Vyatta

Vyatta Download

Unix based Open Source firewall router that see itself in competition with Cisco. The firewall module is not on by default, so once interfaces are defined it will pass traffic freely. All configuration is done via the CLI (there is a web interface, but its just a pretty version of the CLI.

Set-up

Installation (ISO Install)

1. Download the LiveOS ISO
2. Create Red Hat RHEL5 (32 bit) VM with
   • 2GB hard drive
   • 2x E1000 NIC
   • 128MB RAM
3. Connect ISO and allow to boot fully
4. Login as root / vyatta
5. To install to local disk, run the install script with the following command
   • install-system
   • Accept all defaults
6. Reboot and disconnect ISO

Installation (OVF Deployment)

1. Get the URL or download the OVF from http://www.vyatta.com/downloads/
2. Import into vCentre
3. Reconfigure network 2nd NIC is connected to as required
4. Start the VM
5. Login via the console using vyatta / vyatta

Basic Set-up

1. Login and run the following commands to set IP address and default gateway
   • configure
   • set system host-name router-name
   • set interfaces ethernet eth0 address 192.168.1.10/24 (repeat for other interfaces)
   • set system gateway-address 192.168.10.1
2. Enable remote ssh access
   • set service ssh
3. Enable/config NTP
   • set system time-zone Europe/London
   • set system ntp server 192.168.1.50
4. Commit changes and save
   • commit
   • save
   • exit

DNS Client

1. To set DNS servers, use following command (repeat for more servers)
   • set system name-server 172.16.0.34
2. To set DNS suffix search order, in order of preference (1st entered is 1st used)
   • set system domain-search domain mydomain.com
3. To review config
   • show system name-server
   • show system domain-search

Configuration

Basic Commands

In similar fashion to Cisco IOS, configuration has to be entered in config mode, and the configuration can only be viewed in Operator mode.

Command	Description
configure	Enter configuration mode
commit	Apply changes made since last commit
save	Save changes since last save (otherwise lost at reboot)
discard	Discard changes made since last commit

Firewall

If an interface has no firewall config, then it passes all traffic. Once any firewall config is applied then that interface acts as a firewall.

• http://www.carbonwind.net/VyattaOFR/Firewall/Firewall.htm - Useful page to learn from

Command	Description
delete firewall name home_in rule 5	Delete firewall rule no 5

vyatta@vyatta:~$ configure
vyatta@vyatta# set firewall name home_out rule 10 action accept
vyatta@vyatta# set firewall name home_out rule 10 description "VC client access"
vyatta@vyatta# set firewall name home_out rule 10 destination address 10.1.1.5
vyatta@vyatta# set firewall name home_out rule 10 destination port 80,443,8084,8443,9084
vyatta@vyatta# set firewall name home_out rule 10 protocol tcp
vyatta@vyatta# set interfaces ethernet eth0 firewall in name home_out
vyatta@vyatta# commit
vyatta@vyatta# exit
vyatta@vyatta:~$ show firewall home_out

Active on (eth0,IN)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
10    ACCEPT  0.0.0.0/0           10.1.1.5            tcp    any
                                  dst ports: 80,443,8084,8443,9084
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any

The firewall filters in both directions, in and out of the interface. Traffic has to be configured in both directions to work! Therefore its necessary to config as shown...

vyatta@vyatta:~$ show firewall home_in

Active on (eth0,OUT)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
5     ACCEPT  0.0.0.0/0           0.0.0.0/0           icmp   any
10    ACCEPT  0.0.0.0/0           88.221.188.7        tcp    any
                                  dst ports: 443
11    ACCEPT  0.0.0.0/0           92.123.36.7         tcp    any
                                  dst ports: 443
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any

vyatta@vyatta:~$ show firewall home_out

Active on (eth0,IN)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
5     ACCEPT  0.0.0.0/0           0.0.0.0/0           icmp   any
110   ACCEPT  88.221.188.7/32     0.0.0.0/0           tcp    any
              src ports: 443
111   ACCEPT  92.123.36.7         0.0.0.0/0           tcp    any
              src ports: 443
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any

NAT

To allow masquerade NAT, out through eth0, from multiple inside addresses out through the router's outside interface address

set service nat rule 10 type masquerade
set service nat rule 10 source address 10.1.1.0/24
set service nat rule 10 outbound-interface eth0
commit

To allow destination NAT, into the router, presenting machines on the inside, to the outside world

set interfaces ethernet eth0 address 192.168.1.20/24
set service nat
set service nat rule 20 description InsideServerName
set service nat rule 20 type destination
set service nat rule 20 inbound-interface eth0
set service nat rule 20 destination address 192.168.1.20
set service nat rule 20 inside-address address 10.1.1.20
set service nat rule 20 protocol all

Troubleshooting

Command	Comments
show arp
show interfaces
show ip route
show nat rules
show configuration
set system flow-accounting interface eth0	Enable flow accounting
show flow-accounting interface eth0	Show flow accounting for eth0
show flow-accounting interface eth0 host 10.1.1.1	Show flow accounting for specific IP through eth0