mirror of
https://gitlab.com/shorewall/code.git
synced 2025-02-09 14:29:20 +01:00
Shorewall 1.4.2
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@535 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
ed0bbce737
commit
16906234c8
@ -16,10 +16,10 @@ run_iptables -A common -p icmp -j icmpdef
|
||||
############################################################################
|
||||
# NETBIOS chatter
|
||||
#
|
||||
run_iptables -A common -p udp --dport 137:139 -j REJECT
|
||||
run_iptables -A common -p udp --dport 445 -j REJECT
|
||||
run_iptables -A common -p tcp --dport 139 -j REJECT
|
||||
run_iptables -A common -p tcp --dport 445 -j REJECT
|
||||
run_iptables -A common -p udp --dport 137:139 -j reject
|
||||
run_iptables -A common -p udp --dport 445 -j reject
|
||||
run_iptables -A common -p tcp --dport 139 -j reject
|
||||
run_iptables -A common -p tcp --dport 445 -j reject
|
||||
run_iptables -A common -p tcp --dport 135 -j reject
|
||||
############################################################################
|
||||
# UPnP
|
||||
|
||||
@ -44,6 +44,15 @@
|
||||
# an ethernet NIC and must be up before
|
||||
# Shorewall is started.
|
||||
#
|
||||
# routeback - Shorewall show set up the infrastructure
|
||||
# to pass packets from this/these
|
||||
# address(es) back to themselves. This is
|
||||
# necessary of hosts in this group use the
|
||||
# services of a transparent proxy that is
|
||||
# a member of the group or if DNAT is used
|
||||
# to send requests originating from this
|
||||
# group to a server in the group.
|
||||
#
|
||||
#
|
||||
#ZONE HOST(S) OPTIONS
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE
|
||||
|
||||
@ -542,6 +542,9 @@ determine_hosts() {
|
||||
interfaces="$interfaces $interface"
|
||||
fi
|
||||
fi
|
||||
|
||||
[ "${host#*:}" = "0.0.0.0/0" ] || \
|
||||
eval ${zone}_is_complex=Yes
|
||||
done
|
||||
|
||||
eval ${zone}_interfaces="\$interfaces"
|
||||
@ -605,6 +608,10 @@ validate_interfaces_file() {
|
||||
;;
|
||||
routefilter|dropunclean|logunclean|blacklist|proxyarp|maclist|-)
|
||||
;;
|
||||
routeback)
|
||||
[ -n "$z" ] || startup_error "The routeback option may not be specified on a multi-zone interface"
|
||||
eval ${z}_routeback=\"$interface:0.0.0.0/0 \$${z}_routeback\"
|
||||
;;
|
||||
*)
|
||||
error_message "Warning: Invalid option ($option) in record \"$r\""
|
||||
;;
|
||||
@ -635,6 +642,9 @@ validate_hosts_file() {
|
||||
case $option in
|
||||
maclist|-)
|
||||
;;
|
||||
routeback)
|
||||
eval ${z}_routeback=\"$host \$${z}_routeback\"
|
||||
;;
|
||||
*)
|
||||
error_message "Warning: Invalid option ($option) in record \"$r\""
|
||||
;;
|
||||
@ -1665,16 +1675,16 @@ check_config() {
|
||||
determine_interfaces
|
||||
determine_hosts
|
||||
|
||||
echo "Validating policy file..."
|
||||
|
||||
validate_policy
|
||||
|
||||
echo "Validating rules file..."
|
||||
|
||||
rules=`find_file rules`
|
||||
strip_file rules $rules
|
||||
process_rules
|
||||
|
||||
echo "Validating policy file..."
|
||||
|
||||
validate_policy
|
||||
|
||||
rm -rf $TMP_DIR
|
||||
|
||||
echo "Configuration Validated"
|
||||
@ -3185,13 +3195,14 @@ initialize_netfilter () {
|
||||
setcontinue FORWARD
|
||||
setcontinue INPUT
|
||||
setcontinue OUTPUT
|
||||
|
||||
#
|
||||
# Allow DNS lookups during startup for FQDNs and deep-six INVALID packets
|
||||
#
|
||||
|
||||
for chain in INPUT OUTPUT FORWARD; do
|
||||
run_iptables -A $chain -p udp --dport 53 -j ACCEPT
|
||||
run_iptables -A $chain -m state --state INVALID -j DROP
|
||||
run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
|
||||
done
|
||||
|
||||
[ -n "$CLAMPMSS" ] && \
|
||||
@ -3661,6 +3672,13 @@ activate_rules()
|
||||
chain1=`rules_chain $FW $zone`
|
||||
chain2=`rules_chain $zone $FW`
|
||||
|
||||
eval complex=\$${zone}_is_complex
|
||||
|
||||
if [ -n "$complex" ]; then
|
||||
frwd_chain=${zone}_frwd
|
||||
createchain $frwd_chain No
|
||||
fi
|
||||
|
||||
echo "$FW $zone $chain1" >> ${STATEDIR}/chains
|
||||
echo "$zone $FW $chain2" >> ${STATEDIR}/chains
|
||||
|
||||
@ -3678,6 +3696,8 @@ activate_rules()
|
||||
|
||||
run_iptables -A `input_chain $interface` -s $subnet -j $chain2
|
||||
|
||||
[ -n "$complex" ] && \
|
||||
run_iptables -A `forward_chain $interface` -s $subnet -j $frwd_chain
|
||||
done
|
||||
|
||||
for zone1 in $zones; do
|
||||
@ -3692,17 +3712,27 @@ activate_rules()
|
||||
|
||||
echo "$zone $zone1 $chain" >> ${STATEDIR}/chains
|
||||
|
||||
if [ $zone = $zone1 ]; then
|
||||
eval routeback=\"\$${zone}_routeback\"
|
||||
else
|
||||
routeback=
|
||||
fi
|
||||
|
||||
for host in $source_hosts; do
|
||||
interface=${host%:*}
|
||||
subnet=${host#*:}
|
||||
chain1=`forward_chain $interface`
|
||||
|
||||
if [ -n "$complex" ]; then
|
||||
chain1=$frwd_chain
|
||||
else
|
||||
chain1=`forward_chain $interface`
|
||||
fi
|
||||
|
||||
for host1 in $dest_hosts; do
|
||||
interface1=${host1%:*}
|
||||
subnet1=${host1#*:}
|
||||
|
||||
if [ "$host" != "$host1" ]; then
|
||||
run_iptables -A $chain1 -s $subnet -o $interface1 -d $subnet1 -j $chain
|
||||
if [ "$host" != "$host1" ] || list_search $host $routeback; then
|
||||
run_iptables -A $chain1 -o $interface1 -d $subnet1 -j $chain
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
@ -181,6 +181,34 @@ mutex_off()
|
||||
rm -f $STATEDIR/lock
|
||||
}
|
||||
|
||||
#
|
||||
# Read a file and handle "INCLUDE" directives
|
||||
#
|
||||
|
||||
read_file() # $1 = file name, $2 = nest count
|
||||
{
|
||||
local first rest
|
||||
|
||||
while read first rest; do
|
||||
if [ "x$first" = "xINCLUDE" ]; then
|
||||
if [ $2 -lt 4 ]; then
|
||||
read_file `find_file ${rest%#*}` $(($2 + 1))
|
||||
else
|
||||
echo " WARNING: INCLUDE in $1 ignored (nested too deeply)" >&2
|
||||
fi
|
||||
else
|
||||
echo "$first $rest"
|
||||
fi
|
||||
done < $1
|
||||
}
|
||||
|
||||
#
|
||||
# Function for including one file into another
|
||||
#
|
||||
INCLUDE() {
|
||||
. `find_file $@`
|
||||
}
|
||||
|
||||
#
|
||||
# Strip comments and blank lines from a file and place the result in the
|
||||
# temporary directory
|
||||
@ -192,7 +220,7 @@ strip_file() # $1 = Base Name of the file, $2 = Full Name of File (optional)
|
||||
[ $# = 1 ] && fname=`find_file $1` || fname=$2
|
||||
|
||||
if [ -f $fname ]; then
|
||||
cut -d'#' -f1 $fname | grep -v '^[[:space:]]*$' > $TMP_DIR/$1
|
||||
read_file $fname 0 | cut -d'#' -f1 | grep -v '^[[:space:]]*$' > $TMP_DIR/$1
|
||||
else
|
||||
> $TMP_DIR/$1
|
||||
fi
|
||||
|
||||
@ -1 +1 @@
|
||||
1.4.1
|
||||
1.4.2
|
||||
|
||||
@ -1 +1 @@
|
||||
1.4.1
|
||||
1.4.2
|
||||
|
||||
@ -1,9 +1,15 @@
|
||||
Changes since 1.4.0
|
||||
Changes since 1.4.1
|
||||
|
||||
1. Implement NONE policy.
|
||||
1. Re-order steps in the 'check' command so that the policy file is
|
||||
checked before the rules file.
|
||||
|
||||
2. Never create rules for <iface>:<subnet> to itself.
|
||||
2. Create an intermediate chain for input from zones defined in terms
|
||||
of specific hosts or networks.
|
||||
|
||||
3. Always allow intrazone traffic.
|
||||
3. Fixed common.def to use 'reject' rather than 'REJECT'.
|
||||
|
||||
4. Correct building of ECN interface list under ash.
|
||||
4. Added support for INCLUDE directive in all files.
|
||||
|
||||
5. Made traceroute -I work.
|
||||
|
||||
6. Add 'routeback' interface and host attribute.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -15,139 +15,148 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Installation and
|
||||
Upgrade</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
Upgrade</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center"><b>Before upgrading, be sure to review the <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></b></p>
|
||||
href="upgrade_issues.htm">Upgrade Issues<br>
|
||||
</a></b></p>
|
||||
|
||||
<div align="left"><b><br>
|
||||
Before attempting installation, I strongly urge you to read and print a
|
||||
copy of the <a href="shorewall_quickstart_guide.htm">Shorewall QuickStart
|
||||
Guide</a> for the configuration that most closely matches your own.</b><br>
|
||||
</div>
|
||||
|
||||
<p><font size="4"><b><a href="#Install_RPM">Install using RPM</a><br>
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
|
||||
<p><a name="Install_RPM"></a>To install Shorewall using the RPM:</p>
|
||||
|
||||
<p><b>If you have RedHat 7.2 and are running iptables version 1.2.3 (at a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
1.2.4 either from the <a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
1.2.4 either from the <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">RedHat update
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
attempting to start Shorewall.</b></p>
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
attempting to start Shorewall.</b></p>
|
||||
|
||||
<ul>
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -ivh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh --nodeps
|
||||
<shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO RESTORE
|
||||
NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO
|
||||
RESTORE NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="Install_Tarball"></a>To install Shorewall using the tarball
|
||||
and install script: </p>
|
||||
and install script: </p>
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-1.1.10").</li>
|
||||
<li>If you are using <a
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-1.1.10").</li>
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to be
|
||||
started automatically at boot, see <a
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to
|
||||
be started automatically at boot, see <a
|
||||
href="starting_and_stopping_shorewall.htm">these instructions</a>.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file that
|
||||
you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file
|
||||
that you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
|
||||
<p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed
|
||||
and are upgrading to a new version:</p>
|
||||
and are upgrading to a new version:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
or and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the new
|
||||
1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for details.</p>
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
|
||||
details.</p>
|
||||
|
||||
<ul>
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm (e.g.,
|
||||
"rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm
|
||||
(e.g., "rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
|
||||
<p> <b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm (rpm
|
||||
-Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent on
|
||||
the iproute package. Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>). </p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>). </p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -163,33 +172,33 @@ rule forms that are no longer supported under 1.4 (you must use the new
|
||||
details. </p>
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-3.0.1").</li>
|
||||
<li>If you are using <a
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-3.0.1").</li>
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
|
||||
</ul>
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
|
||||
<h3><a name="Config_Files"></a>Configuring Shorewall</h3>
|
||||
|
||||
@ -201,12 +210,14 @@ your setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewa
|
||||
|
||||
</ul>
|
||||
|
||||
<p><font size="2">Updated 3/18/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
<p><font size="2">Updated 4/8/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -12,484 +12,507 @@
|
||||
|
||||
<table cellpadding="0" cellspacing="0" border="0" width="100%"
|
||||
bgcolor="#400169">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="middle" width="33%" bgcolor="#400169"><a
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="middle" width="33%" bgcolor="#400169"><a
|
||||
href="http://www.squid-cache.org/"><img src="images/squidnow.gif"
|
||||
alt="" width="88" height="31" hspace="4">
|
||||
</a><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" align="center" width="34%"><font
|
||||
</a><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" align="center" width="34%"><font
|
||||
color="#ffffff"><b><big><big><big><big>Using Shorewall with Squid</big></big></big></big></b></font><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" width="33%" align="right"><a
|
||||
</td>
|
||||
<td valign="middle" height="90" width="33%" align="right"><a
|
||||
href="http://www.squid-cache.org/"><img src="images/cache_now.gif"
|
||||
alt="" width="100" height="31" hspace="4">
|
||||
</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
This page covers Shorewall configuration to use with <a
|
||||
<br>
|
||||
This page covers Shorewall configuration to use with <a
|
||||
href="http://www.squid-cache.org/">Squid </a>running as a <u><b>Transparent
|
||||
Proxy</b></u>. <br>
|
||||
<a href="#DMZ"></a><br>
|
||||
<img border="0" src="images/j0213519.gif" width="60" height="60"
|
||||
alt="Caution" align="middle">
|
||||
Please observe the following general requirements:<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b>In all cases, Squid should be configured to
|
||||
run as a transparent proxy as described at <a
|
||||
Proxy</b></u>. If you are running Shorewall 1.3, please see <a
|
||||
href="1.3/Shorewall_Squid_Usage.html">this documentation</a>.<br>
|
||||
<a href="#DMZ"></a><br>
|
||||
<img border="0" src="images/j0213519.gif" width="60"
|
||||
height="60" alt="Caution" align="middle">
|
||||
Please observe the following general requirements:<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b>In all cases, Squid should be configured to
|
||||
run as a transparent proxy as described at <a
|
||||
href="http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html">http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html</a>.<br>
|
||||
<b><br>
|
||||
</b><b><img src="images/BD21298_3.gif" alt="" width="13"
|
||||
<b><br>
|
||||
</b><b><img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
</b>The following instructions mention the files
|
||||
/etc/shorewall/start and /etc/shorewall/init -- if you don't have those
|
||||
files, siimply create them.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> When the Squid server is in the DMZ zone or
|
||||
in the local zone, that zone must be defined ONLY by its interface -- no
|
||||
/etc/shorewall/hosts file entries. That is because the packets being routed
|
||||
to the Squid server still have their original destination IP addresses.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have iptables installed on your Squid
|
||||
server.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have NAT and MANGLE enabled in your
|
||||
/etc/shorewall/conf file<br>
|
||||
<br>
|
||||
<b><font color="#009900"> NAT_ENABLED=Yes<br>
|
||||
</font></b> <font
|
||||
</b>The following instructions mention the files
|
||||
/etc/shorewall/start and /etc/shorewall/init -- if you don't have those
|
||||
files, siimply create them.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> When the Squid server is in the DMZ zone
|
||||
or in the local zone, that zone must be defined ONLY by its interface
|
||||
-- no /etc/shorewall/hosts file entries. That is because the packets being
|
||||
routed to the Squid server still have their original destination IP addresses.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have iptables installed on your
|
||||
Squid server.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have NAT and MANGLE enabled in your
|
||||
/etc/shorewall/conf file<br>
|
||||
<br>
|
||||
<b><font color="#009900"> NAT_ENABLED=Yes<br>
|
||||
</font></b> <font
|
||||
color="#009900"><b>MANGLE_ENABLED=Yes</b></font><br>
|
||||
<br>
|
||||
Three different configurations are covered:<br>
|
||||
<br>
|
||||
Three different configurations are covered:<br>
|
||||
|
||||
<ol>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running on
|
||||
the Firewall.</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Local">Squid running in the
|
||||
local network</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running in the
|
||||
DMZ</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running
|
||||
on the Firewall.</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Local">Squid running in
|
||||
the local network</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running in the
|
||||
DMZ</a></li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h2><a name="Firewall"></a>Squid Running on the Firewall</h2>
|
||||
You want to redirect all local www connection requests
|
||||
EXCEPT those to your
|
||||
own http server (206.124.146.177)
|
||||
to a Squid transparent
|
||||
proxy running on the firewall and listening on port 3128. Squid
|
||||
will of course require access to remote web servers.<br>
|
||||
<br>
|
||||
In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
You want to redirect all local www connection requests EXCEPT
|
||||
those to your own
|
||||
http server (206.124.146.177)
|
||||
to a Squid
|
||||
transparent proxy running on the firewall and listening on port
|
||||
3128. Squid will of course require access to remote web servers.<br>
|
||||
<br>
|
||||
In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>REDIRECT</td>
|
||||
<td>loc</td>
|
||||
<td>3128</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> -<br>
|
||||
</td>
|
||||
<td>!206.124.146.177</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>REDIRECT</td>
|
||||
<td>loc</td>
|
||||
<td>3128</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> -<br>
|
||||
</td>
|
||||
<td>!206.124.146.177</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h2><a name="Local"></a>Squid Running in the local network</h2>
|
||||
You want to redirect all local www connection requests to a Squid
|
||||
transparent proxy
|
||||
running in your local zone at 192.168.1.3 and listening on port 3128.
|
||||
Your local interface is eth1. There may also be a web server running on
|
||||
192.168.1.3. It is assumed that web access is already enabled from the local
|
||||
zone to the internet.<br>
|
||||
You want to redirect all local www connection requests to a Squid
|
||||
transparent proxy
|
||||
running in your local zone at 192.168.1.3 and listening on port 3128.
|
||||
Your local interface is eth1. There may also be a web server running
|
||||
on 192.168.1.3. It is assumed that web access is already enabled from the
|
||||
local zone to the internet.<br>
|
||||
|
||||
<p><font color="#ff0000"><b>WARNING: </b></font>This setup may conflict with
|
||||
other aspects of your gateway including but not limited to traffic shaping
|
||||
and route redirection. For that reason, <b>I don't recommend it</b>.<br>
|
||||
</p>
|
||||
other aspects of your gateway including but not limited to traffic shaping
|
||||
and route redirection. For that reason, <b>I don't recommend it</b>.<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">echo 202 www.out >> /etc/iproute2/rt_tables</font></b><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.168.1.3 dev eth1 table www.out<br> ip route flush cache<br> echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects<br>fi<br></font></b></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT<br>
|
||||
</td>
|
||||
<td>loc</td>
|
||||
<td>loc<br>
|
||||
</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>Alternativfely, you can have the following policy:<br>
|
||||
<br>
|
||||
<li>If you are running Shorewall 1.4.1 or Shorewall 1.4.1a, please
|
||||
upgrade to Shorewall 1.4.2 or later.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST PARAMETERS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ZONE<br>
|
||||
</td>
|
||||
<td valign="top">INTERFACE<br>
|
||||
</td>
|
||||
<td valign="top">BROADCAST<br>
|
||||
</td>
|
||||
<td valign="top">OPTIONS<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">detect<br>
|
||||
</td>
|
||||
<td valign="top"><b>routeback</b><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/start add:<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT<br>
|
||||
</td>
|
||||
<td>loc</td>
|
||||
<td>loc<br>
|
||||
</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</li>
|
||||
<br>
|
||||
<li>Alternativfely, if you are running Shorewall 1.4.0 you can have the
|
||||
following policy in place of the above rule:<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST PARAMETERS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/start add:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>iptables -t mangle -A PREROUTING -i eth1 -s ! 192.168.1.3 -p tcp --dport 80 -j MARK --set-mark 202</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.168.1.3, arrange for the following command to be executed
|
||||
after networking has come up<br>
|
||||
<li>On 192.168.1.3, arrange for the following command to be executed
|
||||
after networking has come up<br>
|
||||
|
||||
<pre><b><font color="#009900">iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-ports 3128</font></b><br></pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> If you are running RedHat on the server, you can simply execute
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
||||
color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<h2><a name="DMZ"></a>Squid Running in the DMZ (This is what I do)</h2>
|
||||
You have a single Linux system in your DMZ with IP address 192.0.2.177.
|
||||
You want to run both a web server and Squid on that system. Your DMZ interface
|
||||
is eth1 and your local interface is eth2.<br>
|
||||
You have a single Linux system in your DMZ with IP address 192.0.2.177.
|
||||
You want to run both a web server and Squid on that system. Your DMZ
|
||||
interface is eth1 and your local interface is eth2.<br>
|
||||
|
||||
<ul>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>echo 202 www.out >> /etc/iproute2/rt_tables</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.0.2.177 dev eth1 table www.out<br> ip route flush cache<br>fi</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li> Do<b> one </b>of the following:<br>
|
||||
<br>
|
||||
A) In /etc/shorewall/start add<br>
|
||||
</li>
|
||||
<li> Do<b> one </b>of the following:<br>
|
||||
<br>
|
||||
A) In /etc/shorewall/start add<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900"> iptables -t mangle -A PREROUTING -i eth2 -p tcp --dport 80 -j MARK --set-mark 202</font></b><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf
|
||||
and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
C) Run Shorewall 1.3.14 or later and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202:P<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/rules, you will need:</li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
C) Run Shorewall 1.3.14 or later and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ACTION<br>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTO<br>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
PORT(S)<br>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT<br>
|
||||
PORT(2)<br>
|
||||
</td>
|
||||
<td valign="top">ORIGINAL<br>
|
||||
DEST<br>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
<td valign="top">202:P<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.0.2.177 (your Web/Squid server), arrange for the following
|
||||
command to be executed after networking has come up<br>
|
||||
<li>In /etc/shorewall/rules, you will need:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ACTION<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
</td>
|
||||
<td valign="top">PROTO<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
PORT(S)<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT<br>
|
||||
PORT(2)<br>
|
||||
</td>
|
||||
<td valign="top">ORIGINAL<br>
|
||||
DEST<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.0.2.177 (your Web/Squid server), arrange for the following
|
||||
command to be executed after networking has come up<br>
|
||||
|
||||
<pre><font color="#009900"><b>iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128</b></font><br></pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> If you are running RedHat on the server, you can simply execute
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
||||
color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<p><font size="-1"> Updated 2/22/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
<p><font size="-1"> Updated 4/7/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
<a
|
||||
href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> ©
|
||||
<font size="2">2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -13,186 +13,152 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall and Aliased Interfaces</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<h2>Background</h2>
|
||||
The traditional net-tools contain a program called <i>ifconfig</i> which
|
||||
The traditional net-tools contain a program called <i>ifconfig</i> which
|
||||
is used to configure network devices. ifconfig introduced the concept of
|
||||
<i>aliased </i>or <i>virtial </i>interfaces. These virtual interfaces have
|
||||
names of the form <i>interface</i>:<i>integer </i>(e.g., eth0:0) and ifconfig
|
||||
treats them more or less like real interfaces.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
|
||||
<pre>[root@gateway root]# ifconfig eth0:0<br>eth0:0 Link encap:Ethernet HWaddr 02:00:08:3:FA:55<br> inet addr:206.124.146.178 Bcast:206.124.146.255 Mask:255.255.255.0<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> Interrupt:11 Base address:0x2000<br>[root@gateway root]# <br></pre>
|
||||
The ifconfig utility is being gradually phased out in favor of the <i>ip</i>
|
||||
The ifconfig utility is being gradually phased out in favor of the <i>ip</i>
|
||||
utility which is part of the <i>iproute </i>package. The ip utility does
|
||||
not use the concept of aliases or virtual interfaces but rather treats additional
|
||||
addresses on an interface as objects. The ip utility does provide for interaction
|
||||
with ifconfig in that it allows addresses to be <i>labeled </i>and labels
|
||||
may take the form of ipconfig virtual interfaces.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
|
||||
<pre>[root@gateway root]# ip addr show dev eth0<br>2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb qlen 100<br> link/ether 02:00:08:e3:fa:55 brd ff:ff:ff:ff:ff:ff<br> inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0<br> inet 206.124.146.178/24 brd 206.124.146.255 scope global secondary eth0:0<br>[root@gateway root]# <br></pre>
|
||||
Note that one <u>cannot</u> type "ip addr show dev eth0:0" because "eth0:0"
|
||||
Note that one <u>cannot</u> type "ip addr show dev eth0:0" because "eth0:0"
|
||||
is a label for a particular address rather than a device name.<br>
|
||||
|
||||
<pre>[root@gateway root]# ip addr show dev eth0:0<br>Device "eth0:0" does not exist.<br>[root@gateway root]#<br></pre>
|
||||
The iptables program doesn't support virtual interfaces in either it's
|
||||
The iptables program doesn't support virtual interfaces in either it's
|
||||
"-i" or "-o" command options; as a consequence, Shorewall does not allow
|
||||
them to be used in the /etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<h2>So how do I handle more than one address on an interface?</h2>
|
||||
The answer depends on what you are trying to do with the interfaces.
|
||||
The answer depends on what you are trying to do with the interfaces.
|
||||
In the sub-sections that follow, we'll take a look at common scenarios.<br>
|
||||
|
||||
<h3>Separate Rules</h3>
|
||||
If you need to make a rule for traffic to/from the firewall itself that
|
||||
If you need to make a rule for traffic to/from the firewall itself that
|
||||
only applies to a particular IP address, simply qualify the $FW zone with
|
||||
the IP address.<br>
|
||||
<br>
|
||||
Example (allow SSH from net to eth0:0 above):<br>
|
||||
<br>
|
||||
<br>
|
||||
Example (allow SSH from net to eth0:0 above):<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">fw:206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top">fw:206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>DNAT</h3>
|
||||
Suppose that I had set up eth0:0 as above and I wanted to port forward
|
||||
Suppose that I had set up eth0:0 as above and I wanted to port forward
|
||||
from that virtual interface to a web server running in my local zone at
|
||||
192.168.1.3. That is accomplised by a single rule in the /etc/shorewall/rules
|
||||
file:<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>SNAT</h3>
|
||||
If you wanted to use eth0:0 as the IP address for outbound connections
|
||||
If you wanted to use eth0:0 as the IP address for outbound connections
|
||||
from your local zone (eth1), then in /etc/shorewall/masq:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SUBNET<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ADDRESS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -206,7 +172,7 @@ file:<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0:0<br>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
@ -218,51 +184,42 @@ file:<br>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>STATIC NAT</h3>
|
||||
If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3,
|
||||
you would have the following in /etc/shorewall/nat:<br>
|
||||
<br>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>EXTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ALL INTERFACES<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOCAL<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SUBNET<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ADDRESS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0:0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>STATIC NAT</h3>
|
||||
If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3,
|
||||
you would have the following in /etc/shorewall/nat:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -282,7 +239,7 @@ file:<br>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0:0<br>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
@ -295,252 +252,115 @@ file:<br>
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In either case, to create rules that pertain only to this NAT pair, you
|
||||
simply qualify the local zone with the internal IP address.<br>
|
||||
<br>
|
||||
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a.
|
||||
192.168.1.3.<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>EXTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ALL INTERFACES<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOCAL<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0:0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
In either case, to create rules that pertain only to this NAT pair, you
|
||||
simply qualify the local zone with the internal IP address.<br>
|
||||
<br>
|
||||
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a.
|
||||
192.168.1.3.<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>MULTIPLE SUBNETS</h3>
|
||||
Sometimes multiple IP addresses are used because there are multiple subnetworks
|
||||
configured on a LAN segment. This technique does not provide for any security
|
||||
between the subnetworks if the users of the systems have administrative
|
||||
privileges because in that case, the users can simply manipulate their system's
|
||||
routing table to bypass your firewall/router. Nevertheless, there are cases
|
||||
where you simply want to consider the LAN segment itself as a zone and allow
|
||||
your firewall/router to route between the two subnetworks.<br>
|
||||
<br>
|
||||
Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and
|
||||
Sometimes multiple IP addresses are used because there are multiple
|
||||
subnetworks configured on a LAN segment. This technique does not provide
|
||||
for any security between the subnetworks if the users of the systems have
|
||||
administrative privileges because in that case, the users can simply manipulate
|
||||
their system's routing table to bypass your firewall/router. Nevertheless,
|
||||
there are cases where you simply want to consider the LAN segment itself
|
||||
as a zone and allow your firewall/router to route between the two subnetworks.<br>
|
||||
<br>
|
||||
Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and
|
||||
192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and eth1:0
|
||||
is 192.168.20.254. You want to simply route all requests between the two
|
||||
subnetworks.<br>
|
||||
|
||||
<h4>If you are running Shorewall 1.4.1 or Later</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall
|
||||
1.4.1 and later releases default to allowing intra-zone traffic.<br>
|
||||
<h4>If you are running Shorewall 1.4.0 or earlier<br>
|
||||
</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/policy:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST:LIMIT<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24.
|
||||
The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254.
|
||||
You want to make these subnetworks into separate zones and control the access
|
||||
between them (the users of the systems do not have administrative privileges).<br>
|
||||
<br>
|
||||
In /etc/shorewall/zones:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DISPLAY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESCRIPTION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">Local<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 1<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">Local2<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 2<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
@ -558,18 +378,55 @@ specify the <b>multi</b> option.<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall
|
||||
1.4.1 and later releases default to allowing intra-zone traffic.<br>
|
||||
|
||||
<h4>If you are running Shorewall 1.4.0 or earlier<br>
|
||||
</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -577,7 +434,9 @@ specify the <b>multi</b> option.<br>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
@ -585,15 +444,47 @@ specify the <b>multi</b> option.<br>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/policy:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST:LIMIT<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
@ -601,21 +492,131 @@ specify the <b>multi</b> option.<br>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24.
|
||||
The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254.
