extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-05 04:58:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add 2.6 IPSEC documentation

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-08-16 22:17:09 +00:00
parent 4292ef2e98
commit bac33d7c78
5 changed files with 1266 additions and 517 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

921
Shorewall-docs2/FAQ.xml
View File

File diff suppressed because it is too large Load Diff

294
Shorewall-docs2/IPSEC-2.6.xml Normal file
View File

@ -0,0 +1,294 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article id="IPSEC">
<!--$Id$-->
<articleinfo>
<title>IPSEC using Linux Kernel 2.6</title>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
</author>
</authorgroup>
<pubdate>2004-08-15</pubdate>
<copyright>
<year>2004</year>
<holder>Thomas M. Eastep</holder>
</copyright>
<legalnotice>
<para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice>
</articleinfo>
<warning>
<para>To use this support, your kernel and iptables must include the
Netfilter+ipsec patches and policy match support and you must be running
Shorewall 2.1.4 or later.</para>
</warning>
<warning>
<para>As of this writing, the Netfilter+ipsec and policy match support are
broken when used with a bridge device. The problem has been reported to
the responsible Netfilter developer who has confirmed the problem.</para>
</warning>
<section>
<title>IPSec Gateway on the Firewall System</title>
<para>Suppose that we have the following sutuation:</para>
<graphic fileref="images/TwoNets1.png" />
<para>We want systems in the 192.168.1.0/24 sub-network to be able to
communicate with systems in the 10.0.0.0/8 network. We assume that on both
systems A and B, eth0 is the internet interface.</para>
<para>To make this work, we need to do two things:</para>
<orderedlist numeration="loweralpha">
<listitem>
<para>Open the firewall so that the IPSEC tunnel can be established
(allow the ESP and AH protocols and UDP Port 500).</para>
</listitem>
<listitem>
<para>Allow traffic through the tunnel.</para>
</listitem>
</orderedlist>
<para>Opening the firewall for the IPSEC tunnel is accomplished by adding
an entry to the <filename>/etc/shorewall/tunnels</filename> file.</para>
<para>In <filename>/etc/shorewall/tunnels</filename> on system A, we need
the following</para>
<blockquote>
<para><filename>/etc/shorewall/tunnels</filename> — System A:</para>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec net 134.28.54.2
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
<para><filename>/etc/shorewall/tunnels</filename> — System B:</para>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec net 206.161.148.9
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote>
<note>
<para>If either of the endpoints is behind a NAT gateway then the
tunnels file entry on the <emphasis role="bold">other</emphasis>
endpoint should specify a tunnel type of ipsecnat rather than ipsec and
the GATEWAY address should specify the external address of the NAT
gateway.</para>
</note>
<para>You need to define a zone for the remote subnet or include it in
your local zone. In this example, we'll assume that you have created a
zone called <quote>vpn</quote> to represent the remote subnet.</para>
<blockquote>
<para><filename>/etc/shorewall/zones</filename> — Systems A and
B:</para>
<programlisting>#ZONE DISPLAY COMMENTS
net Internet The big bad internet
vpn VPN Virtual Private Network
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote>
<para>Remember the assumption that both systems A and B have eth0 as their
internet interface.</para>
<para>You must define the vpn zone using the
<filename>/etc/shorewall/hosts</filename> file.</para>
<blockquote>
<para>/etc/shorewall/hosts — System A</para>
<programlisting>#ZONE HOSTS OPTIONS
vpn eth0:10.0.0.0/8 <emphasis role="bold">ipsec</emphasis>
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
<para>/etc/shorewall/hosts — System B</para>
<programlisting>#ZONE HOSTS OPTIONS
vpn eth0:192.168.1.0/24 <emphasis role="bold">ipsec</emphasis>
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote>
<para>Once you have these entries in place, restart Shorewall (type
shorewall restart); you are now ready to configure IPSEC.</para>
</section>
<section>
<title>Mobile System (Road Warrior)</title>
<para>Suppose that you have a laptop system (B) that you take with you
when you travel and you want to be able to establish a secure connection
back to your local network.</para>
<graphic fileref="images/Mobile.png" />
<example>
<title>Road Warrior VPN</title>
<para>You need to define a zone for the laptop or include it in your
local zone. In this example, we'll assume that you have created a zone
called <quote>vpn</quote> to represent the remote host.</para>
<blockquote>
<para>/etc/shorewall/zones — System A</para>
<programlisting>#ZONE DISPLAY COMMENTS
net Internet The big bad internet
vpn VPN Road Warriors
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote>
<para>In this instance, the mobile system (B) has IP address 134.28.54.2
but that cannot be determined in advance. In the
<filename>/etc/shorewall/tunnels</filename> file on system A, the
following entry should be made:<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec net 0.0.0.0/0 vpn
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote></para>
<para><note>
<para>the GATEWAY ZONE column contains the name of the zone
corresponding to peer subnetworks. This indicates that the gateway
system itself comprises the peer subnetwork; in other words, the
remote gateway is a standalone system.</para>
</note></para>
<para>The VPN zone is defined using the /etc/shorewall/hosts
file:</para>
<blockquote>
<para>/etc/shorewall/hosts — System A:</para>
<programlisting>#ZONE HOSTS OPTIONS
vpn eth0:0.0.0.0/0 <emphasis role="bold"> ipsec</emphasis>
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
</blockquote>
<para>You will need to configure your <quote>through the tunnel</quote>
policy as shown under the first example above.</para>
</example>
</section>
<section>
<title>Transport Mode</title>
<para>In today's wireless world, it is often the case that individual
hosts in a network need to establish secure connections with the other
hosts in that network. In that case, IPSEC transport mode is an
appropriate solution.</para>
<para><graphic fileref="images/TransportMode.png" />Here's an example
using the ipsec-tools package. The files shown are from host
192.168.20.10; the configuration of the other nodes is similar.</para>
<blockquote>
<para><filename>/etc/racoon/racoon.conf</filename>:</para>
<programlisting>path pre_shared_key "/etc/racoon/psk.txt" ;
remote anonymous
{
exchange_mode aggressive ;
my_identifier user_fqdn "teastep@shorewall.net" ;
lifetime time 24 hour ;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key ;
dh_group 2 ;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 12 hour ;
encryption_algorithm 3des, blowfish, des, rijndael ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
</programlisting>
<para><filename>/etc/racoon/setkey.conf</filename>:</para>
<programlisting># First of all flush the SPD database
spdflush;
# Add some SPD rules
spdadd 192.168.20.10/32 192.168.20.20/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.20/require;
spdadd 192.168.20.20/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.20-192.168.20.10/require;
spdadd 192.168.20.10/32 192.168.20.30/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.30/require;
spdadd 192.168.20.30/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.30-192.168.20.10/require;
spdadd 192.168.20.10/32 192.168.20.40/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.40/require;
spdadd 192.168.20.40/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.40-192.168.20.10/require;
</programlisting>
<para>/etc/racoon/psk.txt:</para>
<programlisting>teastep@shorewall.net &lt;key&gt;</programlisting>
</blockquote>
<para>Shorewall configuration goes as follows:</para>
<blockquote>
<para><filename>/etc/shorewall/zones</filename>:</para>
<programlisting>#ZONE DISPLAY COMMENTS
loc Local Local Network
net Net Internet
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
<para><filename>/etc/shorewall/interfaces</filename>:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect routefilter,dhcp,tcpflags
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
<para><filename>/etc/shorewall/hosts</filename>:</para>
<programlisting>#ZONE HOST(S) OPTIONS
loc eth0:192.168.20.0/24 ipsec
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE</programlisting>
<para><filename>/etc/shorewall/policy</filename>:</para>
<programlisting>#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
fw all ACCEPT
loc fw ACCEPT
net loc NONE
loc net NONE
net all DROP info
# The FOLLOWING POLICY MUST BE LAST
all all REJECT info
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
<para>Since there are no cases where net&lt;-&gt;loc traffic should
occur, NONE policies are used.</para>
</blockquote>
</section>
</article>

8
Shorewall-docs2/IPSEC.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-08-13</pubdate> <pubdate>2004-08-15</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -39,6 +39,12 @@
Kernel. Netfilter currently lacks full support for the 2.6 kernel's Kernel. Netfilter currently lacks full support for the 2.6 kernel's
implementation of IPSEC. Until that implementation is complete, only a implementation of IPSEC. Until that implementation is complete, only a
simple network-network tunnel is described for 2.6.</para> simple network-network tunnel is described for 2.6.</para>
<para>UPDATE: Some distributions such as <trademark>SuSE</trademark> are
now shipping Kernels and iptables with the IPSEC-Netfilter patches and
policy match support. Check <ulink url="IPSEC-2.6.html">this
article</ulink> for information concerning this support and
Shorewall.</para>
</warning> </warning>
<section> <section>

BIN
Shorewall-docs2/images/TransportMode.png
View File

Binary file not shown.

