mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-16 03:10:39 +01:00
'check' is back in
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
2894700fcf
commit
4b5254bed5
@ -51,16 +51,16 @@
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note: </b>Some SuSE users have encountered a problem whereby rpm
|
||||
reports a conflict with kernel <= 2.2 even though a 2.4 kernel is installed.
|
||||
If this happens, simply use the --nodeps option to rpm (rpm -ivh --nodeps
|
||||
<shorewall rpm>).</li>
|
||||
reports a conflict with kernel <= 2.2 even though a 2.4 kernel is
|
||||
installed. If this happens, simply use the --nodeps option to rpm (rpm
|
||||
-ivh --nodeps <shorewall rpm>).</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to match
|
||||
your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY NETWORK
|
||||
TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO RESTORE
|
||||
NETWORK CONNECTIVITY.</b></font></li>
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO
|
||||
RESTORE NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
|
||||
</ul>
|
||||
@ -89,26 +89,27 @@ directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to match
|
||||
your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to be started
|
||||
automatically at boot, see <a
|
||||
<li>If the install script was unable to configure Shorewall to be
|
||||
started automatically at boot, see <a
|
||||
href="starting_and_stopping_shorewall.htm">these instructions</a>.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file that
|
||||
you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file
|
||||
that you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
|
||||
<p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed
|
||||
and are upgrading to a new version:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
or and you have entries in the /etc/shorewall/hosts file then please check
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version or
|
||||
and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain 1.2
|
||||
rule forms that are no longer supported under 1.4 (you must use the new
|
||||
1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for details.</p>
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
|
||||
details.</p>
|
||||
|
||||
<ul>
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
@ -118,26 +119,27 @@ Beta RPMs installed, you must use the "--oldpackage" option to rpm (e.g.,
|
||||
|
||||
<p> <b>Note: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm (rpm
|
||||
-Uvh --nodeps <shorewall rpm>).<br>
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -Uvh --nodeps <shorewall rpm>).<br>
|
||||
</p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version and correct as necessary.</li>
|
||||
and the new Shorewall version (type "shorewall check") and correct as necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed and
|
||||
are upgrading to a new version using the tarball:</p>
|
||||
<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed
|
||||
and are upgrading to a new version using the tarball:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues</a>
|
||||
for details. </p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version and
|
||||
you have entries in the /etc/shorewall/hosts file then please check your
|
||||
/etc/shorewall/interfaces file to be sure that it contains an entry for
|
||||
each interface mentioned in the hosts file. Also, there are certain 1.2
|
||||
rule forms that are no longer supported under 1.4 (you must use the new
|
||||
1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues</a> for
|
||||
details. </p>
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
@ -156,9 +158,8 @@ or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Check your configuration for incompatibility with 1.4 as described
|
||||
above.<br>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
|
||||
</ul>
|
||||
@ -170,13 +171,15 @@ installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<h3><a name="Config_Files"></a>Configuring Shorewall</h3>
|
||||
|
||||
<p>You will need to edit some or all of the configuration files to match
|
||||
your setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall
|
||||
QuickStart Guides</a> contain all of the information you need.</p>
|
||||
your setup. In most cases, the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guides</a>
|
||||
contain all of the information you need.</p>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
<p><font size="2">Updated 1/24/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
|
||||
<p><font size="2">Updated 2/27/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
@ -185,5 +188,6 @@ your setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewa
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -29,8 +29,8 @@
|
||||
|
||||
<p>Proxy ARP allows you to insert a firewall in front of a set of servers
|
||||
without changing their IP addresses and without having to re-subnet.
|
||||
Before you try to use this technique, I strongly recommend that you read
|
||||
the <a href="shorewall_setup_guide.htm">Shorewall Setup Guide.</a></p>
|
||||
Before you try to use this technique, I strongly recommend that you read the
|
||||
<a href="shorewall_setup_guide.htm">Shorewall Setup Guide.</a></p>
|
||||
|
||||
<p>The following figure represents a Proxy ARP environment.</p>
|
||||
|
||||
@ -75,8 +75,8 @@ in /etc/shorewall/proxyarp:</p>
|
||||
</blockquote>
|
||||
|
||||
<p>Be sure that the internal systems (130.242.100.18 and 130.252.100.19
|
||||
in the above example) are not included in any specification in
|
||||
/etc/shorewall/masq or /etc/shorewall/nat.</p>
|
||||
in the above example) are not included in any specification in /etc/shorewall/masq
|
||||
or /etc/shorewall/nat.</p>
|
||||
|
||||
<p>Note that I've used an RFC1918 IP address for eth1 - that IP address is
|
||||
irrelevant. </p>
|
||||
@ -92,6 +92,7 @@ the Firewall system's eth0 is configured.</p>
|
||||
probably be HOURS before that system can communicate with the internet.
