<pre>#ZONE DISPLAY COMMENTS<br>net Internet Internet<br>WiFi Wireless Wireless Network on eth3<br>me Wookie My Linux Workstation<br>dmz DMZ Demilitarized zone<br>loc Local Local networks<br>tx Texas Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
<p> This is set up so that I can start the firewall before bringing
up
my Ethernet interfaces. </p>
</blockquote>
<blockquote>
<pre>#ZONE INERFACE BROADCAST OPTIONS<br>net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc eth2 192.168.1.255 dhcp,newnotsyn<br>dmz eth1 192.168.2.255 newnotsyn<br>WiFi eth3 192.168.3.255 dhcp,maclist,newnotsyn<br>- texas 192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
<pre>#ZONE HOST(S) OPTIONS<br>me eth2:192.168.1.3<br>tx texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
<pre>#SOURCE DESTINATION POLICY LOG LEVEL BURST:LIMIT<br>me loc NONE # 'me' and 'loc' are in the same network<br>me all ACCEPT # Allow my workstation unlimited access<br>tx me ACCEPT # Alow Texas access to my workstation<br>WiFi loc ACCEPT # Allow the wireless new access<br>all me CONTINUE # Use all->loc rules for my WS also<br>loc net ACCEPT # Allow all net traffic from local net<br>$FW loc ACCEPT # Allow local access from the firewall<br>$FW tx ACCEPT # Allow firewall access to texas<br>loc tx ACCEPT # Allow local net access to texas<br>loc fw REJECT $LOG # Reject loc->fw and log<br>WiFi net ACCEPT # Allow internet access from wirless<br>net all DROP $LOG 10/sec:40 # Rate limit and<br> # DROP net->dmz<br>all all REJECT $LOG # Reject and log the rest<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
<p> Although most of our internal systems use static NAT, my wife's
system (192.168.1.4) uses IP Masquerading (actually SNAT) as does my
personal system (192.168.1.3), our laptop (192.168.3.8) and
visitors with laptops.<br>
</p>
</blockquote>
<blockquote>
<pre>#INTERFACE SUBNET ADDRESS<br>eth0 eth2 206.124.146.176,206.124.146.179<br>eth0 eth3 206.124.146.176,206.124.146.179<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>206.124.146.178 eth0:0 192.168.1.5 No No<br>206.124.146.180 eth0:2 192.168.1.7 No No<br>#<br># The following entry allows the server to be accessed through an address in<br># the local network. This is convenient when I'm on the road and connected<br># to the PPTP server. By doing this, I don't need to set my client's default<br># gateway to route through the tunnel.<br>#<br>192.168.1.193 eth2:0 206.124.146.177 No No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
<h3>Rules File (The shell variables are set in /etc/shorewall/params):</h3>
<blockquote>
<pre>################################################################################################################################################################<br>#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG loc net tcp 6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT loc net tcp 137,445<br>REJECT loc net udp 137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP loc:!192.168.1.0/24 fw<br>ACCEPT loc fw tcp ssh,time,10000,swat,137,139,445<br>ACCEPT loc fw udp snmp,ntp,445<br>ACCEPT loc fw udp 137:139<br>ACCEPT loc fw udp 1024: 137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT loc dmz udp domain,xdmcp<br>ACCEPT loc dmz tcp www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3 -<br>################################################################################################################################################################<br># Me to DMZ (This compensates for the broken RH kernel running in the DMZ -- that kernel's REJECT target is broken and Evolution requires a REJECT from smtps).<br>#<br>REJECT me dmz tcp 465<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT net dmz tcp smtp,www,ftp,imaps,domain,cvspserver,https -<br>ACCEPT net dmz udp domain<br>ACCEPT net:$MIRRORS dmz tcp rsync<br>ACCEPT:$LOG net dmz tcp 32768:61000 20<br>DROP net dmz tcp 1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT net loc:192.168.1.5 tcp 1723<br>ACCEPT net loc:192.168.1.5 gre<br>#<br># ICQ<br>#<br>ACCEPT net loc:192.168.1.5 tcp 4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT net loc:192.168.1.5 udp 6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT net loc:192.168.1.3 tcp 4000:4100<br>####################################
</blockquote>
The next three files deal with redirecting html requests to Squid on
the DMZ server.<spanstyle="font-weight: bold;"><br>
<prestyle="margin-left: 40px;">#MARK SOURCE DEST PROTO PORT(S) CLIENT PORT(S)<br>#<br># In the PREROUTING chain, mark all HTML connection requests to external <br># servers with value 1<br>#<br>1:P eth2 !192.168.0.0/16 tcp 80<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
<prestyle="margin-left: 40px;">#<br># Add a second routing table with my server as the default gateway<br># Use this routing table with all packets marked with value 1<br># <br>if [ -z "`ip route list table 202 2> /dev/null`" ] ; then<br> run_ip rule add fwmark 1 table www.out<br> run_ip route add default via 206.124.146.177 dev eth1 table www.out<br> run_ip route flush cache<br>fi<br></pre>
