Cheap VPS & Xen Server

Residential Proxy Network - Hourly & Monthly Packages

Using Firewall Builder To Configure Router Access Lists


Firewall Builder is a firewall configuration and management GUI that supports configuring a wide range of firewalls from a single application. Supported firewalls include Linux iptables, BSD pf, Cisco ASA/PIX, Cisco router access lists and many more. The complete list of supported platforms along with downloadable binary packages and soure code can be found at http://www.fwbuilder.org.

This tutorial is the first in a series of howtos that will walk through the basic steps of using Firewall Builder to configure each of the supported firewall platforms. In this tutorial we will configure Access Control Lists (ACL) on a Cisco router.

The diagram below shows a simple 2 interface router configuration with the router acting as a gateway to the Internet for a private LAN network.

example_router

We will use Firewall Builder to implement the following basic rules as access lists on the router.

  • Allow inside traffic (10.0.0.0/24) through the router to any Internet address for the HTTP and HTTPS protocols
  • Allow inside traffic (10.0.0.0/24) through the router to a specific IP address (198.51.100.1) for the POP3 protocol.
  • Allow inside traffic (10.0.0.0/24) to the router’s inside interface (FastEthernet0/1) for the SSH protocol.
  • Block all incoming traffic to the rotuer’s outside interface FastEthernet0/0.

Note that Cisco router access lists have an implicit deny all at the end of every access list, so anything that we do not setup a rule to explicitly permit will be denied.

The NAT configuration on the router is as follows:

interface FastEthernet0/0
ip nat outside

interface FastEthernet0/1
ip nat inside

access-list 1 permit 10.0.0.0 0.0.0.255

ip nat inside source list 1 interface FastEthernet0/0 overload

 

Step 1: Create Network Objects

We are going to start by creating the objects that will be used in the rules. Firewall Builder includes hundreds of predefined objects, including most standard protocols, so to implement the rules above we will only need to create the objects that are specific to our network. For our rules this means we need to create objects for the internal 10.0.0.0/24 network and for the POP3 server with an IP address of 198.51.100.1.

 

Create a New IP Network Object

To create the object that will represent our internal 10.0.0.0/24 network in the left hand tree double-click the folder labeled Objects to expand it. Right click on the folder called Networks and select “New Network”. This creates a new network object. In the lower portion of your screen, called the Editor Panel, you can modify the properties of this object.

Change the object name to something that matches the function, in this example we are going to call it “Internal Networks” to represent the local LAN IP addresses. The address is set to 10.0.0.0 and the netmask is 255.255.255.0.

new_network

NOTE: When editing the attributes of an object there is no Apply or Submit button. Once you edit an attribute as soon as you move away from the field you were editing the change will take effect immediately.

 

Create a New IP Address Object

Repeat this process to create an object that will represent the POP3 email server that will be used in rule #2. Go to the object tree and right-click on the Addresses folder and select New Address. In the Editor Panel change the name of the object to “POP3 Server” and set the IP address to 198.51.100.1.

new_address_steps

Step 2: Define The Router

Firewall Builder refers to devices that support filtering rules as firewalls. To create a firewall object to represent your router click on the “Create new firewall” icon on the main window of Firewall Builder. This will launch a wizard that walks you through creating your router.

Enter a name for the firewall object, in this example we will use la-rtr-1. Change the drop down menu for software that is running on the firewall to be “Cisco IOS ACL”.

create_router

Click the Next > button to continue the wizard.

When creating a firewall in Firewall Builder you have a choice of configuring interfaces manually, or you can use SNMP discovery if you have SNMP enabled on your router and you have access to a Read-Only or Read-Write community string. For this example we are going to configure the router interfaces manually.

interface_discovery

Click the Next > button to continue to the next step.

The firewall that you create in Firewall Builder needs to match the router that you want to deploy the access lists on. This means that the interface names and IP addresses in the firewall object that you are creating must match exactly to what is configured on the router.

Click the green green_plus icon to add a new interface to the router. Enter the name of the router exactly as it is shown on a router command line when you run “show ip interfaces brief” command. In this example our interfaces are FastEthernet0/0 and FastEthernet0/1.

Set the interface name as FastEthernet0/0 and set the label to outside. Click on the Add address button and set the IP address to 192.0.2.1 with a netmask of 255.255.255.240.

interface_address

Click the green green_plus icon to add another interface to the router. Enter the information in to the wizard to match the second interface as follows:

interface_address2

Click on the Finish button.

After you create the firewall object that represents the router that you will be installing the access lists on it will be displayed in the object tree on the left side. The Policy object, which is where the access list rules are configured, is automatically opened in the main window.

firewall_object_tree

Before moving on we should save our data file that contains the new firewall object that we just created. Do this by going to the File -> Save As menu item. Choose a name and location to save this file to.

Getting Started: Configuring Cisco Router ACL

Reminder – In this tutorial we are configuring access lists on a router that has the following interface configuration.

example_router

Our goal is to implement the following four rules as access control lists on the router.

