-===  ServiceGroups === +
- +
- +
-^ in ^ out ^ ip ^ source ^ dest ^ action ^ service ^ active ^ +
-| | | | | | |  **firewallToExternal**| | +
-|  |* |  |ALL |ALL |ACCEPT| DNS, SSH, IDENT, SMTP, ICMP, TRACEROUTE, SQUID, HTTP, FTP, BOOTP, NTP, RSYNC |true| +
-| | | | | | |  **externalToFirewall**| | +
-|*|   | |ALL |ALL |ACCEPT |SSH, SMTP, POP3, IMAP, ICMP-limited,​ HTTP, HTTPS, BOOTP, IMAPS, POP3S|true| +
-|*| | |ALL |ALL |Reject |IDENT |true| +
-| | | | | | |  **externalBroadcast**| | +
-|*| | |ALL |ALL |ACCEPT |BOOTP |true| +
- +
- +
- +
-===== Installation ===== +
-get this from PCXFirewall instructions and put here +
- +
-===== System Changes ===== +
-//Please post changes here in the format of:  [H4] date|your name [/H4] [CR]description of chages made// +
- +
-=== March 5 2005 | Carl Fitch === +
-Changed Zone "​external"​ to current static IP address +
- +
- +
-=== Feburary 19 2005 | James Pattie, Carl Fitch === +
-  +
-The initial installation +
- +
-===== TODO ===== +
- +
-Get installation instructions and have James verify +
- +
-<​del>​need to get how to access and use front end.</​del>​ +
- +
-===== Credits ===== +
-Initially installed, configured, and documented by James Pattie and Carl Fitch, 2005-02-19.+
build/firewall.1110091344.txt.gz · Last modified: 2005/03/06 10:44 (external edit)