Vyatta

Vyatta Download

Unix based Open Source firewall router that see itself in competition with Cisco. The firewall module is not on by default, so once interfaces are defined it will pass traffic freely. All configuration is done via the CLI (there is a web interface, but its just a pretty version of the CLI.

Set-up

Installation and Basic Set-up

1. Download the LiveOS ISO
2. Create Red Hat RHEL5 (32 bit) VM with
   • 2GB hard drive
   • 2x E1000 NIC
   • 128MB RAM
3. Connect ISO and allow to boot fully
4. Login as root / vyatta
5. To install to local disk, run the install script with the following command
   • install-system
   • Accept all defaults
6. Reboot and disconnect ISO
7. Login and run the following commands to set IP address and default gateway
   • configure
   • set interfaces ethernet eth0 address 192.168.1.10/24 (repeat for other interfaces)
   • set system gateway-address 192.168.10.1
8. Enable remote ssh access
   • set service ssh
9. Commit changes and save
   • commit
   • save
   • exit

DNS Client

1. To set DNS servers, use following command (repeat for more servers)
   • set system name-server 172.16.0.34
2. To set DNS suffix search order, in order of preference (1st entered is 1st used)
   • set system domain-search domain mydomain.com
3. To review config
   • show system name-server
   • show system domain-search

Configuration

Basic Commands

In similar fashion to Cisco IOS, configuration has to be entered in config mode, and the configuration can only be viewed in Operator mode.

Firewall

If an interface has no firewall config, then it passes all traffic. Once any firewall config is applied then that interface acts as a firewall.

vyatta@vyatta:~$ configure
vyatta@vyatta# set firewall name home_out rule 10 action accept
vyatta@vyatta# set firewall name home_out rule 10 description "VC client access"
vyatta@vyatta# set firewall name home_out rule 10 destination address 10.1.1.5
vyatta@vyatta# set firewall name home_out rule 10 destination port 80,443,8084,8443,9084
vyatta@vyatta# set firewall name home_out rule 10 protocol tcp
vyatta@vyatta# set interfaces ethernet eth0 firewall in name home_out
vyatta@vyatta# commit
vyatta@vyatta# exit
vyatta@vyatta:~$ show firewall home_out

Active on (eth0,IN)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
10    ACCEPT  0.0.0.0/0           10.1.1.5            tcp    any
                                  dst ports: 80,443,8084,8443,9084
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any