|By Michael Shinn, Scott R. Shinn||
|February 27, 2005 12:00 AM EST||
Have you ever needed to set up a firewall in a network without anyone knowing it was there or so that it wouldn't require you to change your network? Welcome to the world of stealth firewalling. We dedicated one chapter in our book, Troubleshooting Linux Firewalls, to it but honestly the topic has so many uses, to do it justice it really needs its own book (or books!).
What Is Stealth Firewalling with Linux?Simply put, a stealth firewall is an Ethernet bridge with filtering capabilities. This means that it's a firewall that operates at Layer 2 of the OSI model, leveraging netfilter rules and chains (Linux's firewall system) applied to the bridge. For those not familiar with what a bridge is: an Ethernet bridge is a means of connecting two or more networks/devices at the Data Link layer. The Data Link layer is the layer of the OSI model before the Network Layer (Layer 3). Layer 3 is where things like the IP in TCP/IP come into the picture. This means that a bridge operates before we get into things like protocols, so you can apply firewalling to protocols other than IP (IPX, DECnet, SNA, etc.) and you don't have to worry about routing issues either. You're moving raw frames from one interface to another, which lets you deploy your stealth firewall without anyone being the wiser. Another advantage of a stealth firewall is that if the hardware fails or malfunctions, you can bypass it with nothing more than a network cable.
How Does a Bridge Work?A bridge operates in promiscuous mode, grabbing all the packets it sees on its interfaces, learns which MAC addresses apply to which interfaces, and moves packets between those interfaces. One example of a bridge that many are familiar with is the humble network switch, wherein all the interfaces on a switch comprise one bridge. With Linux, when you create a bridge you are combining two or more interfaces into one bridge. For instance, we'll create a bridge, br0, that is made up of two interfaces, eth0 and eth1. Think of br0 as a set that contains two elements, eth0 and eth1. When the two interfaces are added to the bridge, the kernel will then move packets back and forth automatically between those two interfaces as if they were both part of the same physical network.
A Brief Explanation of Netfilter
Netfilter, if you're not familiar with it, is Linux's packet filtering system introduced in the 2.4 kernel and continued into 2.6. The netfilter system is manipulated by the userspace tool, iptables, and can also be manipulated by other tools. We only point this out because iptables is sometimes thought to be the only mechanism for controlling the kernel's filtering capabilities, but it's not.
Thanks to the flexibility of the netfilter subsystem and the way it handles packets, we can use it to apply firewall rules to network traffic, even if the device is not operating at the IP layer. The subsystem doesn't actually care; it can apply firewall rules to whatever traffic passes through it. To help explain this, Figure 1 shows which netfilter rules are applied to the bridge interface, and the order in which they are applied for traffic flowing from eth0 to eth1 over the bridge.
What This Means in Practical TermsYou can put a firewall in place without anyone knowing it's there or making any IP topology changes. For example, at the California Community Colocation Project (www.communitycolo.net), we used a bridging/stealth firewall to filter out worm traffic entering and exiting the network. This was done in such a way that there was no interruption for the users of the network, no need to change the routing tables or to even muck about with IP issues, and it required only some basic physical wiring changes. The use of a stealthy firewall such as this leads to all sorts of interesting alternative applications outside of just basic firewalling, such as stealth proxies, traffic-shaping devices, anti-spam/virus filtering, and stealth IDS/IPS systems. The key advantage for the firewall administrator is that you can deploy a fairly paranoid firewall setup without having to make any changes to your network, and failing over, as previously mentioned, is as simple as plugging in a patch cable.
How Do I Set One Up?We're using Fedora Core 3 for our demonstration environment, but the following should apply to nearly any modern Linux distribution running a 2.6 kernel. You can also do this with a 2.4 kernel, but for brevity's sake we're going to stick with the screaming edge. It's more fun that way. First, we need to make sure our kernels support both bridging and Layer 2 filtering in netfilter. If you're running FC3 with the default kernel, you can skip this next bit; this is for those of you running custom 2.6 kernels or other distributions that don't include this functionality by default. To enable bridging and Layer 2 filtering, you'll need to make sure the following settings are configured in your kernel to support ebtables.
