Use FreeBSD firewall to protect enterprise networks

Let's take a look at how to use the established FreeBSD firewall to protect enterprises. Assume that an enterprise has the following servers and workstations:

1. There are two WEB servers, one on the Enterprise homepage and one on the BBS. We hope the IP addresses are xxx. xxx. xxx.001 and xxx. xxx. xxx.002.
2. One DNS server and enterprise e-mail service. The IP address is xxx. xxx. xxx.003, resolve www.testdomain.com to xxx. xxx. xxx.001 and bbs.testdomain.com are parsed to xxx. xxx. xxx.002
3. There are N local networks and computers in the enterprise. The IP addresses are 10.125.0.0 to 10.125.255.255.

For such an enterprise, we must first design the network architecture and take into account the locations of servers and internal networks at the same time to better cooperate with the firewall, so that the firewall can fully protect each part.
First, let's analyze the methods and methods of hacker intrusion. As an intruder, his first step is to find the position of the target enterprise on the network, suppose he knows that the enterprise does not use the host hosting service, but is put together with the enterprise's network, then he only needs to ping the home page of the enterprise to know that the IP address of the enterprise is xxx. xxx. xxx.001 and xxx. xxx. xxx.002, and there is also a DNS server, you can also use tools such as nslookup, you can find the target enterprise's DNS server is the address xxx. xxx. xxx.003, and he plans to, assuming that he has already entered one of the three servers, he will immediately analyze the network structure and access the Intranet to obtain internal network staff information and a lot of important data. We can see from the above that we need to do a lot to protect this network. First, we can try to isolate servers and between servers and internal networks, however, they can apply the functions they should have. Now we plan the enterprise's network as follows:

First, make sure that FreeBSD firewall is the only way for enterprises to connect to Internet servers. Then, set FreeBSD to enable its ipfirewall and NATD functions, I told you that we are putting WWW, BBS, DNS, and other servers internally for protection. Therefore, to enable the reverse proxy function of NATD in the firewall, we should first set xxx. xxx. xxx.001, xxx. xxx. xxx.002, xxx. xxx. xxx.003, bound to the FreeBSD external network card. Assume that the external network card number is fxp0, in the rc. in conf, we need to set the following:

Ifconfig_fxp0 = "inet xxx. xxx. xxx.001 netmask 255.255.255.0"
Ifconfig_fxp0_alias0 = "inet xxx. xxx. xxx.002 netmask 255.255.255.0"
Ifconfig_fxp0_alias1 = "inet xxx. xxx. xxx.003 netmask 255.255.255.0"
After the binding, we will start to analyze it now. First, let's look at the internal network. to access the Internet, we must have a gateway and make them use the network normally, assume that FreeBSD's internal Nic number is fxp1. add in conf:
Ifconfig_fxp1 = "inet 10.125.0.1 netmask 255.255.0.0"
Add the following to the firewall rules:
Divert 8668 ip from any to any via fxp0
This rule allows the NATD service and only allows the NATD service. You must set the internal network to connect to the Internet. We add:
Allow ip from any to 10.125.0.0/16
Allow ip from 10.125.0.0/16 to any

Set Gateway to 10.125.0.1 for the internal network, so that the internal network of the enterprise can connect to the Internet normally.
Then let's take a look at the WWW server. Generally, this server only needs to open three ports. The first port is naturally the HTTP port, and the second port is the ftp port and ftp data port, specifically, the HTTP port is the port that allows access on the Internet and within the enterprise, while the FTP port is used to update the home page or do other things, and it is sufficient only for internal staff to access it, if necessary, open the telnet or ssh port to facilitate remote management by the internal system administrator. We recommend that you use ssh to prevent intrusion, he may want to attack other machines. I decided to separate the WWW server. Now, if FreeBSD's internal Nic number is fxp1, edit rc. conf file, plus:

Ifconfig_fxp1_alias0 = "inet 10.80.0.1 netmask 255.255.255.0"

Then we set the WWW server to the 10.80 network segment, and the gateway is 10.80.0.1. In this way, the WWW server is allocated separately in a special region, suppose we set the IP address of WWW to 10.80.0.80. Now we will set the firewall rules again:

Allow tcp from any to xxx. xxx. xxx.001 80 in
Allow tcp from xxx. xxx. xxx.001 80 to any out // allow any part of the firewall to access 80
Allow tcp from 10.80.0.80 80 to any out
Allow tcp from any to 10.80.0.80 80 in // allow access to port 80 of the WWW Server Anywhere
Allow tcp from 10.125.0.0/16 to 10.80.0.80 21 in
Allow tcp from 10.125.0.0/16 to 10.80.0.80 20 in
Allow tcp from 10.80.0.80 21 to 10.125.0.0/16 out
Allow tcp from 10.80.0.80 20 to 10.125.0.0/16 out // allow the internal network to use the FTP server to connect to the WWW Server

You still need to set NATD after setting firewall rules. We set NATD:
Redirect_port tcp 10.80.0.80: 80 xxx. xxx. xxx.001: 80

In this way, the WWW server allows internal staff to smoothly update the home page and browse the home page, while the Internet can only browse the home page on the WWW server, even if the WWW server intruded into the server by using the HTTP server, all the connections to the server were blocked by the fire wall, and the Intranet of the enterprise could not be intruded or damaged, to fully protect WWW servers and internal networks.

Now let's analyze the DNS server. Because the BBS server and WWW server are essentially the same, we will not discuss it here. The DNS server naturally needs to provide the DNS server, that is, the UDP53 port, because the MAIL function is also provided, the SMTP port and POP3 port must be opened, while the POP3 server can only be accessed by internal enterprises. conf:
Ifconfig_fxp1_alias0 = "inet 10.80.2.1 netmask 255.255.255.0"
Then, set the IP address of the DNS server to 10.80.2.53 and the firewall rule:

Allow udp from any to xxx. xxx. xxx.003 53 in
Allow udp from xxx. xxx. xxx.003 53 to any out // allow access to port 53 of the firewall anywhere
Allow tcp from any to xxx. xxx. xxx.003 25 in
Allow tcp from xxx. xxx. xxx.003 25 to any out // allow access to the smtp port of the firewall anywhere
Allow udp from 10.80.2.53 to any out
Allow udp from any to 10.80.2.53 in // allow access to port 53 of the DNS server anywhere
Allow tcp from any to 10.80.2.53 25 in
Allow tcp from 10.80.2.53 25 to any out // allow access to the SMTP port of DNS anywhere
Allow tcp from 10.125.0.0/16 to 10.80.2.53 110 in
Allow tcp from 10.80.2.53 110 to 10.125.0.0/16 out // allow internal enterprise Access to the POP3 port of DNS
Set NATD:
Redirect_port udp 10.80.2.53: 53 xxx. xxx. xxx.003: 53 // convert 53 of 10.80.2.53 to 53 of xxx. xxx. xxx.003 and use UDP.
Redirect_port tcp 10.80.2.53: 25 xxx. xxx. xxx.003: 25 // Switch 25 of 10.80.2.53 to 25 of xxx. xxx. xxx.003 and use TCP.

After the enterprise network is configured according to the above rules, the enterprise network protection is more rigorous, and strict control is imposed between the server and the internal network of the enterprise. Of course, internal intrusion and IP address theft are not considered here, which is the limitation of FreeBSD firewall. However, you can add a network card to isolate the network of internal personnel of the enterprise with a network card to make up for it.

Well, the above is my personal practice of using FreeBSD firewall to protect enterprise networks. I hope it can help some enterprise network administrators. Article entry: csh responsible editor: csh