transparent firewall using iptables

well i urge every one to see the attached image first.........
well if you are done ithink i have made many things clear now.........
what i want is that the firewall i want to implement should be transparent to both router and switch...
i cant modify the settings of either router or switch becoz of certain reasons and i reaaly want to implement the firewall using iptables and linux.........
i mean what should be the rules that i am suppose to insert into iptables so that after clearing all the rules if a packet is safe to send to n fro from network...it can pass to and fro as it ia passing now........
i think i have made myself very clear...and i suppose there shouldnt be any prob regarding it

What firewall are you using? A software or server firewall? What kind of router is it and what's are the prefs. Also, explaing further, just a tad. Thanks.

i have made it very clear it is to be filtering firewall using IPTABLES on linux. The router is cisco router....and the firewall is to be placed on a dedicated system

IPtables needs to be configured very specifically to your own network. As for someone literally 'hand feeding' you the rules you must 'insert' into it, that would be tough to have it actually work without more knowledge about your LAN. As for setting up IPtables, a very, very good site is

well one thing that concerns me most is "is it possible for the system to act as transparent firewall?"....
and then the IP rules i would have to insert for eth0 and eth1.........anyhow thx for the link

The only truly "transparent" firewall I'm aware of is Sun Microsystems SunScreen firewall. It's got to be the enterprise edition, as the version that ships with Solaris9 is the routing version only.

It may be very possible to do this with iptables but I don't know of anyone who has successfully pulled it off.

P.S. PM me if you want more info on sunscreen.

I must be missing your idea of transparent. If it is a firewall, you are going to notice it is in place because it is applying filters to traffic, whether it be in or out-going. Saying any firewall is transparent would mean that it doesn't do anything, or am I missing something here? Do you just want it to work in between the router and switch?

Please define 'transparent' maybe we can help you out a bit more.

* * Another possibility would be to just use snort and attach it to a hub in between the router and switch, and do not allow any out going packets from that machine, that would be completely 'transparent' I would believe, but it would not necessarily stop any bad traffic, just show you what is happening, then you would have to work from there * *

Transparent IPTABLES firewall:

iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# ------Set policies for packets going through this firewall box-------- #
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Effective IPTABLES firewall:

iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

# ------Set policies for packets going through this firewall box-------- #
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

I think you might be looking for something in the middle.

To be any more specific you would have to let someone know what it is you want to let through, and what you want blocked ( ie. filtered ). Will you need certian ports open for ssh, webservers, ftp servers, video conferencing, irc, games, etc ??? Which is pointed toward the router, eth0 or eth1 ??? Why do you want the firewall behind the router?

It doesn't seem that clear to me.

You might start reading through
Linux netfilter Hacking HOWTO and Iptables Tutorial 1.1.19

well let make things clear..........the swtich send data to the router which acts as the gateway....the whole internal n/w is connected to the switch.........
now what i want is to place the dedicated system acting as a firewall (using IPTABLES) to put b/w the swtich and router......
the prob i cant modify configuration of either the switch or the router........
so how to handle the traffic?

now defining transparent.......

i want the swtich to send every packet to the system runnung firewall....the firewall checks if the packet is valid to send ...if it passes all the rules...the system should forward the packet to the router...but to router it should look as if the packet has come from the switch directly.......

similarly if the router is to send a packet coming from the internet to the internal network.....by the configuration in the router it will pass it on to the switch....but i am to place the firewall between switch and router so the packet should go to the firewall first instead of switch ( rem i cant modify the router config).....the firewall checks to see if it should allo the packet to go inside the network........if valid the packet is to be forwarded to the switch and to the switch it should look as if the packet has come from router itself.......

so by transparent i mean.....the firewall should be invisible to both router and switch....both should think they are ciommunicating directly each other without knowing the data comes filtered through firewall.....

i think now it should b a lot clear

thx for ever help u are putting forward

Quote:

---

Originally posted here by IKnowNot


I think you might be looking for something in the middle.

---

exactly i want something in middle between router and swtich

Quote:

---

To be any more specific you would have to let someone know what it is you want to let through, and what you want blocked ( ie. filtered ). Will you need certian ports open for ssh, webservers, ftp servers, video conferencing, irc, games, etc ??? Which is pointed toward the router, eth0 or eth1 ??? Why do you want the firewall behind the router?

---

i want to allow incoming HTTP,HTTPS data(port 80,443) only, from the internet...and from the internal network outgoing i would like to allow ssh,ftp,http,https

thx for the URLS .. i am already reading these and more.........

no, you still did not make it much clearer .... but I think what you might be looking for is,

Ethernet Bridge + netfilter Howto

Read that after you've read the others, I think you'll be well on your way..

i would like to know what i am missing IKnowNot...pls tell me what would u like to know more ........any how i will read this also...

What you are missing?

I too often times do not articulate in a manner to convey my meaning correctly, as powertoad5000 pointed out in Almost a tutorial

What you need is a way to set up the router side of the firewall box with an Ethernet card with NO IP address, since the router does the natting and/or masquerading for you and will be sending packets into it for numerous destinations, and you probably want the same thing for the switch side since you said you can not change the configurations of either: hence you want a bridge.

Another very important thing is what flavor ( or more precisely what version ) of Linux you are using.
If you are running a 2.0 kernel, IKNowNot.
If you are running a 2.2 kernel, there should be a patch for the bridging, but did you patch(?) the kernel for iptables?

If you are running a recent version of a 2.4 kernel, everything should be be there but you may have to rebuild the kernel to “activate” it.

With the links provided hopefully you should be able to then figure out the firewall rules and bridging you need.

another thought: will you have direct access to the firewall box or will you be accessing it via ssh from the LAN ? If the latter is true you may need a third ethernet card because the others won't have an IP address for the box to connect to otherwise.

Just something to concider.