The Basics

Logging in and User Maintenance
Explanation of Options
Iptables basics


Logging In & User Maintenance

You must log in to fBuilder for the first time using the username and password you supplied during the installation process. Once logged in you can add and delete users by clicking on the User Administration folder. Adding and deleting users is a straight forward process and can be accomplished in the same manner that you would add a new user in any GUI environment.

If you have trouble logging into your fBuilder product, please check our FAQ's to solve common problems.


Explanation of Options

In fBuilder, you will see menu choices on the left hand side of the interface. You can use these menu items to navigate through the fBuilder interface. Below you will find a list of the options and a brief description of what each does:




Iptables Basics

General information about iptables will be dispersed throughout this documentation as the information is needed to understand fBuilder. In no means will we go into great depth about iptables for two reasons: 1) To run fBuilder, you don't really need to understand everything about iptables, and 2) There is a LOT of iptables documentation that can be found on the web.

Some of the basic terms that you will encounter while working with fBuilder include Chains, Limit, State, and Targets. Lets take a quick look at these items and what they mean to you.

Chains:
Chains come in several flavors - INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING, and user defined. Actually, there are more chains with iptables, however, the ones listed are the ones that you will be using in fBuilder. So what is a chain? A chain is a list of rules that network packets will travel through on their journey through your firewall. If a match is found along the way, the firewall will act according to the rule. If no match is found, the default policy of that chain will be processed on the packet.

One important thing to know about chains is how they are processed as this will directly affect how you create your firewall. Even if you just plan on using the wizard and nothing else, you will still want to know this. When a packet comes in to your firewall, the first thing that happens is a routing decision. This means that your firewall decides the appropriate chains to send the packet to. Lets forget about some of the powerful features of iptables right now (Like Network Address Translation), and think of your three main chains: INPUT, OUTPUT, and FORWARD. Many people new to iptables get the meaning of these chains confused and thus have a difficult time creating a meaningful firewall solution. The chains, INPUT and OUTPUT, define rules for the packets headed to the local machine (in other words, the firewall machine itself) while the FORWARD chain defines rules for the packets that are intended to pass through the firewall. So, if you are creating a rule set for a machine that is not routing packets (like your desktop or webserver), you will be most interested in the INPUT and OUTPUT chains. If you are using your iptables solution as a router to protect an internal network, you will be most concerned about the FORWARD chain.

What are these other chains used for? The PREROUTING and POSTROUTING chains are used for things like Network Address Translation (NAT). For those unfamiliar with NAT, a basic example would be for someone who was given one ip address to the internet and would like to run multiple services on multiple machines within the internal network. For instance, you could take a request headed towards port 80 on the external interface of the firewall, and DNAT (Destination NAT) it to port 80 on the internal network to a machine running on a private ip. Explaining all of the things you can do with NAT goes beyond the scope of this document but you can find a lot of information on web about this topic.

Ok, then, why use user defined chains? User defined chains can serve to organize and potentially optimize your firewall rules. For instance, you can create a user defined chain, lets call it TCP, and then insert a rule in the FORWARD chain that sends all TCP data to the TCP Chain. You can create all of your TCP related rules in there so you have them organized. If a packed was sent to the FORWARD chain and was a TCP packet, it would process all rules up to the rule that sends TCP data to the TCP chain and then would be routed to the TCP chain. At this point, it will be processed on each of the rules located in the TCP chain. If no match is found, the packet will be passed back to the FORWARD chain and continue on for the rest of the rules located in the FORWARD chain. If no matches are found, the default policy is used.

Limits:
Limits allow you to add a limit on how many packets can match a specific rule. This is most commonly used to limit how many packets will be logged for a LOG rule but can also be used to limit data. The advantage of limiting log rules is that you can keep your logs from growing out of control in a situation where one rule is generating a lot of log messages. If you chose to limit data, be very careful that you don't constrain your limits to the point where valid data does not pass. A common reason to limit certain data would be for something like ping packets. For instance, you can allow 5 ping packets with a burst of 10 through your firewall every hour. This could be enough to troubleshoot a problem, but would keep someone from sending a lot of ping traffic through your firewall.

Targets:
Targets can be considered the 'ultimate destination' of a packet. This can be ACCEPT, DROP, REDIRECT, DNAT, SNAT, LOG, MASQ, or even a user defined chain. Definitions:

State:
State checking allows the machine to keep track of connections so that you are not forced to create back traffic rules and other things that are insecure. For instance: a rule that allows all traffic to pass through that is established or related will mean that once a connection has been accepted by one of your rules, all other traffic that is part of that connection can be considered 'safe' because you already gave it permission to come through the firewall. When this 'Established/Related' rule is close to the top of your chain, you will avoid having to process all of your rules every time additional packets pass through for that connection. Also, it is more secure because you can avoid having to create holes for backtraffic. For instance, when you go out to the web, the web page data must come back. without state checking, you would need to create a hole in the INPUT chain (if it was a single machine) or the FORWARD chain if this machine was acting as a router. Now, there are no holes, because only established and related data can get through.

LOG Rules:
Log rules in iptables act much like a rule of any other target type. If the criteria is met, then a log is created. This is a good way of creating LOG rules, but it adds a level of complexity that you must be aware of so that your log rules act as expected. For instance, if you want to log all packets that are going to port 80, you must put your LOG rule BEFORE the rule in your chain that actually acts upon port 80 traffic. If the LOG rule was after your rule for port 80, the packet would be gone before it ever gets to your log rule. With fBuilder, you have the option when creating or editing a rule to 'Log this rule'. If you use this option, the LOG rule will be created before the rule as expected. Also, if you want to only log DROPPED packets, you would need a LOG rule that logs everything as the last rule in your chains before the default policy of DROP gets acted upon. This is important to note because of the way certain features in fBuilder work. The 'New Rule' function will append a rule to the end of a chain. If you want to log only dropped packets, you will need to move the LOG rule that logs everything down to the last rule in the chain with the Shift function on the 'View Firewall' screen.


Now you have a basic understanding of the framework of iptables. Additional information will be located as needed throughout this documentation when we introduce the functions of fBuilder. From here, you can read the section titled "Edit Firewall" to learn how to create and edit your firewall.