How to setup an internal firewall

Question

I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to certain websites for our small group, so basically I need to setup a firewall within the infrastructure of the larger company.

The larger company is going to be setting up a separate VLAN for us, however, they don't want to use their firewall equipment to do the actual filtering, which is why I need to setup the filtering myself. I have a spare server at my disposal so I'm hoping to accomplish this with software (preferably Linux based since that usually cheap/free and I'm pretty good with Linux) instead of a hardware device if possible. I'm under the assumption that basically what I need is a firewall that will act as the gateway between our small group and the firewall of the corporation which will then lead to the Internet. I'm also hoping to still use the DHCP server of the larger company to serve our IP addresses (if that's possible to pass through the firewall). Lastly I will need to be able to filter websites based on the MAC address that's trying to access the website.

If anyone can offer advice on which firewall software would be best to use in this scenario that would be much appreciated. Also I'm looking on advice on the best way to structure the network ... should we continue using their DHCP, should we setup our own, if we use our own DHCP server, how do we prevent it from serving address to other users on other VLANs? I'm pretty decent with network stuff, just never worked in an environment with VLANs (I know the basic concepts about VLANs, but that's about it).

Thanks in advance for any help, Harry

Answer 1

First to answer the question of DHCP. DHCP works by sending a broadcast on a network, which means that if the DHCP server can hear the broadcast of a client (DHCP Discovery), then the client and server can negotiate an IP address.

In your case, you are going to be sat on another VLAN from the DHCP server, so effectively a separate subnet. With this in mind, if your subnet is 192.168.1.0/24 and the companies DHCP server sits on 192.168.2.0/24, your client will not be able to communicate with the DHCP server using network broadcast. This means that realistically you are free to set up a DHCP server to serve the appropriate IP address range without subsequently broadcasting out to the rest of the network.

Now it is possible to set up a DHCP Relay on your router which will pass DHCP traffic between your clients and the DHCP server of the larger company if you want to, really this is a decision for you on how you want to manage the IP addresses on your network.

Regarding firewall choice, my preference is to opt for a Linux iptables and squid proxy option. You can forward web traffic transparently to a squid proxy, this is possible using iptables:

http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

Secondly, you want to filter by mac address. Squid supports this with ACL's:

https://superuser.com/questions/343983/restrict-users-with-regard-to-their-mac-addresses-is-it-possible-with-squid

Answer 2

What you can do, is to buy hardware router, and use software firewall, if you really want to. This works pretty much OK. If you want to save money, you can use cheap 10GBps router (but better with ARP table of minimum 1024 entries). The thing is, that your company will grow over time, and you will need more and more data to switch between your devices, you might need to split them as well to different vlans.

Firewall acts as a internet gateway only, so it's up to 1GBps. You need latest gen machine to handle 1GBps forwarding using Linux (like pre-dual core machine @3GHz does only 200MBps).

Later on, you can upgrade switch this way:

Today switch with 10GBps uplink and virtual chassis is a minimum requirement. It's available nearly from all vendors except form the most cheap ones like Dell (they have stacking, but it is not virtual chassis, and it's dodgy anyway).

You can upgrade Vyatta to cluster as well, by using HA mode.

Anyway, it's recommended that you use hardware firewall. Software solutions are good for cloud mainly. Vyatta would be exception because it has features of hardware solutions, like configuration interface via command line, were you setup everything from single unified interface. There is also SQUID. Snort was deprecated because it was slowing down, however this is also somewhat required if you run internet facing services.

Vyatta main role is to provide forwarding, stateful packet inspection and NAT as well web-proxy. If you need mail scanning, and other features, you can setup virtual machines with SpamAssassin, you can also setup the machine with Snort, but dont pack everything on a little unit. Even this provides good of security, it fails at stability and performance.

Also, when buying hardware for firewall, make sure it has PCIe and onboard network directly connected to the CPU and not thru some other chip. Intel sandy-bridge based system is minimum, it's same as dedicated cards with acceleration etc, which are not working just like this with any software firewall, so if you want to use your own firewall, you need to make sure it will match the performance of other "hardware" one, which is really software most of the time, with just different architecture than typical PC.

...so even single core, low power machine will handle even 10GBps no problem, as the overhead is very little. Recommended is Intel card because it has very good drivers. You might need even to tune them a bit if you do lot's of connections at high rate (to enable RSS and increase buffers).

Answer 3

If restricting access to certain websites is all you are after, it seems like you are wanting a proxy server, and not a firewall.

You could try setting up iptables in linux if you want a firewall.