2. Basic configuration - Routing/Firewall |
ROUTE_NETWORK may enable specified external networks access to the own LAN - without masquerading. This may be useful for a connection to a company where an employee of this company shall get access to the own network. Format is identical to the one in MASQ_NETWORK, i.e.ex.
ROUTE_NETWORK='192.168.1.0/24'
It is possible to enter more than one (external) networks here.
ROUTE_NETWORK is an optional variable. In most cases just leave it empty.
If you want to deny access to other networks for some computers you may enter these computers in this list. Routing of IP packets in other networks will then be denied in the firewall for these computers.
Example:
FORWARD_DENY_HOST_N='2' FORWARD_DENY_HOST_1='192.168.6.5' FORWARD_DENY_HOST_2='192.168.6.6'
Deny routing via spec IP ports by using this variable. It - for example - makes sense to forbid routing of NetBios ports 137-139. This means not only denying of routing of IP packets via these ports to remote, but also routing of these ports between two networks (LANs).
When you use more than one network adaptor for several subnets and you want to allow some clients of one subnet to access Windows directories of a client in another subnet, you should not restrict/forbid forwarding of NetBios ports in this case. Here you may enter networks which explicitely allow routing of these ports between them: FORWARD_TRUSTED_NETS
Example: Forbid access to Napster services:
FORWARD_DENY_PORT_N='6' # number FORWARD_DENY_PORT_1='137:139' # NetBios ports 137 to 139 FORWARD_DENY_PORT_2='8888' # Napster port 8888 FORWARD_DENY_PORT_3='7777' # Napster port 7777 FORWARD_DENY_PORT_4='7000' # Napster port 7000 FORWARD_DENY_PORT_5='4444' # Napster port 4444 FORWARD_DENY_PORT_6='4200' # Napster port 4200
From version 1.5.1 there is an additional parameter to the port number. This is:
REJECT - forwarding of IP packet will be rejected DENY - IP packet will be ignored
If this parameter is not set, REJECT method will be used. Example:
FORWARD_DENY_PORT_1='80 DENY' # no surfing today !
Default setting: FORWARD_DENY_PORT_N='1' FORWARD_DENY_PORT_1='137:139'
Disabling of routing with ports entered in FORWARD_DENY_PORT_x may be again disabled (after all: allowed) for spec. networks when using FORWARD_TRUSTED_NETS. Here you may enter networks which you "trust". A typical example for this is routing of NetBios ports between two networks (LANs) which are served by two network adaptors in the FLI4L router itself. If so, you will have to enter all trusted networks; ex.:
FORWARD_TRUSTED_NETS='192.168.1.0/24 192.168.6.0/24'
Firewall ports: in FIREWALL_DENY_PORT_N you will have to enter the number of TCP/IP ports, which shall be disabled for access from remote (i.e. ISDN or DSL) to the FLI4L router. Since FLI4L serves specific services, it makes sense to disable access to them from remote.
This concerns to follwing ports:
port name process ----------------------------------------------------------- 21 ftp ftpd 22 ssh sshd 23 telnet telnetd 37 time [kernel] 53 domain ens 80 www mini_httpd 137:139 netbios smbd (samba) 515 printer lpd 5000 [imond] imond 5001 [telmond] telmond 8000 [proxy] junkbuster
Remark:
A masked LAN (s. above) is always protected against access from remote. Port numbers mentioned in the variables will therefore handle access from remote to the FLI4L router itself.
Ports which shall be denied have to be entered in the single variables FIREWALL_DENY_PORT_1 to FIREWALL_DENY_PORT_n . Combine areas of port numbers by using a colon, ex.: '137:139'
It is (urgently) recommended not to change standard/default configuration of the firewall ports. If you want to enable a spec. service to get access to the internal network via port forwarding, you will have to enable this port explicitely by removing it from this section.
In the sample file you may find all privileged ports from 0 to 1023 as denied, except port number 53. Additionally ports 5000 and 5001 are denied. These both are used by imond and telmond. If you want to use Junkbuster additionally on your router you will have to disable port 8000, too.
