Re: IP access restriction

From: Nigel Wade (nmw_at_ion.le.ac.uk)
Date: 10/13/04

  • Next message: John Hodges: "Re: Xmms does not support MP3?" 
    Date: Wed, 13 Oct 2004 14:24:14 +0100
To: For users of Fedora Core releases <fedora-list@redhat.com>

    Rick Lim wrote:
    > I have a friend that has a few boxes directly on the internet, which he
    > thinks are being access by unwanted "visitors".
    >
    > These machine still have to have routable IP address but should have limited
    > access from external IP subnets.
    >
    >
    >
    > What would be suitable for limiting IP subnet access to these address?
    >
    > Would a 'firewall' like machine with IPTABLES be able to accomplish this,
    > that is without changing the IP address passed through the 'firewallish'
    > machine?
    >

    What's the network topology? If it's possible to insert a single device in
    the network which carries all traffic then it is possible to add a bridging
    firewall.

    You can create bridging firewalls with iptables. We operate one here between
    our subnet and the Uni. router. Building a bridging firewall is pretty
    straight forward.

    You need to install the bridge-utils package first. Then create a bridge
    interface with the brctl command, and give it a name (here its called
    nameOfBridgeInterface):

    # brctl addbr nameOfBridgeInterface

    then you add ethernet cards to the bridge (you can have multiple cards in
    each segment, and the bridging software uses spanning-tree to provide
    redundancy). For 2 cards, eth0 and eth1, with 1 in each segment you would do:

    # brctl addif nameOfBridgeInterface eth0
    # brctl addif nameOfBridgeInterface eth1

    then put the cards in promiscuous mode (they need to accept all packets):

    # ifconfig eth0 promisc 0.0.0.0
    # ifconfig eth1 promisc 0.0.0.0

    then, if you want to be able to connect to the bridge, you create a network
    script for it, /etc/sysconfig/network-scripts/ifcfg-nameOfBridgeInterface

    DEVICE=nameOfBridgeInterface
    BOOTPROTO=static
    BROADCAST=<your-network-broadcast-address>
    IPADDR=<bridge-IP>
    NETMASK=<your-network-netmask>
    NETWORK=<your-network-address>
    ONBOOT=yes
    TYPE=Ethernet
    USERCTL=no
    PEERDNS=no

    The startup scripts will take care of everything else. Iptables rules can be
    applied to the FORWARD chain for packets traversing the bridge, or to the
    INPUT/OUTPUT chains for packets destined to/from the bridge itself. You can
    also add rules for each card.

    You should not have any network initialization on eth0 or eth1, the bridge
    rules above do the necessary work, activating the card in promiscuous mode
    and assigning no IP.

    One problem is that most GUIs for iptables assume you are setting up either
    a personal firewall or a NAT firewall. The only GUI I know that even
    acknowledges that a bridging firewall is a possibility is fwbuilder, and you
    still need to check the rules carefully with that as it has a tendency to
    create spurious rules. 

    -- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    nmw@ion.le.ac.uk
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555
-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: John Hodges: "Re: Xmms does not support MP3?"

    Relevant Pages

    • RE: IP access restriction
      ... The best device looks to be a linux bridging firewall insterted between the ... network gateway and the network. ... Then create a bridge ... then you add ethernet cards to the bridge (you can have multiple cards in ...
      (Fedora)
    • Re: Emails using Gateway IP in header instead of router IP number
      ... that shouldn't matter whether the cable modem is bridged or routed. ... Once the SMTP traffic leaves exchange, I could route it through a packet-inspecting firewall, a NAT device, another firewall, through a linux box, through a spam filter appliance, then through an untangle setup, untill it eventually reaches my network edge and onto Comcast's network. ... header sent from server is using the gateway IP number instead of my ... They should instruct or help Sam in setting up the cable modem in Bridge mode so all outbound traffic appears be coming from the internal router. ...
      (microsoft.public.windows.server.sbs)
    • Re: Wkgrp Network of 3 XP and 1 2K ... CDiag logs - 1 files [1/2] - 1 files [1/2]
      ... >> Fix the Bridge on Gatewayp4, ... >> additional problems will be firewall - see the Error 6118 reference. ... Network Neighborhood while the primary master browser is offline. ...
      (microsoft.public.windowsxp.network_web)
    • RE: Cracking a server without services (filtering bridges)
      ... I run a filtering bridge on my home system between the DSL and the DMZ. ... cards. ... through another firewall for my internal stuff. ...
      (Security-Basics)
    • PF bridged firewall?
      ... sides of the firewall, with the internal range more often than not a NAT'd ... I usually end up putting a bridge in with and IP address one ... past the point of not having enough IP's for the number of clients, ... I could drop a second firewall in, this one acting as a NAT'd range to the ...
      (comp.unix.bsd.openbsd.misc)