3.4. Configuring IP Forwarding Policies

3.4.1. Configuring IP Masquerade on Linux 2.4.x Kernels

Please note that IPCHAINS is no longer the primary firewall configuration tool for the 2.4.x kernels. The new kernels now use the IPTABLES toolkit though the new 2.4.x kernels CAN still run most old IPCHAINS or IPFWADM rulesets via a compatiblity module. It should be noted that when in this mode, NO IPTABLES modules can be loaded. It should also be noted that none of the 2.2.x IPMASQ modules are compatible with 2.4.x kernels. For a more detailed reason for these changes, please see the Section 7.38 section.

Ok, as mentioned before, the /etc/rc.d/rc.local script will load the script called /etc/rc.d/rc.firewall once after every reboot. The script will load all required IPMASQ modules as well as enable the IPMASQ function. In advanced setups, this same file would contain very secure firewall rulesets as well.

Anyway, create the file /etc/rc.d/rc.firewall-2.4 with the following initial SIMPLE ruleset:

<rc.firewall-2.4 START>

#!/bin/sh # # rc.firewall-2.4 FWVER=0.73 # # Initial SIMPLE IP Masquerade test for 2.4.x kernels # using IPTABLES. # # Once IP Masquerading has been tested, with this simple # ruleset, it is highly recommended to use a stronger # IPTABLES ruleset either given later in this HOWTO or # from another reputable resource. # # # # Log: # 0.73 - REJECT is not a legal policy yet; back to DROP # 0.72 - Changed the default block behavior to REJECT not DROP # 0.71 - Added clarification that PPPoE users need to use # "ppp0" instead of "eth0" for their external interface # 0.70 - Added commented option for IRC nat module # - Added additional use of environment variables # - Added additional formatting # 0.63 - Added support for the IRC IPTABLES module # 0.62 - Fixed a typo on the MASQ enable line that used eth0 # instead of $EXTIF # 0.61 - Changed the firewall to use variables for the internal # and external interfaces. # 0.60 - 0.50 had a mistake where the ruleset had a rule to DROP # all forwarded packets but it didn't have a rule to ACCEPT # any packets to be forwarded either # - Load the ip_nat_ftp and ip_conntrack_ftp modules by default # 0.50 - Initial draft # echo -e "\n\nLoading simple rc.firewall version $FWVER..\n" # The location of the iptables and kernel module programs # # If your Linux distribution came with a copy of iptables, # most likely all the programs will be located in /sbin. If # you manually compiled iptables, the default location will # be in /usr/local/sbin # # ** Please use the "whereis iptables" command to figure out # ** where your copy is and change the path below to reflect # ** your setup # #IPTABLES=/sbin/iptables IPTABLES=/usr/local/sbin/iptables DEPMOD=/sbin/depmod INSMOD=/sbin/insmod #Setting the EXTERNAL and INTERNAL interfaces for the network # # Each IP Masquerade network needs to have at least one # external and one internal network. The external network # is where the natting will occur and the internal network # should preferably be addressed with a RFC1918 private address # scheme. # # For this example, "eth0" is external and "eth1" is internal" # # # NOTE: If this doesnt EXACTLY fit your configuration, you must # change the EXTIF or INTIF variables above. For example: # # If you are a PPPoE or analog modem user: # # EXTIF="ppp0" # # EXTIF="eth0" INTIF="eth1" echo " External Interface: $EXTIF" echo " Internal Interface: $INTIF" #====================================================================== #== No editing beyond this line is required for initial MASQ testing == echo -en " loading modules: " # Need to verify that all modules have all required dependencies # echo " - Verifying that all kernel modules are ok" $DEPMOD -a # With the new IPTABLES code, the core MASQ functionality is now either # modular or compiled into the kernel. This HOWTO shows ALL IPTABLES # options as MODULES. If your kernel is compiled correctly, there is # NO need to load the kernel modules manually. # # NOTE: The following items are listed ONLY for informational reasons. # There is no reason to manual load these modules unless your # kernel is either mis-configured or you intentionally disabled # the kernel module autoloader. # # Upon the commands of starting up IP Masq on the server, the # following kernel modules will be automatically loaded: # # NOTE: Only load the IP MASQ modules you need. All current IP MASQ # modules are shown below but are commented out from loading. # =============================================================== echo "----------------------------------------------------------------------" #Load the main body of the IPTABLES module - "iptable" # - Loaded automatically when the "iptables" command is invoked # # - Loaded manually to clean up kernel auto-loading timing issues # echo -en "ip_tables, " $INSMOD ip_tables #Load the IPTABLES filtering module - "iptable_filter" # - Loaded automatically when filter policies are activated #Load the stateful connection tracking framework - "ip_conntrack" # # The conntrack module in itself does nothing without other specific # conntrack modules being loaded afterwards such as the "ip_conntrack_ftp" # module # # - This module is loaded automatically when MASQ functionality