Edit Firewall

Getting Started
Firewall Wizard
New Rule
Default Policy
Manage Chains
Setup Interfaces
Install Firewall
Uninstall Firewall

Getting Started

There are three ways to create a firewall with fBuilder: The Firewall Wizard, one rule at a time with the New Rule option, or a combination of both. The most common way is to use the combination of both. With the wizard, you can create your basic firewall configuration and then fill in your more complex rules with the New Rule option. Also, you can insert a rule at any point in the chain by using the Insert function or edit and delete any of the rules in the chains by using the edit function (both are located on the View Options >> View Firewall screen). This makes for a very flexible design that is easy enough for the novice and powerful enough for the seasoned firewall administrator. Also, as mentioned in the introduction, fBuilder works directly with the rules in memory. When you insert, edit, or delete a rule through the fBuilder interface, there is no need to save and reinstall the firewall because the change takes place as soon as you click the submit button.

All of the options listed here are explained in much greater detail later in this document and in the View Options document.

The Wizard

Using the wizard is pretty straight forward, just click on the 'Edit Firewall>>Firewall Wizard' link and answer a few basic questions about your network. The wizard will then create an iptables script based on the information you provided. The firewall that the wizard creates sets all default policies to DENY and opens specific holes (based on your choices) to allow incoming traffic from the Internet and from your internal network.

The first screen in the wizard asks for the Network Interface information. fBuilder's auto-discovery routines should fill this screen in for you. You should confirm that the settings are correct before continuing to the next screen. You will see the following screens:

External NIC: the name of the NIC that is attached to the internet. (Example - eth0)
External network address: address of the external network. Please note that when specifying a network address, you should enter the address followed by a forward slash (/) then the netmask. You may use shorthand for the netmask, for instance a netmask of 255.255.255.0 may be written as /24.
Internal NIC: the name of the NIC that is attached to your internal network. (Example - eth1) Note: If you only have one NIC, this will be the same as your External NIC.
Internal network address: address of the internal network. Please note that when specifying a network address, you should enter the address followed by a forward slash (/) then the netmask. You may use shorthand for the netmask, for instance a netmask of 255.255.255.0 may be written as /24.
Loopback IP address: address of the loopback interface, most systems can just leave this as 127.0.0.1.

If you chose to enter DMZ information when setting up your interfaces, you will also see that information on the screen above. Also, please note that this screen asks for NETWORK addresses, NOT the ip address of your NIC. If you are unsure of your network address, you can assume that fBuilder has the correct information filled in for you.

The second screen in the wizard is for choosing your incoming and outgoing services. The services listed in the boxes come directly from the /etc/services file on your system. To add/delete a service, edit your /etc/services file and make the addition or deletion. To add the services which will be allowed access through your firewall choose a service from the left window and move it to the right window by highlighting the service you would like moved and clicking on the direction arrow. You can remove services from the right side using the same technique. Remember, in iptables, this information controls what will be allowed in and out of the firewall host machine itself. To learn more about the difference between INPUT (Incoming), OUTPUT (Outgoing), and FORWARD chains, take a look at the iptables section in 'The Basics' section of this documentation.

The third screen is for choosing DNS, ICMP and logging options. By checking the box you are enabling that particular service/protocol. You should note that by logging all packets that your /var/log/messages file will grow very fast. For this reason, we recommend logging only denied packets

At this point you are given the option to choose whether or not to setup IP masquerade / forwarding services. If you say no to this question (or ignore this question) you will be finished using the wizard and your firewall will be created. If you answer yes to this question you will be brought to a screen exactly like the service chooser screen mentioned above. Here you can choose which services your internal network may access. Note: If your firewall is acting as a router (providing services for an internal network) you will want to set up forwarding services. If this is a stand alone machine (Like a desktop or Webserver) you will say no to forwarding services.

After your firewall is created you can install with the 'Install' link at the bottom of the script or with the 'Edit Firewall>>Install Firewall' option. Once your firewall is installed you can view your rule set with the 'View Options>>View Firewall' option and make any necessary changes using the New Rule, edit/delete, or insert capabilities.

The Firewall Wizard saves the settings chose the last time you ran the Wizard. This can be convenient to make modifications to an existing Wizard created firewall. If you make changes using Insert, Edit, or New Rule, your changes will be lost if you choose to run the Wizard again.

