Archives pour la catégorie ‘PF’

Firewall Builder : configuration pour un cluster de firewalls PF

Voici un exemple de fichier de règles firewall, généré avec Firewall Builder, dans le cas d’un cluster de deux firewalls PF sous FreeBSD.

Les règles PF employées couvrent quasiment toutes les fonctionnalités possibles :

  • le filtrage d’accès en IPv4 et IPv6
  • la redondance réseau avec CARP + PFSYNC
  • le filtrage des interfaces virtuelles (VLAN, TUN)
  • le filtrage par balisage des paquets (tagging)
  • la limitation des connexions avec blacklistage automatique
  • le load-balancing des connexions sortantes
  • la gestion de la QoS
  • la gestion FTP pour l’accès interne et externe

A noter que je n’ai pas utilisé la gestion cluster de Firewall Builder ; les règles sont donc dupliquées pour chaque noeud.

Fichier de configuration (format v 5.1) : Faille de sécurité ClamAV CVE-2008-5314 (un téléchargement)

FreeBSD : fichier de règles PF

#
# pf.conf
#

# macros
ext_if = "re0"
int_if = "lo1"

# tables
table  persist {}

# options
set block-policy drop
set skip on lo0
set limit { states 20000, frags 5000, src-nodes 2000 }

# normalization
scrub in all fragment reassemble
scrub all reassemble tcp
scrub in all random-id

#
# redirection
#

nat on $ext_if from !($ext_if) to any -> ($ext_if)

# jail dns
rdr pass on $ext_if proto tcp from any to port 53 -> 172.16.0.1 port 53
rdr pass on $ext_if proto udp from any to port 53 -> 172.16.0.1 port 53
# jail www
rdr pass on $ext_if proto tcp from any to port 80 -> 172.16.0.2 port 80
rdr pass on $ext_if proto tcp from any to port 443 -> 172.16.0.2 port 443
rdr pass on $ext_if proto tcp from any to port 2222 -> 172.16.0.2 port 22

#
# rules
#

block in log
block out log
block quick from
antispoof quick for lo0

pass quick on $int_if

pass out proto tcp all keep state
pass out proto udp all keep state

pass in on $ext_if inet proto icmp from any to any keep state
pass out on $ext_if inet proto icmp from any to any keep state

pass in on $ext_if inet6 proto icmp6 from any to any keep state
pass out on $ext_if inet6 proto icmp6 from any to any keep state

pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep state \
(source-track rule, max-src-conn 4, max-src-conn-rate 4/30, \
overload  flush global)

FreeBSD : redondance réseau CARP et VLAN

Serveur primaire

node1# more /etc/rc.conf
gateway_enable="YES"

network_interfaces="lo0 igb0 igb1 em0"
ifconfig_igb0="up"
ifconfig_igb1="inet 172.16.2.251 netmask 255.255.255.0"
ifconfig_em0="192.168.254.251 netmask 255.255.255.0"
defaultrouter="172.16.2.254"

cloned_interfaces="vlan1 vlan101 vlan102 carp0 carp1 carp2 carp3"
ifconfig_vlan1="inet 192.168.0.251 netmask 255.255.255.0 vlan 1 vlandev igb0"
ifconfig_vlan101="inet 192.168.1.251 netmask 255.255.255.0 vlan 101 vlandev igb0"
ifconfig_vlan102="inet 192.168.2.251 netmask 255.255.255.0 vlan 102 vlandev igb0"
ifconfig_carp0="vhid 1 pass my$ecret 192.168.0.254 netmask 255.255.255.0 advbase 1 advskew 0"
ifconfig_carp1="vhid 2 pass my$ecret 192.168.1.254 netmask 255.255.255.0 advbase 1 advskew 0"
ifconfig_carp2="vhid 3 pass my$ecret 192.168.2.254 netmask 255.255.255.0 advbase 1 advskew 0"
ifconfig_carp3="vhid 4 pass my$ecret 172.16.2.253 netmask 255.255.255.0 advbase 1 advskew 0"

pf_enable="YES"
pf_flags=""
pf_rules="/etc/fw.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pfsync_enable="YES"
pfsync_syncdev="em0"
pfsync_syncpeer="192.168.254.252"
node1# echo net.inet.carp.preempt=1 > /etc/sysctl.conf
node1# sysctl net.inet.carp.preempt=1
node1# ee pf.conf
pass quick on em0 inet proto pfsync from any to any
pass quick on { vlan1 vlan101 vlan102 igb1 } inet proto carp from any to any