560
Shorewall-docs2/three-interface.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-07-31</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2002-2004</year> <year>2002-2004</year>
@ -29,7 +29,8 @@
1.2 or any later version published by the Free Software Foundation; with 1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para> <quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice> </legalnotice>
</articleinfo> </articleinfo>
@ -40,9 +41,9 @@
is a fairly straight-forward task if you understand the basics and follow is a fairly straight-forward task if you understand the basics and follow
the documentation.</para> the documentation.</para>
<para>This guide doesn&#39;t attempt to acquaint you with all of the <para>This guide doesn't attempt to acquaint you with all of the features
features of Shorewall. It rather focuses on what is required to configure of Shorewall. It rather focuses on what is required to configure Shorewall
Shorewall in one of its more popular configurations:</para> in one of its more popular configurations:</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
@ -55,8 +56,9 @@
<note> <note>
<para>If you have more than one public IP address, this is not the <para>If you have more than one public IP address, this is not the
guide you want -- see the <ulink url="shorewall_setup_guide.htm">Shorewall guide you want -- see the <ulink
Setup Guide</ulink> instead.</para> url="shorewall_setup_guide.htm">Shorewall Setup Guide</ulink>
instead.</para>
</note> </note>
</listitem> </listitem>
@ -85,12 +87,13 @@
<section> <section>
<title>Requirements</title> <title>Requirements</title>
<para>Shorewall requires that you have the <command>iproute</command>/<command>iproute2</command> <para>Shorewall requires that you have the
package installed (on <trademark>RedHat</trademark>, the package is <command>iproute</command>/<command>iproute2</command> package installed
called <command>iproute</command>). You can tell if this package is (on <trademark>RedHat</trademark>, the package is called
installed by the presence of an <command>ip</command> program on your <command>iproute</command>). You can tell if this package is installed
firewall system. As <systemitem class="username">root</systemitem>, you by the presence of an <command>ip</command> program on your firewall
can use the <command>which</command> command to check for this program:</para> system. As <systemitem class="username">root</systemitem>, you can use
the <command>which</command> command to check for this program:</para>
<programlisting>[root@gateway root]# <command>which ip</command> <programlisting>[root@gateway root]# <command>which ip</command>
/sbin/ip /sbin/ip
@ -101,8 +104,8 @@
<title>Before you start</title> <title>Before you start</title>
<para>I recommend that you first read through the guide to familiarize <para>I recommend that you first read through the guide to familiarize
yourself with what&#39;s involved then go back through it again making yourself with what's involved then go back through it again making your
your configuration changes.</para> configuration changes.</para>
<caution> <caution>
<para>If you edit your configuration files on a <para>If you edit your configuration files on a
@ -121,7 +124,8 @@
</listitem> </listitem>
<listitem> <listitem>
<para><ulink url="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux <para><ulink
url="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
Version of dos2unix</ulink></para> Version of dos2unix</ulink></para>
</listitem> </listitem>
</itemizedlist> </itemizedlist>
@ -132,7 +136,8 @@
<title>Conventions</title> <title>Conventions</title>
<para>Points at which configuration changes are recommended are flagged <para>Points at which configuration changes are recommended are flagged
with <inlinegraphic fileref="images/BD21298_.gif" format="GIF" />.</para> with <inlinegraphic fileref="images/BD21298_.gif"
format="GIF" />.</para>
<para>Configuration notes that are unique to LEAF/Bering are marked with <para>Configuration notes that are unique to LEAF/Bering are marked with
<inlinegraphic fileref="images/leaflogo.gif" format="GIF" />.</para> <inlinegraphic fileref="images/leaflogo.gif" format="GIF" />.</para>
@ -145,9 +150,10 @@
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>If you have an ADSL Modem and you use PPTP to communicate with a <para>If you have an ADSL Modem and you use PPTP to communicate with a
server in that modem, you must make the <ulink url="PPTP.htm#PPTP_ADSL">changes server in that modem, you must make the <ulink
recommended here</ulink> in addition to those detailed below. ADSL with url="PPTP.htm#PPTP_ADSL">changes recommended here</ulink> in addition to
PPTP is most commonly found in Europe, notably in Austria.</para> those detailed below. ADSL with PPTP is most commonly found in Europe,
notably in Austria.</para>
</section> </section>
<section> <section>
@ -157,23 +163,30 @@
<para>The configuration files for Shorewall are contained in the directory <para>The configuration files for Shorewall are contained in the directory
<filename>/etc/shorewall</filename> -- for simple setups, you will only <filename>/etc/shorewall</filename> -- for simple setups, you will only
need to deal with a few of these as described in this guide.<warning><para><emphasis need to deal with a few of these as described in this guide.<warning>
role="bold">Note to Debian Users</emphasis></para><para>If you install <para><emphasis role="bold">Note to Debian Users</emphasis></para>
using the .deb, you will find that your <filename class="directory">/etc/shorewall</filename>
directory is empty. This is intentional. The released configuration file <para>If you install using the .deb, you will find that your <filename
skeletons may be found on your system in the directory <filename class="directory">/etc/shorewall</filename> directory is empty. This
class="directory">/usr/share/doc/shorewall/default-config</filename>. is intentional. The released configuration file skeletons may be found
Simply copy the files you need from that directory to <filename on your system in the directory <filename
class="directory">/etc/shorewall</filename> and modify the copies.</para><para>Note class="directory">/usr/share/doc/shorewall/default-config</filename>.
