0

Here is my setup:

All nodes are running Ubuntu 10.04 LTS

I have a machine, node1, that acts as a proxy server for a private network. It forwards all incoming connections on port 80 and 443 to my webserver, node2, which has a private ip of 10.182.33.141 and no public IP.

I have several other nodes: node3 is a database server, node4 is a memcached server, etc. They all have a private IP and no public IP.

I want node1 to act as a firewall as well, while still forwarding ports 80 and 443 to node2.

What is the BEST way to configure node1 to begin acting as a firewall? What are some ways to test said firewall for security?

Any direction is greatly appreciated! I'm sorry if this has been asked before, I did search and did not find what I was looking for.

FOR REFERENCE: (iptables -t nat -L)

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             node1               tcp dpt:www to:10.182.33.141:80 
DNAT       tcp  --  anywhere             node1               tcp dpt:https to:10.182.33.141:443 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere

iptables -L is currently empty.

Improve this question
3
  • You mean you want to add an public IP address to node1?
    – ghm1014
    Jun 24, 2011 at 22:29
  • What do you mean, "you want node1 to begin acting as a firewall"? It node1 was is the only system with a public ip address then it's already acting as a firewall of sorts by passing traffic on ports 80 and 443 on to your internal systems. What sort of additional behavior do you want?
    – larsks
    Jun 25, 2011 at 0:25
  • I want it to deny everything else
    – ehftwelve
    Jun 27, 2011 at 22:23

1 Answer 1

Reset to default
1

A few months back, I was trying to establish a similar setup. I eventually abandoned the idea and went back the old, less flexible firewall I had before. I can give you a few pointers, but I can't answer such a broad question readily.

  • Know the difference between masqurading, Source NAT, and Destination NAT.
  • Know what each of the Netfilter tables is for, and which chains are in each
  • Allow all outgoing traffic (if you trust your users)
  • Allow packets of existing connections to continue by using the contrak or state modules
  • DNAT incomming traffic to the servers/ports you want to expose to the world
  • Make sure your firewall (node1) allows packet forwarding: echo >/proc/sys/net/ipv4/ip_forward 1

That's about where I stopped; I had trouble making this box coexist with another machine on our network, which is why I can't say I have a solution.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.