is # enabled # # - Loaded manually to clean up kernel auto-loading timing issues # echo -en "ip_conntrack, " $INSMOD ip_conntrack #Load the FTP tracking mechanism for full FTP tracking # # Enabled by default -- insert a "#" on the next line to deactivate # echo -en "ip_conntrack_ftp, " $INSMOD ip_conntrack_ftp #Load the IRC tracking mechanism for full IRC tracking # # Enabled by default -- insert a "#" on the next line to deactivate # echo -en "ip_conntrack_irc, " $INSMOD ip_conntrack_irc #Load the general IPTABLES NAT code - "iptable_nat" # - Loaded automatically when MASQ functionality is turned on # # - Loaded manually to clean up kernel auto-loading timing issues # echo -en "iptable_nat, " $INSMOD iptable_nat #Loads the FTP NAT functionality into the core IPTABLES code # Required to support non-PASV FTP. # # Enabled by default -- insert a "#" on the next line to deactivate # echo -en "ip_nat_ftp, " $INSMOD ip_nat_ftp #Loads the IRC NAT functionality into the core IPTABLES code # Require to support NAT of IRC DCC requests # # Disabled by default -- remove the "#" on the next line to activate # #echo -e "ip_nat_irc" #$INSMOD ip_nat_irc echo "----------------------------------------------------------------------" # Just to be complete, here is a list of the remaining kernel modules # and their function. Please note that several modules should be only # loaded by the correct master kernel module for proper operation. # -------------------------------------------------------------------- # # ipt_mark - this target marks a given packet for future action. # This automatically loads the ipt_MARK module # # ipt_tcpmss - this target allows to manipulate the TCP MSS # option for braindead remote firewalls. # This automatically loads the ipt_TCPMSS module # # ipt_limit - this target allows for packets to be limited to # to many hits per sec/min/hr # # ipt_multiport - this match allows for targets within a range # of port numbers vs. listing each port individually # # ipt_state - this match allows to catch packets with various # IP and TCP flags set/unset # # ipt_unclean - this match allows to catch packets that have invalid # IP/TCP flags set # # iptable_filter - this module allows for packets to be DROPped, # REJECTed, or LOGged. This module automatically # loads the following modules: # # ipt_LOG - this target allows for packets to be # logged # # ipt_REJECT - this target DROPs the packet and returns # a configurable ICMP packet back to the # sender. # # iptable_mangle - this target allows for packets to be manipulated # for things like the TCPMSS option, etc. echo -e " Done loading modules.\n" #CRITICAL: Enable IP forwarding since it is disabled by default since # # Redhat Users: you may try changing the options in # /etc/sysconfig/network from: # # FORWARD_IPV4=false # to # FORWARD_IPV4=true # echo " Enabling forwarding.." echo "1" > /proc/sys/net/ipv4/ip_forward # Dynamic IP users: # # If you get your IP address dynamically from SLIP, PPP, or DHCP, # enable this following option. This enables dynamic-address hacking # which makes the life with Diald and similar programs much easier. # echo " Enabling DynamicAddr.." echo "1" > /proc/sys/net/ipv4/ip_dynaddr # Enable simple IP forwarding and Masquerading # # NOTE: In IPTABLES speak, IP Masquerading is a form of SourceNAT or SNAT. # # NOTE #2: The following is an example for an internal LAN address in the # 192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask # connecting to the Internet on external interface "eth0". This # example will MASQ internal traffic out to the Internet but not # allow non-initiated traffic into your internal network. # # # ** Please change the above network numbers, subnet mask, and your # *** Internet connection interface name to match your setup # #Clearing any previous configuration # # Unless specified, the defaults for INPUT and OUTPUT is ACCEPT # The default for FORWARD is DROP (REJECT is not a valid policy) # echo " Clearing any existing rules and setting default policy.." $IPTABLES -P INPUT ACCEPT $IPTABLES -F INPUT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -F OUTPUT $IPTABLES -P FORWARD DROP $IPTABLES -F FORWARD $IPTABLES -t nat -F echo " FWD: Allow all connections OUT and only existing and related ones IN" $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT $IPTABLES -A FORWARD -j LOG echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF" $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE echo -e "\nrc.firewall-2.4 v$FWVER done.\n"

<rc.firewall-2.4 STOP>

Once you are finished with editing the /etc/rc.d/rc.firewall ruleset, make it executable by typing in chmod 700 /etc/rc.d/rc.firewall-2.4

Now that the firewall ruleset is ready, you need to let it run after every reboot. You could either do this by running it by hand everytime (such a pain) or add it to the boot scripts. We have covered two methods below:

1. Redhat and Redhat-derived distros:

• There are two ways to automatically load things in Redhat: /etc/rc.d/rc.local or a init script in /etc/rc.d/init.d/. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.. " /etc/rc.d/rc.firewall-2.4

  to the end of the /etc/rc.d/rc.local file and thats it (as described earlier in the HOWTO).

