Dec 2, 2009

Networking : network isolation with iptables and brctl


This is one of the first problems I had to solve in my career : the goal is to isolate a part of an existing network for any reason. Let's say your network is configured 192.168.0.0/16 and you cannot isolate with the use of VLANs (either you don't have compliant equipment, either you cannot do it on your architecture, ...).

The solution is to use a Linux bridge and filter packets with iptables.

Have a look at the graphic at the beginning of this post : this is what I'll implement with the following scripts. So let's suppose you want to isolate a group of client machines with their own servers (UNIX and Windows servers).
Considering this, there are three things to do :

  • Give access to the servers and client machines from admin machines
  • Give access to internet, e-mailing, FTP, etc to isolated machines
  • Give access to some services (license, Samba,...) from machines outside the isolated network

In order to do that, prepare a machine with 2 Ethernet cards, install any distro you want on it (i like CentOS but any Debian-like or Suse or any Linux is fine too). Once your this installed, verify that your 2 Ethernet controllers are recognized :

lsmod
lspci
ifconfig -a

The ifconfig -a command should have 2 ethernet interfaces (eth0 and eth1 usually), if not get the good linux module for your network card !

Now, install bridge utilities :
apt-get install bridge-utils #on Debians
yum install bridge-utils #on RHEL / CentOS / Fedora

Let's configure the brigde now. Here is the script that you'll have to put in /etc/init.d and link to /etc/rc5.d/ according to your distro (see /etc/runlevel for current runlevel and your distro doc for running a script at startup).
#!/bin/sh
#
# Start and stop Network bridge
#
case "$1" in
start)
ifconfig eth0 0.0.0.0 promisc
ifconfig eth1 0.0.0.0 promisc

brctl addbr pont
brctl addif pont eth0
brctl addif pont eth1

ifconfig pont 192.168.231.50 netmask 255.255.255.0
route add default gw 192.168.231.254
;;
stop)
brctl delif pont eth0
brctl delif pont eth1
brctl delbr pont
;;
stat)
brctl showstp
;;
*)
echo "Usage : /etc/init.d/brigde start | stop | stat"
;;
esac

We configure the bridge with the 192.168.231.50 IP address, and add to it our 2 ethernet cards.

Now the bridge is up and running let's focus on the packet filtering. As I said, iptables will help up do that, as long as we know source IP, dest IP, proto (tcp, udp,..) and port. Here is the firewalling script, to be put in /etc/init.d :

#!/bin/sh
#
# Start and stop Firewall
#
case "$1" in
start)
PATH="/usr/sbin:$PATH"

#We flush tables
iptables -F
#We erase all user tables
iptables -X

#Default rules : Deny all access
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#Let's log what goes through our firewall
iptables -t filter -A INPUT -j LOG --log-level notice
iptables -t filter -A OUTPUT -j LOG --log-level notice
iptables -t filter -A FORWARD -j LOG --log-level notice

#Admin machines, access the firewall, and UNIX and Windows servers
awk '{print $1}' /etc/machines_admin | while read ligne
do
#We accept connnection from admin machines to our firewall
iptables -A INPUT --source $ligne -p tcp --dport ssh -j ACCEPT
iptables -A OUTPUT --destination $ligne -p tcp --sport ssh -j ACCEPT
#Connections from admin machines to UNIX server : ping and SSH
iptables -A FORWARD --source $ligne --destination 192.168.100.102 -p icmp -j ACCEPT
iptables -A FORWARD --source 192.168.100.102 --destination $ligne -p icmp -j ACCEPT
iptables -A FORWARD --source $ligne --destination 192.168.100.102 -p tcp --dport ssh -j ACCEPT
iptables -A FORWARD --source 192.168.100.102 --destination $ligne -p tcp --sport ssh -j ACCEPT
#Connections from admns to Windows server : ping and Dameware remote control
iptables -A FORWARD --source $ligne --destination 192.168.100.100 -p icmp -j ACCEPT
iptables -A FORWARD --source 192.168.100.100 --destination $ligne -p icmp -j ACCEPT
iptables -A FORWARD --source $ligne --destination 192.168.100.100 -p tcp --dport 6129 -j ACCEPT
iptables -A FORWARD --source 192.168.100.100 --destination $ligne -p tcp --sport 6129 -j ACCEPT
#Add here any rule you need for admin machines
done

#Machines behind the firewall should accees mail server, internet, and an accees to a FTP server
awk '{print $1}' /etc/machines_client | while read ligne
do
#Client machines ger accees to mail server (smtp and imap), proxy (tcp 8080), and LDAP on the mail server (tcp/389)
iptables -A FORWARD --source $ligne --destination 192.168.110.97 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD --source 192.168.110.97 --destination $ligne -p tcp --sport 8080 -j ACCEPT
iptables -A FORWARD --source $ligne --destination 192.168.110.112 -p tcp --dport 143 -j ACCEPT
iptables -A FORWARD --source 192.168.110.112 --destination $ligne -p tcp --sport 143 -j ACCEPT
iptables -A FORWARD --source $ligne --destination 192.168.110.112 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD --source 192.168.110.112 --destination $ligne -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD --source $ligne --destination 192.168.110.112 -p tcp --dport 389 -j ACCEPT
iptables -A FORWARD --source 192.168.110.112 --destination $ligne -p tcp --sport 389 -j ACCEPT
#We authorize client machines to acceess a FTP server
iptables -A FORWARD --source $ligne --destination 10.243.0.225 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD --source 10.243.0.225 --destination $ligne -p tcp --sport 21 -j ACCEPT
iptables -A FORWARD --source $ligne --destination 10.243.0.225 -p tcp --dport 20 -j ACCEPT
iptables -A FORWARD --source 10.243.0.225 --destination $ligne -p tcp --sport 20 -j ACCEPT
#From admin machines to client machines, we let authorize ping and Dameware remote control
awk '{print $1}' /etc/machines_admin | while read admin
do
iptables -A FORWARD --source $admin --destination $ligne -p tcp --dport 6129 -j ACCEPT
iptables -A FORWARD --source $ligne --destination $admin -p tcp --sport 6129 -j ACCEPT
iptables -A FORWARD --source $admin --destination $ligne -p icmp -j ACCEPT
iptables -A FORWARD --source $ligne --destination $admin -p icmp -j ACCEPT
done
#Add here any rules you need for client machines
done

