From 87574c0fe34870419a59f63e478752beb858338a Mon Sep 17 00:00:00 2001 From: teastep Date: Sat, 3 Sep 2005 15:23:41 +0000 Subject: [PATCH] Replace tables with programlistings git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- .../whitelisting_under_shorewall.xml | 318 ++---------------- 1 file changed, 25 insertions(+), 293 deletions(-) diff --git a/Shorewall-docs2/whitelisting_under_shorewall.xml b/Shorewall-docs2/whitelisting_under_shorewall.xml index cf39efabf..5de15a397 100644 --- a/Shorewall-docs2/whitelisting_under_shorewall.xml +++ b/Shorewall-docs2/whitelisting_under_shorewall.xml @@ -12,7 +12,7 @@ Eastep - 2005-09-02 + 2005-09-03 2002-2005 @@ -74,53 +74,12 @@ Zone File - - - - - ZONE - - DISPLAY - - COMMENTS - - - - - - net - - Net - - Internet - - - - ops - - Operations - - Operations Staff's Class C - - - - loc - - Local - - Local Class B - - - - dmz - - DMZ - - Demilitarized zone - - - - + #ZONE TYPE OPTIONS +fw firewall +net plain +ops plain +loc plain +dmz plain The ops zone has been added to the standard 3-zone zones file -- since ops is a sub-zone of @@ -131,53 +90,10 @@ Interfaces File - - - - - ZONE - - INTERFACE - - BROADCAST - - OPTIONS - - - - - - net - - eth0 - - <whatever> - - <options> - - - - dmz - - eth1 - - <whatever> - - - - - - - - - eth2 - - 10.10.255.255 - - - - - - + #ZONE INTERFACE BROACAST OPTIONS +net eth0 <whatever> ... +dmz eth1 <whatever> ... +- eth2 10.10.255.255 Because eth2 interfaces to two zones (ops and loc), we don't specify a zone @@ -187,37 +103,9 @@ Hosts File - - - - - ZONE - - HOST(S) - - OPTIONS - - - - - - ops - - eth2:10.10.10.0/24 - - - - - - loc - - eth2:0.0.0.0/0 - - - - - - + #ZONE HOST(S) OPTIONS +ops eth2:10.10.10.0/24 +loc eth2:0.0.0.0/0 Here we define the ops and loc zones. When Shorewall is stopped, only the hosts in the @@ -232,93 +120,12 @@ Policy File - - - - - SOURCE - - DEST - - POLICY - - LOG LEVEL - - LIMIT BURST - - - - - - ops - - all - - - ACCEPT - - - - - - - - - all - - - ops - - - - CONTINUE - - - - - - - - loc - - net - - ACCEPT - - - - - - - - net - - all - - DROP - - info - - - - - - all - - all - - REJECT - - info - - - - - - + #SOURCE DEST POLICY LOG LEVEL +ops all ACCEPT +all ops CONTINUE +loc net ACCEPT +net all DROP info +all all REJECT info Two entries for ops (in bold) have been added to the standard 3-zone policy file. @@ -327,61 +134,8 @@ Rules File - - - - - ACTION - - SOURCE - - DEST - - PROTO - - DEST PORT(S) - - SOURCE PORT(S) - - ORIGINAL DEST - - - - - - REDIRECT - - loc!ops - - 3128 - - tcp - - http - - - - - - - - ... - - - - - - - - - - - - - - - - + #ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE PORTS(S) ORIGINAL DEST +REDIRECT loc!ops 3128 tcp http This is the rule that transparently redirects web traffic to the transparent proxy running on the firewall. The Routestopped File - - - - - INTERFACE - - HOST(S)) - - - - - - eth1 - - - - - - eth2 - - 10.10.10.0/24 - - - - + #INTERFACE HOST(S) OPTIONS +eth1 +eth2 10.10.10.0/24 \ No newline at end of file