Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| computers:truenas:gateway [01-Nov-2021 13:58] – [Configure the Firewall] Steve Joynt | computers:truenas:gateway [02-Feb-2025 16:14] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 40: | Line 40: | ||
| ====== Preparing the Gateway Jail ====== | ====== Preparing the Gateway Jail ====== | ||
| + | |||
| + | > IMPORTANT! | ||
| + | > What follows is a work in progress. | ||
| + | > Some of this may be inaccurate or just plain wrong. | ||
| + | > Use these examples at your own risk, and only if you understand what's going on. | ||
| 1. Log in to your TrueNAS server as root using SSH or the Shell option of the TrueNAS Web Portal. | 1. Log in to your TrueNAS server as root using SSH or the Shell option of the TrueNAS Web Portal. | ||
| Line 60: | Line 65: | ||
| </ | </ | ||
| - | ====== Configure the Firewall ====== | ||
| - | This is just a basic configuration, | + | ====== Configure NAT ====== |
| < | < | ||
| - | jexec " | + | jexec " |
| - | | + | |
| - | jexec " | + | jexec " |
| - | "cat >| ${FIREWALL_CONF:? | + | |
| - | <<END | + | |
| - | # be quiet and flush all rules on start | + | use_sockets yes |
| - | -q flush | + | same_ports yes |
| - | # allow local traffic, deny RFC 1918 addresses on the outside | + | END |
| - | add 00100 allow ip from any to any via lo0 | + | |
| - | add 00110 deny ip from any to 127.0.0.0/ | + | |
| - | add 00120 deny ip from any to any not verrevpath in | + | |
| - | add 00301 deny ip from 10.0.0.0/8 to any in via ${PUBLIC_INTERFACE:? | + | |
| - | add 00302 deny ip from 172.16.0.0/ | + | |
| - | add 00303 deny ip from 192.168.0.0/ | + | |
| - | # check if incoming packets belong to a natted session, allow through if yes | + | # public gateway interface needs nat |
| - | add 01000 divert natd ip from any to me in via ${PUBLIC_INTERFACE:? | + | jexec " |
| - | add 01001 check-state | + | |
| - | # allow some traffic from the local net to the router | + | # extra settings for nat are in the file we defined above |
| - | # SSH | + | jexec "ioc-${JAIL_NAME:?}" sysrc natd_flags=" |
| - | add 04000 allow tcp from ${LAN_NETWORK:? | + | |
| - | # ICMP | + | |
| - | add 04001 allow icmp from ${LAN_NETWORK:? | + | |
| - | # NTP | + | |
| - | add 04002 allow tcp from ${LAN_NETWORK:? | + | |
| - | add 04003 allow udp from ${LAN_NETWORK:? | + | |
| - | # DNS | + | |
| - | add 04006 allow udp from ${LAN_NETWORK:? | + | |
| - | # DHCP | + | |
| - | add 04007 allow udp from any to any dst-port 67 in via ${LAN_INTERFACE:?} | + | |
| - | # drop everything else | + | </ |
| - | add 04009 deny ip from ${LAN_NETWORK:? | + | |
| - | # pass outgoing packets (to be natted) on to a special NAT rule | + | ====== Configure |
| - | add 04109 skipto 61000 ip from ${LAN_NETWORK:? | + | |
| - | # allow all outgoing traffic from the router (maybe you should be more restrictive) | + | > IMPORTANT! |
| - | add 05010 allow ip from me to any out keep-state | + | > This firewall does not filter |
| - | + | > At this stage I just want to trigger NAT as appropriate | |
| - | # Drop everything that has come so far. | + | > The " |
| - | # This means it doesn' | + | > If your TrueNAS box connects directly |
| - | # Don't log the most noisy scans. | + | |
| - | add 59998 deny icmp from any to me | + | |
| - | add 59999 deny ip from any to me dst-port 135, | + | |
| - | add 60000 deny log tcp from any to any established | + | |
| - | add 60000 deny log ip from any to any | + | |
| - | + | ||
| - | # this is the NAT rule. Only outgoing packets from the local net will come here. | + | |
| - | # First, nat them, then pass them on (again, you may choose to be more restrictive) | + | |
| - | add 61000 divert natd ip from ${LAN_NETWORK:? | + | |
| - | add 61001 allow ip from any to any | + | |
| - | + | ||
| - | END | + | |
| - | + | ||
| - | </ | + | |
| - | + | ||
| - | ====== Configure NAT ====== | + | |
| < | < | ||
| - | jexec " | + | # use the standard firewall template called " |
| - | mkdir -p "${NAT_CONF%/*}" | + | jexec " |
| + | jexec "ioc-${JAIL_NAME:?}" sysrc firewall_type=" | ||
| - | jexec " | + | # log more while testing, or be quiet in normal operation? |
| - | "cat >| ${NAT_CONF:? | + | jexec " |
| - | << | + | |
| - | + | ||
| - | unregistered_only | + | |
| - | interface ${PUBLIC_INTERFACE:? | + | |
| - | use_sockets | + | |
| - | dynamic | + | |
| - | # dyamically open fw for ftp, irc | + | |
| - | # punch_fw 2000:50 | + | |
| - | + | ||
| - | END | + | |
| </ | </ | ||
| Line 154: | Line 111: | ||
| # enable IP forwarding | # enable IP forwarding | ||
| - | jexec " | + | jexec " |
| - | | + | |
| - | + | ||
| - | # enable firewall | + | |
| - | jexec " | + | |
| - | sysrc firewall_enable=" | + | |
| - | # name of firewall | + | # enable the firewall |
| - | jexec " | + | jexec " |
| - | sysrc firewall_type=" | + | |
| - | + | ||
| - | # log more while testing, or be quiet in normal operation? | + | |
| - | jexec " | + | |
| - | | + | |
| # enable the NAT service | # enable the NAT service | ||
| - | jexec " | + | jexec " |
| - | | + | |
| - | + | ||
| - | # public gateway needs nat | + | |
| - | jexec " | + | |
| - | sysrc natd_interface=" | + | |
| - | + | ||
| - | # extra settings for nat | + | |
| - | jexec " | + | |
| - | sysrc natd_flags=" | + | |
| # start the firewall & natd | # start the firewall & natd | ||
| - | jexec " | + | jexec " |
| - | | + | |
| </ | </ | ||
| + | |||
| + | ====== Firewall and Debugging Logs ====== | ||
| + | |||
| + | If you've turned on any logging for the ipfw service or natd, the output can be seen on the TrueNAS server OUTSIDE THE JAIL in this file... | ||
| + | < | ||
| ====== Credits ====== | ====== Credits ====== | ||
| Line 195: | Line 137: | ||
| * [[https:// | * [[https:// | ||
| * [[https:// | * [[https:// | ||
| + | * [[https:// | ||
| + | |||