2002-09-30 20:11:25 +02:00
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
2002-08-07 16:28:04 +02:00
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<meta http-equiv="Content-Language" content="en-us">
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
|
content="text/html; charset=windows-1252">
|
|
|
|
|
|
<title>Starting and Stopping Shorewall</title>
|
2002-08-07 16:28:04 +02:00
|
|
|
|
</head>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<body>
|
2002-08-07 16:28:04 +02:00
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
|
|
|
|
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<td width="100%">
|
|
|
|
|
|
|
|
|
|
|
|
<h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
|
2002-11-09 19:10:22 +01:00
|
|
|
|
the Firewall</font></h1>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
</td>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
</tr>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
</table>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p> If you have a permanent internet connection such as DSL or Cable,
|
|
|
|
|
|
I recommend that you start the firewall automatically at boot. Once
|
|
|
|
|
|
you have installed "firewall" in your init.d directory, simply type
|
|
|
|
|
|
"chkconfig --add firewall". This will start the firewall in run levels
|
|
|
|
|
|
2-5 and stop it in run levels 1 and 6. If you want to configure your
|
|
|
|
|
|
firewall differently from this default, you can use the "--level" option
|
|
|
|
|
|
in chkconfig (see "man chkconfig") or using your favorite graphical
|
2002-11-09 19:10:22 +01:00
|
|
|
|
run-level editor.</p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<p><strong><u> <font color="#000099"> Important Notes:</font></u></strong><br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<ol>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>Shorewall startup is disabled by default. Once you have configured
|
|
|
|
|
|
your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.
|
|
|
|
|
|
Note: Users of the .deb package must edit /etc/default/shorewall and set
|
|
|
|
|
|
'startup=1'.<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>If you use dialup, you may want to start the firewall in your
|
|
|
|
|
|
/etc/ppp/ip-up.local script. I recommend just placing "shorewall restart"
|
|
|
|
|
|
in that script.</li>
|
|
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
</ol>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p>
|
|
|
|
|
|
</p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p> You can manually start and stop Shoreline Firewall using the "shorewall"
|
|
|
|
|
|
shell program: </p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<ul>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall start - starts the firewall</li>
|
|
|
|
|
|
<li>shorewall stop - stops the firewall</li>
|
|
|
|
|
|
<li>shorewall restart - stops the firewall (if it's running)
|
2002-11-09 19:10:22 +01:00
|
|
|
|
and then starts it again</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall reset - reset the packet and byte counters
|
|
|
|
|
|
in the firewall</li>
|
|
|
|
|
|
<li>shorewall clear - remove all rules and chains installed
|
2002-11-09 19:10:22 +01:00
|
|
|
|
by Shoreline Firewall</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall refresh - refresh the rules involving the broadcast
|
|
|
|
|
|
addresses of firewall interfaces and the black and white lists.</li>
|
|
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<p> The "shorewall" program may also be used to monitor the firewall.</p>
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<ul>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall status - produce a verbose report about the firewall
|
2002-11-09 19:10:22 +01:00
|
|
|
|
(iptables -L -n -v)</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall show <i>chain</i> - produce a verbose report about <i>chain
|
2002-11-09 19:10:22 +01:00
|
|
|
|
</i>(iptables -L <i>chain</i> -n -v)</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall show nat - produce a verbose report about the nat table
|
2002-11-09 19:10:22 +01:00
|
|
|
|
(iptables -t nat -L -n -v)</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall show tos - produce a verbose report about the mangle
|
2002-11-09 19:10:22 +01:00
|
|
|
|
table (iptables -t mangle -L -n -v)</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall show log - display the last 20 packet log entries.</li>
|
|
|
|
|
|
<li>shorewall show connections - displays the IP connections currently
|
2002-11-09 19:10:22 +01:00
|
|
|
|
being tracked by the firewall.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall
|
|
|
|
|
|
show
|
|
|
|
|
|
tc - displays information
|
2002-11-09 19:10:22 +01:00
|
|
|
|
about the traffic control/shaping configuration.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall monitor [ delay ] - Continuously display the firewall
|
|
|
|
|
|
status, last 20 log entries and nat. When the log entry display
|
2002-11-09 19:10:22 +01:00
|
|
|
|
changes, an audible alarm is sounded.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall hits - Produces several reports about the Shorewall
|
|
|
|
|
|
packet log messages in the current /var/log/messages file.</li>
|
|
|
|
|
|
<li>shorewall version - Displays the installed version number.</li>
|
|
|
|
|
|
<li>shorewall check - Performs a <u>cursory</u> validation of
|
2002-11-09 19:10:22 +01:00
|
|
|
|
the zones, interfaces, hosts, rules and policy files. <font size="4"