  The problem with this approach is that the firewall isn't executed until the last stages of booting. The preferred approach is to have the firewall loaded just after the networking subsystem is loaded. To do this, copy the following file into the /etc/rc.d/init.d directory:

  <firewall-2.4 START>

  #!/bin/sh # # chkconfig: 2345 11 89 # # description: Loads the rc.firewall-2.4 ruleset. # # processname: firewall-2.4 # pidfile: /var/run/firewall.pid # config: /etc/rc.d/rc.firewall-2.4 # probe: true # ---------------------------------------------------------------------------- # v02/09/02 # # Part of the copyrighted and trademarked TrinityOS document. # http://www.ecst.csuchico.edu/~dranch # # Written and Maintained by David A. Ranch # dranch@trinnet.net # # Updates # ------- # # ---------------------------------------------------------------------------- # Source function library. . /etc/rc.d/init.d/functions # Check that networking is up. # This line no longer work with bash2 #[ ${NETWORKING} = "no" ] && exit 0 # This should be OK. [ "XXXX${NETWORKING}" = "XXXXno" ] && exit 0 [ -x /sbin/ifconfig ] || exit 0 # The location of various iptables and other shell programs # # If your Linux distribution came with a copy of iptables, most # likely it is located in /sbin. If you manually compiled # iptables, the default location is in /usr/local/sbin # # ** Please use the "whereis iptables" command to figure out # ** where your copy is and change the path below to reflect # ** your setup # IPTABLES=/usr/local/sbin/iptables # See how we were called. case "$1" in start) /etc/rc.d/rc.firewall-2.4 ;; stop) echo -e "\nFlushing firewall and setting default policies to DROP\n" $IPTABLES -P INPUT DROP $IPTABLES -F INPUT $IPTABLES -P OUTPUT DROP $IPTABLES -F OUTPUT $IPTABLES -P FORWARD DROP $IPTABLES -F FORWARD $IPTABLES -F -t nat # Delete all User-specified chains $IPTABLES -X # # Reset all IPTABLES counters $IPTABLES -Z ;; restart) $0 stop $0 start ;; status) $IPTABLES -L ;; mlist) cat /proc/net/ip_conntrack ;; *) echo "Usage: firewall-2.4 {start|stop|status|mlist}" exit 1 esac exit 0

  <firewall-2.4 STOP>

  With this script in place, run the command:

  chkconfig --level=345 firewall-2.4 on

  That's it! Now upon boot, the firewall will be loaded automatically.

2. Slackware:

• There are two ways to load things in Slackware: /etc/rc.d/rc.local or editing the /etc/rc.d/rc.inet2 file. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.." /etc/rc.d/rc.firewall-2.4

Notes on how users might want to change the above firewall ruleset:

You could also have IP Masquerading enabled on a PER MACHINE basis instead of the above method, which is enabling an ENTIRE TCP/IP network. For example, say if I wanted only the 192.168.0.2 and 192.168.0.8 hosts to have access to the Internet and NOT any of the other internal machines. I would change the in the "Enable simple IP forwarding and Masquerading" section (shown above) of the /etc/rc.d/rc.firewall ruleset.

#!/bin/sh # # Partial 2.4.x config to enable simple IP forwarding and Masquerading # v0.61 # # NOTE: The following is an example to allow only IP Masquerading for the # 192.168.0.2 and 192.168.0.8 machines with a 255.255.255.0 or a # "/24" subnet mask connecting to the Internet on interface eth0. # # ** Please change the network number, subnet mask, and the Internet # ** connection interface name to match your internal LAN setup # echo " - Setting the default FORWARD policy to DROP" $IPTABLES -P FORWARD DROP echo " - Enabling SNAT (IPMASQ) functionality on $EXTIF" $IPTABLES -t nat -A POSTROUTING -o $EXTIF -s 192.168.0.2/32 -j MASQUERADE $IPTABLES -t nat -A POSTROUTING -o $EXTIF -s 192.168.0.8/32 -j MASQUERADE echo " - Setting the FORWARD policy to 'DROP' all incoming / unrelated traffic" $IPTABLES -A INPUT -i $EXTIF -m state --state NEW,INVALID -j DROP $IPTABLES -A FORWARD -i $EXTIF -m state --state NEW,INVALID -j DROP

Common mistakes:

It appears that a common mistake with new IP Masq users is to make the first command simply the following:

IPTABLES: --------- iptables -t nat -A POSTROUTING -j MASQUERADE

Do NOT make your default policy MASQUERADING. Otherwise, someone can manipulate their routing tables to tunnel straight back through your gateway, using it to masquerade their OWN identity!

