Zone Based firewalls configuration on VYOS

• On VyOS1 and VyOS2, configure interfaces (eth0 and eth1).
• Assign interfaces to zones: Public_Zone (eth0) and Private_Zone (eth1).
• Use descriptive zone names — shown in diagram
• VM1 & VM3 should be able to access the Internet via vyos1 and vyos2 routers accordingly
• Monitore in/out traffic on vyos router
• SSH to VM2 and VM4 from your’s laptop should be allowed
• Monitore in/out traffic on vyos router
• Ping from VM1 to VM4 should be allowed and block other traffic (Using zones based firewall)
• Monitore in/out traffic on vyos router

Step 1: Configure Interfaces and other configurations on VyOS1 & VyOS2

VyOS1:Enter Configuration Mode

# configure

1. SET INTERFACES

set interfaces ethernet eth0 address ‘dhcp’ set interfaces ethernet eth1 address ‘172.16.100.1/24’ set protocols static route 172.16.200.0/26 next-hop 192.168.18.58(router2 public ip)

2.NAT source rules set nat source rule 31 outbound-interface ‘eth1’ set nat source rule 31 source address ‘192.168.18.0/24’ set nat source rule 31 translation address ‘172.16.100.1’

set nat source rule 99 description ‘Block U2 NAT’ set nat source rule 99 destination address ‘0.0.0.0/0’ set nat source rule 99 ‘exclude’ set nat source rule 99 outbound-interface ‘eth0’ set nat source rule 99 source address ‘172.16.100.10’

set nat source rule 100 description ‘Allow Private Zone to Internet’ set nat source rule 100 outbound-interface ‘eth0’ set nat source rule 100 source address ‘172.16.100.0/24’ set nat source rule 100 translation address ‘masquerade’

set nat source rule 200 outbound-interface ‘eth0’ set nat source rule 200 source address ‘172.16.100.10’ set nat source rule 200 translation address ‘masquerade’

3.destination NAT (DNAT)

set nat destination rule 120 description ‘Dnat’ set nat destination rule 120 destination address ‘192.168.18.57’(router1 public ip) set nat destination rule 120 destination port ‘2222’ set nat destination rule 120 inbound-interface ‘eth0’ set nat destination rule 120 protocol ‘tcp’ set nat destination rule 120 translation address ‘172.16.100.10’ set nat destination rule 120 translation port ‘22’

4.Firewall rules

#configure set zone-policy zone Public_Zone1 interface eth0 set zone-policy zone Private_Zone1 interface eth1

set firewall name Private_Zone1 default-action ‘drop’ set firewall name Private_Zone1 rule 5 action ‘accept’ set firewall name Private_Zone1 rule 5 state established ‘enable’ set firewall name Private_Zone1 rule 5 state related ‘enable’

set firewall name Private_Zone1 rule 10 action ‘accept’ set firewall name Private_Zone1 rule 10 description ‘priv1 machines to pub1’ set firewall name Private_Zone1 rule 10 destination address ‘0.0.0.0/0’ set firewall name Private_Zone1 rule 10 protocol ‘all’ set firewall name Private_Zone1 rule 10 source address ‘172.16.100.0/24’

set firewall name Private_Zone1 rule 20 action ‘accept’ set firewall name Private_Zone1 rule 20 destination port ‘22’ set firewall name Private_Zone1 rule 20 protocol ‘tcp’

set firewall name Private_Zone1 rule 21 action ‘accept’ set firewall name Private_Zone1 rule 21 destination port ‘2222’ set firewall name Private_Zone1 rule 21 protocol ‘tcp’

set firewall name Private_Zone1 rule 110 action ‘accept’ set firewall name Private_Zone1 rule 110 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 110 destination port ‘22’ set firewall name Private_Zone1 rule 110 protocol ‘tcp’ set firewall name Private_Zone1 rule 110 source address ‘192.168.18.201’(host/laptop ip)

set firewall name Private_Zone1 rule 111 action ‘accept’ set firewall name Private_Zone1 rule 111 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 111 protocol ‘icmp’ set firewall name Private_Zone1 rule 111 source address ‘172.16.100.11’

set firewall name Private_Zone1 rule 113 action ‘drop’ set firewall name Private_Zone1 rule 113 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 113 protocol ‘all’ set firewall name Private_Zone1 rule 113 source address ‘0.0.0.0/0’

set firewall name Private_Zone1 rule 114 action ‘drop’ set firewall name Private_Zone1 rule 114 destination address ‘172.16.200.21’ set firewall name Private_Zone1 rule 114 protocol ‘icmp’ set firewall name Private_Zone1 rule 114 source address ‘172.16.100.10’

set firewall name Private_Zone1 rule 115 action ‘accept’ set firewall name Private_Zone1 rule 115 log ‘enable’

set zone-policy zone Private_Zone1 from Public_Zone1 firewall name ‘Private_Zone1’ set zone-policy zone Public_Zone1 from Private_Zone1 firewall name ‘Private_Zone1’

ABOVE CONFIGS FOR ROUTER1

VyOS2:Enter Configuration Mode

enter configure mode:

1. SET INTERFACES

set interfaces ethernet eth0 address ‘dhcp’ set interfaces ethernet eth1 address ‘172.16.200.1/24’ set protocols static route 172.16.100.0/24 next-hop 192.168.18.57