|
2002-11-24 21:12:22 +01:00
|
|
|
|
color="#ff6666"><b>The "check" command does not parse and validate the
|
|
|
|
|
|
generated iptables commands so even though the "check" command completes
|
|
|
|
|
|
successfully, the configuration may fail to start. See the recommended
|
2002-11-09 19:10:22 +01:00
|
|
|
|
way to make configuration changes described below. </b></font> </li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
|
|
|
|
|
] - Restart shorewall using the specified configuration and if an error
|
|
|
|
|
|
occurs or if the<i> timeout </i> option is given and the new configuration
|
|
|
|
|
|
has been up for that many seconds then shorewall is restarted using the
|
|
|
|
|
|
standard configuration.</li>
|
|
|
|
|
|
<li>shorewall deny, shorewall reject, shorewall accept and shorewall
|
2002-11-09 19:10:22 +01:00
|
|
|
|
save implement <a href="blacklisting_support.htm">dynamic blacklisting</a>.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall logwatch (added in version 1.3.2) - Monitors the
|
|
|
|
|
|
<a href="#Conf">LOGFILE </a>and produces an audible alarm when new Shorewall
|
2002-11-09 19:10:22 +01:00
|
|
|
|
messages are logged.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
</ul>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
Finally, the "shorewall" program may be used to dynamically alter the contents
|
2002-11-09 19:10:22 +01:00
|
|
|
|
of a zone.<br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-11-09 19:10:22 +01:00
|
|
|
|
<ul>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>- Adds the
|
2002-11-09 19:10:22 +01:00
|
|
|
|
specified interface (and host if included) to the specified zone.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>- Deletes
|
2002-11-09 19:10:22 +01:00
|
|
|
|
the specified interface (and host if included) from the specified zone.</li>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-11-09 19:10:22 +01:00
|
|
|
|
</ul>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-11-09 19:10:22 +01:00
|
|
|
|
<blockquote>Examples:<br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<blockquote>shorewall add ipsec0:192.0.2.24 vpn1 -- adds the address 192.0.2.24
|
2002-11-09 19:10:22 +01:00
|
|
|
|
from interface ipsec0 to the zone vpn1<br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
shorewall delete ipsec0:192.0.2.24 vpn1 -- deletes the address 192.0.2.24
|
2002-11-09 19:10:22 +01:00
|
|
|
|
from interface ipsec0 from zone vpn1<br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check </b><EFBFBD>and
|
|
|
|
|
|
<b>shorewall try </b>commands allow you to specify which <a
|
|
|
|
|
|
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
|
|
|
|
|
to use:</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
|
2002-11-24 21:12:22 +01:00
|
|
|
|
shorewall try <i>configuration-directory</i></p>
|
|
|
|
|
|
</blockquote>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
|
|
|
|
|
is going to use a file in /etc/shorewall it will first look in the <i>configuration-directory</i>
|
|
|
|
|
|
. If the file is present in the <i>configuration-directory</i>, that
|
|
|
|
|
|
file will be used; otherwise, the file in /etc/shorewall will be used.</p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p> When changing the configuration of a production firewall, I recommend
|
2002-11-09 19:10:22 +01:00
|
|
|
|
the following:</p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<ul>
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>mkdir /etc/test</li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>cd /etc/test</li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li><copy any files that you need to change from /etc/shorewall
|
2002-11-09 19:10:22 +01:00
|
|
|
|
to . and change them here></li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>shorewall -c . check</li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li><correct any errors found by check and check again></li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>/sbin/shorewall try .</li>
|
|
|
|
|
|
|
2002-08-22 23:33:54 +02:00
|
|
|
|
</ul>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p> If the configuration starts but doesn't work, just "shorewall restart"
|
|
|
|
|
|
to restore the old configuration. If the new configuration fails to start,
|
2002-11-09 19:10:22 +01:00
|
|
|
|
the "try" command will automatically start the old one for you.</p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<p> When the new configuration works then just </p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<ul>
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>cp * /etc/shorewall</li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>cd</li>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<li>rm -rf /etc/test</li>
|
|
|
|
|
|
|
2002-08-22 23:33:54 +02:00
|
|
|
|
</ul>
|
|
|
|
|
|
|
2002-08-07 16:28:04 +02:00
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p><font size="2"> Updated 11/21/2002 - <a href="support.htm">Tom Eastep</a>
|
|
|
|
|
|
</font></p>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
|
|
|
|
|
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
2002-11-09 19:10:22 +01:00
|
|
|
|
<20> <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
2002-08-07 16:28:04 +02:00
|
|
|
|
|
|
|
|
|
|
|
2002-11-24 21:12:22 +01:00
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
2002-11-09 19:10:22 +01:00
|
|
|
|
<br>
|
2002-09-30 20:11:25 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
