extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-03 12:09:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Link to different bridging article

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@7056 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-08-05 00:11:55 +00:00
parent cd771b971e
commit aa5ff5724e
1 changed files with 54 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
docs/IPSEC-2.6.xml
View File

@ -77,8 +77,9 @@
the responsible Netfilter developer who has confirmed the problem. The the responsible Netfilter developer who has confirmed the problem. The
problem was presumably corrected in Kernel 2.6.20 as a result of the problem was presumably corrected in Kernel 2.6.20 as a result of the
removal of defered FORWARD/OUTPUT processing of traffic destined for a removal of defered FORWARD/OUTPUT processing of traffic destined for a
bridge. See the <ulink url="NewBridge.html">"<emphasis>Bridging without bridge. See the <ulink
using physdev match support</emphasis>"</ulink> article.</para> url="bridge-Shorewall-perl.html">"<emphasis>Shorewall-perl and Bridged
Firewalls</emphasis>"</ulink> article.</para>
</warning> </warning>
<section id="Overview"> <section id="Overview">
@ -661,49 +662,51 @@ RACOON=/usr/sbin/racoon</programlisting>
</section> </section>
<section id="RW-L2TP"> <section id="RW-L2TP">
<title>Mobile System (Road Warrior) with Layer 2 Tunneling Protocol (L2TP)</title> <title>Mobile System (Road Warrior) with Layer 2 Tunneling Protocol
(L2TP)</title>
<para>This section is based on the previous section. Please make sure that <para>This section is based on the previous section. Please make sure that
you read it thoroughly and understand it. The setup described in this you read it thoroughly and understand it. The setup described in this
section is more complex because you are including an additional layer of section is more complex because you are including an additional layer of
tunneling. Again, make sure that you have read the previous section and tunneling. Again, make sure that you have read the previous section and it
it is highly recommended to have the IPSEC-only configuration working is highly recommended to have the IPSEC-only configuration working
first.</para> first.</para>
<para>Additionally, this section assumes that you are running IPSEC, xl2tpd <para>Additionally, this section assumes that you are running IPSEC,
and pppd on the same system that is running shorewall. However, xl2tpd and pppd on the same system that is running shorewall. However,
configuration of these additional services is beyond the scope of this configuration of these additional services is beyond the scope of this
document.</para> document.</para>
<para>Getting layer 2 tunneling to work is an endeavour unto itself. <para>Getting layer 2 tunneling to work is an endeavour unto itself.
However, if you succeed it can be very convenient. Reasons why you might However, if you succeed it can be very convenient. Reasons why you might
want configure layer 2 tunneling protocol (L2TP): </para> want configure layer 2 tunneling protocol (L2TP):</para>
<orderedlist> <orderedlist>
<listitem> <listitem>
<para>You want to give your road warrior an address that is in the same <para>You want to give your road warrior an address that is in the
segment as the other hosts on your network.</para> same segment as the other hosts on your network.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>Your road warriors are using a legacy operating system (such as MS <para>Your road warriors are using a legacy operating system (such as
Windows or Mac OS X) and you do not want them to have to install third MS Windows or Mac OS X) and you do not want them to have to install
party software in order to connect to the VPN (both MS Windows and Mac OS third party software in order to connect to the VPN (both MS Windows
X include VPN clients which natively support L2TP over IPSEC, but not and Mac OS X include VPN clients which natively support L2TP over
plain IPSEC).</para> IPSEC, but not plain IPSEC).</para>
</listitem> </listitem>
<listitem> <listitem>
<para>You like a challenge.</para> <para>You like a challenge.</para>
</listitem> </listitem>
</orderedlist> </orderedlist>
<para>Since the target for a VPN including L2TP will (almost) never be a <para>Since the target for a VPN including L2TP will (almost) never be a
road warrior running Linux, I will not include the client side of the road warrior running Linux, I will not include the client side of the
configuration.</para> configuration.</para>
<para>The first thing that needs to be done is to create a new zone called <para>The first thing that needs to be done is to create a new zone called
<quote>l2tp</quote> to represent the tunneled layer 2 traffic.</para> <quote>l2tp</quote> to represent the tunneled layer 2 traffic.</para>
<blockquote> <blockquote>
<para><filename>/etc/shorewall/zones</filename> — System A</para> <para><filename>/etc/shorewall/zones</filename> — System A</para>
@ -716,11 +719,11 @@ loc ipv4
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote> </blockquote>
<para>Since the L2TP will require the use of pppd, you will end up with one <para>Since the L2TP will require the use of pppd, you will end up with
or more ppp interfaces (each representing an individual road warrior one or more ppp interfaces (each representing an individual road warrior
connection) for which you will need to account. This can be done by connection) for which you will need to account. This can be done by
