{"id":750,"date":"2021-09-21T10:32:57","date_gmt":"2021-09-21T10:32:57","guid":{"rendered":"https:\/\/www.practicallynetworked.com\/?page_id=750"},"modified":"2021-10-05T16:59:25","modified_gmt":"2021-10-05T16:59:25","slug":"network-appliances-with-linux-part-5","status":"publish","type":"post","link":"https:\/\/www.practicallynetworked.com\/network-appliances-with-linux-part-5\/","title":{"rendered":"Building Network Appliances With Linux, Part 5: Internet-connection Sharing Firewall"},"content":{"rendered":"<p>by Carla Schroder<\/p>\n<hr \/>\n<p>&nbsp;<\/p>\n<p><span class=\"bodycopy\">In our previous installments we did a lot of important preliminary configuration, and hardening our firewall box. Today we&#8217;ll take a quick tour of Webmin, and set up an iptables Internet-connection sharing firewall. Don&#8217;t connect your firewall box to the Internet just yet, as there are some important steps to take first.<\/span><\/p>\n<h3><span class=\"bodycopy\">Cruising Webmin<\/span><\/h3>\n<p><span class=\"bodycopy\">Webmin is an excellent, flexible graphical configuration interface for Linux. You can find modules to configure and manage virtually every Linux service. Unlike a lot of graphical configurators, Webmin reads the source configuration files directly, so you can switch back and forth between using Webmin and editing the files yourself without making a mess.<\/span><\/p>\n<p>A word of caution: Just having a good graphical interface does not mean you are instantly a system administrator. You need the same knowledge whether you use Webmin or edit text configuration files directly. Take some time to look around Webmin and see what you can do with it. You can&#8217;t accidentally hurt anything, because you always have to a click a button to activate any changes.<\/p>\n<h3>Sharing an Internet Connection<\/h3>\n<p>We&#8217;re going to use two scripts for our excellent iptables firewall; one to turn it on, and one to turn it off. Plus we&#8217;re going to enter some important kernel parameters in\u00a0<i>\/etc\/sysctl.conf<\/i>. Make it look just like this, with no other entries:<\/p>\n<pre># \/etc\/sysctl.conf - Configuration file for setting system variables\r\n# See sysctl.conf (5) for information.\r\n\r\nnet.ipv4.ip_forward = 1\r\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\r\nnet.ipv4.tcp_syncookies = 1\r\nnet.ipv4.conf.all.rp_filter = 1\r\nnet.ipv4.conf.all.send_redirects = 0\r\nnet.ipv4.conf.all.accept_redirects = 0\r\nnet.ipv4.conf.all.accept_source_route = 0\r\n<\/pre>\n<table border=\"1\" width=\"220\" cellspacing=\"1\" cellpadding=\"5\" align=\"center\">\n<tbody>\n<tr bgcolor=\"#003399\">\n<td><center><span style=\"color: #ffffff;\"><b><span style=\"font-size: medium;\">Build a Linux Appliance<\/span><\/b><\/span><\/center><span style=\"color: #ffffff; font-family: Arial,Helvetica,Geneva,sans-serif; font-size: small;\"><b><br \/>\n<\/b><\/span><\/p>\n<ul>\n<li><a href=\"https:\/\/www.practicallynetworked.com\/howto\/051806linuxappliance.htm\"><span style=\"color: #ffffff;\">Part 1: Introduction and Hardware Requirements<\/span><\/a><\/li>\n<li><a href=\"https:\/\/www.practicallynetworked.com\/howto\/053106linuxappliance2.htm\"><span style=\"color: #ffffff;\">Part 2: Install and Configure Linux<\/span><\/a><\/li>\n<li><a href=\"https:\/\/www.practicallynetworked.com\/howto\/062006linuxappliance3.htm\"><span style=\"color: #ffffff;\">Part 3: The Firewall<\/span><\/a><\/li>\n<li><span style=\"color: #ffffff;\"><a href=\"https:\/\/www.practicallynetworked.com\/howto\/070506linuxappliance4.htm\">Part 4: Locking Down the Firewall Box<\/a><\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The first line,\u00a0<i>net.ipv4.ip_forward = 1<\/i>\u00a0is what turns on Internet connection sharing. The remaining items are security features.<\/p>\n<p>I call the firewall script\u00a0<i>firewall_nat<\/i>; you may name it whatever you want. (Access\u00a0<a href=\"https:\/\/www.practicallynetworked.com\/howto\/downloads\/firewall_nat.txt\" target=\"_blank\" rel=\"noopener\">the firewall_nat script here<\/a>.)<\/p>\n<p>Copy this just as it&#8217;s shown, with these exceptions:<\/p>\n<ul>\n<li>Use your own network interface names<\/li>\n<li>Use your own IP addresses<\/li>\n<li>On the &#8220;Enable IP masquerading&#8221; line, you have two choices. If you have a static WAN IP, use the SNAT line, substituting your own IP. If you are on DHCP, use the MASQUERADE line<\/li>\n<\/ul>\n<p>Make this script executable, and read\/write for root only:<tt><\/tt><\/p>\n<p><tt><b># chmod 0700 firewall_nat<br \/>\n# chown root:root firewall_nat<\/b><\/tt><\/p>\n<p>This is the &#8220;shutoff&#8221; script, which I call\u00a0<i>ipt_flush<\/i>. Give it the same ownership and permissions as\u00a0<i>firewall_nat<\/i>: (Access the\u00a0<a href=\"https:\/\/www.practicallynetworked.com\/howto\/downloads\/ipt_flush.txt\" target=\"_blank\" rel=\"noopener\">ipt_flush script here<\/a>.)