fli4l documentation - Configuration

2. Basic configuration - Routing/Firewall

##### :::[ ROUTE_NETWORK ]:::
:::[ FORWARD_DENY_HOST_N ; FORWARD_DENY_HOST_x ][ FORWARD_DENY_PORT_N ; FORWARD_DENY_PORT_x ][ TRUSTED_NETS ]:::
:::[ FIREWALL_DENY_PORT_N ][ FIREWALL_DENY_PORT_x ][ FIREWALL_DENY_ICMP ][ FIREWALL_LOG ]:::

#### ROUTE_NETWORK

ROUTE_NETWORK may enable specified external networks access to the own LAN - without masquerading. This may be useful for a connection to a company where an employee of this company shall get access to the own network. Format is identical to the one in MASQ_NETWORK, i.e.ex.

    ROUTE_NETWORK='192.168.1.0/24'

It is possible to enter more than one (external) networks here.

ROUTE_NETWORK is an optional variable. In most cases just leave it empty.

##### [ top ]

#### FORWARD_DENY_HOST_N ; FORWARD_DENY_HOST_x

If you want to deny access to other networks for some computers you may enter these computers in this list. Routing of IP packets in other networks will then be denied in the firewall for these computers.

Example:

    FORWARD_DENY_HOST_N='2'
    FORWARD_DENY_HOST_1='192.168.6.5'
    FORWARD_DENY_HOST_2='192.168.6.6'

##### [ top ]

#### FORWARD_DENY_PORT_N ; FORWARD_DENY_PORT_x

Deny routing via spec IP ports by using this variable. It - for example - makes sense to forbid routing of NetBios ports 137-139. This means not only denying of routing of IP packets via these ports to remote, but also routing of these ports between two networks (LANs).

When you use more than one network adaptor for several subnets and you want to allow some clients of one subnet to access Windows directories of a client in another subnet, you should not restrict/forbid forwarding of NetBios ports in this case. Here you may enter networks which explicitely allow routing of these ports between them: TRUSTED_NETS

Example: Forbid access to Napster services:

    FORWARD_DENY_PORT_N='6'         # number
    FORWARD_DENY_PORT_1='137:139'   # NetBios ports 137 to 139
    FORWARD_DENY_PORT_2='8888'      # Napster port 8888
    FORWARD_DENY_PORT_3='7777'      # Napster port 7777
    FORWARD_DENY_PORT_4='7000'      # Napster port 7000
    FORWARD_DENY_PORT_5='4444'      # Napster port 4444
    FORWARD_DENY_PORT_6='4200'      # Napster port 4200

From version 1.5.1 there is an additional parameter to the port number. This is:

    REJECT      - forwarding of IP packet will be rejected
    DENY        - IP packet will be ignored

If this parameter is not set, REJECT method will be used. Example:

    FORWARD_DENY_PORT_1='80 DENY'   # no surfing today !

Default setting: FORWARD_DENY_PORT_N='1' FORWARD_DENY_PORT_1='137:139'

##### [ top ]

#### TRUSTED_NETS

Disabling of routing with ports entered in FORWARD_DENY_PORT_x may be again disabled (after all: allowed) for spec. networks when using TRUSTED_NETS. Here you may enter networks which you "trust". A typical example for this is routing of NetBios ports between two networks (LANs) which are served by two network adaptors in the FLI4L router itself. If so, you will have to enter all trusted networks; ex.:

    TRUSTED_NETS='192.168.1.0/24 192.168.6.0/24'

Default setting: TRUSTED_NETS=''

##### [ top ]

#### FIREWALL_DENY_PORT_N

Firewall ports: in FIREWALL_DENY_PORT_N you will have to enter the number of TCP/IP ports, which shall be disabled for access from remote (i.e. ISDN or DSL) to the FLI4L router. Since FLI4L serves specific services, it makes sense to disable access to them from remote.

This concerns to follwing ports:

        port           name                    process
    -----------------------------------------------------------
         21            ftp                     ftpd
         22            ssh                     sshd
         23            telnet                  telnetd
         37            time                    [kernel]
         53            domain                  ens
         80            www                     mini_httpd
    137:139            netbios                 smbd (samba)
        515            printer                 lpd
       5000            [imond]                 imond
       5001            [telmond]               telmond
       8000            [proxy]                 junkbuster

Remark:

A masked LAN (s. above) is always protected against access from remote. Port numbers mentioned in the variables will therefore handle access from remote to the FLI4L router itself.

