2003-03-09 02:33:38 +01:00
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>Shorewall and Aliased Interfaces</title>
|
2003-08-05 20:38:21 +02:00
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<meta http-equiv="content-type"
|
|
|
|
|
content="text/html; charset=ISO-8859-1">
|
2003-08-05 20:38:21 +02:00
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<meta name="author" content="Tom Eastep">
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
2003-08-05 20:38:21 +02:00
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
2003-07-22 00:06:18 +02:00
|
|
|
id="AutoNumber1" bgcolor="#3366ff" height="90">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="100%">
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<h1 align="center"><font color="#ffffff">Shorewall and Aliased Interfaces</font></h1>
|
2003-08-05 20:38:21 +02:00
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-09 02:33:38 +01:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<h2>Background</h2>
|
2003-08-05 20:38:21 +02:00
|
|
|
The traditional net-tools contain a program called <i>ifconfig</i>
|
|
|
|
|
which is used to configure network devices. ifconfig introduced the
|
|
|
|
|
concept of <i>aliased </i>or <i>virtual </i>interfaces. These virtual
|
|
|
|
|
interfaces have names of the form <i>interface</i>:<i>integer </i>(e.g.,
|
|
|
|
|
eth0:0) and ifconfig treats them more or less like real interfaces.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example:<br>
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<pre>[root@gateway root]# ifconfig eth0:0<br>eth0:0 Link encap:Ethernet HWaddr 02:00:08:3:FA:55<br> inet addr:206.124.146.178 Bcast:206.124.146.255 Mask:255.255.255.0<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> Interrupt:11 Base address:0x2000<br>[root@gateway root]# <br></pre>
|
2003-08-05 20:38:21 +02:00
|
|
|
The ifconfig utility is being gradually phased out in favor of the
|
|
|
|
|
<i>ip</i> utility which is part of the <i>iproute </i>package. The ip
|
|
|
|
|
utility does not use the concept of aliases or virtual interfaces but rather
|
|
|
|
|
treats additional addresses on an interface as objects in their own right.
|
|
|
|
|
The ip utility does provide for interaction with ifconfig in that it allows
|
|
|
|
|
addresses to be <i>labeled </i>where these labels take the form of ipconfig
|
|
|
|
|
virtual interfaces.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<pre>[root@gateway root]# ip addr show dev eth0<br>2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb qlen 100<br> link/ether 02:00:08:e3:fa:55 brd ff:ff:ff:ff:ff:ff<br> inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0<br> inet 206.124.146.178/24 brd 206.124.146.255 scope global secondary eth0:0<br>[root@gateway root]# <br></pre>
|
2003-08-05 20:38:21 +02:00
|
|
|
Note that one <u>cannot</u> type "ip addr show dev eth0:0" because
|
|
|
|
|
"eth0:0" is a label for a particular address rather than a device name.<br>
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<pre>[root@gateway root]# ip addr show dev eth0:0<br>Device "eth0:0" does not exist.<br>[root@gateway root]#<br></pre>
|
2003-08-05 20:38:21 +02:00
|
|
|
The iptables program doesn't support virtual interfaces in either
|
|
|
|
|
it's "-i" or "-o" command options; as a consequence, Shorewall does not
|
|
|
|
|
allow them to be used in the /etc/shorewall/interfaces file or anywhere
|
|
|
|
|
else except as described in the discussion below. <br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<h2>Adding Addresses to Interfaces</h2>
|
|
|
|
|
Shorewall provides facilities for automatically adding addresses to interfaces
|
|
|
|
|
as described in the following section. It is also easy to add them yourself
|
|
|
|
|
using the <b>ip</b> utility. The above alias was added using:<br>
|
|
|
|
|
<blockquote><b><font color="#009900">ip addr add 206.124.146.178/24 brd 206.124.146.255
|
|
|
|
|
dev eth0 label eth0:0</font></b><br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
You probably want to arrange to add these addresses when the device is started
|
|
|
|
|
rather than placing commands like the above in one of the Shorewall extension
|
|
|
|
|
scripts. For example, on RedHat systems, you can place the commands in /sbin/ifup-local:<br>
|
|
|
|
|
<br>
|
|
|
|
|
<blockquote>
|
|
|
|
|
<pre>#!/bin/sh<br><br>case $1 in<br> eth0)<br> /sbin/ip addr add 206.124.146.177 dev eth0 label eth0:0<br> ;;<br>esac <br></pre>
|
|
|
|
|
</blockquote>
|
|
|
|
|
RedHat systems also allow adding such aliases from the network administration
|
|
|
|
|
GUI (which works well if you have a graphical environment on your firewall).<br>
|
2003-03-09 02:33:38 +01:00
|
|
|
<h2>So how do I handle more than one address on an interface?</h2>
|
2003-08-05 20:38:21 +02:00
|
|
|
The answer depends on what you are trying to do with the interfaces.