Again, you can add these lines to the /etc/rc.d/rc.firewall file, one of the other rc files you prefer, or do it manually every time you need IP Masquerade.

Please see Section 6.4.1 for a detailed guide on a strong IPTABLES ruleset example. For additional details on IPTABLES usage, please refer to http://www.netfilter.org/ (mirror at Samba.org) for the primary IPTABLES site.

3.4.2. Configuring IP Masquerade on Linux 2.2.x Kernels

Please note that IPFWADM is no longer the firewall tool for manipulating IP Masquerading rules for both the 2.1.x and 2.2.x kernels. These new kernels now use the IPCHAINS toolkit. For a more detailed reason for this change, please see Chapter 7.

Create the file /etc/rc.d/rc.firewall-2.2 with the following initial SIMPLE ruleset:

<rc.firewall-2.2 START>

#!/bin/sh # # rc.firewall-2.2 # # - Initial SIMPLE IP Masquerade test for 2.1.x and 2.2.x kernels # using IPCHAINS. # # Once IP Masquerading has been tested, with this simple # ruleset, it is highly recommended to use a stronger # IPTABLES ruleset either given later in this HOWTO or # from another reputable resource. FWVER="1.21" # # 1.21 - Added clarification that PPPoE users need to use # "ppp0" instead of "eth0" for their external interface # 1.20 - Updated the script to use environment vars # 1.01 - Original version echo -e "\n\nLoading simple rc.firewall-2.2 : version $FWVER..\n" # The location of the ipchains and kernel module programs # # If your Linux distribution came with a copy of ipchains, # most likely all the programs will be located in /sbin. If # you manually compiled ipchains, the default location will # be in /usr/local/sbin # # ** Please use the "whereis ipchains" command to figure out # ** where your copy is and change the path below to reflect # ** your setup # IPCHAINS=/sbin/ipchains #IPTABLES=/usr/local/sbin/ipchains DEPMOD=/sbin/depmod INSMOD=/sbin/insmod MODPROBE=/sbin/modprobe #Setting the EXTERNAL and INTERNAL interfaces for the network # # Each IP Masquerade network needs to have at least one # external and one internal network. The external network # is where the NATing will occur and the internal network # should preferably be addressed with a RFC1918 private addressing # scheme. # # For this example, "eth0" is external and "eth1" is internal" # # NOTE: If this doesnt EXACTLY fit your configuration, you must # change the EXTIF or INTIF variables above. For example: # # If you are a PPPoE or analog modem user: # # EXTIF="ppp0" # # ** Please change this to reflect your specific configuration ** # EXTIF="eth0" INTIF="eth1" echo " External Interface: $EXTIF" echo " Internal Interface: $INTIF" # Network Address of the Internal Network # # This example rc.firewall file uses the 192.168.0.0 network # with a /24 or 255.255.255.0 netmask. # # ** Change this variable to reflect your specific setup ** # INTLAN="192.168.0.0/24" echo -e " Internal Interface: $INTLAN\n" # Load all required IP MASQ modules # # NOTE: Only load the IP MASQ modules you need. All current IP MASQ modules # are shown below but are commented out from loading. echo " loading required IPMASQ kernel modules.." # Needed to initially load modules # $DEPMOD -a echo -en " Loading modules: " # Supports the proper masquerading of FTP file transfers using the PORT method # echo -en "FTP, " $MODPROBE ip_masq_ftp # Supports the masquerading of RealAudio over UDP. Without this module, # RealAudio WILL function but in TCP mode. This can cause a reduction # in sound quality # #echo -en "RealAudio, " $MODPROBE ip_masq_raudio # Supports the masquerading of IRC DCC file transfers # #echo -en "Irc, " #$MODPROBE ip_masq_irc # Supports the masquerading of Quake and QuakeWorld by default. This modules is # for for multiple users behind the Linux MASQ server. If you are going to # play Quake I, II, and III, use the second example. # # NOTE: If you get ERRORs loading the QUAKE module, you are running an old # ----- kernel that has bugs in it. Please upgrade to the newest kernel. # #echo -en "Quake, " #Quake I / QuakeWorld (ports 26000 and 27000) #$MODPROBE ip_masq_quake # #Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960) #$MODPROBE ip_masq_quake 26000,27000,27910,27960 # Supports the masquerading of the CuSeeme video conferencing software # #echo -en "CuSeeme, " #$MODPROBE ip_masq_cuseeme #Supports the masquerading of the VDO-live video conferencing software # #echo -en "VdoLive " #$MODPROBE ip_masq_vdolive echo ". Done loading modules." #CRITICAL: Enable IP forwarding since it is disabled by default since # # Redhat Users: you may try changing the options in # /etc/sysconfig/network from: # # FORWARD_IPV4=false # to # FORWARD_IPV4=true # echo " enabling forwarding.." echo "1" > /proc/sys/net/ipv4/ip_forward #CRITICAL: Enable automatic IP defragmenting since it is disabled by default # in 2.2.x kernels. This used to be a compile-time option but the # behavior was changed in 2.2.12 # echo " enabling AlwaysDefrag.." echo "1" > /proc/sys/net/ipv4/ip_always_defrag # Dynamic IP users: # # If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this # following option. This enables dynamic-ip address hacking in IP MASQ, # making the life with Diald and similar programs much easier. # #echo " enabling DynamicAddr.." #echo "1" > /proc/sys/net/ipv4/ip_dynaddr # Enable the LooseUDP patch which some Internet-based games require # # If you are trying to get an Internet game to work through your IP MASQ box, # and you have set it up to the best of your ability without it working, try # enabling this option (delete the "#" character). This option is disabled # by default due to possible internal machine UDP port scanning # vulnerabilities. # #echo " enabling LooseUDP.." #echo "1" > /proc/sys/net/ipv4/ip_masq_udp_dloose #Clearing any previous configuration # # Unless specified, the defaults for INPUT and OUTPUT is ACCEPT # The default for FORWARD is REJECT # echo " clearing any existing rules and setting default policy.." $IPCHAINS -P input ACCEPT $IPCHAINS -P output ACCEPT $IPCHAINS -P forward REJECT $IPCHAINS -F input $IPCHAINS -F output $IPCHAINS -F forward # MASQ timeouts # # 2 hrs timeout for TCP session timeouts # 10 sec timeout for traffic after the TCP/IP "FIN" packet is received # 160 sec timeout for UDP traffic (Important for MASQ'ed ICQ users) # echo " setting default timers.." $IPCHAINS -M -S 7200 10 160 # DHCP: For people who receive their external IP address from either DHCP or # BOOTP such as ADSL or Cablemodem users, it is necessary to use the # following before the deny command. # # This example is currently commented out. # # #$IPCHAINS -A input -j ACCEPT -i $EXTIF -s 0/0 67 -d 0/0 68 -p udp # Enable simple IP forwarding and Masquerading # # NOTE: The following is an example for an internal LAN address in the # 192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask # connecting to the Internet on interface eth0. # # ** Please change this network number, subnet mask, and your Internet # ** connection interface name to match your internal LAN setup # echo " enabling IPMASQ functionality on $EXTIF" $IPCHAINS -P forward DENY $IPCHAINS -A forward -i $EXTIF -s $INTLAN -j MASQ echo -e "\nrc.firewall-2.2 v$FWVER done.\n"