modifying the inerfaces file. (Modify with additional options as needed.) modifying the inerfaces file. (Modify with additional options as
</para> needed.)</para>
<blockquote> <blockquote>
<para><filename>/etc/shorewall/interfaces</filename>:</para> <para><filename>/etc/shorewall/interfaces</filename>:</para>
@ -735,34 +738,34 @@ l2tp ppp+ -
<para>The next thing that must be done is to adjust the policy so that the <para>The next thing that must be done is to adjust the policy so that the
traffic can go where it needs to go.</para> traffic can go where it needs to go.</para>
<para>First, you need to decide if you want for hosts in your local zone to <para>First, you need to decide if you want for hosts in your local zone
be able to connect to your road warriors. You may or may not want to allow to be able to connect to your road warriors. You may or may not want to
this. For example, one reason you might want to allow this is so that your allow this. For example, one reason you might want to allow this is so
support personnel can use ssh, VNC or remote desktop to fix a problem on that your support personnel can use ssh, VNC or remote desktop to fix a
the road warrior's laptop.</para> problem on the road warrior's laptop.</para>
<para>Second, you need to decide if you want the road warrior to have <para>Second, you need to decide if you want the road warrior to have
access to hosts on the local network. You generally want to allow this. access to hosts on the local network. You generally want to allow this.
For example, if you have DNS servers on your local network that you want For example, if you have DNS servers on your local network that you want
the road warrior to use. Or perhaps the road warrior needs to mount NFS the road warrior to use. Or perhaps the road warrior needs to mount NFS
shares or needs to access intranet sites which are not visible from the shares or needs to access intranet sites which are not visible from the
public Internet.</para> public Internet.</para>
<para>Finally, you need to decide if you want the road warriors to be able <para>Finally, you need to decide if you want the road warriors to be able
to access the public Internet. You probably want to do this, unless you to access the public Internet. You probably want to do this, unless you
are trying to create a situation where when the road warrior connects to are trying to create a situation where when the road warrior connects to
the VPN, it is no longer possible to send traffic from the road warrior's the VPN, it is no longer possible to send traffic from the road warrior's
machine to the public Internet. Please note that this not really a strong machine to the public Internet. Please note that this not really a strong
security measure. The road warrior could trivially modify the routing security measure. The road warrior could trivially modify the routing
table on the remote machine to have only traffic destined for systems on table on the remote machine to have only traffic destined for systems on
the VPN local network go through the secure channel. The rest of the the VPN local network go through the secure channel. The rest of the
traffic would simply travel over an Ethernet or wireless interface directly traffic would simply travel over an Ethernet or wireless interface
to the public Internet. In fact, this latter situation is dangerous, as a directly to the public Internet. In fact, this latter situation is
simple mistake could easily create a situation where the road warrior's dangerous, as a simple mistake could easily create a situation where the
machine is acting as a router between your local network and the public road warrior's machine is acting as a router between your local network
Internet, which you certainly do not want to happen. In short, it is best and the public Internet, which you certainly do not want to happen. In
to allow the road warrior to connect to the public Internet by short, it is best to allow the road warrior to connect to the public
default.</para> Internet by default.</para>
<blockquote> <blockquote>
<para><filename>/etc/shorewall/policy</filename>:</para> <para><filename>/etc/shorewall/policy</filename>:</para>
@ -779,12 +782,12 @@ all all REJECT info
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote> </blockquote>
<para>The final step is to modify your rules file. There are two important <para>The final step is to modify your rules file. There are two important
components. First, you must allow the l2tp traffic to reach the xl2tpd components. First, you must allow the l2tp traffic to reach the xl2tpd
process running on the firewall machine. Second, you must add rules to process running on the firewall machine. Second, you must add rules to
open up ports on the firewall to the road warrior for services which are open up ports on the firewall to the road warrior for services which are
running on the firewall. For example, if you are running a webserver on running on the firewall. For example, if you are running a webserver on
the firewall that must be accessible to road warriors. The reason for the the firewall that must be accessible to road warriors. The reason for the
second step is that the policy does not by default allow unrestricted second step is that the policy does not by default allow unrestricted
access to the firewall itself.</para> access to the firewall itself.</para>
@ -989,4 +992,4 @@ all all REJECT info
ipsec-tools source tree. It has a wide variety of sample racoon ipsec-tools source tree. It has a wide variety of sample racoon
configuration files.</para> configuration files.</para>
</section> </section>
</article> </article>