http://www.computerglitch.net/?p=84

Transparent Firewall With OpenBSD VM

November 19, 2009

I had a job where I needed to place a firewall in front of a network of publicly accessible computers. I decided to use a virtual transparent firewall to protect the entire network and make no changes on the client computers. This is document describes how I did it.

First the hardware: I decided to use a Dell Poweredge 1900 with ESXi server. The server has (2) Quad Core Processors, 16GB of RAM and 3 NICs. The storage is local with 4 drives set in a RAID 5 providing 600GB of storage.

Now for the NIC setup. You can see from the below diagram the BSD Bridge is setup on vmnic0 and vmnic1, vmnic2 is reserved for management and other VM’s.

For the configuration of OpenBSD do the following:
Enable PF and IP forwarding (edit /etc/rc.conf and /etc/sysctl.conf)

Configure the bridge (substitute your NIC names in place of vic0 and vic1)
First create the file /etc/bridgename.bridge0:

Add the following to the bridgename.bridge0 file:

After you have added this file reboot the OpenBSD VM, when the system comes back up you should see the following when issuing ifconfig -a

Once you have confirmed the bridge is running its time to configure pf to control the traffic. Here is an example /etc/pf.conf file that blocks all
external traffic destined for the internal network and allows all internal traffic destined for the internet:

A more elaborate example allows SSH traffic from specific IP’s to the internal network and configures OpenDNS redirection for content filtering on the
internal network:

Here is a diagram of the hardware setup and wiring:

http://shackspace.de/wiki/doku.php?id=project:hgg:faq

http://yro.slashdot.org/story/12/01/03/1723225/german-hackers-propose-uncensorable-global-grid-with-satellites

In short I monitor a small segment of the interent, where you have most likely passed through and I look at this traffic to see who is good and who is bad.

I end up seeing traffic from countries that most people have never heard of, and sometimes a "large" amount of traffic.

But there is only one "large" country that baffled me until recently looking into their conditions, considering that the Vatican has a larger footprint than North Korea.

http://www.nytimes.com/2006/10/23/technology/23link.html

The Internet Black Hole That Is North Korea

Written By: Chris SchuldThursday, October 9th, 2008

[user@www]# cd ~
[user@www]# wget "[GIANT_SUN_URL_TO_GET_THE_JAVA_BIN_FILE_x64_IN_THIS_CASE]"
[user@www]# /bin/sh jdk-6u7-linux-x64.bin

[user@www]# alternatives --install /usr/bin/java java /opt/jdk1.6.0_07/bin/java 2
[user@www]# alternatives --config java

There are 2 programs which provide 'java'.

  Selection    Command
-----------------------------------------------
*+ 1           /usr/lib/jvm/jre-1.4.2-gcj/bin/java
   2           /opt/jdk1.6.0_07/bin/java

Enter to keep the current selection[+], or type selection number: 2
[user@www]#

[user@www]# java -version
java version "1.6.0_07"
Java(TM) SE Runtime Environment (build 1.6.0_07-b06)
Java HotSpot(TM) 64-Bit Server VM (build 10.0-b23, mixed mode)
[user@www]#

It flickers a little, but this would be awesome for a "war room".

I'm ok with this.

I need to manage a queue of sorts, but I want many objects to interact with it, and even objects that exist in other threads within the same application.

So what is the best model?

What won't kill me?

So far I have to 2 fancy shmancy solutions, 1 model with a custom Queue controller object using synchronization , and another with an interesting interface to manage the Queue and puts in place a couple interesting scenarios when inserting into a limited Queue.

First Solution: Synchronization

Ok, your asking what is so special in Synchronization?

Well what is special is that only ONE thread can call a method at a time, so when you want to do a pull, you will be sure that a thread is doing a pull.

This in the end is nice, but wasn't 100% what I was looking for, but here is just in case you find this useful.

File: JavaThreadDemo.java

import java.util.*;
import java.util.concurrent.*;

public class JavaThreadDemo {
	//This Queue thinks too much of itself.
	static Queue gQ = new Queue();

	//A pretty constructor
	public JavaThreadDemo() {
	}

	//Main method funky funk.
	public static void main(String[] args) {
		ExecutorService pool = Executors.newFixedThreadPool(3);
		Set<Future<Boolean>> set = new HashSet<Future<Boolean>>();

		//Create the threads
		Callable<Boolean> callable = new Thready(gQ,"Thread 5000",5000); // Run every 5 seconds
		Callable<Boolean> callable2 = new Thready(gQ,"Thread 3000",3000); //Run Every
		Callable<Boolean> callable3 = new Thready(gQ,"Thread 4000",4000);
		Future<Boolean> future = pool.submit(callable);
		Future<Boolean> future2 = pool.submit(callable2);
		Future<Boolean> future3 = pool.submit(callable3);

		//Add the threads to the nice little set and let them cook.
		set.add(future);
		set.add(future2);
		set.add(future3);

		while (true) {
			//Lets see who is in there:
			gQ.print();
			try {
				Thread.sleep(1000);
			} catch (InterruptedException e) {
				e.printStackTrace();
			}
		}
	}
}