<rc.firewall-2.2 STOP>

Once you are finished with editing the /etc/rc.d/rc.firewall ruleset, make it executable by typing in chmod 700 /etc/rc.d/rc.firewall

Now that the firewall ruleset is ready, you need to let it run after every reboot. You could either do this by running it by hand everytime (such a pain) or add it to the boot scripts. We have covered two methods below:

1. Redhat and Redhat-derived distros:

• There are two ways to automatically load things in Redhat: /etc/rc.d/rc.local or a init script in /etc/rc.d/init.d/. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.." /etc/rc.d/rc.firewall-2.2

  to the end of the /etc/rc.d/rc.local file and thats it (as described earlier in the HOWTO).

  The problem with this approach is that the firewall isn't executed until the last stages of booting. The preferred approach is to have the firewall loaded just after the networking subsystem is loaded. To do this, copy the following file into the /etc/rc.d/init.d directory:

  <firewall-2.2 START>

  #!/bin/sh # # chkconfig: 2345 11 89 # # description: Loads the rc.firewall-2.2 ruleset. # # processname: firewall-2.2 # pidfile: /var/run/firewall.pid # config: /etc/rc.d/rc.firewall-2.2 # probe: true # ---------------------------------------------------------------------------- # v08/29/02 # # Part of the copyrighted and trademarked TrinityOS document. # http://www.ecst.csuchico.edu/~dranch # # Written and Maintained by David A. Ranch # dranch@trinnet.net # # Updates # ------- # # ---------------------------------------------------------------------------- # Source function library. . /etc/rc.d/init.d/functions # Check that networking is up. # This line no longer work with bash2 #[ ${NETWORKING} = "no" ] && exit 0 # This should be OK. [ "XXXX${NETWORKING}" = "XXXXno" ] && exit 0 [ -x /sbin/ifconfig ] || exit 0 # The location of various iptables and other shell programs # # If your Linux distribution came with a copy of iptables, most # likely it is located in /sbin. If you manually compiled # iptables, the default location is in /usr/local/sbin # # ** Please use the "whereis iptables" command to figure out # ** where your copy is and change the path below to reflect # ** your setup # IPCHAINS=/sbin/ipchains # See how we were called. case "$1" in start) /etc/rc.d/rc.firewall-2.2 ;; stop) echo -e "\nFlushing firewall and setting default policies to REJECT\n" $IPCHAINS -P input REJECT $IPCHAINS -P output REJECT $IPCHAINS -P forward REJECT $IPCHAINS -F input $IPCHAINS -F output $IPCHAINS -F forward ;; restart) $0 stop $0 start ;; status) $IPCHAINS -L ;; mlist) $IPCHAINS -M -L ;; *) echo "Usage: firewall-2.2 {start|stop|status|mlist}" exit 1 esac exit 0

  <firewall-2.2 STOP>

  With this script in place, run the command:

  chkconfig --level=345 firewall-2.2 on

  That's it! Now upon boot, the firewall will be loaded automatically.

