Firewalls

Table of Contents

1. VirtualBox Configuration
2. Policies
3. Configure and Test Basic Connectivity
4. Implement Source-NAT
5. Implementing Destination-NAT
6. Starting to Filter
7. Assessment

It is recommended that you work in pairs for this lab to make it easier to do testing and troubleshooting. Before doing this lab, you should have completed the Subnetting tutorial for IPv4, as we shall be using the same network design, as shown in Figure 26, “Network Map for this Laboratory”.

You will find it very useful to have read parts of the Vyatta documentation on Firewalling, which should be available in the Lab Resources/Vyatta/Documentation folder.

In this lab, you will make use of the Vyatta firewall to implement several policies suitable for a small network with a few public services. In this network, you will have an external network, an internal LAN and a De-Militarised Zone (DMZ), where your public services are being housed. As already mentioned, this is identical to the network we addressed in the Subnetting tutorial.

Figure 26. Network Map for this Laboratory

Network Map for this Laboratory

The most peculiar thing about the Fake Internet here is the slight-of-hand I’m playing with the default route set on Outside1 and F1. They are in different networks, but there is no routing between them, so I have played a trick whereby the packets are sent directly onto the network, as for a delivery to a machine on the same subnet, rather than forwarding to a router. It is only there to make it possible for me to assign Outside1 and F1 addresses that are very different; so it looks more like the Internet. It also makes for an interesting thought experiment.


1. VirtualBox Configuration

Define the physical topology of your network; you should have learned the skills for this in the previous lab, but here are some reminders.

  • All interfaces will be Internal Network adaptors, not NAT or anything else. Remember that F1 will have three interfaces, so call each switch “LAN”, “DMZ” and “fake_internet” appropriately.

  • Remember to use the init-floppy command inside Vyatta in order to save. If you don’t do this, your changes will only be saved in the filesystem, which is volatile in the LiveCD environment; therefore you will lose your work if you don’t prepare the floppy!