Serveur secondaire

node2# more /etc/rc.conf
gateway_enable="YES"

network_interfaces="lo0 igb0 igb1 em0"
ifconfig_igb0="up"
ifconfig_igb1="inet 172.16.2.252 netmask 255.255.255.0"
ifconfig_em0="192.168.254.252 netmask 255.255.255.0"
defaultrouter="172.16.2.254"

cloned_interfaces="vlan1 vlan101 vlan102 carp0 carp1 carp2 carp3"
ifconfig_vlan1="inet 192.168.0.252 netmask 255.255.255.0 vlan 1 vlandev igb0"
ifconfig_vlan101="inet 192.168.1.252 netmask 255.255.255.0 vlan 101 vlandev igb0"
ifconfig_vlan102="inet 192.168.2.252 netmask 255.255.255.0 vlan 102 vlandev igb0"
ifconfig_carp0="vhid 1 pass my$ecret 192.168.0.254 netmask 255.255.255.0 advbase 1 advskew 100"
ifconfig_carp1="vhid 2 pass my$ecret 192.168.1.254 netmask 255.255.255.0 advbase 1 advskew 100"
ifconfig_carp2="vhid 3 pass my$ecret 192.168.2.254 netmask 255.255.255.0 advbase 1 advskew 100"
ifconfig_carp3="vhid 4 pass my$ecret 172.16.2.253 netmask 255.255.255.0 advbase 1 advskew 100"

pf_enable="YES"
pf_flags=""
pf_rules="/etc/fw.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pfsync_enable="YES"
pfsync_syncdev="em0"
pfsync_syncpeer="192.168.254.251"
node2# echo net.inet.carp.preempt=1 > /etc/sysctl.conf
node2# sysctl net.inet.carp.preempt=1
node2# ee pf.conf
pass quick on em0 inet proto pfsync from any to any
pass quick on { vlan1 vlan101 vlan102 igb1 } inet proto carp from any to any

PF : gestion QoS HSFC avec ALTQ

Configuration noyau

# PF SUPPORT
device          pf
device          pfsync
device          pflog
device          carp
options         ALTQ
options         ALTQ_CBQ
options         ALTQ_RED
options         ALTQ_RIO
options         ALTQ_HFSC
options         ALTQ_PRIQ

Configuration ALTQ

altq on igb0 bandwidth 853Kb hfsc queue { net_ack, net_dns, net_ssh, net_web, net_bulk, net_p2p }
queue net_ack bandwidth 30% qlimit 50 hfsc (realtime 20%)
queue net_dns bandwidth 5% qlimit 50 hfsc (realtime 2%)
queue net_ssh bandwidth 20% qlimit 50 hfsc (realtime 20%) { net2_ssh_bulk, net2_ssh_login }
queue net_ssh_bulk bandwidth 50% qlimit 50 hfsc
queue net_ssh_login bandwidth 50% qlimit 50 hfsc
queue net_web bandwidth 20% qlimit 50 hfsc (realtime (20%, 10000, 5%))
queue net_bulk bandwidth 5% qlimit 50 hfsc (realtime 2% default, ecn)
queue net_p2p bandwidth 1% qlimit 50 hfsc (upperlimit 50%)

Régles de filtrage PF

pass out quick on igb0 inet proto tcp from any to any port 53 flags any queue net_dns
pass out quick on igb0 inet proto udp from any to any port 53 queue net_dns
pass out quick on igb0 inet proto tcp from any to any port 22 flags any queue (net_ssh_bulk, net_ssh_login)
pass out quick on igb0 inet proto tcp from any to any port { 80, 443 } flags any queue net_web
pass out quick on igb0 inet proto tcp from any to any flags any queue (net_bulk, net_ack)
pass out quick on igb0 inet proto udp from any to any port 10000 queue net2_p2p

Attention ! L’option queue, à l’inverse de l’option tag, n’est pas sticky . Le choix de la queue s’appuie donc sur la dernière règle validant le paquet. Si cette dernière ne précise aucune queue, la queue par défaut est donc utilisée. Dans le cas d’une QoS sur les flux FTP, il est nécessaire de spécifier la queue à utiliser par ftp-proxy, par le biais de son option -q.

Pour tester et valider toutes vos règles PF et ALTQ, pftop est d’un grand secours.

Haut de page