Click here to close now.

Welcome!

Linux Authors: Pat Romanski, Liz McMillan, Carmen Gonzalez, JP Morgenthal, AppDynamics Blog

Related Topics: Linux

Linux: Article

Cover Story: Stealth Firewalling with Linux

Ever Needed to Set Up a Firewall in a Network Without Anyone Knowing It?

Have you ever needed to set up a firewall in a network without anyone knowing it was there or so that it wouldn't require you to change your network? Welcome to the world of stealth firewalling. We dedicated one chapter in our book, Troubleshooting Linux Firewalls, to it but honestly the topic has so many uses, to do it justice it really needs its own book (or books!).

What Is Stealth Firewalling with Linux?

Simply put, a stealth firewall is an Ethernet bridge with filtering capabilities. This means that it's a firewall that operates at Layer 2 of the OSI model, leveraging netfilter rules and chains (Linux's firewall system) applied to the bridge. For those not familiar with what a bridge is: an Ethernet bridge is a means of connecting two or more networks/devices at the Data Link layer. The Data Link layer is the layer of the OSI model before the Network Layer (Layer 3). Layer 3 is where things like the IP in TCP/IP come into the picture. This means that a bridge operates before we get into things like protocols, so you can apply firewalling to protocols other than IP (IPX, DECnet, SNA, etc.) and you don't have to worry about routing issues either. You're moving raw frames from one interface to another, which lets you deploy your stealth firewall without anyone being the wiser. Another advantage of a stealth firewall is that if the hardware fails or malfunctions, you can bypass it with nothing more than a network cable.

How Does a Bridge Work?

A bridge operates in promiscuous mode, grabbing all the packets it sees on its interfaces, learns which MAC addresses apply to which interfaces, and moves packets between those interfaces. One example of a bridge that many are familiar with is the humble network switch, wherein all the interfaces on a switch comprise one bridge. With Linux, when you create a bridge you are combining two or more interfaces into one bridge. For instance, we'll create a bridge, br0, that is made up of two interfaces, eth0 and eth1. Think of br0 as a set that contains two elements, eth0 and eth1. When the two interfaces are added to the bridge, the kernel will then move packets back and forth automatically between those two interfaces as if they were both part of the same physical network.

A Brief Explanation of Netfilter
Netfilter, if you're not familiar with it, is Linux's packet filtering system introduced in the 2.4 kernel and continued into 2.6. The netfilter system is manipulated by the userspace tool, iptables, and can also be manipulated by other tools. We only point this out because iptables is sometimes thought to be the only mechanism for controlling the kernel's filtering capabilities, but it's not.

Thanks to the flexibility of the netfilter subsystem and the way it handles packets, we can use it to apply firewall rules to network traffic, even if the device is not operating at the IP layer. The subsystem doesn't actually care; it can apply firewall rules to whatever traffic passes through it. To help explain this, Figure 1 shows which netfilter rules are applied to the bridge interface, and the order in which they are applied for traffic flowing from eth0 to eth1 over the bridge.

What This Means in Practical Terms

You can put a firewall in place without anyone knowing it's there or making any IP topology changes. For example, at the California Community Colocation Project (www.communitycolo.net), we used a bridging/stealth firewall to filter out worm traffic entering and exiting the network. This was done in such a way that there was no interruption for the users of the network, no need to change the routing tables or to even muck about with IP issues, and it required only some basic physical wiring changes. The use of a stealthy firewall such as this leads to all sorts of interesting alternative applications outside of just basic firewalling, such as stealth proxies, traffic-shaping devices, anti-spam/virus filtering, and stealth IDS/IPS systems. The key advantage for the firewall administrator is that you can deploy a fairly paranoid firewall setup without having to make any changes to your network, and failing over, as previously mentioned, is as simple as plugging in a patch cable.

How Do I Set One Up?

We're using Fedora Core 3 for our demonstration environment, but the following should apply to nearly any modern Linux distribution running a 2.6 kernel. You can also do this with a 2.4 kernel, but for brevity's sake we're going to stick with the screaming edge. It's more fun that way. First, we need to make sure our kernels support both bridging and Layer 2 filtering in netfilter. If you're running FC3 with the default kernel, you can skip this next bit; this is for those of you running custom 2.6 kernels or other distributions that don't include this functionality by default. To enable bridging and Layer 2 filtering, you'll need to make sure the following settings are configured in your kernel to support ebtables.