|
||||
You want to make these subnetworks into separate zones and control the
|
||||
access between them (the users of the systems do not have administrative
|
||||
privileges).<br>
|
||||
<br>
|
||||
In /etc/shorewall/zones:<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic
|
||||
that you want to permit.<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/22/2003 A - <a
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DISPLAY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESCRIPTION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">Local<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 1<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">Local2<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 2<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic
|
||||
that you want to permit.<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/27/2003 A - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -17,59 +17,55 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><b>I strongly urge you to read and print a copy of the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||
for the configuration that most closely matches your own.<br>
|
||||
</b></p>
|
||||
for the configuration that most closely matches your own.<br>
|
||||
</b></p>
|
||||
|
||||
<p>The entire set of Shorewall documentation is available in PDF format
|
||||
at:</p>
|
||||
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
||||
|
||||
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||||
<a href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||
<a href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||
</p>
|
||||
|
||||
<p>The documentation in HTML format is included in the .rpm and in the
|
||||
.tgz packages below.</p>
|
||||
<p>The documentation in HTML format is included in the .rpm and in the .tgz
|
||||
packages below.</p>
|
||||
|
||||
<p> Once you've printed the appropriate QuickStart Guide, download <u>
|
||||
one</u> of the modules:</p>
|
||||
one</u> of the modules:</p>
|
||||
|
||||
<ul>
|
||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
||||
with a 2.4 kernel, you can use the RPM version (note: the
|
||||
RPM should also work with other distributions that
|
||||
store init scripts in /etc/init.d and that include chkconfig
|
||||
or insserv). If you find that it works in other cases, let <a
|
||||
RPM should also work with other distributions that store
|
||||
init scripts in /etc/init.d and that include chkconfig or
|
||||
insserv). If you find that it works in other cases, let <a
|
||||
href="mailto:teastep@shorewall.net"> me</a> know so that
|
||||
I can mention them here. See the <a href="Install.htm">Installation
|
||||
Instructions</a> if you have problems installing the RPM.</li>
|
||||
<li>If you are running LRP, download the .lrp file (you
|
||||
might also want to download the .tgz so you will have a copy
|
||||
of the documentation).</li>
|
||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||
<li>If you are running LRP, download the .lrp file
|
||||
(you might also want to download the .tgz so you will have a
|
||||
copy of the documentation).</li>
|
||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||
and would like a .deb package, Shorewall is included in both
|
||||
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
Testing Branch</a> and the <a
|
||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||||
Unstable Branch</a>.</li>
|
||||
<li>Otherwise, download the <i>shorewall</i>
|
||||
module (.tgz)</li>
|
||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian Unstable
|
||||
Branch</a>.</li>
|
||||
<li>Otherwise, download the <i>shorewall</i> module
|
||||
(.tgz)</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -77,21 +73,21 @@ the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
and there is an documentation .deb that also contains the documentation. The
|
||||
.rpm will install the documentation in your default document directory which
|
||||
can be obtained using the following command:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
<p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p>Please verify the version that you have downloaded -- during the
|
||||
release of a new version of Shorewall, the links below may
|
||||
point to a newer or an older version than is shown below.</p>
|
||||
|
||||
<ul>
|
||||
<li>RPM - "rpm -qip LATEST.rpm"</li>
|
||||
<li>TARBALL - "tar -ztf LATEST.tgz" (the directory
|
||||
name will contain the version)</li>
|
||||
<li>LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar
|
||||
<li>RPM - "rpm -qip shorewall-<i>version</i>.noarch.rpm"</li>
|
||||
<li>TARBALL - "tar -ztf shorewall-<i>version</i>.tgz"
|
||||
(the directory name will contain the version)</li>
|
||||
<li>LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar
|
||||
-zxf <downloaded .lrp>; cat var/lib/lrpkg/shorwall.version"
|
||||
</li>
|
||||
|
||||
@ -100,340 +96,86 @@ the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
<p>Once you have verified the version, check the <font
|
||||
color="#ff0000"> <a href="errata.htm"> errata</a></font> to see
|
||||
if there are updates that apply to the version that you have
|
||||
downloaded.</p>
|
||||
downloaded.</p>
|
||||
|
||||
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed
|
||||
configuration of your firewall, you can enable startup by removing the
|
||||
file /etc/shorewall/startup_disabled.</b></font></p>
|
||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION IS
|
||||
REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed configuration
|
||||
of your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
||||
|
||||
<p><b>Download Latest Version</b> (<b>1.4.0</b>): <b>Remember that updates
|
||||
to the mirrors occur 1-12 hours after an update to the Washington
|
||||
State site.</b></p>
|
||||
<p><b></b></p>
|
||||
|
||||
<blockquote>
|
||||
<table border="2" cellspacing="3" cellpadding="3"
|
||||
style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">SourceForge<br>
|
||||
</td>
|
||||
<td valign="top">sf.net<br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Download</a><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.rpm">Download
|
||||
.rpm</a><br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.rpm">Download .rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.lrp"> Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.samples"> Download
|
||||
.samples</a><a
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||
.rpm</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td> <a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||
Download .lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.samples">
|
||||
Download .samples</a><a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||
Download .lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.samples">
|
||||
Download .samples</a><a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Paris, France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://france.shorewall.net/pub/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a href="http://france.shorewall.net/pub/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://france.shorewall.net/pub/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.samples">Download
|
||||
.samples</a><a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="middle">Washington State, USA<br>
|
||||
</td>
|
||||
<td valign="middle">Shorewall.net<br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.rpm" target="_blank">
|
||||
Download .rpm</a> <br>
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.tgz" target="_blank">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.lrp" target="_blank">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.samples"
|
||||
target="_blank">Download .samples</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
|
||||
<p><b>Browse Download Sites:</b></p>
|
||||
<p><b>Download Sites:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SourceForge<br>
|
||||
</td>
|
||||
<td>sf.net</td>
|
||||
<td><a
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SourceForge<br>
|
||||
</td>
|
||||
<td>sf.net</td>
|
||||
<td><a
|
||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
||||
<td>N/A</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td><a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<td>N/A</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Washington State, USA</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td><a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Washington State, USA</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p align="left"><b>CVS:</b></p>
|
||||
|
||||
@ -443,14 +185,15 @@ the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
||||
Shorewall component. There's no guarantee that what you find there
|
||||
will work at all.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/6/2003 - <a
|
||||
<p align="left"><font size="2">Last Updated 3/24/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,19 +2,14 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall 1.4 Errata</title>
|
||||
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
@ -24,15 +19,12 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -40,82 +32,100 @@
|
||||
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
|
||||
|
||||
<li>
|
||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||
a corrected script, be sure to run the script through <u>
|
||||
a corrected script, be sure to run the script through <u>
|
||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>If you are installing Shorewall for the first
|
||||
time and plan to use the .tgz and install.sh script, you can untar
|
||||
the archive, replace the 'firewall' script in the untarred directory
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>When the instructions say to install a corrected
|
||||
firewall script in /usr/share/shorewall/firewall, you may
|
||||
rename the existing file before copying in the new file.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
firewall script in /usr/share/shorewall/firewall, you may
|
||||
rename the existing file before copying in the new file.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are running
|
||||
1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are running
|
||||
1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<ul>
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
href="errata_3.html">Problems in Version 1.3</a></b></li>
|
||||
<li> <b><a
|
||||
<li> <b><a
|
||||
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
||||
<li> <b><font
|
||||
<li> <b><font
|
||||
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||
<li> <b><font
|
||||
<li> <b><font
|
||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a
|
||||
href="#Debug">Problems with kernels >= 2.4.18 and RedHat
|
||||
iptables</a></b></li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
RPM on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with iptables
|
||||
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
and NAT</a></b><br>
|
||||
</li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
RPM on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with iptables
|
||||
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
and NAT</a></b><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
<h2 align="left"><a name="V1.4"></a>Problems in Version 1.4</h2>
|
||||
|
||||
|
||||
<h3></h3>
|
||||
|
||||
<h3>1.4.0</h3>
|
||||
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
||||
<ul>
|
||||
<li>When running under certain shells Shorewall will attempt to create
|
||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||
/etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
<li>Some TCP requests are rejected in the 'common' chain with an ICMP port-unreachable
|
||||
response rather than the more appropriate TCP RST response. This problem
|
||||
is corrected in this updated common.def file which may be installed in /etc/shorewall/common.def.<br>
|
||||
</li>
|
||||
</ul>
|
||||
<h3>1.4.1</h3>
|
||||
|
||||
<ul>
|
||||
<li>When a "shorewall check" command is executed, each "rule" produces
|
||||
the harmless additional message:<br>
|
||||
<br>
|
||||
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected<br>
|
||||
<br>
|
||||
You may correct the problem by installing <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
||||
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
||||
as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>When running under certain shells Shorewall will attempt to create
|
||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||
/etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr width="100%" size="2">
|
||||
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
||||
|
||||
@ -124,140 +134,122 @@ correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
|
||||
<hr>
|
||||
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
||||
iptables version 1.2.3</font></h3>
|
||||
iptables version 1.2.3</font></h3>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
RedHat released this buggy iptables in RedHat 7.2. </p>
|
||||
|
||||
|
||||
<p align="left"> I have built a <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have
|
||||
also built an <a
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have
|
||||
also built an <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||
has released an iptables-1.2.4 RPM of their own which you can
|
||||
download from<font color="#ff6633"> <a
|
||||
has released an iptables-1.2.4 RPM of their own which you can
|
||||
download from<font color="#ff6633"> <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||
</font>I have installed this RPM on my firewall and it works
|
||||
fine.</p>
|
||||
|
||||
</font>I have installed this RPM on my firewall and it works
|
||||
fine.</p>
|
||||
|
||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||
the patches are available for download. This <a
|
||||
the patches are available for download. This <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||
which corrects a problem with parsing of the --log-level specification
|
||||
while this <a
|
||||
which corrects a problem with parsing of the --log-level
|
||||
specification while this <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
<p align="left">To install one of the above patches:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18
|
||||
and RedHat iptables</h3>
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18 and
|
||||
RedHat iptables</h3>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||
may experience the following:</p>
|
||||
|
||||
may experience the following:</p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
|
||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||
this iptables RPM</a>. If you are already running a 1.2.5 version
|
||||
of iptables, you will need to specify the --oldpackage option
|
||||
to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
this iptables RPM</a>. If you are already running a 1.2.5
|
||||
version of iptables, you will need to specify the --oldpackage
|
||||
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||
RPM on SuSE</h3>
|
||||
|
||||
|
||||
<p>If you find that rpm complains about a conflict
|
||||
with kernel <= 2.2 yet you have a 2.4 kernel
|
||||
installed, simply use the "--nodeps" option to
|
||||
rpm.</p>
|
||||
RPM on SuSE</h3>
|
||||
|
||||
<p>If you find that rpm complains about a conflict with kernel <=
|
||||
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
|
||||
option to rpm.</p>
|
||||
|
||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
|
||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
||||
MULTIPORT=Yes</b></h3>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with
|
||||
iptables version 1.2.7 and MULTIPORT=Yes</b></h3>
|
||||
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made
|
||||
an incompatible change to the syntax used to
|
||||
specify multiport match rules; as a consequence,
|
||||
if you install iptables 1.2.7 you must be running
|
||||
Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
||||
change to the syntax used to specify multiport match rules; as
|
||||
a consequence, if you install iptables 1.2.7 you must be
|
||||
running Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<ul>
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or </li>
|
||||
<li>if you are running
|
||||
Shorewall 1.3.6 you may install
|
||||
<a
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or
|
||||
</li>
|
||||
<li>if you are running
|
||||
Shorewall 1.3.6 you may install
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will result
|
||||
in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will
|
||||
result in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
|
||||
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
Error message is:<br>
|
||||
Error message is:<br>
|
||||
|
||||
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
||||
The solution is to put "no" in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
||||
disabled it. The 2.4.19 kernel contains corrected support under a new
|
||||
kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
The solution is to put "no" in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
||||
disabled it. The 2.4.19 kernel contains corrected support under a
|
||||
new kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
|
||||
<p><font size="2"> Last updated 3/21/2003 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
<p><font size="2"> Last updated 3/25/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
</p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -2,22 +2,16 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -25,109 +19,101 @@
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle" align="left">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle" align="left">
|
||||
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a></h1>
|
||||
|
||||
|
||||
<a
|
||||
</a></h1>
|
||||
<a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35" alt="">
|
||||
</a>
|
||||
|
||||
</a>
|
||||
<p align="right"><font color="#ffffff"><b> </b></font> </p>
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
||||
</td>
|
||||
<td valign="middle" width="33%"> <a
|
||||
</td>
|
||||
<td valign="middle" width="33%"> <a
|
||||
href="http://www.postfix.org/"> <img
|
||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
||||
height="45" alt="(Postfix Logo)">
|
||||
</a><br>
|
||||
</a><br>
|
||||
|
||||
<div align="left"><a href="http://www.spamassassin.org"><img
|
||||
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
||||
border="0">
|
||||
</a> </div>
|
||||
<br>
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
<div align="right"><br>
|
||||
<b><font color="#ffffff"><br>
|
||||
Powered by Postfix </font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<b><font color="#ffffff"><br>
|
||||
Powered by Postfix </font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
Guide</a>.<br>
|
||||
</h1>
|
||||
</h1>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tom dot eastep
|
||||
at hp dot com.</p>
|
||||
<p align="left">You can report such problems by sending mail to tmeastep
|
||||
at hotmail dot com.</p>
|
||||
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
|
||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX
|
||||
record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command
|
||||
<li>to ensure that the host name in the HELO/EHLO command
|
||||
is a valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in
|
||||
list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the
|
||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||
one list subscriber wrote to me privately "These e-mail admin's need to
|
||||
get a <i>(explitive deleted)</i> life instead of trying to rid the planet
|
||||
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||
posts as must as possible, I have now configured the list server at shorewall.net
|
||||
to strip all HTML from outgoing posts. This means that HTML-only posts
|
||||
will be bounced by the list server.<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the list
|
||||
subscribers whose MTAs are bouncing all shorewall.net mail. As one list
|
||||
subscriber wrote to me privately "These e-mail admin's need to get a <i>(explitive
|
||||
deleted)</i> life instead of trying to rid the planet of HTML based e-mail".
|
||||
Nevertheless, to allow subscribers to receive list posts as must as possible,
|
||||
I have now configured the list server at shorewall.net to strip all HTML
|
||||
from outgoing posts. This means that HTML-only posts will be bounced by
|
||||
the list server.<br>
|
||||
|
||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post, your
|
||||
If you find that you are missing an occasional list post, your
|
||||
e-mail admin may be blocking mail whose <i>Received:</i> headers contain
|
||||
the names of certain ISPs. Again, I believe that such policies hurt more
|
||||
than they help but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
||||
@ -138,20 +124,17 @@ than they help but I'm not prepared to go so far as to start stripping <i>Recei
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -160,22 +143,21 @@ than they help but I'm not prepared to go so far as to start stripping <i>Recei
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
</form>
|
||||
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
||||
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
||||
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued by Shoreline
|
||||
If you want to trust X.509 certificates issued by Shoreline
|
||||
Firewall (such as the one used on my web site), you may <a
|
||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates then
|
||||
@ -195,12 +177,12 @@ stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
@ -212,30 +194,30 @@ stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
list may be found at <a
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
||||
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
||||
may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
@ -245,12 +227,12 @@ list may be found at <a
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
||||
|
||||
@ -270,26 +252,23 @@ list may be found at <a
|
||||
to make this less confusing. To unsubscribe:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
|
||||
<li>
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a
|
||||
password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
||||
reminder, or change your subscription options enter your subscription
|
||||
email address:". Enter your email address in the box and
|
||||
click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be emailed
|
||||
to you.</p>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -298,12 +277,13 @@ your subscription email address:". Enter your email address
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 2/24/2003 - <a
|
||||
<p align="left"><font size="2">Last updated 3/24/2003 - <a
|
||||
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -2,370 +2,246 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" height="90">
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><a
|
||||
</a></i></font><a
|
||||
href="http://www.shorewall.net" target="_top"><img border="1"
|
||||
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
||||
alt="(Shorewall Logo)" align="right" vspace="4">
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small><big></big>
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
|
||||
<div align="center">
|
||||
<h1><font color="#ffffff">Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy" </small></small></small></font></i></h1>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top">
|
||||
</a> </p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="1.3" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.3 Site is here</font></a>
|
||||
<br>
|
||||
|
||||
</div>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
||||
href="1.3" target="_top"><font color="#ffffff"><br>
|
||||
<small><small><small><small>Shorewall 1.3 Site is here</small></small></small></small></font></a><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><br>
|
||||
<small><small><small><small>Shorewall 1.2 Site is here</small></small></small></small></font></a><br>
|
||||
|
||||
</h1>
|
||||
</div>
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="90%">
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is a
|
||||
<a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
|
||||
that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
|
||||
<br>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR
|
||||
A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
|
||||
<br>
|
||||
|
||||
You should have received
|
||||
a copy of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
<br>
|
||||
This program is
|
||||
distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the
|
||||
implied warranty of MERCHANTABILITY or FITNESS
|
||||
FOR A PARTICULAR PURPOSE. See the GNU General
|
||||
Public License for more details.<br>
|
||||
<br>
|
||||
You should have
|
||||
received a copy of the GNU General Public
|
||||
License along with this program; if
|
||||
not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques Nilo
|
||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
</a>Jacques Nilo
|
||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
<p><b>Congratulations to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! </b><br>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>Congratulations to Jacques and Eric on the recent release of
|
||||
Bering 1.1!!! </b><br>
|
||||
</p>
|
||||
|
||||
<h2>This is a mirror of the main Shorewall web site at SourceForge
|
||||
(<a href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
||||
<h2>This is a mirror of the main Shorewall web site at SourceForge (<a
|
||||
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
<p><b>3/24/2003 - Shorewall 1.4.1 </b><b> </b><b><img
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><b> </b></p>
|
||||
This release follows up on 1.4.0. It corrects a problem introduced in 1.4.0
|
||||
and removes additional warts.<br>
|
||||
<br>
|
||||
<b>Problems Corrected:</b><br>
|
||||
<ol>
|
||||
<li>When Shorewall 1.4.0 is run under the ash shell (such as on Bering/LEAF),
|
||||
it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn
|
||||
file is empty. That problem has been corrected so that ECN disabling rules
|
||||
are only added if there are entries in /etc/shorewall/ecn.</li>
|
||||
</ol>
|
||||
<b>New Features:</b><br>
|
||||
<blockquote>Note: In the list that follows, the term <i>group </i>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
|
||||
a host address) accessed through a particular interface. Examples:<br>
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
</blockquote>
|
||||
<ol>
|
||||
<li>Beginning with Shorewall 1.4.1, if a zone Z comprises more than
|
||||
one group<i> </i>then if there is no explicit Z to Z policy and there are
|
||||
no rules governing traffic from Z to Z then Shorewall will permit all traffic
|
||||
between the groups in the zone.</li>
|
||||
<li>Beginning with Shorewall 1.4.1, Shorewall will never create rules
|
||||
to handle traffic from a group to itself.</li>
|
||||
<li>A NONE policy is introduced in 1.4.1. When a policy of NONE is
|
||||
specified from Z1 to Z2:</li>
|
||||
</ol>
|
||||
<ul>
|
||||
<li>There may be no rules created that govern connections from Z1
|
||||
to Z2.</li>
|
||||
<li>Shorewall will not create any infrastructure to handle traffic
|
||||
from Z1 to Z2.</li>
|
||||
</ul>
|
||||
See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion
|
||||
of how these changes may affect your configuration.<br>
|
||||
</b><br>
|
||||
</p>
|
||||
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b> chain
|
||||
are now properly rejected with TCP RST; previously, some of these requests
|
||||
were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously timed out
|
||||
on the first hop (e.g., to the firewall). This has been worked around.</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file specifies a
|
||||
particular host or network, Shorewall now creates an intermediate chain for
|
||||
handling input from the related zone. This can substantially reduce the number
|
||||
of rules traversed by connections requests from such zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the contents
|
||||
of the named file to be logically included into the file containing the INCLUDE.
|
||||
File names given in an INCLUDE directive are assumed to reside in /etc/shorewall
|
||||
or in an alternate configuration directory if one has been specified for the
|
||||
command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||
are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that interface continues
|
||||
to be a problem. While I firmly believe that this should never happen, people
|
||||
continue to want to do it. To limit the damage that such nonsense produces,
|
||||
I have added a new 'routeback' option in /etc/shorewall/interfaces and /etc/shorewall/hosts.
|
||||
When used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
||||
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on individual group
|
||||
entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option with two exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
||||
tuples associated with the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="file:///Z:/Shorewall-docs/upgrade_issues.htm">Upgrade
|
||||
Issues</a>' for information about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <a
|
||||
href="http://sourceforge.net">M</a></td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</td>
|
||||
<td
|
||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
</a></p>
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 3/21/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<p><font size="2">Updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,450 +2,247 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" height="90">
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font
|
||||
</a></i></font><font
|
||||
color="#ffffff">Shorewall 1.4 - <font
|
||||
size="4">"<i>iptables made easy"</i></font></font><a
|
||||
href="http://www.sf.net"> </a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="/1.3/index.html" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.3 Site here</font></a></div>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font color="#ffffff">
|
||||
<small><small><small>Shorewall 1.3 Site here</small></small></small></font></a><br>
|
||||
<a target="_top" href="http://www1.shorewall.net/1.2/index.htm"><font
|
||||
color="#ffffff"><small><small><small>Shorewall 1.2 Site here<br>
|
||||
</small></small></small></font></a>
|
||||
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="90%">
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall
|
||||
system, a multi-function gateway/router/server or on a standalone
|
||||
GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall
|
||||
system, a multi-function gateway/router/server or on
|
||||
a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
|
||||
<br>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR
|
||||
A PARTICULAR PURPOSE. See the GNU General Public
|
||||
License for more details.<br>
|
||||
|
||||
<br>
|
||||
|
||||
You should have received
|
||||
a copy of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
it under
|
||||
the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
This program
|
||||
is distributed in the hope that it will
|
||||
be useful, but WITHOUT ANY WARRANTY; without
|
||||
even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
<br>
|
||||
You should have
|
||||
received a copy of the GNU General Public
|
||||
License along with this program; if
|
||||
not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
</a>Jacques Nilo
|
||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
||||
find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
</b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>3/24/2003 - Shorewall 1.4.1 </b><b> </b><b><img
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
</b>
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><b> </b></p>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This release follows up on 1.4.0. It corrects a problem introduced
|
||||
in 1.4.0 and removes additional warts.<br>
|
||||
<br>
|
||||
<b>Problems Corrected:</b><br>
|
||||
</b><br>
|
||||
</p>
|
||||
<ol>
|
||||
<li>When Shorewall 1.4.0 is run under the ash shell (such as on Bering/LEAF),
|
||||
it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn file
|
||||
is empty. That problem has been corrected so that ECN disabling rules are
|
||||
only added if there are entries in /etc/shorewall/ecn.</li>
|
||||
</ol>
|
||||
<b>New Features:</b><br>
|
||||
|
||||
<blockquote>Note: In the list that follows, the term <i>group </i>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
|
||||
a host address) accessed through a particular interface. Examples:<br>
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b> chain
|
||||
are now properly rejected with TCP RST; previously, some of these requests
|
||||
were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously timed out
|
||||
on the first hop (e.g., to the firewall). This has been worked around.</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<ol>
|
||||
<li>Beginning with Shorewall 1.4.1, if a zone Z comprises more than
|
||||
one group<i> </i>then if there is no explicit Z to Z policy and there are
|
||||
no rules governing traffic from Z to Z then Shorewall will permit all traffic
|
||||
between the groups in the zone.</li>
|
||||
<li>Beginning with Shorewall 1.4.1, Shorewall will never create rules
|
||||
to handle traffic from a group to itself.</li>
|
||||
<li>A NONE policy is introduced in 1.4.1. When a policy of NONE is
|
||||
specified from Z1 to Z2:</li>
|
||||
</ol>
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
<ul>
|
||||
<li>There may be no rules created that govern connections from Z1
|
||||
to Z2.</li>
|
||||
<li>Shorewall will not create any infrastructure to handle traffic
|
||||
from Z1 to Z2.</li>
|
||||
</ul>
|
||||
See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion
|
||||
of how these changes may affect your configuration.
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file specifies a
|
||||
particular host or network, Shorewall now creates an intermediate chain for
|
||||
handling input from the related zone. This can substantially reduce the number
|
||||
of rules traversed by connections requests from such zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the contents
|
||||
of the named file to be logically included into the file containing the INCLUDE.
|
||||
File names given in an INCLUDE directive are assumed to reside in /etc/shorewall
|
||||
or in an alternate configuration directory if one has been specified for the
|
||||
command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||
are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that interface continues
|
||||
to be a problem. While I firmly believe that this should never happen, people
|
||||
continue to want to do it. To limit the damage that such nonsense produces,
|
||||
I have added a new 'routeback' option in /etc/shorewall/interfaces and /etc/shorewall/hosts.
|
||||
When used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
||||
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on individual group
|
||||
entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option with two exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
||||
tuples associated with the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="file:///Z:/Shorewall-docs/upgrade_issues.htm">Upgrade
|
||||
Issues</a>' for information about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
||||
alt="SourceForge Logo"
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
</a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h4> </h4>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<td
|
||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></p>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 3/21/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<p><font size="2">Updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -17,12 +17,12 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -37,9 +37,9 @@
|
||||
in one of its most common configurations:</p>
|
||||
|
||||
<ul>
|
||||
<li>Linux system</li>
|
||||
<li>Single external IP address</li>
|
||||
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
||||
<li>Linux system</li>
|
||||
<li>Single external IP address</li>
|
||||
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -55,19 +55,19 @@
|
||||
with what's involved then go back through it again making your configuration
|
||||
changes. Points at which configuration changes are recommended are flagged
|
||||
with <img border="0" src="images/BD21298_.gif" width="13" height="13">
|
||||
.</p>
|
||||
.</p>
|
||||
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||
If you edit your configuration files on a Windows system, you
|
||||
If you edit your configuration files on a Windows system, you
|
||||
must save them as Unix files if your editor supports that option or you
|
||||
must run them through dos2unix before trying to use them. Similarly, if
|
||||
you copy a configuration file from your Windows hard drive to a floppy
|
||||
disk, you must run dos2unix against the copy before using it with Shorewall.</p>
|
||||
you copy a configuration file from your Windows hard drive to a floppy disk,
|
||||
you must run dos2unix against the copy before using it with Shorewall.</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
Version of dos2unix</a></li>
|
||||
|
||||
</ul>
|
||||
@ -76,34 +76,34 @@ disk, you must run dos2unix against the copy before using it with Shorewall.</p
|
||||
|
||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||
alt="">
|
||||
The configuration files for Shorewall are contained in the directory
|
||||
/etc/shorewall -- for simple setups, you only need to deal with a few
|
||||
of these as described in this guide. After you have <a
|
||||
The configuration files for Shorewall are contained in the directory
|
||||
/etc/shorewall -- for simple setups, you only need to deal with a few of
|
||||
these as described in this guide. After you have <a
|
||||
href="Install.htm">installed Shorewall</a>, <b>download the <a
|
||||
href="/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface sample</a>,
|
||||
un-tar it (tar -zxvf one-interface.tgz) and and copy the files to /etc/shorewall
|
||||
(they will replace files with the same names that were placed in /etc/shorewall
|
||||
during Shorewall installation)</b>.</p>
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tar it (tar -zxvf one-interface.tgz) and and copy the files
|
||||
to /etc/shorewall (they will replace files with the same names that were
|
||||
placed in /etc/shorewall during Shorewall installation)</b>.</p>
|
||||
|
||||
<p>As each file is introduced, I suggest that you look through the actual
|
||||
file on your system -- each file contains detailed configuration instructions
|
||||
and default entries.</p>
|
||||
|
||||
<p>Shorewall views the network where it is running as being composed of a
|
||||
set of <i>zones.</i> In the one-interface sample configuration, only
|
||||
one zone is defined:</p>
|
||||
set of <i>zones.</i> In the one-interface sample configuration, only one
|
||||
zone is defined:</p>
|
||||
|
||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||
cellspacing="0" id="AutoNumber2">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -117,10 +117,10 @@ one zone is defined:</p>
|
||||
in terms of zones.</p>
|
||||
|
||||
<ul>
|
||||
<li>You express your default policy for connections from one zone
|
||||
<li>You express your default policy for connections from one zone
|
||||
to another zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||
</a>file.</li>
|
||||
<li>You define exceptions to those default policies in the <a
|
||||
<li>You define exceptions to those default policies in the <a
|
||||
href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
|
||||
|
||||
</ul>
|
||||
@ -132,54 +132,54 @@ one zone is defined:</p>
|
||||
the request is first checked against the rules in /etc/shorewall/common
|
||||
(the samples provide that file for you).</p>
|
||||
|
||||
<p>The /etc/shorewall/policy file included with the one-interface sample
|
||||
has the following policies:</p>
|
||||
<p>The /etc/shorewall/policy file included with the one-interface sample has
|
||||
the following policies:</p>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber3">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p>The above policy will:</p>
|
||||
|
||||
<ol>
|
||||
<li>allow all connection requests from the firewall to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to your
|
||||
firewall</li>
|
||||
<li>reject all other connection requests (Shorewall requires this
|
||||
<li>allow all connection requests from the firewall to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to
|
||||
your firewall</li>
|
||||
<li>reject all other connection requests (Shorewall requires this
|
||||
catchall policy).</li>
|
||||
|
||||
</ol>
|
||||
@ -191,38 +191,38 @@ has the following policies:</p>
|
||||
|
||||
<p align="left">The firewall has a single network interface. Where Internet
|
||||
connectivity is through a cable or DSL "Modem", the <i>External Interface</i>
|
||||
will be the ethernet adapter (<b>eth0</b>) that is connected to that
|
||||
"Modem" <u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint
|
||||
<u>P</u>rotocol over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint
|
||||
<u>T</u>unneling <u>P</u>rotocol </i>(PPTP) in which case the External
|
||||
Interface will be a <b>ppp0</b>. If you connect via a regular modem, your
|
||||
External Interface will also be <b>ppp0</b>. If you connect using ISDN,
|
||||
your external interface will be<b> ippp0.</b></p>
|
||||
will be the ethernet adapter (<b>eth0</b>) that is connected to that "Modem"
|
||||
<u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol
|
||||
over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling
|
||||
<u>P</u>rotocol </i>(PPTP) in which case the External Interface will be
|
||||
a <b>ppp0</b>. If you connect via a regular modem, your External Interface
|
||||
will also be <b>ppp0</b>. If you connect using ISDN, your external interface
|
||||
will be<b> ippp0.</b></p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13">
|
||||
The Shorewall one-interface sample configuration assumes that
|
||||
the external interface is <b>eth0</b>. If your configuration is different,
|
||||
The Shorewall one-interface sample configuration assumes that the
|
||||
external interface is <b>eth0</b>. If your configuration is different,
|
||||
you will have to modify the sample /etc/shorewall/interfaces file accordingly.