|
||||
There are a couple of things that you can try:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>(Courtesy of Bradey Honsinger) A reading of Stevens' <i>TCP/IP Illustrated,
|
||||
Vol 1</i> reveals that a <br>
|
||||
@ -105,10 +106,10 @@ a duplicate...<br>
|
||||
this packet causes any other host...that has an entry in its cache for the
|
||||
old hardware address to update its ARP cache entry accordingly."<br>
|
||||
<br>
|
||||
Which is, of course, exactly what you want to do when you switch a host from
|
||||
being exposed to the Internet to behind Shorewall using proxy ARP (or static
|
||||
NAT for that matter). Happily enough, recent versions of Redhat's iputils
|
||||
package include "arping", whose "-U" flag does just that:<br>
|
||||
Which is, of course, exactly what you want to do when you switch a host
|
||||
from being exposed to the Internet to behind Shorewall using proxy ARP (or
|
||||
static NAT for that matter). Happily enough, recent versions of Redhat's
|
||||
iputils package include "arping", whose "-U" flag does just that:<br>
|
||||
<br>
|
||||
<font color="#009900"><b>arping -U -I <i><net if> <newly proxied
|
||||
IP></i></b></font><br>
|
||||
@ -118,9 +119,22 @@ Stevens goes on to mention that not all systems respond correctly to gratuitous
|
||||
ARPs, but googling for "arping -U" seems to support the idea that it works
|
||||
most of the time.<br>
|
||||
<br>
|
||||
To use arping with Proxy ARP in the above example, you would have to:<br>
|
||||
<br>
|
||||
<font color="#009900"><b> shorewall clear<br>
|
||||
</b></font> <font color="#009900"><b>ip addr add 130.252.100.18 dev
|
||||
eth0<br>
|
||||
ip addr add 130.252.100.19 dev eth0</b></font><br>
|
||||
<font color="#009900"><b>arping -U -I eth0 130.252.100.18</b></font><br>
|
||||
<font color="#009900"><b>arping -U -I eth0 130.252.100.19</b></font><br>
|
||||
<b><font color="#009900">ip addr del 130.252.100.18 dev eth0<br>
|
||||
ip addr del 130.252.100.19 dev eth0<br>
|
||||
shorewall start</font></b><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>You can call your ISP and ask them to purge the stale ARP cache
|
||||
entry but many either can't or won't purge individual entries.</li>
|
||||
|
||||
</ol>
|
||||
You can determine if your ISP's gateway ARP cache is stale using ping
|
||||
and tcpdump. Suppose that we suspect that the gateway router has a stale
|
||||
@ -156,9 +170,10 @@ gateway's ARP cache still associates 130.252.100.19 with the NIC in that
|
||||
system rather than with the firewall's eth0.</p>
|
||||
</div>
|
||||
|
||||
<p><font size="2">Last updated 1/11/2003 - </font><font size="2"> <a
|
||||
<p><font size="2">Last updated 1/26/2003 - </font><font size="2"> <a
|
||||
href="support.htm">Tom Eastep</a></font> </p>
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
212
Shorewall-docs/myfiles.htm
Normal file
212
Shorewall-docs/myfiles.htm
Normal file
File diff suppressed because one or more lines are too long
@ -52,8 +52,8 @@ firewall to accommodate.</p>
|
||||
<p>DNS</p>
|
||||
|
||||
<blockquote>
|
||||
<p>UDP Port 53. If you are configuring a DNS client, you will probably want
|
||||
to open TCP Port 53 as well.<br>
|
||||
<p>UDP Port 53. If you are configuring a DNS client, you will probably
|
||||
want to open TCP Port 53 as well.<br>
|
||||
If you are configuring a server, only open TCP Port 53 if you will
|
||||
return long replies to queries or if you need to enable ZONE transfers. In
|
||||
the latter case, be sure that your server is properly configured.</p>
|
||||
@ -144,8 +144,8 @@ the latter case, be sure that your server is properly configured.</p>
|
||||
<p>Note that you MUST include port 21 in the <i>ports</i> list or you may
|
||||
have problems accessing regular FTP servers.</p>
|
||||
|
||||
<p>If there is a possibility that these modules might be loaded before Shorewall
|
||||
starts, then you should include the port list in /etc/modules.conf:<br>
|
||||
<p>If there is a possibility that these modules might be loaded before
|
||||
Shorewall starts, then you should include the port list in /etc/modules.conf:<br>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
@ -174,11 +174,13 @@ starts, then you should include the port list in /etc/modules.conf:<br>
|
||||
|
||||
<p>NFS<br>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
<p>I personally use the following rules for opening access from zone z1
|
||||
to a server with IP address a.b.c.d in zone z2:<br>
|
||||
</p>
|
||||
<pre>ACCEPT z1 z2:a.b.c.d udp 111<br>ACCEPT z1 z2:a.b.c.d udp 2049<br>ACCEPT z1 z2:a.b.c.d udp 32700:<br></pre>
|
||||
|
||||
<pre>ACCEPT z1 z2:a.b.c.d udp 111<br>ACCEPT z1 z2:a.b.c.d tcp 111<br>ACCEPT z1 z2:a.b.c.d udp 2049<br>ACCEPT z1 z2:a.b.c.d udp 32700:<br></pre>
|
||||
</blockquote>
|
||||
|
||||
<blockquote>
|
||||