Device Drivers
  Networking Support
    Networking Options --->
      <M> 802.1d Ethernet Bridging
      [*] Network packet filtering (replaces ipchains)  --->
        [*]   Bridged IP/ARP packets filtering
        Bridge: Netfilter Configuration  --->
          <M> Ethernet Bridge tables (ebtables) support
            <M>   ebt: broute table support (NEW)
            <M>   ebt: filter table support (NEW)
            <M>   ebt: nat table support (NEW)
            <M>   ebt: 802.3 filter support (NEW)
            <M>   ebt: among filter support (NEW)
            <M>   ebt: ARP filter support (NEW)
            <M>   ebt: IP filter support (NEW)
            <M>   ebt: limit match support (NEW)
            <M>   ebt: mark filter support (NEW)
            <M>   ebt: packet type filter support (NEW)
            <M>   ebt: STP filter support (NEW)
            <M>   ebt: 802.1Q VLAN filter support (NEW)
            <M>   ebt: arp reply target support (NEW)
            <M>   ebt: dnat target support (NEW)
            <M>   ebt: mark target support (NEW)
            <M>   ebt: redirect target support (NEW)
            <M>   ebt: snat target support (NEW)
            <M>   ebt: log support (NEW)

You may also need to install ebtables for your distribution. The userspace ebtables utility and 2.4 kernel patches are available at http://sf.net/projects/ebtables and from our Web site - www.gotroot.com.

Next we need to set up our firewall, in this case it's named Minimoose (kudos to those of you who get this reference), to bridge traffic between our network, 10.10.10.0/24, and our gateway, 10.10.10.1. The goal is to put Minimoose between the network and the gateway device. We start this process by first configuring Minimoose's interfaces to act as a bridge. This is accomplished by using the userspace tool, brctl, to set up the bridged interfaces and to "capture" them. In this hypothetical example, Minimoose has two interfaces. One is pointing at the gateway router, which has an IP address 10.10.10.1 and is reached via ethernet interface eth0. Minimoose's other interface, eth1, is facing the actual 10.10.10.0/24 network. Remember, the bridge does not need any IP addresses. It's going to "bridge" the traffic between these two points, allowing traffic to move from the 10.10.10.0/24 network to the gateway router, 10.10.10.1, and vice versa as defined by the firewall rules on Minimoose. The first step, as already explained, is to set up the interfaces on Minimoose and to configure it as a bridge:

1.  Create the logical interface in the kernel, which is called br0.

[root@minimoose root]# brctl addbr br0

2.  Add the left interface, eth0, that connects to the 10.10.10.1 gateway.

[root@minimoose root]# brctl addif br0 eth0

3.  Add the right interface, eth1, that connects to the 10.10.10.0/24 network.

[root@minimoose root]# brctl addif br0 eth1

4.  Activate the bridged interfaces by bringing up the two real interfaces.

[root@minimoose root]# ifconfig eth0 0.0.0.0 promisc up
[root@minimoose root]# ifconfig eth1 0.0.0.0 promisc up

At this point your bridge is working.

As you have probably surmised, Minimoose doesn't even have an IP address for itself. Although it's probably a good idea to add an IP address to one of those interfaces for management reasons, you don't have to in most instances. For example, you could just as easily connect this device to a serial console, or add another interface and run an "Out of Band" network just for admining your stealth firewall, or something like that if you're über paranoid.

Figure 2 shows our network, 10.10.10.0/ 24, before we put our firewall in place.

Now we put our firewall, Minimoose, in place as shown in Figure 3.

With traffic passing from 10.10.10.0/24 to the gateway through Minimoose, it's time to do something interesting with the firewall. Listing 1 provides a simple example script that sets up the firewall rules and configures them to stealthily drop all SMB traffic moving between the gateway and the hosts on the 10.10.10.0/24 network. These rules also allow traffic to move in both directions, not just from the 10.10.10.0/24 network outward, but also from the gateway back into the 10.10.10.0/24 network. This listing will help illustrate the stealthy nature of this configuration; neither the hosts on the 10.10.10/24 network nor the gateway will "see" any changes in the network, except that SMB traffic is not flowing between the two.