|
||||
While you are there, you may wish to review the list of options that
|
||||
are specified for the interface. Some hints:</p>
|
||||
While you are there, you may wish to review the list of options that are
|
||||
specified for the interface. Some hints:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>,
|
||||
you can replace the "detect" in the second column with "-". </p>
|
||||
</li>
|
||||
<li>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>
|
||||
or if you have a static IP address, you can remove "dhcp" from the
|
||||
option list. </p>
|
||||
</li>
|
||||
or if you have a static IP address, you can remove "dhcp" from the option
|
||||
list. </p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">IP Addresses</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">RFC 1918 reserves several <i>Private </i>IP address ranges
|
||||
@ -230,7 +230,7 @@ option list. </p>
|
||||
|
||||
<div align="left">
|
||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">These addresses are sometimes referred to as <i>non-routable</i>
|
||||
because the Internet backbone routers will not forward a packet whose
|
||||
@ -240,157 +240,158 @@ option list. </p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||
width="13" height="13">
|
||||
Before starting Shorewall, you should look at the IP address
|
||||
Before starting Shorewall, you should look at the IP address
|
||||
of your external interface and if it is one of the above ranges, you
|
||||
should remove the 'norfc1918' option from the entry in /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Enabling other Connections</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">If you wish to enable connections from the internet to your
|
||||
firewall, the general format is:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Example - You want to run a Web Server and a POP3 Server
|
||||
on your firewall system:</p>
|
||||
</div>
|
||||
<p align="left">Example - You want to run a Web Server and a POP3 Server on
|
||||
your firewall system:</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber5">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">If you don't know what port and protocol a particular
|
||||
application uses, see <a href="ports.htm">here</a>.</p>
|
||||
</div>
|
||||
<p align="left">If you don't know what port and protocol a particular application
|
||||
uses, see <a href="ports.htm">here</a>.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>Important: </b>I don't recommend enabling telnet to/from
|
||||
the internet because it uses clear text (even for login!). If you want
|
||||
shell access to your firewall from the internet, use SSH:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13">
|
||||
At this point, edit /etc/shorewall/rules to add other connections
|
||||
At this point, edit /etc/shorewall/rules to add other connections
|
||||
as desired.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Starting and Stopping Your Firewall</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"> <img border="0" src="images/BD21298_2.gif"
|
||||
width="13" height="13" alt="Arrow">
|
||||
The <a href="Install.htm">installation procedure </a> configures
|
||||
The <a href="Install.htm">installation procedure </a> configures
|
||||
your system to start Shorewall at system boot but beginning with Shorewall
|
||||
version 1.3.9 startup is disabled so that your system won't try to start
|
||||
Shorewall before configuration is complete. Once you have completed configuration
|
||||
of your firewall, you can enable Shorewall startup by removing the file /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
of your firewall, you can enable Shorewall startup by removing the file
|
||||
/etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Users of the .deb
|
||||
package must edit /etc/default/shorewall and set 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">The firewall is started using the "shorewall start" command
|
||||
@ -400,25 +401,26 @@ application uses, see <a href="ports.htm">here</a>.</p>
|
||||
running firewall may be restarted using the "shorewall restart" command.
|
||||
If you want to totally remove any trace of Shorewall from your Netfilter
|
||||
configuration, use "shorewall clear".</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>WARNING: </b>If you are connected to your firewall from
|
||||
the internet, do not issue a "shorewall stop" command unless you have
|
||||
added an entry for the IP address that you are connected from to <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
Also, I don't recommend using "shorewall restart"; it is better to create
|
||||
Also, I don't recommend using "shorewall restart"; it is better to create
|
||||
an <i><a href="configuration_file_basics.htm#Configs">alternate configuration</a></i>
|
||||
and test it using the <a
|
||||
href="starting_and_stopping_shorewall.htm">"shorewall try" command</a>.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left"><font size="2">Last updated 2/21/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002, 2003
|
||||
Thomas M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -1,407 +1,469 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Standalone Firewall</title>
|
||||
</head>
|
||||
<body>
|
||||
<body>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h2 align="center">Version 2.0.1 Française</h2>
|
||||
|
||||
<p align="left"><small><i><u>Notes du traducteur</u> :<br>
|
||||
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail
|
||||
n'est pas des plus précis (loin de là...). Je ne me suis pas attaché à
|
||||
une traduction exacte du texte, mais plutôt à en faire une version
|
||||
française intelligible par tous (et par moi). Les termes techniques sont
|
||||
la plupart du temps conservés sous leur forme originale et mis entre
|
||||
parenthèses car vous pouvez les retrouver dans le reste des
|
||||
documentations ainsi que dans les fichiers de configuration. N?hésitez
|
||||
pas à me contacter afin d?améliorer ce document <a
|
||||
href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM
|
||||
pour sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP
|
||||
pour son formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
||||
<p align="left">Mettre en place un système Linux en tant que firewall
|
||||
(écluse) pour un petit réseau est une chose assez simple, si vous
|
||||
comprenez les bases et suivez la documentation.</p>
|
||||
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall.
|
||||
Il se focalise sur ce qui est nécessaire pour configurer Shorewall, dans
|
||||
son utilisation la plus courante :</p>
|
||||
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail n'est
|
||||
pas des plus précis (loin de là...). Je ne me suis pas attaché à une traduction
|
||||
exacte du texte, mais plutôt à en faire une version française intelligible
|
||||
par tous (et par moi). Les termes techniques sont la plupart du temps conservés
|
||||
sous leur forme originale et mis entre parenthèses car vous pouvez les retrouver
|
||||
dans le reste des documentations ainsi que dans les fichiers de configuration.
|
||||
N?hésitez pas à me contacter afin d?améliorer ce document <a
|
||||
href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM pour
|
||||
sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP pour son
|
||||
formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
||||
|
||||
<p align="left">Mettre en place un système Linux en tant que firewall (écluse)
|
||||
pour un petit réseau est une chose assez simple, si vous comprenez les bases
|
||||
et suivez la documentation.</p>
|
||||
|
||||
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il
|
||||
se focalise sur ce qui est nécessaire pour configurer Shorewall, dans son
|
||||
utilisation la plus courante :</p>
|
||||
|
||||
<ul>
|
||||
<li>Un système Linux</li>
|
||||
<li>Une seule adresse IP externe</li>
|
||||
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame
|
||||
Relay, rtc...</li>
|
||||
<li>Un système Linux</li>
|
||||
<li>Une seule adresse IP externe</li>
|
||||
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay,
|
||||
rtc...</li>
|
||||
|
||||
</ul>
|
||||
<p>Ce guide suppose que vous avez le paquet iproute/iproute2
|
||||
d'installé. Vous pouvez voir si le paquet est installé en vérifiant la
|
||||
présence du programme ip sur votre système de firewall. Sous root,
|
||||
utilisez la commande 'which' pour rechercher le programme :</p>
|
||||
|
||||
<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé.
|
||||
Vous pouvez voir si le paquet est installé en vérifiant la présence du programme
|
||||
ip sur votre système de firewall. Sous root, utilisez la commande 'which'
|
||||
pour rechercher le programme :</p>
|
||||
|
||||
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
||||
<p>Je vous recommande dans un premier temps de parcourir tout le guide
|
||||
pour vous familiariser avec ce qu'il va se passer, et de revenir au
|
||||
début en effectuant le changements dans votre configuration. Les points,
|
||||
où les changements dans la configuration sont recommandées, sont
|
||||
signalés par une <img border="0" src="images/BD21298_.gif" width="13"
|
||||
height="13"> .</p>
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60"> Si
|
||||
vous éditez vos fichiers de configuration sur un système Windows, vous
|
||||
devez les sauver comme des fichiers Unix si votre éditeur supporte cette
|
||||
option sinon vous devez les faire passer par dos2unix avant d'essayer de
|
||||
les utiliser. De la même manière, si vous copiez un fichier de
|
||||
configuration depuis votre disque dur Windows vers une disquette, vous
|
||||
devez lancer dos2unix sur la copie avant de l'utiliser avec Shorewall.</p>
|
||||
|
||||
<p>Je vous recommande dans un premier temps de parcourir tout le guide pour
|
||||
vous familiariser avec ce qu'il va se passer, et de revenir au début en effectuant
|
||||
le changements dans votre configuration. Les points, où les changements dans
|
||||
la configuration sont recommandées, sont signalés par une <img
|
||||
border="0" src="images/BD21298_.gif" width="13" height="13">
|
||||
.</p>
|
||||
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||
Si vous éditez vos fichiers de configuration sur un système Windows, vous
|
||||
devez les sauver comme des fichiers Unix si votre éditeur supporte cette option
|
||||
sinon vous devez les faire passer par dos2unix avant d'essayer de les utiliser.
|
||||
De la même manière, si vous copiez un fichier de configuration depuis votre
|
||||
disque dur Windows vers une disquette, vous devez lancer dos2unix sur la
|
||||
copie avant de l'utiliser avec Shorewall.</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
Version of dos2unix</a></li>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version
|
||||
of dos2unix</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2 align="left">Les Concepts de Shorewall</h2>
|
||||
|
||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||
alt=""> Les fichiers de configuration pour Shorewall sont situés dans
|
||||
le répertoire /etc/shorewall -- pour de simples paramétrages, vous
|
||||
n'avez à faire qu'avec quelques un d'entre eux comme décris dans ce
|
||||
guide. Après avoir <a href="Install.htm">installé Shorewall</a>, <b>téléchargez
|
||||
le <a href="/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tarez le (tar -zxvf one-interface.tgz) et copiez les
|
||||
fichiers vers /etc/shorewall (Ils remplaceront les fichiers de même nom
|
||||
déjà existant dans /etc/shorewall installés lors de l'installation de
|
||||
Shorewall)</b>.</p>
|
||||
<p>Parallèlement à la description, je vous suggère de jeter un oeil à
|
||||
ceux physiquement présents sur votre système -- chacun des fichiers
|
||||
contient des instructions de configuration détaillées et des entrées par
|
||||
défaut.</p>
|
||||
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble
|
||||
de <i>zones.</i> Dans les fichiers de configuration fournis pour une
|
||||
unique interface, une seule zone est définie :</p>
|
||||
alt="">
|
||||
Les fichiers de configuration pour Shorewall sont situés dans le répertoire
|
||||
/etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec
|
||||
quelques un d'entre eux comme décris dans ce guide. Après avoir <a
|
||||
href="Install.htm">installé Shorewall</a>, <b>téléchargez le <a
|
||||
href="http://france.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tarez le (tar -zxvf one-interface.tgz) et copiez les fichiers
|
||||
vers /etc/shorewall (Ils remplaceront les fichiers de même nom déjà existant
|
||||
dans /etc/shorewall installés lors de l'installation de Shorewall)</b>.</p>
|
||||
|
||||
<p>Parallèlement à la description, je vous suggère de jeter un oeil à ceux
|
||||
physiquement présents sur votre système -- chacun des fichiers contient des
|
||||
instructions de configuration détaillées et des entrées par défaut.</p>
|
||||
|
||||
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble de
|
||||
<i>zones.</i> Dans les fichiers de configuration fournis pour une unique
|
||||
interface, une seule zone est définie :</p>
|
||||
|
||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||
cellspacing="0" id="AutoNumber2">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p>Les zones de Shorewall sont définies dans <a
|
||||
href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
||||
<p>Shorewall reconnaît aussi le système de firewall comme sa propre
|
||||
zone - par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
||||
<p>Les règles concernant le trafic à autoriser ou à interdire sont
|
||||
exprimées en utilisant les termes de zones.</p>
|
||||
|
||||
<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone
|
||||
- par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
||||
|
||||
<p>Les règles concernant le trafic à autoriser ou à interdire sont exprimées
|
||||
en utilisant les termes de zones.</p>
|
||||
|
||||
<ul>
|
||||
<li>Vous exprimez les politiques par défaut pour les connexions d'une
|
||||
zone à une autre dans le fichier<a href="Documentation.htm#Policy">
|
||||
/etc/shorewall/policy </a>.</li>
|
||||
<li>Vous définissez les exceptions à ces règles de politiques par
|
||||
défaut dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
<li>Vous exprimez les politiques par défaut pour les connexions d'une zone
|
||||
à une autre dans le fichier<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||
</a>.</li>
|
||||
<li>Vous définissez les exceptions à ces règles de politiques par défaut
|
||||
dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ul>
|
||||
<p>Pour chacune des demandes de connexion entrantes dans le firewall,
|
||||
les demandes sont en premier lieu comparées par rapport au fichier
|
||||
/etc/shorewall/rules. Si aucune des règles dans ce fichier ne
|
||||
correspondent, alors la première politique dans /etc/shorewall/policy
|
||||
qui y correspond est appliquée. Si cette politique est REJECT ou DROP la
|
||||
requête est alors comparée par rapport aux règles contenues dans
|
||||
/etc/shorewall/common (l'archive d'exemple vous fournit ce fichier).</p>
|
||||
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive
|
||||
one-interface a les politiques suivantes :</p>
|
||||
|
||||
<p>Pour chacune des demandes de connexion entrantes dans le firewall, les
|
||||
demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules.
|
||||
Si aucune des règles dans ce fichier ne correspondent, alors la première
|
||||
politique dans /etc/shorewall/policy qui y correspond est appliquée. Si cette
|
||||
politique est REJECT ou DROP la requête est alors comparée par rapport aux
|
||||
règles contenues dans /etc/shorewall/common (l'archive d'exemple vous fournit
|
||||
ce fichier).</p>
|
||||
|
||||
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive one-interface
|
||||
a les politiques suivantes :</p>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber3">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<pre> </pre>
|
||||
Ces politiques vont :
|
||||
Ces politiques vont :
|
||||
<ol>
|
||||
<li>permettre toutes demandes de connexion depuis le firewall vers
|
||||
l'Internet</li>
|
||||
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet
|
||||
vers votre firewall</li>
|
||||
<li>rejeter toutes les autres requêtes de connexion (Shorewall à
|
||||
besoin de cette politique).</li>
|
||||
<li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
|
||||
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet vers
|
||||
votre firewall</li>
|
||||
<li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin
|
||||
de cette politique).</li>
|
||||
|
||||
</ol>
|
||||
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les
|
||||
changements que vous désirez.</p>
|
||||
|
||||
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les changements
|
||||
que vous désirez.</p>
|
||||
|
||||
<h2 align="left">Interface Externe</h2>
|
||||
<p align="left">Le firewall possède une seule interface réseau. Lorsque
|
||||
la connexion Internet passe par un modem câble ou par un routeur ADSL
|
||||
(pas un simple modem), l'<i>External Interface</i> (interface externe)
|
||||
sera l'adaptateur ethernet (<b>eth0</b>) qui y est connecté <u>à moins
|
||||
que</u> vous vous connectiez par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol
|
||||
over <u>E</u>thernet</i> (PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
||||
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous
|
||||
connectez par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
||||
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface
|
||||
externe sera<b> ippp0.</b></p>
|
||||
|
||||
<p align="left">Le firewall possède une seule interface réseau. Lorsque la
|
||||
connexion Internet passe par un modem câble ou par un routeur ADSL (pas un
|
||||
simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur
|
||||
ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez
|
||||
par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i>
|
||||
(PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
||||
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous connectez
|
||||
par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
||||
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface externe
|
||||
sera<b> ippp0.</b></p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13"> L'exemple de configuration de Shorewall pour une interface
|
||||
suppose que votre interface externe est <b>eth0</b>. Si votre
|
||||
configuration est différente, vous devrez modifier le fichier d'exemple
|
||||
/etc/shorewall/interfaces en conséquence. Puisque vous y êtes, vous
|
||||
pourriez parcourir la liste d'options qui sont spécifiées pour
|
||||
l'interface. Quelques astuces :</p>
|
||||
height="13">
|
||||
L'exemple de configuration de Shorewall pour une interface suppose que votre
|
||||
interface externe est <b>eth0</b>. Si votre configuration est différente,
|
||||
vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence.
|
||||
Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont
|
||||
spécifiées pour l'interface. Quelques astuces :</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<p align="left">Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>,
|
||||
vous pouvez remplacer le "detect" dans la seconde colonne par un
|
||||
"-". </p>
|
||||
</li>
|
||||
<li>
|
||||
vous pouvez remplacer le "detect" dans la seconde colonne par un "-".
|
||||
</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>
|
||||
ou bien si vous avez une adresse IP statique, vous pouvez enlever le
|
||||
"dhcp" de la liste d'option. </p>
|
||||
</li>
|
||||
ou bien si vous avez une adresse IP statique, vous pouvez enlever le "dhcp"
|
||||
de la liste d'option. </p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Adresse IP</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP
|
||||
privée (<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
|
||||
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée
|
||||
(<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">Ces adresses sont parfois désignées comme étant <i>non-routables</i>
|
||||
car les routeurs sur les backbones Internet ne font pas passer les
|
||||
paquets dont les adresses de destinations sont définies dans la RFC
|
||||
1918. Dans certains cas, les fournisseurs (provider ou ISP) utilisent
|
||||
ces adresses et utilisent le <i>Network Address Translation </i>afin
|
||||
de récrire les entêtes des paquets lorsqu'ils les font circuler depuis
|
||||
ou vers l'Internet.</p>
|
||||
car les routeurs sur les backbones Internet ne font pas passer les paquets
|
||||
dont les adresses de destinations sont définies dans la RFC 1918. Dans certains
|
||||
cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent
|
||||
le <i>Network Address Translation </i>afin de récrire les entêtes des paquets
|
||||
lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||
width="13" height="13"> Avant de lancer Shorewall, vous devriez
|
||||
regarder l'adresse de votre interface externe et si elle est comprise
|
||||
dans une des plages précédentes, vous devriez enlever l'option
|
||||
'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
width="13" height="13">
|
||||
Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface
|
||||
externe et si elle est comprise dans une des plages précédentes, vous devriez
|
||||
enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Permettre d'autres connexions</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Si vous désirez autoriser d'autres connexions depuis
|
||||
l'Internet vers votre firewall, le format général est :</p>
|
||||
</div>
|
||||
<p align="left">Si vous désirez autoriser d'autres connexions depuis l'Internet
|
||||
vers votre firewall, le format général est :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et
|
||||
un serveur POP3 sur votre système de firewall :</p>
|
||||
</div>
|
||||
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un
|
||||
serveur POP3 sur votre système de firewall :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber5">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Si vous ne savez pas quel port ou protocole une
|
||||
application particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
||||
</div>
|
||||
<p align="left">Si vous ne savez pas quel port ou protocole une application
|
||||
particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>Important: </b>Je ne vous recommande pas
|
||||
d'autoriser le telnet depuis ou vers l'Internet car il utilise du texte
|
||||
en clair (même pour le login et le mot de passe !). Si vous voulez avoir
|
||||
un accès au shell de votre firewall depuis Internet, utilisez SSH :</p>
|
||||
</div>
|
||||
<p align="left"><b>Important: </b>Je ne vous recommande pas d'autoriser le
|
||||
telnet depuis ou vers l'Internet car il utilise du texte en clair (même pour
|
||||
le login et le mot de passe !). Si vous voulez avoir un accès au shell de
|
||||
votre firewall depuis Internet, utilisez SSH :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT net fw tcp 22</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13"> A ce point, éditez /etc/shorewall/rules pour rajouter
|
||||
les autres connexions désirées.</p>
|
||||
</div>
|
||||
height="13">
|
||||
A ce point, éditez /etc/shorewall/rules pour rajouter les autres connexions
|
||||
désirées.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Lancer et Arrêter son Firewall</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"> <img border="0" src="images/BD21298_2.gif" width="13"
|
||||
height="13" alt="Arrow"> La <a href="Install.htm">procédure
|
||||
d'installation </a> configure votre système pour lancer Shorewall au
|
||||
boot du système, mais au début avec la version 1.3.9 de Shorewall le
|
||||
lancement est désactivé, n'essayer pas de lancer Shorewall avec que la
|
||||
configuration soit finie. Une fois que vous en aurez fini avec la
|
||||
configuration du firewall, vous pouvez permettre le lancement de
|
||||
Shorewall en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les
|
||||
utilisateurs des paquets .deb doivent éditer /etc/default/shorewall et
|
||||
mettre 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
height="13" alt="Arrow">
|
||||
La <a href="Install.htm">procédure d'installation </a> configure votre système
|
||||
pour lancer Shorewall au boot du système, mais au début avec la version 1.3.9
|
||||
de Shorewall le lancement est désactivé, n'essayer pas de lancer Shorewall
|
||||
avec que la configuration soit finie. Une fois que vous en aurez fini avec
|
||||
la configuration du firewall, vous pouvez permettre le lancement de Shorewall
|
||||
en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs
|
||||
des paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Le firewall est activé en utilisant la commande
|
||||
"shorewall start" et arrêté avec "shorewall stop". Lorsque le firewall
|
||||
est stoppé, le routage est autorisé sur les hôtes qui possèdent une
|
||||
entrée dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
Un firewall qui tourne peut être relancé en utilisant la commande
|
||||
"shorewall restart". Si vous voulez enlever toutes traces de Shorewall
|
||||
sur votre configuration de Netfilter, utilisez "shorewall clear".</p>
|
||||
</div>
|
||||
<p align="left">Le firewall est activé en utilisant la commande "shorewall
|
||||
start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé, le
|
||||
routage est autorisé sur les hôtes qui possèdent une entrée dans <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. Un
|
||||
firewall qui tourne peut être relancé en utilisant la commande "shorewall
|
||||
restart". Si vous voulez enlever toutes traces de Shorewall sur votre configuration
|
||||
de Netfilter, utilisez "shorewall clear".</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre
|
||||
firewall depuis Internet, n'essayez pas une commande "shorewall stop"
|
||||
tant que vous n'avez pas ajouté une entrée pour votre adresse IP (celle
|
||||
à partir de laquelle vous êtes connectée) dans <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
De la même manière, je ne vous recommande pas d'utiliser "shorewall
|
||||
restart"; il est plus intéressant de créer une <i><a
|
||||
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall
|
||||
depuis Internet, n'essayez pas une commande "shorewall stop" tant que vous
|
||||
n'avez pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle
|
||||
vous êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
De la même manière, je ne vous recommande pas d'utiliser "shorewall restart";
|
||||
il est plus intéressant de créer une <i><a
|
||||
href="configuration_file_basics.htm#Configs">configuration alternative</a></i>
|
||||
et de la tester en utilisant la commande <a
|
||||
href="starting_and_stopping_shorewall.htm">"shorewall try"</a>.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/9/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002
|
||||
Thomas M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002 Thomas
|
||||
M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -18,9 +18,10 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
|
||||
|
||||
|
||||
@ -28,9 +29,9 @@
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
@ -39,32 +40,33 @@
|
||||
|
||||
|
||||
<h2>Before Reporting a Problem or Asking a Question<br>
|
||||
</h2>
|
||||
There are a number
|
||||
of sources of Shorewall information. Please try these before you post.
|
||||
|
||||
</h2>
|
||||
There are a number
|
||||
of sources of Shorewall information. Please try these before you
|
||||
post.
|
||||
|
||||
<ul>
|
||||
<li>More than half of the questions posted
|
||||
on the support list have answers directly accessible from the
|
||||
<a href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a><br>
|
||||
</li>
|
||||
<li> The <a
|
||||
<li>More than half of the questions posted
|
||||
on the support list have answers directly accessible from the
|
||||
<a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a><br>
|
||||
</li>
|
||||
<li> The <a
|
||||
href="FAQ.htm">FAQ</a> has solutions to more than 20 common problems.
|
||||
</li>
|
||||
|
||||
<li> The <a
|
||||
<li> The <a
|
||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
||||
a number of tips to help you solve common problems.
|
||||
</li>
|
||||
</li>
|
||||
|
||||
<li> The <a
|
||||
<li> The <a
|
||||
href="errata.htm"> Errata</a> has links to download updated
|
||||
components. </li>
|
||||
components. </li>
|
||||
|
||||
<li> The Site and Mailing
|
||||
<li> The Site and Mailing
|
||||
List Archives search facility can locate documents and posts
|
||||
about similar problems: </li>
|
||||
about similar problems: </li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -80,12 +82,12 @@
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -94,49 +96,49 @@
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font><input type="hidden" name="config" value="htdig"><input
|
||||
</font><input type="hidden" name="config" value="htdig"><input
|
||||
type="hidden" name="restrict" value=""><font size="-1"> Include Mailing
|
||||
List Archives:
|
||||
List Archives:
|
||||
<select size="1" name="exclude">
|
||||
<option value="">Yes</option>
|
||||
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
||||
</select>
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
type="submit" value="Search"><br>
|
||||
</form>
|
||||
</blockquote>
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
<h2>Problem Reporting Guidelines<br>
|
||||
</h2>
|
||||
</h2>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Please remember we only know what is posted
|
||||
in your message. Do not leave out any information that appears
|
||||
to be correct, or was mentioned in a previous post. There have been
|
||||
countless posts by people who were sure that some part of their
|
||||
<li>Please remember we only know what is posted
|
||||
in your message. Do not leave out any information that appears
|
||||
to be correct, or was mentioned in a previous post. There have
|
||||
been countless posts by people who were sure that some part of their
|
||||
configuration was correct when it actually contained a small error.
