RaspberryPI 4 Model B as Firewall (Smoothwall Express 3.1)
FAQ:
Q: Why I choose Smoothwall Express 3.1
A: I was looking to get Ipfire on my new Raspberry Pi but at the moment (30.12.2020) is Ipfire not supporting the RaspberryPi 4. The only Firewall that's running well on RaspberryPi is Smoothwall Express 3.1 . And yes its quite better that I was thinking! It has a lot of features and community driven mods. And for RaspberryPi are not so much Firewall DISTROS and especially for the Raspberry 4, Smoothwall Express 3.1 was the only one that I found. And the last update for SWE 3.1 was at Jul 14, 2020.
----------------------------------------------------------
Q: It's only working on RaspberryPi 4?
A: I don't test it, but I think yes. If someone try it on a RaspberryPi 3 Model B+, just send me a message on Twitter.
----------------------------------------------------------
Q: What should I learn?
A: Definitly iptables.
https://en.wikibooks.org/wiki/Communication_Networks/IP_Tables
----------------------------------------------------------
Q: I can't use DHCP simultantly on PURPLE(Wi-Fi) and Green(Switch)
A: It only works if PURPLE is in other subnet as GREEN.
----------------------------------------------------------
Q: Do I need all of your Equipment?
A: If you have something like the Products that I named it shouldn't be a problem but what i definitely recommend you to buy is the "Aluminium heat sink with fan", because the Raspi will get hot.
If you don't have it, then buy all of these things because you will need it all (except the DSL Router/Modem, i mean you should have one lol).
----------------------------------------------------------
Q: I can't access from PURPLE stuffs on GREEN like Webservices etc, what can i do?
A: You need to allow tcp/udp on every port from PURPLE to GREEN and from GREEN to PURPLE. You can do this only for one device or for all devices. You can do this on cli with iptables or on the Webinterface under Networking-Internal.
----------------------------------------------------------
Q: I want to build my own iptables chains/rules and delete the one that get coocked up at booting...
A: You can write a script and add it at the last line of /etc/rc.d/rc.sysinit or you can write/delete the standard one in /etc/rc.d/rc.firewall.up
Your bestfriend is /etc/rc.d !!!!
----------------------------------------------------------
Q: I can't access the firewall from PURPLE, even https or ssh
A: You need to allow it. You can allow it from the webinterface under services->remote access
----------------------------------------------------------
Q: It's PPPOE working?
A: Yes, im using it as PPPOE with a FritzBox (Yes, you can use the fritzbox as modem https://deer-it.de/fritzbox-7412-modem-bridge-mode-pppoe-passthrough/).
You can change the RED interface from the Webinterface to PPPOE.
----------------------------------------------------------
A: Ports?
Q: 222 - ssh , 441 - https
----------------------------------------------------------
The equipment that i used:
| Product | Link |
|---|---|
| USB 3.0 RJ45 10/100/1000 Gigabit Ethernet Adapter | https://amzn.to/3puxu9Z |
| Aluminum heat sink with fan for Raspberry Pi 4B | https://amzn.to/3mZF4aM |
| Raspberry Pi 4 Model B 4GB RAM | https://amzn.to/37UZrBU |
| MicroSD 64GB | https://amzn.to/3o09f2W |
| MicroSD USB Reader | https://amzn.to/34S6rh1 |
| TP-Link TL-SG105 5-Ports Gigabit Network Switch | https://amzn.to/3aXZmiR |
| 3x LAN Kabel (use Gigabit Ethernet Cables), for example these from the link | https://amzn.to/37TTuoK |
| MicroHDMI to HDMI Adapter | https://amzn.to/38PFADn |
| And a DSL Router of course(i think you should have one lol) |
Download
| Name | Description | Link |
|---|---|---|
| RaspberryPi Imager | We will need it to erase & format the MicroSD | https://www.raspberrypi.org/software/ |
| Smoothwall patched for RaspberryPi 4 with update 11 | The Smoothwall Open Source Project was set up in 2000 to develop and maintain Smoothwall Express - a Free firewall that includes its own security-hardened GNU/Linux operating system and an easy-to-use web interface, you can read more at https://smoothwall.org | http://agcl.us/shortie/Express-3.1-SP5-pi4-64.zip or from Mirror(hosted by me) https://teodorcucu.net/download/Express-3.zip |
Credits
https://community.smoothwall.org/forum/viewtopic.php?f=123&p=353493#p353493
Part 1:
-
Open RaspberryPi Imager and choose Operating System
-
Scroll down and choose Erase
-
Select your SD Card
-
Click on Write
-
Now copy all the files from Express-3 to the SD Card
‚
Before booting:
-
Insert the SD Card in your RaspberryPi.
-
Connect it to a monitor and you will need as well a keyboard.
-
The first ethernet cable with the usb-to-lan adapter and then to the router
-
The second ethernet cable with the onboard lan to the switch
-
The third one from the switch to your pc
Now we can start it.
Part 2.1:
- Press Return
- Type 1 and press Return (we rename wlan0 to eth2 so keep in mind, eth2 is our WiFi interface)
- Press Return
- Press Return
- Press Return
- Press Return
- Press Return
- Chose your Country Code and press Return
- Now type 'yes' and press Return
- Select NO
- Select your Keyboard Mapping
- Select your Timezone
- If you want, you can change the hostname of our firewall to something else, if not press Return B
- Select Half-Open
Part 2.2
IMPORTANT : We will use our USBtoEthernet-Adapter as RED Interface (for getting a working internet connection), the Onboard LAN as GREEN for the LAN and the Onboard WiFi as Purple
- Choose Network Configuration Type
- Scroll down and select GREEN + PURPLE + RED
- Now choose Card Assignments
- Choose Ok and hit Return
- The USBtoEthernet Adapter as RED
- The Onboard Ethernet as GREEN
- The Onboard WiFi as Purple
- Now we choose Adress Settings
- Choose Green
- Press Return
- We will choose the standard one 192.168.0.1/24
- Now we Choose Purple
- For purple we use 192.168.1.1 and /24 Mask (you can do later the routing etc)
- Now we select RED
- ATM we will use it as behind the router(not PPPOE, you can do this later) so we choose DHCP B
- Choose Done an hit return
- Choose DNS Settings
- Delete the 1.1.1.1 DNS Server (we will use the default one from RED, Router DNS)
- Choose DONE and hit return
- We choose DHCP Server Configuration
- We activate the DHCP Server Configuration for GREEN(make sure that you connect GREEN to Switch and a Ethernet Cable from Switch to your PC)
- Select FINISHED
- Choose a password for the user 'admin' (webinterface)
- Choose a password for the user 'root' (ssh) B
- We done, hit Return
Part 3.0:
FIXING WIFI:
For some reason is the wifi broken... so we need to resolve that.
-
SSH on smoothwall / on port 222 (Port 222 is the standard port for ssh on Smoothwall) 17. Choose DNS Settings
-
Now we will use my script for fix WIFI
bash <(wget -qO- https://raw.githubusercontent.com/teodorcucu/raspi4-smoothwall-wifi-fix/main/fix-wifi.sh)(Note that the Country Language is set to DE so you will need to change it after rebooting at /etc/hostapd/hostapd.purple.conf and reboot again.
-
Now we need activate DHCP for Purple WiFi, for that access the Webinterface and go to Services-dhcpd, scroll down to interface and choose Purple
-
Enable DHCP and set it up like in the picture
Thats it, now you can connect to the SSID 'Purple-Wifi' with the password 'password'. You can change it at /etc/hostapd/hostapd.purple.conf