In the previous example you can see that applying firewall rules to Layer 3 (IP) traffic works exactly the same as it does with a normal firewall, that is we need to apply those rules to the FORWARD table, and of course make sure you enable ip_forwarding on our firewall for this example to work:

echo 1 > /proc/sys/net/ipv4/ip_forward

Another application of a stealth firewall would be to act as a transparent proxy server. We frequently add squid to our firewalls for performance reasons and this next example shows how to configure the squid Web proxy cache server for your stealth firewall. The good news is that setting this up is easy; the bad news is that it requires adding an IP address to the stealth firewall and, because of this, your firewall will not be as stealthy as you might like, as Web requests will be seen as if they were coming from the bridge's IP address and, of course, your bridge will now have an IP address. Keep in mind, this doesn't mean that other traffic will appear to come from the bridge's IP address or that you need to change any default routes on your network. The stealth firewall will just be seen as another node on your network, not as a router. The steps to set this up are:

1.  Install squid and configure squid.conf to allow connections from localhost. This is typically the default configuration for squid. The steps to do this are beyond the scope of this article, but if you are having problems, please visit our Web site for documentation: www.gotroot.com.

2.  Add an IP address to your bridge interface, if you haven't already done so. In the commands that follow, replace the variable $MANAGEMENTIP with the IP address you intend to assign to your bridge, and the $MANAGEMENTGATEWAY variable with the gateway address for your network.

ifconfig br0 $MANAGEMENTIP
route add default gw $MANAGEMENTGATEWAY

3.  Finally, add the following two rules to your firewall:

iptables -A INPUT -i <internal interface on bridge, such as eth1> -p tcp -d $MANAGEMENTIP -s
10.10.10.0/24 --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -t nat -A PREROUTING -i <internal interface on bridge, such as eth1> -s 10.10.10.0/24 -p
tcp --dport 80 -j REDIRECT --to-port 3128

Your stealth firewall is now configured to grab all the port 80 traffic coming from our hypothetical stealth firewall's internal network, 10.10.10.0/24. Redirect it to squid, and then allow squid to request and cache the documents. Again, all Web requests will now come from the bridge's IP address.

Hopefully this brief introduction to stealth firewalls has encouraged you to think up your own ways to use them in your environment. Stealth firewalls are a fantastic and reliable tool for any network or security administrator. They're easy to set up, can be more secure than classic IP firewalls, and because they require no routing and don't have to be integrated into the network's routing scheme, they are actually less of a risk to a network, from a point-of-failure perspective, than a traditional IP firewall.

As we already mentioned, if the stealth firewall fails, just run a patch cable around it. Of course, this eliminates your firewall and we don't want that. The good news is that there's an easy solution to that problem as well, and it allows you to create a fully automatic failover between two or more stealth firewalls. The better news is that this is already built into Linux and is very robust, but that discussion is for another time.

More Stories By Michael Shinn

Michael is the Managing Partner for the Prometheus Group
(http://www.progllc.com), an Information Technology Services and Products firm specializing in securing and managing IT for their government and commercial customers. Previous to founding the Prometheus Group, he co-founded Plesk, Inc. which makes server management software designed to simplify the full range of user and
administrator management and configuration tasks. Michael also worked for Cisco Systems, the Wheelgroup Corporation and The White House.

More Stories By Scott R. Shinn

Scott Shinn co-founded Plesk, a server management firm. He was formerly a senior network security engineer specializing in penetration testing for Fortune 50 clients at Wheelgroup, a firm later acquired by Cisco.

Comments (6) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Michael Shinn 03/16/05 03:00:05 PM EST

Not sure why the left Figure one out, but here it is from the source link:

Listing 1
#!/bin/bash

IPTABLES=/sbin/iptables
IFCONFIG=/sbin/ifconfig
BRCTL=/usr/sbin/brctl
ROUTE=/sbin/route

MANAGEMENTIP=10.10.10.51
MANAGEMENTGATEWAY=10.10.10.1

# shut down our Ethernet devices
$IFCONFIG eth0 down
$IFCONFIG eth1 down

# bring the Ethernet devices back up with no IP addresses
$IFCONFIG eth0 up 0.0.0.0
$IFCONFIG eth1 up 0.0.0.0

# create our bridge device, and add our Ethernet devices
$BRCTL addbr br0
$BRCTL addif br0 eth0
$BRCTL addif br0 eth1

# add an IP address to the bridge device, this is for management purposes only
$IFCONFIG br0 $MANAGEMENTIP
$ROUTE add default gw $MANAGEMENTGATEWAY

# now for our firewall rules

# note that when bridging these rules are applied against
# the FORWARD chain

#Allow already established connections and related packets to be forwarded
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#Stealthly drop SMB traffic - this is just an example of a protocol you could
#drop.

