mirror of
https://gitlab.com/shorewall/code.git
synced 2025-01-03 03:59:16 +01:00
Documentation Updates
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1966 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
6f82abad22
commit
09e6003f0c
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2005-01-19</pubdate>
|
||||
<pubdate>2005-02-19</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2005</year>
|
||||
@ -447,6 +447,11 @@
|
||||
url="shorewall_prerequisites.htm">Requirements</ulink></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="Shorewall_and_Routing.html">Routing and
|
||||
Shorewall</ulink></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="Multiple_Zones.html">Routing on One
|
||||
Interface</ulink></para>
|
||||
|
||||
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2005-02-17</pubdate>
|
||||
<pubdate>2005-02-19</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
@ -42,7 +42,8 @@
|
||||
and you must be running Shorewall 2.1.5 or later (with Shorewall 2.2.0
|
||||
Beta 1 or later recommended). The Netfilter patches are available from
|
||||
Netfilter Patch-O-Matic-NG and are also included in some commercial
|
||||
distributions (most notably <trademark>SuSE</trademark> 9.1).</para>
|
||||
distributions (most notably <trademark>SuSE</trademark> 9.1 and
|
||||
9.2).</para>
|
||||
</warning>
|
||||
|
||||
<important>
|
||||
|
||||
@ -21,7 +21,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2005-01-29</pubdate>
|
||||
<pubdate>2005-02-08</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2003</year>
|
||||
@ -52,7 +52,7 @@
|
||||
Source project and is <ulink
|
||||
url="http://openvpn.sourceforge.net/license.html">licensed under the
|
||||
GPL</ulink>. OpenVPN can be downloaded from <ulink
|
||||
url="http://openvpn.sourceforge.net/">http://openvpn.sourceforge.net/</ulink>.</para>
|
||||
url="http://openvpn.net/">http://openvpn.net/</ulink>.</para>
|
||||
|
||||
<para>OpenVPN support was added to Shorewall in version 1.3.14.</para>
|
||||
|
||||
|
||||
@ -13,13 +13,15 @@
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
|
||||
<pubdate>2004-11-14</pubdate>
|
||||
<pubdate>2005-02-20</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2003</year>
|
||||
|
||||
<year>2004</year>
|
||||
|
||||
<year>2005</year>
|
||||
|
||||
<holder>Thomas M Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
@ -48,6 +50,11 @@
|
||||
2.4.0)</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Act as a Proxy (although it can be used with a separate proxy
|
||||
such as Squid or Socks).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Do content filtering:</para>
|
||||
|
||||
|
||||
170
Shorewall-docs2/Shorewall_and_Routing.xml
Normal file
170
Shorewall-docs2/Shorewall_and_Routing.xml
Normal file
@ -0,0 +1,170 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<article>
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Shorewall and Routing</title>
|
||||
|
||||
<authorgroup>
|
||||
<author>
|
||||
<firstname>Tom</firstname>
|
||||
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2005-02-19</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2005</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||
License</ulink></quote>.</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<section>
|
||||
<title>Routing vs. Firewalling.</title>
|
||||
|
||||
<para>One of the most misunderstood aspects of Shorewall is its
|
||||
releationship with routing. This article attempts to clear some of the fog
|
||||
that surrounds this issue.</para>
|
||||
|
||||
<para>As a general principle:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>Routing determines where packets are to be sent.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Once routing determines where the packet is to go, the firewall
|
||||
(Shorewall) determines if the packet is allowed to go there.</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>There are ways that Shorewall can affect routing which are described
|
||||
in the following sections.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Routing and Netfilter</title>
|
||||
|
||||
<para>The following diagram shows the relationship between routing
|
||||
decisions and Netfilter.</para>
|
||||
|
||||
<graphic fileref="images/Netfilter.png" />
|
||||
|
||||
<para>The light blue boxes indicate where routing decisions are made. The
|
||||
green boxes show where Netfilter processing takes place (as directed by
|
||||
Shorewall). You will notice that there are two different paths through
|
||||
this maze, depending on where the packet originates. We will look at each
|
||||
of these separately.</para>
|
||||
|
||||
<section>
|
||||
<title>Packets Entering the Firewall from Outside</title>
|
||||
|
||||
<para>When a packet arrives from outside, it first undergoes Netfilter
|
||||
PREROUTING processing. In Shorewall terms:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>Packets may be marked using entries in the <ulink
|
||||
url="???">/etc/shorewall/tcrules</ulink> file. Entries in that file
|
||||
containing ":P" in the mark column are applied here as are rules
|
||||
that default to the MARK_IN_FORWARD_CHAIN=No setting in
|
||||
<filename>/etc/shorewall/shorewall.conf</filename>. These marks may
|
||||
be used to specify that the packet should be routed using an
|
||||
<firstterm>alternate routing table</firstterm>; see the <ulink
|
||||
url="Shorewall_Squid_Usage.html">Shorewall Squid
|
||||
documentation</ulink> for examples.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>The destination IP address may be rewritten as a consequence
|
||||
of:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>DNAT[-] rules.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>REDIRECT[-] rules.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Entries in <filename>/etc/shorewall/nat</filename>.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>So the only influence that Shorewall has over where these packets
|
||||
go is via NAT or by marking them so that they may be routed using an
|
||||
alternate routing table.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Packets Originating on the Firewall</title>
|
||||
|
||||
<para>Processing of packets that originate on the firewall itself are
|
||||
initially routed using the default routing table then passed through the
|
||||
OUTPUT chains. Shorewall can influence what happens here:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>Packets may be marked using entries in the <ulink
|
||||
url="???">/etc/shorewall/tcrules</ulink> file (rules with "$FW" in
|
||||
the SOURCE column). These marks may be used to specify that the
|
||||
packet should be re-routed using an alternate routing table.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>The destination IP address may be rewritten as a consequence
|
||||
of:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>DNAT[-] rules that specify $FW as the SOURCE.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Entries in <filename>/etc/shorewall/nat</filename> that
|
||||
have "Yes" in LOCAL column.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>So again in this case, the only influence that Shorewall has over
|
||||
the packet destination is NAT or marking.</para>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Alternate Routing Table Configuration</title>
|
||||
|
||||
<para>The <ulink url="Shorewall_Squid_Usage.html">Shorewall Squid
|
||||
documentation</ulink> shows how alternate routing tables can be created
|
||||
and used. That documentation shows how you can use logic in
|
||||
<filename>/etc/shorewall/init</filename> to create and populate an
|
||||
alternate table and to add a routing rule for its use. It is fine to use
|
||||
that technique so long as you understand that you are basically just using
|
||||
the Shorewall init script (<filename>/etc/init.d/shorewall</filename>) to
|
||||
configure your alternate routing table at boot time and that <emphasis
|
||||
role="bold">other than as described in the previous section, there is no
|
||||
connection between Shorewall and routing</emphasis>. </para>
|
||||
</section>
|
||||
</article>
|
||||
Binary file not shown.
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2005-01-24</pubdate>
|
||||
<pubdate>2005-02-20</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2005</year>
|
||||
@ -123,9 +123,9 @@
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>If Shorewall isn't started then
|
||||
<command>/sbin/shorewall/start</command>. Otherwise
|
||||
<command>/sbin/shorewall reset</command>.</para>
|
||||
<para>If Shorewall isn't started then <command>/sbin/shorewall
|
||||
start</command>. Otherwise <command>/sbin/shorewall
|
||||
reset</command>.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user