;;
stop)
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
;;
stat)
iptables -L
;;
*)
echo "Usage : /etc/init.d/firewall start | stop | status"
;;
esac

Note that we use 2 files for declaring admin and client machines. These 2 files should be same format as /etc/hosts, meaning for ex for /etc/machines_admin:
192.168.100.45 PC329
192.168.100.222 PC771

Same thing for /etc/machines_client.

Now you have a working, logging firewall/bridge :)

Have fun !

37 comments:

552 said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...

It's great!!..................................................

Anonymous said...

how do u do?................................................................

Anonymous said...

great msg for me, thanks a lot dude˙﹏˙

Anonymous said...

廢話不多,祝你順心~^^........................................

Anonymous said...

uthome聊天ut網際空間聊天ut 網際空間聊天高聊天室ut男同聊天kiss貼圖區東洋kiss圖片kiss圖片區kiss臺灣kiss臺灣色情貼圖區mobile01正妹牆sex女優免費影片sex女優短片sog色論壇sorry演唱會spongebobsuperjunior成員tt 同志網tt1069論壇tt1096 同志網tt1096同志網tt同志交友網站tw king片王tw18成年人網tw18免費線上短片tw18貼圖sm卡通影片sm3usj成員介紹sex女優電影85cc聊天室男同志聊天室0951成人頻道下載

Anonymous said...

Never put off till tomorrow what may be done today.......................................................

Anonymous said...

人是受想像力所支配的。 ..................................................

Anonymous said...

人是受想像力所支配的。.............................................

Anonymous said...

45avdvd 本土av自拍天堂 免費a長片 性感照片xxx383 av1688情人天使娛樂網,sex 台中援交34c甜心寶貝直播貼片 hhh重鹹系列免費 寶貝視訊台中援交友留言 桃園視訊聊天室 小魔女a自拍 上班族視訊 高雄援留言視訊交友 彩虹性愛巴士 夢中情人情趣用品 mmshow tw網愛 苗栗人聊天室 寶貝視訊ok論壇 0941電愛專線 520sex-情色視訊 免費影片無碼卡通 85cc情色視訊交友 免費視訊美女影音觀賞 色瞇瞇影片網 jp成人 免費a影片線上直播 h 視訊自拍美女聊天室 性感沙灘3,性感照片 視訊交友90739,限制級,777美女dvd 洪爺sex免費看a片論壇 微風成人區情色文學 微風論壇短片區 免費成人動畫 玩美辣妹有約 1111av女優天堂 嘟嘟成人網 視訊聊天1799 成人圖片區 台灣kiss,微風成人 show live 視訊聊天 g8成人下載 yam視訊交友 a 免費影片線上直播 情色視訊交友辣妹no3 日本a片援交妹 拓網天空交友高雄視訊 6k情人網辣妹視訊 正妹視訊elove交友 免費視訊formosa car 視訊聊天qk176 成人文學

Anonymous said...

人不可以求其備,必捨其所短,取其所長 ............................................................

Anonymous said...

良言一句三冬暖,惡語傷人六月寒。......................................................................

Anonymous said...

Better late than never...................................................

Anonymous said...

It is never too late to learn. .................................................................

LatoshaDelapena0209嘉瑜 said...

It is no use crying over spilt milk...................................................................

祁禾 said...

期待你每一篇文章......................................................................

Anonymous said...

欣賞是一種美德~回應是最大的支持^^.................................................................

Anonymous said...

良言一句三冬暖,惡語傷人六月寒。....................................................................

Anonymous said...

當一個人內心能容納兩樣相互衝突的東西,這個人便開始變得有價值了。............................................................

Anonymous said...

來拜訪你囉~期待你的下次文章~加油^^..................................................................

Anonymous said...

A bird in hand is worth two in the bush. ..................................................................

Anonymous said...

你的blog超棒............................................................

Anonymous said...

Subtlety is better than force. ............................................................

Anonymous said...

知識可以傳授,智慧卻不行。每個人必須成為他自己。. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Anonymous said...

好多很有用資訊...感謝你的分享喔............................................................

Anonymous said...

耐斯的部落格值得推蔫!............................................................

Anonymous said...

人不能像動物一樣活著,而應該追求知識和美德............................................................

Anonymous said...

良好的開端,已是成功的一半。..................................................

Anonymous said...

做些小善事,說些愛的字句,世界更快樂。.......................................................

Anonymous said...

不要去想沒拿到的東西,多想想自己手裡所擁有的..................................................

韋陳富 said...

良言一句三冬暖,惡語傷人六月寒。......................................................................

Anonymous said...

生命的意義,是在於活的充實;而不是在於活得長久。......................................................

張王雅竹欣虹 said...

活是一種鍛鍊靈魂的東西..................................................................

Anonymous said...

缺少智慧,就是缺少一切..................................................

Anonymous said...

我是天山,等待一輪明月。......................................................................

Anonymous said...

男女互悅,未必廝守終生,相愛就是美的。.................................................................