diff --git a/Shorewall-docs/whitelisting_under_shorewall.htm b/Shorewall-docs/whitelisting_under_shorewall.htm deleted file mode 100644 index b23f190a7..000000000 --- a/Shorewall-docs/whitelisting_under_shorewall.htm +++ /dev/null @@ -1,267 +0,0 @@ - - - - - - - - Whitelisting under Shorewall - - -

Whitelisting under Shorewall
-

-

For a brief time, the 1.2 version of Shorewall -supported -an /etc/shorewall/whitelist file. This file was intended to contain a -list -of IP addresses of hosts whose POLICY to all zones was ACCEPT. The -whitelist file was implemented as a stop-gap measure until the -facilities necessary for implementing white lists using zones was in -place. As of Version 1.3 RC1, those facilities were available.

-

White lists are most often used to give special -privileges to a set  of hosts within an organization. Let us -suppose that we have the following environment:

- -

The basic approach will be that we will place the -operations staff's class C in its own zone called ops. Here are -the appropriate configuration files:

-

Zone File

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ZONE DISPLAY COMMENTS
netNetInternet
opsOperationsOperations Staff's Class C
locLocalLocal Class B
dmzDMZDemilitarized zone
-
-

The ops zone has been added to the standard 3-zone zones -file -- since ops is a sub-zone of loc, we list it BEFORE -loc.

-

Interfaces File

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
ZONE INTERFACE BROADCAST OPTIONS
neteth0<whatever><options>
dmzeth1<whatever>
-
-eth210.10.255.255 
-
-

Because eth2 interfaces to two zones (ops and loc), -we don't specify a zone for it here.

-

Hosts File

-
- - - - - - - - - - - - - - - - - - -
ZONE HOST(S) OPTIONS
opseth2:10.10.10.0/24
-
loceth2:0.0.0.0/0 
-
-

Here we define the ops and loc zones. When Shorewall -is stopped, -only the hosts in the ops zone will be allowed to access the -firewall -and the DMZ. I use 0.0.0.0/0 to define the loc zone rather than -10.10.0.0/16 -so that the limited broadcast address (255.255.255.255) falls into that -zone. If I used 10.10.0.0/16 then I would have to have a separate entry -for that special address.

-

Policy File

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SOURCEDEST POLICY LOG LEVELLIMIT:BURST
opsallACCEPT  
allopsCONTINUE  
locnetACCEPT  
netallDROPinfo 
allallREJECTinfo 
-
-

Two entries for ops have been added to the standard 3-zone -policy file.

-

Rules File

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ACTIONSOURCEDEST PROTODEST
-PORT(S)		SOURCE
-PORT(S)		ORIGINAL
-DEST
REDIRECTloc!ops3128tcphttp  
...      
-
-

This is the rule that transparently redirects web traffic to the -transparent proxy running on the firewall. The SOURCE column explicitly -excludes the ops zone from the rule.

-

Routestopped File

-
- - - - - - - - - - - - - - - -
INTERFACE
- 		HOST(S)
eth1
-
-
eth2
- 		10.10.10.0/24
-
-
-

Updated 2/18/2003 - Tom Eastep -

-

Copyright -© 2002, 2003Thomas M. Eastep.

-
-
-
- -