##### [ top ]

#### FIREWALL_DENY_PORT_x

Ports which shall be denied have to be entered in the single variables FIREWALL_DENY_PORT_1 to FIREWALL_DENY_PORT_n . Combine areas of port numbers by using a colon, ex.: '137:139'

It is (urgently) recommended not to change standard/default configuration of the firewall ports. If you want to enable a spec. service to get access to the internal network via port forwarding, you will have to enable this port explicitely by removing it from this section.

In the sample file you may find all privileged ports from 0 to 1023 as denied, except port number 53. Additionally ports 5000 and 5001 are denied. These both are used by imond and telmond. If you want to use Junkbuster additionally on your router you will have to disable port 8000, too.

Default configuration therefore is:

    FIREWALL_DENY_PORT_N='6'
    FIREWALL_DENY_PORT_1='0:52      REJECT'
    FIREWALL_DENY_PORT_2='54:112    REJECT'
    FIREWALL_DENY_PORT_3='114:1023  REJECT'
    FIREWALL_DENY_PORT_4='5000:5001 REJECT'
    FIREWALL_DENY_PORT_5='8000      REJECT'
    FIREWALL_DENY_PORT_6='20012     REJECT'

IMPORTANT:
In all cases it is necessary to enable port 53. If you wonīt do so, internet DNS calls are not available/possible!

If you - for example - want to enable port 21 for FTP from remote because it shall be forwarded to an internal computer by port forwarding, you may do the following:

    FIREWALL_DENY_PORT_N='7'                # New: 7 instead of 6 entries!
    FIREWALL_DENY_PORT_1='0:20      REJECT' # disable ports from 0 to 20
    FIREWALL_DENY_PORT_2='22:52     REJECT' # disable ports from 22 to 52
    FIREWALL_DENY_PORT_3='54:112    REJECT' # disable ports from 54 to 112
    FIREWALL_DENY_PORT_4='114:1023  REJECT' # disable ports from 114 to 1023
    FIREWALL_DENY_PORT_5='5000:5001 REJECT' # disable imond/telmond ports
    FIREWALL_DENY_PORT_6='8000      REJECT' # disable HTTP proxy access
    FIREWALL_DENY_PORT_7='20012     REJECT' # disable VBOX access
        Here is a list of usual internet services and their ports:

    ftp              21
    ssh              22
    telnet           23
    smtp             25
    time             37
    domain           53
    http             80
    pop3            110
    auth (ident)    113
    syslog          514
    printer         515

        Remember: Only enable these ports, if if you want to enable access to the internal network via port forwarding!

        From version 1.5.1 there is an additional parameter to the port  number. This is:

    REJECT      - reject forwarding of IP packet
    DENY        - simply ignore IP packet

        If you didnīt use the additional parameter, REJECT method will be used: If the router is called on a port from remote, it will send an answer (denial) to the other/calling computer.
        When using DENY method, the router will be "quiet". - but this may cause problems. Some computers - providing internet services like FTP - for example will send a request to port 113 (auth) as an answer to connection establishing. If FLI4L does not react to these requests, a disconnection may occur.
        I prefer the REJECT method since it will cause less problems when using different internet protocols; and itīs as secure as DENY method.

        For additional information about REJECT vs. DENY (called DROP by iptables):

            http://www.iks-jena.de/mitarb/lutz/usenet/Firewall.html#Deny
    	http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject

##### [ top ]

#### FIREWALL_DENY_ICMP

If you want to disable remote access via ICMP protocol, you may set FIREWALL_DENY_ICMP='yes' . After this you wonīt be able to access the router from remote by using "ping".

Important information:

http://www.iks-jena.de/mitarb/lutz/usenet/Firewall.html#Verstecken http://www.fli4l.de/faq/index.php?sid=&aktion=anzeigen&rubrik=3&id=165

Default setting: FIREWALL_DENY_ICMP='no'

##### [ top ]

#### FIREWALL_LOG

Using FIREWALL_LOG enables you to write protocols about accesses from remote to your firewall ports. This is done via syslog interface.

Short description of a protocol line:

Packet log: input REJECT ppp0 PROTO=6 217.88.245.79:3248 217.88.168.16:80 L48 S=0x00 I=60459 F=0x4000 T=124 SYN (#6)

            input       Input chain
            REJECT      Packet was rejected
            ppp0        Device
            PROTO=6     TCP Packet
            L           Lenght of packet in bytes
            S           Type Of Service (TOS)
            I           IP ID, will be invcremented by 1 with each packet from sender
            F           Flags (3 bits), if packet is fragmented it is offset,
                        13 bits
            T           TTL (Time To Live), number of hops until packet will be deleted
            #6          6th rule of packet filter was in action !

Default setting: FIREWALL_LOG='yes'

##### [ top ]