Vyatta

Vyatta Download

Unix based Open Source firewall router that see itself in competition with Cisco. The firewall module is not on by default, so once interfaces are defined it will pass traffic freely. All configuration is done via the CLI (there is a web interface, but its just a pretty version of the CLI.

Set-up

Installation and Basic Set-up

1. Download the LiveOS ISO
2. Create Red Hat RHEL5 (32 bit) VM with
   • 2GB hard drive
   • 2x E1000 NIC
   • 128MB RAM
3. Connect ISO and allow to boot fully
4. Login as root / vyatta
5. To install to local disk, run the install script with the following command
   • install-system
   • Accept all defaults
6. Reboot and disconnect ISO
7. Login and run the following commands to set IP address and default gateway
   • configure
   • set interfaces ethernet eth0 address 192.168.1.10/24 (repeat for other interfaces)
   • set system gateway-address 192.168.10.1
8. Enable remote ssh access
   • set service ssh
9. Commit changes and save
   • commit
   • save
   • exit

DNS Client

1. To set DNS servers, use following command (repeat for more servers)
   • set system name-server 172.16.0.34
2. To set DNS suffix search order, in order of preference (1st entered is 1st used)
   • set system domain-search domain mydomain.com
3. To review config
   • show system name-server
   • show system domain-search

Configuration

Basic Commands

In similar fashion to Cisco IOS, configuration has to be entered in config mode, and the configuration can only be viewed in Operator mode.

Command	Description
configure	Enter configuration mode
commit	Apply changes made since last commit
save	Save changes since last save (otherwise lost at reboot)
discard	Discard changes made since last commit

Firewall

If an interface has no firewall config, then it passes all traffic. Once any firewall config is applied then that interface acts as a firewall.

Command	Description
delete firewall name home_in rule 5	Delete firewall rule no 5

vyatta@vyatta:~$ configure
vyatta@vyatta# set firewall name home_out rule 10 action accept
vyatta@vyatta# set firewall name home_out rule 10 description "VC client access"
vyatta@vyatta# set firewall name home_out rule 10 destination address 10.1.1.5
vyatta@vyatta# set firewall name home_out rule 10 destination port 80,443,8084,8443,9084
vyatta@vyatta# set firewall name home_out rule 10 protocol tcp
vyatta@vyatta# set interfaces ethernet eth0 firewall in name home_out
vyatta@vyatta# commit
vyatta@vyatta# exit
vyatta@vyatta:~$ show firewall home_out

Active on (eth0,IN)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
10    ACCEPT  0.0.0.0/0           10.1.1.5            tcp    any
                                  dst ports: 80,443,8084,8443,9084
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any

The firewall filters in both directions, in and out of the interface. Traffic has to be configured in both directions to work! Therefore its necessary to config as shown...

vyatta@vyatta:~$ show firewall home_in

Active on (eth0,OUT)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
5     ACCEPT  0.0.0.0/0           0.0.0.0/0           icmp   any
10    ACCEPT  0.0.0.0/0           88.221.188.7        tcp    any
                                  dst ports: 443
11    ACCEPT  0.0.0.0/0           92.123.36.7         tcp    any
                                  dst ports: 443
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any

vyatta@vyatta:~$ show firewall home_out

Active on (eth0,IN)

State Codes: E - Established, I - Invalid, N - New, R - Related

rule  action  source              destination         proto  state
----  ------  ------              -----------         -----  -----
5     ACCEPT  0.0.0.0/0           0.0.0.0/0           icmp   any
110   ACCEPT  88.221.188.7/32     0.0.0.0/0           tcp    any
              src ports: 443
111   ACCEPT  92.123.36.7         0.0.0.0/0           tcp    any
              src ports: 443
1025  DROP    0.0.0.0/0           0.0.0.0/0           all    any