mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-15 19:01:19 +01:00
Documentation Updates
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@448 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
5f259f6070
commit
6dd91309a8
File diff suppressed because it is too large
Load Diff
@ -2,147 +2,148 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>ICMP Echo-request (Ping)</title>
|
||||
|
||||
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
Shorewall 'Ping' management has evolved over time with the latest change
|
||||
coming in Shorewall version 1.3.14. In that version, a new option (<b>OLD_PING_HANDLING</b>)
|
||||
was added to /etc/shorewall/shorewall.conf. The value of that option determines
|
||||
the overall handling of ICMP echo requests (pings).<br>
|
||||
|
||||
<br>
|
||||
Shorewall 'Ping' management has evolved over time with the latest change
|
||||
coming in Shorewall version 1.3.14. In that version, a new option (<b>OLD_PING_HANDLING</b>)
|
||||
was added to /etc/shorewall/shorewall.conf. The value of that option determines
|
||||
the overall handling of ICMP echo requests (pings).<br>
|
||||
|
||||
<h2>Shorewall Versions >= 1.3.14 with OLD_PING_HANDLING=No in /etc/shorewall/shorewall.conf</h2>
|
||||
In 1.3.14, Ping handling was put under control of the rules and policies
|
||||
just like any other connection request. In order to accept ping requests from
|
||||
zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you need
|
||||
a rule in /etc/shoreall/rules of the form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
In 1.3.14, Ping handling was put under control of the rules and policies
|
||||
just like any other connection request. In order to accept ping requests
|
||||
from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT and z1
|
||||
is not the firewall zone, you need a rule in /etc/shoreall/rules of the form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
already exist and in that file place the following command:<br>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||
you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||
you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
|
||||
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
|
||||
</h2>
|
||||
There are several aspects to the old Shorewall Ping management:<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
||||
<li>The <b>FORWARDPING</b> option in<a href="Documentation.htm#Conf">
|
||||
/etc/shorewall/shorewall.conf</a>.</li>
|
||||
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ol>
|
||||
There are two cases to consider:<br>
|
||||
|
||||
<ol>
|
||||
<li>Ping requests addressed to the firewall itself; and</li>
|
||||
<li>Ping requests being forwarded to another system. Included here are
|
||||
all cases of packet forwarding including NAT, DNAT rule, Proxy ARP and simple
|
||||
routing.</li>
|
||||
|
||||
</ol>
|
||||
These cases will be covered separately.<br>
|
||||
|
||||
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
||||
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
||||
|
||||
<ol>
|
||||
<li>If neither <b>noping</b> nor <b>filterping </b>are specified for
|
||||
the interface that receives the ping request then the request will be responded
|
||||
to with an ICMP echo-reply.</li>
|
||||
<li>If <b>noping</b> is specified for the interface that receives the
|
||||
ping request then the request is ignored.</li>
|
||||
<li>If <b>filterping </b>is specified for the interface then the request
|
||||
is passed to the rules/policy evaluation.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3>Ping Requests Forwarded by the Firewall</h3>
|
||||
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
||||
|
||||
<h3>Rules Evaluation</h3>
|
||||
Ping requests are ICMP type 8. So the general rule format is:<br>
|
||||
<br>
|
||||
<i>Target Source
|
||||
Destination </i>icmp 8<br>
|
||||
<br>
|
||||
Example 1. Accept pings from the net to the dmz (pings are responded to
|
||||
with an ICMP echo-reply):<br>
|
||||
<br>
|
||||
ACCEPT net dmz
|
||||
icmp 8<br>
|
||||
<br>
|
||||
Example 2. Drop pings from the net to the firewall<br>
|
||||
<br>
|
||||
DROP net fw
|
||||
icmp 8<br>
|
||||
|
||||
<h3>Policy Evaluation</h3>
|
||||
If no applicable rule is found, then the policy for the source to the destination
|
||||
is applied.<br>
|
||||
|
||||
<ol>
|
||||
<li>If the relevant policy is ACCEPT then the request is responded to
|
||||
with an ICMP echo-reply.</li>
|
||||
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
||||
then the request is responded to with an ICMP echo-reply.</li>
|
||||
<li>Otherwise, the relevant REJECT or DROP policy is used and the request
|
||||
is either rejected or simply ignored.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><font size="2">Updated 1/21/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
</h2>
|
||||
There are several aspects to the old Shorewall Ping management:<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
||||
<li>The <b>FORWARDPING</b> option in<a
|
||||
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
||||
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ol>
|
||||
There are two cases to consider:<br>
|
||||
|
||||
<ol>
|
||||
<li>Ping requests addressed to the firewall itself; and</li>
|
||||
<li>Ping requests being forwarded to another system. Included here are
|
||||
all cases of packet forwarding including NAT, DNAT rule, Proxy ARP and simple
|
||||
routing.</li>
|
||||
|
||||
</ol>
|
||||
These cases will be covered separately.<br>
|
||||
|
||||
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
||||
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
||||
|
||||
<ol>
|
||||
<li>If neither <b>noping</b> nor <b>filterping </b>are specified for
|
||||
the interface that receives the ping request then the request will be responded
|
||||
to with an ICMP echo-reply.</li>
|
||||
<li>If <b>noping</b> is specified for the interface that receives the
|
||||
ping request then the request is ignored.</li>
|
||||
<li>If <b>filterping </b>is specified for the interface then the request
|
||||
is passed to the rules/policy evaluation.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3>Ping Requests Forwarded by the Firewall</h3>
|
||||
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
||||
|
||||
<h3>Rules Evaluation</h3>
|
||||
Ping requests are ICMP type 8. So the general rule format is:<br>
|
||||
<br>
|
||||
<i>Target Source
|
||||
Destination </i>icmp 8<br>
|
||||
<br>
|
||||
Example 1. Accept pings from the net to the dmz (pings are responded to
|
||||
with an ICMP echo-reply):<br>
|
||||
<br>
|
||||
ACCEPT net dmz
|
||||
icmp 8<br>
|
||||
<br>
|
||||
Example 2. Drop pings from the net to the firewall<br>
|
||||
<br>
|
||||
DROP net fw
|
||||
icmp 8<br>
|
||||
|
||||
<h3>Policy Evaluation</h3>
|
||||
If no applicable rule is found, then the policy for the source to the
|
||||
destination is applied.<br>
|
||||
|
||||
<ol>
|
||||
<li>If the relevant policy is ACCEPT then the request is responded to
|
||||
with an ICMP echo-reply.</li>
|
||||
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
||||
then the request is responded to with an ICMP echo-reply.</li>
|
||||
<li>Otherwise, the relevant REJECT or DROP policy is used and the request
|
||||
is either rejected or simply ignored.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><font size="2">Updated 2/14/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
@ -15,22 +15,22 @@
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
@ -39,15 +39,15 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font color="#ffffff">Shorewall
|
||||
1.3 - <font size="4">"<i>iptables
|
||||
made easy"</i></font></font></h1>
|
||||
</a></i></font><font color="#ffffff">Shorewall
|
||||
1.3 - <font size="4">"<i>iptables
|
||||
made easy"</i></font></font></h1>
|
||||
|
||||
|
||||
|
||||
@ -56,42 +56,44 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a
|
||||
href="http://shorewall.sf.net/1.2/index.html" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.2 Site here</font></a><br>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
<center>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
@ -100,7 +102,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
@ -112,7 +115,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
@ -127,28 +130,29 @@ firewall that can be used on a dedicated firewall system, a multi-functio
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of
|
||||
<a href="http://www.gnu.org/licenses/gpl.html">Version 2 of
|
||||
it under the terms of
|
||||
<a href="http://www.gnu.org/licenses/gpl.html">Version 2 of
|
||||
the GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
This program is distributed in the
|
||||
hope that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
This program is distributed in
|
||||
the hope that it will be useful, but WITHOUT
|
||||
ANY WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License for
|
||||
more details.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
You should have received a copy of
|
||||
the GNU General Public License along
|
||||
with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 675 Mass Ave, Cambridge, MA
|
||||
02139, USA</p>
|
||||
You should have received a copy
|
||||
of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||
MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
@ -159,7 +163,7 @@ with this program; if not, write to the Free Software
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
@ -171,28 +175,30 @@ with this program; if not, write to the Free Software
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called <i>Bering</i>
|
||||
that features Shorewall-1.3.10 and Kernel-2.4.18.
|
||||
You can find their work at: <a
|
||||
</a>Jacques Nilo and Eric
|
||||
Wolzak have a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called <i>Bering</i>
|
||||
that features Shorewall-1.3.10 and Kernel-2.4.18.