Device Drivers Networking Support Networking Options ---> <M> 802.1d Ethernet Bridging [*] Network packet filtering (replaces ipchains) ---> [*] Bridged IP/ARP packets filtering Bridge: Netfilter Configuration ---> <M> Ethernet Bridge tables (ebtables) support <M> ebt: broute table support (NEW) <M> ebt: filter table support (NEW) <M> ebt: nat table support (NEW) <M> ebt: 802.3 filter support (NEW) <M> ebt: among filter support (NEW) <M> ebt: ARP filter support (NEW) <M> ebt: IP filter support (NEW) <M> ebt: limit match support (NEW) <M> ebt: mark filter support (NEW) <M> ebt: packet type filter support (NEW) <M> ebt: STP filter support (NEW) <M> ebt: 802.1Q VLAN filter support (NEW) <M> ebt: arp reply target support (NEW) <M> ebt: dnat target support (NEW) <M> ebt: mark target support (NEW) <M> ebt: redirect target support (NEW) <M> ebt: snat target support (NEW) <M> ebt: log support (NEW)
You may also need to install ebtables for your distribution. The userspace ebtables utility and 2.4 kernel patches are available at http://sf.net/projects/ebtables and from our Web site - www.gotroot.com.
Next we need to set up our firewall, in this case it's named Minimoose (kudos to those of you who get this reference), to bridge traffic between our network, 10.10.10.0/24, and our gateway, 10.10.10.1. The goal is to put Minimoose between the network and the gateway device. We start this process by first configuring Minimoose's interfaces to act as a bridge. This is accomplished by using the userspace tool, brctl, to set up the bridged interfaces and to "capture" them. In this hypothetical example, Minimoose has two interfaces. One is pointing at the gateway router, which has an IP address 10.10.10.1 and is reached via ethernet interface eth0. Minimoose's other interface, eth1, is facing the actual 10.10.10.0/24 network. Remember, the bridge does not need any IP addresses. It's going to "bridge" the traffic between these two points, allowing traffic to move from the 10.10.10.0/24 network to the gateway router, 10.10.10.1, and vice versa as defined by the firewall rules on Minimoose. The first step, as already explained, is to set up the interfaces on Minimoose and to configure it as a bridge:
1. Create the logical interface in the kernel, which is called br0.
[root@minimoose root]# brctl addbr br0
2. Add the left interface, eth0, that connects to the 10.10.10.1 gateway.
[root@minimoose root]# brctl addif br0 eth0
3. Add the right interface, eth1, that connects to the 10.10.10.0/24 network.
[root@minimoose root]# brctl addif br0 eth1
4. Activate the bridged interfaces by bringing up the two real interfaces.
[root@minimoose root]# ifconfig eth0 0.0.0.0 promisc up
[root@minimoose root]# ifconfig eth1 0.0.0.0 promisc up
At this point your bridge is working.
As you have probably surmised, Minimoose doesn't even have an IP address for itself. Although it's probably a good idea to add an IP address to one of those interfaces for management reasons, you don't have to in most instances. For example, you could just as easily connect this device to a serial console, or add another interface and run an "Out of Band" network just for admining your stealth firewall, or something like that if you're über paranoid.
Figure 2 shows our network, 10.10.10.0/ 24, before we put our firewall in place.
Now we put our firewall, Minimoose, in place as shown in Figure 3.
With traffic passing from 10.10.10.0/24 to the gateway through Minimoose, it's time to do something interesting with the firewall. Listing 1 provides a simple example script that sets up the firewall rules and configures them to stealthily drop all SMB traffic moving between the gateway and the hosts on the 10.10.10.0/24 network. These rules also allow traffic to move in both directions, not just from the 10.10.10.0/24 network outward, but also from the gateway back into the 10.10.10.0/24 network. This listing will help illustrate the stealthy nature of this configuration; neither the hosts on the 10.10.10/24 network nor the gateway will "see" any changes in the network, except that SMB traffic is not flowing between the two.