2. Slackware:

• There are two ways to load things in Slackware: /etc/rc.d/rc.local or editing the /etc/rc.d/rc.inet2 file. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.." /etc/rc.d/rc.firewall-2.2

  to the end of the /etc/rc.d/rc.local file and thats it. The problem with this approach is that if you are running a STRONG firewall ruleset, the firewall isn't executed until the last stages of booting. The preferred approach is to have the firewall loaded just after the networking subsystem is loaded. For now, the HOWTO only covers how to do so using /etc/rc.d/rc.local. If you want a stronger system, I recommend you check out Section 10 of TrinityOS found in the links section at the bottom of this HOWTO.

Notes on how users might want to change the above firewall ruleset:

You could also have IP Masquerading enabled on a PER MACHINE basis instead of the above method, which is enabling an ENTIRE TCP/IP network. For example, say if I wanted only the 192.168.0.2 and 192.168.0.8 hosts to have access to the Internet and NOT any of the other internal machines. I would change the in the "Enable simple IP forwarding and Masquerading" section (shown above) of the /etc/rc.d/rc.firewall ruleset.

#!/bin/sh # # Enable simple IP forwarding and Masquerading # v1.01 # # NOTE: The following is an example used in addition to the simple # IPCHAINS ruleset anove to allow only IP Masquerading for the # 192.168.0.2 and 192.168.0.8 machines with a 255.255.255.0 or a # "24" bit subnet mask connecting to the Internet on interface $EXTIF. # # ** Please change the network number, subnet mask, and the Internet # ** connection interface name to match your internal LAN setup # $IPCHAINS -P forward DENY $IPCHAINS -A forward -i $EXTIF -s 192.168.0.2/32 -j MASQ $IPCHAINS -A forward -i $EXTIF -s 192.168.0.8/32 -j MASQ

Common mistakes:

What appears to be a common mistake with new IP MASQ users is to make the first command:

$IPCHAINS -P forward masquerade

Do NOT make your default policy MASQUERADING. Otherwise, someone can manipulate their routing tables to tunnel straight back through your gateway, using it to masquerade their OWN identity!

Again, you can add these lines to the /etc/rc.d/rc.firewall file, one of the other rc files you prefer, or do it manually every time you need IP Masquerade.

Please see Section 6.4.2 for a detailed guide on IPCHAINS and a strong IPCHAINS ruleset example. For additional details on IPCHAINS usage, please refer to http://www.netfilter.org/ipchains/ (mirror at Samba.org) for the primary IPCHAINS site or the Linux IP CHAINS HOWTO Backup site

3.4.3. Configuring IP Masquerade on Linux 2.0.x Kernels

Create the file /etc/rc.d/rc.firewall with the following initial SIMPLE ruleset: <rc.firewall-2.0 START>