|
||||
You can find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>Congratulations to Jacques and Eric on the recent release of
|
||||
Bering 1.0 Final!!! </b><br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>This is a mirror of the main Shorewall web site at SourceForge
|
||||
(<a href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
||||
|
||||
@ -207,7 +213,8 @@ Bering 1.0 Final!!! </b><br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
@ -219,7 +226,7 @@ Bering 1.0 Final!!! </b><br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2></h2>
|
||||
|
||||
|
||||
@ -228,116 +235,135 @@ Bering 1.0 Final!!! </b><br>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>2/8/2003 - Shoreawll 1.3.14</b><b> </b><b><img
|
||||
|
||||
<p><b>2/8/2003 - Shorewall 1.3.14</b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
</b></p>
|
||||
|
||||
<p>New features include</p>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>An OLD_PING_HANDLING option has been added to shorewall.conf.
|
||||
When set to Yes, Shorewall ping handling is as it has always been (see
|
||||
http://www.shorewall.net/ping.html).<br>
|
||||
<li>An OLD_PING_HANDLING option has been added to shorewall.conf.
|
||||
When set to Yes, Shorewall ping handling is as it has always been (see
|
||||
http://www.shorewall.net/ping.html).<br>
|
||||
<br>
|
||||
When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules
|
||||
and policies just like any other connection request. The FORWARDPING=Yes
|
||||
option in shorewall.conf and the 'noping' and 'filterping' options in
|
||||
/etc/shorewall/interfaces will all generate an error.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>It is now possible to direct Shorewall to create a "label"
|
||||
such as "eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes
|
||||
and ADD_SNAT_ALIASES=Yes. This is done by specifying the label instead
|
||||
of just the interface name:<br>
|
||||
<br>
|
||||
a) In the INTERFACE column of /etc/shorewall/masq<br>
|
||||
b) In the INTERFACE column of /etc/shorewall/nat<br>
|
||||
</li>
|
||||
<li>Support for OpenVPN Tunnels.<br>
|
||||
<br>
|
||||
When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and
|
||||
policies just like any other connection request. The FORWARDPING=Yes option
|
||||
in shorewall.conf and the 'noping' and 'filterping' options in /etc/shorewall/interfaces
|
||||
will all generate an error.<br>
|
||||
</li>
|
||||
<li>Support for VLAN devices with names of the form $DEV.$VID
|
||||
(e.g., eth0.0)<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/tcrules, the MARK value may be optionally followed
|
||||
by ":" and either 'F' or 'P' to designate that the marking will occur in
|
||||
the FORWARD or PREROUTING chains respectively. If this additional specification
|
||||
is omitted, the chain used to mark packets will be determined by the setting
|
||||
of the MARK_IN_FORWARD_CHAIN option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>It is now possible to direct Shorewall to create a "label" such
|
||||
as "eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes
|
||||
and ADD_SNAT_ALIASES=Yes. This is done by specifying the label instead
|
||||
of just the interface name:<br>
|
||||
<br>
|
||||
a) In the INTERFACE column of /etc/shorewall/masq<br>
|
||||
b) In the INTERFACE column of /etc/shorewall/nat<br>
|
||||
</li>
|
||||
<li>Support for OpenVPN Tunnels.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for VLAN devices with names of the form $DEV.$VID (e.g.,
|
||||
eth0.0)<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When an interface name is entered in the SUBNET column of the
|
||||
/etc/shorewall/masq file, Shorewall previously masqueraded traffic from
|
||||
only the first subnet defined on that interface. It did not masquerade
|
||||
traffic from:<br>
|
||||
<br>
|
||||
a) The subnets associated with other addresses on the interface.<br>
|
||||
b) Subnets accessed through local routers.<br>
|
||||
<br>
|
||||
Beginning with Shorewall 1.3.14, if you enter an interface name in the
|
||||
SUBNET column, shorewall will use the firewall's routing table to construct
|
||||
the masquerading/SNAT rules.<br>
|
||||
<br>
|
||||
Example 1 -- This is how it works in 1.3.14.<br>
|
||||
<br>
|
||||
|
||||
<li>When an interface name is entered in the SUBNET column of
|
||||
the /etc/shorewall/masq file, Shorewall previously masqueraded traffic
|
||||
from only the first subnet defined on that interface. It did not masquerade
|
||||
traffic from:<br>
|
||||
<br>
|
||||
a) The subnets associated with other addresses on the interface.<br>
|
||||
b) Subnets accessed through local routers.<br>
|
||||
<br>
|
||||
Beginning with Shorewall 1.3.14, if you enter an interface name
|
||||
in the SUBNET column, shorewall will use the firewall's routing table
|
||||
to construct the masquerading/SNAT rules.<br>
|
||||
<br>
|
||||
Example 1 -- This is how it works in 1.3.14.<br>
|
||||
<br>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br></pre>
|
||||
|
||||
|
||||
|
||||
<pre> [root@gateway test]# shorewall start<br> ...<br> Masqueraded Subnets and Hosts:<br> To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176<br> To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176<br> Processing /etc/shorewall/tos...</pre>
|
||||
<br>
|
||||
When upgrading to Shorewall 1.3.14, if you have multiple local subnets
|
||||
connected to an interface that is specified in the SUBNET column of an /etc/shorewall/masq
|
||||
entry, your /etc/shorewall/masq file will need changing. In most cases,
|
||||
you will simply be able to remove redundant entries. In some cases though,
|
||||
you might want to change from using the interface name to listing specific
|
||||
subnetworks if the change described above will cause masquerading to occur
|
||||
on subnetworks that you don't wish to masquerade.<br>
|
||||
<br>
|
||||
Example 2 -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
When upgrading to Shorewall 1.3.14, if you have multiple local subnets
|
||||
connected to an interface that is specified in the SUBNET column of an
|
||||
/etc/shorewall/masq entry, your /etc/shorewall/masq file will need changing.
|
||||
In most cases, you will simply be able to remove redundant entries. In some
|
||||
cases though, you might want to change from using the interface name to
|
||||
listing specific subnetworks if the change described above will cause masquerading
|
||||
to occur on subnetworks that you don't wish to masquerade.<br>
|
||||
<br>
|
||||
Example 2 -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
<br>
|
||||
In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
<br>
|
||||
Example 3 -- What if your current configuration is like this?<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
<br>
|
||||
Example 3 -- What if your current configuration is like this?<br>
|
||||
<br>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
<br>
|
||||
In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
|
||||
<br>
|
||||
In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
|
||||
|
||||
<pre> #INTERFACE SUBNET ADDRESS<br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
|
||||
<p><b>2/5/2003 - Shorewall Support included in Webmin 1.06</b><b>0
|
||||
</b><b><img border="0" src="images/new10.gif" width="28"
|
||||
height="12" alt="(New)">
|
||||
</b></p>
|
||||
Webmin version 1.060 now has Shorewall support included as standard. See
|
||||
<a href="http://www.webmin.com">http://www.webmin.com</a>.<b> </b>
|
||||
|
||||
</b></p>
|
||||
Webmin version 1.060 now has Shorewall support included as standard.
|
||||
See <a href="http://www.webmin.com">http://www.webmin.com</a>.<b>
|
||||
</b>
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b></b><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
@ -349,40 +375,44 @@ on subnetworks that you don't wish to masquerade.<br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
</td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
valign="top" align="center"> <a
|
||||
href="http://sourceforge.net">M</a></td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</center>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
@ -390,13 +420,12 @@ on subnetworks that you don't wish to masquerade.<br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
@ -406,30 +435,32 @@ on subnetworks that you don't wish to masquerade.<br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 2/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<p><font size="2">Updated 2/13/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -6,7 +6,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
@ -15,22 +15,22 @@
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
@ -40,16 +40,16 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font color="#ffffff">Shorewall
|
||||
1.3 - <font size="4">"<i>iptables
|
||||
made easy"</i></font></font><a href="http://www.sf.net">
|
||||
</a></h1>
|
||||
</a></i></font><font
|
||||
color="#ffffff">Shorewall 1.3 - <font
|
||||
size="4">"<i>iptables made easy"</i></font></font><a
|
||||
href="http://www.sf.net"> </a></h1>
|
||||
|
||||
|
||||
|
||||
@ -59,34 +59,35 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="/1.2/index.html" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.2 Site here</font></a></div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
@ -96,7 +97,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
@ -109,11 +110,12 @@
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall system,
|
||||
a multi-function gateway/router/server or on a standalone GNU/Linux
|
||||
system.</p>
|
||||
|
||||
|
||||
|
||||
@ -125,29 +127,29 @@
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of
|
||||
<a href="http://www.gnu.org/licenses/gpl.html">Version 2 of
|
||||
the GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the terms
|
||||
of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
You should have received a copy
|
||||
of the GNU General Public License
|
||||
along with this program; if not, write to the Free
|
||||
Software Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||
MA 02139, USA</p>
|
||||
You should have received a
|
||||
copy of the GNU General Public License
|
||||
along with this program; if not, write to the
|
||||
Free Software Foundation, Inc., 675 Mass Ave,
|
||||
Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
@ -159,7 +161,7 @@ Software Foundation, Inc., 675 Mass Ave, Cambridge
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
@ -172,23 +174,23 @@ Software Foundation, Inc., 675 Mass Ave, Cambridge
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques Nilo and Eric
|
||||
Wolzak have a LEAF (router/firewall/gateway on
|
||||
a floppy, CD or compact flash) distribution called
|
||||
<i>Bering</i> that features Shorewall-1.3.10
|
||||
and Kernel-2.4.18. You can find their work at:
|
||||
</a>Jacques Nilo and
|
||||
Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution called
|
||||
<i>Bering</i> that features Shorewall-1.3.10
|
||||
and Kernel-2.4.18. You can find their work at:
|
||||
<a href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
<b>Congratulations to Jacques and
|
||||
Eric on the recent release of Bering 1.0 Final!!! <br>
|
||||
</b>
|
||||
<b>Congratulations to Jacques
|
||||
and Eric on the recent release of Bering 1.0 Final!!! <br>
|
||||
</b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
@ -203,99 +205,107 @@ a floppy, CD or compact flash) distribution called
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>2/8/2003 - Shoreawll 1.3.14</b><b> </b><b><img
|
||||
|
||||
<p><b>2/8/2003 - Shorewall 1.3.14</b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
</b></p>
|
||||
|
||||
<p>New features include</p>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>An OLD_PING_HANDLING option has been added to shorewall.conf.
