B.4. Impostare un bridge firewall

This information was contributed by Francois Bayart in order to help users set up a Linux bridge/firewall with the 2.4.x kernel and iptables. Kernel patches are no more needed as the code was made standard part of the Linux kernel distribution.

Per configurare il kernel con il necessario supporto, eseguite make menuconfig o make xconfig. Nella sezione Networking options, abilitate le seguenti opzioni:

[*] Network packet filtering (replaces ipchains)
[ ]   Network packet filtering debugging (NEW)
<*> 802.1d Ethernet Bridging
[*]   netfilter (firewalling) support (NEW)

Attenzione: dovete disabilitare questa opzione se volete applicare delle regole di firewall, altrimenti iptables non funzionerà.

[ ]   Network packet filtering debugging (NEW)

Next, add the correct options in the section IP: Netfilter Configuration. Then, compile and install the kernel. If you want to do it the Debian way, install kernel-package and run make-kpkg to create a custom Debian kernel package you can install on your server using dpkg. Once the new kernel is compiled and installed, install the bridge-utils package.

Una volta completati questi passaggi, potete completare la configurazione del vostro bridge. La sezione successiva mostra due diverse possibili configurazioni per il bridge, ognuna con un'ipotetica mappa di rete ed i comandi necessari.

B.4.1. Un bridge con funzionalità NAT e firewall

La prima configurazione utilizza il bridge come un firewall con traslazione degli indirizzi di rete (NAT), che protegge un server ed i client della LAN interna. Un diagramma della configurazione di rete viene mostrato qui sotto:

Internet ---- router ( 62.3.3.25 ) ---- bridge (62.3.3.26 gw 62.3.3.25 / 192.168.0.1)
                                          |
                                          |
                                          |---- WWW Server (62.3.3.27 gw 62.3.3.25)
                                          |
                                          |
                                         LAN --- Zipowz (192.168.0.2 gw 192.168.0.1)

Le seguenti istruzioni mostrano come sia possibile configurare questo bridge.

# Create the interface br0
/usr/sbin/brctl addbr br0

# Add the Ethernet interface to use with the bridge
/usr/sbin/brctl addif br0 eth0
/usr/sbin/brctl addif br0 eth1

# Start up the Ethernet interface
/sbin/ifconfig eth0 0.0.0.0
/sbin/ifconfig eth1 0.0.0.0

# Configure the bridge ethernet
# The bridge will be correct and invisible ( transparent firewall ).
# It's hidden in a traceroute and you keep your real gateway on the 
# other computers. Now if you want you can config a gateway on your 
# bridge and choose it as your new gateway for the other computers.

/sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.31

# I have added this internal IP to create my NAT 
ip addr add 192.168.0.1/24 dev br0
/sbin/route add default gw 62.3.3.25

B.4.2. Bridge con funzionalità di firewall

Una seconda configurazione possibile è un sistema configurato come un firewall trasparente per una LAN con spazio di indirizzi IP pubblici.

Internet ---- router (62.3.3.25) ---- bridge (62.3.3.26)
                                        |
                                        |
                                        |---- WWW Server (62.3.3.28 gw 62.3.3.25)
                                        |
                                        |
                                        |---- Mail Server (62.3.3.27 gw 62.3.3.25)

Le seguenti istruzioni mostrano come sia possibile configurare questo bridge.

# Create the interface br0
/usr/sbin/brctl addbr br0

# Add the Ethernet interface to use with the bridge
/usr/sbin/brctl addif br0 eth0
/usr/sbin/brctl addif br0 eth1

# Start up the Ethernet interface
/sbin/ifconfig eth0 0.0.0.0
/sbin/ifconfig eth1 0.0.0.0

# Configure the bridge Ethernet
# The bridge will be correct and invisible ( transparent firewall ).
# It's hidden in a traceroute and you keep your real gateway on the 
# other computers. Now if you want you can config a gateway on your
# bridge and choose it as your new gateway for the other computers.

/sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.31

Se eseguite un traceroute verso il Linux Mail Server, non vedrete il bridge. Se volete accedere al bridge con ssh, dovete avere un gateway, altrimenti dovreste prima connettervi ad un altro server, come il "Mail Server" ed in seguito connettervi al bridge tramite la scheda di rete interna.

B.4.3. Regole base di IPtables

Questo è un esempio delle regole base che potreste usare indistintamente per queste due configurazioni.

Esempio B.1. Regole base di IPtables

iptables -F FORWARD
iptables -P FORWARD DROP
iptables -A FORWARD -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Some funny rules but not in a classic Iptables sorry ...
# Limit ICMP 
# iptables -A FORWARD -p icmp -m limit --limit 4/s -j ACCEPT
# Match string, a good simple method to block some VIRUS very quickly
# iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 -m string --string "cmd.exe"

# Block all MySQL connection just to be sure
iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP

# Linux Mail Server Rules

# Allow FTP-DATA (20), FTP (21), SSH (22) 
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.27/32 --dport 20:22 -j ACCEPT

# Allow the Mail Server to connect to the outside
# Note: This is *not* needed for the previous connections 
# (remember: stateful filtering) and could be removed.
iptables -A FORWARD -p tcp -s 62.3.3.27/32 -d 0/0 -j ACCEPT

# WWW Server Rules

# Allow HTTP ( 80 ) connections with the WWW server
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 80 -j ACCEPT

# Allow HTTPS ( 443 ) connections with the WWW server
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 443 -j ACCEPT

# Allow the WWW server to go out
# Note: This is *not* needed for the previous connections 
# (remember: stateful filtering) and could be removed.
iptables -A FORWARD -p tcp -s 62.3.3.28/32 -d 0/0 -j ACCEPT