From 3f69ad342b8b33415cd44821b43847e28f4234e4 Mon Sep 17 00:00:00 2001 From: mhnoyes Date: Tue, 16 Dec 2003 16:44:50 +0000 Subject: [PATCH] Content moved to GenericTunnels.xml git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@860 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Shorewall-docs/GenericTunnels.html | 194 ----------------------------- 1 file changed, 194 deletions(-) delete mode 100644 Shorewall-docs/GenericTunnels.html diff --git a/Shorewall-docs/GenericTunnels.html b/Shorewall-docs/GenericTunnels.html deleted file mode 100644 index 6340f2f85..000000000 --- a/Shorewall-docs/GenericTunnels.html +++ /dev/null @@ -1,194 +0,0 @@ - - - - - Generic Tunnels - - - - -

Generic Tunnels
-

-Shorewall includes built-in support for a wide range of VPN solutions. -If you have need for a tunnel type that does not have explicit support, -you can generally describe the tunneling software using "generic -tunnels"
-

Bridging two Masqueraded Networks

-

Suppose that we have the following situation:

-

-

We want systems in the 192.168.1.0/24 subnetwork to be -able to communicate with the systems in the 10.0.0.0/8 network. This is -accomplished through use of the /etc/shorewall/tunnels file, the -/etc/shorewall/policy file and the /etc/shorewall/tunnel script that is -included with Shorewall.
-

-

Suppose that you have tunneling software that uses two -different protocols:
-

-

a) TCP port 1071
-b) GRE (Protocol 47)
-c) The tunnel interface on system A is "tun0" and the tunnel interface -on system B is also "tun0".
-

-

On each firewall, you will need to declare a zone to -represent the remote subnet. We'll assume that this zone is called -'vpn' and declare it in /etc/shorewall/zones on both systems as follows.

-
- - - - - - - - - - - - - -
ZONEDISPLAYCOMMENTS
vpnVPNRemote Subnet
-
-

On system A, the 10.0.0.0/8 will comprise the vpn -zone. -In /etc/shorewall/interfaces:

-
- - - - - - - - - - - - - - - -
ZONEINTERFACEBROADCASTOPTIONS
vpntun010.255.255.255 
-
-

In /etc/shorewall/tunnels on system A, we need the -following:

-
- - - - - - - - - - - - - - - - - - - - - -
TYPEZONEGATEWAYGATEWAY ZONE
generic:tcp:1071
- 		net134.28.54.2 
generic:47
- 		net
- 		134.28.54.2
-
-
-
-

These entries in /etc/shorewall/tunnels, opens the firewall so that -TCP port 1071 and the Generalized Routing Encapsulation Protocol (47) -will be accepted to/from the remote gateway.

-
- - - - - - - - - - - - - - - -
ZONEINTERFACEBROADCASTOPTIONS
vpntun0192.168.1.255 
-
-

In /etc/shorewall/tunnels on system B, we have:

-
- - - - - - - - - - - - - - - - - - - - - -
TYPEZONEGATEWAYGATEWAY ZONE
generic:tcp:1071
- 		net206.191.148.9 
generic:47
- 		net
- 		134.28.54.2
-
-
-
-

You will need to allow traffic between the "vpn" zone -and the "loc" zone on both systems -- if you simply want to admit all -traffic in both directions, you can use the policy file:

-
- - - - - - - - - - - - - - - - - - - - - -
SOURCEDESTPOLICYLOG LEVEL
locvpnACCEPT 
vpnlocACCEPT 
-
-

On both systems, restart Shorewall and start your VPN software on -each system. The systems in the two masqueraded subnetworks -can now talk to each other

-

Updated 8/9/2003 - Tom Eastep -

-

Copyright © 2001, 2002, 2003Thomas M. Eastep.

-
-
- -