We have written some scripts to set up the EdgeOS device with the correct firewall rules, to get your block lists and use the results to update the ipset sets that are created and to upload your firewall logs to us. You can download the scripts here, but you will probably find it easier to cut and paste the links in the instructions below.
- EdgeOS is a fork of the Vyatta codebase. These instructions have been adapted from our Vyatta instructions but the background links below refer to Vyatta as the two are essentially the same.
- If this is a new device, please allow up to 30 minutes for our systems to be updated.
- If you are unclear about what the scripts will do you should read the background notes first. This also explains the difference between "Bridge" and "Router" mode.
- We also have a PDF file showing how to setup a basic Vyatta/EdgeOS device and then apply ThreatSTOP to it.
You should have a management station with a web browser that can read this page and an ssh client that can access the EdgeOS device.
You should have set up your EdgeOS device with the bridge group and a management ip address that can be accessed from your management station.
The EdgeOS device should have ssh enabled on it, which can be done by entering the following from the console:
You should also ensure that the device has a default gateway and name server configured. If you wish you may set the default name server of the device to one of the ThreatSTOP DNS servers (addresses below).
You should confirm that the management's ssh client can connect to the EdgeOS device and log in to it. Using that login session you should confirm that the EdgeOS device can also access/download files from the Internet. In particular you should check that your EdgeOS device can:
It is recommended that you save the configuration prior to applying the ThreatSTOP changes, which can be done by entering the following from the console:
If this is a reinstallation you may wish to either rename the folder ts-vyatta something else or restore the system to its original state before running the reinstallation code.
You should also download the libnet-dns-perl module. This can be done by entering the following after logging in:
Copy and paste the following line into the EdgeOS ssh session:
The device should download and unpack the ThreatSTOP scripts and then run the setup script which will display the following (if you have a sudo password enabled on your EdgeOS device then you will need to enter that when prompted).
You will then be asked a number of questions and normally you should accept the default values. The critical questions are the third one asking about the bridge id and the subsequent ones concerning firewall rule names and numbers. If the bridge id is not br0 then you must correct this. Likewise if you have existing firewall rules defined for the "in" and "local" directions of the bridge you must enter their names and an appropriate rule number since otherwise those rules will no longer be applied to traffic on that interface. If you do have existing rules it is generally recommended that the ThreatSTOP rules are performed first and thus that they have the lowest numbers. The setup script creates the eight ThreatSTOP rules with consecutive numbers. Thus, if your existing rules start at 10, you should specify that the script insert the rules starting at either 1 or 2.
Once these questions have been answered the script will create the install directory and copy files if required, test whether the firewall can download the block list from ThreatSTOP's DNS server and create the EdgeOS firewall rules (but not apply them) and the modifications of the various files that are needed.
Now you are asked whether you wish to accept the changes. If you have a complex/non-standard configuration you may wish to say N at this point and examine the files that have been created.
Finally you have the choice to run the script to get the block list data for the first time:
After some seconds (depending on the blocklist size and the connectivity to our DNS servers this may take up to a minute) you should see a report of a successful first run and the script completes. Assuming this last step reports success, you have installed ThreatSTOP on your EdgeOS routing device.
You should verify that none of the changes have broken basic connectivity and, if there are no problems, you should save the configuration so that it is used whenever the device reboots. This can be done by entering the following from the console:
To view the contents of the block and allow lists, you will need to run the "ipset" command:
The output will most likely go by too fast to view. You can pipe it to less so you can page through the output:
Restore to previous state
If you have run setup and applied the changes and wish to return to the pre-threatstop configuration then you should perform the following command (assuming that you installed to /home/vyatta/ts-vyatta).
From a console enter:
Optionally you may also wish to remove the ts-vyatta directory (rm -r ts-vyatta/).
This has now restored all the files changed. To restore the configuration you should do the following:
It is possible that you may need to "load prethreatstop" more than once to handle "commit" errors. Once you have managed to load the old configuration without error you should probably reboot the EdgeOS device to be sure that it runs with no traces of ThreatSTOP changes in the system.
There is no content with the specified labels