Difference between revisions of "Bridge Firewall Linux"

From MS Computech
Jump to: navigation, search
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
Bridge Firewall Linux  
 
Bridge Firewall Linux  
  
−
I'm use this install on debian etch.   
+
ผมใช้วิธีนี้ติดตั้งบน Debian 7 8 9   
−
<pre># apt-get install bridge-utils
+
<pre># apt-get install bridge-utils</pre>
−
# brctl addbr br0
+
Edit Config ใน&nbsp;'''/etc/rc.local'''
−
# brctl addif br0 eth0
+
<pre>
−
# brctl addif br0 eth1
+
nano /etc/rc.local
−
# brctl stp br0 on
+
</pre>
−
# ifconfig eth0 0.0.0.0 up
+
<pre>
−
# ifconfig eth1 0.0.0.0 up
+
# Bridge Interface
−
# ifconfig br0 1.1.1.1 netmask 255.0.0.0 up
 
−
# route add default gw 1.1.1.1</pre>  
 
−
&nbsp;Put all&nbsp;above&nbsp;config in /etc/rc.local  
 
−
 
 
−
&nbsp;Install vuurmuur&nbsp;iptables gui&nbsp;for [http://www.vuurmuur.org/trac/wiki/InstallationDebian Debian&amp;Ubuntu]. Or manual iptables
 
−
 
 
−
&nbsp;This is an example of the basic rules that could be used for either of these setups.
 
−
<pre> iptables -F FORWARD
 
−
iptables -P FORWARD DROP
 
−
iptables -A FORWARD -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP
 
−
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 
−
 
−
# Some funny rules but not in a classic Iptables sorry ...
 
−
# Limit ICMP
 
−
# iptables -A FORWARD -p icmp -m limit --limit 4/s -j ACCEPT
 
−
# Match string, a good simple method to block some VIRUS very quickly
 
−
# iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 -m string --string "cmd.exe"
 
−
 
−
# Block all MySQL connection just to be sure
 
−
iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP
 
−
 
−
# Linux Mail Server Rules
 
−
 
−
# Allow FTP-DATA (20), FTP (21), SSH (22)
 
−
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.27/32 --dport 20:22 -j ACCEPT
 
−
 
−
# Allow the Mail Server to connect to the outside
 
−
# Note: This is *not* needed for the previous connections
 
−
# (remember: stateful filtering) and could be removed.
 
−
iptables -A FORWARD -p tcp -s 62.3.3.27/32 -d 0/0 -j ACCEPT
 
−
 
−
# WWW Server Rules
 
−
 
−
# Allow HTTP ( 80 ) connections with the WWW server
 
−
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 80 -j ACCEPT
 
−
 
−
# Allow HTTPS ( 443 ) connections with the WWW server
 
−
iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 443 -j ACCEPT
 
−
 
−
# Allow the WWW server to go out
 
−
# Note: This is *not* needed for the previous connections
 
−
# (remember: stateful filtering) and could be removed.
 
−
iptables -A FORWARD -p tcp -s 62.3.3.28/32 -d 0/0 -j ACCEPT
 
  
 +
ifconfig eth0 down
 +
ifconfig eth1 down
 +
brctl addbr br0
 +
brctl addif br0 eth0
 +
brctl addif br0 eth1
 +
brctl stp br0 on
 +
ifconfig eth0 0.0.0.0 up
 +
ifconfig eth1 0.0.0.0 up
 +
ifconfig br0 192.168.1.107 netmask 255.255.255.0 up
 +
route add default gw 192.168.1.1
 +
</pre>
  
 +
Enable kernel 4.9 bridge filter หากไม่ทำการโหลดโมดูล Bridge จะเป็นแค่ Layer 2 Switch ไม่สามารถ Filter ข้อมูลได้
 +
<pre>
 +
modprobe br_netfilter
 +
depmod -a
 +
echo 1 > /proc/sys/net/ipv4/ip_forward
 
</pre>
 
</pre>

Latest revision as of 19:27, 16 March 2019

Bridge Firewall Linux

ผมใช้วิธีนี้ติดตั้งบน Debian 7 8 9  

# apt-get install bridge-utils

Edit Config ใน /etc/rc.local 

nano /etc/rc.local

# Bridge Interface

ifconfig eth0 down
ifconfig eth1 down
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
brctl stp br0 on
ifconfig eth0 0.0.0.0 up
ifconfig eth1 0.0.0.0 up
ifconfig br0 192.168.1.107 netmask 255.255.255.0 up
route add default gw 192.168.1.1

Enable kernel 4.9 bridge filter หากไม่ทำการโหลดโมดูล Bridge จะเป็นแค่ Layer 2 Switch ไม่สามารถ Filter ข้อมูลได้ 

modprobe br_netfilter
depmod -a
echo 1 > /proc/sys/net/ipv4/ip_forward
Retrieved from "https://msc.siamtools.com/wiki/index.php?title=Bridge_Firewall_Linux&oldid=1386"