|
||||
When set to Yes, Shorewall ping handling is as it has always been (see
|
||||
<li>An OLD_PING_HANDLING option has been added to shorewall.conf.
|
||||
When set to Yes, Shorewall ping handling is as it has always been (see
|
||||
http://www.shorewall.net/ping.html).<br>
|
||||
<br>
|
||||
When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and
|
||||
policies just like any other connection request. The FORWARDPING=Yes option
|
||||
in shorewall.conf and the 'noping' and 'filterping' options in /etc/shorewall/interfaces
|
||||
will all generate an error.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>It is now possible to direct Shorewall to create a "label" such
|
||||
as "eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes
|
||||
and ADD_SNAT_ALIASES=Yes. This is done by specifying the label instead
|
||||
of just the interface name:<br>
|
||||
<br>
|
||||
a) In the INTERFACE column of /etc/shorewall/masq<br>
|
||||
b) In the INTERFACE column of /etc/shorewall/nat<br>
|
||||
</li>
|
||||
<li>Support for OpenVPN Tunnels.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for VLAN devices with names of the form $DEV.$VID (e.g.,
|
||||
eth0.0)<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When an interface name is entered in the SUBNET column of the
|
||||
/etc/shorewall/masq file, Shorewall previously masqueraded traffic from
|
||||
only the first subnet defined on that interface. It did not masquerade
|
||||
<br>
|
||||
When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules
|
||||
and policies just like any other connection request. The FORWARDPING=Yes
|
||||
option in shorewall.conf and the 'noping' and 'filterping' options in
|
||||
/etc/shorewall/interfaces will all generate an error.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>It is now possible to direct Shorewall to create a "label"
|
||||
such as "eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes
|
||||
and ADD_SNAT_ALIASES=Yes. This is done by specifying the label instead of
|
||||
just the interface name:<br>
|
||||
<br>
|
||||
a) In the INTERFACE column of /etc/shorewall/masq<br>
|
||||
b) In the INTERFACE column of /etc/shorewall/nat<br>
|
||||
</li>
|
||||
<li>Support for OpenVPN Tunnels.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for VLAN devices with names of the form $DEV.$VID
|
||||
(e.g., eth0.0)<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>In /etc/shorewall/tcrules, the MARK value may be optionally followed
|
||||
by ":" and either 'F' or 'P' to designate that the marking will occur in
|
||||
the FORWARD or PREROUTING chains respectively. If this additional specification
|
||||
is omitted, the chain used to mark packets will be determined by the setting
|
||||
of the MARK_IN_FORWARD_CHAIN option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When an interface name is entered in the SUBNET column of
|
||||
the /etc/shorewall/masq file, Shorewall previously masqueraded traffic
|
||||
from only the first subnet defined on that interface. It did not masquerade
|
||||
traffic from:<br>
|
||||
<br>
|
||||
a) The subnets associated with other addresses on the interface.<br>
|
||||
b) Subnets accessed through local routers.<br>
|
||||
<br>
|
||||
Beginning with Shorewall 1.3.14, if you enter an interface name in the
|
||||
SUBNET column, shorewall will use the firewall's routing table to construct
|
||||
the masquerading/SNAT rules.<br>
|
||||
<br>
|
||||
Example 1 -- This is how it works in 1.3.14.<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
a) The subnets associated with other addresses on the interface.<br>
|
||||
b) Subnets accessed through local routers.<br>
|
||||
<br>
|
||||
Beginning with Shorewall 1.3.14, if you enter an interface name in
|
||||
the SUBNET column, shorewall will use the firewall's routing table to
|
||||
construct the masquerading/SNAT rules.<br>
|
||||
<br>
|
||||
Example 1 -- This is how it works in 1.3.14.<br>
|
||||
<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br></pre>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# shorewall start<br> ...<br> Masqueraded Subnets and Hosts:<br> To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176<br> To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176<br> Processing /etc/shorewall/tos...</pre>
|
||||
<br>
|
||||
When upgrading to Shorewall 1.3.14, if you have multiple local subnets
|
||||
connected to an interface that is specified in the SUBNET column of an /etc/shorewall/masq
|
||||
entry, your /etc/shorewall/masq file will need changing. In most cases,
|
||||
you will simply be able to remove redundant entries. In some cases though,
|
||||
you might want to change from using the interface name to listing specific
|
||||
subnetworks if the change described above will cause masquerading to occur
|
||||
on subnetworks that you don't wish to masquerade.<br>
|
||||
<br>
|
||||
Example 2 -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
When upgrading to Shorewall 1.3.14, if you have multiple local subnets
|
||||
connected to an interface that is specified in the SUBNET column of an
|
||||
/etc/shorewall/masq entry, your /etc/shorewall/masq file will need changing.
|
||||
In most cases, you will simply be able to remove redundant entries. In
|
||||
some cases though, you might want to change from using the interface name
|
||||
to listing specific subnetworks if the change described above will cause
|
||||
masquerading to occur on subnetworks that you don't wish to masquerade.<br>
|
||||
<br>
|
||||
Example 2 -- Suppose that your current config is as follows:<br>
|
||||
<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
<br>
|
||||
In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
<br>
|
||||
Example 3 -- What if your current configuration is like this?<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
In this case, the second entry in /etc/shorewall/masq is no longer
|
||||
required.<br>
|
||||
<br>
|
||||
Example 3 -- What if your current configuration is like this?<br>
|
||||
<br>
|
||||
|
||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
|
||||
|
||||
<pre> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||
<br>
|
||||
In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
|
||||
<br>
|
||||
In this case, you would want to change the entry in /etc/shorewall/masq
|
||||
to:<br>
|
||||
|
||||
<pre> #INTERFACE SUBNET ADDRESS<br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>2/5/2003 - Shorewall Support included in Webmin 1.06</b><b>0
|
||||
</b><b><img border="0" src="images/new10.gif" width="28"
|
||||
|
||||
<p><b>2/5/2003 - Shorewall Support included in Webmin 1.06</b><b>0
|
||||
</b><b><img border="0" src="images/new10.gif" width="28"
|
||||
height="12" alt="(New)">
|
||||
</b></p>
|
||||
Webmin version 1.060 now has Shorewall support included as standard.
|
||||
See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
</b>
|
||||
</b></p>
|
||||
Webmin version 1.060 now has Shorewall support included as standard.
|
||||
See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
</b>
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
@ -304,7 +314,8 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
@ -312,7 +323,8 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
@ -320,7 +332,8 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
@ -333,28 +346,31 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
||||
alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
</a></h1>
|
||||
</a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h4> </h4>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </h2>
|
||||
|
||||
@ -362,44 +378,44 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</center>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
@ -408,12 +424,12 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
@ -424,31 +440,31 @@ See <a href="http://www.webmin.com">http://www.webmin.com</a> <b>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 2/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
|
||||
<p><font size="2">Updated 2/14/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
|
||||
@ -1,13 +1,13 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Starting and Stopping Shorewall</title>
|
||||
@ -15,315 +15,316 @@
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="100%">
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
|
||||
the Firewall</font></h1>
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
|
||||
the Firewall</font></h1>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> If you have a permanent internet connection such as DSL or Cable,
|
||||
I recommend that you start the firewall automatically at boot. Once
|
||||
you have installed "firewall" in your init.d directory, simply type
|
||||
"chkconfig --add firewall". This will start the firewall in run
|
||||
levels 2-5 and stop it in run levels 1 and 6. If you want to configure
|
||||
your firewall differently from this default, you can use the "--level"
|
||||
option in chkconfig (see "man chkconfig") or using your favorite
|
||||
graphical run-level editor.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><strong><u> <font color="#000099"> Important Notes:</font></u></strong><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>Shorewall startup is disabled by default. Once you have configured
|
||||
your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.
