Linux Networking Cookbook

3.10. Testing Your Firewall

Problem

You want to be able to test your Linux firewall from inside your LAN and outside it so you can see your network from both sides of your firewall. You especially want to see your network the same way the big bad outside world sees it. What are some good ways to do this?

Solution

Simply network with a second PC and run your tests. Assume your firewall box is named firewall, with a WAN IP address of 172.16.0.10, and your PC is called testpc at 192.168.2.10. Connect testpc to the WAN port of firewall with a crossover cable. Then, give them temporary IP addresses and routes to each other:

	root@testpc:~# ifconfig eth0 192.168.2.10 netmask 255.255.255.0 up
	root@firewall:~# ifconfig eth0 172.16.0.10 netmask 255.255.255.0 up
	root@testpc:~# route del default
	root@testpc:~# route add -net 172.16.0.0/24 gw 192.168.2.10 eth0
	root@firewall:~# route del default
	root@firewall:~# route add -net 192.168.2.0/24 gw 172.16.0.10 eth0

Run ping to confirm connectivity.

Here are some quick tests you can run for debugging your new Linux firewall. These commands, run on firewall, show your active iptables rules:

	# /sbin/iptables -t filter -L -v --line-numbers
	# /sbin/iptables -t nat -L -v --line-numbers
	# /sbin/iptables -t mangle -L -v --line-numbers

Nmap is an excellent tool for seeing what your firewall looks like from the outside:

	root@testpc:~# nmap 172.16.0.10
	root@testpc:~# nmap -P0 172.16.0.10

Run netstat on firewall to see what sockets are open and listening for new connections: ...