iptables rules for "virtual wire" firewall

Question

My systems reside on a network with all public IP addresses. I need to firewall my particular subnet without the use of MASQUERADE. I have seen this configuration referred to as a "virtual wire" firewall.

My current configuration: internal subnet | router| rest of institution | internet

Configuration needed: internal subnet | firewall | router | rest of institution | internet

Firewall has two physical interfaces. I have not been able to construct a set of iptables rules that don't require MASQUERADING. Ip addresses I know and can use: xxx.123.68.0/24

router: xxx.123.68.1

firewall eth0 (outside): xxx.123.68.2

firewall eth1 (inside): xxx.123.68.3

rest of addresses are for internal systems

I have constructed INPUT and OUTPUT rules to allow connection to the firewall for management functions, but have not been successful with the FORWARDing chain rules.

Default policy on FORWARD is ACCEPT

Logging turned on to see if any traffic is flowing, but no entries in the log file. I thought that these rules should allow outbound traffic and return traffic

iptables -A FORWARD -p tcp -i eth1 -o eth0 -j ACCEPT

iptables -A FORWARD -p tcp -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

What am I missing?

Answer 1

A 'virtual wire' firewall as you are calling it usually acts as a ethernet bridge. Under Linux, you nneed to use ebtables, at least at some level when filtering on a bridge. There are rules you can add to your bridge filter so that your rules get evaluated by iptables.

Or if you want to use a newer kernel and nftables instead nftables combines all the filtering into a single command, though it may be a bit of a learning curve if you are already familiar with iptables.

Another option that doesn't require a bridge setup, is to instead configure the box for proxy-arp. Using proxy-arp, you can make a box that is a router, act somewhat like a bridge from the perspective of the rest of the network. With proxy-arp your iptables will work.