#!/bin/sh # # rc.firewall-2.0 # # A Initial SIMPLE IP Masquerade setup for 2.0.x kernels using IPFWADM # FWVER="2.02" # # 2.02 - Added clarification that PPPoE users need to use # "ppp0" instead of "eth0" for their external interface # # # Once IP Masquerading has been tested, with this simple # ruleset, it is highly recommended to use a stronger # IPTABLES ruleset either given later in this HOWTO or # from another reputable resource. # echo -e "\n\nLoading simple rc.firewall version $FWVER..\n" #Setting the EXTERNAL and INTERNAL interfaces for the network # # Each IP Masquerade network needs to have at least one # external and one internal network. The external network # is where the NATing will occur and the internal network # should preferably be addressed with a RFC1918 private addressing # scheme. # # For this example, "eth0" is external and "eth1" is internal" # # NOTE: If this doesnt EXACTLY fit your configuration, you must # change the EXTIF or INTIF variables above. For example: # # If you are a PPPoE or analog modem user: # # EXTIF="ppp0" # # ** Please change this to reflect your specific configuration ** # EXTIF="eth0" INTIF="eth1" echo " External Interface: $EXTIF" echo " Internal Interface: $INTIF" # Network Address of the Internal Network # # This example rc.firewall file uses the 192.168.0.0 network # with a /24 or 255.255.255.0 netmask. # # ** Change this variable to reflect your specific setup ** # INTLAN="192.168.0.0/24" echo -e " Internal Interface: $INTLAN\n" # Load all required IP MASQ modules # # NOTE: Only load the IP MASQ modules you need. All current available IP # MASQ modules are shown below but are commented out from loading. echo -en "Loading modules: " # Needed to initially load modules # /sbin/depmod -a # Supports the proper masquerading of FTP file transfers using the PORT method # echo -en "FTP, " /sbin/modprobe ip_masq_ftp # Supports the masquerading of RealAudio over UDP. Without this module, # RealAudio WILL function but in TCP mode. This can cause a reduction # in sound quality # #echo -en "RealAudio, " #/sbin/modprobe ip_masq_raudio # Supports the masquerading of IRC DCC file transfers # #echo -en "Irc, " #/sbin/modprobe ip_masq_irc # Supports the masquerading of Quake and QuakeWorld by default. These modules # are for multiple users behind the Linux MASQ server. If you are going to # play Quake I, II, and III, use the second example. # # NOTE: If you get ERRORs loading the QUAKE module, you are running an old # ----- kernel that has bugs in it. Please upgrade to the newest kernel. # #echo -en "Quake, " #Quake I / QuakeWorld (ports 26000 and 27000) #/sbin/modprobe ip_masq_quake # #Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960) #/sbin/modprobe ip_masq_quake 26000,27000,27910,27960 # Supports the masquerading of the CuSeeme video conferencing software # #echo -en "CuSeeme, " #/sbin/modprobe ip_masq_cuseeme #Supports the masquerading of the VDO-live video conferencing software # #echo -en "VdoLive, " #/sbin/modprobe ip_masq_vdolive echo ". Done loading modules." #CRITICAL: Enable IP forwarding since it is disabled by default # # Redhat Users: you may try changing the options in # /etc/sysconfig/network from: # # FORWARD_IPV4=false # to # FORWARD_IPV4=true # echo " enabling forwarding.." echo "1" > /proc/sys/net/ipv4/ip_forward #CRITICAL: Enable automatic IP defragmenting since it is disabled by default # # This used to be a compile-time option but the behavior was changed # in 2.2.12. This option is required for both 2.0 and 2.2 kernels. # echo " enabling AlwaysDefrag.." echo "1" > /proc/sys/net/ipv4/ip_always_defrag # Dynamic IP users: # # If you get your Internet IP address dynamically from SLIP, PPP, or DHCP, # enable the following option. This enables dynamic-ip address hacking in # IP MASQ, making the life with DialD, PPPd, and similar programs much easier. # #echo " enabling DynamicAddr.." #echo "1" > /proc/sys/net/ipv4/ip_dynaddr #Clearing any previous configuration # # Unless specified, the defaults for INPUT and OUTPUT is ACCEPT # The default for FORWARD is REJECT # echo " clearing any existing rules and setting default policy.." /sbin/ipfwadm -I -p accept /sbin/ipfwadm -O -p accept /sbin/ipfwadm -F -p reject /sbin/ipfwadm -I -f /sbin/ipfwadm -O -f /sbin/ipfwadm -F -f # MASQ timeouts # # 2 hrs timeout for TCP session timeouts # 10 sec timeout for traffic after the TCP/IP "FIN" packet is received # 160 sec timeout for UDP traffic (Important for MASQ'ed ICQ users) # echo " setting default timers.." /sbin/ipfwadm -M -s 7200 10 160 # DHCP: For people who receive their external IP address from either DHCP or # BOOTP such as ADSL or Cablemodem users, it is necessary to use the # following before the deny command. # # This example is currently commented out. # # #/sbin/ipfwadm -I -a accept -S 0/0 67 -D 0/0 68 -W $EXTIF -P udp # Enable simple IP forwarding and Masquerading # # NOTE: The following is an example for an internal LAN address in the # 192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask # connecting to the Internet on interface eth0. # # ** Please change this network number, subnet mask, and your Internet # ** connection interface name to match your internal LAN setup. # echo " enabling IPMASQ functionality on $EXTIF" /sbin/ipfwadm -F -p deny /sbin/ipfwadm -F -a m -W $EXTIF -S $INTLAN -D 0.0.0.0/0 echo -e "\nrc.firewall-2.0 v$FWVER done.\n"

<rc.firewall-2.0 STOP>

Once you are finished with editing the /etc/rc.d/rc.firewall ruleset, make it executable by typing in "chmod 700 /etc/rc.d/rc.firewall"

Now that the firewall ruleset is ready to go, you need to let it run after every reboot. You could either do this by running it by hand everytime (such a pain) or add it to the boot scripts. We have covered two methods below:

Redhat and Redhat-derived distros:

• There are two ways to automatically load things in Redhat: /etc/rc.d/rc.local or a init script in /etc/rc.d/init.d/. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.." /etc/rc.d/rc.firewall

