John,On Tue, 2005-01-04 at 20:28 -0500, Thomas Simmons wrote:
I will soon be setting up a Linux firewall at work and I would like to get some advice on the best way to implement it. Currently the question regards routing to the DMZ. We currently have ~30 websites being hosted on an IIS server thats directly connected to the internet. The server has multiple ip address assigned to the public interface, one for each site, and a default ip. This server also hosts an FTP site for each website, that uses the same ip as its website counterpart. Let's just say the public IP's assigned to this server are 111.111.111.1-111.111.111.32. My first thought was to add 30+ aliases to the firewalls public interface and use DNAT rules to forward traffic on needed ports to the webserver which would have a private ip. I would add something like this to my script.
IFCCMD="/sbin/ifconfig" IPTCMD="/sbin/iptables/" PUBIF="eth2" DMZIF="eth1" PUBMSK="255.255.255.128"
$IFCCMD $PUBIF:1 111.111.111.1 netmask $PUBMSK
$IPTCMD -A PREROUTING -t nat -p tcp -d 111.111.111.1 --dport 80 -j DNAT --to-destination 192.168.11.1:80
$IPTCMD -A FORWARD -i $PUBIF -o $DMZIF -p tcp --dport 80 -d 192.168.11.1 -j ACCEPT
$IPTCMD -A FORWARD -i $DMZIF -o $PUBIF -p tcp --sport 80 -s 192.168.11.1 -j ACCEPT
$IFCCMD $PUBIF:1 111.111.111.1 netmask $PUBMSK
$IPTCMD -A PREROUTING -t nat -p tcp -d 111.111.111.1 --dport 443 -j DNAT --to-destination 192.168.11.1:443
$IPTCMD -A FORWARD -i $PUBIF -o $DMZIF -p tcp --dport 443 -d 192.168.11.1 -j ACCEPT
$IPTCMD -A FORWARD -i $DMZIF -o $PUBIF -p tcp --sport 443 -s 192.168.11.1 -j ACCEPT
$IFCCMD $PUBIF:1 111.111.111.1 netmask $PUBMSK
$IPTCMD -A PREROUTING -t nat -p tcp -d 111.111.111.1 --dport 21 -j DNAT --to-destination 192.168.11.1:21
$IPTCMD -A FORWARD -i $PUBIF -o $DMZIF -p tcp --dport 21 -d 192.168.11.1 -j ACCEPT
$IPTCMD -A FORWARD -i $DMZIF -o $PUBIF -p tcp --sport 21 -s 192.168.11.1 -j ACCEPT
$IPTCMD -t nat -A POSTROUTING -s 192.168.11.1 -o $PUBIF -j SNAT --to 111.111.111.1
I would have to do this for each website, so basically I would be doing that 30 more times in the script, with only ip changes. I have tested it (not with 30 ip's, only 3) but it seems to work great. Is there a better way to do what I need? Is this what is called 1-to-1 nat? The system that we are using as the firewall is a 1GHz Celeron w/ 256MB RAM. The OS is basically a Debian base install w/ 2.4.27-custom kernel. The public and DMZ interfaces have GBE cards installed, so this system shouldn't have any speed problems with this configuration. Is that a fair assumption? Thanks in advance for any suggestions.
Regards, Thomas
I believe you are definitely on the right track. Much better to have IIS behind a firewall and NATted. You are indeed doing one-to-one NAT. I have a couple of suggestions.
I would suggest that you apply the NETMAP patch from patch-o-matic. This way you can define a subnet to which you do one-to-one NAT rather than having to define each address. If your addresses to not exactly match a subnet, you can break it into its composite subnets and use the patch. You can use SubnetCreator (http://subnetcreator.sourceforge.net) to calculate the subnets for you if you'd like. This will minimize the number of rules in your nat table.
I would apply the iprange patch from patch-o-matic. This way you can define the entire range and allow HTTP to that entire range in one rule in your forward table.
I would not use aliases. Rather, I would bind IP addresses to the interface using iproute2, e.g., ip address add 111.111.111.1/24 dev eth2 brd + and I would place this in a separate script.
That leads to the next point. I would not use a script which calls iptables commands. I would create a file in iptables-restore syntax to create the rules and then call iptables-restore from your iptables loading script.
In the ISCS network security management project (http://iscs.sourceforge.net), we do this all automatically, i.e., you would define the IIS server, tell it what real and NAT addresses it has, click on the enforce one-to-one NAT checkbox and click OK. It will automatically write the configuration files in the proper syntax depending on the patches on the firewall, write the files for binding the needed addresses to the interface, do all the error checking to make sure that you haven't made a mistake, push the files onto the gateway and make dynamic changes to the firewall without restarting the services.
Good luck - John
Thanks for your suggestions, I like the sound of the iprange and the NETMAP patches. As for the script, I have not used the iptables-restore syntax, and am very comfortable with iptables commands. My intentions are to actually have two firewall scripts. The default script would have rules that would forward needed traffic to our primary webserver. The second would have rules that would forward traffic to our failover webserver. I would have the firewall verify that our primary server is still online every 30 seconds or so with an echo. If not the second script would execute, forwarding all traffic to the backup server. I am going to have a rather complicated setup(30 web servers 30 mail servers, IPsec VPN gateway + pptp roadwarrior access) and would like to use iptables commands because im so comfortable with them. I also like the idea of doing everything with one (technically two) scripts, as a recovery after a disk failure would be as simple as installing Linux, putting the script on the server and executing it.
As for using iproute2 vs. aliases, why would you use iproute2? What are the benefits of doing this?
Again, thanks alot for the suggestions.
Regards, Thomas
