http://www.fwbuilder.org

Firewall Builder is a firewall configuration and management GUI that supports configuring a wide range of firewalls from a single application. Supported firewalls include Linux iptables, BSD pf, Cisco ASA/PIX, Cisco router access lists and many more. The complete list of supported platforms along with downloadable binary packages and soure code can be found at http://www.fwbuilder.org.

In this tutorial we are going to cover how to use Firewall Builder clusters to manage a single firewall policy that gets deployed on multiple servers. An example of where you could use this would be managing a shared firewall policy for a collection of web servers that are all providing the same service and should have the same rules.

Normally the cluster feature is used to create high availability firewall pairs, but in this case we are going to use it creatively to create a “master” firewall policy that gets deployed on multiple servers. This allows you to create a cluster object with a “master” firewall policy and then add servers as members to this cluster that will inherit the master firewall policy.

For this tutorial we are going to use the web farm example shown below. The example starts with two servers running Linux with iptables should have identical firewall polices. We’ll cover creating the firewalls and cluster and assigning rules to it. At the end we’ll walk through adding a 3rd server to the cluster.

While we are using a small number of servers for this example, the technique we are using can scale to manage a common firewall policy for hundreds or more servers.

web server farm diagram

On these servers we want to implement the following basic firewall rules.

  • Allow system to commuicate to its own loopback interface
  • Allow inbound HTTP and HTTPS from anywhere to the server
  • Allow inbound SSH from a specific set of trusted subnets
  • Allow outbound connectivity to port 8009 (jboss) to a group of application servers

This tutorial assumes knowledge of basic Firewall Builder concepts and common actions like creating firewall objects and rules. You can find more information about Firewall Builder commands on the Firewall Builder website http://www.fwbuilder.org.

Step 1 – Create firewall objects for your servers

To create a cluster we first need to create the firewall objects that will be members of the cluster. Each server is represented by a firewall object in Firewall Builder. Go through the New Firewall wizard and create a firewall called web-01 with two interfaces. The first interface is the Ethernet interface “eth0″ that connects the server to the Internet and the second interface is the loopback interface “lo”.

After you have created the firewall object it should look like this in the object tree:

web-01 firewall object

By default Firewall Builder sets the firewall object to route (forward) IP packets. Since this is a server firewall we should disable IP forwarding on the host. Do this by double-clicking on the firewall object and then click on Host OS Settings in the Editor Panel at the bottom. Change the setting for IPv4 Packet Forwarding to Off.

steps to disable forwarding on      firewall object

To create a second firewall object for web-02 you can use the Duplicate feature in Firewall Builder.

  • Right-click on web-01 firewall and select Duplicate -> place in library User
  • Edit the name of the newly created firewall object to web-02
  • Double-click on web-02′s IP object under the eth0 interface and set the IP address to 192.0.2.12 / 24

Step 2 – Create a new cluster

To create a new cluster right-click on the Clusters folder in the object tree and select New Cluster. This will launch the New Cluster wizard. Name the cluster, for example web-servers, and select both web-01 and web-02 to be members of the cluster. Since we are not using failover it does not matter which firewall is set to Master.

steps to a new cluster     with web-01 and web-02 as members

Click Next >

Since both servers use eth0 as the outside interface leave the interface mapping as is. If you have servers with different interface names on your server, for example if one server uses eth0 and the other server uses eth1, you can set the mapping here.

mapping the      interfaces for the servers in the cluster

Click Next >

To make the cluster interface easy to identify update the label associated with interfaces eth0 and lo. Since we are not running our servers as a high availability cluster with failover set the Failover protocol to None.

modifying      the cluster interface attributes

Make sure to update both the eth0 and lo interfaces.

Click Next >

We want to create new rules for our cluster, so set the source of the cluster rules to be “do not use any, i will create new policy and NAT rules”.

policy rules created      for the cluster

Click Finish

Once you are done you should see a new cluster object in the tree that looks like this:

new cluster object for     web-servers

Step 3 – Define cluster policy rules

After you create the cluster, the Policy object is automatically opened in the Rules Panel. Make sure to create the rules in the cluster object, called web-servers in our example, and not in one of the individual firewalls that are members of the cluster. Remember we wanted both of our servers to have the following rules:

  • Allow system to commuicate to its own loopback interface
  • Allow inbound HTTP and HTTPS from anywhere to the server
  • Allow inbound SSH from a specific set of trusted subnets
  • Allow outbound connectivity to port 8009 (jboss) to a group of application servers

After you configure these rules in the web-servers Policy object the rules should look like this:

cluster policy rules

NOTE: For objects that are related to the firewall itself, such as interfaces, make sure to use the objects from the cluster when creating the rules. The cluster objects will automatically get translated to the correct object for the individual cluster members.

Step 4 – Compile and install rules

The next step is to compile and install the rules on our servers. When Firewall Builder compiles the cluster it will generate a firewall script for each of the cluster members including substituting the cluster objects used in the rules for the matching local object on the cluster member.

For example, the IP address for the eth0 cluster object is automatically translated to the correct address for web-01 (192.0.2.11) and web-02 (192.0.2.12).

You can see this substitution by inspecting the generated file for web-01 after the compile is completed. Note that the destination in the rule shown below is set to the IP address of web-01′s eth0 interface.

echo “Rule 0 (eth0)”
#$IPTABLES -A INPUT -i eth0 -p tcp -m tcp -m multiport \
-d 192.0.2.11 –dports 80,443 -m state –state NEW -j ACCEPT

Modifying rules

Now that you have a cluster setup to generate firewall policies for each of the server firewalls it is easy to make changes that affect all your servers. For example, to add a new rule to all members of the web-servers cluster to allow ICMP from the Trusted Networks object to servers simply add the rule in the cluster policy and compile and install it to the members.

Adding a new server to the cluster

To add a new server to the cluster you first need to create the firewall object to represent the server. You can do this manually, or you can follow the same duplication process we used to create the web-02 firewall object.

The next step is to add the new web-03 firewall object to the cluster.

steps to add a new server      called web-03 to the cluster

Repeat this process for the “lo” loopback interface. Remember the steps are:

  • Double-click on the interface named web-servers:eth0:members
  • Click on the Manage Members button at the bottom of the Editor Panel
  • Click to select the “lo” interface under the web-03 object
  • Click the right arrow > button to add the interface to the cluster member list
  • Click Ok

Installing firewall policy on new server in cluster

To deploy the firewall policy on web-03 you need to compile and install the cluster policy. Since the cluster policy hasn’t changed we don’t need to re-install the policy on web-01 or web-02 so we unselect them from the install list.

compiling and installing      the cluster policy on web-03

You can add and remove servers to the cluster as needed. Here’s our configuration now that we have three servers in the cluster all running the same firewall rules.

web farm with three      servers as members of the same cluster

}