mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-18 09:18:23 +01:00
207 lines
8.8 KiB
Plaintext
207 lines
8.8 KiB
Plaintext
|
|
//=========================================================================\\
|
|
|| Firewall Builder Routing Add-On ||
|
|
|| ||
|
|
|| Copyright (c) 2004 Compal GmbH, Germany ||
|
|
|| Tidei Maurizio, fwbuilder-routing at compal.de ||
|
|
|| ||
|
|
\\=========================================================================//
|
|
|
|
|
|
|
|
Index
|
|
|
|
1 - Requirements
|
|
2 - Features
|
|
3 - Problems
|
|
4 - Future
|
|
|
|
|
|
|
|
(1) Requirements
|
|
================
|
|
|
|
The routing rules composed in the gui can be compiled using the ip
|
|
tables compiler, which now generates "ip route" commands, too. The
|
|
"ip" command is available since Linux 2.2. The other compilers (ipf,
|
|
ipfw, pf and cisco pix) simply ignore the routing rules.
|
|
|
|
If you want to use ECMP routing rules (Equal Cost Multi Path), make
|
|
sure your kernel is compiled with the CONFIG_IP_ROUTE_MULTIPATH
|
|
option.
|
|
|
|
|
|
|
|
(2) Features
|
|
============
|
|
|
|
The GUI's routing add-on offers object based definition of the routing
|
|
rules, exactly the same way as you define policy rules. This enables
|
|
you to use the same objects you already defined to build the firewall
|
|
policy in your routing rules. You won't have to update them
|
|
separately when you change something in your network.
|
|
|
|
In the GUI a routing rule is composed of a Destination, a Gateway, an
|
|
Interface, a Metric and the Comment. The following table shows what
|
|
can be inserted for this elements:
|
|
|
|
| | | | |
|
|
|Destination |Gateway |Interface |Metric |Comment
|
|
------------------------|-------------------------------|---------------|---------------|-------|--------
|
|
What can be inserted? |all Objects under the |- ip-adress |- interface |int |text
|
|
|library's "Objects" section: |- interface | | |
|
|
|- address ranges |- host | | |
|
|
|- addresses | | | |
|
|
|- groups | | | |
|
|
|- hosts | | | |
|
|
|- networks | | | |
|
|
------------------------|-------------------------------|---------------|---------------|-------|--------
|
|
Restrictions |none |Only one |The interface |0-255 |none
|
|
| |interface or |has to be a | |
|
|
| |host with ONE |child of the | |
|
|
| |ip adress can |current fire- | |
|
|
| |be inserted |wall | |
|
|
------------------------|-------------------------------|---------------|---------------|-------|--------
|
|
Default value |"Default" (0.0.0.0/0) |none |none |0 |""
|
|
| | | | |
|
|
|
|
To build a valid routing rule you have to insert at least one of the
|
|
two elements gateway and interface. More than one path can be
|
|
sprecified for one destination.
|
|
|
|
"This approach is called 'Equal-Cost Multi-Path Routing' and is used
|
|
for load balancing (Note that this does not provide failover). With
|
|
ECMP, a router potentially has several available next hops towards any
|
|
given destination. A new gateway is chosen for each new
|
|
source/destination IP pair. This means that, for example, one FTP
|
|
connection will use only one link, but new connection to a different
|
|
server will use another link. This also means that routes to
|
|
often-used sites will always be over the same provider. But on big
|
|
backbones this should distribute traffic fine. Also this has another
|
|
good feature - single connection packets do not get reordered and
|
|
therefore do not kill TCP performance." (The last Paragraph is a
|
|
quotation from
|
|
"http://www.mikrotik.com/Documentation/manual_2.7/IP/Route.html")
|
|
|
|
To create an ECMP rule simply specify several rules with different
|
|
paths, i.e. different combinations of Gateway and Interface, for the
|
|
same Destination and with the same metric.
|
|
|
|
Example:
|
|
|
|
Destination Gateway Interface Metric Comment
|
|
|
|
hostA hostB eth1 0 first possible route
|
|
hostA hostC 0 second possible route
|
|
hostA eth3 0 third possible route
|
|
|
|
If you try to insert a non-valid object in a field, it will be ignored
|
|
and a message box informs you of the mistake.
|
|
|
|
The "Default" route can be specified by inserting a new rule or
|
|
deleting all the destination of an existing rule.
