Chapter 4. Getting Started

This chapter introduces you to the Firewall Builder program. It walks you through using the tool, from starting it to building and installing an actual firewall configuration.

The Firewall Builder package for most Linux distributions creates a menu item that makes starting the program easy. (On Ubuntu, it's System > Administration > Firewall Builder.) However, if the menu item is not there, you can always launch it from the command line by just typing fwbuilder at the shell prompt.

The program starts by opening the main window and a tips dialog.

Let's create our first firewall object. To do this, we'll use the object creation menu, accessed by clicking this icon above the object tree: . Choose New Firewall from the menu that appears.

The first page of the New Firewall wizard appears. In this page of the wizard we can enter the name for the new firewall object (here it is "guardian"), its platform ("iptables") and its host OS ("Linux 2.4/2.6").

The name of the new firewall object can be anything you want. However, if you want to use SNMP to populate the interface objects, or if you want to use DNS lookups to populate IP address objects, you must name the firewall object the same name as the actual firewall machine.

There are three ways a new firewall can be created: you can use a pre-configured template firewall object, create it from scratch, or use SNMP to create a firewall object with interfaces but an empty policy.

The Getting Started chapter demonstrates the first method, using a template object. (Other methods are described in Section 6.1.2.) To do this, check Use pre-configured template firewall objects checkbox. Firewall Builder comes with a default set of objects, and we'll be using one of those there. Alternatively, an administrator can distribute a library of predefined templates to other users in the enterprise, as described in Section 6.4.

We are going to use one of the standard templates distributed with Firewall Builder, so we'll leave the standard template library path and name in the Template file input field. Click Next to move on to the next page of the wizard.

Note that the template firewall object comes completely configured, including addresses and netmasks for its interfaces and some basic policy and NAT rules. This configuration is intended as a starting point only. You should reconfigure addresses of interfaces to match those used on your network. You most likely will have to adjust rules to match your security policy. See Section 11.1 for instructions.

This page of the wizard shows template objects and their configuration. Standard template objects represent firewalls with two or three interfaces, a host with one interface, a web server or a Cisco router. We'll choose fw template 3, a firewall with three interfaces, for this example. Click Finish to create a new firewall object using the chosen template.

Our new firewall object is show in Figure 4-5. Its name is "guardian", and it appears in the object tree in the left hand side of the main window in the folder "Firewalls". When an object is selected in the tree, a brief summary of its properties appears in the panel under the tree. Double-clicking on the object in the tree opens it in the editor panel at the bottom-right panel of the main window. The editor for the firewall object allows us to change its name, platform and host OS, and also provides buttons that open dialogs for "advanced" settings for the firewall platform and host OS. We will inspect these little later in this chapter.

Now would be a good time to save the data to a disk file. To do so use main menu File/Save As.

Pick a location and name for the new data file. Firewall Builder uses file extension ".fwb" for data files.

Note that once the firewall data is saved to a file, its name appears in the main window title. Here it is "test.fwb."

Let's take a little tour of the network and service objects that come standard with the program. You can use these pre-configured objects to build access Policy, NAT, and Routing rules for your firewall.

Objects in the tree are organized in libraries. You can switch between libraries using the drop-down menu above the tree. Firewall Builder comes with a collection of address, service and time interval objects in the library called "Standard". Let's take a look at them.

Folder Objects/Hosts contains a few host objects used in standard firewall templates. Folder Objects/Network contains network objects that represent various standard address ranges and blocks, such as multicast, net 127/8, networks defined in RFC1918 and so on.

Firewall Builder also comes with an extensive collection of service objects. This picture shows some TCP objects (all of them do not fit in the screenshot).

ICMP service objects.

UDP service objects.

Let's inspect some of the objects Firewall Builder created for you as part of the new firewall object. To open an object in the editor and inspect or change its properties, double-click on it in the tree.

You can also right-click on the object in the tree to open a pop-up menu. Choose Edit to edit the object.

Every object in Firewall Builder has basic attributes such as Name and Comment. Other attributes depend on the object type.

Attributes of the firewall object include Platform (can be iptables, pf, ipfilter, etc.), Version (platform-dependent) and Host OS. Buttons Host OS Settings and Firewall Settings open dialogs with many additional attributes that depend on the firewall platform and host OS. More on these later.

Here are the choices for the firewall platform, version (for iptables) and host OS.