<\/p>\n<p>Place\u00a0<i>firewall_nat<\/i>\u00a0in\u00a0<i>\/etc\/init.d<\/i>, and\u00a0<i>ipt_flush<\/i>\u00a0in\u00a0<i>\/usr\/local\/bin<\/i>. As root, test both of them:<tt><\/tt><\/p>\n<p><tt><b># \/etc\/init.d\/firewall_nat<\/b><br \/>\nThe firewall has now started up and is faithfully protecting your system<br \/>\n<b># ipt_flush<\/b><br \/>\nThe firewall is now being shut down. All policies are set to ACCEPT, all rules and chains are deleted, all counters are set to zero<\/tt><\/p>\n<p>&nbsp;<\/p>\n<p>Well OK then. They work!<\/p>\n<h3>Testing the Firewall<\/h3>\n<p><span class=\"bodycopy\">Fire up the firewall and run this command to verify that your iptables rulesets are active:<\/span><\/p>\n<pre><b># iptables -L<\/b>\r\nChain INPUT (policy DROP)\r\ntarget     prot opt source               destination\r\nACCEPT     all  --  anywhere             anywhere\r\nACCEPT     tcp  --  localnet\/24          anywhere            tcp dpt:ssh state NEW\r\nACCEPT     tcp  --  localnet\/24          anywhere            tcp dpt:10000 state NEW\r\nACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED\r\nACCEPT     icmp --  anywhere             anywhere            icmp echo-request\r\nACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded\r\nACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable\r\nDROP       tcp  --  anywhere             anywhere            tcp flags:SYN,RST,ACK\/SYN\r\n\r\nChain FORWARD (policy DROP)\r\ntarget     prot opt source               destination\r\nACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED\r\nACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n<\/pre>\n<p>Connect your WAN interface to the big scary Internet, and disconnect the firewall box from the LAN. Ping Google and other sites you can reasonably expect will always work. When your ping tests succeed, boot up one of your LAN clients with a live Linux on CD-ROM, connect it to your switch\/hub, and do a bit of Web-surfing to verify that everything works. This is the safest way to test LAN connectivity, since a CD-ROM cannot be compromised.<\/p>\n<p>The last step is to configure the firewall to start at boot. Do this in Webmin, using System -&gt; Bootup and Shutdown.<\/p>\n<p>You now have a nice sturdy Internet-connection sharing iptables firewall. Next week we&#8217;ll learn how to configure it for public services like a Web or mail server, and how to prevent bad packets from escaping your network.<\/p>\n<h3>Resources<\/h3>\n<ul>\n<li>Thank you to the gang at Linuxchix.org for their invaluable assistance<\/li>\n<li><a href=\"http:\/\/www.frozentech.com\/content\/livecd.php\" target=\"_blank\" rel=\"noopener\">FrozenTech&#8217;s list of Live Linux CDs<\/a><\/li>\n<li><a href=\"http:\/\/www.enterprisenetworkingplanet.com\/netos\/article.php\/3603211\" target=\"_blank\" rel=\"noopener\">The Penguin&#8217;s Practical Network Troubleshooting Guide, Part 1<\/a><\/li>\n<li><a href=\"http:\/\/www.enterprisenetworkingplanet.com\/netos\/article.php\/3604996\" target=\"_blank\" rel=\"noopener\">The Penguin&#8217;s Practical Network Troubleshooting Guide, Part 2<\/a><\/li>\n<li><a href=\"http:\/\/www.oreilly.com\/catalog\/linuxckbk\/index.html\" target=\"_blank\" rel=\"noopener\">the Linux Cookbook<\/a>, step-by-step Linux system administration<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>by Carla Schroder &nbsp; In our previous installments we did a lot of important preliminary configuration, and hardening our firewall box. Today we&#8217;ll take a quick tour of Webmin, and set up an iptables Internet-connection sharing firewall. Don&#8217;t connect your firewall box to the Internet just yet, as there are some important steps to take first. Cruising Webmin Webmin is an excellent, flexible graphical configuration interface for Linux. You can find modules to configure and manage virtually every Linux service. Unlike a lot of graphical configurators, Webmin reads the source configuration files directly, so you can switch back and forth <\/p>\n","protected":false},"author":2,"featured_media":5599,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/750"}],"collection":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/comments?post=750"}],"version-history":[{"count":0,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/750\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media\/5599"}],"wp:attachment":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media?parent=750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/categories?post=750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/tags?post=750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}