@ -187,18 +189,19 @@ is lots of additional information at
|
||||
href="http://nfs.sourceforge.net/nfs-howto/security.html"> http://nfs.sourceforge.net/nfs-howto/security.html</a></p>
|
||||
</blockquote>
|
||||
|
||||
<p>Didn't find what you are looking for -- have you looked in your own /etc/services
|
||||
file? </p>
|
||||
<p>Didn't find what you are looking for -- have you looked in your own
|
||||
/etc/services file? </p>
|
||||
|
||||
<p>Still looking? Try <a
|
||||
href="http://www.networkice.com/advice/Exploits/Ports"> http://www.networkice.com/advice/Exploits/Ports</a></p>
|
||||
|
||||
<p><font size="2">Last updated 2/7/2003 - </font><font size="2"> <a
|
||||
<p><font size="2">Last updated 2/25/2003 - </font><font size="2"> <a
|
||||
href="support.htm">Tom Eastep</a></font> </p>
|
||||
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,12 +2,16 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall QuickStart Guide</title>
|
||||
@ -31,11 +35,12 @@
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that
|
||||
we must all first walk before we can run.<br>
|
||||
<p align="center">With thanks to Richard who reminded me once again that we
|
||||
must all first walk before we can run.<br>
|
||||
The French Translations are courtesy of Patrice Vetsel<br>
|
||||
</p>
|
||||
|
||||
@ -63,8 +68,8 @@ we must all first walk before we can run.<br>
|
||||
|
||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
||||
the steps necessary to set up a firewall where <b>there are multiple
|
||||
public IP addresses involved or if you want to learn more about
|
||||
Shorewall than is explained in the single-address guides above.</b></p>
|
||||
public IP addresses involved or if you want to learn more about Shorewall
|
||||
than is explained in the single-address guides above.</b></p>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
@ -77,8 +82,8 @@ Shorewall Concepts</a></li>
|
||||
Addressing, Subnets and Routing</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1
|
||||
IP Addresses</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3
|
||||
@ -109,8 +114,9 @@ Routed</a></li>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2
|
||||
Non-routed</a>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
@ -160,8 +166,8 @@ Rules</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common configuration
|
||||
file features</a>
|
||||
<li><a href="configuration_file_basics.htm">Common
|
||||
configuration file features</a>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
@ -169,8 +175,8 @@ Rules</a></li>
|
||||
files</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Ports">Port
|
||||
Numbers/Service Names</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||
<li><a
|
||||
@ -182,16 +188,16 @@ Rules</a></li>
|
||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||
or Subnet</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations (making
|
||||
a test configuration)</a></li>
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
||||
(making a test configuration)</a></li>
|
||||
<li><a href="configuration_file_basics.htm#MAC">Using
|
||||
MAC Addresses in Shorewall</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File Reference
|
||||
Manual</a>
|
||||
<li><a href="Documentation.htm">Configuration File
|
||||
Reference Manual</a>
|
||||
|
||||
<ul>
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
@ -228,8 +234,8 @@ a test configuration)</a></li>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font> (How
|
||||
to extend Shorewall without modifying Shorewall code)</li>
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||
(How to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall
|
||||
Structure</a></li>
|
||||
@ -238,11 +244,15 @@ to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Shorewall Configuration
|
||||
(How I personally use Shorewall)</a><br>
|
||||
</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
@ -261,7 +271,8 @@ to extend Shorewall without modifying Shorewall code)</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><font color="#000099"><a href="NAT.htm">Static
|
||||
NAT</a></font></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent Proxy
|
||||
with Shorewall</a><br>
|
||||
</li>
|
||||
@ -288,7 +299,7 @@ List Creation</a></li>
|
||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||
|
||||
<p><font size="2">Last modified 2/4/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
<p><font size="2">Last modified 2/26/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||
Eastep</font></a><br>
|
||||
@ -298,5 +309,6 @@ List Creation</a></li>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -41,13 +41,13 @@
|
||||
|
||||
|
||||
<p> If you have a permanent internet connection such as DSL or Cable,
|
||||
I recommend that you start the firewall automatically at boot.
