About Firewall configuration

[Edward S.P. Leong]

Dear All,

I want to know MUST the Server machine BEHIND the linux firewall / 
router machine, then it can be assign ( use ) PRIVATE IP to instead of 
PUBLIC IP ?

Edward.

[Will Yonker]

> Dear All,
>
> I want to know MUST the Server machine BEHIND the linux firewall /
> router machine, then it can be assign ( use ) PRIVATE IP to instead of
> PUBLIC IP ?
> Dear All,
>
> I want to know MUST the Server machine BEHIND the linux firewall /
> router machine, then it can be assign ( use ) PRIVATE IP to instead of
> PUBLIC IP ?

I am not sure I understand the question.

If you are asking:

If a machine has to be behind a NATed firewall before you can assign a
private IP address.  The answer is yes and no.  If you want to have
several machines to have access to the Internet and only one IP, then you
would need to use Network Address Translation.  Then you could use one of
the private IP address ranges for all of the machines on your internal
network while only having a single box directly exposed to the Internet. 
This is not the same as a true firewall though because it really doesn't
HAVE to block any traffic.  So the box would really be just a router.

In cases like this, I have found it best to have two NICs in the box that
has Internet access.  That way, you can use one NIC for external and one
NIC for internal traffic.

Here is a simple script that I think would work.

IPTABLES=/sbin/iptables
EXTIF="eth0"
INTIF="eth1"
$IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF -j
MASQUERADE
$IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward

[Edward S.P. Leong]

[e-mail] wrote:
> > Dear All,
> >
> > I want to know MUST the Server machine BEHIND the linux firewall /
> > router machine, then it can be assign ( use ) PRIVATE IP to instead of
> > PUBLIC IP ?
> > Dear All,
> >
> > I want to know MUST the Server machine BEHIND the linux firewall /
> > router machine, then it can be assign ( use ) PRIVATE IP to instead of
> > PUBLIC IP ?
>
> I am not sure I understand the question.
>
> If you are asking:
>
> If a machine has to be behind a NATed firewall before you can assign a
> private IP address.  The answer is yes and no.  If you want to have
> several machines to have access to the Internet and only one IP, then you
> would need to use Network Address Translation.  Then you could use one of
> the private IP address ranges for all of the machines on your internal
> network while only having a single box directly exposed to the Internet. 
> This is not the same as a true firewall though because it really doesn't
> HAVE to block any traffic.  So the box would really be just a router.
>
> In cases like this, I have found it best to have two NICs in the box that
> has Internet access.  That way, you can use one NIC for external and one
> NIC for internal traffic.
>
> Here is a simple script that I think would work.
>
> IPTABLES=/sbin/iptables
> EXTIF="eth0"
> INTIF="eth1"
> $IPTABLES --table nat --append POSTROUTING --out-interface $EXTIF -j
> MASQUERADE
> $IPTABLES --append FORWARD --in-interface $INTIF -j ACCEPT
> echo "1" > /proc/sys/net/ipv4/ip_forward

Hello,

If all of server are NOT DMZ, then they can be assigned ( used ) Private
IP ?

Edward.

[Will Yonker]

> Hello,
>
> If all of server are NOT DMZ, then they can be assigned ( used ) Private
> IP ?

Okay, DMZ adds a layer of complexity but really has no bearing on the
private IP range.

What is it you are trying to accomplish?

Your DMZ can be behind your NAT box but does not have to be.  Some DMZ
setups look something like this:

Internet
   |
   |
   |
   v
Border router
   |      |
   |      |
   |      |
   v      v
DMZ1    DMZ2    DMZ3   ...
   |
   |
   |
   v
Internal firewall
   |            |
   |            |
   |            |
   v            v
Computer1   Computer2   Computer3

So, in this case, you can use either your border router or your internal
firewall as your NAT box.  Either will do but the border router might be a
better choice.

Of course your DMZ boxes should be single tasked.  Therefore, each should
only have 1 or so ports that are accessible from either your internal
network or the Internet.  There is much much more to this though.  Like,
your DMZ boxes should not be allowed to initiate connections, especially
to your internal network.  There should be no connections coming in to the
internal firewall from the Internet or the untrusted network.  Etc...

