up vote 0 down vote favorite
1
share [g+] share [fb]

Here is my setup:

All nodes are running Ubuntu 10.04 LTS

I have a machine, node1, that acts as a proxy server for a private network. It forwards all incoming connections on port 80 and 443 to my webserver, node2, which has a private ip of 10.182.33.141 and no public IP.

I have several other nodes: node3 is a database server, node4 is a memcached server, etc. They all have a private IP and no public IP.

I want node1 to act as a firewall as well, while still forwarding ports 80 and 443 to node2.

What is the BEST way to configure node1 to begin acting as a firewall? What are some ways to test said firewall for security?

Any direction is greatly appreciated! I'm sorry if this has been asked before, I did search and did not find what I was looking for.

FOR REFERENCE: (iptables -t nat -L)

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             node1               tcp dpt:www to:10.182.33.141:80 
DNAT       tcp  --  anywhere             node1               tcp dpt:https to:10.182.33.141:443 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere

iptables -L is currently empty.

link|improve this question
0% accept rate
You mean you want to add an public IP address to node1? – ghm1014 Jun 24 '11 at 22:29
What do you mean, "you want node1 to begin acting as a firewall"? It node1 was is the only system with a public ip address then it's already acting as a firewall of sorts by passing traffic on ports 80 and 443 on to your internal systems. What sort of additional behavior do you want? – larsks Jun 25 '11 at 0:25
I want it to deny everything else – ehftwelve Jun 27 '11 at 22:23
feedback

1 Answer

up vote 1 down vote

A few months back, I was trying to establish a similar setup. I eventually abandoned the idea and went back the old, less flexible firewall I had before. I can give you a few pointers, but I can't answer such a broad question readily.

  • Know the difference between masqurading, Source NAT, and Destination NAT.
  • Know what each of the Netfilter tables is for, and which chains are in each
  • Allow all outgoing traffic (if you trust your users)
  • Allow packets of existing connections to continue by using the contrak or state modules
  • DNAT incomming traffic to the servers/ports you want to expose to the world
  • Make sure your firewall (node1) allows packet forwarding: echo >/proc/sys/net/ipv4/ip_forward 1

That's about where I stopped; I had trouble making this box coexist with another machine on our network, which is why I can't say I have a solution.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.