mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-31 10:38:55 +01:00
More updates to MyNetwork
This commit is contained in:
Tom Eastep
parent
70dfdb517e
commit
4cd41a81f7
@ -165,7 +165,7 @@
|
||||
show correct usage, they don't necessarily provide any useful benefit. I
|
||||
have tried to point those out in the sub-sections that follow.</para>
|
||||
|
||||
<section>
|
||||
<section id="params">
|
||||
<title>/etc/shorewall/params</title>
|
||||
|
||||
<para><programlisting>MIRRORS=62.216.169.37,\
|
||||
@ -186,7 +186,7 @@ VPS_IF=venet0</programlisting>As shown, this file defines variables to hold
|
||||
and the network interfaces.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="conf">
|
||||
<title>/etc/shorewall/shorewall.conf</title>
|
||||
|
||||
<para><programlisting>###############################################################################
|
||||
@ -300,7 +300,7 @@ TCP_FLAGS_DISPOSITION=DROP
|
||||
there</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="zones">
|
||||
<title>/etc/shorewall/zones</title>
|
||||
|
||||
<para><programlisting>fw firewall
|
||||
@ -318,7 +318,7 @@ drct:loc ipv4 #Direct internet access</programlisting>The
|
||||
registration) don't work through the proxy.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="interfaces">
|
||||
<title>/etc/shorewall/interfaces</title>
|
||||
|
||||
<para><programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
||||
@ -328,9 +328,24 @@ net $EXT_IF detect dhcp,blacklist,tcpflags,optional,routefilter=0,nosmu
|
||||
net $COM_IF detect dhcp,blacklist,tcpflags,optional,upnp,routefilter=0,nosmurfs,logmartians=0
|
||||
loc tun+ detect</programlisting>Notice that VPN clients are treated
|
||||
the same as local hosts.</para>
|
||||
|
||||
<para>I set the <emphasis role="bold">proxyarp</emphasis> option on
|
||||
$EXT_IF so that </para>
|
||||
|
||||
<orderedlist numeration="loweralpha">
|
||||
<listitem>
|
||||
<para>The firewall will respond to ARP who-has requests for the
|
||||
servers in the DMZ.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>To keep OpenVZ happy (it issues dire warnings if the option is
|
||||
not set on the associated external interface).</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="hosts">
|
||||
<title>/etc/shorewall/hosts</title>
|
||||
|
||||
<para><programlisting>#ZONE HOST(S) OPTIONS
|
||||
@ -345,7 +360,7 @@ drct $INT_IF:dynamic</programlisting>The <emphasis
|
||||
role="bold">loc</emphasis>).</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="policy">
|
||||
<title>/etc/shorewall/policy</title>
|
||||
|
||||
<para><programlisting>#SOURCE DEST POLICY LOG LIMIT:BURST
|
||||
@ -366,7 +381,7 @@ all all REJECT $LOG</programlisting>I'm a bit
|
||||
someday...</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="accounting">
|
||||
<title>/etc/shorewall/accounting</title>
|
||||
|
||||
<para><programlisting>#ACTION CHAIN SOURCE DESTINATION PROTO DEST SOURCE USER/
|
||||
@ -411,7 +426,7 @@ COUNT web $VPS_IF:206.124.146.0/24 $EXT_IF
|
||||
</orderedlist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="blacklist">
|
||||
<title>/etc/shorewall/blacklist</title>
|
||||
|
||||
<para><programlisting>#ADDRESS/SUBNET PROTOCOL PORT
|
||||
@ -421,7 +436,7 @@ COUNT web $VPS_IF:206.124.146.0/24 $EXT_IF
|
||||
traffic.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="compile">
|
||||
<title>/etc/shorewall/compile</title>
|
||||
|
||||
<para><programlisting>use strict;
|
||||
@ -438,7 +453,7 @@ add_rule $chainref, q(-j ACCEPT);
|
||||
created.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="findgw">
|
||||
<title>/etc/shorewall/findgw</title>
|
||||
|
||||
<para><programlisting>if [ -f /var/lib/dhcp3/dhclient.${1}.leases ]; then