  • Allow inside traffic (10.0.0.0/24) through the router to any Internet address for the HTTP and HTTPS protocols
  • Allow inside traffic (10.0.0.0/24) through the router to a specific IP address (198.51.100.1) for the POP3 protocol.
  • Allow inside traffic (10.0.0.0/24) to the router’s inside interface (FastEthernet0/1) for the SSH protocol.
  • Block all incoming traffic to the router’s outside interface (FastEthernet0/0).

Step 3: Configure Access Lists

After we created the firewall object la-rtr-1 it was automatically opened in the object tree and its Policy object was opened in the main window for editing. The Policy object is where access list rules are configured.

To add a new rule to the Policy, click on the green green_plus icon at the top left of the main window. This creates a new rule with default values set to deny all.

default_rule

In Firewall Builder everything is based on the concept of objects. To configure rules that will be converted in to access lists you simply find the object you want in the tree and drag-and-drop it to the correct section of the rule.

The first rule in our example is to allow internal network traffic to use the HTTP and HTTPS protocols to access the Internet. In configuration the router is NAT’ing the internal network to the IP address on the FastEthernet interface. Since the order of operations on Cisco routers is that NAT takes place before the outbound access list is checked the Source for the outbound rules must be the post-NAT IP address which is represented by the IP interface object under the outside FastEthernet0/0 interface.

new_rule_source

After you drop the interface IP object into the rule the Source section will change from Any to la-rtr-1:FastEthernet0/0:ip.

rule_step1

Since we want this rule to allow traffic to the Internet we will leave the Destination object set to Any. The Any object in Firewall Builder is the same as the “any” parameter in Cisco CLI commands for access lists.

Next we want to define the protocols or services this rule will allow. The example calls for the HTTP and HTTPS services to be allowed out to the Internet.

Firewall Builder comes with hundreds of predefined objects including almost all standard protocols. To access these objects switch to the Standard library by selecting it from the drop down at the top of the Object tree window.

switch_library

After you have switched to the Standard library you can navigate to the HTTP service by opening the Services folder, then opening the TCP folder and scrolling down until you find the http object.

Once you find the http object, drag-and-drop from the tree on the left in to the Service section of the rule in the Rules window.

new_rule_service

Repeat this process to add the HTTPS service to the rule. Drag-and-drop the https object from the tree on the left to the Service section of the rule in the Rules window.

NOTE: Notice that you can have more than one service in a single rule. Firewall Builder will automatically expand this rule in to multiple rules in the Cisco command syntax.

IMPORTANT! To access the objects you previously created, including the router, you need to switch back to the User library. Do this by going to the drop down menu at the top of the object tree panel and switch the selected library from Standard to User.

Due to the NAT configuration that is setup on the router traffic from the 10.0.0.0/24 network will be NAT’ed by the router to its outside IP address (192.0.2.1). This means the traffic that we want to match with our rule will be sent out the FastEthernet0/0 interface. Set the interface in the rule by dragging-and-dropping the FastEthernet0/0 interface object from the tree to the Interface section of the rule.

new_rule_interface

Traffic will be going in the outbound direction on this interface, so we right-click in the Direction section and select Outbound. We want this traffic to be allowed, so we need to change the Action associated with this rule from Deny to Accept. Do this by right-clicking on the Action section of the rule an selecting Accept. Finally, since this is a rule that we expect to match a lot of traffic disable logging by right-clicking in the Options section and selecting Logging Off. You should now see a rule that looks like:

new_rule_complete

The next rule in our example allows the internal network to access an external POP3 server. Click on the rule you just created and then right-click in the rule number section and select “Add New Rule Below”.

add_new_rule_below

To access the objects that we created earlier we need to switch back to the User library. Click on the drop down menu that says Standard and select User from the list. Drag-and-drop the IP address object for the router’s outside inteface from the tree on the left to the rule you just created placing it in the Source section.

NOTE: You can also copy-and-paste objects. For example, you can right-click on the la-rtr-01:FastEthernet0/0:ip object in the first rule and select Copy. Navigate to the Source section of the new rule you just created and right-click and select Paste.

This rule requires both the Source and Destination to be set, so go to the Addresses folder and drag-and-drop the POP3 Server object to the Destination section of the rule.

The POP3 protocol object is located in the Standard library, so select it from the dropdown menu at the top of the Object Window. To find the POP3 object you can scroll down through the object tree, or you can simply type pop3 in to the filter field. This will display all objects in the current library that contain pop3.

pop3_filter

Drag-and-drop the filtered object from the tree to the Sevice section of the rule you are currently editing. Clear the filter field by clicking the X to the right of the input box and then switch back to the User library by selecting it in the dropdown menu at the top of the object panel.

To set the interface the rule should be applied to drag-and-drop the “outside” interface FastEthernet0/0 to the Interface section of the rule.