$IPTABLES -A FORWARD -p all -sport 135 -j DROP
$IPTABLES -A FORWARD -p all -dport 135 -j DROP
$IPTABLES -A FORWARD -p all -sport 137 -j DROP
$IPTABLES -A FORWARD -p all -dport 137 -j DROP
$IPTABLES -A FORWARD -p all -sport 138 -j DROP
$IPTABLES -A FORWARD -p all -dport 138 -j DROP
$IPTABLES -A FORWARD -p all -sport 139 -j DROP
$IPTABLES -A FORWARD -p all -dport 139 -j DROP

#Allow all other traffic out from the 10.10.10.0/24 network
$IPTABLES -A FORWARD -i eth1 -o eth0 -s 10.10.10.0/24 -m state -state NEW -j ACCEPT

#Allow traffic in to the 10.10.10.0/24 networking
$IPTABLES -A FORWARD -i eth0 -o eth1 -d 10.10.10.0/24 -m state -state NEW -j ACCEPT

vs 03/06/05 07:40:56 AM EST

stealth firewall articles are written in may web sites, but
failover stealth-firewall isn't written, like this !

Eric 03/04/05 11:59:03 AM EST

To John: I see no link "Source" at the bottom of the article at either this site (linuxworld.com) nor at gootroot's web site. Would you mind pasting the link into your reply?

baggy 03/01/05 10:18:54 AM EST

I wish more people knew about this stuff. It really gets on my nerves when people think nat is more secure than IP6 becaue you can do inbound routing properly with IP6.

This article shows that you can still have the equivalent of your NAT box in an IP6 environment, only it's vastly more secure because the firewall box doesn't have an IP address at all and therefore cannot be targetted.

John 02/24/05 09:44:37 PM EST

To Eric, I found the example script, Listing 1, at the link "Source" at the bottom of the article (online).

Eric 02/20/05 05:52:17 PM EST

Where is:
"Listing 1 provides a simple example script that sets up the firewall rules and configures them to stealthily drop all SMB traffic moving between the gateway and the hosts on the 10.10.10.0/24 network."

Where is Listing 1?????????????????????????

What sucks is that I purchased a copy of the magazine, then found this article on-line with the same freakin error!

