[SOLVED] How to set up Arch machine as firewall for local network?

nbd · 2018-12-29 20:18:51

Hello,
I'm trying to set up a firewall on an Arch machine for a small local network which consists of a ethernet/wifi router (connected to Internet) and several machines with ethernet/wifi connection to the router.

In this setup I'm referring to two wikis: Router and Internet sharing. One point is unclear for me in my case: wiki says that NAT should be enabled with the following iptables rule:

# iptables -A FORWARD -i net0 -o internet0 -j ACCEPT

This is intended for a firewall machine with two NICs. How does this translate to the network configuration that I described? That is how NAT should be enabled when the firewall machine has one NIC connected to the router?

Last edited by nbd (2018-12-30 12:06:50)

loqs · 2018-12-29 20:29:30

With the devices you want to firewall connected directly to the router as well that complicates things. Does the router support VLANs?

nbd · 2018-12-29 20:43:47

loqs wrote:

Does the router support VLANs?

Not sure how to check it. It does support "Virtual server":

NAT Setting - Virtual Server
To make services, like WWW, FTP, provided by a server in your local network accessible to the outside users, you should specify a local IP address to the server. Then, add the IP address and network protocol type, port number, and name of the service in the following list. Based on the list, the gateway will forward service request from outside users to the corresponding local server.

And also "Route"

LAN - Route
This function allows you to add routing rules into WL-520GU. It is useful if you connect several routers behind WL-520GU to share the same connection to the Internet.

The router is Asus WL-520GU.

UPDATE:
it also supports DMZ:

Virtual DMZ allows you to expose one computer to the Internet, so that all the inbounds packets will be redirected to the computer you set.

Looks like that what's needed in this case?

Last edited by nbd (2018-12-29 20:59:16)

/dev/zero · 2018-12-30 01:15:23

nbd wrote:

I'm trying to set up a firewall on an Arch machine for a small local network which consists of a ethernet/wifi router (connected to Internet) and several machines with ethernet/wifi connection to the router.

Please describe the network topology and define the threats you're trying to protect against.

All consumer-grade routers already provide firewalls, albeit lacking much customisability. Eg, if I'm running an ssh service on one of my Arch Linux machines, and I want to expose that service to the external internet, I need to explicitly configure the router to forward connections on port 22 through to the server. Otherwise nothing gets through in the first place: the router does its job and blocks everything by default.

If you intend your Arch Linux box to act as the actual router, you could make that intention clearer.

If you need something above and beyond what your router is already doing, eg your Arch Linux box receives some traffic from the router and then does further triaging, you need to be explicit about your setup and requirements.

nbd · 2018-12-30 02:11:25

Currently the network looks like this:

Wifi/Ethernet router, connected to WAN, works in the "Home gateway" mode which is described as follows:

In Home Gateway mode, the WL-520GU connects to the Internet via ADSL or cable modem, and clients in your network share the same IP to ISP.
In this mode, NAT is enabled and WAN connection is allowed using PPPoE, DHCP, or static IP. It also support UPnP and DDNS features that are useful for home users.

All other machines currently are router clients and connects to it via ethernet or wifi. That is all machines have 192.168.1.1 as the gateway:

router 192.168.1.1
machine1 192.168.1.2 Arch / ethernet
machine2 192.168.1.3 wifi
machine3 192.168.1.4 ethernet
machine4 192.168.1.5 wifi
machine5 192.168.1.6 wifi

The needed configuration is that all incoming and outcoming internet traffic from/to all local machines went through 192.168.1.2 Arch machine and was controlled by the firewall (iptables) rules that control which internet destinations for which local machine are allowed.

The router's built-in firewall is rather simplistic, though I currently use it for total blocking internet access for some machines while allowing them access to local network. For more granular restricting internet access router's firewall is not convenient, so I hope it will be possible to use a Linux machine for this purpose.

The threats I'm trying to protect against can be formulated as "unauthorized internet access" by software programs, so the solution I think would be allowing outgoing traffic only to whitelisted internet addresses.

Last edited by nbd (2018-12-30 02:12:41)

/dev/zero · 2018-12-30 02:37:37

Thanks for clarifying. It sounds like you want all local machines to use the Arch Linux machine as the firewall, even though the router is still mediating all traffic.

If that's the case, then you should contact your router firmware provider. It is not an Arch Linux problem, if you have some third-party router in the way, and you want to tell it "don't use your own firewall, use the firewall on that Arch Linux box over there", and the router does not offer this option.

If you already have a router that offers this strange functionality, and you are having problems configuring the Arch Linux firewall to work with that crazy router, again, you need to be more explicit about what exactly is going on.

You know, you are not the only person in the world who wants to protect their boxes against "unauthorised internet access". Needing to protect against unauthorised internet access is why I keep my router's firmware up-to-date, I use a jumpbox, and I use ssh-guard and iptables firewalls.

None of the requirement of "preventing unauthorised access" dictates setting up some baroque network topology that knot-twists which traffic gets shunted to some dedicated "firewall" box before it can even get triaged for the first time.

