Firewall Setup Tips - Revision history

Aryker at 03:42, 25 April 2013

2013-04-25T03:42:38Z

← Older revision		Revision as of 23:42, 24 April 2013
Line 340:		Line 340:
	==== Step 1: Configure Your NST Box for a Static IP ====		==== Step 1: Configure Your NST Box for a Static IP ====

	The '''NST''' box acting as the router ~~should~~ be configured to have		The '''NST''' box acting as the router '''must''' be configured to have
	a static IP address by default. In order to do this, create the file: '''/etc/sysconfig/network-scripts/ifcfg-<YOUR NETWORK INTERFACE>'''.		a static IP address by default. In order to do this, create the file: '''/etc/sysconfig/network-scripts/ifcfg-<YOUR NETWORK INTERFACE>'''.
	Example:		Example:

Aryker at 19:11, 3 December 2012

2012-12-03T19:11:24Z

← Older revision		Revision as of 15:11, 3 December 2012
Line 436:		Line 436:

	<div class="screen">		<div class="screen">
	<div class="screenTitle">~~Backing up dhcpd.conf~~</div>		<div class="screenTitle">Configuring iptables</div>
	<div class="userInput"><span class="prompt">[root@probe ~]# </span>echo 1 > /proc/sys/net/ipv4/ip_forward</div>		<div class="userInput"><span class="prompt">[root@probe ~]# </span>echo 1 > /proc/sys/net/ipv4/ip_forward</div>
	<div class="userInput"><span class="prompt">[root@probe ~]# </span>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE</div>		<div class="userInput"><span class="prompt">[root@probe ~]# </span>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE</div>

Aryker: /* Step 4: Configure IPtables */

2012-07-07T03:04:43Z

Step 4: Configure IPtables

← Older revision		Revision as of 23:04, 6 July 2012
Line 431:		Line 431:
	</div>		</div>

	== Step 4: Configure IPtables ==		==== Step 4: Configure IPtables ====

	To enable '''Network Address Translation'''(or '''NAT''') on NST, '''iptables''' must be configured correctly. You can configure '''iptables''' for basic '''NAT''' with the following commands:		To enable '''Network Address Translation'''(or '''NAT''') on NST, '''iptables''' must be configured correctly. You can configure '''iptables''' for basic '''NAT''' with the following commands:

Aryker: /* Step 3: Configure & Enable the DCHP Service */

2012-07-07T03:04:28Z

Step 3: Configure & Enable the DCHP Service

← Older revision		Revision as of 23:04, 6 July 2012
Line 372:		Line 372:
	</div>		</div>

	== Step 3: Configure & Enable the DCHP Service ==		==== Step 3: Configure & Enable the DCHP Service ====

	Typically, a home router will automatically assign an IP address from a specific range of addresses to any machine that connects to its network. Unless every machine on your '''LAN''' will be given a static IP address, you will need to enable the '''DHCP''' service on your '''NST''' router. Keep in mind that if you are using another router as a switch for your '''LAN''', you must disable its '''DHCP''' service first, so they do not conflict.		Typically, a home router will automatically assign an IP address from a specific range of addresses to any machine that connects to its network. Unless every machine on your '''LAN''' will be given a static IP address, you will need to enable the '''DHCP''' service on your '''NST''' router. Keep in mind that if you are using another router as a switch for your '''LAN''', you must disable its '''DHCP''' service first, so they do not conflict.
Line 430:		Line 430:
	<div class="userInput"><span class="prompt">[root@probe ~]# </span></div>		<div class="userInput"><span class="prompt">[root@probe ~]# </span></div>
	</div>		</div>


	== Step 4: Configure IPtables ==		== Step 4: Configure IPtables ==

Aryker: /* Step 2: Restart the Network Services */

2012-07-07T03:04:18Z

Step 2: Restart the Network Services

← Older revision		Revision as of 23:04, 6 July 2012
Line 363:		Line 363:
	</pre>		</pre>

	== Step 2: Restart the Network Services ==		==== Step 2: Restart the Network Services ====