To change the Action to Accept right-click in the Action section of the rule and select Accept. To disable logging for this rule, right-click on the Options section and select Logging Off.

You should now have 2 rules that look like this:

two_rules

Now we need to add our 3rd rule. This rule is designed to allow SSH traffic from the internal network to the router’s inside interface.

Create a new rule below the last rule by selecting the last rule and right-clicking and selecting Add New Rule Below from the menu. This will create a new rule configured with the default values to deny all.

Modify this rule by dragging-and-dropping the Internal Network object from the tree to the Source section of the newly created rule. To restrict the rule to only allow traffic destined to the IP address of the router’s FastEthernet1/0 interface, double-click on the firewall object’s FastEthernet1/0 interface to expand it. Drag-and- drop the IP address of the interface to the Destination section of the rule.

To set the service to SSH switch to the Standard library by selecting it from the dropdown menu above the object tree and then type in “ssh” in the filter box. Drag-and-drop the ssh object from the tree to the Service section. Clear the filter by clicking on the X next to the filter input text box.

Switch back to the User library by selecting it from the dropdown menu above the object tree. Double click the la-rtr-1 object to expand it and drag-and-drop the FastEthernet1/0 interface to the Interface section of the rule.

Since this rule only applies to inbound traffic on this interface set the direction to Inbound by right-clicking in the Direction section and selecting Inbound. Finally, change the action for the rule by right- clicking on the Action section and selecting Accept. Since this rule defines access to the router via SSH we will leave logging enabled for this rule.

You should now have 3 rules that look like:

five_rules

Finally, we need to add a rule to the router’s outside interface that blocks all traffic trying to access the router directly on its outside interface IP address.

To do this we follow the same process from the earlier examples. Since this rule should match all traffic coming from the Internet we leave the Source section as Any. Set the Destination section by dragging-and-dropping the IP address object for outside interface FastEthernet0/0. We want to block all serices, so leave the Service section set to Any. We want this rule to match incoming traffic, so we right-click in the Direction section and select Inbound. The desired Action is to deny the traffic, so we leave that as the default. Finally since this rule will potentially match a lot of traffic we disable logging by right-clicking on the Options section and selecting Logging Off.

We are now done configuring the rules for our access lists and the configuration should look like:

six_rules

In the next section we will go through the process of converting these rules in to Cisco commands and installing them on the router.

Getting Started: Configuring Cisco Router ACL

example_router

For the following sections we are going to assume that the following rules have been defined for the router configuration shown above.

six_rules

Step 4: Compile and Install

In Firewall Builder the process of converting the rules from the Firewall Builder GUI syntax to the target device commands is called compiling the configuration.

To compile, click on the Compile icon which looks like a hammer . If you haven’t saved your configuration file yet you will be asked to do so. After you save your file a wizard will be displayed that lets you select which firewall(s) you want to compile. In this example we are going to complie the firewall called la-rtr-1 configured with the rules above.

If there aren’t any errors, you should see some messages scroll by in the main window and a message at the top left stating Success.

To view the output of the compile, click on the button that says Inspect Generated Files. This will open the file that contains the commands in Cisco command format. Note that any line that starts with “!” is a comment.

compiler_output

The output from the compiler is automatically saved in a file in the same directory as the data file that was used to create it. The generated files are named with the firewall name and a .fw extension. In our example the generated configuration file is called la-rtr-1.fw. You can copy and copy and paste the commands from this file to your router or you can use the built-in Firewall Builder installer.

 

Installing

Firewall Builder can install the generated configuration file for you using SSH. To use the installer we need to identify one of the router interfaces as the “Management Interface”. This tells Firewall Builder which IP address to connect to on the router.

Do this by double-clicking the firewall object to expand it, and then double-clicking on the interface name that you want to assign as the management interface. In our case this is interface FastEthernet0/1 which is the interface connected to the internal network.

set_mgmt_interface

CAUTION! Any time you are changing access lists on your router you face the risk of locking yourself out of the device. Please be careful to always inspect your access lists closely and make sure that you will be able to access the router after the access list is installed.

To install your access lists on the router, click on the install icon . This will bring up a wizard where you will select the firewall to install. Click Next > to install the selected firewall.

install_checkbox

Firewall Builder will compile your rules converting them in to Cisco access list command line format. After the compile completes successfully click Next >. Enter your username, password and enable password.

install_screen

After the access list configuration is installed you see a message at the bottom of the main window and the status indicator in the upper left corner of the wizard will indicate if the installation was successful.

install_success

By default Firewall Builder will connect to your router using SSH and send the commands line-by-line to the router. Depending on the size of your access lists this can be slow.

If your router is running IOS version 12.4 you can select an option to have Firewall Builder scp the generated configuration file to the router instead of applying it line-by-line. This is much faster and is recommended if your router supports it.

This requires ssh version 2 to be enabled on the router and scp server to be enabled. You can find complete instructions for enabling SCP installation in the Firewall Builder Users Guide.

 

 

 

 

 

Comments

comments