File: Queue.java

public class Queue {

	private String value ="Not Set";
	private long cnt = 0;
	public Queue() {
	}

	public Queue(String mVal) {
		this.value = mVal;
	}

	public synchronized void setString(String astr) {
		this.value = astr;
	}

	public synchronized  String getValue() {
		return this.value;
	}

	public synchronized void print() {
		this.cnt++;
		System.out.println(this.cnt+" "+this.value);
	}

}

File: Thready.java

import java.util.concurrent.BlockingQueue;
import java.util.concurrent.Callable;
import java.util.concurrent.TimeUnit;

public class Thready2 implements Callable {

	private BlockingQueue mQ ;
	private boolean pull;
	private long time;
	private String thID = "";

	public Thready2(BlockingQueue aQ, boolean pull, long time,String ID) {
		this.mQ = aQ;
		this.pull = pull;
		this.time = time;
		this.thID = ID;
	}

	@Override
	public Boolean call() throws Exception {
		boolean retVal = true;
		int offerCnt = 0;
		while  (retVal) {
			Queue aQi = null;
			if(pull) {
				aQi = mQ.take();
				System.out.println("Got Something : " + mQ.size()+" : " + aQi.getValue());
			} else {
				aQi = new Queue(this.thID+":"+offerCnt);
				System.out.println("I am making a sacrifical offering.. ");
				if(mQ.offer(aQi,1,TimeUnit.SECONDS)) {
				System.out.println("The Gods have taken my offering.");
				} else {
					System.out.println("The Gods have rejected my offering of " + this.thID+":"+offerCnt);
				}
				System.out.println("The Queue is now : " + mQ.size());
				offerCnt++;
			}
			Thread.sleep(this.time);
		}

		return null;
	}

}

Second Solution: BlockingQueue Interface

Note: Please use the Queue.java from the first example.

Now for this one, I am using a BlockingQueue interface, this is nice because it does what I did with synchronization, but has a few more features that I am displaying here.

What I am displaying with putting an item on the Queue is a timeout, that is nice because you don't want a deadlocked situation when your allocated resources are maxed,
and on the listener end to pop a Queue item off the stack will wait and listen till the cows come home, and reduces the code required like other polling methods. There are other methods to poll and that also have a timeout.

Overall, I have to think that this is a better method because I can show my process who is really in control.

File: JavaThreadDemo2.java

import java.util.HashSet;
import java.util.Set;
import java.util.concurrent.ArrayBlockingQueue;
import java.util.concurrent.BlockingQueue;
import java.util.concurrent.Callable;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;

public class ThreadDemo2 {
	//The Queue
	private final BlockingQueue<Queue> queue = new ArrayBlockingQueue<Queue>(10);

	//A Constructor
	public ThreadDemo2() {
	}

	//Where we start
	public boolean start () {
		boolean retVal = true;
		Queue cQ  = null;
		try {
			//Create Executor pool
			ExecutorService pool = Executors.newFixedThreadPool(3);

			//This is where we will "store" these threads
			Set> set = new HashSet>();

			//Creating the threads
			Callable<Boolean> callable = new Thready2(queue,true,1000,"Listen0");
			Callable<Boolean> callable2 = new Thready2(queue,false,1000,"push1000");
			Callable<Boolean> callable3 = new Thready2(queue,false,400,"push0400");
			Future<Boolean> future = pool.submit(callable);
			Future<Boolean> future2 = pool.submit(callable2);
			Future<Boolean> future3 = pool.submit(callable3);

			//Add them to the nice set and let them cook.
			set.add(future);
			set.add(future2);
			set.add(future3);
		} catch (Exception e) {
			e.printStackTrace();
		}
		if (cQ == null ) {
			System.out.println("cQ is null");
		}
		return retVal;
	}

	public static void main(String[] args) {
		ThreadDemo2 me = new ThreadDemo2();
		if(!me.start()) {
			System.out.println("I dies.");
		}
	}

}

File:Thready2.java

import java.util.concurrent.BlockingQueue;
import java.util.concurrent.Callable;
import java.util.concurrent.TimeUnit;

public class Thready2 implements Callable {

	private BlockingQueue mQ ;
	private boolean pull;
	private long time;
	private String thID = "";

	public Thready2(BlockingQueue aQ, boolean pull, long time,String ID) {
		this.mQ = aQ;
		this.pull = pull;
		this.time = time;
		this.thID = ID;
	}

	@Override
	public Boolean call() throws Exception {
		boolean retVal = true;
		int offerCnt = 0;
		while  (retVal) {
			Queue aQi = null;
			if(pull) {
				aQi = mQ.take();
				System.out.println("Got Something : " + mQ.size()+" : " + aQi.getValue());
			} else {
				aQi = new Queue(this.thID+":"+offerCnt);
				System.out.println("I am making a sacrifical offering.. ");
				if(mQ.offer(aQi,1,TimeUnit.SECONDS)) {
				System.out.println("The Gods have taken my offering.");
				} else {
					System.out.println("The Gods have rejected my offering of " + this.thID+":"+offerCnt);
				}
				System.out.println("The Queue is now : " + mQ.size());
				offerCnt++;
			}
			Thread.sleep(this.time);
		}

		return null;
	}
}

via Creating a Custom Event | Example Depot.