Minicluster:Firewall
The firewall can use IPTables to forward packets between the Internet and the internal network. IPTables is the interface to changing the built in netfilter firewall built into the Linux kernel. We'll also use IPTables to forward SSH requests for the firewall to the head node, making the firewall transparent. (Users of the cluster should interact with the head node, not the firewall.)
For my example (see Network Topology), this means that users will see something like the following. They specify the address of my firewall, eyrie, but then are deposited onto gyrfalcon, my head node.
kwanous@cassowary:~$ ssh eyrie.X.X.edu kwanous@eyrie.X.X.edu's password: Linux gyrfalcon 2.6.18-4-486 #1 Wed May 9 22:23:40 UTC 2007 i686 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. kwanous@gyrfalcon:~$
Índice
Configurando IPTables
- IPTables geralmente é configurado direto na linha de comando (e não de um arquivo). Para que mudanças permaneçam depois de um reboot, um script deve ser rodado na inicialização (usado para DNAT e SNAT translation). Crie o arquivo
[root@one]$ vi /etc/init.d/local #!/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin NAME=local DESC="local services" # Replace this with your firewall's static IP EXTERNIP="X.X.X.X" # The IP address of the internal machine that will respond to SSH requests SSHHOST="192.168.1.200" # The IP range of the internal network LOCALNET="192.168.1.0/24" case "$1" in start) iptables -t nat -A POSTROUTING -d ! ${LOCALNET} -j SNAT --to ${EXTERNIP} iptables -t nat -A PREROUTING --dst ${EXTERNIP} -p tcp --dport 22 -j DNAT --to-destination ${SSHHOST} echo 1 > /proc/sys/net/ipv4/conf/all/forwarding ;; stop) echo 0 > /proc/sys/net/ipv4/conf/all/forwarding iptables -t nat -F ;; *) N=/etc/init.d/$NAME echo "Usage: $N {start|stop}" >&2 exit 1 ;; esac exit 0
Troque a permissão
[root@one]$ chmod +x local
- Crie um link simbólico (adaptar fedora). Symlinks que iniciam com S são executados com argumento
start
e os que iniciam com K são executados comstop
. O scriptlocal
precisa ser executado antes do script networking (S40networking
), assim deverá serS39
.
ln -s /etc/init.d/local /etc/rcS.d/S39local
ou
ln -s /etc/init.d/local /etc/rc2.d/S39local # 2 3 4 5 ???
Entendendo os comandos Iptables
Algumas variáveis foram setadas anteriormente.
- $LOCALNET
- deve ser o IP range da rede local com a máscara CIDR.
- $EXTERNIP
- deve ser o IP para a interface externa da firewall.
- $SSHHOST
- deve ser o IP do nó mestre.
Source Network Address Translation (SNAT)
O primeiro comando faz o SNAT - traduz pacotes gerados por computadores na interface interna para sairem para a internet. Qualquer máquina vendo pacotes na internet do cluster verão eles como vindo da firewall e irão responder para a firewall. Ao invés de aceitar os pacotes, a firewall envia eles para dentro da rede.
iptables -t nat -A POSTROUTING -d ! ${LOCALNET} -j SNAT --to ${EXTERNIP}
-
-t nat
specifies that this rule's type is network address translation (NAT), aka IP masquerading -
-A POSTROUTING
appends a rule to thePOSTROUTING
chain, meaning it will be processed after all the other possible processing has been done -
-d ! ${LOCALNET}
means any packets destined for an IP not within${LOCALNET}
-
-j SNAT
means to jump to the SNAT rule -
--to ${EXTERNIP}
specifies that any packets leaving will assume the IP${EXTERNIP}
All together in English, this rule says to take any packets not destined for sources within the internal network and send them out to their destination on the outside network after changing the source destination IP address to the firewall's IP.
Destination Network Address Translation (DNAT)
This rule does just the opposite. It takes SSH packets coming in from the Internet and sends them along to the head node.
iptables -t nat -A PREROUTING --dst ${EXTERNIP} -p tcp --dport 22 -j DNAT --to-destination ${SSHHOST}
-
-t nat
specifies network address translation (NAT), aka IP masquerading -
-A PREROUTING
appends a rule to thePREROUTING
chain, meaning that this will take affect before any rules have a chance to work on the packet -
--dst ${EXTERNIP}
specifies original the destination of the packet (to the firewall) -
-p tcp
specifiestcp
as the protocol -
--dport 22
specifies the destination port of the packet -
-j DNAT
means to jump to the rule DNAT to do the destination network address translation
In English, this means to take any packets addressed to the firewall that are TCP packets on port 22 (SSH), change their destination to the head node, and forward them on to the internal network. This could be changed to forward all tcp packets inside by removing --dport 22
, but a firewall that forwards everything inside the internal network wouldn't be much of a firewall.
Starting and Stopping NAT
Since the local
script has been symlinked into the /etc/rcS.d/
or /etc/rc2.d/
directory, it will automatically load at boot. To start and stop the script from the command line, use
/etc/init.d/local start
or
/etc/init.d/local stop
Since this script is responsible for allowing the nodes inside the firewall their Internet access, be advised that stopping this script will kill the Internet connection to any machines behind the firewall.
References
- Kirch, Olaf, and Terry Dawson. Linux Network Administrator's Guide. 2nd ed. Sebastopol, CA: O'Reilly Media, Inc., 2000.
- Brockmeier, Joe "Zonker", Dee-Ann LeBlanc, and Ronald W. McCarty, Jr.. Linux Routing. 1st ed. Indianapolis: New Riders, 2001.
- http://www.5dollarwhitebox.org/wiki/index.php/Howtos_Basic_IPTables
- http://www.linux-mag.com/id/282/