Firewall setup
The iptable rules we used for our two firewalls are detailed here.
Firewall 1 iptable rules
We used the following iptable rules for our back end firewall. This firewall is Firewall 1 seen in Figure 1. It protected access to the WebSphere® Application Server Load Balancer, the Web Server, the WebSphere Application Server Apache Server, and the DB2® UDB database.
DISPLAY IPTABLES:
firewall1:/etc/sysconfig/scripts # ./display-iptables
Chain INPUT (policy DROP 679 packets, 48165 bytes)
pkts bytes target prot opt in out source destination
4 336 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
19981 1856K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 192.168.40.90 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.30.82
Chain FORWARD (policy ACCEPT 51M packets, 25G bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 34760 packets, 36M bytes)
pkts bytes target prot opt in out source destination
4 336 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.40.90
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.30.82
ROUTE:
firewall1:/etc/sysconfig/scripts # route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.10.80.0 * 255.255.255.0 U 0 0 0 eth0
192.168.30.0 * 255.255.255.0 U 0 0 0 eth1
192.168.40.0 * 255.255.255.0 U 0 0 0 eth2
link-local * 255.255.0.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
/PROC/QETH
firewall1:/etc/sysconfig/scripts # cat /proc/qeth
devices CHPID interface cardtype port chksum prio-q'ing rtr4 rtr6 fsz cnt
-------------------------- ----- ---------- -------------- ---- ------ ---------- ---- ---- ----- -----
0.0.1a00/0.0.1a01/0.0.1a02 x0A eth0 OSD_1000 0 sw always_q_2 pri no 64k 16
0.0.6100/0.0.6101/0.0.6102 x00 eth1 GuestLAN QDIO 0 sw always_q_2 no no 64k 16
0.0.6103/0.0.6104/0.0.6105 x01 eth2 GuestLAN QDIO 0 sw always_q_2 no no 64k 16
IPTABLES:
firewall1:/etc/sysconfig/scripts # cat start_iptables-FW1
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
###### INPUT
# to drop everything going into firewall
iptables -P INPUT DROP
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 0/0 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.40.90 -j ACCEPT
iptables -A INPUT -p tcp -d 192.168.30.82 -j ACCEPT
# OUTPUT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p tcp -d 192.168.40.90 -j ACCEPT
iptables -A OUTPUT -p tcp -d 192.168.30.82 -j ACCEPTFirewall 2 iptable rules
We used the following iptable rules for our front end firewall. This firewall is Firewall 2 seen in Figure 1 and provided protection between the client machines and the WebSphere Application Server Caching Proxy Server.
DISPLAY IPTABLES:
firewall2:/etc/sysconfig/scripts # ./display_iptables
Chain INPUT (policy DROP 118 packets, 8376 bytes)
pkts bytes target prot opt in out source destination
3629 334K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:22
23 1932 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2714K 308M ACCEPT tcp -- * * 10.10.60.0/24 192.168.40.9
0 tcp dpt:80
4137K 4210M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 6350 packets, 6606K bytes)
pkts bytes target prot opt in out source destination
23 1932 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
firewall2:/etc/sysconfig/scripts # ./display_iptables
Chain INPUT (policy DROP 118 packets, 8376 bytes)
pkts bytes target prot opt in out source destination
3654 336K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
23 1932 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2714K 308M ACCEPT tcp -- * * 10.10.60.0/24 192.168.40.90 tcp dpt:80
4137K 4210M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 6372 packets, 6609K bytes)
pkts bytes target prot opt in out source destination
23 1932 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
ROUTE:
firewall2:/etc/sysconfig/scripts # route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.10.80.0 * 255.255.255.0 U 0 0 0 eth0
10.10.60.0 * 255.255.255.0 U 0 0 0 eth1
192.168.40.0 * 255.255.255.0 U 0 0 0 eth2
link-local * 255.255.0.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
/PROC/QETH
firewall2:/etc/sysconfig/scripts # cat /proc/qeth
devices CHPID interface cardtype port chksum prio-q'ing rtr4 rtr6 fsz cnt
-------------------------- ----- ---------- -------------- ---- ------ ---------- ---- ---- ----- -----
0.0.1a00/0.0.1a01/0.0.1a02 x0B eth0 OSD_1000 0 sw always_q_2 no no 64k 16
0.0.1b00/0.0.1b01/0.0.1b02 x0B eth1 OSD_1000 0 sw always_q_2 pri no 64k 16
0.0.6103/0.0.6104/0.0.6105 x00 eth2 GuestLAN QDIO 0 sw always_q_2 no no 64k 16
IPTABLES:
firewall2:/etc/sysconfig/scripts # cat start_iptables_FW2
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
#### OUTPUT
iptables -A OUTPUT -p icmp -j ACCEPT
###### INPUT
# to drop everything going into firewall
ipt
ables -P INPUT DROP
# allow ssh
iptables -A INPUT -p tcp --dport 22 -s 0/0 -j ACCEPT
#iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
## FORWARD
iptables -P FORWARD DROP
# iptables -A FORWARD -j LOG --log-prefix "FORWETH1" --log-level alert
#iptables -A FORWARD -p tcp -i eth1 -o eth2 -d 192.168.40.90 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -s 10.10.60.0/24 -d 192.168.40.90 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPTStart iptables at system boot
To load the iptables
ruleset at system reboot, we did the following:
- Using Yast, we disabled SUSEfirewall2 (the name of our firewall)
- Ran the script containing the ruleset to load the iptables.
- Ran the command to export the ruleset
iptables-save > /etc/sysconfig/iptables - Wrote the script to run this ruleset at boot. For example:
#!/bin/bash iptables-restore < /etc/sysconfig/iptables - Changed the permissions of the script (our script name was bootiptables).
For example:
chmod 755 bootiptables - Placed our script in the
/etc/init.d/directory - Enabled the execution of the script at boot by using Yast (Yast modules > System > System services (Runlevel)
- In Expert Mode, we unchecked loading for all rulevels for all entries of the firewall
- For the script, checked the boxes for runlevels B, 3, and 5
- Rebooted your system
- Entered
iptables -L -nvto display the rules.