FirewallBuilder

In this section, we'll show how modifying a configlet lets you tailor your generated configuration file.

First, we'll generate a basic firewall policy using the "fw template 1" template. (See the Firewall Object section, Section 5.2.2, for details.)

Then, we'll tell the firewall to always accept SSH connections from the management server at 192.168.1.100. To do this, we select Firewall Settings from the firewall's object editor panel, then enter the management server IP address in the "Always permit ssh access from the management workstation with this address" field.

Figure 13.1. Firewall Settings Dialog (iptables)

We then save and compile the firewall. If we look into the generated .fw file, we see the following:

# ================ Table 'filter', automatic rules
# accept established sessions
$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# backup ssh access
$IPTABLES -A INPUT  -p tcp -m tcp  -s 192.168.1.100/255.255.255.255 \
   --dport 22  -m state --state NEW,ESTABLISHED -j   ACCEPT
$IPTABLES -A OUTPUT  -p tcp -m tcp  -d 192.168.1.100/255.255.255.255 \
   --sport 22  -m state --state ESTABLISHED,RELATED -j ACCEPT
   

Now suppose we want to limit SSH access from the management workstation so that it can only connect to the management interface of the firewall.

First, we copy "/usr/share/fwbuilder-4.0.0/configlets/linux24/automatic_rules" to "$HOME/fwbuilder/configlets/linux24/automatic_rules".

Then, we open our copy of automatic_rules in a text editor and look for this section of the code:

{{if mgmt_access}}
# backup ssh access
{{$begin_rule}} INPUT  -p tcp -m tcp  -s {{$ssh_management_address}} --dport 22  \
        -m state --state NEW,ESTABLISHED -j  ACCEPT {{$end_rule}}
{{$begin_rule}} OUTPUT  -p tcp -m tcp  -d {{$ssh_management_address}} --sport 22 \
        -m state --state ESTABLISHED,RELATED -j ACCEPT {{$end_rule}}
{{endif}}
   

To limit SSH connections to the management interface of the firewall, we modify the configlet as follows:

{{if mgmt_access}}
# backup ssh access
{{$begin_rule}} INPUT -i {{$management_interface}} -p tcp -m tcp \
        -s {{$ssh_management_address}}  --dport 22 \
        -m state --state NEW,ESTABLISHED -j  ACCEPT {{$end_rule}}
{{$begin_rule}} OUTPUT  -o {{$management_interface}} -p tcp -m tcp \
        -d {{$ssh_management_address}}  --sport 22 \
        -m state --state ESTABLISHED,RELATED -j ACCEPT {{$end_rule}}
{{endif}}
   

The variable "{{$management_interface}}" is not used by the original configlet, but it is documented in the comment at the top of the configlet file.

Now we can save the configlet and recompile the firewall. Then, we look at the generated .fw file again.

# ================ Table 'filter', automatic rules
# accept established sessions
$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 
# backup ssh access
$IPTABLES -A INPUT -i eth1 -p tcp -m tcp \
        -s 192.168.1.100/255.255.255.255  --dport 22 \
        -m state --state NEW,ESTABLISHED -j  ACCEPT 
$IPTABLES -A OUTPUT  -o eth1 -p tcp -m tcp \
        -d 192.168.1.100/255.255.255.255  --sport 22 \
        -m state --state ESTABLISHED,RELATED -j ACCEPT
   

As you can see, the rules, instead of being general, now specify eth1.