The idea of this thread is to make a How To for the
"Perfect Firewall" configuration in sme-server.
All the problems related to :
MSN, ICQ, P2P, Mail etc, can be solved easily by doing this steps.
1-
Block outgoing traffic from internal network to Internet.
1.1- grant access to the SME-Server to the local network.
2- Make a list of the privileged mac/ip that need all the ports open (eg VoIP, Skype, Boss computer).
3- Make a list of the general services that can be accessed from Internet (web, smtp, 80, 443, ICMP, etc).
3,1- Establish a proxy that solves the web surfing.
3.2- Establish a proxy for mail.
4- Open the ports that are necessarily to day- to day working according to the terms 2, 3 above.
I´ve been working with this configuration that is so easy to setup on several
IPcop machines with
http://www.blockouttraffic.de/, and others with FreeBSD and ipfw for more than five years .
And is so effective, believe me I have three years with No viruses, No P2P, No Chat from internet, the only problems are with the USB memory sticks.
Now I'm trying to setup SME-servers to reduct machinery (electrical problems are coming) and with less machines the UPS systems can work better, less CO2, and smaller support-plants.
I think the SME-Server is fairly superior to the IPcop possibilities.
So I was reading the site but I can not easily find the doc that show me how to do this in an "elegant form"
My idea is:
-make a SCRIPT that blocks all the traffic from internal network (Green Network)to SME-Server
-make a SCRIPT that blocks all the traffic from internal network (Green Network)to Internet Access.
-make a list of the internal machines/networks that can be connected to the SME-Server. (default every machine in the Green Network)
-make a list of the "standard open ports" for all the machine in the network (eg POP3, IMAP, SMTP, ICMP)
-make a list of the "standard machines" that can access the "standard open ports" (default every machine in the Green Network)
This is the end of the configuration for everybody in the network,
Now we can make serveral groups that can access or reach the ports
-make a list of the "privileged open ports #x" for the "privileged machines" in the network (eg GRE, IPSEC, OVPN, VoIP, ect)
-make a list of the internal machines/networks that can reach "privileged open ports #x"
(the privileged machines are always the accountant, the VoIP machines, everybody that drives special info)
Then:
make a SCRIPT that reads the "standard open ports" and "standard machines" and write the correct configuration to the firewall script.
make a SCRIPT that reads the "privileged open ports #x" and the "privileged machines #x" and write the correct configuration to the firewall script.
As You can see we can drive easily several groups of machines,.and this tool for every network administrator that have to fight with P2P and Chat is solved since the beginning.
I was reading the dev-manual and tring to understand Iptables scripts. but I can not make work well.
So help is welcome to make this scripts avaiable to everybody.
Thanks in advance.
12 Replies
3293 Views