|
||||
Once you have installed "firewall" in your init.d directory, simply
|
||||
type "chkconfig --add firewall". This will start the firewall
|
||||
in run levels 2-5 and stop it in run levels 1 and 6. If you want
|
||||
to configure your firewall differently from this default, you can
|
||||
use the "--level" option in chkconfig (see "man chkconfig") or using
|
||||
your favorite graphical run-level editor.</p>
|
||||
I recommend that you start the firewall automatically at boot. Once
|
||||
you have installed "firewall" in your init.d directory, simply type
|
||||
"chkconfig --add firewall". This will start the firewall in run
|
||||
levels 2-5 and stop it in run levels 1 and 6. If you want to configure
|
||||
your firewall differently from this default, you can use the "--level"
|
||||
option in chkconfig (see "man chkconfig") or using your favorite
|
||||
graphical run-level editor.</p>
|
||||
|
||||
|
||||
|
||||
@ -60,14 +60,14 @@ your favorite graphical run-level editor.</p>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>Shorewall startup is disabled by default. Once you have configured
|
||||
your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.
|
||||
Note: Users of the .deb package must edit /etc/default/shorewall and
|
||||
set 'startup=1'.<br>
|
||||
<li>Shorewall startup is disabled by default. Once you have
|
||||
configured your firewall, you can enable startup by removing the file
|
||||
/etc/shorewall/startup_disabled. Note: Users of the .deb package must
|
||||
edit /etc/default/shorewall and set 'startup=1'.<br>
|
||||
</li>
|
||||
<li>If you use dialup, you may want to start the firewall
|
||||
in your /etc/ppp/ip-up.local script. I recommend just placing "shorewall
|
||||
restart" in that script.</li>
|
||||
in your /etc/ppp/ip-up.local script. I recommend just placing
|
||||
"shorewall restart" in that script.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
@ -105,8 +105,8 @@ a shell trace of the command is produced as in:<br>
|
||||
|
||||
|
||||
|
||||
<p>The above command would trace the 'start' command and place the trace
|
||||
information in the file /tmp/trace<br>
|
||||
<p>The above command would trace the 'start' command and place the trace information
|
||||
in the file /tmp/trace<br>
|
||||
</p>
|
||||
|
||||
<p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
|
||||
@ -117,8 +117,8 @@ information in the file /tmp/trace<br>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>shorewall status - produce a verbose report about the firewall
|
||||
(iptables -L -n -v)</li>
|
||||
<li>shorewall status - produce a verbose report about the
|
||||
firewall (iptables -L -n -v)</li>
|
||||
<li>shorewall show <i>chain</i> - produce a verbose report
|
||||
about <i>chain </i>(iptables -L <i>chain</i> -n -v)</li>
|
||||
<li>shorewall show nat - produce a verbose report about the
|
||||
@ -133,17 +133,28 @@ mangle table (iptables -t mangle -L -n -v)</li>
|
||||
tc - displays
|
||||
information about the traffic control/shaping configuration.</li>
|
||||
<li>shorewall monitor [ delay ] - Continuously display the
|
||||
firewall status, last 20 log entries and nat. When the log
|
||||
entry display changes, an audible alarm is sounded.</li>
|
||||
firewall status, last 20 log entries and nat. When the log entry
|
||||
display changes, an audible alarm is sounded.</li>
|
||||
<li>shorewall hits - Produces several reports about the Shorewall
|
||||
packet log messages in the current /var/log/messages file.</li>
|
||||
<li>shorewall version - Displays the installed version
|
||||
number.</li>
|
||||
<li>shorewall check - Performs a <u>cursory</u> validation of the
|
||||
zones, interfaces, hosts, rules and policy files.<br>
|
||||
<br>
|
||||
<font size="4" color="#ff6666"><b>The "check" command is totally unsuppored
|
||||
and does not parse and validate the generated iptables commands.