In the previous example you can see that applying firewall rules to Layer 3 (IP) traffic works exactly the same as it does with a normal firewall, that is we need to apply those rules to the FORWARD table, and of course make sure you enable ip_forwarding on our firewall for this example to work:
echo 1 > /proc/sys/net/ipv4/ip_forward
Another application of a stealth firewall would be to act as a transparent proxy server. We frequently add squid to our firewalls for performance reasons and this next example shows how to configure the squid Web proxy cache server for your stealth firewall. The good news is that setting this up is easy; the bad news is that it requires adding an IP address to the stealth firewall and, because of this, your firewall will not be as stealthy as you might like, as Web requests will be seen as if they were coming from the bridge's IP address and, of course, your bridge will now have an IP address. Keep in mind, this doesn't mean that other traffic will appear to come from the bridge's IP address or that you need to change any default routes on your network. The stealth firewall will just be seen as another node on your network, not as a router. The steps to set this up are:
1. Install squid and configure squid.conf to allow connections from localhost. This is typically the default configuration for squid. The steps to do this are beyond the scope of this article, but if you are having problems, please visit our Web site for documentation: www.gotroot.com.
2. Add an IP address to your bridge interface, if you haven't already done so. In the commands that follow, replace the variable $MANAGEMENTIP with the IP address you intend to assign to your bridge, and the $MANAGEMENTGATEWAY variable with the gateway address for your network.
ifconfig br0 $MANAGEMENTIP
route add default gw $MANAGEMENTGATEWAY
3. Finally, add the following two rules to your firewall:
iptables -A INPUT -i <internal interface on bridge, such as eth1> -p tcp -d $MANAGEMENTIP -s
10.10.10.0/24 --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t nat -A PREROUTING -i <internal interface on bridge, such as eth1> -s 10.10.10.0/24 -p
tcp --dport 80 -j REDIRECT --to-port 3128
Your stealth firewall is now configured to grab all the port 80 traffic coming from our hypothetical stealth firewall's internal network, 10.10.10.0/24. Redirect it to squid, and then allow squid to request and cache the documents. Again, all Web requests will now come from the bridge's IP address.
Hopefully this brief introduction to stealth firewalls has encouraged you to think up your own ways to use them in your environment. Stealth firewalls are a fantastic and reliable tool for any network or security administrator. They're easy to set up, can be more secure than classic IP firewalls, and because they require no routing and don't have to be integrated into the network's routing scheme, they are actually less of a risk to a network, from a point-of-failure perspective, than a traditional IP firewall.
As we already mentioned, if the stealth firewall fails, just run a patch cable around it. Of course, this eliminates your firewall and we don't want that. The good news is that there's an easy solution to that problem as well, and it allows you to create a fully automatic failover between two or more stealth firewalls. The better news is that this is already built into Linux and is very robust, but that discussion is for another time.
|Michael Shinn 03/16/05 03:00:05 PM EST|
Not sure why the left Figure one out, but here it is from the source link:
# shut down our Ethernet devices
# bring the Ethernet devices back up with no IP addresses
# create our bridge device, and add our Ethernet devices
# add an IP address to the bridge device, this is for management purposes only
# now for our firewall rules
# note that when bridging these rules are applied against
#Allow already established connections and related packets to be forwarded
#Stealthly drop SMB traffic - this is just an example of a protocol you could
$IPTABLES -A FORWARD -p all -sport 135 -j DROP
#Allow all other traffic out from the 10.10.10.0/24 network
#Allow traffic in to the 10.10.10.0/24 networking
|vs 03/06/05 07:40:56 AM EST|
stealth firewall articles are written in may web sites, but
|Eric 03/04/05 11:59:03 AM EST|
To John: I see no link "Source" at the bottom of the article at either this site (linuxworld.com) nor at gootroot's web site. Would you mind pasting the link into your reply?
|baggy 03/01/05 10:18:54 AM EST|
I wish more people knew about this stuff. It really gets on my nerves when people think nat is more secure than IP6 becaue you can do inbound routing properly with IP6.
This article shows that you can still have the equivalent of your NAT box in an IP6 environment, only it's vastly more secure because the firewall box doesn't have an IP address at all and therefore cannot be targetted.
|John 02/24/05 09:44:37 PM EST|
To Eric, I found the example script, Listing 1, at the link "Source" at the bottom of the article (online).
|Eric 02/20/05 05:52:17 PM EST|
Where is Listing 1?????????????????????????
What sucks is that I purchased a copy of the magazine, then found this article on-line with the same freakin error!
