As discussed in our article “Why Build a Linux Firewall“, there are many advantages to having a custom-built firewall appliance in your home. While these Linux distributions are easy to set up and have nice User Interfaces, they still have some problems. Not every feature of Linux is exposed in the GUI, so while these firewalls are very capable they don’t allow for simple customization, which is probably best for the home user.
Sometimes you need to open up an advanced feature here and there, and the need for these expose themselves when you are running an Email server behind your firewall. One issue that seems to be more common today is the infection of viruses and malware that start broadcasting spam from your network. If you also run a web-based business, then your business IPs can get blacklisted and your email rejected… all because one of your users made a simple mistake.
Another issue to consider is how your email is sent through the firewall. Many email servers do an “MX lookup” when they receive mail in an effort to fight spam. If your mail doesn’t come from the same IP address as your registered MX record, then your mail will likely get dropped.
In this article we show you your options on making your network more secure, and how to preserve your online reputation with a little customization of your Linux firewall. While we use IPcop (downloadable here), many of these tips work on just about any firewall that uses IPtables.
On the next pages we look at some of these options…
People choose a Linux firewall distribution mainly for the features exposed in its interface. For those who aren’t complete Linux nerds, then you may be more comfortable using an add-on for IPcop called BlockOutTraffic, or BOT. This addon has a seamless GUI configuration that incorporates with IPcop’s interface rather well. You can set up restriction rules by MAC address, IP addresses and interfaces, as well as other constraints.
The main issue with BOT is that it is pessimistic in nature. By this I mean that it blocks ALL traffic until you set up rules to let it through. Right after installing it you must set up rules so a computer can manage your firewall, else you can’t connect to it at all (meaning reinstalling IPcop). Most people know the common ports to let through, but you’ll certainly run into issues where something just doesn’t work.
If you have custom Internet traffic needs (like web gaming) then you’ll find that none of these services will work. You must then scan your firewall logs to determine which ports you need to open in order for your application to work.
This seems like a lot of headache, but if you need additional security then you’ll just have to accept the fact that there will be headaches. It may have pessimistic rules, but it definitely prevents unwanted traffic from getting onto the Internet. Just be ready to play “tech support” to your family when none of their online games or email programs work.
A more elegant solution is to use IPtables. We look at that on the next page…
To ensure that no compromised computer on the inside of your firewall can sully your Internet reputation, you need to lock it down. If any computers on your internal networks gets a malicious virus or other malware, then you may unwittingly become a spammer, and may be banned as such. A more elegant method of blocking unwanted outgoing traffic is to use IPtables. Unfortunately, there is no GUI interface within IPcop to update this file, so we’ll have to SSH into our Firewall and edit some files. Don’t worry, I’ll walk you through it, and if I can do it without blowing things up then you can.
First, open IPCop’s web interface, and then navigate to System –> SSH Access. Click the checkbox that says “SSH Access”. For security purposes, this should only be on while you are actively doing maintenance. If it was already on, then shame on you.
Next, you’ll need a terminal emulator. Many people use PuTTY (download here) because it’s free and easy to use. In the Host Name, enter the internal IP address of your IPcop firewall (in my case 192.168.1.1). By default, IPcop uses port “222” instead of “22”, so enter “222” in the Port field and click “Open”.
You’ll get a text screen asking you to login. Login as “root” and supply the root password you set up when you installed IPcop.
We need to navigate to the rc.firewall.local file so that we can edit it. You don’t have to know any fancy Linux commands… we can navigate using the same ones used by DOS.
- Type “cd /etc” and press enter
- If you type “dir” then you’ll see the “rc.d” directory in blue (blue text means it’s a directory)
- Type “cd rc.d” and press enter
- If you type “dir” then you’ll see the rc.firewall.local file, which we’ll be editing.
There are two common Linux text editors, “vi” and “nano”. I prefer nano because it is much more usable. - Type “nano rc.firewall.local” and press enter
You may want to resize your Putty window to see all of the text, but what you’ll want to do is insert several lines of text right below the “## add your ‘start’ rules here” but before the two semicolons (“;;“). The rc.firewall.local file is a “modular” file that gets read by the rc.firewall file. This way you can add custom firewall rules without totally screwing everything up. What we want to do is insert some code that blocks all SMTP (port 25) traffic on the green network. Optionally, you may want to allow “trusted” computers to send SMTP mail, such as a PHP server on your orange network. Insert these lines of code, but replace the internal IP addresses with your own.
## add your 'start' rules here #allow smtp from some allowed ips (on orange network) /sbin/iptables -A CUSTOMFORWARD -p tcp -i eth2 -s 192.168.10.3 --dport 25 -j ACCEPT /sbin/iptables -A CUSTOMFORWARD -p tcp -i eth2 -s 192.168.10.3 --dport 465 -j ACCEPT # log stuff that is not the mail server (on green network) /sbin/iptables -A CUSTOMFORWARD -p tcp -i eth0 -s ! 192.168.10.4 --dport 25 -j LOG --log-prefix "SMT$ #/sbin/iptables -A CUSTOMFORWARD -p tcp -i eth0 -s ! 192.168.10.4 --dport 465 -j LOG --log-prefix "S$ # block all other outgoing SMTP traffic (on green network) /sbin/iptables -A CUSTOMFORWARD -p tcp -i eth0 -s ! 192.168.10.4 --dport 25 -j REJECT #/sbin/iptables -A CUSTOMFORWARD -p tcp -i eth0 -s ! 192.168.10.4 --dport 465 -j REJECT
I didn’t write this code, but I found this on the Internet here and modified it for my purposes. The “orange” part of the code allows additional servers on that IP address to send SMTP mail (port 25) and Secure SMTP mail (port 465). I want my web server (on IP 192.168.10.3) to be able to send SMTP mail, so I’ve added an exception here.
