Protect Windows with Virtualbox, pfsense, ipcop, ipfire and t1n1wall

This is a precursor of possible a long post about configuring a software firewall using virtualbox together with an open source firewall distribution such as ipcop, pfsense and t1n1wall (one of the successors of m0n0wall).

I will jot down the most important elements here and these are the results of hours of tests on various combination of configurations.

My network settings

  1. One external IP address directly connected to the outside world.
  2. One physical network card.
  3. MS Loopback network card (installed under Windows to function as the Bridged Network interface).

Network properties in the host machine

Instead of keeping just the Bridge Protocal of vmware and Bridged Networking Driver of virtualbox, I ticked another two additional protocols:

  1. Link-layer Topology Discovery Mapper I/O Driver
  2. Link-layer Topology Discovery Responder

In particular, Link-layer Topology Discovery Responder is essential for connecting to the wireless network. When it is unticked, the WAN interface under ipcop or pfsense finds it very difficult to connect to the wireless router. As a result, the network property for the physical network interface on the Windows host machine looks as follows:

Keep both the bridge protocols and the Link-layer protocols in the host machine
Keep both the bridge protocols and the Link-layer protocols in the host machine

Network configuration under virtualbox

  1. The most important thing is the network configuration under virtualbox. Both the adapter 1 and adapter2 need to be attached to Bridged Adapter (see attached pictures).
  2. I did limited tests and it appeared that selecting the Host-only adapter can also work, since there is a virtualbox bridged network driver ticked for “VirtualBox Host-Only Network”. However, if I choose Host-Only network for adapter2, t1n1wall cannot forward traffic from the host Windows machine to the outside world. For t1n1wall, and maybe other BSD flavored firewalls, it is better to set the adapter2 as bridged — although I assume making adapter2 the Host-Only network will make the host machine safer.
  3. I also installed Debian+arnos iptables firewall in virtualbox, and the adapter2 can be Host-Only or Bridged, both will work. In arno’s iptables firewall, just enable NAT and the host Windows machine will be able to visit the outside world.
  4. To easily identify which NIC is designated to WAN or LAN, click on Advanced and manually edit the automatically generated MAC address to something you can identify. I change the last two digits of the WAN MAC address into something like 080027276FAA and the last two digits of the LAN MAC address into something like 080027698CBB.
virtualbox.adapter1
virtualbox network configuration for ipcop, pfsense adapter1
virtualbox.adapter2
virtualbox network configuration for ipcop, pfsense adapter2. For adapter2, selecting host-only network should also work, but I am not so sure if portforwarding will be affected or not.

Do you need to setup VLAN under t1n1 and pfsense?

No. If you use bridged network, there is no need to setup VLAN.

If you choose to attach the network adapter to Internal Network, you may need to setup VLAN for the LAN to access the Internet, however, I didn’t test it. I am not so sure if you can even choose Internal Network when you want the host Windows machine to access the Internet.

Pfsense

I experienced several problems with pfsense and I don’t recommend using it with virtualbox and vmware if your sole purpose is using a firewall to protect your Windows PC with a firewall.

  1. Time drifts under vmware. pfsense experienced serious time drifts under vmware workstation 9.0. I simply can’t get the accurate time for pfsense under vmware. There is no time-drifting problems for virtualbox and pfsense.
  2. Port forwarding does not work. after numerous attempts, I still can’t reliably forward the ports to bittorrent clients running on the Windows host machine. I setup both NAT and firewall rules, and set the log to record the hits of the rules, however, it either turns up a few hits or no hits at all — even though the bittorrent client is working heavily with multiple downloads. Port forwarding works well under t1n1wall and ipcop, and the firewall log shows up the hit records with no problems.
  3. Overkill for the purpose. I run a single Windows PC as a host and I don’t need all the bells and whistles of pfsense, which have numerous configurations and settings I will never use.

ipcop vs ipfire

  1. Ipcop is simple and elegant. Its settings are easy to understand and intuitive. Just works and serves the purpose as a firewall very well.
  2. Ipfire has many features and packages. It appears it uses much more resources with my limited tests.

t1n1wall and smallwall

  1. t1n1 is simple to use and port forwarding for bittorrent clients works well. Its development is more recent than smallwall.
  2. smallwall should work almost identically with t1n1wall, and I chose t1n1wall simply because its releases are newer.

vmware and its network configuration

  1. For the LAN interface, I created vmnet2 and designated it as host-only network. There is no problems installing ipcop running on it, although I haven’t tested port forwarding heavily on it.
  2. You can also install MS Loopback NIC, create a new vmnet interface and designate it as bridged network.
  3. In virtual machine settings, in the Network Adapter section, click on Advanced, and modify its MAC address so that you will know which interface is assigned to WAN or LAN in the firewall.

questions that remains to be solved

  1. Linux firewalls appears to be less “secure”, because I don’t have to set port-forwarding rules to make bittorrent clients directly connect to the outside. With BSD flavored firewalls, I will need to specifically configure NAT rules and portforwarding to allow bittorrent work properly. Don’t know why this happens.
  2. Is for the LAN adapter, is Host-Only network safer than than Bridged network?
  3. For BSD firewalls, using Host-Only adapter does not seem to work. It has to be bridged network.

acknowledgements

These two resources provides very useful information for sett

  1. http://www.dowdandassociates.com/blog/content/howto-software-routers-on-virtual-machines/
  2. http://timita.org/wordpress/2011/07/31/protect-windows-with-pfsense-and-virtualbox-part-3-installing-virtualbox-and-creating-a-new-vm-for-pfsense/