firewall implimentation - recomendations



hello, as i mentioned in my hello thread, i am working on a project to implement a unix firewall server for our network.

obviously there are some basics that would need to be ironed out before i can think of doing this right. now distro of unix aside for now, this is what i am thinking for first steps.

obviously, deciding i want a fire wall.
figure out topography. know where the server will sit when it comes to the network topography.
decide if i want exclusive or inclusive (i am planning on inclusive so it is more secure, yes i know it will require a lot of checking up on in the beginning.)

essentially, at this point, what i am looking for is some advice. what do you all recommend?

any questions you may have to assist in a good implementation of said software firewall? any advice at this time would help a great deal. i figure one this is all ready to go, then i will be ready to worry about the scripting and setup of the firewall protocols and so on. which is going to be a task in of itself. at least i have used linux before, so i have some idea what i am doing.

so, me and my lack of experience have just been schooled.

we are going to have a server, 2 nic's. so now here comes the big picture, which is actually really small.

we will have the internet coming through to the modem which will proceed to the firewall (hardware) then fomr there to the unix firewall server, then out to the network. so i will need to figure out how to route, have the signal come in on eth0 and then go back out on eth1. then setup my rules in between.

now, i was thinking of using freebsd, for testing purposes, can not beat the price. and if it works then possibly purchasing a unix distro. i am all for companies who provide good product to get recognition for it.

does anyone have any tips that i should know when embarking on this endeavor? things i should know about freebsd that will make this process, easy or harder to accomplish?

actually, ya... we, the current it team, inherited this mess from another guy. we used to have only a soft firewall, ms internet security or some such crap like that. oh ya this network was a huge mess. at least now we have a hardware firewall in place.

but yes, it does go from internet > modem > firewall (hardware) > *.*.2.* network. we have 2 outs form the firewall, the other one goes into another 2 network switch. (replication).

you can see why it is we need some better security in this place.

what i want is to have an inclusive system. sort of a redundant soft backup, what ever gets through the exclusive hardware firewall, can be stopped one it hits the unix firewall in the way. that is the plan anyway. i am hoping with the tips and tricks people like yourself offer, this company can tight up security something fierce. we get blasted with viruses like nobodies business, well we are better now that we have some new firewall policies in place. we went form like 10k in a week to 20 even.

security is a nightmare in this place. they have been so used to being open that the idea of closing them off is a threat to them for some reason. so we have to do things slowly, bit by bit we have cleaned things up nicely. things are running a lot smoother now than they used to be, that is for damn sure.

so openbsd you say? hmmm. and i agree no flam warring, facts only, opinions are important, but statics are more important, that is what my bosses care about when they sign off on buying this stuff  

i look forward to more replies, and i will give those links a look see.

we use ms exchange and active directory *cries*. we have norton 9 pro on the exchange server which does active scans of workstations throughout the network as well as in coming e-mails. we have recently had the firewall scan all incoming traffic for certain types of files. we made the scan inclusive for certain common file types example excell. no excel files of any sort get in unless they fit the rules.

when i said "statics are more important" i am sorry i meant statistics are more important.

anyway, so that image is an idea of how it should all be run then? now to give you an idea of our rack setup... *cries some more*.

to give you an idea of our topology...

we have 1 server rack. with 20 servers (various sizes) which all plug directly into our switch stacks.

our switches hehe. we have 8 patch panels with 24 ports each, these plug directly into the switch stack as well. we have 3 fiber boxes which connect the back (warehouse) to the front, and int he back we have more switches and work stations we are running off of. i can create a visio quick diagram of our server rack and switch/modem stack if that would help with the advice in setup. i will start working on one, it won't take long, and i am sure it would help everyone understand things a bit better.


question... i am assuming that if openbsd 1 fails, signal is still coming from openbsd 2, which will allow the network to remain online. obviously if hardare firealla fails it all goes down, but nothing we can do about that at presant. and when you say switch 1 and 2 that is just generic names, since they are all on the 2 network right? no matter how we look at it, there is redundat signal coming in past the first hardware firewall point. (looks good, nice and clean).

windows/ad/exchange does not have to be a security nightmare - provided you patch, configure and administer the boxes properly (and that advice goes for all systems). you would benefit from checking that you have a secure baseline build for your win2k/2k3 boxes (maybe use the nsa snac hardening guides?) and a proper patching mechanism in place (e.g. sus or sms). configuration change management and proper documentation should be order of the day across all corporate systems.

if you're sending/receiving mails to/from outside, you should be running an smtp proxy in a firewalled dmz - this allows you to trap mails and scan them for the nasties, before they reach your exchange server. again, openbsd running postfix, clamav and spamassasin would be well placed here. same goes for your web traffic - setup squid on another box in the dmz and inspect all traffic - ban your prohibited file types there. log mails/web traffic which violates policy and set the systems to mail your admin team.

the diagram i attached above was how i saw what you described. it isn't necessarily the best way to go. personally, i would remove the "hardware firewall" and let the openbsd boxes be your firewalls/routers to the outside world, then configure some dmzs for the semi-public services such as web servers and mail/web proxies. if you're on dialup, attach a modem to each openbsd firewall yourself and let it handle the dialup needs during failover. if you have dsl/leased line, speak to your isp and see if they can supply you with some sort of redundancy at that point (maybe even an isdn backup for your fixed link) with an upgraded device. also consider two separate isps to provide services, in case one goes belly up.

here is an idea of what our serve room looks like. as far as the server racks and the switch racks go. there is more to the room, and more stuff in it but this is the stuff we are talking about. the modem is t-1 that is our only signal coming into the building for internet.

damn i created the file but i can not insert the image, it is not hosted anywhere. i am going to send it to your forum box, assuming i can, so you can see what i am working with.

when you get it, you will see our rack. what i would like to do is in the rack put 1 or 2 for redundancy, openbsd servers in there, to run the firewalls. now these will be xeons with like a gig of ram so i would almost use them for more than just firewall purposes, but that is just a possibility, i am sure we can get a low end server for this purpose. all of our servers are dell or worse... (supermicro). i am encouraging my company to switch to ibm servers or something else. either way, i will try to send you the file so you can see what we have now, and that will help define possible advice for this project.

apparetly i can not send you a message... so i will try and see about getting the imagine hosted or something by 12:30.

here we go. hosted the picture on yahoo.



the image itself kind of sucks, i was trying to save space and not take too long as well. either way it kind of illustrates our problem :-p

as i said, most of the racks are dell 1850 - 1u, dell 2850 - 2u, dell 6500 6u.

total of 6 nortel baystack switches (48 port) 2 nortel baystack switches (24 ports). all at the top on the switch rack is just our patch panels. they plug directly into the 2 network switches starting form top to bottom.

if you think this is bad, you should have seen it before my bosses started to clean it all up.

i would advise against using your firewall boxes for anything other than firewalling. the more services you run on a box, the more vulnerable it becomes. your firewalls should be rock solid bastions of defence. as for your rack config, the physical layout of your boxes in the rack isn't really the issue*, it's the logical configuration you should be more concerned with. don't just focus on your firewalls, take a layered approach to security models and think about all of the traffic, services, users and data that your systems involve.

i can't view the image you posted. i use imageshack to host images for stuff like this forum, check it out. post a visio diagram of your network layout (**no real external ips/addresses or other company identifying information!!**) if you can ...

* i won't go into ups, power & cooling considerations for now.