shorewall_code/Shorewall-docs/myfiles.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
                                                    
  <meta http-equiv="Content-Type"
 content="text/html; charset=windows-1252">
  <title>My Shorewall Configuration</title>
                                                                        
                   
  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                                                    
  <meta name="ProgId" content="FrontPage.Editor.Document">
                                                    
  <meta name="Microsoft Theme" content="none">
</head>
  <body>
                          
<table border="0" cellpadding="0" cellspacing="0"
 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 bgcolor="#3366ff" height="90">
                                 <tbody>
                            <tr>
                                   <td width="100%">                    
                                                                       
      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
                                   </td>
                                 </tr>
                                                    
  </tbody>             
</table>
                          
<blockquote> </blockquote>
                          
<h1>My Current Network </h1>
                          
<blockquote>                                       
  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small> 
        use a combination of Static NAT and Proxy ARP, neither of which are 
  relevant      to a simple configuration with a single public IP address.</small></b></big><big><b><small> 
        If you have just a single public IP address, most of what you see 
here     won't   apply to your setup so beware of copying parts of this configuration 
     and  expecting them to work for you. What you copy may or may not work 
  in   your configuration.<br>
               </small></b></big></p>
                                                   
  <p><big><b><small><big><font color="#ff0000">Warning 2: </font><small>The 
 configuration shown here corresponds to version 1.4.6.</small></big></small></b></big><br>
                   </p>
                                                    
  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180). 
            My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> 
 Speedport)          is connected to eth0. I have a local network connected 
 to eth2 (subnet       192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) 
 and a Wireless   network connected to eth3 (192.168.3.0/24).</p>
                                                    
  <p> I use:<br>
                          </p>
                                                    
  <ul>
                            <li>Static NAT for Ursa (my XP System) - Internal 
  address     192.168.1.5      and external address 206.124.146.178.</li>
                            <li>Static NAT for Wookie (my Linux System).
Internal     address    192.168.1.3 and external address 206.124.146.179.</li>
             <li>Static NAT for EastepLaptop (My work system). Internal address 
   192.168.1.7  and external address 206.124.146.180.<br>
             </li>
                            <li>SNAT through the primary gateway address
(206.124.146.176)         for<6F>   my Wife's system (Tarry) and our<75> laptop
(Tipper) which connects       through the Wireless Access Point (wap) via
a Wireless Bridge (bridge).           <b><br>
                 <br>
           Note:</b> While the distance between the WAP and where I usually 
 use   the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus 
 wireless   card)   has proved very unsatisfactory (lots of lost connections). 
 By replacing   the  WAC11 with the WET11 wireless bridge, I have virtually 
 eliminated these   problems  (Being an old radio tinkerer (K7JPV), I was 
also able to eliminate   the disconnects by hanging a piece of aluminum foil 
on the family room wall.   Needless to say, my wife Tarry rejected that as 
a permanent solution :-).</li>
                                                    
  </ul>
                                                    
  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
                                                    
  <p> Wookie  and the Firewall both run Samba and the Firewall acts as a WINS
server.<br>
         </p>
                           
  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
in the local zone.</p>
                                                    
  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional 
    to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit 
 preamble),   I use <a href="MAC_Validation.html">MAC verification.</a> This 
 is still a  weak combination and if I lived near a wireless "hot spot", I
 would probably   add IPSEC or something similar to my WiFi-&gt;local connections.<br>
           </p>
                                                    
  <p> The single system in the DMZ (address 206.124.146.177) runs postfix, 
           Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and 
an   FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch 
 our  email    from our    old and current ISPs. That server is managed through 
   Proxy ARP.</p>
                                                    
  <p> The firewall system itself runs a DHCP server that serves the local 
             network. It also runs Postfix which is configured as a Virus 
and    Spam filter with all incoming mail then being forwarded to the MTA 
in the    DMZ.</p>
                                                    
  <p> All administration and publishing is done using ssh/scp. I have X installed 
       on the firewall but no X server or desktop is installed.     X applications
   tunnel through SSH to XWin.exe running on Ursa. The server does have a
desktop   environment installed and that desktop environment is available
via XDMCP   from the local zone. For the most part though, X tunneled through
SSH is  used for server administration and the server runs at run level 3
(multi-user  console mode on RedHat).</p>
                                                    
  <p> I run an SNMP server on my firewall to serve <a
 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running 
           in the DMZ.</p>
                                                    
