mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-10-26 08:41:46 +01:00
backport all firewall based documentation
This commit is contained in:
rebortg
parent
951c56bce1
commit
7385cfe0d4
@ -4,31 +4,32 @@
|
||||
Firewall
|
||||
########
|
||||
|
||||
With VyOS being based on top of Linux and its kernel, the Netfilter project
|
||||
created the iptables and now the successor nftables for the Linux kernel to
|
||||
work directly on the data flows. This now extends the concept of zone-based
|
||||
security to allow for manipulating the data at multiple stages once accepted
|
||||
by the network interface and the driver before being handed off to the
|
||||
destination (e.g. a web server OR another device).
|
||||
As VyOS is based on Linux it leverages its firewall. The Netfilter project
|
||||
created iptables and its successor nftables for the Linux kernel to
|
||||
work directly on packet data flows. This now extends the concept of
|
||||
zone-based security to allow for manipulating the data at multiple stages once
|
||||
accepted by the network interface and the driver before being handed off to
|
||||
the destination (e.g., a web server OR another device).
|
||||
|
||||
A simplified traffic flow, based on Netfilter packet flow, is shown next, in
|
||||
order to have a full view and understanding of how packets are processed, and
|
||||
what possible paths can take.
|
||||
A simplified traffic flow diagram, based on Netfilter packet flow, is shown
|
||||
next, in order to have a full view and understanding of how packets are
|
||||
processed, and what possible paths traffic can take.
|
||||
|
||||
.. figure:: /_static/images/firewall-gral-packet-flow.png
|
||||
|
||||
Main notes regarding this packet flow and terminology used in VyOS firewall:
|
||||
The main points regarding this packet flow and terminology used in VyOS
|
||||
firewall are covered below:
|
||||
|
||||
* **Bridge Port?**: choose appropiate path based on if interface were the
|
||||
packet was received is part of a bridge, or not.
|
||||
* **Bridge Port?**: choose appropriate path based on whether interface
|
||||
where the packet was received is part of a bridge, or not.
|
||||
|
||||
If interface were the packet was received isn't part of a bridge, then packet
|
||||
is processed at the **IP Layer**:
|
||||
If the interface where the packet was received isn't part of a bridge, then
|
||||
packetis processed at the **IP Layer**:
|
||||
|
||||
* **Prerouting**: several actions can be done in this stage, and currently
|
||||
these actions are defined in different parts in vyos configuration. Order
|
||||
these actions are defined in different parts in VyOS configuration. Order
|
||||
is important, and all these actions are performed before any actions
|
||||
define under ``firewall`` section. Relevant configuration that acts in
|
||||
defined under ``firewall`` section. Relevant configuration that acts in
|
||||
this stage are:
|
||||
|
||||
* **Conntrack Ignore**: rules defined under ``set system conntrack ignore
|
||||
@ -40,12 +41,12 @@ is processed at the **IP Layer**:
|
||||
* **Destination NAT**: rules defined under ``set [nat | nat66]
|
||||
destination...``.
|
||||
|
||||
* **Destination is the router?**: choose appropiate path based on
|
||||
destination IP address. Transit forward continunes to **forward**,
|
||||
* **Destination is the router?**: choose appropriate path based on
|
||||
destination IP address. Transit forward continues to **forward**,
|
||||
while traffic that destination IP address is configured on the router
|
||||
continues to **input**.
|
||||
|
||||
* **Input**: stage where traffic destinated to the router itself can be
|
||||
* **Input**: stage where traffic destined for the router itself can be
|
||||
filtered and controlled. This is where all rules for securing the router
|
||||
should take place. This includes ipv4 and ipv6 filtering rules, defined
|
||||
in:
|
||||
@ -61,14 +62,14 @@ is processed at the **IP Layer**:
|
||||
|
||||
* ``set firewall ipv6 forward filter ...``.