|
||||
@ -447,7 +462,7 @@ fi</programlisting>The Comcast line has a dynamic IP address assigned with the
|
||||
help of dhclient.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="isusable">
|
||||
<title>/etc/shorewall/isusable</title>
|
||||
|
||||
<para><programlisting>local status
|
||||
@ -459,7 +474,7 @@ return $status</programlisting>For use with <ulink
|
||||
url="MultiISP.html#lsm">lsm</ulink>.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="libprivate">
|
||||
<title>/etc/shorewall/lib.private</title>
|
||||
|
||||
<para><programlisting>start_lsm() {
|
||||
@ -486,7 +501,7 @@ EOF
|
||||
url="MultiISP.html#lsm">lsm</ulink>.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="masq">
|
||||
<title>/etc/shorewall/masq</title>
|
||||
|
||||
<para><programlisting>#INTERFACE SOURCE ADDRESS
|
||||
@ -527,14 +542,15 @@ Comcast 2 0x20000 main $COM_IF detect track,balance
|
||||
the multi-ISP aspects of this configuration.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="proxyarp">
|
||||
<title>/etc/shorewall/proxyarp</title>
|
||||
|
||||
<para><programlisting><empty></programlisting>I let OpenVZ
|
||||
configure the Proxy ARP for my servers.</para>
|
||||
<para><programlisting><empty></programlisting>As mentioned <link
|
||||
linkend="interfaces">above</link>, I set the proxyarp on the associated
|
||||
external interface instead of defining proxy ARP in this file.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="restored">
|
||||
<title>/etc/shorewall/restored</title>
|
||||
|
||||
<para><programlisting>if [ -z "$(ps ax | grep 'lsm ' | grep -v 'grep ' )" ]; then
|
||||
@ -545,7 +561,7 @@ chmod 744 ${VARDIR}/state</programlisting>If lsm isn't running then start it.
|
||||
Make the state file world-readable.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="route_rules">
|
||||
<title>/etc/shorewall/route_rules</title>
|
||||
|
||||
<para><programlisting>#SOURCE DEST PROVIDER PRIORITY
|
||||
@ -560,7 +576,7 @@ chmod 744 ${VARDIR}/state</programlisting>If lsm isn't running then start it.
|
||||
interface.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="routestopped">
|
||||
<title>/etc/shorewall/routestopped</title>
|
||||
|
||||
<para><programlisting>#INTERFACE HOST(S) OPTIONS PROTO
|
||||
@ -570,7 +586,7 @@ $EXT_IF - notrack 41</programlistin
|
||||
the lights on while Shorewall is stopped.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="rules">
|
||||
<title>/etc/shorewall/rules</title>
|
||||
|
||||
<para><programlisting>###############################################################################################################################################################################
|
||||
@ -708,7 +724,7 @@ COMMENT
|
||||
ACCEPT any any icmp 8</programlisting></para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="started">
|
||||
<title>/etc/shorewall/started</title>
|
||||
|
||||
<para><programlisting>if [ -z "$(ps ax | grep 'lsm ' | grep -v 'grep ' )" ]; then
|
||||
@ -719,7 +735,7 @@ chmod 744 ${VARDIR}/state</programlisting>If lsm isn't running then start it.
|
||||
Make the state file world-readable.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="stopped">
|
||||
<title>/etc/shorewall/stopped</title>
|
||||
|
||||
<para><programlisting>if [ "$COMMAND" = stop -o "$COMMAND" = clear ]; then
|
||||
@ -730,7 +746,7 @@ chmod 744 ${VARDIR}/state</programlisting>Kill lsm if the command is stop or
|
||||
clear. Make the state file world-readable.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<section id="tunnels">
|
||||
<title>/etc/shorewall/tunnels</title>
|
||||
|
||||
<para><programlisting>#TYPE ZONE GATEWAY GATEWAY
|
||||
|
||||
Loading…
Reference in New Issue
Block a user