Firewall zones set the foundation for a security policy. Vyatta will group your network into different zones.
Table of contents
Real-world use case
You need to apply a consistent security policy between your networks: here's how to configure firewall zones with Vyatta.
Vyatta: zone policy
In this article, I'm using version 6.6R1 of Vyatta.
Most of this article is based on the official documentation.
Zone-policies let you define access: inbound and outbound.
By default, they accept no inbound or outbound traffic, which is why zones are paired with strict and precise firewall rules.
The goal is to allow or deny certain network traffic flows between them: for example, a DMZ.
And if you're used to talking about green, red, orange, blue, then hold on tight! Because colored interfaces don't exist in Vyatta, at least not in that way.
Note that the idea of a red or green interface is just a convention, not a restriction.
Conventional diagram of the different zones
The network follows an internal security policy. Each zone uses one or more interfaces with precise firewall rules between them.
Summary:
Internet network zone: eth0, eth1
Demilitarized zone: eth2
Local network zone: eth3
Local VPN zone: LOCAL-ZONE
Why do I use 2 cards (eth0 and eth1) instead of just one? Simply because I lease routed addresses on the internet.
Don't forget your NAT and DHCP rules explained in this article.
Configuring zones + firewalls in Vyatta:
Internet network zone with firewalls:
set zone-policy zone internet
set zone-policy zone internet description "internet"
set zone-policy zone internet default-action drop
set zone-policy zone internet interface eth0
set zone-policy zone internet interface eth1
set firewall name internet_trafic
set firawall name internet_trafic default-action accept
set firewall name internet_trafic description "Allow internet traffic"
set firewall name internet_trafic rule 1 action accept
set firewall name internet_trafic rule 1 state established enable
set firewall name internet_trafic rule 1 state related enable
Demilitarized zone with firewalls:
set zone-policy zone dmz
set zone-policy zone dmz description "dmz"
set zone-policy zone dmz default-action drop
set zone-policy zone dmz interface eth2
set firewall name internet_vers_dmz
set firawall name internet_vers_dmz default-action drop
set firewall name internet_vers_dmz description "filter internet traffic to dmz"
set firewall name internet_vers_dmz rule 1 action accept
set firewall name internet_vers_dmz rule 1 destination addresse X.X.X.X (your server's address)
set firewall name internet_vers_dmz rule 1 destination port 80,443
set firewall name internet_vers_dmz rule 1 protocol tcp
LAN zone with firewalls:
set zone-policy zone lan
set zone-policy zone lan description "lan"
set zone-policy zone lan default-action drop
set zone-policy zone lan interface eth3
set firewall name lan_vers_dmz
set firewall name lan_vers_dmz description "Allow lan to dmz"
set firewall name lan_vers_dmz rule 1 action accept
set firewall name lan_vers_dmz rule 1 destination adresse X.X.X.X (your server's address)
set firewall name lan_vers_dmz rule 1 destination port 22,80,443
set firewall name lan_vers_dmz_rule 1 source adresse X.X.X.X/X (lan network address)
set firewall name lan_vers_dmz rule 1 protocol tcp
set firewall name lan_vers_dmz rule 2 action accept
set firewall name lan_vers_dmz rule 2 icmp type-name any
set firewall name lan_vers_dmz rule 2 protocol icmp
set firewall name lan_vers_vyatta rule 1 action accept
set firewall name lan_vers_vyatta rule 1 destination adresse X.X.X.X/X (lan network address)
set firewall name lan_vers_vyatta rule 1 source adresse X.X.X.X/X (vpn network address)set firewall name lan_vers_dmz rule 1 protocol tcp
set firewall name lan_vers_vyatta rule 2 action accept
set firewall name lan_vers_vyatta rule 2 icmp type-name any
set firewall name lan_vers_vyatta rule 2 protocol icmp
Vyatta VPN zone with firewalls:
set zone-policy zone vyatta
set zone-policy zone vyatta description "vyatta local-zone"
set zone-policy zone vyatta interface local-zone
set firewall name vpn_vers_vyatta
set firawall name vpn_vers_vyatta default-action accept
set firewall name vpn_vers_vyatta description "filter inbound traffic to vyatta"
set firewall name vpn_vers_vyatta rule 1 action drop
set firewall name vpn_vers_vyatta rule 1 destination addresse X.X.X.X (your public eth1 interface's address)
set firewall name vpn_vers_vyatta rule 1 protocol tcp_udp
set firewall name vpn_vers_vyatta rule 2 action drop
set firewall name vpn_vers_vyatta rule 2 destination adresse X.X.X.X (your public eth0 interface's address)
set firewall name vpn_vers_vyatta rule 2 destination port 53
set firewall name vpn_vers_vyatta rule 2 protocol tcp_udp
Adding firewall rules to zones:
Allow traffic from the internet zone to the dmz:
set zone-policy zone internet from dmz firewall name internet_trafic
Allow traffic from the dmz zone to the internet:
set zone-policy zone dmz from internet firewall name internet_vers_dmz
Allow traffic from the internet zone to the lan:
set zone-policy zone internet from lan name internet_trafic
Allow traffic from the dmz zone to the lan:
set zone-policy zone dmz from lan name lan_vers_dmz
Allow traffic from the vyatta zone to the internet:
set zone-policy zone vyatta from internet firewall name vpn_vers_vyatta
Allow traffic from the lan zone to vyatta:
set zone-policy zone lan from vyatta firewall name lan_vers_vyatta
Zone-policies and firewall rules hold no more secrets for you!