|
||||
Even though the "check" command completes successfully, the configuration
|
||||
may fail to start. Problem reports that complain about errors that the 'check'
|
||||
command does not detect will not be accepted.<br>
|
||||
<br>
|
||||
See the recommended way to make configuration changes described below.</b></font><br>
|
||||
</li>
|
||||
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
||||
] - Restart shorewall using the specified configuration and if an
|
||||
error occurs or if the<i> timeout </i> option is given and the new configuration
|
||||
has been up for that many seconds then shorewall is restarted using
|
||||
the standard configuration.</li>
|
||||
] - Restart shorewall using the specified configuration and if
|
||||
an error occurs or if the<i> timeout </i> option is given and the
|
||||
new configuration has been up for that many seconds then shorewall
|
||||
is restarted using the standard configuration.</li>
|
||||
<li>shorewall deny, shorewall reject, shorewall accept and
|
||||
shorewall save implement <a href="blacklisting_support.htm">dynamic
|
||||
blacklisting</a>.</li>
|
||||
@ -168,14 +179,15 @@ Adds the specified interface (and host if included) to the specified zone.</l
|
||||
|
||||
<blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- adds the address 192.0.2.24 from interface ipsec0 to the zone vpn1<br>
|
||||
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- deletes the address 192.0.2.24 from interface ipsec0 from zone vpn1<br>
|
||||
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24
|
||||
vpn1</b></font> -- deletes the address 192.0.2.24 from interface ipsec0
|
||||
from zone vpn1<br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p> The <b>shorewall start</b>, <b>shorewall restart, </b>and <b>shorewall
|
||||
try </b>commands allow you to specify which <a
|
||||
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check, </b>and
|
||||
<b>shorewall try </b>commands allow you to specify which <a
|
||||
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
||||
to use:</p>
|
||||
|
||||
@ -183,15 +195,16 @@ try </b>commands allow you to specify which <a
|
||||
<blockquote>
|
||||
|
||||
|
||||
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart}<br>
|
||||
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
|
||||
shorewall try <i>configuration-directory</i></p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
||||
is going to use a file in /etc/shorewall it will first look in the <i>configuration-directory</i>
|
||||
. If the file is present in the <i>configuration-directory</i>, that
|
||||
file will be used; otherwise, the file in /etc/shorewall will be used.</p>
|
||||
is going to use a file in /etc/shorewall it will first look in the
|
||||
<i>configuration-directory</i> . If the file is present in the <i>configuration-directory</i>,
|
||||
that file will be used; otherwise, the file in /etc/shorewall will be
|
||||
used.</p>
|
||||
|
||||
|
||||
|
||||
@ -210,6 +223,8 @@ try </b>commands allow you to specify which <a
|
||||
|
||||
<li><copy any files that you need to change from
|
||||
/etc/shorewall to . and change them here></li>
|
||||
<li><font color="#009900"><b>shorewall -c . check</b></font></li>
|
||||
<li><correct any errors found by check and check again></li>
|
||||
|
||||
|
||||
<li><font color="#009900"><b>/sbin/shorewall
|
||||
@ -253,10 +268,11 @@ try .</b></font></li>
|
||||
|
||||
<p> <br>
|
||||
</p>
|
||||
You will note that the commands that result in state transitions use
|
||||
the word "firewall" rather than "shorewall". That is because the actual
|
||||
You will note that the commands that result in state transitions
|
||||
use the word "firewall" rather than "shorewall". That is because the actual
|
||||
transitions are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
|
||||
on Debian); /sbin/shorewall runs 'firewall" according to the following table:<br>
|
||||
on Debian); /sbin/shorewall runs 'firewall" according to the following
|
||||
table:<br>
|
||||
<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="2" border="1">
|
||||
@ -310,25 +326,13 @@ on Debian); /sbin/shorewall runs 'firewall" according to the following table:<b
|
||||
</table>
|
||||
<br>
|
||||
|
||||
<p><font size="2"> Updated 2/10/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
<p><font size="2"> Updated 2/27/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
||||
|
||||
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user