|
||||
We tend to be skeptics where detail is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking for
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking for
|
||||
<strong>free</strong> technical support. Any help we offer
|
||||
is an act of generosity, not an obligation. Try to make it easy
|
||||
for us to help you. Follow good, courteous practices in writing
|
||||
and formatting your e-mail. Provide details that we need if you expect
|
||||
good answers. <em>Exact quoting </em> of error messages, log entries,
|
||||
command output, and other output is better than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please
|
||||
don't describe your environment and then ask us to send you
|
||||
custom configuration files. We're here to answer your
|
||||
questions but we can't do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
include this information:</li>
|
||||
for us to help you. Follow good, courteous practices in writing and
|
||||
formatting your e-mail. Provide details that we need if you expect good
|
||||
answers. <em>Exact quoting </em> of error messages, log entries,
|
||||
command output, and other output is better than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please
|
||||
don't describe your environment and then ask us to send
|
||||
you custom configuration files. We're here to answer
|
||||
your questions but we can't do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
include this information:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -144,68 +146,68 @@ don't describe your environment and then ask us to send you
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall you are
|
||||
<li>the exact version of Shorewall you are
|
||||
running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized, the exact
|
||||
<li>If your kernel is modularized, the exact
|
||||
output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
Guides, please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake
|
||||
using the Mandrake installation of Shorewall, please say so.</b><br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
|
||||
</ul>
|
||||
@ -215,49 +217,51 @@ using the Mandrake installation of Shorewall, please say so.</b><br>
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||
problems of any kind then:</b></big></i></u></font><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li>As a general
|
||||
matter, please <strong>do not edit the diagnostic information</strong>
|
||||
in an attempt to conceal your IP address, netmask, nameserver
|
||||
addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive them
|
||||
anyway from information contained in the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
<li>As a general
|
||||
matter, please <strong>do not edit the diagnostic information</strong>
|
||||
in an attempt to conceal your IP address, netmask, nameserver
|
||||
addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive
|
||||
them anyway from information contained in the SMTP headers of your
|
||||
post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
color="#009900">/sbin/shorewall show log</font></b>") when
|
||||
you exercise the function that is giving you problems? If so,
|
||||
include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
(especially the /etc/shorewall/hosts file if you have
|
||||
modified that file) that you think are relevant. If you
|
||||
include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||
you exercise the function that is giving you problems? If so,
|
||||
include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
(especially the /etc/shorewall/hosts file if you have
|
||||
modified that file) that you think are relevant. If
|
||||
you include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||
as well (rules are meaningless unless one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
color="#009900"><b>shorewall start</b></font>", include a
|
||||
trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't post GIFs
|
||||
of your network layout, etc. to the Mailing
|
||||
trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't post
|
||||
GIFs of your network layout, etc. to the Mailing
|
||||
List -- your post will be rejected.</b></li>
|
||||
|
||||
</ul>
|
||||
@ -266,30 +270,30 @@ List -- your post will be rejected.</b></li>
|
||||
|
||||
|
||||
|
||||
The author gratefully acknowleges that the above list was heavily
|
||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||
found at <a
|
||||
The author gratefully acknowleges that the above list was heavily
|
||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||
found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h2>When using the mailing list, please post in plain text</h2>
|
||||
|
||||
<blockquote>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian
|
||||
way to control spam and that the ultimate losers here are not
|
||||
the spammers but the list subscribers whose MTAs are bouncing
|
||||
all shorewall.net mail. As one list subscriber wrote to me privately
|
||||
"These e-mail admin's need to get a <i>(expletive deleted)</i> life
|
||||
instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I
|
||||
have now configured the list server at shorewall.net to strip all HTML
|
||||
from outgoing posts.<br>
|
||||
</blockquote>
|
||||
to allow subscribers to receive list posts as must as possible, I have
|
||||
now configured the list server at shorewall.net to strip all HTML
|
||||
from outgoing posts.<br>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
@ -299,28 +303,24 @@ have now configured the list server at shorewall.net to strip all HTML
|
||||
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF
|
||||
Users mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased an MNF
|
||||
license from MandrakeSoft then you can post non MNF-specific Shorewall
|
||||
questions to the </b><a
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF
|
||||
Users mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased an
|
||||
MNF license from MandrakeSoft then you can post non MNF-specific
|
||||
Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> or to the <a
|
||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||
Forum</a>. <b>Do not expect to get free MNF support on the list or forum.</b><br>
|
||||
list</a>. <b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> or to the <a
|
||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||
Forum</a>.<br>
|
||||
To Subscribe to the mailing list go to <a
|
||||
list</a>.<br>
|
||||
To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
@ -328,16 +328,17 @@ Forum</a>.<br>
|
||||
|
||||
<p>For information on other Shorewall mailing lists, go to <a
|
||||
href="http://lists.shorewall.net/mailing_list.htm">http://lists.shorewall.net/mailing_list.htm</a><br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/17/2003 - Tom Eastep</font></p>
|
||||
<p align="left"><font size="2">Last Updated 4/10/2003 - Tom Eastep</font></p>
|
||||
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -6,12 +6,10 @@
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Upgrade Issues</title>
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -19,167 +17,183 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p>For upgrade instructions see the <a
|
||||
href="Install.htm">Install/Upgrade page</a>.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<p>It is important that you read all of the sections on this page where the
|
||||
version number mentioned in the section title is later than what you are
|
||||
currently running. <br>
|
||||
</p>
|
||||
version number mentioned in the section title is later than what you are
|
||||
currently running.<br>
|
||||
</p>
|
||||
<p> In the descriptions that follows, the term <b><i>group </i></b>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may
|
||||
be a host address) accessed through a particular interface.<br>
|
||||
</p>
|
||||
<p>Examples:<br>
|
||||
<br>
|
||||
eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</p>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<h3>Version >= 1.4.2</h3>
|
||||
There are some cases where you may want to handle traffic from a particular
|
||||
group to itself. While I personally think that such a setups are ridiculous,
|
||||
there are two cases covered in this documentation where it can occur:<br>
|
||||
<ol>
|
||||
<li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
|
||||
<li><a href="Shorewall_Squid_Usage.html">When running Squid as a transparent
|
||||
proxy in your local zone.</a></li>
|
||||
</ol>
|
||||
If you have either of these cases, you will want to review the current documentation
|
||||
and change your configuration accordingly.<br>
|
||||
<h3>Version >= 1.4.1</h3>
|
||||
In the description that follows, the term <i>group </i>refers to a particular
|
||||
network or subnetwork (which may be 0.0.0.0/0 or it may be a host address)
|
||||
accessed through a particular interface. Examples:<br>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<ul>
|
||||
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
||||
zone is accepted by default. Previously, traffic from a zone to itself was
|
||||
treated just like any other traffic; any matching rules were applied followed
|
||||
by enforcement of the appropriate policy. With 1.4.1 and later versions,
|
||||
unless you have explicit rules for traffic from Z to Z or you have an explicit
|
||||
Z to Z policy (where "Z" is some zone) then traffic between the groups in
|
||||
zone Z will be accepted. If you do have one or more explicit rules for Z
|
||||
to Z or if you have an explicit Z to Z policy then the behavior is as it
|
||||
was in prior versions.</li>
|
||||
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
||||
zone is accepted by default. Previously, traffic from a zone to itself
|
||||
was treated just like any other traffic; any matching rules were applied
|
||||
followed by enforcement of the appropriate policy. With 1.4.1 and later
|
||||
versions, unless you have explicit rules for traffic from Z to Z or you
|
||||
have an explicit Z to Z policy (where "Z" is some zone) then traffic between
|
||||
the groups in zone Z will be accepted. If you do have one or more explicit
|
||||
rules for Z to Z or if you have an explicit Z to Z policy then the behavior
|
||||
is as it was in prior versions.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic between
|
||||
two interfaces to the same zone, that policy can be removed and traffic
|
||||
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic between
|
||||
two interfaces to the same zone, that policy can be removed and traffic
|
||||
between the interfaces will traverse fewer rules than previously.</li>
|
||||
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
||||
rules then your configuration should not require any change.</li>
|
||||
<li>If you are currently relying on a implicit policy (one that has
|
||||
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
||||
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
||||
add an explicit DROP or REJECT policy for Z to Z.<br>
|
||||
</li>
|
||||
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
||||
rules then your configuration should not require any change.</li>
|
||||
<li>If you are currently relying on a implicit policy (one that has
|
||||
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
||||
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
||||
add an explicit DROP or REJECT policy for Z to Z.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>Beginning with Version 1.4.1, Shorewall will never create rules to
|
||||
deal with traffic from a given group back to itself. The <i>multi</i> interface
|
||||
option is no longer available so if you want to route traffic between two
|
||||
subnetworks on the same interface then either:</li>
|
||||
<li>Beginning with Version 1.4.1, Shorewall will never create rules
|
||||
to deal with traffic from a given group back to itself. The <i>multi</i>
|
||||
interface option is no longer available so if you want to route traffic between
|
||||
two subnetworks on the same interface then either:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>The subnetworks must be in different zones; or</li>
|
||||
<li>You must use the /etc/shorewall/hosts file to define the subnetworks
|
||||
as two groups in a single zone.</li>
|
||||
<li>The subnetworks must be in different zones; or</li>
|
||||
<li>You must use the /etc/shorewall/hosts file to define the subnetworks
|
||||
as two groups in a single zone.</li>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
Example 1 -- Two zones:<br>
|
||||
</blockquote>
|
||||
If you use the technique described in FAQ 2 to send local requests addressed
|
||||
to your firewall's external address back to a local server then you need to
|
||||
change your configuration to match <a href="FAQ.htm#faq2">the new version
|
||||
of FAQ #2.<br>
|
||||
</a><br>
|
||||
Example 1 -- Two zones:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/policy<br><br>z1 z2 ACCEPT<br>z2 z1 ACCEPT<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.0/24<br>z2 eth1:192.168.2.0/24<br></pre>
|
||||
</blockquote>
|
||||
Example 2 -- One zone:
|
||||
</blockquote>
|
||||
Example 2 -- One zone:
|
||||
<blockquote>
|
||||
<pre><br>/etc/shorewall/zones<br><br>z Zone The Zone<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z eth1:192.168.1.0/24<br>z eth1:192.168.2.0/24<br></pre>
|
||||
</blockquote>
|
||||
Note that in the second example, we don't need any policy since z->z
|
||||
traffic is accepted by default. The second technique is preferable if you
|
||||
want unlimited access between the two subnetworks.<br>
|
||||
<br>
|
||||
Sometimes, you want two separate zones on one interface but you don't want
|
||||
Shorewall to set up any infrastructure to handle traffic between them. <br>
|
||||
<br>
|
||||
Example:<br>
|
||||
</blockquote>
|
||||
Note that in the second example, we don't need any policy since z->z
|
||||
traffic is accepted by default. The second technique is preferable if you
|
||||
want unlimited access between the two subnetworks.<br>
|
||||
<br>
|
||||
Sometimes, you want two separate zones on one interface but you don't
|
||||
want Shorewall to set up any infrastructure to handle traffic between them.
|
||||
<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/interfaces<br><br>z2 eth1 192.168.1.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.3<br></pre>
|
||||
</blockquote>
|
||||
Here, zone z1 is nested in zone z2 and the firewall is not going to be involved
|
||||
in any traffic between these two zones. Beginning with Shorewall 1.4.1, you
|
||||
can prevent Shorewall from setting up any infrastructure to handle traffic
|
||||
between z1 and z2 by using the new NONE policy:<br>
|
||||
</blockquote>
|
||||
Here, zone z1 is nested in zone z2 and the firewall is not going to be
|
||||
involved in any traffic between these two zones. Beginning with Shorewall
|
||||
1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
|
||||
traffic between z1 and z2 by using the new NONE policy:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/policy<br><pre>z1 z2 NONE<br>z2 z1 NONE</pre></pre>
|
||||
</blockquote>
|
||||
Note that NONE policies are generally used in pairs unless there is asymetric
|
||||
routing where only the traffic on one direction flows through the firewall
|
||||
and you are using a NONE polciy in the other direction.
|
||||
</blockquote>
|
||||
Note that NONE policies are generally used in pairs unless there is asymetric
|
||||
routing where only the traffic on one direction flows through the firewall
|
||||
and you are using a NONE polciy in the other direction.
|
||||
<h3>Version >= 1.4.0</h3>
|
||||
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
||||
package ('ip' utility).</b><br>
|
||||
<br>
|
||||
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
||||
package ('ip' utility).</b><br>
|
||||
<br>
|
||||
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
If you are upgrading from a version < 1.4.0, then:<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm
|
||||
-Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
If you are upgrading from a version < 1.4.0, then:<br>
|
||||
|
||||
<ul>
|
||||
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
||||
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||
ICMP echo-request (ping) packets are treated just like any other connection
|
||||
request and are subject to rules and policies.</li>
|
||||
<li>Interface names of the form <device>:<integer>
|
||||
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
||||
(they always have produced warnings in iptables).</li>
|
||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone contents
|
||||
are determined by BOTH the interfaces and hosts files when there are entries
|
||||
for the zone in both files.</li>
|
||||
<li>The <b>routestopped</b> option in the interfaces and hosts
|
||||
file has been eliminated; use entries in the routestopped file instead.</li>
|
||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no
|
||||
longer accepted; you must convert to using the new syntax.</li>
|
||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is no
|
||||
longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
||||
<li value="6">Late-arriving DNS replies are now dropped by default;
|
||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
||||
logging these packets.</li>
|
||||
<li value="6">The 'firewall', 'functions' and 'version' file have
|
||||
been moved to /usr/share/shorewall.</li>
|
||||
<li value="6">The icmp.def file has been removed. If you include
|
||||
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
||||
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||
ICMP echo-request (ping) packets are treated just like any other connection
|
||||
request and are subject to rules and policies.</li>
|
||||
<li>Interface names of the form <device>:<integer>
|
||||
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
||||
(they always have produced warnings in iptables).</li>
|
||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
|
||||
contents are determined by BOTH the interfaces and hosts files when there
|
||||
are entries for the zone in both files.</li>
|
||||
<li>The <b>routestopped</b> option in the interfaces and hosts
|
||||
file has been eliminated; use entries in the routestopped file instead.</li>
|
||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
||||
no longer accepted; you must convert to using the new syntax.</li>
|
||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is
|
||||
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
||||
<li value="6">Late-arriving DNS replies are now dropped by default;
|
||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
||||
logging these packets.</li>
|
||||
<li value="6">The 'firewall', 'functions' and 'version' file
|
||||
have been moved to /usr/share/shorewall.</li>
|
||||
<li value="6">The icmp.def file has been removed. If you include
|
||||
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||
</li>
|
||||
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -190,81 +204,84 @@ longer accepted; you must convert to using the new syntax.</li>
|
||||
<h3>Version 1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li value="8">The 'multi' interface option is no longer supported. Shorewall
|
||||
will generate rules for sending packets back out the same interface that
|
||||
they arrived on in two cases:</li>
|
||||
<li value="8">The 'multi' interface option is no longer supported.
|
||||
Shorewall will generate rules for sending packets back out the same
|
||||
interface that they arrived on in two cases:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ul>
|
||||
<li>There is an <u>explicit</u> policy for the source zone to or from
|
||||
the destination zone. An explicit policy names both zones and does not
|
||||
use the 'all' reserved word.</li>
|
||||
<li>There is an <u>explicit</u> policy for the source zone to or
|
||||
from the destination zone. An explicit policy names both zones and does
|
||||
not use the 'all' reserved word.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>There are one or more rules for traffic for the source zone to
|
||||
or from the destination zone including rules that use the 'all' reserved
|
||||
word. Exception: if the source zone and destination zone are the same then
|
||||
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||
DESTINATION columns.</li>
|
||||
<li>There are one or more rules for traffic for the source zone to
|
||||
or from the destination zone including rules that use the 'all' reserved
|
||||
word. Exception: if the source zone and destination zone are the same
|
||||
then the rule must be explicit - it must name the zone in both the SOURCE
|
||||
and DESTINATION columns.</li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3>Version >= 1.3.14</h3>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
Beginning in version 1.3.14, Shorewall treats entries in <a
|
||||
href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change
|
||||
involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second)
|
||||
<b>column</b>:<br>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
Beginning in version 1.3.14, Shorewall treats entries in
|
||||
<a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The
|
||||
change involves entries with an <b>interface name</b> in the <b>SUBNET</b>
|
||||
(second) <b>column</b>:<br>
|
||||
|
||||
<ul>
|
||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
||||
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
||||
masquerade traffic from that subnet. Any other subnets that routed through
|
||||
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
||||
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
||||
masquerade traffic from that subnet. Any other subnets that routed through
|
||||
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
||||
or to have SNAT applied.</li>
|
||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||
routing table to determine ALL subnets routed through the named interface.
|
||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||
applied.</li>
|
||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||
routing table to determine ALL subnets routed through the named interface.
|
||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||
applied.</li>
|
||||
|
||||
</ul>
|
||||
You will need to make a change to your configuration if:<br>
|
||||
You will need to make a change to your configuration if:<br>
|
||||
|
||||
<ol>
|
||||
<li>You have one or more entries in /etc/shorewall/masq with
|
||||
an interface name in the SUBNET (second) column; and</li>
|
||||
<li>That interface connects to more than one subnetwork.</li>
|
||||
<li>You have one or more entries in /etc/shorewall/masq with
|
||||
an interface name in the SUBNET (second) column; and</li>
|
||||
<li>That interface connects to more than one subnetwork.</li>
|
||||
|
||||
</ol>
|
||||
Two examples:<br>
|
||||
<br>
|
||||
<b>Example 1</b> -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
Two examples:<br>
|
||||
<br>
|
||||
<b>Example 1</b> -- Suppose that your current config is as
|
||||
follows:<br>
|
||||
<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
|
||||
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
</blockquote>
|
||||
<b>Example 2</b>-- What if your current configuration is like
|
||||
this?<br>
|
||||
required.<br>
|
||||
</blockquote>
|
||||
<b>Example 2</b>-- What if your current configuration is like
|
||||
this?<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
||||
|
||||
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
</blockquote>
|
||||
to:<br>
|
||||
</blockquote>
|
||||
|
||||
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
Version 1.3.14 also introduced simplified ICMP echo-request
|
||||
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||
is used to specify that the old (pre-1.3.14) ping handling is to be
|
||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
Version 1.3.14 also introduced simplified ICMP echo-request
|
||||
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||
is used to specify that the old (pre-1.3.14) ping handling is to be
|
||||
used (If the option is not set in your /etc/shorewall/shorewall.conf
|
||||
then OLD_PING_HANDLING=Yes is assumed). I don't plan on supporting the
|
||||
old handling indefinitely so I urge current users to migrate to using
|
||||
@ -272,155 +289,149 @@ the new handling as soon as possible. See the <a href="ping.html">'Ping'
|
||||
handling documentation</a> for details.<br>
|
||||
|
||||
<h3>Version 1.3.10</h3>
|
||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||
<br>
|
||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3>Version >= 1.3.9</h3>
|
||||
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||
If you have an application that uses functions from that file, your
|
||||
application will need to be changed to reflect this change of location.<br>
|
||||
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||
If you have an application that uses functions from that file, your
|
||||
application will need to be changed to reflect this change of location.<br>
|
||||
|
||||
<h3>Version >= 1.3.8</h3>
|
||||
|
||||
<p>If you have a pair of firewall systems configured for failover
|
||||
or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall
|
||||
versions >= 1.3.8. Beginning with version
|
||||
1.3.8, you must set NEWNOTSYN=Yes in
|
||||
your /etc/shorewall/shorewall.conf file.</p>
|
||||
or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall
|
||||
versions >= 1.3.8. Beginning with version 1.3.8,
|
||||
you must set NEWNOTSYN=Yes in your
|
||||
/etc/shorewall/shorewall.conf file.</p>
|
||||
|
||||
<h3>Version >= 1.3.7</h3>
|
||||
|
||||
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
||||
will need to include the following
|
||||
rules in their /etc/shorewall/icmpdef
|
||||
file (creating this file if necessary):</p>
|
||||
will need to include the following
|
||||
rules in their /etc/shorewall/icmpdef file (creating this
|
||||
file if necessary):</p>
|
||||
|
||||
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
||||
|
||||
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
||||
command from that file since the icmp.def file is now empty.</p>
|
||||
command from that file since the icmp.def file is now empty.</p>
|
||||
|
||||
<h3><b><a name="Bering">Upgrading </a>Bering to
|
||||
Shorewall >= 1.3.3</b></h3>
|
||||
<h3><b><a name="Bering">Upgrading </a>Bering to Shorewall >= 1.3.3</b></h3>
|
||||
|
||||
<p>To properly upgrade with Shorewall version
|
||||
1.3.3 and later:</p>
|
||||
<p>To properly upgrade with Shorewall version 1.3.3 and later:</p>
|
||||
|
||||
<ol>
|
||||
<li>Be sure you have a backup
|
||||
-- you will need to transcribe any
|
||||
Shorewall configuration changes that
|
||||
you have made to the new configuration.</li>
|
||||
<li>Replace the shorwall.lrp
|
||||
package provided on the Bering floppy
|
||||
with the later one. If you did not
|
||||
obtain the later version from Jacques's
|
||||
site, see additional instructions below.</li>
|
||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||
file and remove the /var/lib/shorewall
|
||||
entry if present. Then do not forget
|
||||
to backup root.lrp !</li>
|
||||
<li>Be sure you have a
|
||||
backup -- you will need to transcribe
|
||||
any Shorewall configuration changes
|
||||
that you have made to the new configuration.</li>
|
||||
<li>Replace the shorwall.lrp
|
||||
package provided on the Bering floppy
|
||||
with the later one. If you did not
|
||||
obtain the later version from Jacques's site, see additional instructions
|
||||
below.</li>
|
||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||
file and remove the /var/lib/shorewall
|
||||
entry if present. Then do not forget
|
||||
to backup root.lrp !</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||
for setting up a two-interface firewall</a> plus you also need
|
||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||
for setting up a two-interface firewall</a> plus you also need
|
||||
to add the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
||||
|
||||
<blockquote>
|
||||
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
||||
|
||||
<p align="left">If you have a pair of firewall systems configured for
|
||||
failover or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall versions
|
||||
1.3.6 and 1.3.7</p>
|
||||
failover or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall versions 1.3.6
|
||||
and 1.3.7</p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
|
||||
<li>
|
||||
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
||||
the following rule<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A newnotsyn
|
||||
-j RETURN # So that the connection tracking table can be
|
||||
rebuilt<br>
|
||||
# from non-SYN
|
||||
packets after takeover.<br>
|
||||
</font> </p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
the following rule<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A newnotsyn
|
||||
-j RETURN # So that the connection tracking table can be
|
||||
rebuilt<br>
|
||||
# from
|
||||
non-SYN packets after takeover.<br>
|
||||
</font> </p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Create /etc/shorewall/common (if you don't already
|
||||
have that file) and include the following:<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A common -p
|
||||
tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks to
|
||||
rebuild connection<br>
|
||||
|
||||
#tracking table. <br>
|
||||
. /etc/shorewall/common.def</font> </p>
|
||||
</li>
|
||||
have that file) and include the following:<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A common
|
||||
-p tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks
|
||||
to rebuild connection<br>
|
||||
|
||||
#tracking table. <br>
|
||||
. /etc/shorewall/common.def</font> </p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3 align="left">Versions >= 1.3.5</h3>
|
||||
|
||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no
|
||||
longer supported. </p>
|
||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no longer
|
||||
supported. </p>
|
||||
|
||||
<p align="left">Example 1:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">Must be replaced with:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Example 2:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Must be replaced with:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> REDIRECT loc 3128 tcp 80</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 align="left">Version >= 1.3.2</h3>
|
||||
|
||||
<p align="left">The functions and versions files together with the
|
||||
'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||
If you have applications that access these files, those
|
||||
applications should be modified accordingly.</p>
|
||||
<p align="left">The functions and versions files together with the 'firewall'
|
||||
symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||
If you have applications that access these files, those applications
|
||||
should be modified accordingly.</p>
|
||||
|
||||
<p><font size="2"> Last updated 3/18/2003 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
<p><font size="2"> Last updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
</p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=1.4.1
|
||||
VERSION=1.4.2
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -542,6 +542,9 @@ determine_hosts() {
|
||||
interfaces="$interfaces $interface"
|
||||
fi
|
||||
fi
|
||||
|
||||
[ "${host#*:}" = "0.0.0.0/0" ] || \
|
||||
eval ${zone}_is_complex=Yes
|
||||
done
|
||||
|
||||
eval ${zone}_interfaces="\$interfaces"
|
||||
@ -605,6 +608,10 @@ validate_interfaces_file() {
|
||||
;;
|
||||
routefilter|dropunclean|logunclean|blacklist|proxyarp|maclist|-)
|
||||
;;
|
||||
routeback)
|
||||
[ -n "$z" ] || startup_error "The routeback option may not be specified on a multi-zone interface"
|
||||
eval ${z}_routeback=\"$interface:0.0.0.0/0 \$${z}_routeback\"
|
||||
;;
|
||||
*)
|
||||
error_message "Warning: Invalid option ($option) in record \"$r\""
|
||||
;;
|
||||
@ -635,6 +642,9 @@ validate_hosts_file() {
|
||||
case $option in
|
||||
maclist|-)
|
||||
;;
|
||||
routeback)
|
||||
eval ${z}_routeback=\"$host \$${z}_routeback\"
|
||||
;;
|
||||
*)
|
||||
error_message "Warning: Invalid option ($option) in record \"$r\""
|
||||
;;
|
||||
@ -3185,13 +3195,14 @@ initialize_netfilter () {
|
||||
setcontinue FORWARD
|
||||
setcontinue INPUT
|
||||
setcontinue OUTPUT
|
||||
|
||||
#
|
||||
# Allow DNS lookups during startup for FQDNs and deep-six INVALID packets
|
||||
#
|
||||
|
||||
for chain in INPUT OUTPUT FORWARD; do
|
||||
run_iptables -A $chain -p udp --dport 53 -j ACCEPT
|
||||
run_iptables -A $chain -m state --state INVALID -j DROP
|
||||
run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
|
||||
done
|
||||
|
||||
[ -n "$CLAMPMSS" ] && \
|
||||
@ -3661,6 +3672,13 @@ activate_rules()
|
||||
chain1=`rules_chain $FW $zone`
|
||||
chain2=`rules_chain $zone $FW`
|
||||
|
||||
eval complex=\$${zone}_is_complex
|
||||
|
||||
if [ -n "$complex" ]; then
|
||||
frwd_chain=${zone}_frwd
|
||||
createchain $frwd_chain No
|
||||
fi
|
||||
|
||||
echo "$FW $zone $chain1" >> ${STATEDIR}/chains
|
||||
echo "$zone $FW $chain2" >> ${STATEDIR}/chains
|
||||
|
||||
@ -3678,6 +3696,8 @@ activate_rules()
|
||||
|
||||
run_iptables -A `input_chain $interface` -s $subnet -j $chain2
|
||||
|
||||
[ -n "$complex" ] && \
|
||||
run_iptables -A `forward_chain $interface` -s $subnet -j $frwd_chain
|
||||
done
|
||||
|
||||
for zone1 in $zones; do
|
||||
@ -3692,17 +3712,27 @@ activate_rules()
|
||||
|
||||
echo "$zone $zone1 $chain" >> ${STATEDIR}/chains
|
||||
|
||||
if [ $zone = $zone1 ]; then
|
||||
eval routeback=\"\$${zone}_routeback\"
|
||||
else
|
||||
routeback=
|
||||
fi
|
||||
|
||||
for host in $source_hosts; do
|
||||
interface=${host%:*}
|
||||
subnet=${host#*:}
|
||||
chain1=`forward_chain $interface`
|
||||
|
||||
if [ -n "$complex" ]; then
|
||||
chain1=$frwd_chain
|
||||
else
|
||||
chain1=`forward_chain $interface`
|
||||
fi
|
||||
|
||||
for host1 in $dest_hosts; do
|
||||
interface1=${host1%:*}
|
||||
subnet1=${host1#*:}
|
||||
|
||||
if [ "$host" != "$host1" ]; then
|
||||
run_iptables -A $chain1 -s $subnet -o $interface1 -d $subnet1 -j $chain
|
||||
if [ "$host" != "$host1" ] || list_search $host $routeback; then
|
||||
run_iptables -A $chain1 -o $interface1 -d $subnet1 -j $chain
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
@ -181,6 +181,34 @@ mutex_off()
|
||||
rm -f $STATEDIR/lock
|
||||
}
|
||||
|
||||
#
|
||||
# Read a file and handle "INCLUDE" directives
|
||||
#
|
||||
|
||||
read_file() # $1 = file name, $2 = nest count
|
||||
{
|
||||
local first rest
|
||||
|
||||
while read first rest; do
|
||||
if [ "x$first" = "xINCLUDE" ]; then
|
||||
if [ $2 -lt 4 ]; then
|
||||
read_file `find_file ${rest%#*}` $(($2 + 1))
|
||||
else
|
||||
echo " WARNING: INCLUDE in $1 ignored (nested too deeply)" >&2
|
||||
fi
|
||||
else
|
||||
echo "$first $rest"
|
||||
fi
|
||||
done < $1
|
||||
}
|
||||
|
||||
#
|
||||
# Function for including one file into another
|
||||
#
|
||||
INCLUDE() {
|
||||
. `find_file $@`
|
||||
}
|
||||
|
||||
#
|
||||
# Strip comments and blank lines from a file and place the result in the
|
||||
# temporary directory
|
||||
@ -192,7 +220,7 @@ strip_file() # $1 = Base Name of the file, $2 = Full Name of File (optional)
|
||||
[ $# = 1 ] && fname=`find_file $1` || fname=$2
|
||||
|
||||
if [ -f $fname ]; then
|
||||
cut -d'#' -f1 $fname | grep -v '^[[:space:]]*$' > $TMP_DIR/$1
|
||||
read_file $fname 0 | cut -d'#' -f1 | grep -v '^[[:space:]]*$' > $TMP_DIR/$1
|
||||
else
|
||||
> $TMP_DIR/$1
|
||||
fi
|
||||
|
||||
@ -44,6 +44,15 @@
|
||||
# an ethernet NIC and must be up before
|
||||
# Shorewall is started.
|
||||
#
|
||||
# routeback - Shorewall show set up the infrastructure
|
||||
# to pass packets from this/these
|
||||
# address(es) back to themselves. This is
|
||||
# necessary of hosts in this group use the
|
||||
# services of a transparent proxy that is
|
||||
# a member of the group or if DNAT is used
|
||||
# to send requests originating from this
|
||||
# group to a server in the group.
|
||||
#
|
||||
#
|
||||
#ZONE HOST(S) OPTIONS
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE
|
||||
|
||||
@ -54,7 +54,7 @@
|
||||
# /etc/rc.d/rc.local file is modified to start the firewall.
|
||||
#
|
||||
|
||||
VERSION=1.4.1
|
||||
VERSION=1.4.2
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,19 +1,90 @@
|
||||
This is a minor release of Shorewall.
|
||||
|
||||
This release introduces incompatibilities with prior releases. See
|
||||
http://www.shorewall.net/upgrade_issues.htm.
|
||||
Problems Corrected:
|
||||
|
||||
Changes are:
|
||||
1) TCP connection requests rejected out of the common chain are now
|
||||
properly rejected with TCP RST; previously, some of these requests
|
||||
were rejeced with an ICMP port-unreachable response.
|
||||
|
||||
a) There is now a new NONE policy specifiable in
|
||||
/etc/shorewall/policy. This policy will cause Shorewall to assume that
|
||||
there will never be any traffic between the source and destination
|
||||
zones.
|
||||
2) 'traceroute -I' from behind the firewall previously timed out on the
|
||||
first hop (e.g., to the firewall). This has been worked around.
|
||||
|
||||
b) Shorewall no longer creates rules to govern traffic from an
|
||||
interface:subnet to itself.
|
||||
New Features:
|
||||
|
||||
c) Intra-zone traffic is always accepted now (exception is (b)
|
||||
above).. Intrazone policies and rules are no longer allowed.
|
||||
1) Where an entry in the/etc/shorewall/hosts file specifies a
|
||||
particular host or network, Shorewall now creates an intermediate
|
||||
chain for handling input from the related zone. This can
|
||||
substantially reduce the number of rules traversed by connections
|
||||
requests from such zones.
|
||||
|
||||
2) Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the
|
||||
contents of the named file to be logically included into the file
|
||||
containing the INCLUDE. File names given in an INCLUDE directive
|
||||
are assumed to reside in /etc/shorewall or in an alternate
|
||||
configuration directory if one has been specified for the command.
|
||||
|
||||
Examples:
|
||||
shorewall/params.mgmt:
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3
|
||||
TIME_SERVERS=4.4.4.4
|
||||
BACKUP_SERVERS=5.5.5.5
|
||||
----- end params.mgmt -----
|
||||
|
||||
|
||||
shorewall/params:
|
||||
# Shorewall 1.3 /etc/shorewall/params
|
||||
[..]
|
||||
#######################################
|
||||
|
||||
INCLUDE params.mgmt
|
||||
|
||||
# params unique to this host here
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
|
||||
----- end params -----
|
||||
|
||||
|
||||
shorewall/rules.mgmt:
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22
|
||||
----- end rules.mgmt -----
|
||||
|
||||
shorewall/rules:
|
||||
# Shorewall version 1.3 - Rules File
|
||||
[..]
|
||||
#######################################
|
||||
|
||||
INCLUDE rules.mgmt
|
||||
|
||||
# rules unique to this host here
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|
||||
----- end rules -----
|
||||
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE
|
||||
directives are ignored.
|
||||
|
||||
3) Routing traffic from an interface back out that interface continues
|
||||
to be a problem. While I firmly believe that this should never
|
||||
happen, people continue to want to do it. To limit the damage that
|
||||
such nonsense produces, I have added a new 'routeback' option in
|
||||
/etc/shorewall/interfaces and /etc/shorewall/hosts. When used in
|
||||
/etc/shorewall/interfaces, the 'ZONE' column may not contain '-'; in
|
||||
other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on
|
||||
individual group entries in /etc/shorewall/hosts.
|
||||
|
||||
The 'routeback' option is similar to the old 'multi' option with two
|
||||
exceptions:
|
||||
|
||||
a) The option pertains to a particular zone,interface,address tuple.
|
||||
|
||||
b) The option only created infrastructure to pass traffic from
|
||||
(zone,interface,address) tuples back to themselves (the 'multi'
|
||||
option affected all (zone,interface,address) tuples associated with
|
||||
the given 'interface').
|
||||
|
||||
See the 'Upgrade Issues' for information about how this new option
|
||||
may affect your configuration.