|
||||
Note: Users of the .deb package must edit /etc/default/shorewall and set
|
||||
'startup=1'.<br>
|
||||
</li>
|
||||
<li>If you use dialup, you may want to start the firewall in
|
||||
your /etc/ppp/ip-up.local script. I recommend just placing "shorewall
|
||||
restart" in that script.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> You can manually start and stop Shoreline Firewall using the "shorewall"
|
||||
<p> If you have a permanent internet connection such as DSL or Cable,
|
||||
I recommend that you start the firewall automatically at boot. Once
|
||||
you have installed "firewall" in your init.d directory, simply type
|
||||
"chkconfig --add firewall". This will start the firewall in run
|
||||
levels 2-5 and stop it in run levels 1 and 6. If you want to configure
|
||||
your firewall differently from this default, you can use the "--level"
|
||||
option in chkconfig (see "man chkconfig") or using your favorite
|
||||
graphical run-level editor.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><strong><u> <font color="#000099"> Important Notes:</font></u></strong><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>Shorewall startup is disabled by default. Once you have configured
|
||||
your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.
|
||||
Note: Users of the .deb package must edit /etc/default/shorewall and
|
||||
set 'startup=1'.<br>
|
||||
</li>
|
||||
<li>If you use dialup, you may want to start the firewall in
|
||||
your /etc/ppp/ip-up.local script. I recommend just placing "shorewall
|
||||
restart" in that script.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> You can manually start and stop Shoreline Firewall using the "shorewall"
|
||||
shell program: </p>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li>shorewall start - starts the firewall</li>
|
||||
<li>shorewall stop - stops the firewall</li>
|
||||
<li>shorewall restart - stops the firewall (if it's
|
||||
running) and then starts it again</li>
|
||||
<li>shorewall reset - reset the packet and byte counters
|
||||
in the firewall</li>
|
||||
<li>shorewall clear - remove all rules and chains
|
||||
installed by Shoreline Firewall</li>
|
||||
<li>shorewall refresh - refresh the rules involving the broadcast
|
||||
<li>shorewall start - starts the firewall</li>
|
||||
<li>shorewall stop - stops the firewall</li>
|
||||
<li>shorewall restart - stops the firewall (if it's
|
||||
running) and then starts it again</li>
|
||||
<li>shorewall reset - reset the packet and byte counters
|
||||
in the firewall</li>
|
||||
<li>shorewall clear - remove all rules and chains
|
||||
installed by Shoreline Firewall</li>
|
||||
<li>shorewall refresh - refresh the rules involving the broadcast
|
||||
addresses of firewall interfaces and the black and white lists.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
If you include the keyword <i>debug</i> as the first argument, then a
|
||||
If you include the keyword <i>debug</i> as the first argument, then a
|
||||
shell trace of the command is produced as in:<br>
|
||||
|
||||
|
||||
<pre> <font color="#009900"><b>shorewall debug start 2> /tmp/trace</b></font><br></pre>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The above command would trace the 'start' command and place the trace information
|
||||
in the file /tmp/trace<br>
|
||||
</p>
|
||||
|
||||
<p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
|
||||
|
||||
<p>The above command would trace the 'start' command and place the trace
|
||||
information in the file /tmp/trace<br>
|
||||
</p>
|
||||
|
||||
<p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
|
||||
bottom of this page.<br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<p>The "shorewall" program may also be used to monitor the firewall.</p>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li>shorewall status - produce a verbose report about the firewall
|
||||
(iptables -L -n -v)</li>
|
||||
<li>shorewall show <i>chain</i> - produce a verbose report about
|
||||
<i>chain </i>(iptables -L <i>chain</i> -n -v)</li>
|
||||
<li>shorewall show nat - produce a verbose report about the nat
|
||||
<li>shorewall status - produce a verbose report about the firewall
|
||||
(iptables -L -n -v)</li>
|
||||
<li>shorewall show <i>chain</i> - produce a verbose report about
|
||||
<i>chain </i>(iptables -L <i>chain</i> -n -v)</li>
|
||||
<li>shorewall show nat - produce a verbose report about the nat
|
||||
table (iptables -t nat -L -n -v)</li>
|
||||
<li>shorewall show tos - produce a verbose report about the mangle
|
||||
table (iptables -t mangle -L -n -v)</li>
|
||||
<li>shorewall show log - display the last 20 packet log entries.</li>
|
||||
<li>shorewall show connections - displays the IP connections currently
|
||||
being tracked by the firewall.</li>
|
||||
<li>shorewall
|
||||
show
|
||||
tc - displays information
|
||||
about the traffic control/shaping configuration.</li>
|
||||
<li>shorewall monitor [ delay ] - Continuously display the firewall
|
||||
status, last 20 log entries and nat. When the log entry display
|
||||
changes, an audible alarm is sounded.</li>
|
||||
<li>shorewall hits - Produces several reports about the Shorewall
|
||||
<li>shorewall show tos - produce a verbose report about the mangle
|
||||
table (iptables -t mangle -L -n -v)</li>
|
||||
<li>shorewall show log - display the last 20 packet log entries.</li>
|
||||
<li>shorewall show connections - displays the IP connections
|
||||
currently being tracked by the firewall.</li>
|
||||
<li>shorewall
|
||||
show
|
||||
tc - displays information
|
||||
about the traffic control/shaping configuration.</li>
|
||||
<li>shorewall monitor [ delay ] - Continuously display the firewall
|
||||
status, last 20 log entries and nat. When the log entry display
|
||||
changes, an audible alarm is sounded.</li>
|
||||
<li>shorewall hits - Produces several reports about the Shorewall
|
||||
packet log messages in the current /var/log/messages file.</li>
|
||||
<li>shorewall version - Displays the installed version number.</li>
|
||||
<li>shorewall check - Performs a <u>cursory</u> validation
|
||||
of the zones, interfaces, hosts, rules and policy files. <font
|
||||
size="4" color="#ff6666"><b>The "check" command does not parse and validate
|
||||
the generated iptables commands so even though the "check" command
|
||||
completes successfully, the configuration may fail to start. See the
|
||||
recommended way to make configuration changes described below. </b></font>
|
||||
</li>
|
||||
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
||||
] - Restart shorewall using the specified configuration and if an
|
||||
error occurs or if the<i> timeout </i> option is given and the new configuration
|
||||
has been up for that many seconds then shorewall is restarted using
|
||||
the standard configuration.</li>
|
||||
<li>shorewall deny, shorewall reject, shorewall accept and shorewall
|
||||
save implement <a href="blacklisting_support.htm">dynamic blacklisting</a>.</li>
|
||||
<li>shorewall logwatch (added in version 1.3.2) - Monitors the
|
||||
<a href="#Conf">LOGFILE </a>and produces an audible alarm when new
|
||||
<li>shorewall version - Displays the installed version number.</li>
|
||||
<li>shorewall check - Performs a <u>cursory</u> validation
|
||||
of the zones, interfaces, hosts, rules and policy files. <font
|
||||
size="4" color="#ff6666"><b>The "check" command does not parse and validate
|
||||
the generated iptables commands so even though the "check" command
|
||||
completes successfully, the configuration may fail to start. See the
|
||||
recommended way to make configuration changes described below. </b></font>
|
||||
</li>
|
||||
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
||||
] - Restart shorewall using the specified configuration and if an
|
||||
error occurs or if the<i> timeout </i> option is given and the new configuration
|
||||
has been up for that many seconds then shorewall is restarted using
|
||||
the standard configuration.</li>
|
||||
<li>shorewall deny, shorewall reject, shorewall accept and shorewall
|
||||
save implement <a href="blacklisting_support.htm">dynamic blacklisting</a>.</li>
|
||||
<li>shorewall logwatch (added in version 1.3.2) - Monitors the
|
||||
<a href="#Conf">LOGFILE </a>and produces an audible alarm when new
|
||||
Shorewall messages are logged.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
Finally, the "shorewall" program may be used to dynamically alter the
|
||||
Finally, the "shorewall" program may be used to dynamically alter the
|
||||
contents of a zone.<br>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>- Adds
|
||||
<li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>- Adds
|
||||
the specified interface (and host if included) to the specified zone.</li>
|
||||
<li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
||||
Deletes the specified interface (and host if included) from the specified
|
||||
<li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
||||
Deletes the specified interface (and host if included) from the specified
|
||||
zone.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<blockquote>Examples:<br>
|
||||
|
||||
<blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- adds the address 192.0.2.24 from interface ipsec0 to the zone vpn1<br>
|
||||
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- deletes the address 192.0.2.24 from interface ipsec0 from zone vpn1<br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- adds the address 192.0.2.24 from interface ipsec0 to the zone vpn1<br>
|
||||
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24 vpn1</b></font>
|
||||
-- deletes the address 192.0.2.24 from interface ipsec0 from zone vpn1<br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check </b> and
|
||||
|
||||
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check </b> and
|
||||
<b>shorewall try </b>commands allow you to specify which <a
|
||||
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
||||
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
||||
to use:</p>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
|
||||
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
|
||||
shorewall try <i>configuration-directory</i></p>
|
||||
</blockquote>
|
||||
shorewall try <i>configuration-directory</i></p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
