MNF2 Firewall
From Freelock Knowledge Base
Notes:
Contents |
[edit] firewall rules
- Create outgoing accept rules for DHCP responses: fw:lan, fw:wifi udp 67-68
- status messages are sent from the firewall via SMTP. Make sure you open up an outgoing rule in the firewall to allow it to send these messages.
[edit] Port forwarding rules
To forward ports from WAN:
- DNAT
- Service to forward (port)
- Client: WAN
- Server: LAN, internal IP address
- Forwarding address: public IP address (if more than one)
[edit] Loopback rules
With MNF 2, to get loopback rules, you need to limit the from address. Otherwise you'll do SNAT for all incoming connections, making the entire Internet look like it's coming from the LAN zone!
We were an open relay for a couple days because of this.
- DNAT
- Forward all ports, tcp+udp
- Client: LAN private IP/netmask (use full dotted style)
- Server: LAN, internal IP address
[edit] Prevent password expiration
[root@mnf john]# more /etc/security/msec/level.local
no_password_aging_for("root")
no_password_aging_for("admin")
no_password_aging_for("john")
[edit] Allow secured SSH access from everywhere
Add this to /etc/hosts.allow:
sshd:ALL:ALLOW
Copy your ssh key to ~/.ssh/authorized_keys
Change this setting in /etc/ssh/sshd_config
PasswordAuthentication no
[edit] SSH access to both firewall and forwarded to server on LAN
1. Create a DNAT rule to forward port 22 to the appropriate LAN server:
DNAT wan lan:172.16.0.1:22 tcp 22
2. Create a DNAT rule to forward port 222 to port 22 on the firewall. If the firewall has a dynamic WAN address, you can use a static LAN address as the destination IP address:
DNAT wan:216.231.62.127 fw:172.16.0.2:22 tcp 222
[edit] NTP Cron job
In the Beta, the NTP cron job gets restored whenever you hit the NTP settings in the web page. It restores a job that attempts to pipe to /dev/null, instead of directing stdout/stderr. Change the template for this file to set appropriately?
CVS version apparently fixes this by setting ntpd to auto-update, instead of needing a cron job.
[edit] CA Certificate manager
Certificates are generated and put into /etc/freeswan/ipsec.d/certs and keys into /etc/freeswan/ipsec.d/private. The CA cert is put into /etc/freeswan/ipsec.d/cacerts, and we needed to create /etc/freeswan/ipsec.d/newcerts as a temporary directory before certificate generation worked properly.
See Running a CA for more.
[edit] OpenVPN
We haven't found the OpenVPN interface to be that useful. We just create the appropriate server OpenVPN files and drop them into /etc/openvpn.
The trick is getting the firewall configured to accept connections correctly.
We've opened two different ports for the VPN: UDP 1194 (default OpenVPN port) and TCP 443 (alternate port that's nearly always open through firewalls).
To set up the firewall for OpenVPN:
1. In the Zones interface, create a VPN zone, and make sure it's above the WAN zone in the list. 2. In the Interfaces list, add tun0 and tun1 to the VPN zone. Apply. 3. Add a default Policy for the VPN tunnel. We typically set vpn:all to ACCEPT, and apply. 4. Create a "tunnel" for each port and zone combination you want to enable: usually generic:udp:1194 wan, generic:tcp:443 wan, and generic:udp:1194 wifi. 5. Create the OpenVPN configs:
[root@peachpit shorewall]# more /etc/openvpn/freelock.conf #Generated by openvpn-setup.pl port 1194 proto udp dev tun # Multi-client server mode server tls-server # Diffie-Hellman parameters. # Generate your own with: # openssl dhparam -out dh1024.pem 1024 # Substitute 2048 for 1024 if you are using # 2048 bit keys. dh dh1024.pem # Any X509 key management system can be used. # OpenVPN can also use a PKCS #12 formatted key file # (see pkcs12 directive in man page). ca ca.crt cert ovpn-server.crt key ovpn-server.key # Routed VPN or Bridged VPN server 192.168.167.0 255.255.255.0 ;ifconfig-pool-persist ipp.txt tls-auth ta.key 0 # Advertise subnets to client push "route 192.168.9.0 255.255.255.0" push "dhcp-option DNS 192.168.9.39" push "dhcp-option WINS 192.168.9.39" push "dhcp-option DOMAIN freelock.lan" client-to-client # Keep Alive keepalive 15 120 # It's a good idea to reduce the OpenVPN # daemon's privileges after initialization. user nobody group nogroup # The persist options will try to avoid # accessing certain resources on restart # that may no longer be accessible because # of the privilege downgrade. persist-key persist-tun # Output a short status file showing # current connections, truncated # and rewritten every minute. status openvpn-status.log log-append openvpn-log # Use LZO compression (with adaptive shutoff) comp-lzo # Verbosity verb 3
6. Create/copy a dh1024.pem file, the ca.crt, and the server cert and key to the /etc/openvpn directory. Also a tls-auth passphrase or key. 7. Start the openvpn server.
8. Create and distribute a client config file:
[root@hunter openvpn]# more freelock.conf # Specify that we are a client and that we # will be pulling certain config file directives # from the server. client # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. ;dev tap dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. ;proto tcp proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. ;remote 192.168.119.254 1194 remote foraker.freelock.com 1194 ;remote 216.231.62.115 443 ;remote 216.231.62.127 1194 ;remote my-server-2 1194 float # Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. ;remote-random # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Downgrade privileges after initialization (non-Windows only) ;user nobody ;group nogroup # Try to preserve some state across restarts. persist-key persist-tun # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #] # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca ca.crt cert hunter.freelock.lan.crt key hunter.freelock.lan.key # Verify server certificate by checking # that the certicate has the nsCertType # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build-key-server # script in the easy-rsa folder will do this. ns-cert-type server # If a tls-auth key is used on the server # then every client must also have the key. tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo # Set log file verbosity. verb 3 # Silence repeating messages ;mute 20 pull dhcp-options up /etc/openvpn/client.up down /etc/openvpn/client.down