2.NAT source rules set nat source rule 99 description ‘Block U4 NAT’ set nat source rule 99 ‘exclude’ set nat source rule 99 outbound-interface ‘eth0’ set nat source rule 99 source address ‘172.16.200.21’

set nat source rule 100 outbound-interface ‘eth0’ set nat source rule 100 source address ‘172.16.200.20’ set nat source rule 100 translation address ‘masquerade’

set nat source rule 151 outbound-interface ‘eth0’ set nat source rule 151 source address ‘172.16.200.21’ set nat source rule 151 translation address ‘192.168.18.58’

set nat source rule 300 outbound-interface ‘eth1’ set nat source rule 300 source address ‘192.168.18.0/24’ set nat source rule 300 translation address ‘172.16.200.1’

3.destination NAT (DNAT) set nat destination rule 150 destination address ‘192.168.18.58’ set nat destination rule 150 destination port ‘2222’ set nat destination rule 150 inbound-interface ‘eth0’ set nat destination rule 150 protocol ‘tcp’ set nat destination rule 150 translation address ‘172.16.200.21’ set nat destination rule 150 translation port ‘22’

**4.Firewall rules** set zone-policy zone Public_Zone2 interface eth0 set zone-policy zone Private_Zone2 interface eth1

set firewall name Private_Zone2 rule 50 action ‘drop’ set firewall name Private_Zone2 rule 50 destination address ‘172.16.200.21’ set firewall name Private_Zone2 rule 50 protocol ‘icmp’ set firewall name Private_Zone2 rule 50 source address ‘172.16.100.10’

set firewall name Private_Zone2 rule 110 action ‘accept’ set firewall name Private_Zone2 rule 110 destination address ‘172.16.200.21’ set firewall name Private_Zone2 rule 110 destination port ‘22’ set firewall name Private_Zone2 rule 110 protocol ‘tcp’ set firewall name Private_Zone2 rule 110 source address ‘192.168.18.201’

set firewall name Private_Zone2 rule 111 action ‘accept’ set firewall name Private_Zone2 rule 111 destination address ‘172.16.200.21’ set firewall name Private_Zone2 rule 111 protocol ‘icmp’ set firewall name Private_Zone2 rule 111 source address ‘172.16.100.11’

set firewall name Private_Zone2 rule 112 action ‘accept’ set firewall name Private_Zone2 rule 112 log ‘enable’

set firewall name Private_Zone2 rule 113 action ‘drop’ set firewall name Private_Zone2 rule 113 destination address ‘172.16.200.21’ set firewall name Private_Zone2 rule 113 protocol ‘all’ set firewall name Private_Zone2 rule 113 source address ‘0.0.0.0/0’

set firewall name Public_Zone1 rule 150 action ‘accept’ set firewall name Public_Zone1 rule 150 destination port ‘22’ set firewall name Public_Zone1 rule 150 protocol ‘tcp’

set zone-policy zone Private_Zone2 from Public_Zone2 firewall name ‘Private_Zone2’ set zone-policy zone Public_Zone2 from Private_Zone2 firewall name ‘Private_Zone2’

vyos@vyos:~$ show configuration commands | grep firewall set firewall name Private_Zone1 default-action ‘drop’ set firewall name Private_Zone1 rule 5 action ‘accept’ set firewall name Private_Zone1 rule 5 state established ‘enable’ set firewall name Private_Zone1 rule 5 state related ‘enable’ set firewall name Private_Zone1 rule 10 action ‘accept’ set firewall name Private_Zone1 rule 10 description ‘priv1 machines to pub1’ set firewall name Private_Zone1 rule 10 destination address ‘0.0.0.0/0’ set firewall name Private_Zone1 rule 10 protocol ‘all’ set firewall name Private_Zone1 rule 10 source address ‘172.16.100.0/24’ set firewall name Private_Zone1 rule 20 action ‘accept’ set firewall name Private_Zone1 rule 20 destination port ‘22’ set firewall name Private_Zone1 rule 20 protocol ‘tcp’ set firewall name Private_Zone1 rule 21 action ‘accept’ set firewall name Private_Zone1 rule 21 destination port ‘2222’ set firewall name Private_Zone1 rule 21 protocol ‘tcp’ set firewall name Private_Zone1 rule 110 action ‘accept’ set firewall name Private_Zone1 rule 110 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 110 destination port ‘22’ set firewall name Private_Zone1 rule 110 protocol ‘tcp’ set firewall name Private_Zone1 rule 110 source address ‘192.168.18.201’ set firewall name Private_Zone1 rule 111 action ‘accept’ set firewall name Private_Zone1 rule 111 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 111 protocol ‘icmp’ set firewall name Private_Zone1 rule 111 source address ‘172.16.100.11’ set firewall name Private_Zone1 rule 113 action ‘drop’ set firewall name Private_Zone1 rule 113 destination address ‘172.16.100.10’ set firewall name Private_Zone1 rule 113 protocol ‘all’ set firewall name Private_Zone1 rule 113 source address ‘0.0.0.0/0’ set firewall name Private_Zone1 rule 114 action ‘drop’ set firewall name Private_Zone1 rule 114 destination address ‘172.16.200.21’ set firewall name Private_Zone1 rule 114 protocol ‘icmp’ set firewall name Private_Zone1 rule 114 source address ‘172.16.100.10’ set firewall name Private_Zone2 rule 115 action ‘accept’ set firewall name Private_Zone2 rule 115 log ‘enable’ set zone-policy zone Private_Zone1 from Public_Zone1 firewall name ‘Private_Zone1’ set zone-policy zone Public_Zone1 from Private_Zone1 firewall name ‘Private_Zone1’