that you must copy <filename class="directory">/usr/share/doc/shorewall/default-config/shorewall.conf</filename> Simply copy the files you need from that directory to <filename
and /usr/share/doc/shorewall/default-config/modules to /etc/shorewall even class="directory">/etc/shorewall</filename> and modify the
if you do not modify those files.</para></warning></para> copies.</para>
<para>Note that you must copy <filename
class="directory">/usr/share/doc/shorewall/default-config/shorewall.conf</filename>
and /usr/share/doc/shorewall/default-config/modules to /etc/shorewall
even if you do not modify those files.</para>
</warning></para>
<para>After you have installed Shorewall, download the <ulink <para>After you have installed Shorewall, download the <ulink
url="http://shorewall.net/pub/shorewall/Samples">three-interface sample</ulink>, url="http://shorewall.net/pub/shorewall/Samples">three-interface
un-tar it (<command>tar <option>-zxvf</option> <filename>three-interfaces.tgz</filename></command>) sample</ulink>, un-tar it (<command>tar <option>-zxvf</option>
and and copy the files to <filename>/etc/shorewall</filename> (the files <filename>three-interfaces.tgz</filename></command>) and and copy the
will replace files with the same names that were placed in files to <filename>/etc/shorewall</filename> (the files will replace files
with the same names that were placed in
<filename>/etc/shorewall</filename> when Shorewall was installed).</para> <filename>/etc/shorewall</filename> when Shorewall was installed).</para>
<para>As each file is introduced, I suggest that you look through the <para>As each file is introduced, I suggest that you look through the
@ -216,7 +229,8 @@
</tgroup> </tgroup>
</informaltable> </informaltable>
<para>Zone names are defined in <filename>/etc/shorewall/zones</filename>.</para> <para>Zone names are defined in
<filename>/etc/shorewall/zones</filename>.</para>
<para>Shorewall also recognizes the firewall system as its own zone - by <para>Shorewall also recognizes the firewall system as its own zone - by
default, the firewall itself is known as <varname>fw</varname>.</para> default, the firewall itself is known as <varname>fw</varname>.</para>
@ -227,7 +241,8 @@
<itemizedlist> <itemizedlist>
<listitem> <listitem>
<para>You express your default policy for connections from one zone to <para>You express your default policy for connections from one zone to
another zone in the <filename>/etc/shorewall/policy</filename> file.</para> another zone in the <filename>/etc/shorewall/policy</filename>
file.</para>
</listitem> </listitem>
<listitem> <listitem>
@ -311,31 +326,37 @@ fw net ACCEPT</programlisting>
<quote>Modem</quote> (e.g., <filename class="devicefile">eth0</filename>) <quote>Modem</quote> (e.g., <filename class="devicefile">eth0</filename>)
unless you connect via <emphasis>Point-to-Point Protocol</emphasis> over unless you connect via <emphasis>Point-to-Point Protocol</emphasis> over
Ethernet (PPPoE) or <emphasis>Point-to-Point Tunneling Protocol</emphasis> Ethernet (PPPoE) or <emphasis>Point-to-Point Tunneling Protocol</emphasis>
(PPTP) in which case the External Interface will be a <literal>ppp</literal> (PPTP) in which case the External Interface will be a
interface (e.g., <filename class="devicefile">ppp0</filename>). If you <literal>ppp</literal> interface (e.g., <filename
connect via a regular modem, your External Interface will also be class="devicefile">ppp0</filename>). If you connect via a regular modem,
<filename class="devicefile">ppp0</filename>. If you connect using ISDN, your External Interface will also be <filename
you external interface will be <filename class="devicefile">ippp0</filename>.</para> class="devicefile">ppp0</filename>. If you connect using ISDN, you
external interface will be <filename
class="devicefile">ippp0</filename>.</para>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>If your external interface is <filename class="devicefile">ppp0</filename> <para>If your external interface is <filename
or <filename class="devicefile">ippp0</filename> then you will want to set class="devicefile">ppp0</filename> or <filename
<varname>CLAMPMSS=yes</varname> in <filename>/etc/shorewall/shorewall.conf</filename>.</para> class="devicefile">ippp0</filename> then you will want to set
<varname>CLAMPMSS=yes</varname> in
<filename>/etc/shorewall/shorewall.conf</filename>.</para>
<para>Your Local Interface will be an ethernet adapter (<filename <para>Your Local Interface will be an ethernet adapter (<filename
class="devicefile">eth0</filename>, <filename class="devicefile">eth1</filename> class="devicefile">eth0</filename>, <filename
or <filename class="devicefile">eth2</filename>) and will be connected to class="devicefile">eth1</filename> or <filename
a hub or switch. Your local computers will be connected to the same switch class="devicefile">eth2</filename>) and will be connected to a hub or
(note: If you have only a single local system, you can connect the switch. Your local computers will be connected to the same switch (note:
firewall directly to the computer using a cross-over cable).</para> If you have only a single local system, you can connect the firewall
directly to the computer using a cross-over cable).</para>
<para>Your DMZ Interface will also be an ethernet adapter (<filename <para>Your DMZ Interface will also be an ethernet adapter (<filename
class="devicefile">eth0</filename>, <filename class="devicefile">eth1</filename> class="devicefile">eth0</filename>, <filename
or <filename class="devicefile">eth2</filename>) and will be connected to class="devicefile">eth1</filename> or <filename
a hub or switch. Your DMZ computers will be connected to the same switch class="devicefile">eth2</filename>) and will be connected to a hub or
(note: If you have only a single DMZ system, you can connect the firewall switch. Your DMZ computers will be connected to the same switch (note: If
directly to the computer using a cross-over cable).</para> you have only a single DMZ system, you can connect the firewall directly
to the computer using a cross-over cable).</para>
<caution> <caution>
<para>Do not connect the internal and external interface to the same hub <para>Do not connect the internal and external interface to the same hub
@ -359,23 +380,25 @@ fw net ACCEPT</programlisting>
for the interfaces. Some hints:</para> for the interfaces. Some hints:</para>
<tip> <tip>
<para>If your external interface is <filename class="devicefile">ppp0</filename> <para>If your external interface is <filename
or <filename class="devicefile">ippp0</filename>, you can replace the class="devicefile">ppp0</filename> or <filename
class="devicefile">ippp0</filename>, you can replace the
<quote>detect</quote> in the second column with <quote>-</quote> <quote>detect</quote> in the second column with <quote>-</quote>
(without the quotes).</para> (without the quotes).</para>
</tip> </tip>
<tip> <tip>
<para>If your external interface is <filename class="devicefile">ppp0</filename> <para>If your external interface is <filename
or <filename class="devicefile">ippp0</filename> or if you have a static class="devicefile">ppp0</filename> or <filename
