My first svn commit! Expand the policy entries in the samples.

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@3563 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Samples/one-interface/policy

@@ -84,6 +84,8 @@
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
 $FW		net		ACCEPT
+$FW		net		REJECT		info
+net		$FW		DROP		info
 net		all		DROP		info
 # The FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info

Samples/three-interfaces/policy

@@ -83,14 +83,59 @@
 #
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
+
+#
+# Note about policies and logging:
+#	This file contains an explicit policy for every combination of
+#	zones defined in this sample.  This is solely for the purpose of
+#	providing more specific messages in the logs.  This is not
+#	necessary for correct operation of the firewall, but greatly
+#	assists in diagnosing problems.
+#
+
+#
+# Policies for traffic originating from the local LAN (loc)
+#
+# If you want to force clients to access the Internet via a proxy server
+# in your DMZ, change the following policy to REJECT info.
 loc		net		ACCEPT
-# If you want open access to the Internet from your Firewall
+# If you want open access to DMZ from loc, change the following policy
-# remove the comment from the following line.
+# to ACCEPT.  (If you chose not to do this, you will need to add a rule
-#$FW		net		ACCEPT
+# for each service in the rules file.)
-# Also If You Wish To Open Up DMZ Access To The Internet
+loc		dmz		REJECT		info
-# remove the comment from the following line.
+loc		$FW		REJECT		info
-#dmz		net		ACCEPT
+loc		all		REJECT		info
+
+#
+# Policies for traffic originating from the firewall ($FW)
+#
+# If you want open access to the Internet from your firewall, change the
+# following policy to ACCEPT.
+$FW		net		REJECT		info
+$FW		dmz		REJECT		info
+$FW		loc		REJECT		info
+$FW		all		REJECT		info
+
+#
+# Policies for traffic originating from the De-Militarized Zone (dmz)
+#
+# If you want open access from DMZ to the Internet change the following
+# policy to ACCEPT.  This may be useful if you run a proxy server in
+# your DMZ.
+dmz		net		REJECT		info
+dmz		$FW		REJECT		info
+dmz		loc		REJECT		info
+dmz		all		REJECT		info
+
+#
+# Policies for traffic originating from the Internet zone (net)
+#
+net		dmz		DROP		info
+net		$FW		DROP		info
+net		loc		DROP		info
 net		all		DROP		info
+
 # THE FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info
+
 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

Samples/two-interfaces/policy

@@ -83,11 +83,43 @@
 #
 ###############################################################################
 #SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
+
+#
+# Note about policies and logging:
+#	This file contains an explicit policy for every combination of
+#	zones defined in this sample.  This is solely for the purpose of
+#	providing more specific messages in the logs.  This is not
+#	necessary for correct operation of the firewall, but greatly
+#	assists in diagnosing problems.
+#
+
+#
+# Policies for traffic originating from the local LAN (loc)
+#
+# If you want to force clients to access the Internet via a proxy server
+# on your firewall, change the following policy to REJECT info.
 loc		net		ACCEPT
-# If you want open access to the Internet from your Firewall
+loc		$FW		REJECT		info
-# remove the comment from the following line.
+loc		all		REJECT		info
-#$FW		net		ACCEPT
+
+#
+# Policies for traffic originating from the firewall ($FW)
+#
+# If you want open access to the Internet from your firewall, change the
+# following policy to ACCEPT.  This may be useful if you run a proxy
+# server on the firewall.
+$FW		net		REJECT		info
+$FW		loc		REJECT		info
+$FW		all		REJECT		info
+
+#
+# Policies for traffic originating from the Internet zone (net)
+#
+net		$FW		DROP		info
+net		loc		DROP		info
 net		all		DROP		info
+
 # THE FOLLOWING POLICY MUST BE LAST
 all		all		REJECT		info
+
 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE