{"id":147,"date":"2005-01-14T20:48:40","date_gmt":"2005-01-14T20:48:40","guid":{"rendered":""},"modified":"2005-01-14T20:48:40","modified_gmt":"2005-01-14T20:48:40","slug":"","status":"publish","type":"post","link":"https:\/\/www.sungate.co.uk\/?p=147","title":{"rendered":"IP Tables"},"content":{"rendered":"

Relating to the VNUML setup mentioned in the previous post, I’ve been tinkering with IP tables<\/a> to write firewall and routing rules for our new network.<\/p>\n

I’ve tried to ‘learn’ IP tables several times, and repeatedly find myself thinking that I’ve got it sussed only to realise that I’ve misunderstood something really critical. I am currently in the “I’ve got this sussed”<\/i> state and hopefully it’s for real this time. One of the ways I managed to simplify my re-introduction to the process was to work with a subset of the IP tables rules. Specifically, if I assume (for the sake of argument) that the firewall will only<\/i> be doing routing, filtering and port forwarding, then I don’t need to worry about the INPUT and OUTPUT rules at all. It’s all basically FORWARD and NAT, which is easier to grasp. Then, I realised that if you’re doing ‘outgoing’ NAT, that’s always a POSTROUTING SNAT rule (i.e. you change the source address after you’ve routed the packet out of your network); if you’re doing incoming port forwarding, it’s always a PREROUTING DNAT rule (since you’re changing the destination of the packets before you route them). I expect I will re-introduce some INPUT and OUTPUT rules soon, so that a very minimal degree of remote admin of the firewall will be possible, e.g. allow SSH access from the IPs of the systems administrators on the local network only.<\/p>\n

If none of this makes sense to you, then don’t let it worry you; you can probably survive in this world without understanding the intricacies of firewall rulesets.<\/p>\n

However, a question does arise as to the best operating system to use for running a ‘home grown’ firewall. I’d choose Debian<\/a> Stable like a shot, but if we plan to actually stop the firewall making its own connections, or hosting any of its own services, even Debian Stable might be more than I really need. If it isn’t ‘allowed’ to contact the internet itself, it won’t be able to download its own security updates (whether it needs them or not is debatable in this situation too, since it isn’t presenting any services). So, to those of you out there who have done this before: What OS have you used for a dedicated home-made firewall?<\/b> I know that a bare OpenBSD<\/a> is well thought of for this job, but are there any Debian-related or Debian-derived setups that you’ve used?<\/p>\n","protected":false},"excerpt":{"rendered":"

Relating to the VNUML setup mentioned in the previous post, I’ve been tinkering with IP tables to write firewall and routing rules for our new network. I’ve tried to ‘learn’ IP tables several times, and repeatedly find myself thinking that I’ve got it sussed only to realise that I’ve misunderstood something really critical. I am… (read more<\/a>)<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-147","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=147"}],"version-history":[{"count":0,"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/147\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sungate.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}