||||
is going to use a file in /etc/shorewall it will first look in the <i>configuration-directory</i>
|
||||
. If the file is present in the <i>configuration-directory</i>, that
|
||||
|
||||
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
||||
is going to use a file in /etc/shorewall it will first look in the <i>configuration-directory</i>
|
||||
. If the file is present in the <i>configuration-directory</i>, that
|
||||
file will be used; otherwise, the file in /etc/shorewall will be used.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> When changing the configuration of a production firewall, I recommend
|
||||
the following:</p>
|
||||
|
||||
<p> When changing the configuration of a production firewall, I recommend
|
||||
the following:</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
<li><font color="#009900"><b>mkdir /etc/test</b></font></li>
|
||||
<li><font color="#009900"><b>mkdir /etc/test</b></font></li>
|
||||
|
||||
<li><font color="#009900"><b>cd /etc/test</b></font></li>
|
||||
<li><font color="#009900"><b>cd /etc/test</b></font></li>
|
||||
|
||||
<li><copy any files that you need to change from /etc/shorewall
|
||||
to . and change them here></li>
|
||||
<li><copy any files that you need to change from /etc/shorewall
|
||||
to . and change them here></li>
|
||||
|
||||
<li><font color="#009900"><b>shorewall -c . check</b></font></li>
|
||||
<li><font color="#009900"><b>shorewall -c . check</b></font></li>
|
||||
|
||||
<li><correct any errors found by check and check again></li>
|
||||
<li><correct any errors found by check and check again></li>
|
||||
|
||||
<li><font color="#009900"><b>/sbin/shorewall try .</b></font></li>
|
||||
|
||||
<li><font color="#009900"><b>/sbin/shorewall try .</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p> If the configuration starts but doesn't work, just "shorewall restart"
|
||||
to restore the old configuration. If the new configuration fails to start,
|
||||
the "try" command will automatically start the old one for you.</p>
|
||||
|
||||
<p> If the configuration starts but doesn't work, just "shorewall restart"
|
||||
to restore the old configuration. If the new configuration fails to
|
||||
start, the "try" command will automatically start the old one for you.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> When the new configuration works then just </p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
<li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
|
||||
<li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
|
||||
|
||||
<li><font color="#009900"><b>cd</b></font></li>
|
||||
<li><font color="#009900"><b>cd</b></font></li>
|
||||
|
||||
<li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
|
||||
|
||||
<li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a name="StateDiagram"></a>The Shorewall State Diargram is depicted below.<br>
|
||||
</p>
|
||||
<div align="center"><img
|
||||
src="file:///J:/Shorewall-docs/images/State_Diagram.png"
|
||||
</p>
|
||||
|
||||
<div align="center"><img src="images/State_Diagram.png"
|
||||
alt="(State Diagram)" width="747" height="714" align="middle">
|
||||
<br>
|
||||
</div>
|
||||
|
||||
<br>
|
||||
</div>
|
||||
|
||||
<p> <br>
|
||||
</p>
|
||||
You will note that the commands that result in state transitions use
|
||||
the word "firewall" rather than "shorewall". That is because the actual
|
||||
transitions are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
|
||||
on Debian); /sbin/shorewall runs 'firewall" according to the following table:<br>
|
||||
<br>
|
||||
|
||||
</p>
|
||||
You will note that the commands that result in state transitions use
|
||||
the word "firewall" rather than "shorewall". That is because the actual transitions
|
||||
are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall on
|
||||
Debian); /sbin/shorewall runs 'firewall" according to the following table:<br>
|
||||
<br>
|
||||
|
||||
<table cellpadding="2" cellspacing="2" border="1">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">shorewall start<br>
|
||||
</td>
|
||||
<td valign="top">firewall start<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall stop<br>
|
||||
</td>
|
||||
<td valign="top">firewall stop<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall restart<br>
|
||||
</td>
|
||||
<td valign="top">firewall restart<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall add<br>
|
||||
</td>
|
||||
<td valign="top">firewall add<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall delete<br>
|
||||
</td>
|
||||
<td valign="top">firewall delete<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall refresh<br>
|
||||
</td>
|
||||
<td valign="top">firewall refresh<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall try<br>
|
||||
</td>
|
||||
<td valign="top">firewall -c <new configuration> restart<br>
|
||||
If unsuccessful then firewall start (standard configuration)<br>
|
||||
If timeout then firewall restart (standard configuration)<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td valign="top">shorewall start<br>
|
||||
</td>
|
||||
<td valign="top">firewall start<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall stop<br>
|
||||
</td>
|
||||
<td valign="top">firewall stop<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall restart<br>
|
||||
</td>
|
||||
<td valign="top">firewall restart<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall add<br>
|
||||
</td>
|
||||
<td valign="top">firewall add<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall delete<br>
|
||||
</td>
|
||||
<td valign="top">firewall delete<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall refresh<br>
|
||||
</td>
|
||||
<td valign="top">firewall refresh<br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">shorewall try<br>
|
||||
</td>
|
||||
<td valign="top">firewall -c <new configuration> restart<br>
|
||||
If unsuccessful then firewall start (standard configuration)<br>
|
||||
If timeout then firewall restart (standard configuration)<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
|
||||
<p><font size="2"> Updated 1/29/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
<br>
|
||||
|
||||
<p><font size="2"> Updated 2/10/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
||||
|
||||
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -2,128 +2,129 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Support</title>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p> <b><big><big><font color="#ff0000">While I don't answer Shorewall questions
|
||||
emailed directly to me, I try to spend some time each day answering questions
|
||||
on the Shorewall Users Mailing List.</font></big><span
|
||||
|
||||
<p> <b><big><big><font color="#ff0000">While I don't answer Shorewall questions
|
||||
emailed directly to me, I try to spend some time each day answering questions
|
||||
on the Shorewall Users Mailing List.</font></big><span
|
||||
style="font-weight: 400;"></span></big></b></p>
|
||||
|
||||
|
||||
<h2 align="center"><big><font color="#ff0000"><b>-Tom Eastep</b></font></big></h2>
|
||||
|
||||
|
||||
<h1>Before Reporting a Problem</h1>
|
||||
<i>"Well at least you tried to read the documentation, which is a lot more
|
||||
<i>"Well at least you tried to read the documentation, which is a lot more
|
||||
than some people on this list appear to do.</i>"<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<div align="center">- Wietse Venema - On the Postfix mailing list<br>
|
||||
</div>
|
||||
<br>
|
||||
There are a number of sources for
|
||||
problem solution information. Please try these before you post.
|
||||
|
||||
</div>
|
||||
<br>
|
||||
There are a number of sources for
|
||||
problem solution information. Please try these before you post.
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a><br>
|
||||
<br>
|
||||
</li>
|
||||
<li> The <a href="FAQ.htm">FAQ</a>
|
||||
<br>
|
||||
</li>
|
||||
<li> The <a href="FAQ.htm">FAQ</a>
|
||||
has solutions to more than 20 common problems. </li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li> The <a
|
||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
||||
a number of tips to help you solve common problems. </li>
|
||||
|
||||
<li> The <a
|
||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
||||
a number of tips to help you solve common problems. </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li> The <a
|
||||
href="errata.htm"> Errata</a> has links to download updated
|
||||
components. </li>
|
||||
|
||||
<li> The <a
|
||||
href="errata.htm"> Errata</a> has links to download updated
|
||||
components. </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li> The Mailing List
|
||||
Archives search facility can locate posts about similar problems:
|
||||
</li>
|
||||
|
||||
<li> The Mailing List
|
||||
Archives search facility can locate posts about similar
|
||||
problems: </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
<h2>Mailing List Archive Search</h2>
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -132,255 +133,257 @@ Archives search facility can locate posts about similar problem
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden"
|
||||
</font> <input type="hidden"
|
||||
name="config" value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30"
|
||||
Search: <input type="text" size="30"
|
||||
name="words" value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
|
||||
</form>
|
||||
|
||||
<h2>Problem Reporting Guidelines </h2>
|
||||
<i>"Let me see if I can translate your message into a real-world
|
||||
example. It would be like saying that you have three rooms at home,
|
||||
and when you walk into one of the rooms, you detect this strange smell.
|
||||
Can anyone tell you what that strange smell is?<br>
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the
|
||||
smell and even what's causing it. You would be absolutely amazed
|
||||
at the range and variety of smells we could come up with. Even more
|
||||
amazing is that all of the explanations for the smells would be completely
|
||||
plausible."<br>
|
||||
</i><br>
|
||||
|
||||
<i>"Let me see if I can translate your message into a real-world
|
||||
example. It would be like saying that you have three rooms at home,
|
||||
and when you walk into one of the rooms, you detect this strange smell.
