                  Firewall Builder Frequently Asked Questions

     ----------------------------------------------------------------------

1. What are the system requirements for Firewall Builder ?

   These are listed in the file "Requirements" in the docs directory. It is
   /usr/share/doc/fwbuilder/Requirements.

2. Where do I get GTK-- packages for RedHat 7.0 and 7.1 ?

   See gtk-- home page at http://gtkmm.sourceforge.net/ and follow link
   "Download" or directly in http://www.hvrlab.org/pub/gtkmm/

3. fwbuilder or one of policy compilers crashes. What do I do ?

   Please file a bug on Sourceforge. Provide information we might need to fix
   the problem (in the form of the output of the following commands):

 cat /etc/issue

 rpm -qa | grep gnome
 rpm -qa | grep gtk
 rpm -qa | grep libxml
 rpm -qa | grep libsigc++

 ls -la /usr/share/fwbuilder
 ls -la /usr/share/pixmaps/fwbuilder

 ldd /usr/bin/fwbuilder
 ldd /usr/bin/fwb_ipfilter
 ldd /usr/bin/fwb_iptables

   Also send us core file and .xml file with your objects. If program crashes
   but does not generate core file (it shows "crash" dialog instead), run it
   as follows:

 fwbuilder --disable-crash-dialog

   It will dump core then.

4. I get "I/O Error" while compiling policy. There is no other indication of
error though.

   Did you install package with corresponding compiler ? We ship compilers in
   a separate RPMs named like this: fwbuilder-ipchains-0.8.7-2-rh7.i386.rpm

   Check if compiler dumped core. If you can't find it, you may try to run
   compiler manually, providing the following command line parameters:

   $ fwb_ipchains -f path_to_objects.xml_file firewall_object_name

   All policy compilers have the same command line format.

5. fwbuilder crashes on my Debian or Mandrake or SuSe system. What do I do ?

   We can not guarantee that Firewall Builder would work flawlessly on Debian
   or Mandrake or SuSe since we do not have access to these distributions for
   testing.

   Sometimes we recieve packages built for these distributions by volunteers.
   In this case we post these packages in "Contribs" area on the project's
   page on Sourceforge. We do not verify or even try these packages and
   completely rely on people who submit them. We usually post information
   about authors, so if you have questions you can contact them directly.

   We welcome help from anyone who can test Firewall Builder on these
   distributions and provide feedback

6. Druid seems to multiply rules in the policy

   This is how it works now. Interactive Druid does not check for rules in
   existing policy and simply adds new ones. If you run Druid twice and ask
   it to generate the same set of rules, you'll get the same rules many times
   in your policy. This will be improved in subsequent releases.

7. I use iptables (or other) to protect local host. How do I use Firewall
Builder to build policy?

   Your host may or may not have its IP address assigned via PPPoE or DHCP.

   Here is what you do if address is static:

     * create firewall object, enter its IP address
     * create interface for it in "Interfaces" tab, mark address as
       "external"
     * add loopback interface named "lo", address 127.0.0.1/255.0.0.0
     * call Druid, chose "Firewall protects local host" and then pick rules
       you want.

   See what Druid have created for you. You can edit and add rules now.

   If address is dynamic:

     * create firewall object, mark its address as "dynamic"
     * create interface for it in "Interfaces" tab, mark address as
       "external" and "dynamic"
     * add loopback interface named "lo", address 127.0.0.1/255.0.0.0
     * call Druid, chose "Firewall protects local host" and then pick rules
       you want.

   Note also that there are now two places to look for policy: the "main"
   policy, this is what you saw in the old version, and policy attached to
   firewall interface. To see this one, open firewall object, go to tab
   "Interfaces" and highlight interface. For example, this is where you find
   your loopback rules and anti-spoofing rules.

8. What firewall platforms are supported ?

   As of version 0.9.3 we support iptables and are working on ipfilter policy
   compiler. We dropped support for ipchains as obsolete technology and
   because lack of time

9. I do not see log records in /var/log/messages, what's wrong?

   RedHat Linux comes with syslog preconfigured to write all log messages
   with level "info" and higher to /var/log/messages, while iptables script
   generated by Firewall Builder by default logs everything as "debug". You
   need either to edit /etc/syslog.conf to make all "debug" messages to be
   logged, or change log level to "info" in iptables tab in firewall dialog

10. I've got logging working, but I think it sends too much information to the
log so I can not really find what I am interested in. Is there a way to make it
more readable?

   You can use our script logwatcher.pl available in Contrib area. It reads
   log file /var/log/messages and shows only the following fields from each
   log line:

     * Date and time
     * rule number (assuming you use default setting for the rule prefix
       which looks like this: "RULE %N -- %A")
     * rule action (Deny/Reject/Accept)
     * interface
     * protocol
     * source address and source port
     * destination address and destination port
     * ICMP type and code for ICMP packets

   Note though that this script drops some data logged by iptables to improve
   readability. You may miss some important information because of this, so
   in case of real problem always look in the original log!

11. How can I configure NAT to provide access from the Internet to my server
behind the firewall ?

   ( The following recomendations assume you are using iptables )

   There are two possibilities here, depending on what IP address you want to
   use to access your server - that of your firewall or separate one. If you
   use the same address your firewall has, you can arrange access to your
   internal server from outside, and provide your internal users with access
   to the Internet using only one address. This scheme may become a
   limitation though if you have multiple servers inside your network which
   need to be accessed from outside. In the latter case you may want to use
   different port numbers or different addresses for access to different
   internal servers.

  11.1 You want to use IP address of the firewall to access your server inside.

   This is easy. Just add rule to the "NAT":

 ----------+-----------+-----------+-------------+-------------+-------------
 Orig. Src | Orig. Dst | Orig. Srv | Transl. Src | Transl. Dst | Transl. Srv
 ----------+-----------+-----------+-------------+-------------+-------------
           |           |           |             |             |
 Any       | firewall  | any       | Original    | Server      | Original

   where "firewall" is the object for your firewall and "Server" is the
   object for your server behind the firewall.

   this is it, Firewall Builder will generate iptables code for DNAT
   translation using firewall's IP address.

  11.2 You want to use separate IP address for translation

   Create a rule in "NAT" in a similar way:

 ----------+-----------+-----------+-------------+-------------+-------------
 Orig. Src | Orig. Dst | Orig. Srv | Transl. Src | Transl. Dst | Transl. Srv
 ----------+-----------+-----------+-------------+-------------+-------------
           |           |           |             |             |
 Any       | Server-NAT|   any     |   Original  |   Server    |   Original

   where "Server-NAT" is special object with address of the translation you
   want to create, and "Server" is an object for your server behind the
   firewall.

   In addition to the firewall rule, you need to set up static ARP entry and
   add routing. Asuming external translated address of the server is
   NN.NN.NN.NN, external firewall's interface is eth1 and its internal
   interface is eth0, the following commands would do the trick:

 # arp -Ds NN.NN.NN.NN eth1 pub         # adds static "published" ARP entry
 # route add NN.NN.NN.NN dev eth0       # routes it through internal interface

   As of version 0.9.3 iptables compiler can add these two commands to the
   generated firewall script if checkbox "Create ARP entries for DNAT
   translations" is checked in "iptables" tab in firewall object's dialog
