FirewallBuilder

There is a special type of interface child object, called the Attached Network object, that represents the networks that are directly attached to the interface. Figure 5.35 shows an example firewall configuration for a firewall with two network interfaces.

Figure 5.35. Example Firewall Configuration

In the example configuration one of the interfaces, eth0, has one IP address and the other interface, eth1, has two IP addresses as shown in Table 5.2.

To create an object that matches the attached networks, select an interface, right-click on the interface and select New Attached Network from the context menu as shown in Figure 5.36.

Figure 5.36. Adding Attached Network Object to Interface eth1

This will create a new child object under the eth1 interface object called linux-1:eth1:attached.

Figure 5.37. Adding Attached Network Object to Interface eth1

If you open the object for editing as shown in Figure 5.38 you will see the list of all networks that are currently attached to the eth1 interface. If you add or delete IP addresses from the interface the Attached Network object will be automatically updated.

Figure 5.38. Adding Attached Network Object to Interface eth1

The Attached Network object can than be used in rules just like any other Network object. Figure 5.39 shows an example of using the Attached Network object from the eth1 interface in a NAT policy rule.

Figure 5.39. Adding Attached Network Object to Interface eth1

Compiling this rule for an iptables firewall results in the output shown below.

echo "Rule 0 (NAT)"
# 
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.10.10.0/24 -j SNAT --to-source 192.0.2.1
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 172.16.0.0/24 -j SNAT --to-source 192.0.2.1

Attached Networks - Cisco ASA/PIX

The Attached Network object on Cisco ASA/PIX firewalls works the same way as it does for iptables firewalls where the Attached Network object will be expanded to include all networks that are associated with the IP address(es) assigned to the interface.

Attached Networks - PF

On PF firewalls the Attached Networks object translates into the "<interface>:network" configuration parameter. For example, if you create an Attached Network object on interface em0, and use that Attached Network object in a rule, the generated configuration will use the em0:network parameter in the generated configuration.