|
||||
Can anyone tell you what that strange smell is?<br>
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the
|
||||
smell and even what's causing it. You would be absolutely amazed at
|
||||
the range and variety of smells we could come up with. Even more amazing
|
||||
is that all of the explanations for the smells would be completely plausible."<br>
|
||||
</i><br>
|
||||
|
||||
<div align="center"> - <i>Russell Mosemann</i> on the Postfix mailing list<br>
|
||||
</div>
|
||||
<br>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Please remember we only know what is posted in your message.
|
||||
Do not leave out any information that appears to be correct, or was mentioned
|
||||
in a previous post. There have been countless posts by people who were
|
||||
sure that some part of their configuration was correct when it actually
|
||||
contained a small error. We tend to be skeptics where detail is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking for <strong>free</strong>
|
||||
technical support. Any help we offer is an act of generosity, not an obligation.
|
||||
Try to make it easy for us to help you. Follow good, courteous practices
|
||||
in writing and formatting your e-mail. Provide details that we need if
|
||||
you expect good answers. <em>Exact quoting </em> of error messages, log
|
||||
entries, command output, and other output is better than a paraphrase or
|
||||
summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please don't describe your
|
||||
environment and then ask us to send you custom configuration
|
||||
files. We're here to answer your questions but we can't
|
||||
do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong> include
|
||||
<li>Please remember we only know what is posted in your message.
|
||||
Do not leave out any information that appears to be correct, or was
|
||||
mentioned in a previous post. There have been countless posts by people
|
||||
who were sure that some part of their configuration was correct when
|
||||
it actually contained a small error. We tend to be skeptics where detail
|
||||
is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're asking for <strong>free</strong>
|
||||
technical support. Any help we offer is an act of generosity, not an
|
||||
obligation. Try to make it easy for us to help you. Follow good, courteous
|
||||
practices in writing and formatting your e-mail. Provide details that
|
||||
we need if you expect good answers. <em>Exact quoting </em> of error messages,
|
||||
log entries, command output, and other output is better than a paraphrase
|
||||
or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li> Please don't describe
|
||||
your environment and then ask us to send you custom
|
||||
configuration files. We're here to answer your questions but
|
||||
we can't do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong> include
|
||||
this information:</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall you are running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized, the exact output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart Guides,
|
||||
please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
||||
installation of Shorewall, please say so.</b><br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall you are running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the exact kernel version you are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname -a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized, the exact output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart Guides, please
|
||||
indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
||||
installation of Shorewall, please say so.</b><br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li><b>NEVER </b>include the output of "<b><font
|
||||
color="#009900">iptables -L</font></b>". Instead, if you are having connection
|
||||
problems of any kind, post the exact output of<br>
|
||||
<br>
|
||||
<b><font color="#009900">/sbin/shorewall status<br>
|
||||
<br>
|
||||
</font></b>Since that command generates a lot of output, we
|
||||
suggest that you redirect the output to a file and attach the file to
|
||||
<li><b>NEVER </b>include the output of "<b><font
|
||||
color="#009900">iptables -L</font></b>". Instead, <b>if you are having
|
||||
connection problems of any kind</b>, post the exact output of<br>
|
||||
<br>
|
||||
<b><font color="#009900">/sbin/shorewall status<br>
|
||||
<br>
|
||||
</font></b>Since that command generates a lot of output, we
|
||||
suggest that you redirect the output to a file and attach the file to
|
||||
your post<br>
|
||||
<br>
|
||||
<b><font color="#009900">/sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>As a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address, netmask,
|
||||
nameserver addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive them
|
||||
anyway from information contained in the SMTP headers of your post).<strong></strong></li>
|
||||
|
||||
<br>
|
||||
<b><font color="#009900">/sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
</li>
|
||||
<li>As a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address, netmask,
|
||||
nameserver addresses, domain name, etc. These aren't secrets, and concealing
|
||||
them often misleads us (and 80% of the time, a hacker could derive them
|
||||
anyway from information contained in the SMTP headers of your post).<strong></strong></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li> Do you see any "Shorewall"
|
||||
messages ("<b><font color="#009900">/sbin/shorewall show log</font></b>")
|
||||
when you exercise the function that is giving you problems? If
|
||||
so, include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
(especially the /etc/shorewall/hosts file if you have modified
|
||||
that file) that you think are relevant. If you include /etc/shorewall/rules,
|
||||
please include /etc/shorewall/policy as well (rules are meaningless unless
|
||||
one also knows the policies). </li>
|
||||
|
||||
<li> Do you see any
|
||||
"Shorewall" messages ("<b><font color="#009900">/sbin/shorewall show
|
||||
log</font></b>") when you exercise the function that is giving
|
||||
you problems? If so, include the message(s) in your post along with a
|
||||
copy of your /etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration files
|
||||
(especially the /etc/shorewall/hosts file if you have modified
|
||||
that file) that you think are relevant. If you include /etc/shorewall/rules,
|
||||
please include /etc/shorewall/policy as well (rules are meaningless
|
||||
unless one also knows the policies). </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li> If an error occurs
|
||||
when you try to "<font color="#009900"><b>shorewall start</b></font>",
|
||||
include a trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions). </li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
|
||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||
your network layout, etc. to the Mailing List -- your
|
||||
post will be rejected.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
The author gratefully acknowleges that the above list was heavily
|
||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li> If an error occurs
|
||||
when you try to "<font color="#009900"><b>shorewall start</b></font>",
|
||||
include a trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions). </li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
|
||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||
your network layout, etc. to the Mailing List -- your
|
||||
post will be rejected.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
The author gratefully acknowleges that the above list was heavily
|
||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||
found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in
|
||||
list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the
|
||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||
one list subscriber wrote to me privately "These e-mail admin's need
|
||||
to get a <i>(expletive deleted)</i> life instead of trying to rid the
|
||||
planet of HTML based e-mail". Nevertheless, to allow subscribers to receive
|
||||
list posts as must as possible, I have now configured the list server
|
||||
at shorewall.net to strip all HTML from outgoing posts.<br>
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users
|
||||
mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft Multi Network Firewall
|
||||
(MNF) and you have not purchased an MNF license from MandrakeSoft then
|
||||
you can post non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list.</a> <b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list.</a></p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 2/4/2003 - Tom Eastep</font></p>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in
|
||||
list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the list
|
||||
subscribers whose MTAs are bouncing all shorewall.net mail. As one
|
||||
list subscriber wrote to me privately "These e-mail admin's need to get
|
||||
a <i>(expletive deleted)</i> life instead of trying to rid the planet
|
||||
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||
posts as must as possible, I have now configured the list server at shorewall.net
|
||||
to strip all HTML from outgoing posts.<br>
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users
|
||||
mailing list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft Multi Network Firewall
|
||||
(MNF) and you have not purchased an MNF license from MandrakeSoft then
|
||||
you can post non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list.</a> <b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list.</a></p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 2/9/2003 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -1,324 +1,331 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Traffic Shaping</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Traffic Shaping/Control</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="left">Beginning with version 1.2.0, Shorewall has limited support
|
||||
for traffic shaping/control. In order to use traffic shaping under Shorewall,
|
||||
it is essential that you get a copy of the <a
|
||||
for traffic shaping/control. In order to use traffic shaping under Shorewall,
|
||||
it is essential that you get a copy of the <a
|
||||
href="http://ds9a.nl/lartc">Linux Advanced Routing and Shaping HOWTO</a>,
|
||||
version 0.3.0 or later. You must also install the iproute (iproute2) package
|
||||
to provide the "ip" and "tc" utilities.</p>
|
||||
|
||||
version 0.3.0 or later. You must also install the iproute (iproute2)
|
||||
package to provide the "ip" and "tc" utilities.</p>
|
||||
|
||||
<p align="left">Shorewall traffic shaping support consists of the following:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf.
|
||||
Traffic Shaping also requires that you enable packet mangling.</li>
|
||||
<li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added in Shorewall
|
||||
1.3.13). When Traffic Shaping is enabled (TC_ENABLED=Yes), the setting of
|
||||
this variable determines whether Shorewall clears the traffic shaping configuration
|
||||
during Shorewall [re]start and Shorewall stop. <br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcrules</b> - A file where you can specify
|
||||
firewall marking of packets. The firewall mark value may be used to
|
||||
classify packets for traffic shaping/control.<br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcstart </b>- A user-supplied file that
|
||||
is sourced by Shorewall during "shorewall start" and which you can
|
||||
use to define your traffic shaping disciplines and classes. I have
|
||||
provided a <a href="ftp://ftp.shorewall.net/pub/shorewall/cbq">sample</a>
|
||||
that does table-driven CBQ shaping but if you read the traffic shaping
|
||||
sections of the HOWTO mentioned above, you can probably code your
|
||||
own faster than you can learn how to use my sample. I personally use
|
||||
<a href="http://luxik.cdi.cz/%7Edevik/qos/htb/">HTB</a> (see below).