Default configuration therefore is:
FIREWALL_DENY_PORT_N='6' FIREWALL_DENY_PORT_1='0:52 REJECT' FIREWALL_DENY_PORT_2='54:112 REJECT' FIREWALL_DENY_PORT_3='114:1023 REJECT' FIREWALL_DENY_PORT_4='5000:5001 REJECT' FIREWALL_DENY_PORT_5='8000 REJECT' FIREWALL_DENY_PORT_6='20012 REJECT'
IMPORTANT:
In all cases it is necessary to enable port 53. If you wonīt do so, internet DNS calls are not available/possible!
If you - for example - want to enable port 21 for FTP from remote because it shall be forwarded to an internal computer by port forwarding, you may do the following:
FIREWALL_DENY_PORT_N='7' # New: 7 instead of 6 entries! FIREWALL_DENY_PORT_1='0:20 REJECT' # disable ports from 0 to 20 FIREWALL_DENY_PORT_2='22:52 REJECT' # disable ports from 22 to 52 FIREWALL_DENY_PORT_3='54:112 REJECT' # disable ports from 54 to 112 FIREWALL_DENY_PORT_4='114:1023 REJECT' # disable ports from 114 to 1023 FIREWALL_DENY_PORT_5='5000:5001 REJECT' # disable imond/telmond ports FIREWALL_DENY_PORT_6='8000 REJECT' # disable HTTP proxy access FIREWALL_DENY_PORT_7='20012 REJECT' # disable VBOX accessHere is a list of usual internet services and their ports:
ftp 21 ssh 22 telnet 23 smtp 25 time 37 domain 53 http 80 pop3 110 auth (ident) 113 syslog 514 printer 515Remember: Only enable these ports, if if you want to enable access to the internal network via port forwarding!
From version 1.5.1 there is an additional parameter to the port number. This is:
REJECT - reject forwarding of IP packet DENY - simply ignore IP packetIf you didnīt use the additional parameter, REJECT method will be used. When using DENY method, the router will be "quiet" when it is called on this port from remote. Using REJECT method will force the router to send an answer (denial) to the other/calling computer. If you want to make your computer "invisible" to prot scanners from the internet, you should use - at least for ports 0:1023 - the DENY method. But DENY may cause problems. Some computers - providing internet services like FTP - for example will send a request to port 113 (auth) as an answer to connection establishing. If FLI4L does not react to these requests, a disconnection may occur.
You may solve this problem by changing default configuration in the following way:
Example:
FIREWALL_DENY_PORT_N='6' FIREWALL_DENY_PORT_1='0:52 DENY' # 53 must stay open for DNS FIREWALL_DENY_PORT_2='54:112 DENY' FIREWALL_DENY_PORT_3='114:1023 DENY' # 113 will be rejected FIREWALL_DENY_PORT_4='5000:5001 DENY' FIREWALL_DENY_PORT_5='8000 DENY' FIREWALL_DENY_PORT_6='20012 DENY'I prefer the REJECT method since it will cause less problems when using different internet protocols; and itīs as secure as DENY method.
For additional information: firewall FAQ
If you want to disable remote access via ICMP protocol, you may set FIREWALL_DENY_ICMP='yes' . After this you wonīt be able to access the router from remote by using "ping".
Default setting: FIREWALL_DENY_ICMP='no'
Using FIREWALL_LOG enables you to write protocols about accesses from remote to your firewall ports. This is done via syslog interface.
Short description of a protocol line:
input Input chain REJECT Packet was rejected ppp0 Device PROTO=6 TCP Packet L Lenght of packet in bytes S Type Of Service (TOS) I IP ID, will be invcremented by 1 with each packet from sender F Flags (3 bits), if packet is fragmented it is offset, 13 bits T TTL (Time To Live), number of hops until packet will be deleted #6 6th rule of packet filter was in action !
Default setting: FIREWALL_LOG='yes'
«« 2. Basic configuration - Masquerading | :: Home :: | 2. Basic configuration - Domain configuration »» |