	<div class="screen">		<div class="screen">
Line 371:		Line 371:
	<div class="userInput"><span class="prompt">[root@probe ~]# </span></div>		<div class="userInput"><span class="prompt">[root@probe ~]# </span></div>
	</div>		</div>


	== Step 3: Configure & Enable the DCHP Service ==		== Step 3: Configure & Enable the DCHP Service ==

Aryker: /* Step 1: Configure Your NST Box for a Static IP */

2012-07-07T03:03:33Z

Step 1: Configure Your NST Box for a Static IP

← Older revision		Revision as of 23:03, 6 July 2012
Line 338:		Line 338:
	[[Image:nst-nat.png]]		[[Image:nst-nat.png]]

	== Step 1: Configure Your NST Box for a Static IP ==		==== Step 1: Configure Your NST Box for a Static IP ====

	The '''NST''' box acting as the router should be configured to have		The '''NST''' box acting as the router should be configured to have

Aryker: /* Automating the Firewall Setup */

2012-07-07T03:03:01Z

Automating the Firewall Setup

← Older revision		Revision as of 23:03, 6 July 2012
Line 447:		Line 447:

	This will configure your '''NST''' box for basic router functionality. Note that in this state, connections from the outside world will still be accepted. In order to selectively filter incoming and outgoing connections, you will have to configure '''iptables''' further.		This will configure your '''NST''' box for basic router functionality. Note that in this state, connections from the outside world will still be accepted. In order to selectively filter incoming and outgoing connections, you will have to configure '''iptables''' further.

	~~==== Automating the Firewall Setup ====~~

	It becomes tedious to setup a firewall each time one installs a new version of the '''NST''' to a hard disk partition or boots from a '''Live CD'''. One can automate the process of setting up a firewall by:

	* Mounting a thumb drive or hard disk partition.
	* Creating a directory named: "'''firewall'''" on the mounted partition.
	* Copying the above script to: "'''firewall/firewall'''".
	* Modifying the top portion of the script according the '''LAN''' configuration.
	* Creating a script named: "'''firewall/setup.sh'''" with the following contents:
	~~<pre class="programListing">~~
	~~# install firewall~~
	~~${NSTHOME}/firewall &&~~
	~~iptables-save >\| /etc/sysconfig/iptables &&~~
	~~service iptables start;~~
	~~</pre>~~
	* Un-mounting the thumb drive or hard disk partion.

	The following demonstrates the command sequence to accomplish the above. It assumes that hard disk partition '''hda4''' will be used to save the configuration and that you've created your own custom version of the firewall script at: "'''/tmp/firewall'''".

	~~<div class="screen">~~
	~~<div class="screenTitle">Creating an Automated Firewall Setup</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>mount /dev/hda4 /mnt/ext3</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>mkdir /mnt/ext3/firewall</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>cp /tmp/firewall /mnt/ext3/firewall/firewall</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>vi /mnt/ext3/firewall/setup.sh</div>~~
	~~<pre class="computerOutput">~~
	~~# install firewall~~
	~~${NSTHOME}/firewall &&~~
	~~iptables-save >\| /etc/sysconfig/iptables &&~~
	~~service iptables start;~~

	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~
	~~:wq~~
	~~</pre>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>find /mnt/ext3/firewall</div>~~
	~~<pre class="computerOutput">~~
	~~/mnt/ext3/firewall~~
	~~/mnt/ext3/firewall/firewall~~
	~~/mnt/ext3/firewall/setup.sh~~
	~~</pre>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>umount /mnt/ext3</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span></div>~~
	~~</div>~~

	~~One you get the above steps down, you can then quickly load your setup after a '''Live CD''' boot (or new hard drive installation of the '''NST''' distribution) via:~~

	~~<div class="screen">~~
	~~<div class="screenTitle">Using an Automated Firewall Setup</div>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span>lnstcustom firewall hda4</div>~~
	~~<pre class="computerOutput">~~

