mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-23 06:38:53 +01:00
New files for 1.3.8
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@243 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
329bddd120
commit
478b108bc0
81
Shorewall-docs/VPN.htm
Executable file
81
Shorewall-docs/VPN.htm
Executable file
@ -0,0 +1,81 @@
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
|
||||
<title>VPN</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#FFFFFF">VPN</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<p>It is often the case that a system behind the firewall needs to be able to
|
||||
access a remote network through Virtual Private Networking (VPN). The two most
|
||||
common means for doing this are IPSEC and PPTP. The basic setup is shown in the
|
||||
following diagram:</p>
|
||||
<p align="center"><img border="0" src="images/VPN.png" width="568" height="796"></p>
|
||||
<p align="left">A system with an RFC 1918 address needs to access a remote
|
||||
network through a remote gateway. For this example, we will assume that the
|
||||
local system has IP address 192.168.1.12 and that the remote gateway has IP
|
||||
address 192.0.2.224.</p>
|
||||
<p align="left">If PPTP is being used, there are no firewall requirements beyond
|
||||
the default loc->net ACCEPT policy. There is one restriction however: Only one
|
||||
local system at a time can be connected to a single remote gateway unless you
|
||||
patch your kernel from the 'Patch-o-matic' patches available at
|
||||
<a href="http://www.netfilter.org">http://www.netfilter.org</a>. </p>
|
||||
<p align="left">If IPSEC is being used then there are firewall configuration
|
||||
requirements as follows:</p>
|
||||
<blockquote>
|
||||
<table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber2" height="98">
|
||||
<tr>
|
||||
<td height="38"><u><b>ACTION</b></u></td>
|
||||
<td height="38"><u><b>SOURCE</b></u></td>
|
||||
<td height="38"><u><b>DESTINATION</b></u></td>
|
||||
<td height="38"><u><b>PROTOCOL</b></u></td>
|
||||
<td height="38"><u><b>PORT</b></u></td>
|
||||
<td height="38"><u><b>CLIENT<br>
|
||||
PORT</b></u></td>
|
||||
<td height="38"><u><b>ORIGINAL<br>
|
||||
DEST</b></u></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td height="19">DNAT</td>
|
||||
<td height="19">net:192.0.2.224</td>
|
||||
<td height="19">loc:192.168.1.12</td>
|
||||
<td height="19">50</td>
|
||||
<td height="19"> </td>
|
||||
<td height="19"> </td>
|
||||
<td height="19"> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td height="19">DNAT</td>
|
||||
<td height="19">net:192.0.2.224</td>
|
||||
<td height="19">loc:192.168.1.12</td>
|
||||
<td height="19">udp</td>
|
||||
<td height="19">500</td>
|
||||
<td height="19"> </td>
|
||||
<td height="19"> </td>
|
||||
</tr>
|
||||
</table>
|
||||
</blockquote>
|
||||
<p>If you want to be able to give access to all of your local systems to the
|
||||
remote network, you should consider running a VPN client on your firewall. As
|
||||
starting points, see
|
||||
<a href="http://www.shorewall.net/Documentation.htm#Tunnels">
|
||||
http://www.shorewall.net/Documentation.htm#Tunnels</a> or
|
||||
<a href="http://www.shorewall.net/PPTP.htm">http://www.shorewall.net/PPTP.htm</a>.</p>
|
||||
<p><font size="2">Last modified 8/27/2002 - <a href="support.htm">Tom
|
||||
Eastep</a></font><p><font face="Trebuchet MS"><a href="copyright.htm">
|
||||
<font size="2">Copyright</font> © <font size="2">2002 Thomas M. Eastep.</font></a></font><p> </p>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
145
Shorewall-docs/upgrade_issues.htm
Executable file
145
Shorewall-docs/upgrade_issues.htm
Executable file
@ -0,0 +1,145 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
|
||||
<title>Upgrade Issues</title>
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#FFFFFF">Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<p>For upgrade instructions see the
|
||||
<a href="Install.htm">Install/Upgrade page</a>.</p>
|
||||
|
||||
<h3>Version >= 1.3.7</h3>
|
||||
|
||||
<p>Users specifying ALLOWRELATED=No in
|
||||
/etc/shorewall.conf will need to include the
|
||||
following rules in their /etc/shorewall/icmpdef
|
||||
file (creating this file if necessary):</p>
|
||||
|
||||
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
|
||||
run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
|
||||
run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
|
||||
run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
|
||||
run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
||||
<p>Users having an /etc/shorewall/icmpdef file may remove the ".
