Proxy ARP and Transparent firewall under Linux2.4 kernel

Article title: Proxy ARP and Transparent firewall under Linux2.4 kernel. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: Wu Aiting
　　
I. Operating Environment
　　
Redhat 7.X, iptables, iproute2
　　
　　
II. Why does Proxy ARP be required?
　　
To add a firewall, you can re-deploy the network structure as follows:
　　
A. The two sides of the firewall use real addresses and private addresses respectively, and use NAT or port forwarding to implement external services. The disadvantage is that they cannot support all protocols.
B. Segment the IP address obtained from the ISP into two subnets for use at both ends of the firewall. The disadvantage is that you need to change the default server gateway and subnet mask settings.
C. using the Proxy ARP technology to build a transparent firewall can be easily implemented in the Linux 2.4 kernel. it can maintain the existing IP address, Gateway, and subnet mask settings, plus the use of real IP addresses, so it supports all protocols.
　　
3. Typical application legends
　　
Next we will consider a typical small enterprise network environment:
　　
1> The company has a leased line to connect to the internet. to protect servers in the DMZ zone, we want to set up a firewall to directly connect to the router. Next, we will link all the WEB, Mail, and DNS servers that provide services externally, for example:
　　
　　
　　
Internet
|
| DDN
____ | ____
| Router |
| _________ | E0: a. B. c.1
|
__|__ Eth0: a. B. c.2
|
| F | Transparent firewall using Proxy ARP Technology (gw: a. B. c.1)
| _____ |
| Eth1: a. B. c.2 (the same IP address can be used on both sides to save IP addresses)
|
_____________ | ____________
|
__|__ _ | _
Mail relay | A | ip: a. B. c.3 | B | C |
Web proxy | gw: a. B. c.1 | ___ |
| _____ | WEB DNS
| Ip: a. B. c.4 IP: a. B. c.5
_ Intranet _____ _ | gw: a. B. c.1 gw: a. B. c.1
192.168.1.0/24 |
__| __
| D |
| Mail |
| _____ |
　　
　　
Note:
1. a firewall F protects the entire DMZ zone and internal network. the same IP address a. B. c.2 can be used on both sides.
2. Transparent firewall F is on both sides of the same network segment, and the IP address and Gateway settings of the protected machine are the same as those when there is no transparent firewall, which is transparent to the protected server and external users. When the firewall F is removed, the entire network can still work.
3. server A is connected to the internal network as the proxy server to share the Internet, and Sendmail is configured as the email server D on the intranet as the Mail relay.
4. server A can also directly connect to the Router, which is the same as server F. In this way, you must set firewall rules for server A separately.
5. if only server F is connected to the vro, you only need to use a crossover cable to link the vro without using a HUB or Switch.
6. you can also merge A to F, so that three NICs on F need to be connected to both DMZ and internal network.
　　
4. how to set Proxy ARP?
　　
Redhat 7.2 already has iproute2. Use the # ip route command instead of the previous # route command
Assume that the IP address obtained from the ISP is. b. c.0/28 can have. b. c.0-15 a total of 16 IP addresses are available, but. b. c.0 (network address) and. b. c.15 (broadcast address) is unavailable, so the actual available IP address is. b. c.1-14 a total of 14 IP addresses.
　　
A. During installation, set the IP addresses of eth0 and eth1 to a. B. c.2, and the default gateway is a. B. c.1.
B. run the following command after startup or put/etc/rc. d/rc. local
Ip route del a. B. c.0/28 dev eth0
　　
Ip route add a. B. c.1 dev eth0
　　
Echo 1>/proc/sys/net/ipv4/conf/eth0/proxy_arp
Echo 1>/proc/sys/net/ipv4/conf/eth1/proxy_arp
　　
Echo 1>/proc/sys/net/ipv4/ip_forward
　　
　　
Finally, when you run the ip route command, you should see the output similar to the following.
　　
A. B. c.1 dev eth0 scope link
A. B. c.0/28 dev eth1 proto kernel scope link src a. B. c.2
127.0.0.0/8 dev lo scope link
Default via a. B. c.1 dev eth0
　　
C. I ping all the machines and routers in the DMZ area from the firewall F, and then make sure that you can ping the routers from the web and DNS,
If you add a later Transparent firewall, you may have to wait for a long time to let the router know that you are using the Proxy ARP,
Eventually, the vroarp clears its ARP cache. if possible, turn off the power of the vro and enable it to clear the ARP cache more quickly.
　　
D. The time for different Linux kernels to respond to the new ARP cache varies, and the Linux 2.4 kernel is faster.
　　
E. of course, you can also use different IP addresses on both ends of Transparent firewall F.
　　
　　
V. Other applications
　　
　　
The following is a Proxy ARP application in another case.
　　
On the company's Lan, there are two database servers that you need to protect separately. you can add a Transparent firewall without modifying any existing IP address settings, similar to the above principle, such.
　　
　　
　　
Ip: 192.168.1.201
　　
Gw: 192.168.1.1
　　
| Database1 | _______
| __________ Eth1 | F2 | eth0 ____________ | F1 | corporate firewall
| |____ | ___ | 192.168.1.1
| Database2 | internal proxy arpfirewall
　　
Ip: 192.168.1.202
Gw: 192.168.1.1
　　
　　
　　
The procedure is as follows:
1. set the same IP address for both ends of F2 as 192.168.1.200, and the default gateway is 192.168.1.1.
　　
2. run
Ip route del 192.168.1.0/24 dev eth1
　　
Ip route add 192.168.1.201 dev eth1
Ip route add 192.168.1.202 dev eth1
　　
Echo 1>/proc/sys/net/ipv4/conf/eth0/proxy_arp
Echo 1>/proc/sys/net/ipv4/conf/eth1/proxy_arp
　　
Echo 1>/proc/sys/net/ipv4/ip_forward
　　
3. ensure that the database server can ping the server at the other end of the proxy arpfirewall, and then set specific firewall rules on F2.