|
||||
HTB support may eventually become an integral part of Shorewall since
|
||||
HTB is a lot simpler and better-documented than CBQ. As of 2.4.20,
|
||||
HTB is a standard part of the kernel but iproute2 must be patched in
|
||||
order to use it.<br>
|
||||
<br>
|
||||
In tcstart, when you want to run the 'tc' utility, use the
|
||||
run_tc function supplied by shorewall if you want tc errors to stop
|
||||
the firewall.<br>
|
||||
<br>
|
||||
You can generally use off-the-shelf traffic shaping scripts by simply
|
||||
copying them to /etc/shorewall/tcstart. I use <a
|
||||
<li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf.
|
||||
Traffic Shaping also requires that you enable packet mangling.</li>
|
||||
<li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added in
|
||||
Shorewall 1.3.13). When Traffic Shaping is enabled (TC_ENABLED=Yes), the
|
||||
setting of this variable determines whether Shorewall clears the traffic
|
||||
shaping configuration during Shorewall [re]start and Shorewall stop. <br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcrules</b> - A file where you can specify
|
||||
firewall marking of packets. The firewall mark value may be used
|
||||
to classify packets for traffic shaping/control.<br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcstart </b>- A user-supplied file that
|
||||
is sourced by Shorewall during "shorewall start" and which you can
|
||||
use to define your traffic shaping disciplines and classes. I have
|
||||
provided a <a href="ftp://ftp.shorewall.net/pub/shorewall/cbq">sample</a>
|
||||
that does table-driven CBQ shaping but if you read the traffic shaping
|
||||
sections of the HOWTO mentioned above, you can probably code your
|
||||
own faster than you can learn how to use my sample. I personally
|
||||
use <a href="http://luxik.cdi.cz/%7Edevik/qos/htb/">HTB</a> (see
|
||||
below). HTB support may eventually become an integral part of Shorewall
|
||||
since HTB is a lot simpler and better-documented than CBQ. As of 2.4.20,
|
||||
HTB is a standard part of the kernel but iproute2 must be patched in
|
||||
order to use it.<br>
|
||||
<br>
|
||||
In tcstart, when you want to run the 'tc' utility, use the
|
||||
run_tc function supplied by shorewall if you want tc errors to stop
|
||||
the firewall.<br>
|
||||
<br>
|
||||
You can generally use off-the-shelf traffic shaping scripts by simply
|
||||
copying them to /etc/shorewall/tcstart. I use <a
|
||||
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (HTB version)
|
||||
that way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart and
|
||||
modified it according to the Wonder Shaper README). <b>WARNING: </b>If you
|
||||
use use Masquerading or SNAT (i.e., you only have one external IP address)
|
||||
then listing internal hosts in the NOPRIOHOSTSRC variable in the wshaper[.htb]
|
||||
script won't work. Traffic shaping occurs after SNAT has already been applied
|
||||
so when traffic shaping happens, all outbound traffic will have as a source
|
||||
address the IP addresss of your firewall's external interface.<br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcclear</b> - A user-supplied file that
|
||||
is sourced by Shorewall when it is clearing traffic shaping. This
|
||||
file is normally not required as Shorewall's method of clearing qdisc
|
||||
and filter definitions is pretty general.</li>
|
||||
|
||||
that way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart and
|
||||
modified it according to the Wonder Shaper README). <b>WARNING: </b>If
|
||||
you use use Masquerading or SNAT (i.e., you only have one external IP address)
|
||||
then listing internal hosts in the NOPRIOHOSTSRC variable in the wshaper[.htb]
|
||||
script won't work. Traffic shaping occurs after SNAT has already been applied
|
||||
so when traffic shaping happens, all outbound traffic will have as a source
|
||||
address the IP addresss of your firewall's external interface.<br>
|
||||
</li>
|
||||
<li><b>/etc/shorewall/tcclear</b> - A user-supplied file that
|
||||
is sourced by Shorewall when it is clearing traffic shaping. This
|
||||
file is normally not required as Shorewall's method of clearing qdisc
|
||||
and filter definitions is pretty general.</li>
|
||||
|
||||
</ul>
|
||||
Shorewall allows you to start traffic shaping when Shorewall itself starts
|
||||
or it allows you to bring up traffic shaping when you bring up your interfaces.<br>
|
||||
<br>
|
||||
To start traffic shaping when Shorewall starts:<br>
|
||||
Shorewall allows you to start traffic shaping when Shorewall itself starts
|
||||
or it allows you to bring up traffic shaping when you bring up your interfaces.<br>
|
||||
<br>
|
||||
To start traffic shaping when Shorewall starts:<br>
|
||||
|
||||
<ol>
|
||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
|
||||
<li>Supply an /etc/shorewall/tcstart script to configure your traffic shaping
|
||||
rules.</li>
|
||||
<li>Optionally supply an /etc/shorewall/tcclear script to stop traffic
|
||||
shaping. That is usually unnecessary.</li>
|
||||
<li>If your tcstart script uses the 'fwmark' classifier, you can mark packets
|
||||
using entries in /etc/shorewall/tcrules.</li>
|
||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
|
||||
<li>Supply an /etc/shorewall/tcstart script to configure your traffic
|
||||
shaping rules.</li>
|
||||
<li>Optionally supply an /etc/shorewall/tcclear script to stop traffic
|
||||
shaping. That is usually unnecessary.</li>
|
||||
<li>If your tcstart script uses the 'fwmark' classifier, you can mark
|
||||
packets using entries in /etc/shorewall/tcrules.</li>
|
||||
|
||||
</ol>
|
||||
To start traffic shaping when you bring up your network interfaces, you will
|
||||
have to arrange for your traffic shaping configuration script to be run at
|
||||
that time. How you do that is distribution dependent and will not be covered
|
||||
To start traffic shaping when you bring up your network interfaces, you
|
||||
will have to arrange for your traffic shaping configuration script to be run
|
||||
at that time. How you do that is distribution dependent and will not be covered
|
||||
here. You then should:<br>
|
||||
|
||||
<ol>
|
||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
|
||||
<li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear scripts.</li>
|
||||
<li value="4">If your tcstart script uses the 'fwmark' classifier, you
|
||||
can mark packets using entries in /etc/shorewall/tcrules.</li>
|
||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
|
||||
<li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear scripts.</li>
|
||||
<li value="4">If your tcstart script uses the 'fwmark' classifier, you
|
||||
can mark packets using entries in /etc/shorewall/tcrules.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<h3 align="left">Kernel Configuration</h3>
|
||||
|
||||
|
||||
<p align="left">This screen shot show how I've configured QoS in my Kernel:</p>
|
||||
|
||||
|
||||
<p align="center"><img border="0" src="images/QoS.png" width="590"
|
||||
height="764">
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<h3 align="left"><a name="tcrules"></a>/etc/shorewall/tcrules</h3>
|
||||
|
||||
|
||||
<p align="left">The fwmark classifier provides a convenient way to classify
|
||||
packets for traffic shaping. The /etc/shorewall/tcrules file provides
|
||||
a means for specifying these marks in a tabular fashion.<br>
|
||||
</p>
|
||||
|
||||
<p align="left">Normally, packet marking occurs in the PREROUTING chain before
|
||||
any address rewriting takes place. This makes it impossible to mark inbound
|
||||
packets based on their destination address when SNAT or Masquerading are
|
||||
being used. Beginning with Shorewall 1.3.12, you can cause packet marking
|
||||
to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN option in
|
||||
<a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||
</p>
|
||||
|
||||
<p align="left">Columns in the file are as follows:</p>
|
||||
|
||||
<ul>
|
||||
<li>MARK - Specifies the mark value is to be assigned in case
|
||||
of a match. This is an integer in the range 1-255.<br>
|
||||
<br>
|
||||
Example - 5<br>
|
||||
</li>
|
||||
<li>SOURCE - The source of the packet. If the packet originates
|
||||
on the firewall, place "fw" in this column. Otherwise, this is a
|
||||
comma-separated list of interface names, IP addresses, MAC addresses in
|
||||
<a href="Documentation.htm#MAC">Shorewall Format</a> and/or Subnets.<br>
|
||||
<br>
|
||||
Examples<br>
|
||||
eth0<br>
|
||||
192.168.2.4,192.168.1.0/24<br>
|
||||
</li>
|
||||
<li>DEST -- Destination of the packet. Comma-separated list of
|
||||
IP addresses and/or subnets.<br>
|
||||
</li>
|
||||
<li>PROTO - Protocol - Must be the name of a protocol from
|
||||
/etc/protocol, a number or "all"<br>
|
||||
</li>
|
||||
<li>PORT(S) - Destination Ports. A comma-separated list of Port
|
||||
names (from /etc/services), port numbers or port ranges (e.g., 21:22);
|
||||
if the protocol is "icmp", this column is interpreted as the
|
||||
destination icmp type(s).<br>
|
||||
</li>
|
||||
<li>CLIENT PORT(S) - (Optional) Port(s) used by the client. If
|
||||
omitted, any source port is acceptable. Specified as a comma-separate
|
||||
list of port names, port numbers or port ranges.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">Example 1 - All packets arriving on eth1 should be marked
|
||||
with 1. All packets arriving on eth2 and eth3 should be marked with 2.