Interfaces of the firewall are represented by objects located below the Firewall object in the tree. We refer to them as "children" of the firewall object. Figure 4-18 shows properties of interface eth0. To open it in the editor, double-click on it in the tree. If editor panel is already open and shows some object, it is sufficient to select the new object in the tree to reveal it in the editor panel (no need to double-click).

IP and MAC addresses of interfaces are represented by child objects in the tree located below the corresponding interface.

An interface object has several attributes that define its function, such as "Management interface", "external", and so on.

• Name: The name of the interface object in Firewall Builder must match exactly the name of the interface of the firewall machine it represents. This will be something like "eth0", "eth1", "en0", "br0", and so on.

• Label: On most OS's this field is not used and serves the purpose of a descriptive label. Firewall Builder GUI uses a label, if it is not blank, to show interfaces in the tree. One of the suggested uses for this field is to mark interfaces to reflect the network topology ('outside', 'inside') or the purpose ('web frontend' or 'backup subnet'). The label is mandatory for Cisco PIX though, where it must reflect the network topology.

• Management interface: When the firewall has several network interfaces, one of them can be marked as the "management interface". The management interface is used for all communication between Firewall Builder and the firewall. For example, the Firewall Builder policy installer uses the address of the management interface to connect to the firewall via SSH when it copies the generated script or configuration file to it. (firewall object only)

• External interface (insecure): Marks an interface that connects to the Internet.

• Unprotected interface: Recognized by policy compilers for Cisco IOS access lists and PF. The compiler for IOS ACL just skips unprotected interfaces and does not assign an ACL to them. The compiler for PF generates a "set skip on <interface_name>" clause for unprotected interfaces.

• Regular Interface: Use this option if the interface has an IP address assigned to it manually.

• Address is assigned dynamically: Use this option if the interface has a dynamic address obtained via DHCP, PPP or another protocol. In this case an address is unknown when when Firewall Builder generates the Firewall policy. Some firewalls allow for using the interface name in the policy instead of the IP address; the firewall engine then picks its address either when the policy is activated or even at run-time.

• Unnumbered interface: Use this option if the interface can never have an IP address, such as the Ethernet interface used to run PPPoE communication on some ADSL connections, or tunnel endpoint interface (GRE, PPPoE, sometimes IPSEC). Although unnumbered interfaces do not have addresses, firewall policy rules and access lists can be associated with them.

• Bridge port: This option is used for a port of a bridged firewall. Compilers skip bridge ports when they pick interfaces to attach policy and NAT rules to. For target firewall platforms that support bridging and require special configuration parameters to match bridged packets, compilers use this attribute to generate proper configurations. For example, in the case of iptables, the compiler uses -m physdev --physdev-in or -m physdev --physdev-out for bridge port interfaces.

• Security level: The security level of this interface, used only with Cisco PIX (ASA).

• Network zone: Network zone of this interface, used only with Cisco PIX (ASA). Network zone drop-down list shows all network objects and groups of addresses and networks present in the tree. Choose one of them to tell the compiler which networks and blocks of addresses can be reached through this interface. Compiler uses this information to decide which interface each ACL rule should be associated with based on the addresses used in the destination of the rule.

Here is IP address of interface eth0. The address and netmask are attributes of the child object of the type "IPv4 address". Here the address is "192.0.2.1" and netmask "255.255.255.0". (Netmask can also be specified using slash notation, such as 24, without the actual slash.) Button DNS Lookup can be used to determine IP address using DNS. The program runs DNS query for the "A" record for the name of the parent firewall object. (This only works if the firewall object has the same name as the actual firewall machine.)

This is the IP address of the internal interface of the firewall. The address used in this template is "192.168.1.1" with netmask "255.255.255.0". This is a typical address used for small and home networks. Some commercial firewall appliances come pre-configured with this address.

If your network uses an address different from the "192.168.1.0/24" address used in the template, you should change the address of the interface in the editor panel and click Apply. In addition, you also will need to replace the network object "net-192.168.1.0" used in several Policy and NAT rules of the newly created firewall with a network object that has an address matching your network configuration. See Section 11.1 for instructions.

Here is the IP address of the DMZ interface of the firewall. The address used in this template is "192.168.2.1", with netmask "255.255.255.0". Change it to match your DMZ network address.

Let's inspect the properties of the firewall object. Double-click on the firewall "guardian" in the tree to open it in the editor panel, then click the Firewall Settings button in the editor. This opens a new dialog that looks like Figure 4-23.

