Firewall Configurations - EOLE AMON (French academy)

General Discussions
, ,
1

I stumbled across a reference to EOLE AMON today.

That is a Firewall that was created to protect the network and the web services for the one French Academy, Académie de Dijon.

Detailed documentation is available here:

The complete OSS for EOLE is available from GitHub:

Does anyone have any experience with that Firewall component? If you do, would you care to share your sense of how manageable/simple the task of “re-targeting” for as a Desktop “appliance application” would be?

3 Likes
2

As far as my shameful low level of understanding of the french language did permit me to understand, I think the special thing about it is deep-packet-inspection.

Am I right or am I missing something ?

2 Likes
3

They say

EOLE AMON 2.9 is … to monitor and filter traffic between different zones … acting as a router, AMON securely shares internet access among sub-networks within a local area network (LAN)…

That is your question if EOLE AMON can be used within virtual machine on a host computer to protect that same host can address any ‘classic’ routing multihomed firewall.

Well, local firewalls are implemented differently. They intercept and process TCP/IP traffic locally. Nevertheless, I think that is possible. The task however is not simple and implementation is not as clean and safe as firewalling should be.

Look, there is a host and virtual FW appliance within it. FW has two virtual ETH interfaces: public and internal. You have to route all TCP/IP traffic for the host through FW.

  • All outgoing host traffic can be routed to internal FW interface. That is simple. You just substitute default route to host’s ETH with default route to FW’ internal interface. Obviously, they must belong to the same IP network. N.B. that host’s LAN traffic to internal network through host’s ETH is not suppressed yet. Probably, iptables filtering may help with that.
  • All incoming traffic at host’s ETH should be directed to FW’s external ETH. The only solution I can think out is to use iptables forwarding. N.B. that in case of internal network that will cause asymmetric routing which may be discouraged by FW.
2 Likes
4

If that is the case, then they probably lean heavily on hardware assisted virtualisation where you can set the NIC dedicated to a virtual machine
( VTd ? VTx ? Can’t remember, too long ago)

EDIT: After some reading and deciphering I couldn’t find anything yet about virtualisation. It really looks more like an enterprise router/firewall on steroids including support for VPN-tunneling between routers.

I remember doing that with some home routers once with someone living in another city. Creating an encrypted tunnel between our two routers merged our local networks to one Virtual Local Network.

I can be mistaken though. My french is terrible.

2 Likes