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall
|
||||
%define version 1.4.1
|
||||
%define version 1.4.2
|
||||
%define release 1
|
||||
%define prefix /usr
|
||||
|
||||
@ -105,6 +105,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
|
||||
|
||||
%changelog
|
||||
* Mon Apr 07 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.2-1
|
||||
* Fri Mar 21 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.1-1
|
||||
* Mon Mar 17 2003 Tom Eastep <tom@shorewall.net>
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Seattle Firewall
|
||||
|
||||
VERSION=1.4.1
|
||||
VERSION=1.4.2
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -15,139 +15,147 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Installation and
|
||||
Upgrade</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
Upgrade</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center"><b>Before upgrading, be sure to review the <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></b></p>
|
||||
href="upgrade_issues.htm">Upgrade Issues<br>
|
||||
</a></b></p>
|
||||
|
||||
<div align="left"><b>Before attempting installation, I strongly urge you to
|
||||
read and print a copy of the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||
for the configuration that most closely matches your own.</b><br>
|
||||
</div>
|
||||
|
||||
<p><font size="4"><b><a href="#Install_RPM">Install using RPM</a><br>
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
|
||||
<p><a name="Install_RPM"></a>To install Shorewall using the RPM:</p>
|
||||
|
||||
<p><b>If you have RedHat 7.2 and are running iptables version 1.2.3 (at a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
1.2.4 either from the <a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
1.2.4 either from the <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">RedHat update
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
attempting to start Shorewall.</b></p>
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
attempting to start Shorewall.</b></p>
|
||||
|
||||
<ul>
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -ivh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh --nodeps
|
||||
<shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO RESTORE
|
||||
NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO
|
||||
RESTORE NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="Install_Tarball"></a>To install Shorewall using the tarball
|
||||
and install script: </p>
|
||||
and install script: </p>
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-1.1.10").</li>
|
||||
<li>If you are using <a
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-1.1.10").</li>
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to be
|
||||
started automatically at boot, see <a
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to
|
||||
be started automatically at boot, see <a
|
||||
href="starting_and_stopping_shorewall.htm">these instructions</a>.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file that
|
||||
you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file
|
||||
that you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
|
||||
<p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed
|
||||
and are upgrading to a new version:</p>
|
||||
and are upgrading to a new version:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
or and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the new
|
||||
1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for details.</p>
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
|
||||
details.</p>
|
||||
|
||||
<ul>
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm (e.g.,
|
||||
"rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm
|
||||
(e.g., "rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
|
||||
<p> <b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm (rpm
|
||||
-Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent on
|
||||
the iproute package. Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>). </p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>). </p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -163,50 +171,52 @@ rule forms that are no longer supported under 1.4 (you must use the new
|
||||
details. </p>
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-3.0.1").</li>
|
||||
<li>If you are using <a
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-3.0.1").</li>
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
|
||||
</ul>
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
|
||||
<h3><a name="Config_Files"></a>Configuring Shorewall</h3>
|
||||
|
||||
<p>You will need to edit some or all of the configuration files to match
|
||||
your setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall
|
||||
QuickStart Guides</a> contain all of the information you need.</p>
|
||||
QuickStart Guides</a> contain all of the information you need.</p>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><font size="2">Updated 3/18/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
<p><font size="2">Updated 4/8/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -16,12 +16,12 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Static NAT</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -29,7 +29,7 @@
|
||||
<p><font color="#ff0000"><b>IMPORTANT: If all you want to do is forward
|
||||
ports to servers behind your firewall, you do NOT want to use static
|
||||
NAT. Port forwarding can be accomplished with simple entries in the
|
||||
<a href="Documentation.htm#Rules">rules file</a>.</b></font></p>
|
||||
<a href="Documentation.htm#Rules">rules file</a>.</b></font></p>
|
||||
|
||||
<p>Static NAT is a way to make systems behind a firewall and configured
|
||||
with private IP addresses (those reserved for private use in RFC1918)
|
||||
@ -41,40 +41,39 @@ I strongly recommend that you read the <a
|
||||
|
||||
<p align="center"><strong> <img src="images/staticnat.png"
|
||||
width="435" height="397">
|
||||
</strong></p>
|
||||
</strong></p>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<p align="left">Static NAT can be used to make the systems with the
|
||||
10.1.1.* addresses appear to be on the upper (130.252.100.*) subnet. If
|
||||
we assume that the interface to the upper subnet is eth0, then the following
|
||||
/etc/shorewall/NAT file would make the lower left-hand system appear
|
||||
to have IP address 130.252.100.18 and the right-hand one to have IP address
|
||||
130.252.100.19.</p>
|
||||
<p align="left">Static NAT can be used to make the systems with the 10.1.1.*
|
||||
addresses appear to be on the upper (130.252.100.*) subnet. If we assume
|
||||
that the interface to the upper subnet is eth0, then the following /etc/shorewall/NAT
|
||||
file would make the lower left-hand system appear to have IP address
|
||||
130.252.100.18 and the right-hand one to have IP address 130.252.100.19.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>EXTERNAL</b></td>
|
||||
<td><b>INTERFACE</b></td>
|
||||
<td><b>INTERNAL</b></td>
|
||||
<td><b>ALL INTERFACES</b></td>
|
||||
<td><b>LOCAL</b></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>130.252.100.18</td>
|
||||
<td>eth0</td>
|
||||
<td>10.1.1.2</td>
|
||||
<td>yes</td>
|
||||
<td>yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>130.252.100.19</td>
|
||||
<td>eth0</td>
|
||||
<td>10.1.1.3</td>
|
||||
<td>yes</td>
|
||||
<td>yes</td>
|
||||
</tr>
|
||||
<td><b>EXTERNAL</b></td>
|
||||
<td><b>INTERFACE</b></td>
|
||||
<td><b>INTERNAL</b></td>
|
||||
<td><b>ALL INTERFACES</b></td>
|
||||
<td><b>LOCAL</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>130.252.100.18</td>
|
||||
<td>eth0</td>
|
||||
<td>10.1.1.2</td>
|
||||
<td>yes</td>
|
||||
<td>yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>130.252.100.19</td>
|
||||
<td>eth0</td>
|
||||
<td>10.1.1.3</td>
|
||||
<td>yes</td>
|
||||
<td>yes</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -83,18 +82,21 @@ to have IP address 130.252.100.18 and the right-hand one to have IP address
|
||||
example) is (are) not included in any specification in /etc/shorewall/masq
|
||||
or /etc/shorewall/proxyarp.</p>
|
||||
|
||||
<p><a name="AllInterFaces"></a>Note 1: The "ALL INTERFACES" column
|
||||
is used to specify whether access to the external IP from all firewall
|
||||
interfaces should undergo NAT (Yes or yes) or if only access from the
|
||||
interface in the INTERFACE column should undergo NAT. If you leave this
|
||||
column empty, "Yes" is assumed. The ALL INTERFACES column was added
|
||||
in version 1.1.6.</p>
|
||||
<p><a name="AllInterFaces"></a>Note 1: The "ALL INTERFACES" column is used
|
||||
to specify whether access to the external IP from all firewall interfaces
|
||||
should undergo NAT (Yes or yes) or if only access from the interface in
|
||||
the INTERFACE column should undergo NAT. If you leave this column empty,
|
||||
"Yes" is assumed. The ALL INTERFACES column was added in version 1.1.6.</p>
|
||||
|
||||
<p>Note 2: Shorewall will automatically add the external address to the
|
||||
specified interface unless you specify <a
|
||||
href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>="no" (or "No") in
|
||||
/etc/shorewall/shorewall.conf; If you do not set ADD_IP_ALIASES or if
|
||||
you set it to "Yes" or "yes" then you must NOT configure your own alias(es).</p>
|
||||
you set it to "Yes" or "yes" then you must NOT configure your own alias(es).
|
||||
<b>RESTRICTION: </b>Shorewall can only add external addresses to an interface
|
||||
that is configured with a single subnetwork -- if your external interface
|
||||
has addresses in more than one subnetwork, Shorewall can only add addresses
|
||||
to the first one.</p>
|
||||
|
||||
<p><a name="LocalPackets"></a>Note 3: The contents of the "LOCAL" column
|
||||
determine whether packets originating on the firewall itself and destined
|
||||
@ -102,13 +104,14 @@ for the EXTERNAL address are redirected to the internal ADDRESS. If this
|
||||
column contains "yes" or "Yes" (and the ALL INTERFACES COLUMN also contains
|
||||
"Yes" or "yes") then such packets are redirected; otherwise, such packets
|
||||
are not redirected. The LOCAL column was added in version 1.1.8.</p>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<p><font size="2">Last updated 1/11/2003 - </font><font size="2"> <a
|
||||
<p><font size="2">Last updated 4/11/2003 - </font><font size="2"> <a
|
||||
href="support.htm">Tom Eastep</a></font> </p>
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -12,484 +12,507 @@
|
||||
|
||||
<table cellpadding="0" cellspacing="0" border="0" width="100%"
|
||||
bgcolor="#400169">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="middle" width="33%" bgcolor="#400169"><a
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="middle" width="33%" bgcolor="#400169"><a
|
||||
href="http://www.squid-cache.org/"><img src="images/squidnow.gif"
|
||||
alt="" width="88" height="31" hspace="4">
|
||||
</a><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" align="center" width="34%"><font
|
||||
</a><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" align="center" width="34%"><font
|
||||
color="#ffffff"><b><big><big><big><big>Using Shorewall with Squid</big></big></big></big></b></font><br>
|
||||
</td>
|
||||
<td valign="middle" height="90" width="33%" align="right"><a
|
||||
</td>
|
||||
<td valign="middle" height="90" width="33%" align="right"><a
|
||||
href="http://www.squid-cache.org/"><img src="images/cache_now.gif"
|
||||
alt="" width="100" height="31" hspace="4">
|
||||
</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
This page covers Shorewall configuration to use with <a
|
||||
<br>
|
||||
This page covers Shorewall configuration to use with <a
|
||||
href="http://www.squid-cache.org/">Squid </a>running as a <u><b>Transparent
|
||||
Proxy</b></u>. <br>
|
||||
<a href="#DMZ"></a><br>
|
||||
<img border="0" src="images/j0213519.gif" width="60" height="60"
|
||||
alt="Caution" align="middle">
|
||||
Please observe the following general requirements:<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b>In all cases, Squid should be configured to
|
||||
run as a transparent proxy as described at <a
|
||||
Proxy</b></u>. If you are running Shorewall 1.3, please see <a
|
||||
href="1.3/Shorewall_Squid_Usage.html">this documentation</a>.<br>
|
||||
<a href="#DMZ"></a><br>
|
||||
<img border="0" src="images/j0213519.gif" width="60"
|
||||
height="60" alt="Caution" align="middle">
|
||||
Please observe the following general requirements:<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b>In all cases, Squid should be configured to
|
||||
run as a transparent proxy as described at <a
|
||||
href="http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html">http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html</a>.<br>
|
||||
<b><br>
|
||||
</b><b><img src="images/BD21298_3.gif" alt="" width="13"
|
||||
<b><br>
|
||||
</b><b><img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
</b>The following instructions mention the files
|
||||
/etc/shorewall/start and /etc/shorewall/init -- if you don't have those
|
||||
files, siimply create them.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> When the Squid server is in the DMZ zone or
|
||||
in the local zone, that zone must be defined ONLY by its interface -- no
|
||||
/etc/shorewall/hosts file entries. That is because the packets being routed
|
||||
to the Squid server still have their original destination IP addresses.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have iptables installed on your Squid
|
||||
server.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have NAT and MANGLE enabled in your
|
||||
/etc/shorewall/conf file<br>
|
||||
<br>
|
||||
<b><font color="#009900"> NAT_ENABLED=Yes<br>
|
||||
</font></b> <font
|
||||
</b>The following instructions mention the files
|
||||
/etc/shorewall/start and /etc/shorewall/init -- if you don't have those
|
||||
files, siimply create them.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> When the Squid server is in the DMZ zone
|
||||
or in the local zone, that zone must be defined ONLY by its interface
|
||||
-- no /etc/shorewall/hosts file entries. That is because the packets being
|
||||
routed to the Squid server still have their original destination IP addresses.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have iptables installed on your
|
||||
Squid server.<br>
|
||||
<br>
|
||||
<b><img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
</b> You must have NAT and MANGLE enabled in your
|
||||
/etc/shorewall/conf file<br>
|
||||
<br>
|
||||
<b><font color="#009900"> NAT_ENABLED=Yes<br>
|
||||
</font></b> <font
|
||||
color="#009900"><b>MANGLE_ENABLED=Yes</b></font><br>
|
||||
<br>
|
||||
Three different configurations are covered:<br>
|
||||
<br>
|
||||
Three different configurations are covered:<br>
|
||||
|
||||
<ol>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running on
|
||||
the Firewall.</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Local">Squid running in the
|
||||
local network</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running in the
|
||||
DMZ</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running
|
||||
on the Firewall.</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#Local">Squid running in
|
||||
the local network</a></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running in the
|
||||
DMZ</a></li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h2><a name="Firewall"></a>Squid Running on the Firewall</h2>
|
||||
You want to redirect all local www connection requests
|
||||
EXCEPT those to your
|
||||
own http server (206.124.146.177)
|
||||
to a Squid transparent
|
||||
proxy running on the firewall and listening on port 3128. Squid
|
||||
will of course require access to remote web servers.<br>
|
||||
<br>
|
||||
In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
You want to redirect all local www connection requests EXCEPT
|
||||
those to your own
|
||||
http server (206.124.146.177)
|
||||
to a Squid
|
||||
transparent proxy running on the firewall and listening on port
|
||||
3128. Squid will of course require access to remote web servers.<br>
|
||||
<br>
|
||||
In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>REDIRECT</td>
|
||||
<td>loc</td>
|
||||
<td>3128</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> -<br>
|
||||
</td>
|
||||
<td>!206.124.146.177</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>REDIRECT</td>
|
||||
<td>loc</td>
|
||||
<td>3128</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> -<br>
|
||||
</td>
|
||||
<td>!206.124.146.177</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h2><a name="Local"></a>Squid Running in the local network</h2>
|
||||
You want to redirect all local www connection requests to a Squid
|
||||
transparent proxy
|
||||
running in your local zone at 192.168.1.3 and listening on port 3128.
|
||||
Your local interface is eth1. There may also be a web server running on
|
||||
192.168.1.3. It is assumed that web access is already enabled from the local
|
||||
zone to the internet.<br>
|
||||
You want to redirect all local www connection requests to a Squid
|
||||
transparent proxy
|
||||
running in your local zone at 192.168.1.3 and listening on port 3128.
|
||||
Your local interface is eth1. There may also be a web server running
|
||||
on 192.168.1.3. It is assumed that web access is already enabled from the
|
||||
local zone to the internet.<br>
|
||||
|
||||
<p><font color="#ff0000"><b>WARNING: </b></font>This setup may conflict with
|
||||
other aspects of your gateway including but not limited to traffic shaping
|
||||
and route redirection. For that reason, <b>I don't recommend it</b>.<br>
|
||||
</p>
|
||||
other aspects of your gateway including but not limited to traffic shaping
|
||||
and route redirection. For that reason, <b>I don't recommend it</b>.<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">echo 202 www.out >> /etc/iproute2/rt_tables</font></b><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.168.1.3 dev eth1 table www.out<br> ip route flush cache<br> echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects<br>fi<br></font></b></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT<br>
|
||||
</td>
|
||||
<td>loc</td>
|
||||
<td>loc<br>
|
||||
</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>Alternativfely, you can have the following policy:<br>
|
||||
<br>
|
||||
<li>If you are running Shorewall 1.4.1 or Shorewall 1.4.1a, please
|
||||
upgrade to Shorewall 1.4.2 or later.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST PARAMETERS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ZONE<br>
|
||||
</td>
|
||||
<td valign="top">INTERFACE<br>
|
||||
</td>
|
||||
<td valign="top">BROADCAST<br>
|
||||
</td>
|
||||
<td valign="top">OPTIONS<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">detect<br>
|
||||
</td>
|
||||
<td valign="top"><b>routeback</b><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/start add:<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>ACTION</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b> PROTO</b></td>
|
||||
<td><b>DEST<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>SOURCE<br>
|
||||
PORT(S)</b></td>
|
||||
<td><b>ORIGINAL<br>
|
||||
DEST</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT<br>
|
||||
</td>
|
||||
<td>loc</td>
|
||||
<td>loc<br>
|
||||
</td>
|
||||
<td>tcp</td>
|
||||
<td>www</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</li>
|
||||
<br>
|
||||
<li>Alternativfely, if you are running Shorewall 1.4.0 you can have the
|
||||
following policy in place of the above rule:<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST PARAMETERS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/start add:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>iptables -t mangle -A PREROUTING -i eth1 -s ! 192.168.1.3 -p tcp --dport 80 -j MARK --set-mark 202</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.168.1.3, arrange for the following command to be executed
|
||||
after networking has come up<br>
|
||||
<li>On 192.168.1.3, arrange for the following command to be executed
|
||||
after networking has come up<br>
|
||||
|
||||
<pre><b><font color="#009900">iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-ports 3128</font></b><br></pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> If you are running RedHat on the server, you can simply execute
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
||||
color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<h2><a name="DMZ"></a>Squid Running in the DMZ (This is what I do)</h2>
|
||||
You have a single Linux system in your DMZ with IP address 192.0.2.177.
|
||||
You want to run both a web server and Squid on that system. Your DMZ interface
|
||||
is eth1 and your local interface is eth2.<br>
|
||||
You have a single Linux system in your DMZ with IP address 192.0.2.177.
|
||||
You want to run both a web server and Squid on that system. Your DMZ
|
||||
interface is eth1 and your local interface is eth2.<br>
|
||||
|
||||
<ul>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
<li>On your firewall system, issue the following command<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>echo 202 www.out >> /etc/iproute2/rt_tables</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/init, put:<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><font color="#009900"><b>if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.0.2.177 dev eth1 table www.out<br> ip route flush cache<br>fi</b></font><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li> Do<b> one </b>of the following:<br>
|
||||
<br>
|
||||
A) In /etc/shorewall/start add<br>
|
||||
</li>
|
||||
<li> Do<b> one </b>of the following:<br>
|
||||
<br>
|
||||
A) In /etc/shorewall/start add<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900"> iptables -t mangle -A PREROUTING -i eth2 -p tcp --dport 80 -j MARK --set-mark 202</font></b><br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf
|
||||
and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
C) Run Shorewall 1.3.14 or later and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202:P<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">202<br>
|
||||
</td>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>In /etc/shorewall/rules, you will need:</li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
C) Run Shorewall 1.3.14 or later and add the following entry in /etc/shorewall/tcrules:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ACTION<br>
|
||||
<td valign="top">MARK<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
<td valign="top">DESTINATION<br>
|
||||
</td>
|
||||
<td valign="top">PROTO<br>
|
||||
<td valign="top">PROTOCOL<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
PORT(S)<br>
|
||||
<td valign="top">PORT<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT<br>
|
||||
PORT(2)<br>
|
||||
</td>
|
||||
<td valign="top">ORIGINAL<br>
|
||||
DEST<br>
|
||||
<td valign="top">CLIENT PORT<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
<td valign="top">202:P<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
<td valign="top">eth2<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.0.2.177 (your Web/Squid server), arrange for the following
|
||||
command to be executed after networking has come up<br>
|
||||
<li>In /etc/shorewall/rules, you will need:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">ACTION<br>
|
||||
</td>
|
||||
<td valign="top">SOURCE<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
</td>
|
||||
<td valign="top">PROTO<br>
|
||||
</td>
|
||||
<td valign="top">DEST<br>
|
||||
PORT(S)<br>
|
||||
</td>
|
||||
<td valign="top">CLIENT<br>
|
||||
PORT(2)<br>
|
||||
</td>
|
||||
<td valign="top">ORIGINAL<br>
|
||||
DEST<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">dmz<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>On 192.0.2.177 (your Web/Squid server), arrange for the following
|
||||
command to be executed after networking has come up<br>
|
||||
|
||||
<pre><font color="#009900"><b>iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128</b></font><br></pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> If you are running RedHat on the server, you can simply execute
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
the following commands after you have typed the iptables command above:<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
||||
color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<p><font size="-1"> Updated 2/22/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
<p><font size="-1"> Updated 4/7/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
<a
|
||||
href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> ©
|
||||
<font size="2">2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -13,186 +13,152 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall and Aliased Interfaces</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<h2>Background</h2>
|
||||
The traditional net-tools contain a program called <i>ifconfig</i> which
|
||||
The traditional net-tools contain a program called <i>ifconfig</i> which
|
||||
is used to configure network devices. ifconfig introduced the concept of
|
||||
<i>aliased </i>or <i>virtial </i>interfaces. These virtual interfaces have
|
||||
names of the form <i>interface</i>:<i>integer </i>(e.g., eth0:0) and ifconfig
|
||||
treats them more or less like real interfaces.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
|
||||
<pre>[root@gateway root]# ifconfig eth0:0<br>eth0:0 Link encap:Ethernet HWaddr 02:00:08:3:FA:55<br> inet addr:206.124.146.178 Bcast:206.124.146.255 Mask:255.255.255.0<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> Interrupt:11 Base address:0x2000<br>[root@gateway root]# <br></pre>
|
||||
The ifconfig utility is being gradually phased out in favor of the <i>ip</i>
|
||||
The ifconfig utility is being gradually phased out in favor of the <i>ip</i>
|
||||
utility which is part of the <i>iproute </i>package. The ip utility does
|
||||
not use the concept of aliases or virtual interfaces but rather treats additional
|
||||
addresses on an interface as objects. The ip utility does provide for interaction
|
||||
with ifconfig in that it allows addresses to be <i>labeled </i>and labels
|
||||
may take the form of ipconfig virtual interfaces.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
|
||||
<pre>[root@gateway root]# ip addr show dev eth0<br>2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb qlen 100<br> link/ether 02:00:08:e3:fa:55 brd ff:ff:ff:ff:ff:ff<br> inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0<br> inet 206.124.146.178/24 brd 206.124.146.255 scope global secondary eth0:0<br>[root@gateway root]# <br></pre>
|
||||
Note that one <u>cannot</u> type "ip addr show dev eth0:0" because "eth0:0"
|
||||
Note that one <u>cannot</u> type "ip addr show dev eth0:0" because "eth0:0"
|
||||
is a label for a particular address rather than a device name.<br>
|
||||
|
||||
<pre>[root@gateway root]# ip addr show dev eth0:0<br>Device "eth0:0" does not exist.<br>[root@gateway root]#<br></pre>
|
||||
The iptables program doesn't support virtual interfaces in either it's
|
||||
The iptables program doesn't support virtual interfaces in either it's
|
||||
"-i" or "-o" command options; as a consequence, Shorewall does not allow
|
||||
them to be used in the /etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<h2>So how do I handle more than one address on an interface?</h2>
|
||||
The answer depends on what you are trying to do with the interfaces.
|
||||
The answer depends on what you are trying to do with the interfaces.
|
||||
In the sub-sections that follow, we'll take a look at common scenarios.<br>
|
||||
|
||||
<h3>Separate Rules</h3>
|
||||
If you need to make a rule for traffic to/from the firewall itself that
|
||||
If you need to make a rule for traffic to/from the firewall itself that
|
||||
only applies to a particular IP address, simply qualify the $FW zone with
|
||||
the IP address.<br>
|
||||
<br>
|
||||
Example (allow SSH from net to eth0:0 above):<br>
|
||||
<br>
|
||||
<br>
|
||||
Example (allow SSH from net to eth0:0 above):<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">fw:206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top">fw:206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>DNAT</h3>
|
||||
Suppose that I had set up eth0:0 as above and I wanted to port forward
|
||||
Suppose that I had set up eth0:0 as above and I wanted to port forward
|
||||
from that virtual interface to a web server running in my local zone at
|
||||
192.168.1.3. That is accomplised by a single rule in the /etc/shorewall/rules
|
||||
file:<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">DNAT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">80<br>
|
||||
</td>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>SNAT</h3>
|
||||
If you wanted to use eth0:0 as the IP address for outbound connections
|
||||
If you wanted to use eth0:0 as the IP address for outbound connections
|
||||
from your local zone (eth1), then in /etc/shorewall/masq:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SUBNET<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ADDRESS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -206,7 +172,7 @@ file:<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0:0<br>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
@ -218,51 +184,42 @@ file:<br>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>STATIC NAT</h3>
|
||||
If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3,
|
||||
you would have the following in /etc/shorewall/nat:<br>
|
||||
<br>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>EXTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ALL INTERFACES<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOCAL<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SUBNET<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ADDRESS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">eth0:0<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>STATIC NAT</h3>
|
||||
If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3,
|
||||
you would have the following in /etc/shorewall/nat:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -282,7 +239,7 @@ file:<br>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0:0<br>
|
||||
<td valign="top">eth0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
@ -295,252 +252,115 @@ file:<br>
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In either case, to create rules that pertain only to this NAT pair, you
|
||||
simply qualify the local zone with the internal IP address.<br>
|
||||
<br>
|
||||
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a.
|
||||
192.168.1.3.<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
Shorewall can create the alias (additional address) for you if you set
|
||||
ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||
that you can see the created address using ifconfig. In addition to setting
|
||||
ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||
column as follows:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>EXTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERNAL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ALL INTERFACES<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOCAL<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">206.124.146.178<br>
|
||||
</td>
|
||||
<td valign="top">eth0:0<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
<td valign="top">no<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
<br>
|
||||
</blockquote>
|
||||
In either case, to create rules that pertain only to this NAT pair, you
|
||||
simply qualify the local zone with the internal IP address.<br>
|
||||
<br>
|
||||
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a.
|
||||
192.168.1.3.<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" border="1" cellspacing="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ACTION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PROTOCOL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top">net<br>
|
||||
</td>
|
||||
<td valign="top">loc:192.168.1.3<br>
|
||||
</td>
|
||||
<td valign="top">tcp<br>
|
||||
</td>
|
||||
<td valign="top">22<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
|
||||
<h3>MULTIPLE SUBNETS</h3>
|
||||
Sometimes multiple IP addresses are used because there are multiple subnetworks
|
||||
configured on a LAN segment. This technique does not provide for any security
|
||||
between the subnetworks if the users of the systems have administrative
|
||||
privileges because in that case, the users can simply manipulate their system's
|
||||
routing table to bypass your firewall/router. Nevertheless, there are cases
|
||||
where you simply want to consider the LAN segment itself as a zone and allow
|
||||
your firewall/router to route between the two subnetworks.<br>
|
||||
<br>
|
||||
Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and
|
||||
Sometimes multiple IP addresses are used because there are multiple
|
||||
subnetworks configured on a LAN segment. This technique does not provide
|
||||
for any security between the subnetworks if the users of the systems have
|
||||
administrative privileges because in that case, the users can simply manipulate
|
||||
their system's routing table to bypass your firewall/router. Nevertheless,
|
||||
there are cases where you simply want to consider the LAN segment itself
|
||||
as a zone and allow your firewall/router to route between the two subnetworks.<br>
|
||||
<br>
|
||||
Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and
|
||||
192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and eth1:0
|
||||
is 192.168.20.254. You want to simply route all requests between the two
|
||||
subnetworks.<br>
|
||||
|
||||
<h4>If you are running Shorewall 1.4.1 or Later</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall
|
||||
1.4.1 and later releases default to allowing intra-zone traffic.<br>
|
||||
<h4>If you are running Shorewall 1.4.0 or earlier<br>
|
||||
</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/policy:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST:LIMIT<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24.
|
||||
The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254.
|
||||
You want to make these subnetworks into separate zones and control the access
|
||||
between them (the users of the systems do not have administrative privileges).<br>
|
||||
<br>
|
||||
In /etc/shorewall/zones:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DISPLAY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESCRIPTION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">Local<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 1<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">Local2<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 2<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
@ -558,18 +378,55 @@ specify the <b>multi</b> option.<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall
|
||||
1.4.1 and later releases default to allowing intra-zone traffic.<br>
|
||||
|
||||
<h4>If you are running Shorewall 1.4.0 or earlier<br>
|
||||
</h4>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
@ -577,7 +434,9 @@ specify the <b>multi</b> option.<br>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
@ -585,15 +444,47 @@ specify the <b>multi</b> option.<br>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/policy:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
<td valign="top"><b>SOURCE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESTINATION<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>POLICY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>LOG LEVEL<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BURST:LIMIT<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">ACCEPT<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
@ -601,21 +492,131 @@ specify the <b>multi</b> option.<br>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24.
|
||||
The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254.
