From 9e6109bc36929356266eaf4b1b8ac3f04dff0885 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Wed, 17 Feb 2016 15:55:21 -0800 Subject: [PATCH] Update the Bridge document for 5.0 Signed-off-by: Tom Eastep --- docs/bridge-Shorewall-perl.xml | 56 +++++++++++++++------------------- 1 file changed, 24 insertions(+), 32 deletions(-) diff --git a/docs/bridge-Shorewall-perl.xml b/docs/bridge-Shorewall-perl.xml index 386c6e6cb..77117ce1a 100644 --- a/docs/bridge-Shorewall-perl.xml +++ b/docs/bridge-Shorewall-perl.xml @@ -134,7 +134,7 @@ the bridge would work exactly the same if public IP addresses were used (remember that the bridge doesn't deal with IP addresses). - + There are a several key differences in this setup and a normal Shorewall configuration: @@ -180,7 +180,7 @@ systems connected to that switch. All of the systems on the local side of the router would still be configured with IP addresses in 192.168.1.0/24 as shown below. + fileref="images/bridge3.png"/>
@@ -596,8 +596,8 @@ all all REJECT info is connected to eth0 and the switch to eth1: - #ZONE INTERFACE BROADCAST OPTIONS -world br0 detect bridge + #ZONE INTERFACE OPTIONS +world br0 bridge net br0:eth0 loc br0:eth1 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE @@ -645,9 +645,9 @@ br0 192.168.1.0/24 routeback /etc/shorewall/interfaces: - #ZONE INTERFACE BROADCAST OPTIONS - world br0 - bridge - world br1 - bridge + #ZONE INTERFACE OPTIONS + world br0 bridge + world br1 bridge z1 br0:p+ z2 br1:p+ @@ -657,11 +657,11 @@ br0 192.168.1.0/24 routeback configuration may be defined using the following in /etc/shorewall/interfaces: - #ZONE INTERFACE BROADCAST OPTIONS - world br0 - bridge - world br1 - bridge - z1 br0:x+ - physical=p+ - z2 br1:y+ - physical=p+ + #ZONE INTERFACE OPTIONS + world br0 bridge + world br1 bridge + z1 br0:x+ physical=p+ + z2 br1:y+ physical=p+ In this configuration, 'x+' is the logical name for ports p+ on bridge br0 while 'y+' is the logical name for ports p+ on bridge @@ -673,8 +673,7 @@ br0 192.168.1.0/24 routeback Example from /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST - # PORT(S) + #ACTION SOURCE DEST PROTO DPORT REJECT z1:x1023 z1:x1024 tcp 1234
@@ -683,7 +682,7 @@ br0 192.168.1.0/24 routeback A system running Shorewall doesn't have to be exclusively a bridge or a router -- it can act as both, which is also know as a brouter. Here's - an example: + an example: This is basically the same setup as shown in the Shorewall Setup Guide with the @@ -710,11 +709,11 @@ loc ipv4 The /etc/shorewall/interfaces file is as - follows:#ZONE INTERFACE BROADCAST OPTIONS -pub br0 detect routefilter,bridge + follows:#ZONE INTERFACE OPTIONS +pub br0 routefilter,bridge net br0:eth0 dmz br0:eth2 -loc eth1 detect +loc eth1 @@ -761,9 +760,7 @@ all all REJECT info /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST SOURCE -# - PORT(S) PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT ACCEPT all all icmp 8 ACCEPT loc $DMZ tcp 25,53,80,443,... ACCEPT loc $DMZ udp 53 @@ -784,7 +781,7 @@ ACCEPT $FW $DMZ tcp 53 This configuration is shown in the following diagram. - + In this configuration, veth0 is assigned the internal IP address; br0 does not have an IP address. @@ -872,8 +869,7 @@ iface veth0 inet static For this configuration, we need several additional zones as shown here: - #ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS + #ZONE TYPE OPTIONS IN_OPTIONS OUT_OPTIONS fw firewall net ipv4 zone1 bport @@ -943,8 +939,7 @@ all all REJECT:info Rules allowing traffic from the net to zone2 look like this: - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK -# PORT(S) PORT(S) DEST LIMIT GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK ACCEPT col zone2 tcp 22 - - - - net @@ -969,8 +964,7 @@ ACCEPT col zone3 tcp 22 Suppose that you want to forward tcp port 80 to 192.168.4.45 in zone3: - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK -# PORT(S) PORT(S) DEST LIMIT GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK DNAT- net loc:172.168.4.45 tcp 80 ACCEPT col zone3:172.168.4.45 tcp 80 - - - - net @@ -979,15 +973,13 @@ ACCEPT col zone3:172.168.4.45 tcp 80 - - role="bold">zonei zones to the net zone look like this: - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK -# PORT(S) PORT(S) DEST LIMIT GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK ACCEPT loc net tcp 21 - - - - zone1 And to the firewall: - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK -# PORT(S) PORT(S) DEST LIMIT GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK ACCEPT zone2 col tcp - - - - zone2