Click the Help button to open help fir this dialog. The online help explains all attributes and parameters located in each tab of the advanced settings dialog. Explore it, as many parameters are important and affect the generated firewall script in different ways.

The next few images show other tabs of the advanced settings dialog. You can find detailed explanations of all parameters in the online help.

This page defines various parameters for the built-in policy installer. The installer uses an SSH client (pscp.exe and plink.exe on Windows) to transfer the generated script to the firewall machine and activate it there.

You can define shell commands that will be included in the generated script at the beginning and at the end of it. These commands can do anything you want, such as configure some subsystems, set up routing, and so on.

Parameters for logging.

This screen shows more options for the script generation. Notice that Firewall Builder can produce the iptables script in two formats: 1) as a shell script that calls the iptables utility to add each rule one by one, or 2) it can use iptables-restore script to activate the whole policy at once. Other parameters are explained in the online help.

Starting with v3.0, Firewall Builder can generate both IPv4 and IPv6 policies. This tab controls the order in which they are added to the script if you have defined rules for both address families in the Policy objects of the firewall.

Let's take a look at the policy of the template firewall shown in Figure 4-30. These rules are intended to be an example, a starting point to help you create your own policy. Most likely you will want to modify the rules to suite your requirements. Explanations of the rules given here are brief because the goal of Getting Started is only to demonstrate how to use Firewall Builder.

• Rule 0: This is an anti-spoofing rule. It blocks incoming packets on the external interface that have source addresses that belong to the firewall or your internal or DMZ networks. The rule is associated with outside interface and has Direction set to "Inbound".

• Rule 1: This rule permits any packets on the loopback interface. This is necessary because many services on the firewall machine communicate back to the same machine via loopback.

• Rule 2: Permit ssh access from internal network to the firewall machine. Notice service object "ssh" in the column Service. (This object can be found in the Standard objects library in the Services/TCP folder.)

Access policy rules belong to the object "Policy", which is a child object of the firewall and can be found in the tree right below it. As with any other object in Firewall Builder, the Policy object has some attributes that you can edit if you double-click on it in the tree.

• Policy can be IPv4, IPv6, or combined IPv4 and IPv6. In the last case you can use a mix of IPv4 and IPv6 address objects in the same policy (in different rules), and Firewall Builder will automatically figure out which one is which and sort them out.

• Policy can translate into only the mangle table (used for modifying packets) or a combination of the filter table (used for allowing/blocking packets) and the mangle table. In the latter case, the policy compiler decides which table to use based on the rule action and service object. Some actions, such as "Tag" (which translates into iptables target MARK), go into mangle table.

• The "Top ruleset" is the one the compiler will use to populate iptables built-in chains INPUT/OUTPUT/FORWARD. (If you have only one ruleset, then mark it as the top ruleset.) If a policy is not marked as "top ruleset", generated rules will go into a user-defined chain with the same name as the policy object.

Here are the pre-configured NAT rules.

• Rule 0: Tells the firewall that no address translation should be done for packets traveling from network 192.168.2.0 to 192.168.1.0 (because Translated Source, Translated Destination and Translated Service are left empty).

• Rule 1: Packets coming into the firewall from internal and DMZ networks are translated so that their source address will change to that of the outside interface on the firewall.

• Rule 2: Packets coming from the Internet to the interface "outside" will be translated and forwarded to the internal server on DMZ represented by the host object "server on dmz".

Now we compile the policy of the firewall "guardian" and generate the iptables script. To do so, right-click on the firewall in the tree, then select Compile from the pop-up menu.

A new dialog appears that allows you to choose which firewalls you want to compile. Obviously this is only useful if you have several firewalls in the object tree. Since the checkbox next to the "guardian" firewall is already checked, click Next to proceed.

Firewall Builder calls the appropriate policy compiler. The dialog displays compiler progress and results.

Compiler generates an iptables script in a ".fw" file with the same name the same as the firewall object (guardian.fw). The file is placed in the same directory as the .fwb data file.

Here is the how generated script looks (this is just the beginning). Now you can transfer it to the firewall and execute it there to install iptables rules. However, it is much more convenient to use Firewall Builders' built-in policy installer to do this.

To use the installer, right-click on the firewall object in the tree and select Install. Firewall Builder will compile the policy (if it is not compiled already) and then open a dialog where you can configure the parameters of the installer. Here you need to enter a password to authenticate to the firewall. Section Section 8.7 has detailed instructions for setting up and using the installer.