Overview

This document outlines the security policies and dynamic routing configurations for the network gateway, including firewall rules via nftables and BGP peering via BIRD.

How Zones are Defined and Connected

In this architecture, zones (zone_blue, zone_green, zone_red, and wan) directly correspond to network interfaces (either physical NICs, VLAN tags, or bridge interfaces) on the Gateway Server.

Chain Structure (nftables): The firewall strictly controls traffic flow by matching the input interface (iif) and output interface (oif). For example, iif zone_blue oif zone_green tcp dport 22 accept explicitly states: If a packet enters the server via the zone_blue interface and is destined to leave via the zone_green interface on TCP Port 22, allow it.

Default Deny Policy: The forward chain has a base policy drop. This means unless explicitly defined by interface-to-interface rules, traffic between zones is entirely blocked.

Egress & NAT: Traffic leaving any internal zone (zone_red, zone_green, zone_blue) destined for the wan interface is permitted by the forward chain. Upon exiting the wan interface, the postrouting NAT chain masks the internal IP addresses behind the public IP 185.28.228.1 using Source NAT (SNAT).

nftables Configuration

The following script defines the firewall ruleset, including input filtering for management, inter-zone forwarding rules, and Source NAT (SNAT) for WAN egress.

#!/usr/sbin/nft -f

# Flush existing rules and tables
flush ruleset

# Create a new table
table ip filter {
    # Create chains
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Allow loopback traffic
        iif lo accept
        
        # Allow SSH (Port 22) and Management
        iif ens3 accept
        tcp dport 22 accept
        
        # Allow Services
        tcp dport 80 accept    # HTTP
        tcp dport 179 accept   # BGP
        
        log prefix "Dropped packet: " level info
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        
        # Log dropped packets for debugging
        log prefix "Dropped packet: " level info

        # Allow established and related traffic
        ct state established,related accept

        # Allow all traffic from zone interfaces to WAN interface
        iif { zone_red, zone_green, zone_blue } oif wan accept

        # Inter-zone SSH (Port 22)
        iif zone_blue oif zone_green tcp dport 22 accept
        iif zone_green oif zone_blue tcp dport 22 accept

        # Inter-zone HTTP (Port 80)
        iif zone_blue oif zone_green tcp dport 80 accept
        iif zone_green oif zone_blue tcp dport 80 accept
    }

    chain output {
        type filter hook output priority 0; policy accept;
        # Allow loopback traffic
        oif lo accept
    }
}

# Create a new table for NAT
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        # SNAT for packets going out through the WAN interface
        oif wan snat X.X.X.X
    }
}

BIRD BGP Configuration

This configuration manages the BGP peering sessions across different security zones and the WAN uplink. Global Definitions & Filters

# Define the prefix set
define IPV4_DEFAULT = [ 0.0.0.0/0 ];
define SNAT = [ 185.28.228.0/22 ];


# Router ID
router id 172.16.1.3;


# Define the filters (route maps)
filter WAN_IN {
if net ~IPV4_DEFAULT then {
accept;
}
reject;
}


filter WAN_OUT {
if net ~IPV4_DEFAULT then {
reject;
}
if net ~SNAT then {
accept;
}
reject;
}


filter ZONE_DEFAULT_IN {
if net ~IPV4_DEFAULT then {
reject;
}
accept;
}


filter ZONE_DEFAULT_OUT {
if net ~IPV4_DEFAULT then {
accept;
}
reject;
}


protocol kernel {
learn; # Learn routes from the kernel
persist; # Don't remove routes on BIRD shutdown
scan time 20; # Scan kernel routing table every 20 seconds
ipv4 {
import all;
export all;
};
}


protocol direct {
ipv4;
}
# Device protocol to read the interface list
protocol device {
scan time 10; # Scan interfaces every 10 seconds
}
protocol static {
ipv4;
route 185.28.228.0/22 via "lo";
}


# Define the BGP protocols
protocol bgp ZONE_BLUE_SW1 {
local as 4244003666;
neighbor 172.16.1.2 as 4244003001;
multihop 2;
ipv4 {
gateway recursive;
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp ZONE_BLUE_SW2 {
local as 4244003666;
neighbor 172.16.1.3 as 4244003002;
multihop 2;
ipv4 {
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp ZONE_GREEN_SW1 {
local as 4244003666;
neighbor 172.16.1.10 as 4244003001;
multihop 2;
ipv4 {
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp ZONE_GREEN_SW2 {
local as 4244003666;
neighbor 172.16.1.11 as 4244003002;
multihop 2;
ipv4 {
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp ZONE_RED_SW1 {
local as 4244003666;
neighbor 172.16.1.18 as 4244003001;
multihop 2;
ipv4 {
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp ZONE_RED_SW2 {
local as 4244003666;
neighbor 172.16.1.19 as 4244003002;
multihop 2;
ipv4 {
import filter ZONE_DEFAULT_IN;
export filter ZONE_DEFAULT_OUT;
};
}


protocol bgp WAN_R1 {
local as 4244003666;
neighbor 172.16.100.1 as 4244003555;
ipv4 {
import filter WAN_IN;
export filter WAN_OUT;
};
}

The content of this post was created by the author; AI was used for editing and restructuring.