|
||||
You want to make these subnetworks into separate zones and control the
|
||||
access between them (the users of the systems do not have administrative
|
||||
privileges).<br>
|
||||
<br>
|
||||
In /etc/shorewall/zones:<br>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic
|
||||
that you want to permit.<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/22/2003 A - <a
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DISPLAY<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>DESCRIPTION<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">Local<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 1<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">Local2<br>
|
||||
</td>
|
||||
<td valign="top">Local Zone 2<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/interfaces:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>INTERFACE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>BROADCAST<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">-<br>
|
||||
</td>
|
||||
<td valign="top">eth1<br>
|
||||
</td>
|
||||
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||
</td>
|
||||
<td valign="top">Note 1:<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
Note 1: If you are running Shorewall 1.3.10 or earlier then you must
|
||||
specify the <b>multi</b> option.<br>
|
||||
<br>
|
||||
In /etc/shorewall/hosts:<br>
|
||||
|
||||
<blockquote>
|
||||
<table cellpadding="2" cellspacing="0" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top"><b>ZONE<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>HOSTS<br>
|
||||
</b></td>
|
||||
<td valign="top"><b>OPTIONS<br>
|
||||
</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.1.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">loc2<br>
|
||||
</td>
|
||||
<td valign="top">eth0:192.168.20.0/24<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
</blockquote>
|
||||
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic
|
||||
that you want to permit.<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/27/2003 A - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,23 +2,17 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Index</title>
|
||||
|
||||
<base
|
||||
target="main">
|
||||
|
||||
<base target="main">
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -26,138 +20,108 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#4b017c" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%" height="90">
|
||||
|
||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm">Home</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_features.htm">Features</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||
<li> <a href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
<li> <a href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||
<li> <a
|
||||
href="Documentation.htm">Reference Manual</a></li>
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
href="useful_links.html">Useful Links</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
</li>
|
||||
<li> <a
|
||||
href="troubleshoot.htm">Troubleshooting</a></li>
|
||||
<li> <a href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
<li> <a href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||
<li> <a href="support.htm">Getting
|
||||
<li> <a href="support.htm">Getting
|
||||
help or Answers to Questions</a><br>
|
||||
</li>
|
||||
|
||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</li>
|
||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
<ul>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://germany.shorewall.net">Germany</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://france.shorewall.net">France</a></li>
|
||||
<li><a href="http://www.shorewall.net"
|
||||
<li><a href="http://www.shorewall.net"
|
||||
target="_top">Washington State, USA</a><br>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a href="News.htm">News
|
||||
<li> <a href="News.htm">News
|
||||
Archive</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||
<li> <a href="quotes.htm">Quotes
|
||||
<li> <a href="quotes.htm">Quotes
|
||||
from Users</a></li>
|
||||
<li> <a href="shoreline.htm">About
|
||||
<li> <a href="shoreline.htm">About
|
||||
the Author</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<b>Note: </b></strong>Search is unavailable
|
||||
<b>Note: </b></strong>Search is unavailable
|
||||
Daily 0200-0330 GMT.<br>
|
||||
<strong></strong>
|
||||
|
||||
<strong></strong>
|
||||
<p><strong>Quick Search</strong><br>
|
||||
<font face="Arial" size="-1"> <input
|
||||
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
<font face="Arial" size="-1">
|
||||
<input type="text" name="words" size="15"></font><font size="-1"> </font>
|
||||
<font face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
||||
value="Search"></font> </p>
|
||||
<font face="Arial"> <input
|
||||
<font face="Arial"> <input
|
||||
type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||
|
||||
|
||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001-2003 Thomas M. Eastep.</font></a><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></p>
|
||||
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,23 +2,16 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Index</title>
|
||||
|
||||
|
||||
<base target="main">
|
||||
|
||||
<base target="main">
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -26,142 +19,107 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#4b017c" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%" height="90">
|
||||
|
||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="sourceforge_index.htm">Home</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_features.htm">Features</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||
<li> <a href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
<li> <a href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||
<li> <a
|
||||
href="Documentation.htm">Reference Manual</a></li>
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
href="useful_links.html">Useful Links</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
</li>
|
||||
<li> <a
|
||||
href="troubleshoot.htm">Troubleshooting</a></li>
|
||||
<li> <a href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
<li> <a href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||
<li> <a href="support.htm">Getting
|
||||
<li> <a href="support.htm">Getting
|
||||
Help or Answers to Questions</a></li>
|
||||
|
||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
<ul>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://germany.shorewall.net">Germany</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://france.shorewall.net">France</a></li>
|
||||
<li><a href="http://www.shorewall.net"
|
||||
<li><a href="http://www.shorewall.net"
|
||||
target="_top">Washington State, USA</a><br>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a href="News.htm">News
|
||||
<li> <a href="News.htm">News
|
||||
Archive</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||
<li> <a href="quotes.htm">Quotes
|
||||
<li> <a href="quotes.htm">Quotes
|
||||
from Users</a></li>
|
||||
<li> <a href="shoreline.htm">About
|
||||
<li> <a href="shoreline.htm">About
|
||||
the Author</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="sourceforge_index.htm#Donations">Donations</a></li>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<b>Note: </b></strong>Search is unavailable
|
||||
<b>Note: </b></strong>Search is unavailable
|
||||
Daily 0200-0330 GMT.<br>
|
||||
<strong></strong>
|
||||
|
||||
<strong></strong>
|
||||
<p><strong>Quick Search</strong><br>
|
||||
<font face="Arial" size="-1">
|
||||
<input type="text" name="words" size="15"></font><font size="-1"> </font>
|
||||
<font face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
<font face="Arial" size="-1"> <input
|
||||
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
||||
value="Search"></font> </p>
|
||||
<font face="Arial"> <input
|
||||
<font face="Arial"> <input
|
||||
type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||
|
||||
|
||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
||||
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001-2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -17,440 +17,170 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><b>I strongly urge you to read and print a copy of the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||
for the configuration that most closely matches your own.<br>
|
||||
</b></p>
|
||||
for the configuration that most closely matches your own.<br>
|
||||
</b></p>
|
||||
|
||||
<p>The entire set of Shorewall documentation is available in PDF format
|
||||
at:</p>
|
||||
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
||||
|
||||
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||||
<a href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||
</p>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||
</p>
|
||||
|
||||
<p>The documentation in HTML format is included in the .rpm and in the
|
||||
.tgz packages below.</p>
|
||||
|
||||
<p> Once you've printed the appropriate QuickStart Guide, download <u>
|
||||
one</u> of the modules:</p>
|
||||
one</u> of the modules:</p>
|
||||
|
||||
<ul>
|
||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
||||
with a 2.4 kernel, you can use the RPM version (note: the
|
||||
RPM should also work with other distributions that
|
||||
store init scripts in /etc/init.d and that include chkconfig
|
||||
or insserv). If you find that it works in other cases, let <a
|
||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
||||
with a 2.4 kernel, you can use the RPM version (note: the
|
||||
RPM should also work with other distributions that store
|
||||
init scripts in /etc/init.d and that include chkconfig or
|
||||
insserv). If you find that it works in other cases, let <a
|
||||
href="mailto:teastep@shorewall.net"> me</a> know so that
|
||||
I can mention them here. See the <a href="Install.htm">Installation
|
||||
Instructions</a> if you have problems installing the RPM.</li>
|
||||
<li>If you are running LRP, download the .lrp file (you
|
||||
might also want to download the .tgz so you will have a copy
|
||||
I can mention them here. See the <a href="Install.htm">Installation
|
||||
Instructions</a> if you have problems installing the RPM.</li>
|
||||
<li>If you are running LRP, download the .lrp file
|
||||
(you might also want to download the .tgz so you will have a copy
|
||||
of the documentation).</li>
|
||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||
and would like a .deb package, Shorewall is included in both
|
||||
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
Testing Branch</a> and the <a
|
||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||||
Unstable Branch</a>.</li>
|
||||
<li>Otherwise, download the <i>shorewall</i>
|
||||
module (.tgz)</li>
|
||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||
and would like a .deb package, Shorewall is included in both
|
||||
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||
Testing Branch</a> and the <a
|
||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian Unstable
|
||||
Branch</a>.</li>
|
||||
<li>Otherwise, download the <i>shorewall</i>
|
||||
module (.tgz)</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p>The documentation in HTML format is included in the .tgz and .rpm files
|
||||
and there is an documentation .deb that also contains the documentation. The
|
||||
.rpm will install the documentation in your default document directory which
|
||||
can be obtained using the following command:<br>
|
||||
</p>
|
||||
and there is an documentation .deb that also contains the documentation. The
|
||||
.rpm will install the documentation in your default document directory
|
||||
which can be obtained using the following command:<br>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
<p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p>Please verify the version that you have downloaded -- during the
|
||||
release of a new version of Shorewall, the links below may
|
||||
point to a newer or an older version than is shown below.</p>
|
||||
|
||||
<ul>
|
||||
<li>RPM - "rpm -qip LATEST.rpm"</li>
|
||||
<li>TARBALL - "tar -ztf LATEST.tgz" (the directory
|
||||
name will contain the version)</li>
|
||||
<li>LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar
|
||||
-zxf <downloaded .lrp>; cat var/lib/lrpkg/shorwall.version"
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p>Once you have verified the version, check the <font
|
||||
color="#ff0000"> <a href="errata.htm"> errata</a></font> to see
|
||||
if there are updates that apply to the version that you have
|
||||
downloaded.</p>
|
||||
<p>Please check the <font color="#ff0000"> <a href="errata.htm"> errata</a></font>
|
||||
to see if there are updates that apply to the version
|
||||
that you have downloaded.</p>
|
||||
|
||||
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed
|
||||
configuration of your firewall, you can enable startup by removing the
|
||||
file /etc/shorewall/startup_disabled.</b></font></p>
|
||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed configuration
|
||||
of your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
||||
|
||||
<p><b>Download Latest Version</b> (<b>1.4.0</b>): <b>Remember that updates
|
||||
to the mirrors occur 1-12 hours after an update to the Washington
|
||||
State site.</b></p>
|
||||
<p><b></b></p>
|
||||
|
||||
<blockquote>
|
||||
<table border="2" cellspacing="3" cellpadding="3"
|
||||
style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">SourceForge<br>
|
||||
</td>
|
||||
<td valign="top">sf.net<br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Download</a><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.rpm">Download
|
||||
.rpm</a><br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.rpm">Download .rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.lrp"> Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.samples"> Download
|
||||
.samples</a><a
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||
.rpm</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||
Download.md5sums<br>
|
||||
</a><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td> <a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||
Download .lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.samples">
|
||||
Download .samples</a><a target="_blank"
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||
Download .lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.samples">
|
||||
Download .samples</a><a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Paris, France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://france.shorewall.net/pub/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://france.shorewall.net/pub/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a href="http://france.shorewall.net/pub/LATEST.samples">Download
|
||||
.samples</a><a
|
||||
href="http://france.shorewall.net/pub/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
<td> <a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||
.rpm</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.samples">Download
|
||||
.samples</a><a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums"><br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="middle">Washington State, USA<br>
|
||||
</td>
|
||||
<td valign="middle">Shorewall.net<br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||
.lrp</a><br>
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples">Download
|
||||
.samples</a><br>
|
||||
</td>
|
||||
<td valign="top"><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.rpm" target="_blank">
|
||||
Download .rpm</a> <br>
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.tgz" target="_blank">Download
|
||||
.tgz</a> <br>
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.lrp" target="_blank">Download
|
||||
.lrp</a><br>
|
||||
<a target="_blank"
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||
.md5sums<br>
|
||||
</a><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.samples"
|
||||
target="_blank">Download .samples</a><br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
|
||||
<p><b>Browse Download Sites:</b></p>
|
||||
<p><b>Download Sites:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SourceForge<br>
|
||||
</td>
|
||||
<td>sf.net</td>
|
||||
<td><a
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>SERVER LOCATION</b></td>
|
||||
<td><b>DOMAIN</b></td>
|
||||
<td><b>HTTP</b></td>
|
||||
<td><b>FTP</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SourceForge<br>
|
||||
</td>
|
||||
<td>sf.net</td>
|
||||
<td><a
|
||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
||||
<td>N/A</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
<td>N/A</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Slovak Republic</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
<td> <a target="_blank"
|
||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Texas, USA</td>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a
|
||||
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
<td><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
<td><a target="_blank"
|
||||
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td><a
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||
<td>Correofuego.com.ar</td>
|
||||
<td><a
|
||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
<td> <a target="_blank"
|
||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
</tr>
|
||||
<tr>
|
||||
<td>France</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
||||
<td> <a target="_blank"
|
||||
<td> <a target="_blank"
|
||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Washington State, USA</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Washington State, USA</td>
|
||||
<td>Shorewall.net</td>
|
||||
<td><a
|
||||
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||
<td><a
|
||||
<td><a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
||||
</tr>
|
||||
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p align="left"><b>CVS:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<p align="left">The <a target="_top"
|
||||
href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS repository
|
||||
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
||||
Shorewall component. There's no guarantee that what you find there
|
||||
will work at all.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
||||
Shorewall component. There's no guarantee that what you find there
|
||||
will work at all.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/6/2003 - <a
|
||||
<p align="left"><font size="2">Last Updated 3/24/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,19 +2,14 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall 1.4 Errata</title>
|
||||
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
@ -24,15 +19,12 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -40,82 +32,100 @@
|
||||
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
|
||||
|
||||
<li>
|
||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||
a corrected script, be sure to run the script through <u>
|
||||
a corrected script, be sure to run the script through <u>
|
||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>If you are installing Shorewall for the first
|
||||
time and plan to use the .tgz and install.sh script, you can untar
|
||||
the archive, replace the 'firewall' script in the untarred directory
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>When the instructions say to install a corrected
|
||||
firewall script in /usr/share/shorewall/firewall, you may
|
||||
rename the existing file before copying in the new file.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
firewall script in /usr/share/shorewall/firewall, you may
|
||||
rename the existing file before copying in the new file.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are running
|
||||
1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are running
|
||||
1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<ul>
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
href="errata_3.html">Problems in Version 1.3</a></b></li>
|
||||
<li> <b><a
|
||||
<li> <b><a
|
||||
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
||||
<li> <b><font
|
||||
<li> <b><font
|
||||
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||
<li> <b><font
|
||||
<li> <b><font
|
||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a
|
||||
href="#Debug">Problems with kernels >= 2.4.18 and RedHat
|
||||
iptables</a></b></li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
RPM on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with iptables
|
||||
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
and NAT</a></b><br>
|
||||
</li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
RPM on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with iptables
|
||||
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
and NAT</a></b><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
<h2 align="left"><a name="V1.4"></a>Problems in Version 1.4</h2>
|
||||
|
||||
|
||||
<h3></h3>
|
||||
|
||||
<h3>1.4.0</h3>
|
||||
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
||||
<ul>
|
||||
<li>When running under certain shells Shorewall will attempt to create
|
||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||
/etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
<li>Some TCP requests are rejected in the 'common' chain with an ICMP port-unreachable
|
||||
response rather than the more appropriate TCP RST response. This problem
|
||||
is corrected in this updated common.def file which may be installed in /etc/shorewall/common.def.<br>
|
||||
</li>
|
||||
</ul>
|
||||
<h3>1.4.1</h3>
|
||||
|
||||
<ul>
|
||||
<li>When a "shorewall check" command is executed, each "rule" produces
|
||||
the harmless additional message:<br>
|
||||
<br>
|
||||
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected<br>
|
||||
<br>
|
||||
You may correct the problem by installing <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
||||
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
||||
as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>When running under certain shells Shorewall will attempt to create
|
||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||
/etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr width="100%" size="2">
|
||||
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
||||
|
||||
@ -124,140 +134,122 @@ correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
|
||||
<hr>
|
||||
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
||||
iptables version 1.2.3</font></h3>
|
||||
iptables version 1.2.3</font></h3>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
RedHat released this buggy iptables in RedHat 7.2. </p>
|
||||
|
||||
|
||||
<p align="left"> I have built a <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have
|
||||
also built an <a
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have
|
||||
also built an <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||
has released an iptables-1.2.4 RPM of their own which you can
|
||||
download from<font color="#ff6633"> <a
|
||||
has released an iptables-1.2.4 RPM of their own which you can
|
||||
download from<font color="#ff6633"> <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||
</font>I have installed this RPM on my firewall and it works
|
||||
fine.</p>
|
||||
|
||||
</font>I have installed this RPM on my firewall and it works
|
||||
fine.</p>
|
||||
|
||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||
the patches are available for download. This <a
|
||||
the patches are available for download. This <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||
which corrects a problem with parsing of the --log-level specification
|
||||
while this <a
|
||||
which corrects a problem with parsing of the --log-level
|
||||
specification while this <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
<p align="left">To install one of the above patches:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18
|
||||
and RedHat iptables</h3>
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18 and
|
||||
RedHat iptables</h3>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||
may experience the following:</p>
|
||||
|
||||
may experience the following:</p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
|
||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||
this iptables RPM</a>. If you are already running a 1.2.5 version
|
||||
of iptables, you will need to specify the --oldpackage option
|
||||
to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
this iptables RPM</a>. If you are already running a 1.2.5
|
||||
version of iptables, you will need to specify the --oldpackage
|
||||
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||
RPM on SuSE</h3>
|
||||
|
||||
|
||||
<p>If you find that rpm complains about a conflict
|
||||
with kernel <= 2.2 yet you have a 2.4 kernel
|
||||
installed, simply use the "--nodeps" option to
|
||||
rpm.</p>
|
||||
RPM on SuSE</h3>
|
||||
|
||||
<p>If you find that rpm complains about a conflict with kernel <=
|
||||
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
|
||||
option to rpm.</p>
|
||||
|
||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
|
||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
||||
MULTIPORT=Yes</b></h3>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with
|
||||
iptables version 1.2.7 and MULTIPORT=Yes</b></h3>
|
||||
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made
|
||||
an incompatible change to the syntax used to
|
||||
specify multiport match rules; as a consequence,
|
||||
if you install iptables 1.2.7 you must be running
|
||||
Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
||||
change to the syntax used to specify multiport match rules; as
|
||||
a consequence, if you install iptables 1.2.7 you must be
|
||||
running Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<ul>
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or </li>
|
||||
<li>if you are running
|
||||
Shorewall 1.3.6 you may install
|
||||
<a
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or
|
||||
</li>
|
||||
<li>if you are running
|
||||
Shorewall 1.3.6 you may install
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will result
|
||||
in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will
|
||||
result in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
|
||||
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
Error message is:<br>
|
||||
Error message is:<br>
|
||||
|
||||
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
||||
The solution is to put "no" in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
||||
disabled it. The 2.4.19 kernel contains corrected support under a new
|
||||
kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
The solution is to put "no" in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
||||
disabled it. The 2.4.19 kernel contains corrected support under a
|
||||
new kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
|
||||
<p><font size="2"> Last updated 3/21/2003 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
<p><font size="2"> Last updated 3/25/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
</p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@ -2,22 +2,16 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -25,109 +19,101 @@
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle" align="left">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle" align="left">
|
||||
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a></h1>
|
||||
|
||||
|
||||
<a
|
||||
</a></h1>
|
||||
<a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35" alt="">
|
||||
</a>
|
||||
|
||||
</a>
|
||||
<p align="right"><font color="#ffffff"><b> </b></font> </p>
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
||||
</td>
|
||||
<td valign="middle" width="33%"> <a
|
||||
</td>
|
||||
<td valign="middle" width="33%"> <a
|
||||
href="http://www.postfix.org/"> <img
|
||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
||||
height="45" alt="(Postfix Logo)">
|
||||
</a><br>
|
||||
</a><br>
|
||||
|
||||
<div align="left"><a href="http://www.spamassassin.org"><img
|
||||
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
||||
border="0">
|
||||
</a> </div>
|
||||
<br>
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
<div align="right"><br>
|
||||
<b><font color="#ffffff"><br>
|
||||
Powered by Postfix </font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<b><font color="#ffffff"><br>
|
||||
Powered by Postfix </font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
Guide</a>.<br>
|
||||
</h1>
|
||||
</h1>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tom dot eastep
|
||||
at hp dot com.</p>
|
||||
<p align="left">You can report such problems by sending mail to tmeastep
|
||||
at hotmail dot com.</p>
|
||||
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
|
||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX
|
||||
record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command
|
||||
<li>to ensure that the host name in the HELO/EHLO command
|
||||
is a valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in
|
||||
list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the
|
||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||
one list subscriber wrote to me privately "These e-mail admin's need to
|
||||
get a <i>(explitive deleted)</i> life instead of trying to rid the planet
|
||||
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||
posts as must as possible, I have now configured the list server at shorewall.net
|
||||
to strip all HTML from outgoing posts. This means that HTML-only posts
|
||||
will be bounced by the list server.<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the list
|
||||
subscribers whose MTAs are bouncing all shorewall.net mail. As one list
|
||||
subscriber wrote to me privately "These e-mail admin's need to get a <i>(explitive
|
||||
deleted)</i> life instead of trying to rid the planet of HTML based e-mail".
|
||||
Nevertheless, to allow subscribers to receive list posts as must as possible,
|
||||
I have now configured the list server at shorewall.net to strip all HTML
|
||||
from outgoing posts. This means that HTML-only posts will be bounced by
|
||||
the list server.<br>
|
||||
|
||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post, your
|
||||
If you find that you are missing an occasional list post, your
|
||||
e-mail admin may be blocking mail whose <i>Received:</i> headers contain
|
||||
the names of certain ISPs. Again, I believe that such policies hurt more
|
||||
than they help but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
||||
@ -138,20 +124,17 @@ than they help but I'm not prepared to go so far as to start stripping <i>Recei
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -160,22 +143,21 @@ than they help but I'm not prepared to go so far as to start stripping <i>Recei
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
</form>
|
||||
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
||||
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
||||
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued by Shoreline
|
||||
If you want to trust X.509 certificates issued by Shoreline
|
||||
Firewall (such as the one used on my web site), you may <a
|
||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates then
|
||||
@ -195,12 +177,12 @@ stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
@ -212,30 +194,30 @@ stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
list may be found at <a
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
||||
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
||||
may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
@ -245,12 +227,12 @@ list may be found at <a
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
||||
|
||||
@ -270,26 +252,23 @@ list may be found at <a
|
||||
to make this less confusing. To unsubscribe:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
|
||||
<li>
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a
|
||||
password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
||||
reminder, or change your subscription options enter your subscription
|
||||
email address:". Enter your email address in the box and
|
||||
click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be emailed
|
||||
to you.</p>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -298,12 +277,13 @@ your subscription email address:". Enter your email address
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 2/24/2003 - <a
|
||||
<p align="left"><font size="2">Last updated 3/24/2003 - <a
|
||||
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -2,385 +2,267 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base
|
||||
target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" height="90">
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><a
|
||||
</a></i></font><a
|
||||
href="http://www.shorewall.net" target="_top"><img border="1"
|
||||
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
||||
alt="(Shorewall Logo)" align="right" vspace="4">
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
|
||||
<div align="center">
|
||||
<h1><font color="#ffffff">Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy" </small></small></small></font></i></h1>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top">
|
||||
</a> </p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="1.3" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.3 Site is here</font></a>
|
||||
<br>
|
||||
|
||||
</div>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
||||
href="1.3" target="_top"><font color="#ffffff"><br>
|
||||
<small><small><small><small>Shorewall 1.3 Site is here</small></small></small></small></font></a><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><br>
|
||||
<small><small><small><small>Shorewall 1.2 Site is here</small></small></small></small></font></a><br>
|
||||
|
||||
</h1>
|
||||
</div>
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="90%">
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
|
||||
<br>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR
|
||||
A PARTICULAR PURPOSE. See the GNU General Public
|
||||
License for more details.<br>
|
||||
|
||||
<br>
|
||||
|
||||
You should have received
|
||||
a copy of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
it under
|
||||
the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
This program
|
||||
is distributed in the hope that it will
|
||||
be useful, but WITHOUT ANY WARRANTY; without
|
||||
even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
<br>
|
||||
You should have
|
||||
received a copy of the GNU General Public
|
||||
License along with this program; if
|
||||
not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
</a>Jacques Nilo
|
||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
||||
find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></p>
|
||||
|
||||
<p><b>Congratulations to Jacques and Eric on the recent release of
|
||||
Bering 1.1!!! </b><br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<h2>This is a mirror of the main Shorewall web site at SourceForge
|
||||
(<a href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
<p><b>3/24/2003 - Shorewall 1.4.1 </b><b> </b><b><img
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
This release follows up on 1.4.0. It corrects a problem introduced in 1.4.0
|
||||
and removes additional warts.<br>
|
||||
<br>
|
||||
<b>Problems Corrected:</b><br>
|
||||
</b></p>
|
||||
|
||||
<ol>
|
||||
<li>When Shorewall 1.4.0 is run under the ash shell (such as on
|
||||
Bering/LEAF), it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn
|
||||
file is empty. That problem has been corrected so that ECN disabling rules
|
||||
are only added if there are entries in /etc/shorewall/ecn.</li>
|
||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||
Shorewall presentation to GSLUG</a>. The presentation is in HTML format
|
||||
but was generated from Microsoft PowerPoint and is best viewed using Internet
|
||||
Explorer although Konqueror also seems to work reasonably well. Neither Opera
|
||||
or Netscape work well to view the presentation.<br>
|
||||
</blockquote>
|
||||
|
||||
</ol>
|
||||
<b>New Features:</b><br>
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</p>
|
||||
|
||||
<blockquote>Note: In the list that follows, the term <i>group </i>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may
|
||||
be a host address) accessed through a particular interface. Examples:<br>
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated
|
||||
with each of your zones.<br>
|
||||
</blockquote>
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b>
|
||||
chain are now properly rejected with TCP RST; previously, some of these
|
||||
requests were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously timed
|
||||
out on the first hop (e.g., to the firewall). This has been worked around.</li>
|
||||
|
||||
<ol>
|
||||
<li>Beginning with Shorewall 1.4.1, if a zone Z comprises more
|
||||
than one group<i> </i>then if there is no explicit Z to Z policy and there
|
||||
are no rules governing traffic from Z to Z then Shorewall will permit all
|
||||
traffic between the groups in the zone.</li>
|
||||
<li>Beginning with Shorewall 1.4.1, Shorewall will never create
|
||||
rules to handle traffic from a group to itself.</li>
|
||||
<li>A NONE policy is introduced in 1.4.1. When a policy of NONE
|
||||
is specified from Z1 to Z2:</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
</ol>
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
<ul>
|
||||
<li>There may be no rules created that govern connections from
|
||||
Z1 to Z2.</li>
|
||||
<li>Shorewall will not create any infrastructure to handle traffic
|
||||
from Z1 to Z2.</li>
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file specifies
|
||||
a particular host or network, Shorewall now creates an intermediate chain
|
||||
for handling input from the related zone. This can substantially reduce the
|
||||
number of rules traversed by connections requests from such zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the contents
|
||||
of the named file to be logically included into the file containing the INCLUDE.
|
||||
File names given in an INCLUDE directive are assumed to reside in /etc/shorewall
|
||||
or in an alternate configuration directory if one has been specified for
|
||||
the command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||
are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that interface
|
||||
continues to be a problem. While I firmly believe that this should never
|
||||
happen, people continue to want to do it. To limit the damage that such
|
||||
nonsense produces, I have added a new 'routeback' option in /etc/shorewall/interfaces
|
||||
and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the 'ZONE'
|
||||
column may not contain '-'; in other words, 'routeback' can't be used as
|
||||
an option for a multi-zone interface. The 'routeback' option CAN be specified
|
||||
however on individual group entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option with two
|
||||
exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
||||
tuples associated with the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>' for information
|
||||
about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion
|
||||
of how these changes may affect your configuration.<br>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</td>
|
||||
<td
|
||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></p>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 3/21/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
<p><font size="2">Updated 4/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,22 +2,16 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall QuickStart Guide</title>
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -25,25 +19,22 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
||||
(HOWTO's)<br>
|
||||
Version 4.0</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
Version 4.0</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that
|
||||
we must all first walk before we can run.<br>
|
||||
The French Translations are courtesy of Patrice Vetsel<br>
|
||||
</p>
|
||||
<p align="center">With thanks to Richard who reminded me once again that we
|
||||
must all first walk before we can run.<br>
|
||||
The French Translations are courtesy of Patrice Vetsel<br>
|
||||
</p>
|
||||
|
||||
<h2>The Guides</h2>
|
||||
|
||||
@ -53,12 +44,12 @@ we must all first walk before we can run.<br>
|
||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="standalone.htm">Standalone</a> Linux
|
||||
<li><a href="standalone.htm">Standalone</a> Linux
|
||||
System (<a href="standalone_fr.html">Version Française</a>)</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a>
|
||||
<li><a href="two-interface.htm">Two-interface</a>
|
||||
Linux System acting as a firewall/router for a small local network
|
||||
(<a href="two-interface_fr.html">Version Française</a>)</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a>
|
||||
<li><a href="three-interface.htm">Three-interface</a>
|
||||
Linux System acting as a firewall/router for a small local network
|
||||
and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
||||
|
||||
@ -73,80 +64,68 @@ we must all first walk before we can run.<br>
|
||||
Shorewall than is explained in the single-address guides above.</b></p>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall Concepts</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Interfaces">3.0 Network Interfaces</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Addressing">4.0 Addressing, Subnets
|
||||
and Routing</a>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4
|
||||
Address Resolution Protocol</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#RFC1918">4.5 RFC 1918</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0
|
||||
Setting up your Network</a>
|
||||
</li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Options">5.0 Setting up your Network</a>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#ProxyARP">5.2.3 Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4
|
||||
Static NAT</a></li>
|
||||
|
||||
|
||||
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#NAT">5.2.4 Static NAT</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3
|
||||
Rules</a></li>
|
||||
<li><a
|
||||
</li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds and Ends</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0
|
||||
DNS</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||
Stopping the Firewall</a></li>
|
||||
|
||||
@ -160,150 +139,138 @@ DNS</a></li>
|
||||
trying to use this documentation directly.</p>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
||||
(e.g., eth0:0)</a><br>
|
||||
</li>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
|
||||
</li>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
<ul>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common
|
||||
configuration file features</a>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Comments">Comments in configuration
|
||||
files</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||
or Subnet</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations (making
|
||||
a test configuration)</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
||||
(making a test configuration)</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File
|
||||
Reference Manual</a>
|
||||
|
||||
<ul>
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Zones">zones</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Policy">policy</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Rules">rules</a></font></li>
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Masq">masq</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#NAT">nat</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font> (How
|
||||
to extend Shorewall without modifying Shorewall code through the use of
|
||||
files in /etc/shorewall -- /etc/shorewall/start, /etc/shorewall/stopped,
|
||||
etc.)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><a href="ECN.html">ECN Disabling by host or
|
||||
subnet</a><br>
|
||||
</li>
|
||||
<li><font color="#000099"><a href="shorewall_extension_scripts.htm">Extension
|
||||
Scripts</a></font> (How to extend Shorewall without modifying Shorewall
|
||||
code through the use of files in /etc/shorewall -- /etc/shorewall/start,
|
||||
/etc/shorewall/stopped, etc.)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall
|
||||
Structure</a></li>
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel
|
||||
Configuration</a></font></li>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Shorewall Configuration
|
||||
(How I personally use Shorewall)</a><br>
|
||||
</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Shorewall Configuration
|
||||
(How I personally use Shorewall)</a><br>
|
||||
</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
<ul>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||
|
||||
<ul>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a href="NAT.htm">Static
|
||||
<li><font color="#000099"><a href="NAT.htm">Static
|
||||
NAT</a></font></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
||||
Proxy with Shorewall</a><br>
|
||||
</li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/QOS</a></li>
|
||||
<li>VPN
|
||||
|
||||
</li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/QOS</a></li>
|
||||
<li>VPN
|
||||
<ul>
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||
</li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||
</li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system
|
||||
behind your firewall to a remote network.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White
|
||||
List Creation</a></li>
|
||||
|
||||
</ul>
|
||||
@ -311,11 +278,12 @@ Proxy with Shorewall</a><br>
|
||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||
|
||||
<p><font size="2">Last modified 3/12/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
<p><font size="2">Last modified 4/112003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||
Eastep</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,321 +1,281 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
<base target="_self">
|
||||
<base
|
||||
target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" height="90">
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font
|
||||
</a></i></font><font
|
||||
color="#ffffff">Shorewall 1.4 - <font
|
||||
size="4">"<i>iptables made easy"</i></font></font><a
|
||||
href="http://www.sf.net"> </a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="/1.3/index.html" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.3 Site here</font></a></div>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font color="#ffffff">
|
||||
<small><small><small>Shorewall 1.3 Site here</small></small></small></font></a><br>
|
||||
<a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small>Shorewall
|
||||
1.2 Site here<br>
|
||||
</small></small></small></font></a>
|
||||
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="90%">
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall
|
||||
system, a multi-function gateway/router/server or on a standalone
|
||||
GNU/Linux system.</p>
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
|
||||
<br>
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||
(iptables) based firewall that can be used on a dedicated
|
||||
firewall system, a multi-function gateway/router/server
|
||||
or on a standalone GNU/Linux system.</p>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR
|
||||
A PARTICULAR PURPOSE. See the GNU General Public
|
||||
License for more details.<br>
|
||||
|
||||
<br>
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under
|
||||
the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
This program
|
||||
is distributed in the hope that it will
|
||||
be useful, but WITHOUT ANY WARRANTY; without
|
||||
even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
<br>
|
||||
You should
|
||||
have received a copy of the GNU General
|
||||
Public License along with this program;
|
||||
if not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
||||
USA</p>
|
||||
|
||||
|
||||
You should have received
|
||||
a copy of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
||||
find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
<h2>News</h2>
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
</b>
|
||||
|
||||
<p><b>3/24/2003 - Shorewall 1.4.1 </b><b> </b><b><img
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
</b></p>
|
||||
|
||||
<p>This release follows up on 1.4.0. It corrects a problem introduced
|
||||
in 1.4.0 and removes additional warts.<br>
|
||||
<br>
|
||||
<b>Problems Corrected:</b><br>
|
||||
</p>
|
||||
<ol>
|
||||
<li>When Shorewall 1.4.0 is run under the ash shell (such as on Bering/LEAF),
|
||||
it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn file
|
||||
is empty. That problem has been corrected so that ECN disabling rules are
|
||||
only added if there are entries in /etc/shorewall/ecn.</li>
|
||||
</ol>
|
||||
<b>New Features:</b><br>
|
||||
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and is best
|
||||
viewed using Internet Explorer although Konqueror also seems to work reasonably
|
||||
well. Neither Opera or Netscape work well to view the presentation.</blockquote>
|
||||
|
||||
<blockquote>Note: In the list that follows, the term <i>group </i>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
|
||||
a host address) accessed through a particular interface. Examples:<br>
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</p>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
</blockquote>
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
<ol>
|
||||
<li>Beginning with Shorewall 1.4.1, if a zone Z comprises more than
|
||||
one group<i> </i>then if there is no explicit Z to Z policy and there are
|
||||
no rules governing traffic from Z to Z then Shorewall will permit all traffic
|
||||
between the groups in the zone.</li>
|
||||
<li>Beginning with Shorewall 1.4.1, Shorewall will never create rules
|
||||
to handle traffic from a group to itself.</li>
|
||||
<li>A NONE policy is introduced in 1.4.1. When a policy of NONE is
|
||||
specified from Z1 to Z2:</li>
|
||||
</ol>
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b>
|
||||
chain are now properly rejected with TCP RST; previously, some of these requests
|
||||
were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously timed
|
||||
out on the first hop (e.g., to the firewall). This has been worked around.</li>
|
||||
|
||||
<ul>
|
||||
<li>There may be no rules created that govern connections from Z1
|
||||
to Z2.</li>
|
||||
<li>Shorewall will not create any infrastructure to handle traffic
|
||||
from Z1 to Z2.</li>
|
||||
</ul>
|
||||
See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion
|
||||
of how these changes may affect your configuration.
