[ Pobierz całość w formacie PDF ]

have different Ethernet cards. IP Forwarding on it is turned off.
IP Forwarding on both Linux boxes is also turned off. The router will not forward packets destined for
192.168.1.xxx unless explicitly told to do so, so the internet will not be able to get in. The reason for turning
off IP Forwarding here is so that packets from the Troop's network will not be able to reach the Mercenary
network, and vica versa.
The NFS server can also be set to offer different files to the different networks. This can come in handy, and
a little trickery with symbolic links can make it so that the common files can be shared with all. Using this
setup and another ethernet card can offer this one file server for all three networks.
The Proxy Setup
Now, since all three levels want to be able to monitor the network for their own devious purposes, all three
need to have net access. The external network is connected directly into the internet, so we don't have to mess
with proxy servers here. The Mercenary and Troop networks are behind firewalls, so it is necessary to set up
proxy servers here.
Both networks will be setup very similarly. They both have the same IP addresses assigned to them. I will
throw in a couple of parameters, just to make things more interesting though.
1. No one can use the file server for internet access. This exposes the file server to viruses and other
nasty things, and it is rather important, so its off limits.
The Network Setup 31
Firewall and Proxy Server HOWTO
2. We will not allow troop access to the World Wide Web. They are in training, and this kind of
information retrieval power might prove to be damaging.
So, the sockd.conf file on the Troop's Linux box will have this line:
and on the Mercenary machine:
And, the Troop's Linux box will have this line
deny eq 80
This says to deny access to all machines trying to access the port equal (eq) to 80, the http port. This will still
allow all other services, just deny Web access.
Then, both files will have:
to allow all the computers on the 192.168.1.xxx network to use this proxy server except for those that have
already been denied (ie. The file server and Web access from the Troop network).
The Troop's sockd.conf file will look like:
deny eq 80
and the Mercenary file will look like:
This should configure everything correctly. Each network is isolated accordingly, with the proper amount of
interaction. Everyone should be happy.
The Network Setup 32
Firewall and Proxy Server HOWTO
13.Making Management Easy
13.1 Firewall tools
There are several software packages that will make managing your firewall easier.
Be carefull, don't use these tools unless you can do without them. These scripts make it just as easy to make a
misstake as they do to help you get it wright.
Both graphical and web based interfaces are being developed to work with the Linux filtering rules. Some
companies have even create commercial firewalls based on Linux by putting it in their own box with their
own management code. (nice)
I'm not realy a GUI guy. However, I have been using firewalls with GUI interfaces for some time. I've found
they help by providing a nice report of all the rules in one easy glance.
gfcc (GTK+ Firewall Control Center) is a GTK+ application which can control Linux firewall policies and
rules, based on ipchains package. Go to http://icarus.autostock.co.kr and get your copy. This is a realy good
I have included RC scripts in appendex A. These scripts work with and without gfcc.
There a lots of scripts avaible to setup a firewall. One very complete script is avaible at
http://www.jasmine.org.uk/~simon/bookshelf/papers/instant-firewall/instant-firewall.html. Another will
done script is at http://www.pointman.org/.
Kfirewall is a GUI frontend for ipchains or ipfwadm (depending on your kernel version).
FCT is an HTML based tool for the configuration of a firewall. It features automatic script-generation for
IP-filtering commands (ipfwadm) on a firewall for multiple interfaces and any internet services.
13.2 General tools
WebMin is a general system admin package. It will not help you manage the firewall rules but it will help
you with turning on and off damons and processes. This program is VERY good, I'm hoping the J. Cameron
will include a IPCHAINS module. http://www.webmin.com/
If you are an ISP, you will want to know about IPFA (IP Firewall Acounting)
http://www.soaring-bird.com/ipfa/. It can do Per-Month/Per-day/per-min/ logs and has a Web based GUI
httptunnel. httptunnel creates a bidirectional virtual data path tunnelled in HTTP requests. The HTTP requests
13.Making Management Easy 33
Firewall and Proxy Server HOWTO
can be sent via an HTTP proxy if so desired. Or, on their system they install a Virtual Private Network (vpn).
See: http://sunsite.auc.dk/vpnd/ Or, Maybe this user simply puts a modem on their NT system and turns on
routing. Finally, on the workstation, on the private LAN, change the default gateway to point to the new route
to the Internet. Now, from this workstation, you can go anywhere. The only thing the firewall admin might
see is one connect with nowill see is a really long DNS lookup. Now, take over the world!
15.APPENDEX A - Example Scripts
15.1 RC Script useing GFCC
# Firewall Script - Version 0.9.1
# chkconfig: 2345 09 99
# description: firewall script for 2.2.x kernel
# Set for testing
# set -x
# This script is written for RedHat 6.1 or better.
# Be careful about offering public services like web or ftp servers.
# 1. place this file in /etc/rc.d/init.d (you'll have to be root..)
# call it something like "firewall" :-)
# make it root owned --> "chown root.root (filename)"
# make it executable --> "chmod 755 (filename)"
# 2. use GFCC to create your firewall rules and export them to a file
# named /etc/gfcc/rules/firewall.rule.sh.
# [ Pobierz całość w formacie PDF ]


Powered by WordPress dla [Nie kocha się ojca ani matki ani żony ani dzieca, lecz kocha się przyjemne uczucia, które w nas wzbudzają]. Design by Free WordPress Themes.