	~~setting global variables~~

	~~applying general security settings to /proc filesystem~~

	~~applying nat rules~~

	~~applying incoming internet blocking of reserved private networks~~

	~~applying icmp rules~~

	~~applying icmp type match blocking~~

	~~applying port forwarding rules~~

	~~Forwarding connections to port "20022" to "192.168.0.2:22~~
	~~Forwarding connections to port "23456" to "192.168.0.2:23456~~
	~~Forwarding connections to port "23465" to "192.168.0.2:23465~~
	~~Forwarding connections to port "8669" to "192.168.0.2:8669~~
	~~Forwarding connections to port "8668" to "192.168.0.2:8668~~
	~~applying default drop policies~~

	~~### quicktables is loaded ###~~

	~~Flushing firewall rules: [ OK ]~~
	~~Setting chains to policy ACCEPT: filter nat [ OK ]~~
	~~Unloading iptables modules: [ OK ]~~
	~~Applying iptables firewall rules: [ OK ]~~
	~~Loading additional iptables modules: ip_conntrack_netbios_n[ OK ]~~
	~~</pre>~~
	~~<div class="userInput"><span class="prompt">[root@taco ~]# </span></div>~~
	~~</div>~~

	NOTE: Replace: "'''hda4'''" with the partition you placed your "'''firewall'''" directory in. Also, you will most likely find it useful to customize the file: '''setup.sh'''. It can be extended to quickly configure many additional things on your '''NST''' system.

Aryker: /* Turning a NST Probe Into A Broadband Router */

2012-07-07T03:00:59Z

Turning a NST Probe Into A Broadband Router

← Older revision		Revision as of 23:00, 6 July 2012
Line 313:		Line 313:
	</div>		</div>

	== Turning a NST Probe Into A Broadband Router ==		== Turning an NST Probe Into A Broadband Router ==

	In many homes and small businesses, you will find a small broadband router (such as a ''LinkSys WRT54G''). The broadband router is typically configured to act as a firewall and perform Network Address Translation ('''NAT'''). This provides a layer of protection of the internal Local Area Network ('''LAN''') from the outside world. It allows systems on the '''LAN''' to initiate connections to the outside world, but blocks the outside world from initiating connections to systems within the '''LAN'''.		In many homes and small businesses, you will find a small broadband router (such as a ''LinkSys WRT54G''). The broadband router is typically configured to act as a firewall and perform Network Address Translation ('''NAT'''). This provides a layer of protection of the internal Local Area Network ('''LAN''') from the outside world. It allows systems on the '''LAN''' to initiate connections to the outside world, but blocks the outside world from initiating connections to systems within the '''LAN'''.
Line 337:		Line 337:

	[[Image:nst-nat.png]]		[[Image:nst-nat.png]]


	== Step 1: Configure Your NST Box for a Static IP ==		== Step 1: Configure Your NST Box for a Static IP ==

Aryker: /* NST Broadband Router Configuration Script */

2012-07-07T02:59:15Z

NST Broadband Router Configuration Script

Show changes

Paul Blankenbaker: /* No Incoming Connections */

2010-10-02T11:54:09Z

No Incoming Connections

← Older revision		Revision as of 07:54, 2 October 2010
Line 142:		Line 142:
	<div class="screen">		<div class="screen">
	<div class="screenTitle">Using quicktables-2.3</div>		<div class="screenTitle">Using quicktables-2.3</div>
	<div class="userInput"><span class="prompt">[root@tmobile ~]# </span>quicktables-2.3</div>		<div class="userInput"><span class="prompt">[root@tmobile ~]# </span>/usr/share/quicktables/quicktables-2.3</div>
	<pre class="computerOutput">		<pre class="computerOutput">

Line 312:		Line 312:
	<div class="userInput"><span class="prompt">[root@tmobile ~]# </span></div>		<div class="userInput"><span class="prompt">[root@tmobile ~]# </span></div>
	</div>		</div>


	== Turning a NST Probe Into A Broadband Router ==		== Turning a NST Probe Into A Broadband Router ==