Firewall Builder Frequently Asked Questions

1. What are the system requirements for Firewall Builder ?

These are listed in the file "Requirements" in the docs directory. It is /usr/share/doc/fwbuilder/Requirements.

2. Where do I get GTK-- packages for RedHat 7.0 and 7.1 ?

See gtk-- home page at http://gtkmm.sourceforge.net/ and follow link "Download" or directly in http://www.hvrlab.org/pub/gtkmm/

3. fwbuilder or one of policy compilers crashes. What do I do ?

Please file a bug on Sourceforge. Provide information we might need to fix the problem (in the form of the output of the following commands):

cat /etc/issue

rpm -qa | grep gnome
rpm -qa | grep gtk
rpm -qa | grep libxml
rpm -qa | grep libsigc++

ls -la /usr/share/fwbuilder
ls -la /usr/share/pixmaps/fwbuilder

ldd /usr/bin/fwbuilder
ldd /usr/bin/fwb_ipfilter
ldd /usr/bin/fwb_iptables

Also send us core file and .xml file with your objects. If program crashes but does not generate core file (it shows "crash" dialog instead), run it as follows:

fwbuilder --disable-crash-dialog

It will dump core then.

4. I get "I/O Error" while compiling policy. There is no other indication of error though.

Did you install package with corresponding compiler ? We ship compilers in a separate RPMs named like this: fwbuilder-ipchains-0.8.7-2-rh7.i386.rpm

Check if compiler dumped core. If you can't find it, you may try to run compiler manually, providing the following command line parameters:

$ fwb_ipchains -f path_to_objects.xml_file firewall_object_name

All policy compilers have the same command line format.

5. fwbuilder crashes on my Debian or Mandrake or SuSe system. What do I do ?

We can not guarantee that Firewall Builder would work flawlessly on Debian or Mandrake or SuSe since we do not have access to these distributions for testing.

Sometimes we recieve packages built for these distributions by volunteers. In this case we post these packages in "Contribs" area on the project's page on Sourceforge. We do not verify or even try these packages and completely rely on people who submit them. We usually post information about authors, so if you have questions you can contact them directly.

We welcome help from anyone who can test Firewall Builder on these distributions and provide feedback

6. Druid seems to multiply rules in the policy

This is how it works now. Interactive Druid does not check for rules in existing policy and simply adds new ones. If you run Druid twice and ask it to generate the same set of rules, you'll get the same rules many times in your policy. This will be improved in subsequent releases.

7. I use iptables (or other) to protect local host. How do I use Firewall Builder to build policy?

Your host may or may not have its IP address assigned via PPPoE or DHCP.

Here is what you do if address is static:

create firewall object, enter its IP address
create interface for it in "Interfaces" tab, mark address as "external"
add loopback interface named "lo", address 127.0.0.1/255.0.0.0
call Druid, chose "Firewall protects local host" and then pick rules you want.

See what Druid have created for you. You can edit and add rules now.

If address is dynamic:

create firewall object, mark its address as "dynamic"
create interface for it in "Interfaces" tab, mark address as "external" and "dynamic"
add loopback interface named "lo", address 127.0.0.1/255.0.0.0
call Druid, chose "Firewall protects local host" and then pick rules you want.

Note also that there are now two places to look for policy: the "main" policy, this is what you saw in the old version, and policy attached to firewall interface. To see this one, open firewall object, go to tab "Interfaces" and highlight interface. For example, this is where you find your loopback rules and anti-spoofing rules.

8. What firewall platforms are supported ?

As of version 0.9.3 we support iptables and are working on ipfilter policy compiler. We dropped support for ipchains as obsolete technology and because lack of time

9. I do not see log records in /var/log/messages, what's wrong?

RedHat Linux comes with syslog preconfigured to write all log messages with level "info" and higher to /var/log/messages, while iptables script generated by Firewall Builder by default logs everything as "debug". You need either to edit /etc/syslog.conf to make all "debug" messages to be logged, or change log level to "info" in iptables tab in firewall dialog

10. I've got logging working, but I think it sends too much information to the log so I can not really find what I am interested in. Is there a way to make it more readable?

You can use our script logwatcher.pl available in Contrib area. It reads log file /var/log/messages and shows only the following fields from each log line:

Date and time
rule number (assuming you use default setting for the rule prefix which looks like this: "RULE %N -- %A")
rule action (Deny/Reject/Accept)
interface
protocol
source address and source port
destination address and destination port
ICMP type and code for ICMP packets

Note though that this script drops some data logged by iptables to improve readability. You may miss some important information because of this, so in case of real problem always look in the original log!

11. How can I configure NAT to provide access from the Internet to my server behind the firewall ?

( The following recomendations assume you are using iptables )

There are two possibilities here, depending on what IP address you want to use to access your server - that of your firewall or separate one. If you use the same address your firewall has, you can arrange access to your internal server from outside, and provide your internal users with access to the Internet using only one address. This scheme may become a limitation though if you have multiple servers inside your network which need to be accessed from outside. In the latter case you may want to use different port numbers or different addresses for access to different internal servers.

11.1 You want to use IP address of the firewall to access your server inside.

This is easy. Just add rule to the "NAT":

Orig. Src	Orig. Dst	Orig. Srv	Transl. Src	Transl. Dst	Transl. Srv
Any	firewall	any	Original	Server	Original

where "firewall" is the object for your firewall and "Server" is the object for your server behind the firewall.

this is it, Firewall Builder will generate iptables code for DNAT translation using firewall's IP address.

11.2 You want to use separate IP address for translation

Create a rule in "NAT" in a similar way:

Orig. Src	Orig. Dst	Orig. Srv	Transl. Src	Transl. Dst	Transl. Srv
Any	Server-NAT	any	Original	Server	Original

where "Server-NAT" is special object with address of the translation you want to create, and "Server" is an object for your server behind the firewall.

In addition to the firewall rule, you need to set up static ARP entry and add routing. Asuming external translated address of the server is NN.NN.NN.NN, external firewall's interface is eth1 and its internal interface is eth0, the following commands would do the trick:

# arp -Ds NN.NN.NN.NN eth1 pub   
# route add NN.NN.NN.NN dev eth0

The first command adds static "published" ARP entry,
while the second command routes it through internal interface

As of version 0.9.3 iptables compiler can add these two commands to the generated firewall script if checkbox "Create ARP entries for DNAT translations" is checked in "iptables" tab in firewall object's dialog