|
|
|
|
Before compiling the rules, they traverse several checks, to make sure
|
|
that only complete, non-ambiguous and non-concurring rules are
|
|
translated into ip commands. Follow the instructions of the compiler
|
|
to correct the errors.
|
|
|
|
If no error was found, the rules are automatically classified in ECMP
|
|
rules and non-ECMP. The ECMP rules are written out in a separated
|
|
section of the firewall script after the "normal" routing rules.
|
|
|
|
|
|
|
|
(3) Problems
|
|
============
|
|
|
|
1.
|
|
Please note that when executing a firewall script all existing
|
|
routing rules previously set by user space processes will be
|
|
deleted.
|
|
|
|
To see which rules will be deleted, you can use the command "ip
|
|
route show". All lines not including "proto kernel" will be deleted
|
|
upon reload of the firewall script.
|
|
|
|
2.
|
|
*** NOTE FOR REDHAT 8.0 ***
|
|
|
|
Redhat seems to reset routing rules explicitly upon system
|
|
startup. Therefore its hard to distinguish interface rules from
|
|
rules setup by the user. On Redhat systems you need to include the
|
|
interface basic routing rules into your fwbuilder routing setup. IF
|
|
YOU DO NOT FOLLOW THIS HINT, YOUR MACHINE WILL FREEZE ANY NETWORK
|
|
TRAFFIC UPON START OF THE FIREWALL SCRIPT. This means e.g. if eth0
|
|
has network 192.168.3.0/24 attached to it, you need to add a route
|
|
with Destination=Network(192.168.3.0/24), Gateway empty and
|
|
Interface=eth0. We encountered this problem on redhat 8.0. Other
|
|
versions and distros might be affected too. Debian sarge and SuSE
|
|
Linux work fine without interface routing rules being included in
|
|
fwbuilders routing rules.
|
|
|
|
3.
|
|
If the firewall script states that the ECMP routes could not be
|
|
installed on your system, make sure your Kernel was compiled with
|
|
the CONFIG_IP_ROUTE_MULTIPATH option or renounce to ECMP rules.
|
|
|
|
4.
|
|
If you have interfaces with a dynamic address or a point-to-point
|
|
address and you try to insert a routing rule for the default
|
|
gateway, compilation might fail, stateing "gateway not reachable".
|
|
Typically this is the case for DSL dialup links. Solution: leave the
|
|
gateway field empty. Just specify the interface.
|
|
|
|
Example:
|
|
|
|
The firewall connects itself to the internet by a DSL link via
|
|
interface ppp0. During dialup pppd configures the default route:
|
|
|
|
default via 62.14.190.33 dev ppp
|
|
|
|
After specifying a routing rule in fwbuilder Destination=default,
|
|
Gateway empty, Interface=ppp0 and running the script on the
|
|
firewall, the route looks like:
|
|
|
|
default dev ppp0 scope link
|
|
|
|
Besides this, the kernel generates another route automaticelly upon
|
|
default gw setup:
|
|
|
|
62.14.190.33 dev ppp0 proto kernel scope link src 191.54.12.143
|
|
|
|
We tested this on Debian/sarge with kernel 2.4.27.
|
|
|
|
Technical explanation:
|
|
|
|
On compilation, fwbuilder checks if gateways are reachable through
|
|
any local network of the firewall. Otherwise setting up routing
|
|
rules will fail on the firewall upon install. In case of
|
|
point-to-point interfaces fwbuilder doesn't know the point-to-point
|
|
address of the interface. Therefore this check fails since for
|
|
fwbuilder it looks like the gateway is not from any local network.
|
|
The only workaround available so far is to leave the gateway empty
|
|
and to specify the interface only. Pakets will find their way to
|
|
the internet anyway, since they are traveling over a point-to-point
|
|
interface.
|
|
|
|
|
|
(4) Future
|
|
==========
|
|
|
|
Ideas, that could be implemented in the future, are:
|
|
|
|
- Multiple customizable routing tables
|
|
|
|
The idea is to add an option to the policy rules enabling the user
|
|
to mark matching packets with a color. For every used color a new
|
|
routing table would have to be built, that will be used only for
|
|
packets marked with the associated color.
|
|
|
|
|
|
- Load balancing
|
|
|
|
Another idea is to integrate more sophisticated load balancing
|
|
options in fwbuilder's GUI.
|
|
|