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file specifies
|
||||
a particular host or network, Shorewall now creates an intermediate chain
|
||||
for handling input from the related zone. This can substantially reduce
|
||||
the number of rules traversed by connections requests from such zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the contents
|
||||
of the named file to be logically included into the file containing the
|
||||
INCLUDE. File names given in an INCLUDE directive are assumed to reside
|
||||
in /etc/shorewall or in an alternate configuration directory if one has
|
||||
been specified for the command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||
are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that interface
|
||||
continues to be a problem. While I firmly believe that this should never
|
||||
happen, people continue to want to do it. To limit the damage that such
|
||||
nonsense produces, I have added a new 'routeback' option in /etc/shorewall/interfaces
|
||||
and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the 'ZONE'
|
||||
column may not contain '-'; in other words, 'routeback' can't be used as
|
||||
an option for a multi-zone interface. The 'routeback' option CAN be specified
|
||||
however on individual group entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option with two
|
||||
exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
||||
tuples associated with the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>' for information
|
||||
about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
||||
alt="SourceForge Logo"
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
</a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h4> </h4>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<td
|
||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" style="margin-top: 1px;">
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 3/21/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
<p><font size="2">Updated 4/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -17,12 +17,12 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -37,9 +37,9 @@
|
||||
in one of its most common configurations:</p>
|
||||
|
||||
<ul>
|
||||
<li>Linux system</li>
|
||||
<li>Single external IP address</li>
|
||||
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
||||
<li>Linux system</li>
|
||||
<li>Single external IP address</li>
|
||||
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -55,19 +55,19 @@
|
||||
with what's involved then go back through it again making your configuration
|
||||
changes. Points at which configuration changes are recommended are flagged
|
||||
with <img border="0" src="images/BD21298_.gif" width="13" height="13">
|
||||
.</p>
|
||||
.</p>
|
||||
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||
If you edit your configuration files on a Windows system, you
|
||||
If you edit your configuration files on a Windows system, you
|
||||
must save them as Unix files if your editor supports that option or you
|
||||
must run them through dos2unix before trying to use them. Similarly, if
|
||||
you copy a configuration file from your Windows hard drive to a floppy
|
||||
disk, you must run dos2unix against the copy before using it with Shorewall.</p>
|
||||
you copy a configuration file from your Windows hard drive to a floppy disk,
|
||||
you must run dos2unix against the copy before using it with Shorewall.</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
Version of dos2unix</a></li>
|
||||
|
||||
</ul>
|
||||
@ -76,34 +76,34 @@ disk, you must run dos2unix against the copy before using it with Shorewall.</p
|
||||
|
||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||
alt="">
|
||||
The configuration files for Shorewall are contained in the directory
|
||||
/etc/shorewall -- for simple setups, you only need to deal with a few
|
||||
of these as described in this guide. After you have <a
|
||||
The configuration files for Shorewall are contained in the directory
|
||||
/etc/shorewall -- for simple setups, you only need to deal with a few of
|
||||
these as described in this guide. After you have <a
|
||||
href="Install.htm">installed Shorewall</a>, <b>download the <a
|
||||
href="/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface sample</a>,
|
||||
un-tar it (tar -zxvf one-interface.tgz) and and copy the files to /etc/shorewall
|
||||
(they will replace files with the same names that were placed in /etc/shorewall
|
||||
during Shorewall installation)</b>.</p>
|
||||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tar it (tar -zxvf one-interface.tgz) and and copy the files
|
||||
to /etc/shorewall (they will replace files with the same names that were
|
||||
placed in /etc/shorewall during Shorewall installation)</b>.</p>
|
||||
|
||||
<p>As each file is introduced, I suggest that you look through the actual
|
||||
file on your system -- each file contains detailed configuration instructions
|
||||
and default entries.</p>
|
||||
|
||||
<p>Shorewall views the network where it is running as being composed of a
|
||||
set of <i>zones.</i> In the one-interface sample configuration, only
|
||||
one zone is defined:</p>
|
||||
set of <i>zones.</i> In the one-interface sample configuration, only one
|
||||
zone is defined:</p>
|
||||
|
||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||
cellspacing="0" id="AutoNumber2">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -117,10 +117,10 @@ one zone is defined:</p>
|
||||
in terms of zones.</p>
|
||||
|
||||
<ul>
|
||||
<li>You express your default policy for connections from one zone
|
||||
<li>You express your default policy for connections from one zone
|
||||
to another zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||
</a>file.</li>
|
||||
<li>You define exceptions to those default policies in the <a
|
||||
<li>You define exceptions to those default policies in the <a
|
||||
href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
|
||||
|
||||
</ul>
|
||||
@ -132,54 +132,54 @@ one zone is defined:</p>
|
||||
the request is first checked against the rules in /etc/shorewall/common
|
||||
(the samples provide that file for you).</p>
|
||||
|
||||
<p>The /etc/shorewall/policy file included with the one-interface sample
|
||||
has the following policies:</p>
|
||||
<p>The /etc/shorewall/policy file included with the one-interface sample has
|
||||
the following policies:</p>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber3">
|
||||
<tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p>The above policy will:</p>
|
||||
|
||||
<ol>
|
||||
<li>allow all connection requests from the firewall to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to your
|
||||
firewall</li>
|
||||
<li>reject all other connection requests (Shorewall requires this
|
||||
<li>allow all connection requests from the firewall to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to
|
||||
your firewall</li>
|
||||
<li>reject all other connection requests (Shorewall requires this
|
||||
catchall policy).</li>
|
||||
|
||||
</ol>
|
||||
@ -191,38 +191,38 @@ has the following policies:</p>
|
||||
|
||||
<p align="left">The firewall has a single network interface. Where Internet
|
||||
connectivity is through a cable or DSL "Modem", the <i>External Interface</i>
|
||||
will be the ethernet adapter (<b>eth0</b>) that is connected to that
|
||||
"Modem" <u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint
|
||||
<u>P</u>rotocol over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint
|
||||
<u>T</u>unneling <u>P</u>rotocol </i>(PPTP) in which case the External
|
||||
Interface will be a <b>ppp0</b>. If you connect via a regular modem, your
|
||||
External Interface will also be <b>ppp0</b>. If you connect using ISDN,
|
||||
your external interface will be<b> ippp0.</b></p>
|
||||
will be the ethernet adapter (<b>eth0</b>) that is connected to that "Modem"
|
||||
<u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol
|
||||
over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling
|
||||
<u>P</u>rotocol </i>(PPTP) in which case the External Interface will be
|
||||
a <b>ppp0</b>. If you connect via a regular modem, your External Interface
|
||||
will also be <b>ppp0</b>. If you connect using ISDN, your external interface
|
||||
will be<b> ippp0.</b></p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13">
|
||||
The Shorewall one-interface sample configuration assumes that
|
||||
the external interface is <b>eth0</b>. If your configuration is different,
|
||||
The Shorewall one-interface sample configuration assumes that the
|
||||
external interface is <b>eth0</b>. If your configuration is different,
|
||||
you will have to modify the sample /etc/shorewall/interfaces file accordingly.
|
||||
While you are there, you may wish to review the list of options that
|
||||
are specified for the interface. Some hints:</p>
|
||||
While you are there, you may wish to review the list of options that are
|
||||
specified for the interface. Some hints:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>,
|
||||
you can replace the "detect" in the second column with "-". </p>
|
||||
</li>
|
||||
<li>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>
|
||||
or if you have a static IP address, you can remove "dhcp" from the
|
||||
option list. </p>
|
||||
</li>
|
||||
or if you have a static IP address, you can remove "dhcp" from the option
|
||||
list. </p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">IP Addresses</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">RFC 1918 reserves several <i>Private </i>IP address ranges
|
||||
@ -230,7 +230,7 @@ option list. </p>
|
||||
|
||||
<div align="left">
|
||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">These addresses are sometimes referred to as <i>non-routable</i>
|
||||
because the Internet backbone routers will not forward a packet whose
|
||||
@ -240,157 +240,158 @@ option list. </p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||
width="13" height="13">
|
||||
Before starting Shorewall, you should look at the IP address
|
||||
Before starting Shorewall, you should look at the IP address
|
||||
of your external interface and if it is one of the above ranges, you
|
||||
should remove the 'norfc1918' option from the entry in /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Enabling other Connections</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">If you wish to enable connections from the internet to your
|
||||
firewall, the general format is:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Example - You want to run a Web Server and a POP3 Server
|
||||
on your firewall system:</p>
|
||||
</div>
|
||||
<p align="left">Example - You want to run a Web Server and a POP3 Server on
|
||||
your firewall system:</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber5">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">If you don't know what port and protocol a particular
|
||||
application uses, see <a href="ports.htm">here</a>.</p>
|
||||
</div>
|
||||
<p align="left">If you don't know what port and protocol a particular application
|
||||
uses, see <a href="ports.htm">here</a>.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>Important: </b>I don't recommend enabling telnet to/from
|
||||
the internet because it uses clear text (even for login!). If you want
|
||||
shell access to your firewall from the internet, use SSH:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13">
|
||||
At this point, edit /etc/shorewall/rules to add other connections
|
||||
At this point, edit /etc/shorewall/rules to add other connections
|
||||
as desired.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Starting and Stopping Your Firewall</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"> <img border="0" src="images/BD21298_2.gif"
|
||||
width="13" height="13" alt="Arrow">
|
||||
The <a href="Install.htm">installation procedure </a> configures
|
||||
The <a href="Install.htm">installation procedure </a> configures
|
||||
your system to start Shorewall at system boot but beginning with Shorewall
|
||||
version 1.3.9 startup is disabled so that your system won't try to start
|
||||
Shorewall before configuration is complete. Once you have completed configuration
|
||||
of your firewall, you can enable Shorewall startup by removing the file /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
of your firewall, you can enable Shorewall startup by removing the file
|
||||
/etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Users of the .deb
|
||||
package must edit /etc/default/shorewall and set 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">The firewall is started using the "shorewall start" command
|
||||
@ -400,25 +401,26 @@ application uses, see <a href="ports.htm">here</a>.</p>
|
||||
running firewall may be restarted using the "shorewall restart" command.
|
||||
If you want to totally remove any trace of Shorewall from your Netfilter
|
||||
configuration, use "shorewall clear".</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>WARNING: </b>If you are connected to your firewall from
|
||||
the internet, do not issue a "shorewall stop" command unless you have
|
||||
added an entry for the IP address that you are connected from to <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
Also, I don't recommend using "shorewall restart"; it is better to create
|
||||
Also, I don't recommend using "shorewall restart"; it is better to create
|
||||
an <i><a href="configuration_file_basics.htm#Configs">alternate configuration</a></i>
|
||||
and test it using the <a
|
||||
href="starting_and_stopping_shorewall.htm">"shorewall try" command</a>.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left"><font size="2">Last updated 2/21/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002, 2003
|
||||
Thomas M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -1,407 +1,469 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Standalone Firewall</title>
|
||||
</head>
|
||||
<body>
|
||||
<body>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h2 align="center">Version 2.0.1 Française</h2>
|
||||
|
||||
<p align="left"><small><i><u>Notes du traducteur</u> :<br>
|
||||
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail
|
||||
n'est pas des plus précis (loin de là...). Je ne me suis pas attaché à
|
||||
une traduction exacte du texte, mais plutôt à en faire une version
|
||||
française intelligible par tous (et par moi). Les termes techniques sont
|
||||
la plupart du temps conservés sous leur forme originale et mis entre
|
||||
parenthèses car vous pouvez les retrouver dans le reste des
|
||||
documentations ainsi que dans les fichiers de configuration. N?hésitez
|
||||
pas à me contacter afin d?améliorer ce document <a
|
||||
href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM
|
||||
pour sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP
|
||||
pour son formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
||||
<p align="left">Mettre en place un système Linux en tant que firewall
|
||||
(écluse) pour un petit réseau est une chose assez simple, si vous
|
||||
comprenez les bases et suivez la documentation.</p>
|
||||
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall.
|
||||
Il se focalise sur ce qui est nécessaire pour configurer Shorewall, dans
|
||||
son utilisation la plus courante :</p>
|
||||
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail n'est
|
||||
pas des plus précis (loin de là...). Je ne me suis pas attaché à une traduction
|
||||
exacte du texte, mais plutôt à en faire une version française intelligible
|
||||
par tous (et par moi). Les termes techniques sont la plupart du temps conservés
|
||||
sous leur forme originale et mis entre parenthèses car vous pouvez les retrouver
|
||||
dans le reste des documentations ainsi que dans les fichiers de configuration.
|
||||
N?hésitez pas à me contacter afin d?améliorer ce document <a
|
||||
href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM pour
|
||||
sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP pour son
|
||||
formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
||||
|
||||
<p align="left">Mettre en place un système Linux en tant que firewall (écluse)
|
||||
pour un petit réseau est une chose assez simple, si vous comprenez les bases
|
||||
et suivez la documentation.</p>
|
||||
|
||||
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il
|
||||
se focalise sur ce qui est nécessaire pour configurer Shorewall, dans son
|
||||
utilisation la plus courante :</p>
|
||||
|
||||
<ul>
|
||||
<li>Un système Linux</li>
|
||||
<li>Une seule adresse IP externe</li>
|
||||
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame
|
||||
Relay, rtc...</li>
|
||||
<li>Un système Linux</li>
|
||||
<li>Une seule adresse IP externe</li>
|
||||
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay,
|
||||
rtc...</li>
|
||||
|
||||
</ul>
|
||||
<p>Ce guide suppose que vous avez le paquet iproute/iproute2
|
||||
d'installé. Vous pouvez voir si le paquet est installé en vérifiant la
|
||||
présence du programme ip sur votre système de firewall. Sous root,
|
||||
utilisez la commande 'which' pour rechercher le programme :</p>
|
||||
|
||||
<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé.
|
||||
Vous pouvez voir si le paquet est installé en vérifiant la présence du programme
|
||||
ip sur votre système de firewall. Sous root, utilisez la commande 'which'
|
||||
pour rechercher le programme :</p>
|
||||
|
||||
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
||||
<p>Je vous recommande dans un premier temps de parcourir tout le guide
|
||||
pour vous familiariser avec ce qu'il va se passer, et de revenir au
|
||||
début en effectuant le changements dans votre configuration. Les points,
|
||||
où les changements dans la configuration sont recommandées, sont
|
||||
signalés par une <img border="0" src="images/BD21298_.gif" width="13"
|
||||
height="13"> .</p>
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60"> Si
|
||||
vous éditez vos fichiers de configuration sur un système Windows, vous
|
||||
devez les sauver comme des fichiers Unix si votre éditeur supporte cette
|
||||
option sinon vous devez les faire passer par dos2unix avant d'essayer de
|
||||
les utiliser. De la même manière, si vous copiez un fichier de
|
||||
configuration depuis votre disque dur Windows vers une disquette, vous
|
||||
devez lancer dos2unix sur la copie avant de l'utiliser avec Shorewall.</p>
|
||||
|
||||
<p>Je vous recommande dans un premier temps de parcourir tout le guide pour
|
||||
vous familiariser avec ce qu'il va se passer, et de revenir au début en effectuant
|
||||
le changements dans votre configuration. Les points, où les changements dans
|
||||
la configuration sont recommandées, sont signalés par une <img
|
||||
border="0" src="images/BD21298_.gif" width="13" height="13">
|
||||
.</p>
|
||||
|
||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||
Si vous éditez vos fichiers de configuration sur un système Windows, vous
|
||||
devez les sauver comme des fichiers Unix si votre éditeur supporte cette option
|
||||
sinon vous devez les faire passer par dos2unix avant d'essayer de les utiliser.
|
||||
De la même manière, si vous copiez un fichier de configuration depuis votre
|
||||
disque dur Windows vers une disquette, vous devez lancer dos2unix sur la
|
||||
copie avant de l'utiliser avec Shorewall.</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
Version of dos2unix</a></li>
|
||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||
of dos2unix</a></li>
|
||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version
|
||||
of dos2unix</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2 align="left">Les Concepts de Shorewall</h2>
|
||||
|
||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||
alt=""> Les fichiers de configuration pour Shorewall sont situés dans
|
||||
le répertoire /etc/shorewall -- pour de simples paramétrages, vous
|
||||
n'avez à faire qu'avec quelques un d'entre eux comme décris dans ce
|
||||
guide. Après avoir <a href="Install.htm">installé Shorewall</a>, <b>téléchargez
|
||||
le <a href="/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tarez le (tar -zxvf one-interface.tgz) et copiez les
|
||||
fichiers vers /etc/shorewall (Ils remplaceront les fichiers de même nom
|
||||
déjà existant dans /etc/shorewall installés lors de l'installation de
|
||||
Shorewall)</b>.</p>
|
||||
<p>Parallèlement à la description, je vous suggère de jeter un oeil à
|
||||
ceux physiquement présents sur votre système -- chacun des fichiers
|
||||
contient des instructions de configuration détaillées et des entrées par
|
||||
défaut.</p>
|
||||
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble
|
||||
de <i>zones.</i> Dans les fichiers de configuration fournis pour une
|
||||
unique interface, une seule zone est définie :</p>
|
||||
alt="">
|
||||
Les fichiers de configuration pour Shorewall sont situés dans le répertoire
|
||||
/etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec
|
||||
quelques un d'entre eux comme décris dans ce guide. Après avoir <a
|
||||
href="Install.htm">installé Shorewall</a>, <b>téléchargez le <a
|
||||
href="http://france.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
||||
sample</a>, un-tarez le (tar -zxvf one-interface.tgz) et copiez les fichiers
|
||||
vers /etc/shorewall (Ils remplaceront les fichiers de même nom déjà existant
|
||||
dans /etc/shorewall installés lors de l'installation de Shorewall)</b>.</p>
|
||||
|
||||
<p>Parallèlement à la description, je vous suggère de jeter un oeil à ceux
|
||||
physiquement présents sur votre système -- chacun des fichiers contient des
|
||||
instructions de configuration détaillées et des entrées par défaut.</p>
|
||||
|
||||
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble de
|
||||
<i>zones.</i> Dans les fichiers de configuration fournis pour une unique
|
||||
interface, une seule zone est définie :</p>
|
||||
|
||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||
cellspacing="0" id="AutoNumber2">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>Name</b></u></td>
|
||||
<td><u><b>Description</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>net</b></td>
|
||||
<td><b>The Internet</b></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p>Les zones de Shorewall sont définies dans <a
|
||||
href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
||||
<p>Shorewall reconnaît aussi le système de firewall comme sa propre
|
||||
zone - par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
||||
<p>Les règles concernant le trafic à autoriser ou à interdire sont
|
||||
exprimées en utilisant les termes de zones.</p>
|
||||
|
||||
<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone
|
||||
- par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
||||
|
||||
<p>Les règles concernant le trafic à autoriser ou à interdire sont exprimées
|
||||
en utilisant les termes de zones.</p>
|
||||
|
||||
<ul>
|
||||
<li>Vous exprimez les politiques par défaut pour les connexions d'une
|
||||
zone à une autre dans le fichier<a href="Documentation.htm#Policy">
|
||||
/etc/shorewall/policy </a>.</li>
|
||||
<li>Vous définissez les exceptions à ces règles de politiques par
|
||||
défaut dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
<li>Vous exprimez les politiques par défaut pour les connexions d'une zone
|
||||
à une autre dans le fichier<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||
</a>.</li>
|
||||
<li>Vous définissez les exceptions à ces règles de politiques par défaut
|
||||
dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ul>
|
||||
<p>Pour chacune des demandes de connexion entrantes dans le firewall,
|
||||
les demandes sont en premier lieu comparées par rapport au fichier
|
||||
/etc/shorewall/rules. Si aucune des règles dans ce fichier ne
|
||||
correspondent, alors la première politique dans /etc/shorewall/policy
|
||||
qui y correspond est appliquée. Si cette politique est REJECT ou DROP la
|
||||
requête est alors comparée par rapport aux règles contenues dans
|
||||
/etc/shorewall/common (l'archive d'exemple vous fournit ce fichier).</p>
|
||||
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive
|
||||
one-interface a les politiques suivantes :</p>
|
||||
|
||||
<p>Pour chacune des demandes de connexion entrantes dans le firewall, les
|
||||
demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules.
|
||||
Si aucune des règles dans ce fichier ne correspondent, alors la première
|
||||
politique dans /etc/shorewall/policy qui y correspond est appliquée. Si cette
|
||||
politique est REJECT ou DROP la requête est alors comparée par rapport aux
|
||||
règles contenues dans /etc/shorewall/common (l'archive d'exemple vous fournit
|
||||
ce fichier).</p>
|
||||
|
||||
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive one-interface
|
||||
a les politiques suivantes :</p>
|
||||
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber3">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>SOURCE ZONE</b></u></td>
|
||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||
<td><u><b>POLICY</b></u></td>
|
||||
<td><u><b>LOG LEVEL</b></u></td>
|
||||
<td><u><b>LIMIT:BURST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>fw</td>
|
||||
<td>net</td>
|
||||
<td>ACCEPT</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>net</td>
|
||||
<td>all<br>
|
||||
</td>
|
||||
<td>DROP</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>all</td>
|
||||
<td>all</td>
|
||||
<td>REJECT</td>
|
||||
<td>info</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<pre> </pre>
|
||||
Ces politiques vont :
|
||||
Ces politiques vont :
|
||||
<ol>
|
||||
<li>permettre toutes demandes de connexion depuis le firewall vers
|
||||
l'Internet</li>
|
||||
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet
|
||||
vers votre firewall</li>
|
||||
<li>rejeter toutes les autres requêtes de connexion (Shorewall à
|
||||
besoin de cette politique).</li>
|
||||
<li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
|
||||
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet vers
|
||||
votre firewall</li>
|
||||
<li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin
|
||||
de cette politique).</li>
|
||||
|
||||
</ol>
|
||||
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les
|
||||
changements que vous désirez.</p>
|
||||
|
||||
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les changements
|
||||
que vous désirez.</p>
|
||||
|
||||
<h2 align="left">Interface Externe</h2>
|
||||
<p align="left">Le firewall possède une seule interface réseau. Lorsque
|
||||
la connexion Internet passe par un modem câble ou par un routeur ADSL
|
||||
(pas un simple modem), l'<i>External Interface</i> (interface externe)
|
||||
sera l'adaptateur ethernet (<b>eth0</b>) qui y est connecté <u>à moins
|
||||
que</u> vous vous connectiez par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol
|
||||
over <u>E</u>thernet</i> (PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
||||
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous
|
||||
connectez par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
||||
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface
|
||||
externe sera<b> ippp0.</b></p>
|
||||
|
||||
<p align="left">Le firewall possède une seule interface réseau. Lorsque la
|
||||
connexion Internet passe par un modem câble ou par un routeur ADSL (pas un
|
||||
simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur
|
||||
ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez
|
||||
par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i>
|
||||
(PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
||||
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous connectez
|
||||
par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
||||
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface externe
|
||||
sera<b> ippp0.</b></p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13"> L'exemple de configuration de Shorewall pour une interface
|
||||
suppose que votre interface externe est <b>eth0</b>. Si votre
|
||||
configuration est différente, vous devrez modifier le fichier d'exemple
|
||||
/etc/shorewall/interfaces en conséquence. Puisque vous y êtes, vous
|
||||
pourriez parcourir la liste d'options qui sont spécifiées pour
|
||||
l'interface. Quelques astuces :</p>
|
||||
height="13">
|
||||
L'exemple de configuration de Shorewall pour une interface suppose que votre
|
||||
interface externe est <b>eth0</b>. Si votre configuration est différente,
|
||||
vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence.
|
||||
Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont
|
||||
spécifiées pour l'interface. Quelques astuces :</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<p align="left">Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>,
|
||||
vous pouvez remplacer le "detect" dans la seconde colonne par un
|
||||
"-". </p>
|
||||
</li>
|
||||
<li>
|
||||
vous pouvez remplacer le "detect" dans la seconde colonne par un "-".
|
||||
</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>
|
||||
ou bien si vous avez une adresse IP statique, vous pouvez enlever le
|
||||
"dhcp" de la liste d'option. </p>
|
||||
</li>
|
||||
ou bien si vous avez une adresse IP statique, vous pouvez enlever le "dhcp"
|
||||
de la liste d'option. </p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Adresse IP</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP
|
||||
privée (<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
|
||||
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée
|
||||
(<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">Ces adresses sont parfois désignées comme étant <i>non-routables</i>
|
||||
car les routeurs sur les backbones Internet ne font pas passer les
|
||||
paquets dont les adresses de destinations sont définies dans la RFC
|
||||
1918. Dans certains cas, les fournisseurs (provider ou ISP) utilisent
|
||||
ces adresses et utilisent le <i>Network Address Translation </i>afin
|
||||
de récrire les entêtes des paquets lorsqu'ils les font circuler depuis
|
||||
ou vers l'Internet.</p>
|
||||
car les routeurs sur les backbones Internet ne font pas passer les paquets
|
||||
dont les adresses de destinations sont définies dans la RFC 1918. Dans certains
|
||||
cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent
|
||||
le <i>Network Address Translation </i>afin de récrire les entêtes des paquets
|
||||
lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
|
||||
|
||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||
width="13" height="13"> Avant de lancer Shorewall, vous devriez
|
||||
regarder l'adresse de votre interface externe et si elle est comprise
|
||||
dans une des plages précédentes, vous devriez enlever l'option
|
||||
'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
width="13" height="13">
|
||||
Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface
|
||||
externe et si elle est comprise dans une des plages précédentes, vous devriez
|
||||
enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Permettre d'autres connexions</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Si vous désirez autoriser d'autres connexions depuis
|
||||
l'Internet vers votre firewall, le format général est :</p>
|
||||
</div>
|
||||
<p align="left">Si vous désirez autoriser d'autres connexions depuis l'Internet
|
||||
vers votre firewall, le format général est :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td><i><protocol></i></td>
|
||||
<td><i><port></i></td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et
|
||||
un serveur POP3 sur votre système de firewall :</p>
|
||||
</div>
|
||||
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un
|
||||
serveur POP3 sur votre système de firewall :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber5">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>80</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>110</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Si vous ne savez pas quel port ou protocole une
|
||||
application particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
||||
</div>
|
||||
<p align="left">Si vous ne savez pas quel port ou protocole une application
|
||||
particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>Important: </b>Je ne vous recommande pas
|
||||
d'autoriser le telnet depuis ou vers l'Internet car il utilise du texte
|
||||
en clair (même pour le login et le mot de passe !). Si vous voulez avoir
|
||||
un accès au shell de votre firewall depuis Internet, utilisez SSH :</p>
|
||||
</div>
|
||||
<p align="left"><b>Important: </b>Je ne vous recommande pas d'autoriser le
|
||||
telnet depuis ou vers l'Internet car il utilise du texte en clair (même pour
|
||||
le login et le mot de passe !). Si vous voulez avoir un accès au shell de
|
||||
votre firewall depuis Internet, utilisez SSH :</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||
id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><u><b>ACTION</b></u></td>
|
||||
<td><u><b>SOURCE</b></u></td>
|
||||
<td><u><b>DESTINATION</b></u></td>
|
||||
<td><u><b>PROTOCOL</b></u></td>
|
||||
<td><u><b>PORT</b></u></td>
|
||||
<td><u><b>SOURCE PORT</b></u></td>
|
||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ACCEPT</td>
|
||||
<td>net</td>
|
||||
<td>fw</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
<td> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</blockquote>
|
||||
</div>
|
||||
</blockquote>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT net fw tcp 22</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||
height="13"> A ce point, éditez /etc/shorewall/rules pour rajouter
|
||||
les autres connexions désirées.</p>
|
||||
</div>
|
||||
height="13">
|
||||
A ce point, éditez /etc/shorewall/rules pour rajouter les autres connexions
|
||||
désirées.</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<h2 align="left">Lancer et Arrêter son Firewall</h2>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"> <img border="0" src="images/BD21298_2.gif" width="13"
|
||||
height="13" alt="Arrow"> La <a href="Install.htm">procédure
|
||||
d'installation </a> configure votre système pour lancer Shorewall au
|
||||
boot du système, mais au début avec la version 1.3.9 de Shorewall le
|
||||
lancement est désactivé, n'essayer pas de lancer Shorewall avec que la
|
||||
configuration soit finie. Une fois que vous en aurez fini avec la
|
||||
configuration du firewall, vous pouvez permettre le lancement de
|
||||
Shorewall en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les
|
||||
utilisateurs des paquets .deb doivent éditer /etc/default/shorewall et
|
||||
mettre 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
height="13" alt="Arrow">
|
||||
La <a href="Install.htm">procédure d'installation </a> configure votre système
|
||||
pour lancer Shorewall au boot du système, mais au début avec la version 1.3.9
|
||||
de Shorewall le lancement est désactivé, n'essayer pas de lancer Shorewall
|
||||
avec que la configuration soit finie. Une fois que vous en aurez fini avec
|
||||
la configuration du firewall, vous pouvez permettre le lancement de Shorewall
|
||||
en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs
|
||||
des paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Le firewall est activé en utilisant la commande
|
||||
"shorewall start" et arrêté avec "shorewall stop". Lorsque le firewall
|
||||
est stoppé, le routage est autorisé sur les hôtes qui possèdent une
|
||||
entrée dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
Un firewall qui tourne peut être relancé en utilisant la commande
|
||||
"shorewall restart". Si vous voulez enlever toutes traces de Shorewall
|
||||
sur votre configuration de Netfilter, utilisez "shorewall clear".</p>
|
||||
</div>
|
||||
<p align="left">Le firewall est activé en utilisant la commande "shorewall
|
||||
start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé, le
|
||||
routage est autorisé sur les hôtes qui possèdent une entrée dans <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. Un
|
||||
firewall qui tourne peut être relancé en utilisant la commande "shorewall
|
||||
restart". Si vous voulez enlever toutes traces de Shorewall sur votre configuration
|
||||
de Netfilter, utilisez "shorewall clear".</p>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre
|
||||
firewall depuis Internet, n'essayez pas une commande "shorewall stop"
|
||||
tant que vous n'avez pas ajouté une entrée pour votre adresse IP (celle
|
||||
à partir de laquelle vous êtes connectée) dans <a
|
||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
De la même manière, je ne vous recommande pas d'utiliser "shorewall
|
||||
restart"; il est plus intéressant de créer une <i><a
|
||||
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall
|
||||
depuis Internet, n'essayez pas une commande "shorewall stop" tant que vous
|
||||
n'avez pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle
|
||||
vous êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||
De la même manière, je ne vous recommande pas d'utiliser "shorewall restart";
|
||||
il est plus intéressant de créer une <i><a
|
||||
href="configuration_file_basics.htm#Configs">configuration alternative</a></i>
|
||||
et de la tester en utilisant la commande <a
|
||||
href="starting_and_stopping_shorewall.htm">"shorewall try"</a>.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/9/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002
|
||||
Thomas M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002 Thomas
|
||||
M. Eastep</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,73 +2,57 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall Support Guide</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h2>Before Reporting a Problem or Asking a Question<br>
|
||||
</h2>
|
||||
There are a number
|
||||
of sources of Shorewall information. Please try these before you post.