IP address, you can remove <quote>dhcp</quote> from the option list.</para> class="devicefile">ippp0</filename> or if you have a static IP address,
you can remove <quote>dhcp</quote> from the option list.</para>
</tip> </tip>
<tip> <tip>
<para>If you specify <emphasis>nobogons</emphasis> for your external <para>If you specify <emphasis>nobogons</emphasis> for your external
interface, you will want to check the <ulink url="errata.htm">Shorewall interface, you will want to check the <ulink url="errata.htm">Shorewall
Errata</ulink> periodically for updates to the <filename>/usr/share/shorewall/bogons Errata</ulink> periodically for updates to the
file</filename>.</para> <filename>/usr/share/shorewall/bogons file</filename>.</para>
</tip> </tip>
</section> </section>
@ -388,7 +411,7 @@ fw net ACCEPT</programlisting>
Configuration Protocol (DHCP) or as part of establishing your connection Configuration Protocol (DHCP) or as part of establishing your connection
when you dial in (standard modem) or establish your PPP connection. In when you dial in (standard modem) or establish your PPP connection. In
rare cases, your ISP may assign you a static IP address; that means that rare cases, your ISP may assign you a static IP address; that means that
you configure your firewall&#39;s external interface to use that address you configure your firewall's external interface to use that address
permanently. Regardless of how the address is assigned, it will be shared permanently. Regardless of how the address is assigned, it will be shared
by all of your systems when you access the Internet. You will have to by all of your systems when you access the Internet. You will have to
assign your own addresses for your internal network (the local and DMZ assign your own addresses for your internal network (the local and DMZ
@ -403,16 +426,17 @@ fw net ACCEPT</programlisting>
<para>Before starting Shorewall, you should look at the IP address of your <para>Before starting Shorewall, you should look at the IP address of your
external interface and if it is one of the above ranges, you should remove external interface and if it is one of the above ranges, you should remove
the <varname>norfc1918</varname> option from the external interface&#39;s the <varname>norfc1918</varname> option from the external interface's
entry in <filename>/etc/shorewall/interfaces</filename>.</para> entry in <filename>/etc/shorewall/interfaces</filename>.</para>
<para>You will want to assign your local addresses from one sub-network or <para>You will want to assign your local addresses from one sub-network or
subnet and your DMZ addresses from another subnet. For our purposes, we subnet and your DMZ addresses from another subnet. For our purposes, we
can consider a subnet to consists of a range of addresses <systemitem can consider a subnet to consists of a range of addresses <systemitem
class="ipaddress">x.y.z.0</systemitem> - <systemitem class="ipaddress">x.y.z.255</systemitem>. class="ipaddress">x.y.z.0</systemitem> - <systemitem
Such a subnet will have a Subnet Mask of <systemitem class="netmask">255.255.255.0</systemitem>. class="ipaddress">x.y.z.255</systemitem>. Such a subnet will have a Subnet
The address <systemitem class="ipaddress">x.y.z.0</systemitem> is reserved Mask of <systemitem class="netmask">255.255.255.0</systemitem>. The
as the Subnet Address and <systemitem class="netmask">x.y.z.255</systemitem> address <systemitem class="ipaddress">x.y.z.0</systemitem> is reserved as
the Subnet Address and <systemitem class="netmask">x.y.z.255</systemitem>
is reserved as the Subnet Broadcast Address. In Shorewall, a subnet is is reserved as the Subnet Broadcast Address. In Shorewall, a subnet is
described using Classless InterDomain Routing (CIDR) notation with described using Classless InterDomain Routing (CIDR) notation with
consists of the subnet address followed by <varname>/24</varname>. The consists of the subnet address followed by <varname>/24</varname>. The
@ -436,27 +460,31 @@ fw net ACCEPT</programlisting>
<row> <row>
<entry>Subnet Address:</entry> <entry>Subnet Address:</entry>
<entry><systemitem class="ipaddress">10.10.10.0</systemitem></entry> <entry><systemitem
class="ipaddress">10.10.10.0</systemitem></entry>
</row> </row>
<row> <row>
<entry>Broadcast Address:</entry> <entry>Broadcast Address:</entry>
<entry><systemitem class="ipaddress">10.10.10.255</systemitem></entry> <entry><systemitem
class="ipaddress">10.10.10.255</systemitem></entry>
</row> </row>
<row> <row>
<entry>CIDR Notation:</entry> <entry>CIDR Notation:</entry>
<entry><systemitem class="ipaddress">10.10.10.0/24</systemitem></entry> <entry><systemitem
class="ipaddress">10.10.10.0/24</systemitem></entry>
</row> </row>
</tbody> </tbody>
</tgroup> </tgroup>
</table> </table>
<para>It is conventional to assign the internal interface either the first <para>It is conventional to assign the internal interface either the first
usable address in the subnet (<systemitem class="ipaddress">10.10.10.1</systemitem> usable address in the subnet (<systemitem
in the above example) or the last usable address (<systemitem class="ipaddress">10.10.10.1</systemitem> in the above example) or the
last usable address (<systemitem
class="ipaddress">10.10.10.254</systemitem>).</para> class="ipaddress">10.10.10.254</systemitem>).</para>
<para>One of the purposes of subnetting is to allow all computers in the <para>One of the purposes of subnetting is to allow all computers in the
@ -466,17 +494,18 @@ fw net ACCEPT</programlisting>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>Your local computers (Local Computers 1 &#38; 2) should be <para>Your local computers (Local Computers 1 &amp; 2) should be
configured with their default gateway set to the IP address of the configured with their default gateway set to the IP address of the
firewall&#39;s internal interface and your DMZ computers (DMZ Computers 1 firewall's internal interface and your DMZ computers (DMZ Computers 1
&#38; 2) should be configured with their default gateway set to the IP &amp; 2) should be configured with their default gateway set to the IP
address of the firewall&#39;s DMZ interface.</para> address of the firewall's DMZ interface.</para>
<para>The foregoing short discussion barely scratches the surface <para>The foregoing short discussion barely scratches the surface
regarding subnetting and routing. If you are interested in learning more regarding subnetting and routing. If you are interested in learning more
about IP addressing and routing, I highly recommend <quote>IP about IP addressing and routing, I highly recommend <quote>IP
Fundamentals: What Everyone Needs to Know about Addressing &#38; Routing</quote>, Fundamentals: What Everyone Needs to Know about Addressing &amp;
Thomas A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.</para> Routing</quote>, Thomas A. Maufer, Prentice-Hall, 1999, ISBN
0-13-975483-0.</para>
<para>The remainder of this quide will assume that you have configured <para>The remainder of this quide will assume that you have configured
your network as shown here:</para> your network as shown here:</para>
@ -492,13 +521,15 @@ fw net ACCEPT</programlisting>
<caption> <caption>
<para>The default gateway for the DMZ computers would be <systemitem <para>The default gateway for the DMZ computers would be <systemitem
