So why am I publishing my firewall? What's the Big Deal?
Download the tarball. Extract it into a temporary directory so
you don't overwrite any critical files!
mkdir -p /path/to/extract
chdir /path/to/extract
tar xjvf /path/to/custom_firewall.tbz2
If you decide to use this, search EDIT and TUNE in firewall.sh and read all the files in /path/to/extract/etc.
This is a Slackware Linux machine with 2 NICs (Network Interface Cards), one connected to a Motorola cable modem ("WAN facing"), designated IFE meaning "InterFace External", and the other connected to the LAN switch, designated IFI meaning "InterFace Internal". This computer provides a substantial number of services such as an FTP server, HTTP server and SMTP server. Because my internet IP is provided by Time Warner Cable, my WAN/internet IP is not static. This means that security conscious SMTP administrators are going to reject my SMTP server via the use of a "black hole" (RBL) service. If you also have a dynamic IP, don't try to run a mail (SMTP) server.
My kernel has been configured to create modules for iptables. The exception is CONFIG_IP_NF_CONNTRACK=y which configures ip_conntrack into the kernel. This prevents it from being unloaded during a restart of the firewall, which helps prevent disconnections by maintaining the ESTABLISHED state of connections. In addition, my iptables is enhanced to contain extensions. The most important extension for anyone wishing to use my firewall is mport, a clone of multiport but with different syntax.
There are two wireless access points connected to the LAN switch; neither needs WEP/WPA/Etc security, so they are both open and unencrypted.
LAN computers run Linux or Windows. Any LAN computer that wants to access the internet must set the Slackware box as the default gateway. IP addresses of permanently connected computers are assigned statically, but the Slackware box runs a DHCP daemon so that "walk in" users may connect - but with extremely limited access and only after their MAC addresses are added to the DHCP server's list of ethernet addresses.
Using a Linux box rather than a firewall appliance such as SonicWALL is more expensive, but iptables allows an unlimited number of rules where most appliances do not. Neither are any "for a fee" subscription services necessary, and because Linux is free, the customer does not need to purchase any software. So, in the long run, a Linux based firewall plus internet services server is both cheaper and more secure than the alternatives.
The original for this firewall came from malibyte.net.
The configuration for dhcpd (dhcpd.conf) is in the tarball. The important thing is "deny unknown-clients;" because that prevents the daemon from assigning an IP unless the client's MAC is present in dhcpd.conf. This works in conjunction with an access list, which is a file containing the IP address of each computer and a list of the ports each is allowed to use. In short, internet access requres that both the computer's MAC and the IP be manually configured before internet access is granted. In an environment where there are a large number of computers or where the administrator is lazy, this setup is inappropriate. It should also be noted that most of the computers in the LAN have static IPs. That's because machines that obtain an IP dynamically are restricted to ports 53, 80, 110, 123 and 443 which are dns, http, pop3, time and https, respectively. Refer to /etc/services.
You should refer to the ACL file you downloaded in order to facilitate your understanding of the access control used. A computer that will be granted access to this server and to the internet has one or more line entries in a file named ACL. A line is a semicolon delimited list in a strict format so that the firewall script can parse it and create iptables rules from it. Each line must begin with the LAN IP of the workstation, the protocol (tcp or udp), source port list, and either -m mport --dports or --dport. An optional comment may follow, which I use to cross reference the IP to the workstation's name or describe the purpose of the entry.
An example line is
192.168.EDIT.8/31;udp;24664;--dport;1024:65535 # uTorrent
which allows an incoming udp connection on source port 24664 where the
destination port is any high port. This creates an iptables line
iptables -A FORWARD -p udp -i eth0 -o eth1 -s 192.168.EDIT.8/32 --sport 24664 --dport 1024:65535 -j ACCEPT
Note that only the FORWARD chain is involved with access control.
Together with dhcpd.conf, this either allows or disallows the 2 computers with MAC addresses matching IPs ending in .8 or .9 to use uTorrent. If the MAC is present but the ACL record is not, or vice versa, the connection is denied. Only if both are present is the connection allowed. In short, everything that is not specifically allowed is disallowed, but an existing ESTABLISHED connection will probably survive the reloading of the firewall script after you have altered the ACL or dhcpd.conf. See Known Bugs above.