[Edward S.P. Leong]

[e-mail] wrote:
> > Hello,
> >
> > If all of server are NOT DMZ, then they can be assigned ( used ) Private
> > IP ?
>
> Okay, DMZ adds a layer of complexity but really has no bearing on the
> private IP range.
>
> What is it you are trying to accomplish?
>
> Your DMZ can be behind your NAT box but does not have to be.  Some DMZ
> setups look something like this:
>
> Internet
>   |
>   |
>   |
>   v
> Border router
>   |      |
>   |      |
>   |      |
>   v      v
> DMZ1    DMZ2    DMZ3   ...
>   |
>   |
>   |
>   v
> Internal firewall
>   |            |
>   |            |
>   |            |
>   v            v
> Computer1   Computer2   Computer3
>
> So, in this case, you can use either your border router or your internal
> firewall as your NAT box.  Either will do but the border router might be a
> better choice.
>
> Of course your DMZ boxes should be single tasked.  Therefore, each should
> only have 1 or so ports that are accessible from either your internal
> network or the Internet.  There is much much more to this though.  Like,
> your DMZ boxes should not be allowed to initiate connections, especially
> to your internal network.  There should be no connections coming in to the
> internal firewall from the Internet or the untrusted network.  Etc...

My means :
The Server machine is not DMZ, so can it use Private IP only ?

[Will Yonker]

> My means :
> The Server machine is not DMZ, so can it use Private IP only ?

Your only limitation is that a machine can NOT use an address in the
private IP range to communicate DIRECTLY to the Internet.

If you have a router (be it hardware or software) to map your traffic to a
public IP, you can use either.

So:  If your network has a DMZ, it should have a firewall that protects
the internal network.  This firewall could (is?) be configured to use NAT
(i.e. masquerading).  Given all of that, and your server is located on the
internal network, it can use either a public or private IP address.

[Edward S.P. Leong]

[e-mail] wrote:
> > My means :
> > The Server machine is not DMZ, so can it use Private IP only ?
>
> Your only limitation is that a machine can NOT use an address in the
> private IP range to communicate DIRECTLY to the Internet.

Sorry, pardon me !
> If you have a router (be it hardware or software) to map your traffic to a
> public IP, you can use either.

The router machine is a general router machine which provided by ISP, so
it can't to be configed with firewall function ( only routed / routing
function )...

[Ed Greshko]

> The router machine is a general router machine which provided by ISP, so
> it can't to be configed with firewall function ( only routed / routing
> function )...

If I were you, I'd head over to http://www.shorewall.net/ and check out that
site.  They have lots of good information on setting up a Linux firewall
with diagrams that may shed some light on your given situation.

I would install the shorewall package on FC6 and configure it using the site
as your guide.  (You should be able to simply do "yum install shorewall")
Then if I had additional questions on configuration I'd join the shorewall
mailing list and ask on that list as they are friendly and eager to help.

Regards,
Ed

[Will Yonker]

> [e-mail] wrote:
> > > My means :
> > > The Server machine is not DMZ, so can it use Private IP only ?
> >
> > Your only limitation is that a machine can NOT use an address in the
> > private IP range to communicate DIRECTLY to the Internet.
>
> Sorry, pardon me !

I did not mean to sound like I was yelling.  I simply used the capitals to
emphasize.  :)
> > If you have a router (be it hardware or software) to map your traffic to
> > a
> > public IP, you can use either.
>
> The router machine is a general router machine which provided by ISP, so
> it can't to be configed with firewall function ( only routed / routing
> function )...

Another poster suggested you go and install surewall.  I would not suggest
you do that!  Not without some thought and planning anyway.  You would
want a good understanding of what that package is and how it can help you.
 Putting another router that is totally under your control between your
network and your ISPs is a good idea though.

Give a lot of thought to your network design and what you want to do with
it.  Do some reading on DMZs and what they are intended to do.  You really
want to allow the minimum amount of incoming (and to a slightly lesser
degree outgoing) traffic while still allowing your users to perform their
functions.

Here are a few sites to get you started:

http://tldp.org/HOWTO/Security-HOWTO/index.html

http://www.netfilter.org/

http://www.linuxsecurity.com/

I hope this all makes sense without being too basic.  Security is an
important topic.