Building a Transparent Firewall with Linux, Part III

The last task to cover this month, and (I hope) the last OpenWrt-specific one, is configuring networking on OpenWrt. This is a huge topic I can't cover in depth (though I think my examples are pretty clear). There's a more complete explanation of the many different ways you can configure networking on OpenWrt on the OpenWrt Wiki (wiki.openwrt.org/doc/uci/network).

Speaking of which, you'll notice that the wiki article on configuring networking doesn't list any actual uci commands; it shows only the “finished product”, /etc/config/network. This is because statements in OpenWrt's /etc/config files are easy to translate into uci commands once you understand the syntax.

I recommend you first sketch out on paper what you want /etc/config/network to look like, compare that to how /etc/config/network presently looks, note which lines need to change, and then translate those changes into a list of commands. It is somewhat easier to make mistakes when entering a long sequence of commands than it is by simply editing a configuration file. However, using the up-arrow key to call up the command you just entered, and then backspacing over the part that's different in the next command in the sequence, reduces the amount of typing you need to do and, therefore, your potential for messing up.

Listing 2 shows Backfire's default /etc/config/network file for a Linksys WRT54GL.

config switch eth0
        option enable   1

config switch_vlan eth0_0
        option device   "eth0"
        option vlan     0
        option ports    "0 1 2 3 5"

config switch_vlan eth0_1
        option device   "eth0"
        option vlan     1
        option ports    "4 5"

config interface loopback
        option ifname   "lo"
        option proto    static
        option ipaddr   127.0.0.1
        option netmask  255.0.0.0

config interface lan
        option type     bridge
        option ifname   "eth0.0"
        option proto    static
        option ipaddr   192.168.1.1
        option netmask  255.255.255.0

#### WAN configuration
config interface        wan
        option ifname   "eth0.1"
        option proto    dhcp

Let's work our way down this file, from the top. First, config switch eth0 and option enable 1 constitute the first configuration section. Each section consists of a config line that names some network interface, switch, vlan or other element, followed by one or more option lines that affect that element. The first section in Listing 2 enables the switch device eth0.

As is typical for broadband routers, all the Ethernet ports on a Linksys WRT54G are controlled by a single switch chipset (a Broadcom chipset in this case). Individual ports are referred to in OpenWrt by their Virtual LAN (VLAN) assignment, for example, eth0.0 (VLAN #0), eth0.1 (VLAN #1) and so forth. Subsequent configuration sections in Listing 2 define and configure those VLANs.

The second section in Listing 2 shows the settings for VLAN 0, called eth0_0 within the config file but subsequently known to the kernel as eth0.0. option device, specifies which switch the VLAN is associated with (eth0 being the only switch present); option vlan specifies the VLAN number you want to define; and option ports specifies which ports belong to this VLAN.

Port numbers are assigned differently from what you'd expect in OpenWrt. Port #5 is a “virtual” port associated with the kernel itself. Every VLAN must be associated with port #5. Port #4 on the WRT54GL is labeled as the “WAN port”, the port you customarily connect to your DSL router or cable modem (though in OpenWrt you can assign it to whatever VLAN you like—there's actually nothing special about it).

Ports 0–3 correspond to ports 4, 3, 2 and 1, respectively, on the WRT54GL; they're numbered backward relative to the screen printing on the box. Therefore, in Listing 2, option ports "0 1 2 3 5" means “ports 4, 3, 2 and 1” and option ports "4 5" would translate to “the WAN port”.

Therefore, it follows that the next section defines the WAN port as belonging to VLAN #1 (eth0.1).

Don't worry about the loopback section. If you know anything about loopback interfaces, this section's meaning is obvious. If you don't, it doesn't matter because you never should change this section anyhow. Suffice it to say that as on any other Linux system, packets sent to either IP address 127.0.0.1 or interface lo will go directly to the local kernel and be flagged as having originated locally.

The last two sections define network interfaces. The first interface section is arbitrarily named lan, its actual interface name (ifname) being eth0.0 (which as you'll recall is actually VLAN 0 on the switch eth0). Since it concerns switch ports, it's of the type switch. This interface has a static IP address of 192.168.1.1, with a netmask of 255.255.255.0.

As you'll recall from the second section of Listing 2, eth0.0 is associated with ports 1–4 on the router. This VLAN is now being defined as a standalone Ethernet switch whose IP address is 192.168.1.1/24 (implying that anything connecting to ports 1–4 needs to have an IP address in the same logical LAN).

In the second interface section, VLAN 1 (eth0.1), which is associated only with the router's WAN port (OpenWrt port 4), is configured as a standard (nonbridge) interface with a dynamic, dhcp-assigned IP address.

So, what changes do I want to make? Basically, I want to configure the entire block of Ethernet interfaces as a single switch, including the WAN interface. I also want to change the switch's IP address (and also its network address) to 10.0.0.253, an unused IP address on the network into which I plan to insert the firewall.

Since all bridge ports will be on the same VLAN, I can delete the entire VLAN eth0_1 section and the entire interface wan section. I'll also have to change the ports option under VLAN eth0_0 and the ipaddr option under interface lan. All this will take a total of only seven commands (including rebooting the system)!

Listing 3 shows the way you want /etc/config/network to look.