Vuurmuur - iptables manager

Victor Julien

July 7, 2014

Victor Julien Vuurmuur - iptables manager July 7, 2014 1 / 23

About me

Vuurmuur’founder’ and lead developer of Vuurmuur

Open SourceSuricata IDS/IPSModSecurity, libhtp, modsec2sguil, sguil, snort_inline

Contact@inliniachttp://blog.inliniac.net/

Victor Julien Vuurmuur - iptables manager July 7, 2014 2 / 23

iptables

Powerful, but complexPacket processing happens in several tables: mangle, filter, nat,rawDefault chains: INPUT, OUTPUT, FORWARD and several othersAlso, define your own chainsDon’t get me started on traffic shaping

Victor Julien Vuurmuur - iptables manager July 7, 2014 3 / 23

Rule Example

Example of a rule:

i p t a b l e s − t f i l t e r −A FORWARD − i eth1 −o ppp0 \−p tcp −m tcp −−syn \−s 192.168.0.33/255.255.255.255 −−spor t 1024:65535 \−d 0 . 0 . 0 . 0 / 0 . 0 . 0 . 0 −−dpor t 4070 \−m l i m i t −− l i m i t 5 / sec −− l i m i t −burs t 10 \−m conntrack −−c t s t a t e NEW \− j NFLOG −−nf log−p r e f i x "ACCEPT " −−nf log−group 9

Rather complex, right?

Victor Julien Vuurmuur - iptables manager July 7, 2014 4 / 23

Vuurmuur

Started in 2002 as a project to learn programmingBorn out of frustration with managing iptables scriptsMature, free-time projectTherefore, slow moving project :)

Victor Julien Vuurmuur - iptables manager July 7, 2014 5 / 23

Vuurmuur

GoalAllow users to easily setup and manage a secure andefficient firewall, without needing iptables specific knowledge.

Victor Julien Vuurmuur - iptables manager July 7, 2014 6 / 23

Vuurmuur

FeaturesNcurses GUI – manage over SSHTarget is gateway firewallsLog viewer, connection viewerEasy way to setup NAT, portforwardingNFQUEUE support for integrating with Suricata IPSBasic traffic shaping and prioritization supportBasic IPv6 supportKeeps an ’audit log’ of all changes

Victor Julien Vuurmuur - iptables manager July 7, 2014 7 / 23

Ncurses

Victor Julien Vuurmuur - iptables manager July 7, 2014 8 / 23

Vuurmuur

ConceptsOne or more ’zones’: in/out, lan/wan, red/greenWithin each zone: one or more networksWithin each network: one or more hosts (optional)Interface mapping with local interfacesInterfaces are connected to a networkServices define protocols and ports

Victor Julien Vuurmuur - iptables manager July 7, 2014 9 / 23

Concepts

Victor Julien Vuurmuur - iptables manager July 7, 2014 10 / 23

Rules

Rule Exampleaccept service http from local.lan to worldsnat service http from local.lan to world

About the namesZone names have a fixed structure"local.lan" means: zone "lan" and within that network "local"In "server.local.lan", "server" is the hostThis way it’s always clear what part of your network a rule appliesto

Victor Julien Vuurmuur - iptables manager July 7, 2014 11 / 23

Rules

Port forwarding rule Exampleportfw service ssh from world to myserver.servers.dmz

Port forwarding rule example, with NFQUEUEnfqueue service smtp from world to mailserver.servers.dmzdnat service smtp from world to mailserver.servers.dmz

Victor Julien Vuurmuur - iptables manager July 7, 2014 12 / 23

Rules

Victor Julien Vuurmuur - iptables manager July 7, 2014 13 / 23

Rules

Traffic Shaping Rule Example

accept se rv i ce any from voip . l o c a l . lan to wor ld . i n e t \op t ions log , l o g l i m i t = " 1 " , \in_min=" 50kbps " , out_min=" 50kbps " , p r i o = " 1 "

Victor Julien Vuurmuur - iptables manager July 7, 2014 14 / 23

Vuurmuur

How it worksRead rules, zones, etcTurn into iptables and ’tc’ rulesetsFeeds ruleset to iptables-restoreEnable/disable ip forwarding if necessaryHelpful command: vuuurmuur -b (bash out)

Victor Julien Vuurmuur - iptables manager July 7, 2014 15 / 23

Log Viewer

Victor Julien Vuurmuur - iptables manager July 7, 2014 16 / 23

Connection Viewer

Victor Julien Vuurmuur - iptables manager July 7, 2014 17 / 23

Applying Changes

Victor Julien Vuurmuur - iptables manager July 7, 2014 18 / 23

Ulogd2

Vuurmuur to JSON logging

stack=log1 :NFLOG, base1 :BASE, i f i 1 : IFINDEX , \i p 2 s t r 1 : IP2STR , mac2str1 :HWHDR, json1 :JSON

[ log1 ]group=9[ json1 ]sync=1f i l e = " / var / log / ulogd . json "

Victor Julien Vuurmuur - iptables manager July 7, 2014 19 / 23

Ulogd2

PCAP Logging

stack=log2 :NFLOG, base1 :BASE, pcap1 :PCAP[ log2 ]group=7[ pcap1 ]f i l e = " / var / log / vuurmuur . pcap "sync=1

Victor Julien Vuurmuur - iptables manager July 7, 2014 20 / 23

Coming Soon

In DevelopmentNFLOG / IDS target: support Suricata’s NFLOG input (git master)Use Ulogd2 to replace vuurmuur_log

Victor Julien Vuurmuur - iptables manager July 7, 2014 21 / 23

Coming soon?

Future WorkNftables supportipset supportSYNPROXYReal GUI?Web GUI?

Victor Julien Vuurmuur - iptables manager July 7, 2014 22 / 23

Finally

Get Involved!Open Source: GPLv2+http://www.vuurmuur.org/#vuurmuur on freenodehttps://github.com/inliniac/vuurmuur

Victor Julien Vuurmuur - iptables manager July 7, 2014 23 / 23