class="ipaddress">10.10.11.254</systemitem> and the default gateway class="ipaddress">10.10.11.254</systemitem> and the default gateway
for the Local computers would be <systemitem class="ipaddress">10.10.10.254</systemitem>.</para> for the Local computers would be <systemitem
class="ipaddress">10.10.10.254</systemitem>.</para>
<warning> <warning>
<para>Your ISP might assign your external interface an RFC 1918 <para>Your ISP might assign your external interface an RFC 1918
address. If that address is in the <systemitem class="ipaddress">10.10.10.0/24</systemitem> address. If that address is in the <systemitem
subnet then you will need to select a DIFFERENT RFC 1918 subnet class="ipaddress">10.10.10.0/24</systemitem> subnet then you will
for your local network and if it is in the <systemitem need to select a DIFFERENT RFC 1918 subnet for your local network
and if it is in the <systemitem
class="ipaddress">10.10.11.0/24</systemitem> subnet then you will class="ipaddress">10.10.11.0/24</systemitem> subnet then you will
need to select a different RFC 1918 subnet for your DMZ.</para> need to select a different RFC 1918 subnet for your DMZ.</para>
</warning> </warning>
@ -511,49 +542,59 @@ fw net ACCEPT</programlisting>
<title>IP Masquerading (SNAT)</title> <title>IP Masquerading (SNAT)</title>
<para>The addresses reserved by RFC 1918 are sometimes referred to as <para>The addresses reserved by RFC 1918 are sometimes referred to as
non-routable because the Internet backbone routers don&#39;t forward non-routable because the Internet backbone routers don't forward packets
packets which have an RFC-1918 destination address. When one of your local which have an RFC-1918 destination address. When one of your local systems
systems (let&#39;s assume local computer 1) sends a connection request to (let's assume local computer 1) sends a connection request to an internet
an internet host, the firewall must perform Network Address Translation host, the firewall must perform Network Address Translation (NAT). The
(NAT). The firewall rewrites the source address in the packet to be the firewall rewrites the source address in the packet to be the address of
address of the firewall&#39;s external interface; in other words, the the firewall's external interface; in other words, the firewall makes it
firewall makes it look as if the firewall itself is initiating the look as if the firewall itself is initiating the connection. This is
connection. This is necessary so that the destination host will be able to necessary so that the destination host will be able to route return
route return packets back to the firewall (remember that packets whose packets back to the firewall (remember that packets whose destination
destination address is reserved by RFC 1918 can&#39;t be routed accross address is reserved by RFC 1918 can't be routed accross the internet).
the internet). When the firewall receives a return packet, it rewrites the When the firewall receives a return packet, it rewrites the destination
destination address back to 10.10.10.1 and forwards the packet on to local address back to 10.10.10.1 and forwards the packet on to local computer
computer 1.</para> 1.</para>
<para>On Linux systems, the above process is often referred to as IP <para>On Linux systems, the above process is often referred to as IP
Masquerading and you will also see the term Source Network Address Masquerading and you will also see the term Source Network Address
Translation (SNAT) used. Shorewall follows the convention used with Translation (SNAT) used. Shorewall follows the convention used with
Netfilter: <itemizedlist><listitem><para><emphasis>Masquerade</emphasis> Netfilter: <itemizedlist>
describes the case where you let your firewall system automatically detect <listitem>
the external interface address.</para></listitem><listitem><para><emphasis>SNAT</emphasis> <para><emphasis>Masquerade</emphasis> describes the case where you
refers to the case when you explicitly specify the source address that you let your firewall system automatically detect the external interface
want outbound packets from your local network to use.</para></listitem></itemizedlist> address.</para>
In Shorewall, both Masquerading and SNAT are configured with entries in </listitem>
the <filename class="directory">/etc/shorewall/</filename><filename>masq</filename>
<listitem>
<para><emphasis>SNAT</emphasis> refers to the case when you
explicitly specify the source address that you want outbound packets
from your local network to use.</para>
</listitem>
</itemizedlist> In Shorewall, both Masquerading and SNAT are configured
with entries in the <filename
class="directory">/etc/shorewall/</filename><filename>masq</filename>
file.</para> file.</para>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>If your external firewall interface is <filename class="devicefile">eth0</filename>, <para>If your external firewall interface is <filename
your local interface <filename class="devicefile">eth1</filename> and your class="devicefile">eth0</filename>, your local interface <filename
DMZ interface is <filename class="devicefile">eth2</filename> then you do class="devicefile">eth1</filename> and your DMZ interface is <filename
not need to modify the file provided with the sample. Otherwise, edit class="devicefile">eth2</filename> then you do not need to modify the file
<filename class="directory">/etc/shorewall/</filename><filename>masq</filename> provided with the sample. Otherwise, edit <filename
and change it to match your configuration.</para> class="directory">/etc/shorewall/</filename><filename>masq</filename> and
change it to match your configuration.</para>
<para>If, despite all advice to the contrary, you are using this guide and <para>If, in spite of all advice to the contrary, you are using this guide
want to use one-to-one NAT or Proxy ARP for your DMZ, remove the entry for and want to use one-to-one NAT or Proxy ARP for your DMZ, remove the entry
eth2 from <filename>/etc/shorewall/masq</filename>.</para> for eth2 from <filename>/etc/shorewall/masq</filename>.</para>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>If your external IP is static, you can enter it in the third column <para>If your external IP is static, you can enter it in the third column
in the <filename class="directory">/etc/shorewall/</filename><filename>masq</filename> in the <filename
class="directory">/etc/shorewall/</filename><filename>masq</filename>
entry if you like although your firewall will work fine if you leave that entry if you like although your firewall will work fine if you leave that
column empty. Entering your static IP in column 3 makes processing column empty. Entering your static IP in column 3 makes processing
outgoing packets a little more efficient.</para> outgoing packets a little more efficient.</para>
@ -562,9 +603,16 @@ fw net ACCEPT</programlisting>
<para>If you are using the Debian package, please check your <para>If you are using the Debian package, please check your
<filename>shorewall.conf</filename> file to ensure that the following are <filename>shorewall.conf</filename> file to ensure that the following are