  The problem with this approach is that the firewall isn't executed until the last stages of booting. The preferred approach is to have the firewall loaded just after the networking subsystem is loaded. To do this, copy the following file into the /etc/rc.d/init.d directory:

  <firewall-2.0 START>

  #!/bin/sh # # chkconfig: 2345 11 89 # # description: Loads the rc.firewall-2.0 ruleset. # # processname: firewall-2.0 # pidfile: /var/run/firewall.pid # config: /etc/rc.d/rc.firewall-2.0 # probe: true # ---------------------------------------------------------------------------- # v02/09/02 # # Part of the copyrighted and trademarked TrinityOS document. # http://www.ecst.csuchico.edu/~dranch # # Written and Maintained by David A. Ranch # dranch@trinnet.net # # Updates # ------- # # ---------------------------------------------------------------------------- # Source function library. . /etc/rc.d/init.d/functions # Check that networking is up. # This line no longer work with bash2 #[ ${NETWORKING} = "no" ] && exit 0 # This should be OK. [ "XXXX${NETWORKING}" = "XXXXno" ] && exit 0 [ -x /sbin/ifconfig ] || exit 0 # The location of various iptables and other shell programs # # If your Linux distribution came with a copy of iptables, most # likely it is located in /sbin. If you manually compiled # iptables, the default location is in /usr/local/sbin # # ** Please use the "whereis iptables" command to figure out # ** where your copy is and change the path below to reflect # ** your setup # IPFWADM=/sbin/ipfwadm # See how we were called. case "$1" in start) /etc/rc.d/rc.firewall-2.0 ;; stop) echo -e "\nFlushing firewall and setting default policies to REJECT\n" $IPFWADM -I -p REJECT $IPFWADM -O -p REJECT $IPFWADM -F -p REJECT $IPFWADM -I -f $IPFWADM -O -f $IPFWADM -F -f ;; restart) $0 stop $0 start ;; status) $IPFWADM -l ;; mlist) $IPFWADM -M -l ;; *) echo "Usage: firewall-2.0 {start|stop|status|mlist}" exit 1 esac exit 0

  <firewall-2.0 STOP>

  With this script in place, run the command:

  chkconfig --level=345 firewall-2.0 on

  That's it! Now upon boot, the firewall will be loaded automatically.

Slackware:

• There are two ways to automatically load things in Slackware: /etc/rc.d/rc.local or editing the /etc/rc.d/rc.inet2 file. The first method is the easiest. All you have to do is add the line:

  echo "Loading the rc.firewall ruleset.." /etc/rc.d/rc.firewall-2.0

  to the end of the /etc/rc.d/rc.local file and thats it. The problem with this approach is that if you are running a STRONG firewall ruleset, the firewall isn' t executed until the last stages of booting. The preferred approach is to have the firewall loaded just after the networking subsystem is loaded. For now, the HOWTO only covers how to do so using /etc/rc.d/rc.local. If you want the strong er system, I recommend you check out Section 10 of TrinityOS found in the links section at the bottom of this HOWTO.

Notes on how users might want to change the above firewall ruleset:

You could have also enabled IP Masquerading on a PER MACHINE basis instead of the above method enabling an ENTIRE TCP/IP network. For example, say if I wanted only the 192.168.0.2 and 192.168.0.8 hosts to have access to the Internet and NOT any of the other internal machines. I would change the in the "Enable simple IP forwarding and Masquerading" section (shown above) of the /etc/rc.d/rc.firewall ruleset.

# Enable simple IP forwarding and Masquerading # v2.01 # # NOTE: The following is an example to only allow IP Masquerading for the # 192.168.0.2 and 192.168.0.8 machines with a 255.255.255.0 or a "24" # bit subnet mask connected to the Internet on interface eth0. # # ** Please change this network number, subnet mask, and your Internet # ** connection interface name to match your internal LAN setup # # Please use the following in ADDITION to the simple rulesets above for # specific MASQ networks. # /sbin/ipfwadm -F -p deny /sbin/ipfwadm -F -a m -W $EXTIF -S 192.168.0.2/32 -D 0.0.0.0/0 /sbin/ipfwadm -F -a m -W $EXTIF -S 192.168.0.8/32 -D 0.0.0.0/0

Common mistakes:

What appears to be a common mistake with new IP Masq users is to make the first command:

ipfwadm -F -p masquerade

Do NOT make your default policy MASQUERADING. Otherwise, someone who has the ability to manipulate their routing tables will be able to tunnel straight back through your gateway, using it to masquerade their OWN identity!

Again, you can add these lines to the /etc/rc.d/rc.firewall file, one of the other rc files (if you prefer), or manually add those lines every time you need IP Masquerade.

Please see Section 6.4.2 and Section 6.4.3for a detailed guide and stronger examples of IPCHAINS and IPFWADM ruleset examples.