New Rule

The New Rule function allows you to create new firewall rules one by one. Each rule will be inserted at the end of the chain specified. If you would like to insert a rule in the middle of a chain, please view the 'Insert' option in the 'View Options' documentation. Please note that when using this method for creating your firewall, you will also need to use the 'Default Policy' option to set the default policy for the INPUT, OUTPUT and FORWARD chains. If you created your firewall through the Wizard, you will not have to worry about setting the default policy as the Wizard does this for you.

The New Rule function is for system administrators who are experienced in building Linux firewalls or for those that want to customize their Linux firewall. The New Rule function works much like the command line in that you can invert a particular option by clicking the exclamation point next to the option you wish to invert, create limits, use custom protocols and user defined chains, state checking (connection tracking), etc.

Here we will list all of the choices found on the New Rule screen and what each one does:

Exclamation point check boxes -- Used to invert the selection next to the check box. If confused, think of this as saying 'NOT'. For instance if you click the check box in front of Inbound interface, and set the interface to eth0, it would be like saying "packets that are not coming in eth0".
Inbound Interface -- This can be used to specify where the packet is coming into the firewall from. It can be used in the INPUT, FORWARD, and PREROUTING chains as well as user defined chains called from these chains. The inbound interface is not necessary for creating most rules unless you are trying to achieve fine grained control that can not be accomplished with ip addresses alone.
Outbound Interface -- This specifies where the packet will leave the firewall. It can be used in the OUTPUT, FORWARD, and POSTROUTING chains as well as user defined chains called from these chains. As with the inbound, the outbound interface is not necessary for creating most rules unless you are trying to achieve fine grained control that can not be accomplished with ip addresses alone.
Source IP Address -- This is where the packet is coming from. If left blank, you are saying 'Anywhere'. Another way of saying 'Anywhere' is to specify this as 0.0.0.0/0. You can use complete subnets or just specific ip addresses in this field. 192.168.1.0/24 is the same as saying 192.168.1.0/255.255.255.0. Remember, by clicking the check box, you can invert this option to say 'traffic NOT coming from this ip address'.
Source Ports -- Here you can specify the ports traffic will be coming from. Typically, this will be a range of unregistered port numbers and can be entered as 1024:65535. If you leave the field blank, it will mean 'any' source port. If you know the port or port range for the application you are allowing through (or blocking) you can enter just a single port or a range by entering :. Notice the : between the numbers. So, 80:85 means ports 80 through 85.
Destination IP Address -- This is the address or addresses where the packet is going. If left blank, you are saying 'Anywhere'. Please view more about syntax of this field above in the Source IP Address bullet.
Destination Port -- This is the port or ports that the traffic is headed to. fBuilder allows you to put in a port number (i.e 80), a range of numbers (i.e 80:85), or a name as it is listed in your /etc/services (i.e www). If you choose to use the names of your port, it is case sensitive. In other words, pop3 will work on my system but POP3 will not. If you get an error when entering the rule, you can check your /etc/services to locate the correct name or just use the port numbers associated with that service. Again, the check box inverts your selection. By checking it, you are saying 'traffic that is NOT going to this port'.
NAT To IP Address -- This is the address of the machine that you will be sending the packets to if you are creating a NAT rule. This is only valid in the PREROUTING and POSTROUTING chains with the DNAT, SNAT, or MASQ targets. The syntax for this field is the same as above: you can use an IP address or define a network by using the ip/subnet syntax as detailed in the Source IP Address bullet above. For more information about Network Address Translation, please look at the section called 'iptables basics' in 'The Basics' documentation.
NAT To Port -- This is the port or ports that you will be sending the packet to. This can be the same or can be altered from the original packet. For example, traffic with a destination ip of 111.111.111.111 on port 80, can have a NAT To ip address of 192.168.1.100 on port 1234. In this situation, 111.111.111.111 would be the public address on your firewall and 192.168.1.100 would be a machine running inside the private network.
Rule Type -- Specifies the chain that the rule will be placed in. The User Defined drop down box will be empty unless you have added a User Defined Chain in the 'Manage Chains' function.
Target -- This is the action that you want performed on the packet.
- ACCEPT -- Allows the packet through -- Available in all chains
- DROP -- Drop the packet denying access -- Available in all chains
- DNAT -- Destination NAT -- Change the destination information of the packet -- Available in the PREROUTING Chain
- SNAT -- Source NAT -- Change the source information of the packet -- Available in the POSTROUTING Chain
- MASQ -- Masquerade -- Similar to SNAT but focuses on the interface. Typically used for DHCP connections. -- Available in the POSTROUTING Chain.
- REDIRECT -- Redirect the packet to another process. Useful for things like Squid. -- Only available in the PREROUTING Chain
- LOG -- Creates a log message if the criteria is met -- Available in all chains
- User Defined -- Sends the packet to the User defined chain. -- Available in all chains
Protocol -- This is the protocol you want to match on the packet. ALL will allow any protocol. ICMP type allows you to specify a specific ICMP type if you choose. To allow all ICMP, just leave the Type set to the default value of 'Valid ICMP Types'. Custom allows you to allow protocols like GRE or any other non-standard protocols.
Rule Options -- consists of State Checking, Ack but must be set, and Syn bit must be set. To learn a little more about State checking, please read the iptables primer in 'The Basics' documentation. The Ack/Syn bit must be set options allow for more fine grained control for the seasoned firewall administrator.
Log this rule -- This will create a log rule with the exact same criteria as the rule you are creating and will input it into the same chain right before the new rule. This will allow the match to be logged before the target has been applied to the packet.
Limit -- When using limiting, you are setting a threshold on how many packets will be allowed to match in a given time frame. The Burst number is an initial number of packets that you will allow before that limiting kicks in. This is typically used in log rules, to keep your log files from growing too much if a log rule is generating a lot of messages, and to limit certain types of data to reduce traffic or the possibilities of DoS attacks. The limit defaults for fBuilder can be found in the fbuilder.conf file. You can always change the limit through the interface, however, you may want to change the defaults if you tend to use the same limits often.

