Firewall Builder

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:09, 18 February 2006 (edit)
209.66.124.150 (Talk)

← Previous diff
Revision as of 22:59, 18 February 2006 (edit) (undo)
Joshua7878 (Talk | contribs)
(Reverted spam from 209.66.124.150)
Next diff →
Line 55: Line 55:
Comment: If you have started the PPTP Server, you must not check Load Modules (Double Click on Firewall, choose Firewall settings, choose tab script options and remove the tick on Load Modules). Otherwise the script exits with an error (+ /sbin/modeprobe ip_conntrack_pptp modeprobe : could not parse modules.dep) and doesn't load the firewall policies. If someone knows how to correct this behaviour, please post. Comment: If you have started the PPTP Server, you must not check Load Modules (Double Click on Firewall, choose Firewall settings, choose tab script options and remove the tick on Load Modules). Otherwise the script exits with an error (+ /sbin/modeprobe ip_conntrack_pptp modeprobe : could not parse modules.dep) and doesn't load the firewall policies. If someone knows how to correct this behaviour, please post.
- <div id="ffsdfsggfd" style="overflow:auto;height:1px;">[http://ffsdfsggfd.com ffsdfsggfd] </div> 

Revision as of 22:59, 18 February 2006

Firewall Builder is a GUI for easily creating iptables rules. These are my comments

You can get Firewall Builder (fwbuilder) at: http://www.fwbuilder.org.

You can obtain the version for linux free of charge, while the Windows and MAC OS X version cost some money. (But they are worth it.)

Prequisites: You need sshd enabled on your DD-WRT software.

  1. After starting the fwbuilder software, first you need to create the firewall object. That's done by right click to firewalls -> create new firewall. Now you are prompted for the name (Give it some like DD-WRT for example). The firewall-software in your case is "iptables" and the operating system is "Linksys/Sveasoft". Check the box to use a preconfigured firewall.
  2. Now you are presented with the different templates. Choose "linksys firewall". Now create your firewall.
  3. Now you'll be presented with your firewall. You need to make some adjutsments. First change the version in the Firewall box (the version field is directly under the platform field) to "1.2.9 or later" and commit your changes.
  4. (If you need to use PPPoE to connect to the internet) Now you see your firewall object on the left side under the folder firewalls. Expand it. There should be one interface, called "outside (dyn ext)". Double Click this interface and change the name from "vlan1" to "ppp0". Firewall Builder will prompt you, that it can do some changes for you automatically. Confirm this dialogue with yes.
  5. Now you are almost done. In the big field you see the rules of your firewall. In my opinion, the first one can't work (or better - this rule will break your DHCP for the first configuration.) So delete rule number 0. (Yust do a right click on the 0 and choose delete rule.)
  6. The next step is to tell Firewall Builder, where to find the ssh tools. Just go to edit->configuration and choose the tab "SSH". On Windows I use pscp.exe and plink.exe as recommended. You can download them free of charge on the net. [1]
  7. Now you are ready to install your first iptables firewall with Firewall Builder. Press the icon with the computer and the two arrows. This will prompt you, where to save the fwbuilder file on your computer for later configuration. Just choose a name. The next step is compiling your firewall rules. And than hit install. Firewall Builder needs the connection details now. The username is "root" and you need to enter your password here. If you confirm this page, you'll see a dialogue about installing the firewall. Thats all.

There are some points, you should take care of: - The basic ruleset is not secure because it allows any connection to extern. It needs to be configured tp your needs. - NEVER FORGET TO ALLOW SSH ACCESS IN A RULE TO YOUR FIREWALL. OTHERWISE YOU ARE OUTSIDE OF YOUR WALL (THATS REALLY SECURE, ISN'T IT?). If that happens, follow some descriptions how to recover from a bad firmware flash. (My recommendation: press reset and hold while you power on, reset at least for 30 seconds and power off. Try if you can to ping your router while it's booting. If not, Good Luck!)


 Firewall Builder WRT slideshow 

USe of FWBuilder 2.0.10-1 with DD-WRT V23 + JFFS2

Sure you also can use it without jffs2, but then you are somewhat limited with the size of the firewall you can build.

How to: Flash the Linksys device with dd-wrt v23 final (Go to Administration -> Firmware Upgrade). If you not have done until now, go to Administration -> Management and enable JFFS2 and Clean JFFS2 JFFS2. Then go to Administration -> Services and enable SSHD. Now start Putty.exe or any other SSH-program and login (username: root + your password). Now do:

cd /jffs

mkdir firewall

Let the SSH console open.

Now start fwbuilder.exe. Choose "Create new project file". Right click on "Firewalls" and choose "New Firewall". Enter the name of the new opject below: something like "my firewall". Choose firewall software is running "iptables". Choose OS the new firewall runs on: "Linksys/Sveasoft". Check "Use preconfigured tamplate firewall objects". Choose template "linksys firewall" and press Finish.

Double Click on my firewall and cange Version to "1.2.9 or later". Now change Host OS to "Linux 2.4/2.6". Choose "Firewall Settings" and choose tab compiler. Fill in the field Output file name: "firewall.fw". Choose tab installer and put in the field "Directory on the firewall where script should be installed" "/jffs/firewall/". Press OK to close the dialog. Now select from the menu Edit -> Preferences tab SSH. Enter the path for pscp.exe and plink.exe. Expand the tree under my firewall and double click on "outside (dyn ext)" and change the Name to "ppp0" if you use PPPoE to connect to the internet. Confirm the following dialog with "Yes". Now build your firewall rules.

After building your rules, choose Rules -> Install. On request choose "compile" and than "install". In the following dialog enter username "root" and your password.

In the SSH console enter:

nvram set rc_firewall=/jffs/firewall/firewall.fw

nvram commit

chmod 775 /jffs/firewall/firewall.fw

If you want to know about the free space on your jffs partition enter "df" in the SSH console.

That's all.

Comment: If you have started the PPTP Server, you must not check Load Modules (Double Click on Firewall, choose Firewall settings, choose tab script options and remove the tick on Load Modules). Otherwise the script exits with an error (+ /sbin/modeprobe ip_conntrack_pptp modeprobe : could not parse modules.dep) and doesn't load the firewall policies. If someone knows how to correct this behaviour, please post.