choke firewall died, can't find firewall script

[Moriah]

My poor choke firewall has finally died. It was working at 8:00 am EDT July 12, 2024, and was no longer working by 10:00 am EDT. It was *VERY* old -- it had either a celeron or a core 2 duo cpu and was running 32 bit linux. Its been a long time since it was rebooted, so when I got physically in front of it, I confirmed it had power, as the pilot light was lit. I tried to reboot it and it powered up (pilot lite lit up), but never entered the boot sequence or the BIOS setup screen. There was nothing on the screen, and no beeps from the BIOS signifying any error codes.

I am very close to moving the entire network to a new building, so I already had a new machine built to replace it, but I was waiting until the move to perform the substitution. I now have the new machine in place, running an i-5 cpu and 64 bit linux. I would be done except I cannot remember where I saved the firewall configuration script. I have backups for this machine on my backup server.

Surely the firewall configuration is saved somewhere on disk so it can re-instantiate itself on reboot. Where is that configuration saved?

Is it possible to examine this file and reconstruct a text version of the configuration? This is a fairly simple firewall. It sits between my DMZ and my LAN, so the workstations on the LAN are masqueraded to the DMZ, and then they are masqueraded again by the gateway firewall, which sits between the DMZ and the internet.

I checked on my backup server, and the version of iptables is the same on the old dead machine and the new replacement one:

[Hu]

The Gentoo init script for iptables normally reads/writes /var/lib/iptables/rules-save. Do you have that file?

You probably do want a nat table, so if it is not working, your new firewall may not be usable until you fix your kernel configuration.

[pietinger]

[Moriah]

@Hu: Yes, I have the saved firewall rules on my backup server, but it doesn't look like anything I can just load, or edit and load.

I think you are right: I need to check my kernel config, as I am likely missing some options relaterd to nat.

@pietinger: I only need the nat so masqueraded machines on the lan can reach the server on the dmz, and they are using the ip address the server presents to the internet at large, and the server is static natted by the gateway firewall, so I translate the internet visible address of the server to the static natted address of the server on the dmz so the workstations can see the web and email servers without having to edit their /etc/hosts file every time a laptop moves from my lan to a remote wifi connection.

Since the natting seems to be the complaint of iptables, I will have to look at the kernel setup as it relates to iptables and nat. I will try to look into this tomorrow, but I am getting sleepy now, so I am going to bed.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.

[Moriah]

OK, I remoived the NAT stuff, but it still doesn't work. My lan is 192.168.1.* and my DMZ is 192.168.2.* and the firewall script is:

[pietinger]

Moriah,

I don't know how much you know about netfiler kernel modules, so please don't be angry if I write something you already know.

The kernel modules are the actual "firewall", the two programs "iptables" or "nftables" are actually only "helper programs" to transfer the rules for these modules to the kernel.

The kernel modules can do two things:

1. filter data packets,
AND
2. change data packets !

The filtering is what is known as a "firewall".

As I see it, you didn't do any filtering with the above script (because you simply allowed everything [1]), but only the modification of data packets ... NAT (network address translation) ...

There are two main ways to do NAT: Source NAT (SNAT) and Destination NAT (DNAT) ... (and of course you can do both IF you need both).

At the moment your script does NOT do the filtering (firewall) nor a NAT ... and is therefore completely worthless.

If you would describe your network in detail (ALL CLIENTS, ALL SERVER, ALL SWITCHES, ALL gateways + routers to your ISP) I could help you.

In general, I can therefore only say what a CLEAN network should look like (=best practice):

There are (mainly) two ways to run a DMZ (for small and medium sized networks; I dont talk about networks with 50.000 stations):

1. with one firewall, or
2. with two firewalls

See: https://en.wikipedia.org/wiki/DMZ_(computing)#Architecture

It is always claimed that the solution with two firewalls is more secure (e.g. because you can choose two different manufacturers).

Quite frankly, that's nonsense ... as long as we are talking about SMALL networks (yes, 100 clients, 10 VLANS in the LAN, and 4 servers in the DMZ IS a small network).

Regardless of whether solution (1) or (2) is used, there are two (three) things that are essential (and apply to both solutions):

A. No station in the LAN can reach the Internet directly. Each station in the LAN can reach only the servers in the DMZ - nothing else!

B. Each server in the DMZ has a personal firewall installed.

(C. All servers, gateways and the admin station have fixed IP addresses; DHCP is only available for the clients in the LAN; an IP address concept is in place. [2])

------

Details for A:

If you are wondering how a client in the LAN is supposed to surf the Internet, the answer is: In the DMZ there is a server on which a web proxy service is running. Yes, each client only gets the exact time from a server in the DMZ (which has an ntpd, for example). The name resolution (DNS) is also done by a server in the DMZ ... and e-mail is also only available from the DMZ ... and everything else too. Period. Off. End of story. Amen.

Details of B:

First of all we should ask why multiple servers in the DMZ ? I could just put in a S/390 and run all services in different VMs. Well, yes, it's safer if I have at least two machines: One machine that is directly accessible from the Internet (web server and e-mail) and a second machine that only provides all services for clients of the LAN (DNS, NTP, proxy). The larger a company is, the more servers are in the DMZ. What happens if a server in the DMZ is compromised? Yes, this server can address any other server of the DMZ directly ... there is no Edge-FW in between ... and that is precisely why a personal firewall is installed on each server itself.

Now we come to the exciting question of how the two "firewalls" should/must be configured:

a) The Core FW allows all clients to access the servers / server services in the DMZ and prohibits everything else.

b) The Edge FW allows incoming traffic to the web server and e-mail server + outgoing traffic from the DMZ servers to various servers on the Internet + outgoing HTTP/HTTPS traffic FROM the proxy to the entire Internet. In addition, this Edge FW must also operate NATting, because we want to connect from a private network (with private IP addresses) to the global internet (with global IP addresses).

c) Each personal firewall only allows inbound traffic for the services it provides. If the server is also running an sshd (so that the admin station can access any server remotely), then one rule of this personal FW is: Allow incoming port 22 only from the admin station.

I have described a simple network with only one firewall here:
https://forums.gentoo.org/viewtopic-t-1114432.html

You might want to read this first:
https://forums.gentoo.org/viewtopic-p-8465650.html#8465650


1)

[Hu]

[Moriah]

I think I'm going to apply a different approach. I also replaced my gateway firewall some time ago, and it is running the same identical hardware as this new choke firewall. I think I am going to copy the .config from that gateway firewall to the choke firewall and rebuild the kernel. I know NAT is working there, along with forwarding, which seems to be an issue withe the choke right now.

Sorry to be so pragmatic, but I really need to get this choke working as quickly as possible.
_________________
The MyWord KJV Bible tool is at http://www.elilabs.com/~myword

Foghorn Leghorn is a Warner Bros. cartoon character.