SYS-CON Events announced today that Cloudian, Inc., the leading provider of hybrid cloud storage solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cloudian, Inc., is a Foster City, California - based software company specializing in cloud storage software. The main product is Cloudian, an Amazon S3-compliant cloud object storage platform, the bedrock of cloud computing systems, that enables cloud service providers and enterprises to build reliable, affordable and scalable cloud storage solu...
Apr. 27, 2015 01:00 AM EDT Reads: 2,756
SYS-CON Events announced today that Gridstore™, the leader in hyper-converged infrastructure purpose-built to optimize Microsoft workloads, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Gridstore™ is the leader in hyper-converged infrastructure purpose-built for Microsoft workloads and designed to accelerate applications in virtualized environments. Gridstore’s hyper-converged infrastructure is the industry’s first all flash version of HyperConverged Appliances that include both compute and storag...
Apr. 27, 2015 12:45 AM EDT Reads: 4,665
Temasys has announced senior management additions to its team. Joining are David Holloway as Vice President of Commercial and Nadine Yap as Vice President of Product. Over the past 12 months Temasys has doubled in size as it adds new customers and expands the development of its Skylink platform. Skylink leads the charge to move WebRTC, traditionally seen as a desktop, browser based technology, to become a ubiquitous web communications technology on web and mobile, as well as Internet of Things compatible devices.
Apr. 27, 2015 12:45 AM EDT Reads: 2,334
SYS-CON Events announced today that IDenticard will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. IDenticard™ is the security division of Brady Corp (NYSE: BRC), a $1.5 billion manufacturer of identification products. We have small-company values with the strength and stability of a major corporation. IDenticard offers local sales, support and service to our customers across the United States and Canada. Our partner network encompasses some 300 of the world's leading systems integrators and security s...
Apr. 27, 2015 12:00 AM EDT Reads: 5,277
“With easy-to-use SDKs for Atmel’s platforms, IoT developers can now reap the benefits of realtime communication, and bypass the security pitfalls and configuration complexities that put IoT deployments at risk,” said Todd Greene, founder & CEO of PubNub. PubNub will team with Atmel at CES 2015 to launch full SDK support for Atmel’s MCU, MPU, and Wireless SoC platforms. Atmel developers now have access to PubNub’s secure Publish/Subscribe messaging with guaranteed ¼ second latencies across PubNub’s 14 global points-of-presence. PubNub delivers secure communication through firewalls, proxy ser...
Apr. 27, 2015 12:00 AM EDT Reads: 3,883
SYS-CON Events announced today that On the Avenue Marketing Group, a sales and marketing firm that utilizes events to market and sell products to consumers, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. On the Avenue Marketing Group (OTA) is a sales and marketing firm that utilizes events to market and sell products to consumers. On behalf of our clients, we attend thousands of fairs, festivals, expos, concerts, conferences, and sporting events annually, helping them reach millions of individuals ...
Apr. 26, 2015 07:30 PM EDT Reads: 3,507
Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch of Docker's initial release in March of 2013, interest was revved up several notches. Then late last...
Apr. 26, 2015 07:00 PM EDT Reads: 2,892
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Apr. 26, 2015 05:00 PM EDT Reads: 4,492
Health care systems across the globe are under enormous strain, as facilities reach capacity and costs continue to rise. M2M and the Internet of Things have the potential to transform the industry through connected health solutions that can make care more efficient while reducing costs. In fact, Vodafone's annual M2M Barometer Report forecasts M2M applications rising to 57 percent in health care and life sciences by 2016. Lively is one of Vodafone's health care partners, whose solutions enable older adults to live independent lives while staying connected to loved ones. M2M will continue to gr...
Apr. 26, 2015 03:00 PM EDT Reads: 1,535
SYS-CON Media announced today that @WebRTCSummit Blog, the largest WebRTC resource in the world, has been launched. @WebRTCSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. @WebRTCSummit Blog can be bookmarked ▸ Here @WebRTCSummit conference site can be bookmarked ▸ Here
Apr. 26, 2015 03:00 PM EDT Reads: 2,515
SYS-CON Events announced today that Ciqada will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Ciqada™ makes it easy to connect your products to the Internet. By integrating key components - hardware, servers, dashboards, and mobile apps - into an easy-to-use, configurable system, your products can quickly and securely join the internet of things. With remote monitoring, control, and alert messaging capability, you will meet your customers' needs of tomorrow - today! Ciqada. Let your products take flight. For more inform...