  <p align="center">                           <img border="0"
 src="images/network.png" width="764" height="846"
 alt="(My network layout)">
                          </p>
                                                    
  <p><EFBFBD></p>
                                                    
  <p>The ethernet interface in the Server is configured         with IP address
      206.124.146.177, netmask    255.255.255.0. The server's default gateway
    is      206.124.146.254 (Router at my ISP. This is the same         
 default      gateway used by the firewall itself). On the firewall,    
                            Shorewall automatically adds a host route to
                            206.124.146.177 through eth1 (192.168.2.1) because
    of                            the entry in /etc/shorewall/proxyarp (see
 below).</p>
                                                                    
  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior 
         access.<br>
                     </p>
                                                    
  <p><font color="#ff0000" size="5"></font></p>
                   </blockquote>
                          
<h3>Shorewall.conf</h3>
                          
<blockquote>                                       
  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SHOREWALL_SHELL=/bin/ash<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
          </blockquote>
                   
<h3>Params File (Edited):</h3>
                          
<blockquote>                                    
  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
            </blockquote>
                          
<h3>Zones File</h3>
                          
<blockquote>                                       
  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font></pre>
               </blockquote>
                          
<h3>Interfaces File: </h3>
                          
<blockquote>                                        
  <p> This is set up so that I can start the firewall before bringing up
my Ethernet  interfaces. </p>
                             </blockquote>
                          
<blockquote>                                       
  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font>                </pre>
               </blockquote>
                          
<h3>Hosts File: </h3>
                          
<blockquote>                                       
  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
               </blockquote>
                          
<h3>Routestopped File:</h3>
                          
<blockquote>                                       
  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2">	</font></pre>
               </blockquote>
                          
<h3>Policy File:</h3>
                          
<blockquote>                                       
  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
               </blockquote>
                          
<h3>Masq File: </h3>
                          
<blockquote>                                        
  <p> Although most of our internal systems use static NAT, my wife's system 
            (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors 
    with     laptops. Also, I masquerade systems connected through the wireless
    network.</p>
                          </blockquote>
                          
<blockquote>                                       
  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
         </blockquote>
                 
<h3>NAT File: </h3>
                 
<blockquote>                                       
  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
               </blockquote>
                                          
<h3>Proxy ARP File:</h3>
                          
<blockquote>                                       
  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
 face="Courier" size="2">     	</font></pre>
               </blockquote>
                          
<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
                          
<blockquote>                                       
  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
               </blockquote>
                          
<h3></h3>
                          
<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
                          
<blockquote>                                       
  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp 
               </blockquote>
                          