I think you want something like what I've got, but you want to go about it in some baroque way. I can't help you with your baroque preconceptions: either demonstrate that you really have special requirements, or concede you just don't know how to configure your router and set up your local network

nbd · 2018-12-30 03:00:49

/dev/zero wrote:

Please don't make this topic "bikeshed".

I hope someone will advise what settings should be used in the described network configuration instead of

# iptables -A FORWARD -i net0 -o internet0 -j ACCEPT

Trilby · 2018-12-30 03:22:29

There are no settings that can make magic happen. If you don't like /dev/zeros tone, I can empathize. He could have been less confrontational about your network being 'boroque' and focused more on it being ... well, broke. There is no setting on the firewall of of 192.168.1.2 that could possibly block traffic between 192.168.1.1 and other 192.168.1.{3,4,5,6} with your current network setup.

If you change your network setup such that 192.168.1.2 acts as a router for 192.168.1.{3,4,5,6} then it could be possible (but if 192.168.1.2 has only the single wired NIC then that's also not possible).

nbd · 2018-12-30 03:35:39

Trilby wrote:

There is no setting on the firewall of of 192.168.1.2 that could possibly block traffic between 192.168.1.1 and other 192.168.1.{3,4,5,6} with your current network setup.

Why setting on 192.168.1.2? These settings can be specified on 192.168.1.{3,4,5,6}. A couple of years ago I had MITM proxy running on 192.168.1.2 and in Firefox settings on 192.168.1.3 I specified "connect via proxy 192.168.1.2" and all Firefoxes traffic went strictly through MITM on 192.168.1.2.

/dev/zero · 2018-12-30 03:35:47

Trilby wrote:

If you don't like /dev/zeros tone, I can empathize. He could have been less confrontational about your network being 'boroque' and focused more on it being ... well, broke.

Aw, now now. I'm much less confrontational than I used to be. Let's face it: OP's situation is "broke" exactly because it's "baroque".

By calling it what it is, I hope they will reframe their requirements. The goal isn't for anyone to feel bad. We all start ignorant!

nbd wrote:

Please don't make this topic "bikeshed".

I'm not a mod, and I'm not the person who asked the question, and I've acted in good faith by attempting to elicit more clarity from you about your question.

Meaning, I'm not responsible if this gets TGNed.

If you get TGNed, you may reflect on how to ask a more precise question in future. The Arch Linux community does not wield "Wands of Networking" that will elucidate and repair all possible problems.

Trilby · 2018-12-30 03:49:52

nbd wrote:

These settings can be specified on 192.168.1.{3,4,5,6}.

Yes, they can. But that would be individual firewalls on each system and have absolutely nothing to do with any previous content of this thread.

nbd wrote:

A couple of years ago I had MITM proxy running on 192.168.1.2 and in Firefox settings on 192.168.1.3 I specified "connect via proxy 192.168.1.2" and all Firefoxes traffic went strictly through MITM on 192.168.1.2.

Yes, if all the other systems can proxy all traffic through 192.168.1.2, this could work as well, but you'd be relying on those proxy settings remaining intact - the one specific attack vector you mentioned concern for, however, would preclude this: if you want to prevent some activities originating from 192.168.1.{3,4,5,6} by a setting on your firewall, the users of those systems could trivially circumvent this by simply disabling the proxy settings.

If you can assume the people sitting in the chairs of 192.168.1.{3,4,5,6} are reliable and cooperative, it'd be far easier to just tell them not to visit some website than it would be to tell them to use your system as a proxy and block said website at your firewall. Alternatively, if you can set up a proxy settings on their systems, why not just set up a firewall on their systems to block traffic to the sites of concern?

This is sounding more and more like an X-Y problem (or X-Y-Z). You think setting up a firewall on 192.168.1.2 may be a good way to achieve some goal. From the sounds of it, it is most likely not. But we don't yet really know what the goal is.

Last edited by Trilby (2018-12-30 03:55:09)

/dev/zero · 2018-12-30 03:55:39

Trilby wrote:

But we don't yet really know what the goal is.

Like I said, nbd needs to clarify what exactly they require. You call my tone harsh, but your tolerance of their fuzziness is not helping anyone arrive at a solution.

nbd · 2018-12-30 12:06:04

I found the solution and mark this thread solved.

For those who may be interested here is the way to go:

https://www.ostechnix.com/how-to-assign … -in-linux/

Trilby · 2018-12-30 14:48:50

*headdesk*

If that is a solution to your problem, your problem was never presented in this thread.

Arch Linux

#1 2018-12-29 20:18:51

[SOLVED] How to set up Arch machine as firewall for local network?

#2 2018-12-29 20:29:30

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#3 2018-12-29 20:43:47

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#4 2018-12-30 01:15:23

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#5 2018-12-30 02:11:25

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#6 2018-12-30 02:37:37

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#7 2018-12-30 03:00:49

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#8 2018-12-30 03:22:29

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#9 2018-12-30 03:35:39

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#10 2018-12-30 03:35:47

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#11 2018-12-30 03:49:52

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#12 2018-12-30 03:55:39

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#13 2018-12-30 12:06:04

Re: [SOLVED] How to set up Arch machine as firewall for local network?

#14 2018-12-30 14:48:50

Re: [SOLVED] How to set up Arch machine as firewall for local network?

Board footer