Apr. 26, 2015 03:00 PM EDT Reads: 1,934
SYS-CON Events announced today that GENBAND, a leading developer of real time communications software solutions, has been named “Silver Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. The GENBAND team will be on hand to demonstrate their newest product, Kandy. Kandy is a communications Platform-as-a-Service (PaaS) that enables companies to seamlessly integrate more human communications into their Web and mobile applications - creating more engaging experiences for their customers and boosting collaboration and productiv...
Apr. 26, 2015 02:00 PM EDT Reads: 2,752
Dave will share his insights on how Internet of Things for Enterprises are transforming and making more productive and efficient operations and maintenance (O&M) procedures in the cleantech industry and beyond. Speaker Bio: Dave Landa is chief operating officer of Cybozu Corp (kintone US). Based in the San Francisco Bay Area, Dave has been on the forefront of the Cloud revolution driving strategic business development on the executive teams of multiple leading Software as a Services (SaaS) application providers dating back to 2004. Cybozu's kintone.com is a leading global BYOA (Build Your O...
Apr. 26, 2015 02:00 PM EDT Reads: 1,579
The best mobile applications are augmented by dedicated servers, the Internet and Cloud services. Mobile developers should focus on one thing: writing the next socially disruptive viral app. Thanks to the cloud, they can focus on the overall solution, not the underlying plumbing. From iOS to Android and Windows, developers can leverage cloud services to create a common cross-platform backend to persist user settings, app data, broadcast notifications, run jobs, etc. This session provides a high level technical overview of many cloud services available to mobile app developers, includi...
Apr. 26, 2015 02:00 PM EDT Reads: 1,429
SYS-CON Events announced today that BroadSoft, the leading global provider of Unified Communications and Collaboration (UCC) services to operators worldwide, has been named “Gold Sponsor” of SYS-CON's WebRTC Summit, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BroadSoft is the leading provider of software and services that enable mobile, fixed-line and cable service providers to offer Unified Communications over their Internet Protocol networks. The Company’s core communications platform enables the delivery of a range of enterprise and consumer calling...
Apr. 26, 2015 01:30 PM EDT Reads: 2,562
While not quite mainstream yet, WebRTC is starting to gain ground with Carriers, Enterprises and Independent Software Vendors (ISV’s) alike. WebRTC makes it easy for developers to add audio and video communications into their applications by using Web browsers as their platform. But like any market, every customer engagement has unique requirements, as well as constraints. And of course, one size does not fit all. In her session at WebRTC Summit, Dr. Natasha Tamaskar, Vice President, Head of Cloud and Mobile Strategy at GENBAND, will explore what is needed to take a real time communications ...
Apr. 26, 2015 01:00 PM EDT Reads: 1,801
The IoT Bootcamp is coming to Cloud Expo | @ThingsExpo on June 9-10 at the Javits Center in New York. Instructor. Registration is now available at http://iotbootcamp.sys-con.com/ Instructor Janakiram MSV previously taught the famously successful Multi-Cloud Bootcamp at Cloud Expo | @ThingsExpo in November in Santa Clara. Now he is expanding the focus to Janakiram is the founder and CTO of Get Cloud Ready Consulting, a niche Cloud Migration and Cloud Operations firm that recently got acquired by Aditi Technologies. He is a Microsoft Regional Director for Hyderabad, India, and one of the f...
Apr. 26, 2015 12:00 PM EDT Reads: 1,678
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
Apr. 26, 2015 12:00 PM EDT Reads: 2,329
WebRTC is an up-and-coming standard that enables real-time voice and video to be directly embedded into browsers making the browser a primary user interface for communications and collaboration. WebRTC runs in a number of browsers today and is currently supported in over a billion installed browsers globally, across a range of platform OS and devices. Today, organizations that choose to deploy WebRTC applications and use a host machine that supports audio through USB or Bluetooth can use Plantronics products to connect and transit or receive the audio associated with the WebRTC session.
Apr. 26, 2015 12:00 PM EDT Reads: 1,913
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to offer disruptive APIs to developers.
Apr. 26, 2015 12:00 PM EDT Reads: 1,869