From 745e04823df9bf74db02d75481bb72f956a27255 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Thu, 18 Feb 2016 09:06:09 -0800 Subject: [PATCH] Update the IPSEC doc for 5.0 Signed-off-by: Tom Eastep --- docs/IPSEC-2.6.xml | 43 +++++++++++++++++-------------------------- 1 file changed, 17 insertions(+), 26 deletions(-) diff --git a/docs/IPSEC-2.6.xml b/docs/IPSEC-2.6.xml index 4aeabc572..decc79c75 100644 --- a/docs/IPSEC-2.6.xml +++ b/docs/IPSEC-2.6.xml @@ -295,8 +295,7 @@ ipsec net 206.162.148.9 /etc/shorewall/zones — Systems A and B: - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS net ipv4 vpn ipv4 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE @@ -330,17 +329,17 @@ vpn eth0:192.168.1.0/24,206.162.148.9 ips /etc/shorewall/policy entries on each system:
- #SOURCE DESTINATION POLICY LEVEL BURST:LIMIT -loc vpn ACCEPT -vpn loc ACCEPT + #SOURCE DEST POLICY LEVEL BURST:LIMIT +loc vpn ACCEPT +vpn loc ACCEPT
If you need access from each firewall to hosts in the other network, then you could add:
- #SOURCE DESTINATION POLICY LEVEL BURST:LIMIT -$FW vpn ACCEPT + #SOURCE DEST POLICY LEVEL BURST:LIMIT +$FW vpn ACCEPT
If you need access between the firewall's, you should describe the @@ -348,7 +347,7 @@ $FW vpn ACCEPT from System B, add this rule on system A:
- #ACTION SOURCE DESTINATION PROTO POLICY + #ACTION SOURCE DEST PROTO POLICY ACCEPT vpn:134.28.54.2 $FW
@@ -458,8 +457,7 @@ sainfo address 192.168.1.0/24 any address 134.28.54.2/32 any through an ESP tunnel then the following entry would be appropriate: - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS sec ipsec mode=tunnel mss=1400 You should also set FASTACCEPT=No in shorewall.conf to ensure @@ -493,8 +491,7 @@ sec ipsec mode=tunnel mss=1400 /etc/shorewall/zones — System A - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS net ipv4 vpn ipsec loc ipv4 @@ -536,8 +533,7 @@ vpn eth0:0.0.0.0/0
/etc/shorewall/zones - System B: - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS vpn ipsec net ipv4 loc ipv4 @@ -716,9 +712,8 @@ RACOON=/usr/sbin/racoon
/etc/shorewall/zones — System A - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS -net ipv4 + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS +et ipv4 vpn ipsec l2tp ipv4 loc ipv4 @@ -802,8 +797,7 @@ all all REJECT info
/etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST SOURCE -# PORT(S) PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT ?SECTION ESTABLISHED # Prevent IPsec bypass by hosts behind a NAT gateway L2TP(REJECT) net $FW @@ -890,9 +884,8 @@ spdadd 192.168.20.40/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.
/etc/shorewall/interfaces: - #ZONE INTERFACE BROADCAST OPTIONS -net eth0 detect routefilter,dhcp,tcpflags -#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE + #ZONE INTERFACE OPTIONS +net eth0 routefilter,dhcp,tcpflags /etc/shorewall/tunnels: @@ -910,8 +903,7 @@ net ipv4 /etc/shorewall/hosts: #ZONE HOST(S) OPTIONS -loc eth0:192.168.20.0/24 -#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE +loc eth0:192.168.20.0/24 It is worth noting that although loc is a sub-zone of net, because loc @@ -928,8 +920,7 @@ net loc NONE loc net NONE net all DROP info # The FOLLOWING POLICY MUST BE LAST -all all REJECT info -#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE +all all REJECT info Since there are no cases where net<->loc traffic should occur, NONE policies are used.