<p><font size="2">Last updated 7/27/2003 - <a href="support.htm">Tom Eastep</a></font> 
        </p>
                           <a href="copyright.htm"><font size="2">Copyright</font>
       <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
 <br>
</body>
</html>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 								<html>
 								<head>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta http-equiv="Content-Type"
 								 content="text/html; charset=windows-1252">
 								  <title>My Shorewall Configuration</title>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								  <meta name="ProgId" content="FrontPage.Editor.Document">
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="Microsoft Theme" content="none">
 								</head>
 								  <body>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<table border="0" cellpadding="0" cellspacing="0"
 								 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								 bgcolor="#3366ff" height="90">
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                                 <tbody>
 								                            <tr>
 								                                   <td width="100%">
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                                   </td>
 								                                 </tr>
 								  </tbody>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</table>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<blockquote> </blockquote>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h1>My Current Network </h1>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								        use a combination of Static NAT and Proxy ARP, neither of which are
 								  relevant      to a simple configuration with a single public IP address.</small></b></big><big><b><small>
 								        If you have just a single public IP address, most of what you see
 								here     won't   apply to your setup so beware of copying parts of this configuration
 								     and  expecting them to work for you. What you copy may or may not work
 								  in   your configuration.<br>
 								               </small></b></big></p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p><big><b><small><big><font color="#ff0000">Warning 2: </font><small>The
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								 configuration shown here corresponds to version 1.4.6.</small></big></small></b></big><br>
 								                   </p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180).
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								            My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a>
 								 Speedport)          is connected to eth0. I have a local network connected
 								 to eth2 (subnet       192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24)
 								 and a Wireless   network connected to eth3 (192.168.3.0/24).</p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I use:<br>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                          </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <ul>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                            <li>Static NAT for Ursa (my XP System) - Internal
 								  address     192.168.1.5      and external address 206.124.146.178.</li>
 								                            <li>Static NAT for Wookie (my Linux System).
 								Internal     address    192.168.1.3 and external address 206.124.146.179.</li>
 								             <li>Static NAT for EastepLaptop (My work system). Internal address
 .168.1.7  and external address 206.124.146.180.<br>
 								             </li>
 								                            <li>SNAT through the primary gateway address
 								(206.124.146.176)         for<6F>   my Wife's system (Tarry) and our<75> laptop
 								(Tipper) which connects       through the Wireless Access Point (wap) via
 								a Wireless Bridge (bridge).           <b><br>
 								                 <br>
 								           Note:</b> While the distance between the WAP and where I usually
 								 use   the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus
 								 wireless   card)   has proved very unsatisfactory (lots of lost connections).
 								 By replacing   the  WAC11 with the WET11 wireless bridge, I have virtually
 								 eliminated these   problems  (Being an old radio tinkerer (K7JPV), I was
 								also able to eliminate   the disconnects by hanging a piece of aluminum foil
 								on the family room wall.   Needless to say, my wife Tarry rejected that as
 								a permanent solution :-).</li>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  </ul>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> Wookie  and the Firewall both run Samba and the Firewall acts as a WINS
 								server.<br>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								         </p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
 								in the local zone.</p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								    to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit
 								 preamble),   I use <a href="MAC_Validation.html">MAC verification.</a> This
 								 is still a  weak combination and if I lived near a wireless "hot spot", I
 								 would probably   add IPSEC or something similar to my WiFi-&gt;local connections.<br>
 								           </p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> The single system in the DMZ (address 206.124.146.177) runs postfix,
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								           Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and
 								an   FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch
 								 our  email    from our    old and current ISPs. That server is managed through
 								   Proxy ARP.</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> The firewall system itself runs a DHCP server that serves the local
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								             network. It also runs Postfix which is configured as a Virus
 								and    Spam filter with all incoming mail then being forwarded to the MTA
 								in the    DMZ.</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> All administration and publishing is done using ssh/scp. I have X installed
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								       on the firewall but no X server or desktop is installed.     X applications
 								   tunnel through SSH to XWin.exe running on Ursa. The server does have a
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								desktop   environment installed and that desktop environment is available
 								via XDMCP   from the local zone. For the most part though, X tunneled through
 								SSH is  used for server administration and the server runs at run level 3
 								(multi-user  console mode on RedHat).</p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I run an SNMP server on my firewall to serve <a
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								           in the DMZ.</p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p align="center">                           <img border="0"
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								 src="images/network.png" width="764" height="846"
 								 alt="(My network layout)">
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                          </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><EFBFBD></p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p>The ethernet interface in the Server is configured         with IP address
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+.124.146.177, netmask    255.255.255.0. The server's default gateway
 								    is      206.124.146.254 (Router at my ISP. This is the same
 								 default      gateway used by the firewall itself). On the firewall,
 								                            Shorewall automatically adds a host route to
 .124.146.177 through eth1 (192.168.2.1) because
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								    of                            the entry in /etc/shorewall/proxyarp (see
 								 below).</p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								         access.<br>
 								                     </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><font color="#ff0000" size="5"></font></p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Shorewall.conf</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SHOREWALL_SHELL=/bin/ash<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								          </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Params File (Edited):</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								            </blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								<h3>Zones File</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2"><br></font></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								<h3>Interfaces File: </h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> This is set up so that I can start the firewall before bringing up
 								my Ethernet  interfaces. </p>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								                             </blockquote>
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2"><br></font>                </pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Hosts File: </h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Routestopped File:</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2">	</font></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Policy File:</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Masq File: </h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								  <p> Although most of our internal systems use static NAT, my wife's system
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								            (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors
 								    with     laptops. Also, I masquerade systems connected through the wireless
 								    network.</p>
 								                          </blockquote>
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								         </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>NAT File: </h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Proxy ARP File:</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2">     	</font></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								<h3></h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp
-												Snapshot 20030809


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@691 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-08-09 19:14:58 +02:00
+								               </blockquote>
 								<p><font size="2">Last updated 7/27/2003 - <a href="support.htm">Tom Eastep</a></font>
 								        </p>
 								                           <a href="copyright.htm"><font size="2">Copyright</font>
 								       <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								 <br>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</body>
 								</html>