The “green” part of the code basically logs and blocks any traffic that is not the mail server (192.168.10.4) from sending SMTP traffic (port 25), but I’ve allowed Secure SMTP (port 465) by commenting out those lines). You will find that after this is implemented that email clients will no longer work, which is why I’ve left open Secure SMTP (delete the opening “#” character to make that line active. The goal here is to prevent viruses from making our web business look shady, and it is extremely unlikely that virus writers will use Secure SMTP, because they couldn’t send to just any mail server. If you want to play Network Nazi at home, then by all means block all mail traffic and force your wife and kids to use a webmail client… see how well that goes over.
Note that my Orange network is on “eth2”. If yours is different then you may have to change this (look it up in the web GUI click on Status –> Network Status). If you want to add restrictions to your “blue” (wireless) network, then just modify the lines so that “eth0” corresponds to your blue interface.
Once the code is entered, press Ctrl + X (the same thing as ^X) and nano will ask you if you want to save. Type “Y”, and it will ask you which file to write to. By default it is the same name (rc.firewall.local). Press Enter and you’ll be back at the command prompt.
Type “exit” and press enter. Putty will close.
Go back into IPcop’s web interface and turn off SSH access and click “Save”. Then you need to reboot your firewall for the changes to take affect.
Make sure your server’s MX records are correct or you’ll be identified as a spammer. On the next page we show you how to fix it…
The most elegant solution to the “mismatched MX records” problem would be to force the firewall to send out traffic on the appropriate Internet IP address for all servers. If traffic came from the NATed internal IP address of 192.168.10.4 then the firewall would send this traffic out on 61.56.223.4 (web.myserver.com) rather than the firewall’s IP address (61.56.223.2). This can be set up using IPtables, but must be edited in the rc.firewall file rather than rc.firewall.local.
Navigate to the same directory we were in before (/etc/rc.d) and type “nano rc.firewall” and press enter.
You need to look at the bottom of the “iptables_red()” section and insert some code right before the #outgoing masquerading line.
# all outgoing traffic should appear to come from the original server's IP
/sbin/iptables -t nat -A RED -s 192.168.10.3 -o $IFACE -j SNAT --to-source 61.56..223.3
/sbin/iptables -t nat -A RED -s 192.168.10.4 -o $IFACE -j SNAT --to-source 61.56.223.4
/sbin/iptables -t nat -A RED -s 192.168.10.5 -o $IFACE -j SNAT --to-source 61.56.223.5
# Outgoing masquerading
/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
Of course, change the internal IP (192.168.10.x) to your server’s IP and the external (61.56.223.x) to your server’s external internet IP. The goal of this code is to translate any port coming from any of these internal IPs on my DMZ to the same port on their corresponding Internet address. This would be the preferred method over updating your MX records to match your firewall, as it would remove all restrictions and still allow for MX lookups to not tag my mail as spam.
Once this is implemented, exit PuTTY, turn off SSH, and reboot your server. You should see all traffic coming from your internal servers being sent out on their registered internet addresses.
Ok, now your email clients are broken. The next page shows you how to fix them…
If you’ve implemented these rules on your firewall, then you’ll probably get a lot of complaints from your roomates, spouses, and children that they can no longer use their email clients. You have a few options:
- Insist that they use a webmail client
- Add exception rules for their particular IP
- Update their mail client to use Secure SMTP (or IMAP)
- Tell them to go screw themselves
Pretty much any response except Number 3 will ensure there is urine in next morning’s coffee. If you add an exception just for one computer, then you’ll still run into the same problem if that computer happens to get a virus, so I wouldn’t recommend doing that. Webmail already uses a web browser, so those ports (80 and 993) are probably already open and they would have no issues.
The best (and most transparent solution) for your end users is to update their mail client to use Secure SMTP (port 465) instead of SMTP (port 25). If their particular mail service supports IMAP, then you could do that, too. That way, users are more secure (and less likely to be hacked), anonymous SMTP traffic still gets blocked (a la viruses), and you still have a secure network. It’s win-win, baby.
In Control Panel, click on Mail. You can optionally do this in Outlook by clicking on “Tools” and “Accounts”. Modify their existing email account. You need to click on the “More Settings” button. In the new window, click on the “Advanced” tab and make the following changes:
- Change “Outgoing server (SMTP)” to “465”
- Change “Use the following type of encrypted connection” to “SSL”
- Click OK and save the changes
You can test the settings or try to send new email, but if you’ve done everything right then your users will never know there’s anything different.