|
||||
|
||||
* **Output**: stage where traffic that is originated by the router itself
|
||||
can be filtered and controlled. Bare in mind that this traffic can be a
|
||||
new connection originted by a internal process running on VyOS router,
|
||||
such as NTP, or can be a response to traffic received externaly through
|
||||
**inputt** (for example response to an ssh login attempt to the router).
|
||||
* **Output**: stage where traffic that originates from the router itself
|
||||
can be filtered and controlled. Bear in mind that this traffic can be a
|
||||
new connection originated by a internal process running on VyOS router,
|
||||
such as NTP, or a response to traffic received externaly through
|
||||
**input** (for example response to an ssh login attempt to the router).
|
||||
This includes ipv4 and ipv6 filtering rules, defined in:
|
||||
|
||||
* ``set firewall ipv4 input filter ...``.
|
||||
* ``set firewall ipv4 output filter ...``.
|
||||
|
||||
* ``set firewall ipv6 output filter ...``.
|
||||
|
||||
@ -79,16 +80,16 @@ is processed at the **IP Layer**:
|
||||
* **Source NAT**: rules defined under ``set [nat | nat66]
|
||||
destination...``.
|
||||
|
||||
If interface were the packet was received is part of a bridge, then packet
|
||||
is processed at the **Bridge Layer**, which contains a ver basic setup where
|
||||
for bridge filtering:
|
||||
If the interface where the packet was received is part of a bridge, then
|
||||
the packet is processed at the **Bridge Layer**, which contains a basic setup for
|
||||
bridge filtering:
|
||||
|
||||
* **Forward (Bridge)**: stage where traffic that is trasspasing through the
|
||||
* **Forward (Bridge)**: stage where traffic that is trespasing through the
|
||||
bridge is filtered and controlled:
|
||||
|
||||
* ``set firewall bridge forward filter ...``.
|
||||
|
||||
Main structure VyOS firewall cli is shown next:
|
||||
The main structure of the VyOS firewall CLI is shown next:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
@ -134,7 +135,7 @@ Main structure VyOS firewall cli is shown next:
|
||||
- custom_zone_name
|
||||
+ ...
|
||||
|
||||
Please, refer to appropiate section for more information about firewall
|
||||
Please, refer to appropriate section for more information about firewall
|
||||
configuration:
|
||||
|
||||
.. toctree::
|
||||
|
||||
@ -123,3 +123,41 @@ written from the perspective of: *Source Zone*-to->*Destination Zone*
|
||||
set firewall zone DMZ from LAN firewall name LANv4-to-DMZv4
|
||||
set firewall zone LAN from DMZ firewall name DMZv4-to-LANv4
|
||||
|
||||
**************
|
||||
Operation-mode
|
||||
**************
|
||||
|
||||
.. opcmd:: show firewall zone-policy
|
||||
|
||||
This will show you a basic summary of zones configuration.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
vyos@vyos:~$ show firewall zone-policy
|
||||
Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
|
||||
------ ------------ ----------- --------------- ---------------
|
||||
LAN eth1 WAN WAN_to_LAN
|
||||
eth2
|
||||
LOCAL LOCAL LAN LAN_to_LOCAL
|
||||
WAN WAN_to_LOCAL WAN_to_LOCAL_v6
|
||||
WAN eth3 LAN LAN_to_WAN
|
||||
eth0 LOCAL LOCAL_to_WAN
|
||||
vyos@vyos:~$
|
||||
|
||||
.. opcmd:: show firewall zone-policy zone <zone>
|
||||
|
||||
This will show you a basic summary of a particular zone.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
vyos@vyos:~$ show firewall zone-policy zone WAN
|
||||
Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
|
||||
------ ------------ ----------- --------------- ---------------
|
||||
WAN eth3 LAN LAN_to_WAN
|
||||
eth0 LOCAL LOCAL_to_WAN
|
||||
vyos@vyos:~$ show firewall zone-policy zone LOCAL
|
||||
Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
|
||||
------ ------------ ----------- --------------- ---------------
|
||||
LOCAL LOCAL LAN LAN_to_LOCAL
|
||||
WAN WAN_to_LOCAL WAN_to_LOCAL_v6
|
||||
vyos@vyos:~$
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user