|
||||
/etc/shorewall/icmp.def" command from that file since the icmp.def file is now
|
||||
empty.</p>
|
||||
<h3><b><a name="Bering">Upgrading </a>Bering to
|
||||
Shorewall >= 1.3.3</b></h3>
|
||||
|
||||
<p>To properly upgrade with Shorewall version
|
||||
1.3.3 and later:</p>
|
||||
|
||||
<ol>
|
||||
<li>Be sure you have a backup -- you will need
|
||||
to transcribe any Shorewall configuration
|
||||
changes that you have made to the new
|
||||
configuration.</li>
|
||||
<li>Replace the shorwall.lrp package provided on
|
||||
the Bering floppy with the later one. If you did
|
||||
not obtain the later version from Jacques's
|
||||
site, see additional instructions below.</li>
|
||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||
file and remove the /var/lib/shorewall entry if
|
||||
present. Then do not forget to backup root.lrp !</li>
|
||||
</ol>
|
||||
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions for
|
||||
setting up a two-interface firewall</a> plus you also need to add the following
|
||||
two Bering-specific rules to /etc/shorewall/rules:</p>
|
||||
<blockquote>
|
||||
<pre># Bering specific rules:
|
||||
# allow loc to fw udp/53 for dnscache to work
|
||||
# allow loc to fw tcp/80 for weblet to work
|
||||
#
|
||||
ACCEPT loc fw udp 53
|
||||
ACCEPT loc fw tcp 80</pre>
|
||||
</blockquote>
|
||||
|
||||
<h3 align="Left">Version >= 1.3.6</h3>
|
||||
|
||||
<p align="Left">If you have a pair of firewall systems configured for
|
||||
failover, you will need to modify your firewall setup slightly under
|
||||
Shorewall versions >= 1.3.6. </p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
|
||||
<p align="Left">Create the file /etc/shorewall/newnotsyn and in it add
|
||||
the following rule<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A newnotsyn -j RETURN # So that the
|
||||
connection tracking table can be rebuilt<br>
|
||||
|
||||
# from non-SYN packets after takeover.<br>
|
||||
</font></li>
|
||||
<li>
|
||||
|
||||
<p align="Left">Create /etc/shorewall/common (if you don't already
|
||||
have that file) and include the following:<br>
|
||||
<br>
|
||||
<font face="Courier">run_iptables -A common -p tcp --tcp-flags
|
||||
ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection<br>
|
||||
|
||||
#tracking table. <br>
|
||||
. /etc/shorewall/common.def</font></li>
|
||||
</ol>
|
||||
|
||||
<h3 align="Left">Versions >= 1.3.5</h3>
|
||||
|
||||
<p align="Left">Some forms of pre-1.3.0 rules file syntax are no
|
||||
longer supported. </p>
|
||||
|
||||
<p align="Left">Example 1:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
||||
</div>
|
||||
|
||||
<p align="Left">Must be replaced with:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
||||
</div>
|
||||
<div align="left">
|
||||
<p align="left">Example 2:</div>
|
||||
<div align="left">
|
||||
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
||||
</div>
|
||||
<div align="left">
|
||||
<p align="left">Must be replaced with:</div>
|
||||
<div align="left">
|
||||
<pre> REDIRECT loc 3128 tcp 80</pre>
|
||||
</div>
|
||||
|
||||
<h3 align="Left">Version >= 1.3.2</h3>
|
||||
|
||||
<p align="Left">The functions and versions files together with the
|
||||
'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||
If you have applications that access these files, those applications
|
||||
should be modified accordingly.</p>
|
||||
|
||||
<p><font size="2">
|
||||
Last updated 9/13/2002 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Reference in New Issue
Block a user