|
|
|
|
|
In the sub-sections that follow, we'll take a look at common scenarios.<br>
|
|
|
|
|
|
2003-03-09 02:33:38 +01:00
|
|
|
<h3>Separate Rules</h3>
|
2003-08-05 20:38:21 +02:00
|
|
|
If you need to make a rule for traffic to/from the firewall itself
|
|
|
|
|
that only applies to a particular IP address, simply qualify the $FW zone
|
|
|
|
|
with the IP address.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example (allow SSH from net to eth0:0 above):<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-03-23 19:47:54 +01:00
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ACTION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PROTOCOL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">net<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">$FW:206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">22<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-09 02:33:38 +01:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<h3>DNAT</h3>
|
2003-08-05 20:38:21 +02:00
|
|
|
Suppose that I had set up eth0:0 as above and I wanted to port
|
|
|
|
|
forward from that virtual interface to a web server running in my local
|
|
|
|
|
zone at 192.168.1.3. That is accomplised by a single rule in the /etc/shorewall/rules
|
|
|
|
|
file:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-05-18 20:38:34 +02:00
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ACTION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PROTOCOL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">DNAT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">net<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">loc:192.168.1.3<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">80<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">-<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-09 02:33:38 +01:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<h3>SNAT</h3>
|
2003-08-05 20:38:21 +02:00
|
|
|
If you wanted to use eth0:0 as the IP address for outbound connections
|
|
|
|
|
from your local zone (eth1), then in /etc/shorewall/masq:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-03-09 02:33:38 +01:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SUBNET<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ADDRESS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">eth0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-09 02:33:38 +01:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Shorewall can create the alias (additional address) for you if
|
|
|
|
|
you set ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning
|
2003-07-22 00:06:18 +02:00
|
|
|
with Shorewall 1.3.14, Shorewall can actually create the "label" (virtual
|
|
|
|
|
interface) so that you can see the created address using ifconfig. In
|
|
|
|
|
addition to setting ADD_SNAT_ALIASES=Yes, you specify the virtual interface
|
|
|
|
|
name in the INTERFACE column as follows:<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-03-09 02:33:38 +01:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SUBNET<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ADDRESS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">eth0:0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-09 02:33:38 +01:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
</blockquote>
|
|
|
|
|
Shorewall can also set up SNAT to round-robin over a range of IP addresses.
|
|
|
|
|
Do do that, you specify a range of IP addresses in the ADDRESS column. If
|
|
|
|
|
you specify a label in the INTERFACE column, Shorewall will use that label
|
|
|
|
|
for the first address of the range and will increment the label by one for
|
|
|
|
|
each subsequent label.<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-07-22 00:06:18 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SUBNET<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ADDRESS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">eth0:0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">206.124.146.178-206.124.146.180<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-07-22 00:06:18 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
</blockquote>
|
|
|
|
|
The above would create three IP addresses:<br>
|
|
|
|
|
<br>
|
|
|
|
|
eth0:0 = 206.124.146.178<br>
|
|
|
|
|
eth0:1 = 206.124.146.179<br>
|
|
|
|
|
eth0:2 = 206.124.146.180<br>
|
|
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<h3>STATIC NAT</h3>
|
2003-08-05 20:38:21 +02:00
|
|
|
If you wanted to use static NAT to link eth0:0 with local address
|
|
|
|
|
192.168.1.3, you would have the following in /etc/shorewall/nat:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-04-13 17:28:32 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>EXTERNAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERNAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ALL INTERFACES<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>LOCAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">192.168.1.3<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">no<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">no<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-04-13 17:28:32 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Shorewall can create the alias (additional address) for you if
|
|
|
|
|
you set ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning
|
|
|
|
|
with Shorewall 1.3.14, Shorewall can actually create the "label" (virtual
|
2003-07-22 00:06:18 +02:00
|
|
|
interface) so that you can see the created address using ifconfig. In
|
|
|
|
|
addition to setting ADD_IP_ALIASES=Yes, you specify the virtual interface
|
|
|
|
|
name in the INTERFACE column as follows:<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-03-23 19:47:54 +01:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>EXTERNAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERNAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ALL INTERFACES<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>LOCAL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">206.124.146.178<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth0:0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">192.168.1.3<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">no<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">no<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
|
|
|
|
</table>
|
|
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
In either case, to create rules that pertain only to this NAT pair,
|
|
|
|
|
you simply qualify the local zone with the internal IP address.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a.