set correctly; if they are not, change them appropriately: set correctly; if they are not, change them appropriately: <itemizedlist>
<itemizedlist><listitem><para><varname>NAT_ENABLED=Yes</varname> <listitem>
(Shorewall versions earlier than 1.4.6)</para></listitem><listitem><para><varname>IP_FORWARDING=On</varname></para></listitem></itemizedlist></para> <para><varname>NAT_ENABLED=Yes</varname> (Shorewall versions earlier
than 1.4.6)</para>
</listitem>
<listitem>
<para><varname>IP_FORWARDING=On</varname></para>
</listitem>
</itemizedlist></para>
</section> </section>
<section> <section>
@ -588,9 +636,10 @@ fw net ACCEPT</programlisting>
<para>The general form of a simple port forwarding rule in <filename <para>The general form of a simple port forwarding rule in <filename
class="directory">/etc/shorewall/</filename><filename>rules</filename> is: class="directory">/etc/shorewall/</filename><filename>rules</filename> is:
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
DNAT net dmz:<emphasis>&#60;server local IP address&#62;</emphasis>[:<emphasis>&#60;server port&#62;</emphasis>] <emphasis>&#60;protocol&#62;</emphasis> <emphasis>&#60;port&#62;</emphasis></programlisting> DNAT net dmz:<emphasis>&lt;server local IP address&gt;</emphasis>[:<emphasis>&lt;server port&gt;</emphasis>] <emphasis>&lt;protocol&gt;</emphasis> <emphasis>&lt;port&gt;</emphasis></programlisting>
If you don&#39;t specify the <emphasis><varname>&#60;server port&#62;</varname></emphasis>, If you don't specify the <emphasis><varname>&lt;server
it is assumed to be the same as <emphasis><varname>&#60;port&#62;</varname></emphasis>.</para> port&gt;</varname></emphasis>, it is assumed to be the same as
<emphasis><varname>&lt;port&gt;</varname></emphasis>.</para>
<example> <example>
<title>You run a Web Server on DMZ Computer 2 and you want to forward <title>You run a Web Server on DMZ Computer 2 and you want to forward
@ -598,71 +647,113 @@ DNAT net dmz:<emphasis>&#60;server local IP address&#62;</emphasis>[:
<para><programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) <para><programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
DNAT net dmz:10.10.11.2 tcp 80 DNAT net dmz:10.10.11.2 tcp 80
ACCEPT loc dmz:10.10.11.2 tcp 80</programlisting><itemizedlist><listitem><para>Entry ACCEPT loc dmz:10.10.11.2 tcp 80</programlisting><itemizedlist>
1 forwards port 80 from the Internet.</para></listitem><listitem><para>Entry <listitem>
2 allows connections from the local network.</para></listitem></itemizedlist> <para>Entry 1 forwards port 80 from the Internet.</para>
Several important points to keep in mind:<itemizedlist><listitem><para>When </listitem>
you are connecting to your server from your local systems, you must use
the server&#39;s internal IP address (<systemitem class="ipaddress">10.10.11.2</systemitem>).</para></listitem><listitem><para>Many <listitem>
ISPs block incoming connection requests to port 80. If you have problems <para>Entry 2 allows connections from the local network.</para>
connecting to your web server, try the following rule and try connecting </listitem>
to port 5000 (e.g., connect to <literal>http://w.x.y.z:5000 where </itemizedlist> Several important points to keep in mind:<itemizedlist>
w.x.y.z</literal> is your external IP).<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE <listitem>
<para>When you are connecting to your server from your local
systems, you must use the server's internal IP address
(<systemitem class="ipaddress">10.10.11.2</systemitem>).</para>
</listitem>
<listitem>
<para>Many ISPs block incoming connection requests to port 80. If
you have problems connecting to your web server, try the following
rule and try connecting to port 5000 (e.g., connect to
<literal>http://w.x.y.z:5000 where w.x.y.z</literal> is your
external IP).<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE
# PORT(S) # PORT(S)
DNAT net dmz:10.10.11.2:80 tcp 80 5000</programlisting></para></listitem><listitem><para>If DNAT net dmz:10.10.11.2:80 tcp 80 5000</programlisting></para>
you want to be able to access your server from the local network using </listitem>
your external address, then if you have a static external IP you can
replace the loc-&#62;dmz rule above with:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL <listitem>
<para>If you want to be able to access your server from the local
network using your external address, then if you have a static
external IP you can replace the loc-&gt;dmz rule above
with:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
# PORT(S) DEST # PORT(S) DEST
DNAT loc dmz:10.10.11.2 tcp 80 - <emphasis>&#60;external IP&#62;</emphasis></programlisting>If DNAT loc dmz:10.10.11.2 tcp 80 - <emphasis>&lt;external IP&gt;</emphasis></programlisting>If
you have a dynamic IP then you must ensure that your external interface you have a dynamic IP then you must ensure that your external
is up before starting Shorewall and you must take steps as follows interface is up before starting Shorewall and you must take steps
(assume that your external interface is <filename class="devicefile">eth0</filename>):<orderedlist><listitem><para>Include as follows (assume that your external interface is <filename
the following in /etc/shorewall/params:</para><para><command>ETH0_IP=$(find_interface_address class="devicefile">eth0</filename>):<orderedlist>
eth0)</command></para></listitem><listitem><para>Make your <listitem>
<literal>loc-&#62;dmz</literal> rule: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL <para>Include the following in /etc/shorewall/params:</para>
<para><command>ETH0_IP=$(find_interface_address
eth0)</command></para>
</listitem>
<listitem>
<para>Make your <literal>loc-&gt;dmz</literal> rule:
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
# PORT(S) DEST # PORT(S) DEST
DNAT loc dmz:10.10.11.2 tcp 80 - $ETH0_IP</programlisting></para></listitem></orderedlist></para></listitem><listitem><para>If DNAT loc dmz:10.10.11.2 tcp 80 - $ETH0_IP</programlisting></para>
you want to access your server from the DMZ using your external IP </listitem>
address, see <ulink url="FAQ.htm#faq2a">FAQ 2a</ulink>.</para></listitem></itemizedlist></para> </orderedlist></para>
</listitem>
<listitem>
<para>If you want to access your server from the DMZ using your
external IP address, see <ulink url="FAQ.htm#faq2a">FAQ
2a</ulink>.</para>
</listitem>
</itemizedlist></para>
</example> </example>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>At this point, add the DNAT and ACCEPT rules for your servers.</para> <para>At this point, add the DNAT and ACCEPT rules for your
servers.</para>
</section> </section>
<section> <section>
<title>Domain Name Server (DNS)</title> <title>Domain Name Server (DNS)</title>
<para>Normally, when you connect to your ISP, as part of getting an IP <para>Normally, when you connect to your ISP, as part of getting an IP
address your firewall&#39;s <emphasis>Domain Name Service</emphasis> (DNS) address your firewall's <emphasis>Domain Name Service</emphasis> (DNS)
resolver will be automatically configured (e.g., the <filename>/etc/resolv.conf</filename> resolver will be automatically configured (e.g., the
file will be written). Alternatively, your ISP may have given you the IP <filename>/etc/resolv.conf</filename> file will be written).
