IP access restriction

[Nigel Wade]

Rick Lim wrote:
> I have a friend that has a few boxes directly on the internet, which he
> thinks are being access by unwanted "visitors".
> 
> These machine still have to have routable IP address but should have limited
> access from external IP subnets.
> 
>  
> 
> What would be suitable for limiting IP subnet access to these address?
> 
> Would a 'firewall' like machine with IPTABLES be able to accomplish this,
> that is without changing the IP address passed through the 'firewallish'
> machine?
> 

What's the network topology? If it's possible to insert a single device in 
the network which carries all traffic then it is possible to add a bridging 
firewall.

You can create bridging firewalls with iptables. We operate one here between 
our subnet and the Uni. router. Building a bridging firewall is pretty 
straight forward.

You need to install the bridge-utils package first. Then create a bridge 
interface with the brctl command, and give it a name (here its called 
nameOfBridgeInterface):

# brctl addbr nameOfBridgeInterface

then you add ethernet cards to the bridge (you can have multiple cards in 
each segment, and the bridging software uses spanning-tree to provide 
redundancy). For 2 cards, eth0 and eth1, with 1 in each segment you would do:

# brctl addif nameOfBridgeInterface eth0
# brctl addif nameOfBridgeInterface eth1

then put the cards in promiscuous mode (they need to accept all packets):

# ifconfig eth0 promisc 0.0.0.0
# ifconfig eth1 promisc 0.0.0.0

then, if you want to be able to connect to the bridge, you create a network 
script for it, /etc/sysconfig/network-scripts/ifcfg-nameOfBridgeInterface

DEVICE=nameOfBridgeInterface
BOOTPROTO=static
BROADCAST=<your-network-broadcast-address>
IPADDR=<bridge-IP>
NETMASK=<your-network-netmask>
NETWORK=<your-network-address>
ONBOOT=yes
TYPE=Ethernet
USERCTL=no
PEERDNS=no

The startup scripts will take care of everything else. Iptables rules can be 
applied to the FORWARD chain for packets traversing the bridge, or to the 
INPUT/OUTPUT chains for packets destined to/from the bridge itself. You can 
also add rules for each card.

You should not have any network initialization on eth0 or eth1, the bridge 
rules above do the necessary work, activating the card in promiscuous mode 
and assigning no IP.

One problem is that most GUIs for iptables assume you are setting up either 
a personal firewall or a NAT firewall. The only GUI I know that even 
acknowledges that a bridging firewall is a possibility is fwbuilder, and you 
still need to check the rules carefully with that as it has a tendency to 
create spurious rules.

-- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    nmw at ion.le.ac.uk
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555