|
||||
|
||||
|
||||
</h2>
|
||||
There are a number
|
||||
of sources of Shorewall information. Please try these before you
|
||||
post.
|
||||
<ul>
|
||||
<li>More than half of the questions posted
|
||||
on the support list have answers directly accessible from the
|
||||
<a href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a><br>
|
||||
</li>
|
||||
<li> The <a
|
||||
href="FAQ.htm">FAQ</a> has solutions to more than 20 common problems.
|
||||
</li>
|
||||
|
||||
<li> The <a
|
||||
<li>More than half of the questions
|
||||
posted on the support list have answers directly accessible from
|
||||
the <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a><br>
|
||||
</li>
|
||||
<li> The
|
||||
<a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
||||
problems. </li>
|
||||
<li> The <a
|
||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
||||
a number of tips to help you solve common problems.
|
||||
</li>
|
||||
|
||||
<li> The <a
|
||||
a number of tips to help you solve common problems.
|
||||
</li>
|
||||
<li> The <a
|
||||
href="errata.htm"> Errata</a> has links to download updated
|
||||
components. </li>
|
||||
|
||||
<li> The Site and Mailing
|
||||
List Archives search facility can locate documents and posts
|
||||
about similar problems: </li>
|
||||
components. </li>
|
||||
<li> The Site and
|
||||
Mailing List Archives search facility can locate documents and
|
||||
posts about similar problems: </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2>Site and Mailing List Archive Search</h2>
|
||||
|
||||
<blockquote>
|
||||
@ -80,12 +64,12 @@
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -94,250 +78,229 @@
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font><input type="hidden" name="config" value="htdig"><input
|
||||
</font><input type="hidden" name="config" value="htdig"><input
|
||||
type="hidden" name="restrict" value=""><font size="-1"> Include Mailing
|
||||
List Archives:
|
||||
List Archives:
|
||||
<select size="1" name="exclude">
|
||||
<option value="">Yes</option>
|
||||
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
||||
</select>
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
type="submit" value="Search"><br>
|
||||
</form>
|
||||
</blockquote>
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
<h2>Problem Reporting Guidelines<br>
|
||||
</h2>
|
||||
|
||||
</h2>
|
||||
|
||||
<ul>
|
||||
<li>Please remember we only know what is posted
|
||||
in your message. Do not leave out any information that appears
|
||||
to be correct, or was mentioned in a previous post. There have been
|
||||
countless posts by people who were sure that some part of their
|
||||
configuration was correct when it actually contained a small error.
|
||||
We tend to be skeptics where detail is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking for
|
||||
<strong>free</strong> technical support. Any help we offer
|
||||
is an act of generosity, not an obligation. Try to make it easy
|
||||
for us to help you. Follow good, courteous practices in writing
|
||||
<li>Please remember we only know what is posted
|
||||
in your message. Do not leave out any information that appears
|
||||
to be correct, or was mentioned in a previous post. There have
|
||||
been countless posts by people who were sure that some part of
|
||||
their configuration was correct when it actually contained a small
|
||||
error. We tend to be skeptics where detail is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking
|
||||
for <strong>free</strong> technical support. Any help we
|
||||
offer is an act of generosity, not an obligation. Try to make it
|
||||
easy for us to help you. Follow good, courteous practices in writing
|
||||
and formatting your e-mail. Provide details that we need if you expect
|
||||
good answers. <em>Exact quoting </em> of error messages, log entries,
|
||||
command output, and other output is better than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please
|
||||
don't describe your environment and then ask us to send you
|
||||
custom configuration files. We're here to answer your
|
||||
questions but we can't do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
include this information:</li>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please
|
||||
don't describe your environment and then ask us to send
|
||||
you custom configuration files. We're here to answer
|
||||
your questions but we can't do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
include this information:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall you are
|
||||
running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
<li>the exact version of Shorewall you are
|
||||
running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized, the exact
|
||||
output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized, the exact
|
||||
output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||
problems of any kind then:</b></big></i></u></font><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status >
|
||||
/tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
Guides, please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake
|
||||
using the Mandrake installation of Shorewall, please say so.</b><br>
|
||||
</li>
|
||||
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart Guides,
|
||||
please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
||||
installation of Shorewall, please say so.<br>
|
||||
<br>
|
||||
</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||
problems of any kind then:</b></big></i></u></font><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
</ul>
|
||||
<li>As a general
|
||||
matter, please <strong>do not edit the diagnostic information</strong>
|
||||
in an attempt to conceal your IP address, netmask, nameserver
|
||||
addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive them
|
||||
anyway from information contained in the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
<li>As a
|
||||
general matter, please <strong>do not edit the diagnostic information</strong>
|
||||
in an attempt to conceal your IP address, netmask, nameserver
|
||||
addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive them
|
||||
anyway from information contained in the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
color="#009900">/sbin/shorewall show log</font></b>") when
|
||||
you exercise the function that is giving you problems? If so,
|
||||
include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
you exercise the function that is giving you problems? If so, include
|
||||
the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
(especially the /etc/shorewall/hosts file if you have
|
||||
modified that file) that you think are relevant. If you
|
||||
include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||
as well (rules are meaningless unless one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
color="#009900"><b>shorewall start</b></font>", include a
|
||||
trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't post GIFs
|
||||
of your network layout, etc. to the Mailing
|
||||
List -- your post will be rejected.</b></li>
|
||||
modified that file) that you think are relevant. If
|
||||
you include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||
as well (rules are meaningless unless one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
color="#009900"><b>shorewall start</b></font>", include a trace
|
||||
(See the <a href="troubleshoot.htm">Troubleshooting</a> section for
|
||||
instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't post
|
||||
GIFs of your network layout, etc. to the Mailing
|
||||
List -- your post will be rejected.</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
|
||||
The author gratefully acknowleges that the above list was heavily
|
||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||
found at <a
|
||||
<blockquote> The author gratefully acknowleges that the above list was
|
||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||
<em>Olszewski</em> found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h2>When using the mailing list, please post in plain text</h2>
|
||||
|
||||
<blockquote>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian
|
||||
way to control spam and that the ultimate losers here are not
|
||||
the spammers but the list subscribers whose MTAs are bouncing
|
||||
all shorewall.net mail. As one list subscriber wrote to me privately
|
||||
"These e-mail admin's need to get a <i>(expletive deleted)</i> life
|
||||
instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I
|
||||
<blockquote> A growing number of MTAs serving list subscribers are
|
||||
rejecting all HTML traffic. At least one MTA has gone so far as to
|
||||
blacklist shorewall.net "for continuous abuse" because it has been
|
||||
my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian
|
||||
way to control spam and that the ultimate losers here are not
|
||||
the spammers but the list subscribers whose MTAs are bouncing
|
||||
all shorewall.net mail. As one list subscriber wrote to me privately
|
||||
"These e-mail admin's need to get a <i>(expletive deleted)</i> life
|
||||
instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I
|
||||
have now configured the list server at shorewall.net to strip all HTML
|
||||
from outgoing posts.<br>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF
|
||||
Users mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased an MNF
|
||||
license from MandrakeSoft then you can post non MNF-specific Shorewall
|
||||
questions to the </b><a
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF
|
||||
Users mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased an MNF
|
||||
license from MandrakeSoft then you can post non MNF-specific Shorewall
|
||||
questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> or to the <a
|
||||
list</a> or the <a
|
||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||
Forum</a>. <b>Do not expect to get free MNF support on the list or forum.</b><br>
|
||||
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> or to the <a
|
||||
list</a> or to the <a
|
||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||
Forum</a>.<br>
|
||||
To Subscribe to the mailing list go to <a
|
||||
To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
<p>For information on other Shorewall mailing lists, go to <a
|
||||
href="http://lists.shorewall.net/mailing_list.htm">http://lists.shorewall.net/mailing_list.htm</a><br>
|
||||
</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 3/17/2003 - Tom Eastep</font></p>
|
||||
</p>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 4/10/2003 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -6,12 +6,10 @@
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Upgrade Issues</title>
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -19,167 +17,183 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p>For upgrade instructions see the <a
|
||||
href="Install.htm">Install/Upgrade page</a>.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
<p>It is important that you read all of the sections on this page where the
|
||||
version number mentioned in the section title is later than what you are
|
||||
currently running. <br>
|
||||
</p>
|
||||
version number mentioned in the section title is later than what you are
|
||||
currently running.<br>
|
||||
</p>
|
||||
<p> In the descriptions that follows, the term <b><i>group </i></b>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may
|
||||
be a host address) accessed through a particular interface.<br>
|
||||
</p>
|
||||
<p>Examples:<br>
|
||||
<br>
|
||||
eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</p>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<h3>Version >= 1.4.2</h3>
|
||||
There are some cases where you may want to handle traffic from a particular
|
||||
group to itself. While I personally think that such a setups are ridiculous,
|
||||
there are two cases covered in this documentation where it can occur:<br>
|
||||
<ol>
|
||||
<li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
|
||||
<li><a href="Shorewall_Squid_Usage.html">When running Squid as a transparent
|
||||
proxy in your local zone.</a></li>
|
||||
</ol>
|
||||
If you have either of these cases, you will want to review the current documentation
|
||||
and change your configuration accordingly.<br>
|
||||
<h3>Version >= 1.4.1</h3>
|
||||
In the description that follows, the term <i>group </i>refers to a particular
|
||||
network or subnetwork (which may be 0.0.0.0/0 or it may be a host address)
|
||||
accessed through a particular interface. Examples:<br>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<ul>
|
||||
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
||||
zone is accepted by default. Previously, traffic from a zone to itself was
|
||||
treated just like any other traffic; any matching rules were applied followed
|
||||
by enforcement of the appropriate policy. With 1.4.1 and later versions,
|
||||
unless you have explicit rules for traffic from Z to Z or you have an explicit
|
||||
Z to Z policy (where "Z" is some zone) then traffic between the groups in
|
||||
zone Z will be accepted. If you do have one or more explicit rules for Z
|
||||
to Z or if you have an explicit Z to Z policy then the behavior is as it
|
||||
was in prior versions.</li>
|
||||
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
||||
zone is accepted by default. Previously, traffic from a zone to itself
|
||||
was treated just like any other traffic; any matching rules were applied
|
||||
followed by enforcement of the appropriate policy. With 1.4.1 and later
|
||||
versions, unless you have explicit rules for traffic from Z to Z or you
|
||||
have an explicit Z to Z policy (where "Z" is some zone) then traffic between
|
||||
the groups in zone Z will be accepted. If you do have one or more explicit
|
||||
rules for Z to Z or if you have an explicit Z to Z policy then the behavior
|
||||
is as it was in prior versions.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic between
|
||||
two interfaces to the same zone, that policy can be removed and traffic
|
||||
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic between
|
||||
two interfaces to the same zone, that policy can be removed and traffic
|
||||
between the interfaces will traverse fewer rules than previously.</li>
|
||||
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
||||
rules then your configuration should not require any change.</li>
|
||||
<li>If you are currently relying on a implicit policy (one that has
|
||||
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
||||
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
||||
add an explicit DROP or REJECT policy for Z to Z.<br>
|
||||
</li>
|
||||
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
||||
rules then your configuration should not require any change.</li>
|
||||
<li>If you are currently relying on a implicit policy (one that has
|
||||
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
||||
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
||||
add an explicit DROP or REJECT policy for Z to Z.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>Beginning with Version 1.4.1, Shorewall will never create rules to
|
||||
deal with traffic from a given group back to itself. The <i>multi</i> interface
|
||||
option is no longer available so if you want to route traffic between two
|
||||
subnetworks on the same interface then either:</li>
|
||||
<li>Beginning with Version 1.4.1, Shorewall will never create rules
|
||||
to deal with traffic from a given group back to itself. The <i>multi</i>
|
||||
interface option is no longer available so if you want to route traffic between
|
||||
two subnetworks on the same interface then either:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>The subnetworks must be in different zones; or</li>
|
||||
<li>You must use the /etc/shorewall/hosts file to define the subnetworks
|
||||
as two groups in a single zone.</li>
|
||||
<li>The subnetworks must be in different zones; or</li>
|
||||
<li>You must use the /etc/shorewall/hosts file to define the subnetworks
|
||||
as two groups in a single zone.</li>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
Example 1 -- Two zones:<br>
|
||||
</blockquote>
|
||||
If you use the technique described in FAQ 2 to send local requests addressed
|
||||
to your firewall's external address back to a local server then you need to
|
||||
change your configuration to match <a href="FAQ.htm#faq2">the new version
|
||||
of FAQ #2.<br>
|
||||
</a><br>
|
||||
Example 1 -- Two zones:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/policy<br><br>z1 z2 ACCEPT<br>z2 z1 ACCEPT<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.0/24<br>z2 eth1:192.168.2.0/24<br></pre>
|
||||
</blockquote>
|
||||
Example 2 -- One zone:
|
||||
</blockquote>
|
||||
Example 2 -- One zone:
|
||||
<blockquote>
|
||||
<pre><br>/etc/shorewall/zones<br><br>z Zone The Zone<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z eth1:192.168.1.0/24<br>z eth1:192.168.2.0/24<br></pre>
|
||||
</blockquote>
|
||||
Note that in the second example, we don't need any policy since z->z
|
||||
traffic is accepted by default. The second technique is preferable if you
|
||||
want unlimited access between the two subnetworks.<br>
|
||||
<br>
|
||||
Sometimes, you want two separate zones on one interface but you don't want
|
||||
Shorewall to set up any infrastructure to handle traffic between them. <br>
|
||||
<br>
|
||||
Example:<br>
|
||||
</blockquote>
|
||||
Note that in the second example, we don't need any policy since z->z
|
||||
traffic is accepted by default. The second technique is preferable if you
|
||||
want unlimited access between the two subnetworks.<br>
|
||||
<br>
|
||||
Sometimes, you want two separate zones on one interface but you don't
|
||||
want Shorewall to set up any infrastructure to handle traffic between them.
|
||||
<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/interfaces<br><br>z2 eth1 192.168.1.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.3<br></pre>
|
||||
</blockquote>
|
||||
Here, zone z1 is nested in zone z2 and the firewall is not going to be involved
|
||||
in any traffic between these two zones. Beginning with Shorewall 1.4.1, you
|
||||
can prevent Shorewall from setting up any infrastructure to handle traffic
|
||||
between z1 and z2 by using the new NONE policy:<br>
|
||||
</blockquote>
|
||||
Here, zone z1 is nested in zone z2 and the firewall is not going to be
|
||||
involved in any traffic between these two zones. Beginning with Shorewall
|
||||
1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
|
||||
traffic between z1 and z2 by using the new NONE policy:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>/etc/shorewall/policy<br><pre>z1 z2 NONE<br>z2 z1 NONE</pre></pre>
|
||||
</blockquote>
|
||||
Note that NONE policies are generally used in pairs unless there is asymetric
|
||||
routing where only the traffic on one direction flows through the firewall
|
||||
and you are using a NONE polciy in the other direction.
|
||||
</blockquote>
|
||||
Note that NONE policies are generally used in pairs unless there is asymetric
|
||||
routing where only the traffic on one direction flows through the firewall
|
||||
and you are using a NONE polciy in the other direction.
|
||||
<h3>Version >= 1.4.0</h3>
|
||||
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
||||
package ('ip' utility).</b><br>
|
||||
<br>
|
||||
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
||||
package ('ip' utility).</b><br>
|
||||
<br>
|
||||
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
If you are upgrading from a version < 1.4.0, then:<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm
|
||||
-Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
If you are upgrading from a version < 1.4.0, then:<br>
|
||||
|
||||
<ul>
|
||||
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
||||
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||
ICMP echo-request (ping) packets are treated just like any other connection
|
||||
request and are subject to rules and policies.</li>
|
||||
<li>Interface names of the form <device>:<integer>
|
||||
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
||||
(they always have produced warnings in iptables).</li>
|
||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone contents
|
||||
are determined by BOTH the interfaces and hosts files when there are entries
|
||||
for the zone in both files.</li>
|
||||
<li>The <b>routestopped</b> option in the interfaces and hosts
|
||||
file has been eliminated; use entries in the routestopped file instead.</li>
|
||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no
|
||||
longer accepted; you must convert to using the new syntax.</li>
|
||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is no
|
||||
longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
||||
<li value="6">Late-arriving DNS replies are now dropped by default;
|
||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
||||
logging these packets.</li>
|
||||
<li value="6">The 'firewall', 'functions' and 'version' file have
|
||||
been moved to /usr/share/shorewall.</li>
|
||||
<li value="6">The icmp.def file has been removed. If you include
|
||||
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
||||
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||
ICMP echo-request (ping) packets are treated just like any other connection
|
||||
request and are subject to rules and policies.</li>
|
||||
<li>Interface names of the form <device>:<integer>
|
||||
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
||||
(they always have produced warnings in iptables).</li>
|
||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
|
||||
contents are determined by BOTH the interfaces and hosts files when there
|
||||
are entries for the zone in both files.</li>
|
||||
<li>The <b>routestopped</b> option in the interfaces and hosts
|
||||
file has been eliminated; use entries in the routestopped file instead.</li>
|
||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
||||
no longer accepted; you must convert to using the new syntax.</li>
|
||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is
|
||||
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
||||
<li value="6">Late-arriving DNS replies are now dropped by default;
|
||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
||||
logging these packets.</li>
|
||||
<li value="6">The 'firewall', 'functions' and 'version' file
|
||||
have been moved to /usr/share/shorewall.</li>
|
||||
<li value="6">The icmp.def file has been removed. If you include
|
||||
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||
</li>
|
||||
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -190,81 +204,84 @@ longer accepted; you must convert to using the new syntax.</li>
|
||||
<h3>Version 1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li value="8">The 'multi' interface option is no longer supported. Shorewall
|
||||
will generate rules for sending packets back out the same interface that
|
||||
they arrived on in two cases:</li>
|
||||
<li value="8">The 'multi' interface option is no longer supported.
|
||||
Shorewall will generate rules for sending packets back out the same
|
||||
interface that they arrived on in two cases:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote>
|
||||
<ul>
|
||||
<li>There is an <u>explicit</u> policy for the source zone to or from
|
||||
the destination zone. An explicit policy names both zones and does not
|
||||
use the 'all' reserved word.</li>
|
||||
<li>There is an <u>explicit</u> policy for the source zone to or
|
||||
from the destination zone. An explicit policy names both zones and does
|
||||
not use the 'all' reserved word.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>There are one or more rules for traffic for the source zone to
|
||||
or from the destination zone including rules that use the 'all' reserved
|
||||
word. Exception: if the source zone and destination zone are the same then
|
||||
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||
DESTINATION columns.</li>
|
||||
<li>There are one or more rules for traffic for the source zone to
|
||||
or from the destination zone including rules that use the 'all' reserved
|
||||
word. Exception: if the source zone and destination zone are the same
|
||||
then the rule must be explicit - it must name the zone in both the SOURCE
|
||||
and DESTINATION columns.</li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3>Version >= 1.3.14</h3>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
Beginning in version 1.3.14, Shorewall treats entries in <a
|
||||
href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change
|
||||
involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second)
|
||||
<b>column</b>:<br>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
Beginning in version 1.3.14, Shorewall treats entries in
|
||||
<a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The
|
||||
change involves entries with an <b>interface name</b> in the <b>SUBNET</b>
|
||||
(second) <b>column</b>:<br>
|
||||
|
||||
<ul>
|
||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
||||
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
||||
masquerade traffic from that subnet. Any other subnets that routed through
|
||||
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
||||
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
||||
masquerade traffic from that subnet. Any other subnets that routed through
|
||||
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
||||
or to have SNAT applied.</li>
|
||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||
routing table to determine ALL subnets routed through the named interface.
|
||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||
applied.</li>
|
||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||
routing table to determine ALL subnets routed through the named interface.
|
||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||
applied.</li>
|
||||
|
||||
</ul>
|
||||
You will need to make a change to your configuration if:<br>
|
||||
You will need to make a change to your configuration if:<br>
|
||||
|
||||
<ol>
|
||||
<li>You have one or more entries in /etc/shorewall/masq with
|
||||
an interface name in the SUBNET (second) column; and</li>
|
||||
<li>That interface connects to more than one subnetwork.</li>
|
||||
<li>You have one or more entries in /etc/shorewall/masq with
|
||||
an interface name in the SUBNET (second) column; and</li>
|
||||
<li>That interface connects to more than one subnetwork.</li>
|
||||
|
||||
</ol>
|
||||
Two examples:<br>
|
||||
<br>
|
||||
<b>Example 1</b> -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
Two examples:<br>
|
||||
<br>
|
||||
<b>Example 1</b> -- Suppose that your current config is as
|
||||
follows:<br>
|
||||
<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
|
||||
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
</blockquote>
|
||||
<b>Example 2</b>-- What if your current configuration is like
|
||||
this?<br>
|
||||
required.<br>
|
||||
</blockquote>
|
||||
<b>Example 2</b>-- What if your current configuration is like
|
||||
this?<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
||||
|
||||
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
</blockquote>
|
||||
to:<br>
|
||||
</blockquote>
|
||||
|
||||
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||
Version 1.3.14 also introduced simplified ICMP echo-request
|
||||
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||
is used to specify that the old (pre-1.3.14) ping handling is to be
|
||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||
height="13">
|
||||
Version 1.3.14 also introduced simplified ICMP echo-request
|
||||
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||
is used to specify that the old (pre-1.3.14) ping handling is to be
|
||||
used (If the option is not set in your /etc/shorewall/shorewall.conf
|
||||
then OLD_PING_HANDLING=Yes is assumed). I don't plan on supporting the
|
||||
old handling indefinitely so I urge current users to migrate to using
|
||||
@ -272,155 +289,149 @@ the new handling as soon as possible. See the <a href="ping.html">'Ping'
|
||||
handling documentation</a> for details.<br>
|
||||
|
||||
<h3>Version 1.3.10</h3>
|
||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||
<br>
|
||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>
|
||||
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3>Version >= 1.3.9</h3>
|
||||
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||
If you have an application that uses functions from that file, your
|
||||
application will need to be changed to reflect this change of location.<br>
|
||||
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||
If you have an application that uses functions from that file, your
|
||||
application will need to be changed to reflect this change of location.<br>
|
||||
|
||||
<h3>Version >= 1.3.8</h3>
|
||||
|
||||
<p>If you have a pair of firewall systems configured for failover
|
||||
or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall
|
||||
versions >= 1.3.8. Beginning with version
|
||||
1.3.8, you must set NEWNOTSYN=Yes in
|
||||
your /etc/shorewall/shorewall.conf file.</p>
|
||||
or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall
|
||||
versions >= 1.3.8. Beginning with version 1.3.8,
|
||||
you must set NEWNOTSYN=Yes in your
|
||||
/etc/shorewall/shorewall.conf file.</p>
|
||||
|
||||
<h3>Version >= 1.3.7</h3>
|
||||
|
||||
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
||||
will need to include the following
|
||||
rules in their /etc/shorewall/icmpdef
|
||||
file (creating this file if necessary):</p>
|
||||
will need to include the following
|
||||
rules in their /etc/shorewall/icmpdef file (creating this
|
||||
file if necessary):</p>
|
||||
|
||||
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
||||
|
||||
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
||||
command from that file since the icmp.def file is now empty.</p>
|
||||
command from that file since the icmp.def file is now empty.</p>
|
||||
|
||||
<h3><b><a name="Bering">Upgrading </a>Bering to
|
||||
Shorewall >= 1.3.3</b></h3>
|
||||
<h3><b><a name="Bering">Upgrading </a>Bering to Shorewall >= 1.3.3</b></h3>
|
||||
|
||||
<p>To properly upgrade with Shorewall version
|
||||
1.3.3 and later:</p>
|
||||
<p>To properly upgrade with Shorewall version 1.3.3 and later:</p>
|
||||
|
||||
<ol>
|
||||
<li>Be sure you have a backup
|
||||
-- you will need to transcribe any
|
||||
Shorewall configuration changes that
|
||||
you have made to the new configuration.</li>
|
||||
<li>Replace the shorwall.lrp
|
||||
package provided on the Bering floppy
|
||||
with the later one. If you did not
|
||||
obtain the later version from Jacques's
|
||||
site, see additional instructions below.</li>
|
||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||
file and remove the /var/lib/shorewall
|
||||
entry if present. Then do not forget
|
||||
to backup root.lrp !</li>
|
||||
<li>Be sure you have a
|
||||
backup -- you will need to transcribe
|
||||
any Shorewall configuration changes
|
||||
that you have made to the new configuration.</li>
|
||||
<li>Replace the shorwall.lrp
|
||||
package provided on the Bering floppy
|
||||
with the later one. If you did not
|
||||
obtain the later version from Jacques's site, see additional instructions
|
||||
below.</li>
|
||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||
file and remove the /var/lib/shorewall
|
||||
entry if present. Then do not forget
|
||||
to backup root.lrp !</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||
for setting up a two-interface firewall</a> plus you also need
|
||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||
for setting up a two-interface firewall</a> plus you also need
|
||||
to add the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
||||
|
||||
<blockquote>
|
||||
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
||||
|
||||
<p align="left">If you have a pair of firewall systems configured for
|
||||
failover or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall versions
|
||||
1.3.6 and 1.3.7</p>
|
||||
failover or if you have asymmetric routing, you will need to modify
|
||||
your firewall setup slightly under Shorewall versions 1.3.6
|
||||
and 1.3.7</p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
|
||||
<li>
|
||||
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
||||
the following rule<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A newnotsyn
|
||||
-j RETURN # So that the connection tracking table can be
|
||||
rebuilt<br>
|
||||
# from non-SYN
|
||||
packets after takeover.<br>
|
||||
</font> </p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
the following rule<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A newnotsyn
|
||||
-j RETURN # So that the connection tracking table can be
|
||||
rebuilt<br>
|
||||
# from
|
||||
non-SYN packets after takeover.<br>
|
||||
</font> </p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Create /etc/shorewall/common (if you don't already
|
||||
have that file) and include the following:<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A common -p
|
||||
tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks to
|
||||
rebuild connection<br>
|
||||
|
||||
#tracking table. <br>
|
||||
. /etc/shorewall/common.def</font> </p>
|
||||
</li>
|
||||
have that file) and include the following:<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A common
|
||||
-p tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks
|
||||
to rebuild connection<br>
|
||||
|
||||
#tracking table. <br>
|
||||
. /etc/shorewall/common.def</font> </p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3 align="left">Versions >= 1.3.5</h3>
|
||||
|
||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no
|
||||
longer supported. </p>
|
||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no longer
|
||||
supported. </p>
|
||||
|
||||
<p align="left">Example 1:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p align="left">Must be replaced with:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Example 2:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">Must be replaced with:</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<pre> REDIRECT loc 3128 tcp 80</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 align="left">Version >= 1.3.2</h3>
|
||||
|
||||
<p align="left">The functions and versions files together with the
|
||||
'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||
If you have applications that access these files, those
|
||||
applications should be modified accordingly.</p>
|
||||
<p align="left">The functions and versions files together with the 'firewall'
|
||||
symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||
If you have applications that access these files, those applications
|
||||
should be modified accordingly.</p>
|
||||
|
||||
<p><font size="2"> Last updated 3/18/2003 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
<p><font size="2"> Last updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
</p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user