address of a pair of DNS name servers for you to manually configure as Alternatively, your ISP may have given you the IP address of a pair of DNS
your primary and secondary name servers. It is your responsibility to name servers for you to manually configure as your primary and secondary
configure the resolver in your internal systems. You can take one of two name servers. It is your responsibility to configure the resolver in your
approaches: <itemizedlist><listitem><para>You can configure your internal internal systems. You can take one of two approaches: <itemizedlist>
systems to use your ISP&#39;s name servers. If your ISP gave you the <listitem>
addresses of their servers or if those addresses are available on their <para>You can configure your internal systems to use your ISP's name
web site, you can configure your internal systems to use those addresses. servers. If your ISP gave you the addresses of their servers or if
If that information isn&#39;t available, look in <filename>/etc/resolv.conf</filename> those addresses are available on their web site, you can configure
on your firewall system -- the name servers are given in <quote>nameserver</quote> your internal systems to use those addresses. If that information
records in that file.</para></listitem><listitem><para><inlinegraphic isn't available, look in <filename>/etc/resolv.conf</filename> on
fileref="images/BD21298_.gif" format="GIF" /></para><para>You can your firewall system -- the name servers are given in
configure a <emphasis>Caching Name Server</emphasis> on your firewall or <quote>nameserver</quote> records in that file.</para>
in your DMZ. <trademark>Red Hat</trademark> has an RPM for a caching name </listitem>
server (which also requires the &#39;<command>bind</command>&#39; RPM) and
for Bering users, there is <filename>dnscache.lrp</filename>. If you take <listitem>
this approach, you configure your internal systems to use the caching name <para><inlinegraphic fileref="images/BD21298_.gif"
server as their primary (and only) name server. You use the internal IP format="GIF" /></para>
address of the firewall (<systemitem class="ipaddress">10.10.10.254</systemitem>
in the example above) for the name server address if you choose to run the <para>You can configure a <emphasis>Caching Name Server</emphasis>
name server on your firewall. To allow your local systems to talk to your on your firewall or in your DMZ. <trademark>Red Hat</trademark> has
caching name server, you must open port 53 (both UDP and TCP) from the an RPM for a caching name server (which also requires the
local network to the server; you do that by adding the rules in '<command>bind</command>' RPM) and for Bering users, there is
<filename>/etc/shorewall/rules</filename>.</para></listitem></itemizedlist> <filename>dnscache.lrp</filename>. If you take this approach, you
If you run the name server on the firewall: configure your internal systems to use the caching name server as
their primary (and only) name server. You use the internal IP
address of the firewall (<systemitem
class="ipaddress">10.10.10.254</systemitem> in the example above)
for the name server address if you choose to run the name server on
your firewall. To allow your local systems to talk to your caching
name server, you must open port 53 (both UDP and TCP) from the local
network to the server; you do that by adding the rules in
<filename>/etc/shorewall/rules</filename>.</para>
</listitem>
</itemizedlist> If you run the name server on the firewall:
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
AllowDNS loc fw AllowDNS loc fw
AllowDNS dmz fw </programlisting> Run name server on DMZ AllowDNS dmz fw </programlisting> Run name server on DMZ
@ -674,11 +765,12 @@ AllowDNS fw dmz:10.10.11.1 </programlisting></para>
<emphasis>defined action</emphasis>. Shorewall includes a number of <emphasis>defined action</emphasis>. Shorewall includes a number of
defined actions and <ulink url="User_defined_Actions.html">you can add defined actions and <ulink url="User_defined_Actions.html">you can add
your own</ulink>. To see the list of actions included with your version of your own</ulink>. To see the list of actions included with your version of
Shorewall, look in the file <filename>/usr/share/shorewall/actions.std</filename>. Shorewall, look in the file
Those actions that accept connection requests have names that begin with <filename>/usr/share/shorewall/actions.std</filename>. Those actions that
accept connection requests have names that begin with
<quote>Allow</quote>.</para> <quote>Allow</quote>.</para>
<para>You don&#39;t have to use defined actions when coding a rule in <para>You don't have to use defined actions when coding a rule in
<filename>/etc/shorewall/rules</filename>; the generated Netfilter ruleset <filename>/etc/shorewall/rules</filename>; the generated Netfilter ruleset
is slightly more efficient if you code your rules directly rather than is slightly more efficient if you code your rules directly rather than
using defined actions. The first example above (name server on the using defined actions. The first example above (name server on the
@ -690,9 +782,9 @@ ACCEPT loc fw udp 53
ACCEPT dmz fw tcp 53 ACCEPT dmz fw tcp 53
ACCEPT dmz fw udp 53 </programlisting> ACCEPT dmz fw udp 53 </programlisting>
<para>In cases where Shorewall doesn&#39;t include a defined action to <para>In cases where Shorewall doesn't include a defined action to meet
meet your needs, you can either define the action yourself or you can your needs, you can either define the action yourself or you can simply
simply code the appropriate rules directly.</para> code the appropriate rules directly.</para>
</section> </section>
<section> <section>
@ -712,12 +804,12 @@ AllowSSH loc dmz </programlisting>Those rules allow you to run
connect to those servers from your local systems.</para> connect to those servers from your local systems.</para>
<para>If you wish to enable other connections between your systems, the <para>If you wish to enable other connections between your systems, the
general format for using a defined action is: general format for using a defined action is: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) &lt;<emphasis>action</emphasis>&gt; <emphasis>&lt;source zone&gt; &lt;destination zone&gt;</emphasis></programlisting></para>
&#60;<emphasis>action</emphasis>&#62; <emphasis>&#60;source zone&#62; &#60;destination zone&#62;</emphasis></programlisting></para>
<para>The general format when not using a defined action is:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) <para>The general format when not using a defined action
ACCEPT <emphasis>&#60;source zone&#62; &#60;destination zone&#62; &#60;protocol&#62; &#60;port&#62; </emphasis></programlisting></para> is:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
ACCEPT <emphasis>&lt;source zone&gt; &lt;destination zone&gt; &lt;protocol&gt; &lt;port&gt; </emphasis></programlisting></para>
<example> <example>
<title>You want to run a publicly-available DNS server on your firewall <title>You want to run a publicly-available DNS server on your firewall
@ -735,27 +827,33 @@ ACCEPT net fw tcp 53
ACCEPT net fw udp 53 </programlisting> ACCEPT net fw udp 53 </programlisting>
<para>Those rules would of course be in addition to the rules listed <para>Those rules would of course be in addition to the rules listed
above under &#34;If you run the name server on your firewall&#34;.</para> above under "If you run the name server on your firewall".</para>
</example> </example>
<para>If you don&#39;t know what port and protocol a particular <para>If you don't know what port and protocol a particular application
application uses, <ulink url="ports.htm">look here</ulink>.</para> uses, <ulink url="ports.htm">look here</ulink>.</para>
<important> <important>
<para>I don&#39;t recommend enabling telnet to/from the Internet because <para>I don't recommend enabling telnet to/from the Internet because it
it uses clear text (even for login!). If you want shell access to your uses clear text (even for login!). If you want shell access to your
firewall from the Internet, use SSH: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) firewall from the Internet, use SSH: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
AllowSSH net fw</programlisting></para> AllowSSH net fw</programlisting></para>
</important> </important>
<para><inlinegraphic fileref="images/leaflogo.gif" format="GIF" /> Bering <para><inlinegraphic fileref="images/leaflogo.gif" format="GIF" /> Bering
users will want to add the following two rules to be compatible with users will want to add the following two rules to be compatible with
Jacques&#39;s Shorewall configuration: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) Jacques's Shorewall configuration: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
ACCEPT loc fw udp 53 ACCEPT loc fw udp 53
ACCEPT net fw tcp 80 </programlisting><itemizedlist><listitem><para>Entry ACCEPT net fw tcp 80 </programlisting><itemizedlist>
1 allows the DNS Cache to be used.</para></listitem><listitem><para>Entry <listitem>
2 allows the <quote>weblet</quote> to work.</para></listitem></itemizedlist><inlinegraphic <para>Entry 1 allows the DNS Cache to be used.</para>
fileref="images/BD21298_.gif" format="GIF" /></para> </listitem>
<listitem>
<para>Entry 2 allows the <quote>weblet</quote> to work.</para>
</listitem>
</itemizedlist><inlinegraphic fileref="images/BD21298_.gif"
format="GIF" /></para>
<para>Now modify <filename>/etc/shorewall/rules</filename> to add or <para>Now modify <filename>/etc/shorewall/rules</filename> to add or
remove other connections as required.</para> remove other connections as required.</para>
@ -771,18 +869,18 @@ ACCEPT net fw tcp 80 </programlisting><it
external IP address does not mean that the request will be associated external IP address does not mean that the request will be associated
with the external interface or the <quote>net</quote> zone. Any with the external interface or the <quote>net</quote> zone. Any
traffic that you generate from the local network will be associated traffic that you generate from the local network will be associated
with your local interface and will be treated as loc-&#62;fw traffic.</para> with your local interface and will be treated as loc-&gt;fw
traffic.</para>
</listitem> </listitem>
<listitem> <listitem>
<para><emphasis role="bold">IP addresses are properties of systems, <para><emphasis role="bold">IP addresses are properties of systems,
not of interfaces</emphasis>. It is a mistake to believe that your not of interfaces</emphasis>. It is a mistake to believe that your
firewall is able to forward packets just because you can ping the IP firewall is able to forward packets just because you can ping the IP
address of all of the firewall&#39;s interfaces from the local address of all of the firewall's interfaces from the local network.
