slopfront
Reddit, read-only. No JavaScript. No cookies. No tracking.
preferences
Saved in links, not cookies.

Transparent/bridged firewall on ER-X?

1 points · submitted Jul 2019 by u/daveidfx · archived

I've been banging my head on this for a bit, and I'm having trouble getting my head around it. I'd appreciate any help you can offer. I'd like to use my Edgerouter-X as a transparent firewall to allow traffic (and related/established) to go upstream, but deny traffic (except from one specific server, either by IP or MAC) to the downstream side of the device. I'd like to use eth0 for the upstream side of the bridge.

If possible, it would also be great to get mirroring of eth0 to eth1 for wireshark purposes, but I could lose that if needed.

I'd like to use eth2 for exclusive, out-of-band access to ER-X management.

I'd like to use eth3 for bridged downstream LAN and eth4 (which has POE passthrough) for bridged downstream WLAN. I've been trying to work with them both as the only members of switch0, but could drop that if necessary.

I'd also like to pass DHCP requests and replies through to and from the upstream DHCP server elsewhere on the LAN to be bridged.

I added eth0 and switch0 to a bridge, br0, then tried to hang firewall rules on it. The trouble is that br0 doesn't differentiate what direction packets come from - it's all coming in and it's all going out, so there's no way to filter upstream and downstream separately that I can see. At least, not when trying to apply firewall rules to the bridge.

I tried working around that by doing it with zone policies on the NICs instead, but that doesn't seem to work either. Can a NIC not be in a zone if it's also in a bridge?

​

I realize that all this may be asking a lot of the ER-X hardware, but I don't mind if this slows down to 100mb if it works.

​

I've seen some various posts suggesting one way or another on whether transparent firewalling is supported on the ER-X, going back 5 or 6 years, but I think it currently is. If I'm interpreting correctly, I may need to get ebtables involved somehow for filtering on that?

​

I guess I'm having trouble understanding what rules are allowed to be attached to what objects. Since transparent firewalling isn't a common thing, it doesn't seem to be in the EdgeOS documentation that I can see.

​

Here's my latest stab at a zone-based (sanitized) config, if that helps.

ubnt@er-x-01:~$ show configuration
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group Upstream_Mgmt {
            address 10.AA.BB.CC
            description "A Server"
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name Inside_Out {
        default-action accept
        rule 10 {
            action drop
            description "drop invalid"
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name Outside_In {
        default-action drop
        rule 10 {
            action accept
            description "accept est/rel"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "drop inval/new"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new enable
                related disable
            }
        }
        rule 30 {
            action accept
            description "accept dhcp replies"
            destination {
                port 68
            }
            log enable
            protocol udp
            source {
                port 67
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    bridge br0 {
        aging 300
        bridged-conntrack enable
        firewall {
        }
        hello-time 2
        max-age 20
        priority 32768
        promiscuous disable
        stp false
    }
    ethernet eth0 {
        bridge-group {
            bridge br0
        }
        description OUTSIDE
        duplex auto
        mirror eth1
        speed auto
    }
    ethernet eth1 {
        description WIREMIRROR
        duplex auto
        speed auto
    }
    ethernet eth2 {
        address 192.168.2.1/24
        description MGMT
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description BRIDGED_LAN
        duplex auto
        speed auto
    }
    ethernet eth4 {
        description BRIDGED_WLAN
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        bridge-group {
            bridge br0
        }
        mtu 1500
        switch-port {
            interface eth3 {
            }
            interface eth4 {
            }
            vlan-aware disable
        }
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name Mgmt_network {
            authoritative disable
            subnet 192.168.2.0/24 {
                default-router 192.168.2.1
                lease 86400
                start 192.168.2.10 {
                    stop 192.168.2.20
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    gui {
        http-port 80
        https-port 443
        listen-address 192.168.2.1
        older-ciphers disable
    }
    ssh {
        listen-address 192.168.2.1
        port 22
        protocol-version v2
    }
    ubnt-discover {
        disable
    }
}
system {
    domain-name domain.name
    gateway-address 10.AA.BB.DD
    host-name er-x-01
    login {
        user ubnt {
            authentication {
                encrypted-password ****************
            }
            level admin
        }
    }
    name-server 10.AA.BB.EE
    name-server 10.AA.BB.FF
    name-server 10.AA.BB.GG
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}
zone-policy {
    zone INSIDE {
        default-action drop
        from OUTSIDE {
            firewall {
                name Outside_In
            }
        }
        interface eth3
        interface eth4
    }
    zone OUTSIDE {
        default-action drop
        from INSIDE {
            firewall {
                name Inside_Out
            }
        }
        interface eth0
    }
}

2 comments · 100% upvoted · other discussions

comments

Read-only. Use the arrows to collapse threads.

tlf01111 1 points · Jul 2019 · Before-Unifi Ubnt

First I'm not 100% sure an ER-X could do that, but I may be wrong there. True transparent firewalling is a bit tricky; I've done it with a combo of iptables & ebtables on vanilla CentOS servers before, so its feasible the ER-X's could do it I guess.

Regarding your configuration dump , wouldn't you need to specify the firewall rule group name under the firewall{} stanza? It's blank as you have it.

daveidfx [OP] 1 points · Jul 2019

Thanks for the reply.

It's possible that bridge firewall{} bit is wrong - certainly something must be. But I though since eth0, 3, and 4 were tagged in the zone-policy stanza at the end that that covered it. This config is trying to use zone policies on ethernet interfaces instead of rule groups on the bridge to get around the bidirectional problem. I can't tell from the documentation I can find on zone policies if that's valid or not.