|
|
|
|
|
192.168.1.3.<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ACTION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PROTOCOL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">net<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">loc:192.168.1.3<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">22<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
2003-07-22 00:06:18 +02:00
|
|
|
</td>
|
2003-08-05 20:38:21 +02:00
|
|
|
<td valign="top"><br>
|
2003-07-22 00:06:18 +02:00
|
|
|
</td>
|
2003-08-05 20:38:21 +02:00
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-07-22 00:06:18 +02:00
|
|
|
</table>
|
|
|
|
|
<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<h3>MULTIPLE SUBNETS</h3>
|
2003-08-05 20:38:21 +02:00
|
|
|
Sometimes multiple IP addresses are used because there are multiple
|
|
|
|
|
subnetworks configured on a LAN segment. This technique does not provide
|
|
|
|
|
for any security between the subnetworks if the users of the systems have
|
|
|
|
|
administrative privileges because in that case, the users can simply manipulate
|
|
|
|
|
their system's routing table to bypass your firewall/router. Nevertheless,
|
|
|
|
|
there are cases where you simply want to consider the LAN segment itself
|
|
|
|
|
as a zone and allow your firewall/router to route between the two subnetworks.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example 1: Local interface eth1 interfaces to 192.168.1.0/24
|
|
|
|
|
and 192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254
|
2003-07-22 00:06:18 +02:00
|
|
|
and eth1:0 is 192.168.20.254. You want to simply route all requests between
|
2003-08-05 20:38:21 +02:00
|
|
|
the two subnetworks.<br>
|
|
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<h4>If you are running Shorewall 1.4.1 or Later</h4>
|
2003-08-05 20:38:21 +02:00
|
|
|
In /etc/shorewall/interfaces:<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-03-23 19:47:54 +01:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>BROADCAST<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>OPTIONS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">-<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">192.168.1.255,192.168.20.255<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-04-13 17:28:32 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
In /etc/shorewall/hosts:<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-04-13 17:28:32 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>HOSTS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>OPTIONS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1:192.168.1.0/24<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1:192.168.20.0/24<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-03-23 19:47:54 +01:00
|
|
|
</table>
|
2003-07-22 00:06:18 +02:00
|
|
|
<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
</blockquote>
|
|
|
|
|
Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall
|
|
|
|
|
1.4.1 and later releases default to allowing intra-zone traffic.<br>
|
|
|
|
|
|
|
|
|
|
<h4>If you are running Shorewall 1.4.0 or earlier<br>
|
|
|
|
|
</h4>
|
|
|
|
|
In /etc/shorewall/interfaces:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-04-13 17:28:32 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>BROADCAST<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>OPTIONS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">192.168.1.255,192.168.20.255<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Note 1:<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-04-13 17:28:32 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Note 1: If you are running Shorewall 1.3.10 or earlier then you
|
|
|
|
|
must specify the <b>multi</b> option.<br>
|
2003-07-22 00:06:18 +02:00
|
|
|
<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
In /etc/shorewall/policy:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-04-13 17:28:32 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>SOURCE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>POLICY<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>LOG LEVEL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>BURST:LIMIT<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-05-18 20:38:34 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and
|
|
|
|
|
192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and
|
2003-07-22 00:06:18 +02:00
|
|
|
eth1:0 is 192.168.20.254. You want to make these subnetworks into separate
|
|
|
|
|
zones and control the access between them (the users of the systems do
|
|
|
|
|
not have administrative privileges).<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
In /etc/shorewall/zones:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-05-18 20:38:34 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DISPLAY<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESCRIPTION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Local<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Local Zone 1<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc2<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Local2<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Local Zone 2<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-04-13 17:28:32 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
In /etc/shorewall/interfaces:<br>
|
2003-07-22 00:06:18 +02:00
|
|
|
<br>
|
2003-08-05 20:38:21 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-05-18 20:38:34 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>INTERFACE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>BROADCAST<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>OPTIONS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">-<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">192.168.1.255,192.168.20.255<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">Note 1:<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-05-18 20:38:34 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Note 1: If you are running Shorewall 1.3.10 or earlier then you
|
|
|
|
|
must specify the <b>multi</b> option.<br>
|
|
|
|
|
<br>
|
|
|
|
|
In /etc/shorewall/hosts:<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-05-18 20:38:34 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-08-05 20:38:21 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>ZONE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>HOSTS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>OPTIONS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1:192.168.1.0/24<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc2<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1:192.168.20.0/24<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-05-18 20:38:34 +02:00
|
|
|
</table>
|
2003-08-05 20:38:21 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic
|
|
|
|
|
that you want to permit.<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<p align="left"><font size="2">Last Updated 7/29/2003 A - <a
|
2003-03-09 02:33:38 +01:00
|
|
|
href="support.htm">Tom Eastep</a></font></p>
|
2003-08-05 20:38:21 +02:00
|
|
|
|
2003-05-18 20:38:34 +02:00
|
|
|
<p><a href="copyright.htm"><font size="2">Copyright</font> ©
|
2003-08-05 20:38:21 +02:00
|
|
|
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
2003-07-22 00:06:18 +02:00
|
|
|
</p>
|
2003-03-23 19:47:54 +01:00
|
|
|
<br>
|
2003-03-09 02:33:38 +01:00
|
|
|
</body>
|
|
|
|
|
</html>
|