network. The only conclusion you can draw from such pinging success is The only conclusion you can draw from such pinging success is that the
that the link between the local system and the firewall works and that link between the local system and the firewall works and that you
you probably have the local system&#39;s default gateway set probably have the local system's default gateway set correctly.</para>
correctly.</para>
</listitem> </listitem>
<listitem> <listitem>
@ -790,8 +888,9 @@ ACCEPT net fw tcp 80 </programlisting><it
interfaces are in the $FW (fw) zone</emphasis>. If 192.168.1.254 is interfaces are in the $FW (fw) zone</emphasis>. If 192.168.1.254 is
the IP address of your internal interface then you can write the IP address of your internal interface then you can write
<quote><emphasis role="bold">$FW:192.168.1.254</emphasis></quote> in a <quote><emphasis role="bold">$FW:192.168.1.254</emphasis></quote> in a
rule but you may not write <quote><emphasis role="bold">loc:192.168.1.254</emphasis></quote>. rule but you may not write <quote><emphasis
Similarly, it is nonsensical to add 192.168.1.254 to the <emphasis role="bold">loc:192.168.1.254</emphasis></quote>. Similarly, it is
nonsensical to add 192.168.1.254 to the <emphasis
role="bold">loc</emphasis> zone using an entry in role="bold">loc</emphasis> zone using an entry in
<filename>/etc/shorewall/hosts</filename>.</para> <filename>/etc/shorewall/hosts</filename>.</para>
</listitem> </listitem>
@ -823,45 +922,52 @@ ACCEPT net fw tcp 80 </programlisting><it
<para>The <ulink url="Install.htm">installation procedure</ulink> <para>The <ulink url="Install.htm">installation procedure</ulink>
configures your system to start Shorewall at system boot but beginning configures your system to start Shorewall at system boot but beginning
with Shorewall version 1.3.9 startup is disabled so that your system with Shorewall version 1.3.9 startup is disabled so that your system won't
won&#39;t try to start Shorewall before configuration is complete. Once try to start Shorewall before configuration is complete. Once you have
you have completed configuration of your firewall, you can enable completed configuration of your firewall, you can enable Shorewall startup
Shorewall startup by removing the file <filename>/etc/shorewall/startup_disabled</filename>. by removing the file <filename>/etc/shorewall/startup_disabled</filename>.
<important><para>Users of the <filename>.deb</filename> package must edit <important>
<filename>/etc/default/shorewall</filename> and set <varname>startup=1</varname>.</para></important>The <para>Users of the <filename>.deb</filename> package must edit
firewall is started using the <command>shorewall start</command> command <filename>/etc/default/shorewall</filename> and set
and stopped using <command>shorewall stop</command>. When the firewall is <varname>startup=1</varname>.</para>
stopped, routing is enabled on those hosts that have an entry in <ulink </important>The firewall is started using the <command>shorewall
start</command> command and stopped using <command>shorewall
stop</command>. When the firewall is stopped, routing is enabled on those
hosts that have an entry in <ulink
url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>. url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>.
A running firewall may be restarted using the <command>shorewall restart</command> A running firewall may be restarted using the <command>shorewall
command. If you want to totally remove any trace of Shorewall from your restart</command> command. If you want to totally remove any trace of
Netfilter configuration, use <command>shorewall clear</command>.</para> Shorewall from your Netfilter configuration, use <command>shorewall
clear</command>.</para>
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para> <para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
<para>The three-interface sample assumes that you want to enable routing <para>The three-interface sample assumes that you want to enable routing
to/from <filename class="devicefile">eth1</filename> (your local network) to/from <filename class="devicefile">eth1</filename> (your local network)
and <filename class="devicefile">eth2</filename> (DMZ) when Shorewall is and <filename class="devicefile">eth2</filename> (DMZ) when Shorewall is
stopped. If these two interfaces don&#39;t connect to your local network stopped. If these two interfaces don't connect to your local network and
and DMZ or if you want to enable a different set of hosts, modify DMZ or if you want to enable a different set of hosts, modify
<filename>/etc/shorewall/routestopped</filename> accordingly. <filename>/etc/shorewall/routestopped</filename> accordingly. <warning>
<warning><para>If you are connected to your firewall from the Internet, do <para>If you are connected to your firewall from the Internet, do not
not issue a <command>shorewall stop</command> command unless you have issue a <command>shorewall stop</command> command unless you have
added an entry for the IP address that you are connected from to <ulink added an entry for the IP address that you are connected from to
url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>. <ulink
Also, I don&#39;t recommend using <command>shorewall restart</command>; it url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>.
is better to create an <ulink url="configuration_file_basics.htm#Levels">alternate Also, I don't recommend using <command>shorewall restart</command>; it
configuration</ulink> and test it using the <ulink is better to create an <ulink
url="starting_and_stopping_shorewall.htm"><command>shorewall try</command> url="configuration_file_basics.htm#Levels">alternate
command</ulink>.</para></warning></para> configuration</ulink> and test it using the <ulink
url="starting_and_stopping_shorewall.htm"><command>shorewall
try</command> command</ulink>.</para>
</warning></para>
</section> </section>
<section> <section>
<title>Additional Recommended Reading</title> <title>Additional Recommended Reading</title>
<para>I highly recommend that you review the <ulink <para>I highly recommend that you review the <ulink
url="configuration_file_basics.htm">Common Configuration File Features</ulink> url="configuration_file_basics.htm">Common Configuration File
page -- it contains helpful tips about Shorewall features than make Features</ulink> page -- it contains helpful tips about Shorewall features
administering your firewall easier.</para> than make administering your firewall easier.</para>
</section> </section>
</article> </article>