When you click the 'Add New Rule' button, your change takes place immediately. The rule is appended to the end of the chain that you specified in the 'Rule Type' option. If an error occurs, you will be prompted with the error that was produced by iptables to help you diagnose the problem.

Default Policy

The Default Policy function will enable you to set the default policies for the INPUT, OUTPUT, and FORWARD chains. As with all fBuilder functions, the policy change takes place immediately after hitting the 'Set Net Policy' button. If you created the firewall with the 'Firewall Wizard', your polices will be set to 'DROP'. This is the most secure method as it says 'That which is not explicitly allowed is Dropped'. For troubleshooting reasons, you may want to change these settings temporarily to ACCEPT to see if the desired traffic is allowed through. If it is, then you know that your firewall is blocking the traffic that you are troubleshooting. Remember: Change the setting back to DROP after you have finished troubleshooting the issue.

Manage Chains

The Manage Chains function allows you to create and delete user defined chains in your firewall. To create a new User defined chain, you can type the name in the text area labeled 'Add User Defined Chain' and click 'Add'. Your chain is immediately added to the firewall and you will see it added to the upper section labeled 'Existing User Defined Chains'. To delete a chain, you can put a check next to the name of the chain and click 'Delete'. If there are rules in the chain, fBuilder will give you the option to flush the chain before deleting. You can check both boxes for the chain and click delete again. If there is a reference to that chain somewhere in one of your other chains, iptables will not allow you to delete it until the reference is gone. You will have to find the rule in the 'View Firewall' screen and delete it by clicking the 'Edit' button and then 'Delete' once you are in the edit function. Once all references are removed, fBuilder will allow you to delete the user defined chain.

Setup Interfaces

On your first run of fBuilder, you will be prompted to 'Set Up Interfaces' if a .interfaces file is not found. This is so that fBuilder will know what interface is facing the external network and which is facing the internal network. If this machine only has one interface (for example a desktop machine or a stand alone server) you will put the same interface name in both the External Interface and the Internal Interface. The DMZ interface should be set to NONE unless you have three NIC's and intend on having one of them be a DMZ. To assist in understanding External and Internal, you can think of it as External points to the Internet and Internal points to the private network.

Install Firewall

By clicking 'Install Firewall', fBuilder will install the firewall that is saved in the fw-init script. This script is created by the 'Firewall Wizard' and updated every time you click 'Save Firewall' from the 'View Firewall' screen. The fw-init script is fBuilder dependant and is not the script that you will run at boot time. The boot time firewall is the rc.firewall script that you can Export from the 'View Firewall' screen. Remember to save the firewall, then click 'View Firewall' and then "Export to rc.firewall' so your changes are in both places. Remember, you do not need to click 'Install Firewall; after saving because all changes with fBuilder are happening in real time. Saving the firewall just allows you to start it again in the future after you 'Uninstall Firewall' or Reboot. rc.firewall can be added to your start up scripts so you don't have to do this manually every time. For more information on how to make fBuilder start at boot time, please see the section called 'Boot time' in the 'Other' section of this documentation.

Uninstall Firewall

Uninstall Firewall will set all Default Policies to ACCEPT and then flush your chains. This will allow all traffic to be allowed.