@ThingsExpo Stories
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
There's no doubt that the Internet of Things is driving the next wave of innovation. Google has spent billions over the past few months vacuuming up companies that specialize in smart appliances and machine learning. Already, Philips light bulbs, Audi automobiles, and Samsung washers and dryers can communicate with and be controlled from mobile devices. To take advantage of the opportunities the Internet of Things brings to your business, you'll want to start preparing now.
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal an...
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at @ThingsExpo, Robin Raymond, Chief Architect at Hookflash, will walk through the shifting landscape of traditional telephone and voice services ...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at Internet of @ThingsExpo, James Kirkland, Chief Architect for the Internet of Things and Intelligent Systems at Red Hat, described how to revolutioniz...
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo, June 9-11, 2015, at the Javits Center in New York City. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be
The security devil is always in the details of the attack: the ones you've endured, the ones you prepare yourself to fend off, and the ones that, you fear, will catch you completely unaware and defenseless. The Internet of Things (IoT) is nothing if not an endless proliferation of details. It's the vision of a world in which continuous Internet connectivity and addressability is embedded into a growing range of human artifacts, into the natural world, and even into our smartphones, appliances, and physical persons. In the IoT vision, every new "thing" - sensor, actuator, data source, data con...
Container frameworks, such as Docker, provide a variety of benefits, including density of deployment across infrastructure, convenience for application developers to push updates with low operational hand-holding, and a fairly well-defined deployment workflow that can be orchestrated. Container frameworks also enable a DevOps approach to application development by cleanly separating concerns between operations and development teams. But running multi-container, multi-server apps with containers is very hard. You have to learn five new and different technologies and best practices (libswarm, sy...
SYS-CON Events announced today that DragonGlass, an enterprise search platform, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. After eleven years of designing and building custom applications, OpenCrowd has launched DragonGlass, a cloud-based platform that enables the development of search-based applications. These are a new breed of applications that utilize a search index as their backbone for data retrieval. They can easily adapt to new data sets and provide access to both structured and unstruc...
There's Big Data, then there's really Big Data from the Internet of Things. IoT is evolving to include many data possibilities like new types of event, log and network data. The volumes are enormous, generating tens of billions of logs per day, which raise data challenges. Early IoT deployments are relying heavily on both the cloud and managed service providers to navigate these challenges. In her session at Big Data Expo®, Hannah Smalltree, Director at Treasure Data, discussed how IoT, Big Data and deployments are processing massive data volumes from wearables, utilities and other machines...
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud environment, and we must architect and code accordingly. At the very least, you'll have no problem fil...
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
The worldwide cellular network will be the backbone of the future IoT, and the telecom industry is clamoring to get on board as more than just a data pipe. In his session at @ThingsExpo, Evan McGee, CTO of Ring Plus, Inc., discussed what service operators can offer that would benefit IoT entrepreneurs, inventors, and consumers. Evan McGee is the CTO of RingPlus, a leading innovative U.S. MVNO and wireless enabler. His focus is on combining web technologies with traditional telecom to create a new breed of unified communication that is easily accessible to the general consumer. With over a de...
Disruptive macro trends in technology are impacting and dramatically changing the "art of the possible" relative to supply chain management practices through the innovative use of IoT, cloud, machine learning and Big Data to enable connected ecosystems of engagement. Enterprise informatics can now move beyond point solutions that merely monitor the past and implement integrated enterprise fabrics that enable end-to-end supply chain visibility to improve customer service delivery and optimize supplier management. Learn about enterprise architecture strategies for designing connected systems tha...
Cloud is not a commodity. And no matter what you call it, computing doesn’t come out of the sky. It comes from physical hardware inside brick and mortar facilities connected by hundreds of miles of networking cable. And no two clouds are built the same way. SoftLayer gives you the highest performing cloud infrastructure available. One platform that takes data centers around the world that are full of the widest range of cloud computing options, and then integrates and automates everything. Join SoftLayer on June 9 at 16th Cloud Expo to learn about IBM Cloud's SoftLayer platform, explore se...
SYS-CON Media announced today that 9 out of 10 " most read" DevOps articles are published by @DevOpsSummit Blog. Launched in October 2014, @DevOpsSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce softw...
15th Cloud Expo, which took place Nov. 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA, expanded the conference content of @ThingsExpo, Big Data Expo, and DevOps Summit to include two developer events. IBM held a Bluemix Developer Playground on November 5 and ElasticBox held a Hackathon on November 6. Both events took place on the expo floor. The Bluemix Developer Playground, for developers of all levels, highlighted the ease of use of Bluemix, its services and functionality and provide short-term introductory projects that developers can complete between sessions.
From telemedicine to smart cars, digital homes and industrial monitoring, the explosive growth of IoT has created exciting new business opportunities for real time calls and messaging. In his session at @ThingsExpo, Ivelin Ivanov, CEO and Co-Founder of Telestax, shared some of the new revenue sources that IoT created for Restcomm – the open source telephony platform from Telestax. Ivelin Ivanov is a technology entrepreneur who founded Mobicents, an Open Source VoIP Platform, to help create, deploy, and manage applications integrating voice, video and data. He is the co-founder of TeleStax, a...
The Internet of Things (IoT) promises to evolve the way the world does business; however, understanding how to apply it to your company can be a mystery. Most people struggle with understanding the potential business uses or tend to get caught up in the technology, resulting in solutions that fail to meet even minimum business goals. In his session at @ThingsExpo, Jesse Shiah, CEO / President / Co-Founder of AgilePoint Inc., showed what is needed to leverage the IoT to transform your business. He discussed opportunities and challenges ahead for the IoT from a market and technical point of vie...