|
||||
All packets originating on the firewall itself should be marked with 3.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>1</td>
|
||||
<td>eth1</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>2</td>
|
||||
<td>eth2</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">2<br>
|
||||
</td>
|
||||
<td valign="top">eth3<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">all<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>3</td>
|
||||
<td>fw</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="left">Example 2 - All GRE (protocol 47) packets not originating
|
||||
on the firewall and destined for 155.186.235.151 should be marked with
|
||||
12.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>12</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>155.186.235.151</td>
|
||||
<td>47</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="left">Example 3 - All SSH packets originating in 192.168.1.0/24
|
||||
and destined for 155.186.235.151 should be marked with 22.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>22</td>
|
||||
<td>192.168.1.0/24</td>
|
||||
<td>155.186.235.151</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h3>My Setup<br>
|
||||
</h3>
|
||||
|
||||
<p>While I am currently using the HTB version of <a
|
||||
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (I just copied
|
||||
wshaper.htb to <b>/etc/shorewall/tcstart</b> and modified it as shown in
|
||||
the Wondershaper README), I have also run with the following set of hand-crafted
|
||||
rules in my <b>/etc/shorewall/tcstart</b> file:<br>
|
||||
packets for traffic shaping. The /etc/shorewall/tcrules file provides
|
||||
a means for specifying these marks in a tabular fashion.<br>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
<p align="left">Normally, packet marking occurs in the PREROUTING chain before
|
||||
any address rewriting takes place. This makes it impossible to mark inbound
|
||||
packets based on their destination address when SNAT or Masquerading are
|
||||
being used. Beginning with Shorewall 1.3.12, you can cause packet marking
|
||||
to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN option
|
||||
in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||
</p>
|
||||
|
||||
<p align="left">Columns in the file are as follows:</p>
|
||||
|
||||
<ul>
|
||||
<li>MARK - Specifies the mark value is to be assigned in case
|
||||
of a match. This is an integer in the range 1-255. Beginning with Shorewall
|
||||
version 1.3.14, this value may be optionally followed by ":" and either 'F'
|
||||
or 'P' to designate that the marking will occur in the FORWARD or PREROUTING
|
||||
chains respectively. If this additional specification is omitted, the chain
|
||||
used to mark packets will be determined by the setting of the MARK_IN_FORWARD_CHAIN
|
||||
option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||
<br>
|
||||
Example - 5<br>
|
||||
</li>
|
||||
<li>SOURCE - The source of the packet. If the packet originates
|
||||
on the firewall, place "fw" in this column. Otherwise, this is a
|
||||
comma-separated list of interface names, IP addresses, MAC addresses in
|
||||
<a href="Documentation.htm#MAC">Shorewall Format</a> and/or Subnets.<br>
|
||||
<br>
|
||||
Examples<br>
|
||||
eth0<br>
|
||||
192.168.2.4,192.168.1.0/24<br>
|
||||
</li>
|
||||
<li>DEST -- Destination of the packet. Comma-separated list
|
||||
of IP addresses and/or subnets.<br>
|
||||
</li>
|
||||
<li>PROTO - Protocol - Must be the name of a protocol from
|
||||
/etc/protocol, a number or "all"<br>
|
||||
</li>
|
||||
<li>PORT(S) - Destination Ports. A comma-separated list of
|
||||
Port names (from /etc/services), port numbers or port ranges (e.g.,
|
||||
21:22); if the protocol is "icmp", this column is interpreted as
|
||||
the destination icmp type(s).<br>
|
||||
</li>
|
||||
<li>CLIENT PORT(S) - (Optional) Port(s) used by the client.
|
||||
If omitted, any source port is acceptable. Specified as a comma-separate
|
||||
list of port names, port numbers or port ranges.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">Example 1 - All packets arriving on eth1 should be marked
|
||||
with 1. All packets arriving on eth2 and eth3 should be marked with 2.
|
||||
All packets originating on the firewall itself should be marked with 3.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>1</td>
|
||||
<td>eth1</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>2</td>
|
||||
<td>eth2</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td valign="top">2<br>
|
||||
</td>
|
||||
<td valign="top">eth3<br>
|
||||
</td>
|
||||
<td valign="top">0.0.0.0/0<br>
|
||||
</td>
|
||||
<td valign="top">all<br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
<td valign="top"><br>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>3</td>
|
||||
<td>fw</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>all</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="left">Example 2 - All GRE (protocol 47) packets not originating
|
||||
on the firewall and destined for 155.186.235.151 should be marked with
|
||||
12.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>12</td>
|
||||
<td>0.0.0.0/0</td>
|
||||
<td>155.186.235.151</td>
|
||||
<td>47</td>
|
||||
<td> </td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="left">Example 3 - All SSH packets originating in 192.168.1.0/24
|
||||
and destined for 155.186.235.151 should be marked with 22.</p>
|
||||
|
||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><b>MARK</b></td>
|
||||
<td><b>SOURCE</b></td>
|
||||
<td><b>DEST</b></td>
|
||||
<td><b>PROTO</b></td>
|
||||
<td><b>PORT(S)</b></td>
|
||||
<td><b>CLIENT PORT(S)</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>22</td>
|
||||
<td>192.168.1.0/24</td>
|
||||
<td>155.186.235.151</td>
|
||||
<td>tcp</td>
|
||||
<td>22</td>
|
||||
<td> </td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h3>My Setup<br>
|
||||
</h3>
|
||||
|
||||
<p>While I am currently using the HTB version of <a
|
||||
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (I just copied
|
||||
wshaper.htb to <b>/etc/shorewall/tcstart</b> and modified it as shown
|
||||
in the Wondershaper README), I have also run with the following set of
|
||||
hand-crafted rules in my <b>/etc/shorewall/tcstart</b> file:<br>
|
||||
</p>
|
||||
|
||||
<blockquote>
|
||||
<pre>run_tc qdisc add dev eth0 root handle 1: htb default 30<br><br>run_tc class add dev eth0 parent 1: classid 1:1 htb rate 384kbit burst 15k<br><br>echo " Added Top Level Class -- rate 384kbit"</pre>
|
||||
|
||||
|
||||
<pre>run_tc class add dev eth0 parent 1:1 classid 1:10 htb rate 140kbit ceil 384kbit burst 15k prio 1<br>run_tc class add dev eth0 parent 1:1 classid 1:20 htb rate 224kbit ceil 384kbit burst 15k prio 0<br>run_tc class add dev eth0 parent 1:1 classid 1:30 htb rate 20kbit ceil 384kbit burst 15k quantum 1500 prio 1</pre>
|
||||
|
||||
|
||||
<pre>echo " Added Second Level Classes -- rates 140kbit, 224kbit, 20kbit"</pre>
|
||||
|
||||
|
||||
<pre>run_tc qdisc add dev eth0 parent 1:10 pfifo limit 5<br>run_tc qdisc add dev eth0 parent 1:20 pfifo limit 10<br>run_tc qdisc add dev eth0 parent 1:30 pfifo limit 5</pre>
|
||||
|
||||
|
||||
<pre>echo " Enabled PFIFO on Second Level Classes"</pre>
|
||||
|
||||
|
||||
<pre>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:10<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 0 handle 2 fw classid 1:20<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 3 fw classid 1:30</pre>
|
||||
|
||||
|
||||
<pre>echo " Defined fwmark filters"<br></pre>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
|
||||
<p>My tcrules file that went with this tcstart file is shown in Example 1
|
||||
above. You can look at my <a href="myfiles.htm">network configuration</a>
|
||||
to get an idea of why I wanted these particular rules.<br>
|
||||
</p>
|
||||
|
||||
above. You can look at my <a href="myfiles.htm">network configuration</a>
|
||||
to get an idea of why I wanted these particular rules.<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>I wanted to allow up to 140kbits/second for traffic outbound from
|
||||
my DMZ (note that the ceiling is set to 384kbit so outbound DMZ traffic
|
||||
can use all available bandwidth if there is no traffic from the local systems
|
||||
or from my laptop or firewall).</li>
|
||||
<li>My laptop and local systems could use up to 224kbits/second.</li>
|
||||
<li>My firewall could use up to 20kbits/second.<br>
|
||||
</li>
|
||||
|
||||
<li>I wanted to allow up to 140kbits/second for traffic outbound
|
||||
from my DMZ (note that the ceiling is set to 384kbit so outbound DMZ traffic
|
||||
can use all available bandwidth if there is no traffic from the local systems
|
||||
or from my laptop or firewall).</li>
|
||||
<li>My laptop and local systems could use up to 224kbits/second.</li>
|
||||
<li>My firewall could use up to 20kbits/second.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><font size="2">Last Updated 2/13/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><font size="2">Last Updated 12/31/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user