mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-12 18:54:25 +01:00
Rename index.xml to Documentation_Index.xml
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1021 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
16b3dd2574
commit
c168e02c8f
@ -23,7 +23,7 @@
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<edition>1.4.9 Beta 2</edition>
|
||||
<edition>1.4.8</edition>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
@ -37,14 +37,16 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para><ulink url="Introduction.html">Introduction</ulink></para>
|
||||
<para><ulink url="Introduction.html">Introduction to Shorewall</ulink></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="shorewall_quickstart_guide.htm">QuickStart Guides
|
||||
(HOWTOS)</ulink></para>
|
||||
|
||||
<para></para>
|
||||
<para>The remainder of the Documentation supplements the QuickStart
|
||||
Guides. Please review the appropriate guide before trying to use this
|
||||
documentation directly.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -97,8 +97,8 @@ removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
||||
<td>Infohiiway.com</td>
|
||||
<td><a href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||
<td><a target="_blank"
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse (Temporarily
|
||||
Unavailable)</a></td>
|
||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse<br>
|
||||
</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hamburg, Germany</td>
|
||||
@ -182,7 +182,7 @@ These snapshots have undergone initial testing and will have been
|
||||
installed and run at shorewall.net.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
<p align="left"><font size="2">Last Updated 11/14/2003 - <a
|
||||
<p align="left"><font size="2">Last Updated 12/29/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
|
||||
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2003-12-06</pubdate>
|
||||
<pubdate>2003-12-29</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2003</year>
|
||||
@ -88,11 +88,8 @@
|
||||
|
||||
<para>The firewall runs on a 256MB PII/233 with RH9.0.</para>
|
||||
|
||||
<para>Wookie and the Firewall both run Samba and the Firewall acts as a
|
||||
WINS server.</para>
|
||||
|
||||
<para>Wookie is in its own <quote>whitelist</quote> zone called
|
||||
<quote>me</quote> which is embedded in the local zone.</para>
|
||||
<para>Wookie, Ursa and the Firewall all run Samba and the Firewall acts as
|
||||
a WINS server.</para>
|
||||
|
||||
<para>The wireless network connects to eth3 via a LinkSys WAP11. 
|
||||
In additional to using the rather weak WEP 40-bit encryption (64-bit with
|
||||
@ -172,9 +169,10 @@ SHARED_DIR=/usr/share/shorewall</programlisting>
|
||||
<title>Params File (Edited)</title>
|
||||
|
||||
<blockquote>
|
||||
<para>MIRRORS=<list of shorewall mirror ip addresses>
|
||||
NTPSERVERS=<list of the NTP servers I sync with> TEXAS=<ip
|
||||
address of gateway in Dallas> LOG=info</para>
|
||||
<para><programlisting>MIRRORS=<list of shorewall mirror ip addresses>
|
||||
NTPSERVERS=<list of the NTP servers I sync with>
|
||||
TEXAS=<ip address of gateway in Dallas>
|
||||
LOG=info</programlisting></para>
|
||||
</blockquote>
|
||||
</section>
|
||||
|
||||
@ -185,7 +183,6 @@ SHARED_DIR=/usr/share/shorewall</programlisting>
|
||||
<programlisting>#ZONE DISPLAY COMMENTS
|
||||
net Internet Internet
|
||||
WiFi Wireless Wireless Network on eth3
|
||||
me Wookie My Linux Workstation
|
||||
dmz DMZ Demilitarized zone
|
||||
loc Local Local networks
|
||||
tx Texas Peer Network in Dallas
|
||||
@ -203,7 +200,7 @@ tx Texas Peer Network in Dallas
|
||||
<programlisting>#ZONE INERFACE BROADCAST OPTIONS
|
||||
net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags
|
||||
loc eth2 192.168.1.255 dhcp,newnotsyn
|
||||
dmz eth1 192.168.2.255 newnotsyn
|
||||
dmz eth1 192.168.2.255 newnotsyn
|
||||
WiFi eth3 192.168.3.255 dhcp,maclist,newnotsyn
|
||||
- texas 192.168.9.255
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</programlisting>
|
||||
@ -215,7 +212,6 @@ WiFi eth3 192.168.3.255 dhcp,maclist,newnotsyn
|
||||
|
||||
<blockquote>
|
||||
<programlisting>#ZONE HOST(S) OPTIONS
|
||||
me              eth2:192.168.1.3
|
||||
tx              texas:192.168.8.0/22
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
@ -251,11 +247,7 @@ eth3 192.168.3.0/24
|
||||
|
||||
<blockquote>
|
||||
<programlisting>#SOURCE DESTINATION POLICY LOG LEVEL BURST:LIMIT
|
||||
me loc NONE # 'me' and 'loc' are in the same network
|
||||
me all ACCEPT # Allow my workstation unlimited access
|
||||
tx me ACCEPT # Alow Texas access to my workstation
|
||||
WiFi loc ACCEPT # Allow the wireless new access
|
||||
all me CONTINUE # Use all->loc rules for my WS also
|
||||
loc net ACCEPT # Allow all net traffic from local net
|
||||
$FW loc ACCEPT # Allow local access from the firewall
|
||||
$FW tx ACCEPT # Allow firewall access to texas
|
||||
@ -353,9 +345,10 @@ ACCEPT $MIRRORS
|
||||
<title>Rules File (The shell variables are set in /etc/shorewall/params)</title>
|
||||
|
||||
<blockquote>
|
||||
<programlisting>################################################################################################################################################################
|
||||
#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT ORIGINAL DEST:SNAT
|
||||
################################################################################################################################################################
|
||||
<programlisting>###############################################################################################################################################################################
|
||||
#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT ORIGINAL RATE USER
|
||||
# PORT(S) DEST:SNAT SET
|
||||
###############################################################################################################################################################################
|
||||
# Local Network to Internet - Reject attempts by Trojans to call home
|
||||
#
|
||||
REJECT:$LOG loc net tcp 6667
|
||||
@ -364,7 +357,13 @@ REJECT:$LOG loc net tcp
|
||||
#
|
||||
REJECT loc net tcp 137,445
|
||||
REJECT loc net udp 137:139
|
||||
################################################################################################################################################################
|
||||
#
|
||||
DROP loc:!192.168.1.0/24 net
|
||||
|
||||
QUEUE loc net udp
|
||||
QUEUE loc fw udp
|
||||
QUEUE loc net tcp
|
||||
###############################################################################################################################################################################
|
||||
# Local Network to Firewall
|
||||
#
|
||||
DROP loc:!192.168.1.0/24 fw
|
||||
@ -372,22 +371,23 @@ ACCEPT loc fw tcp
|
||||
ACCEPT loc fw udp snmp,ntp,445
|
||||
ACCEPT loc fw udp 137:139
|
||||
ACCEPT loc fw udp 1024: 137
|
||||
################################################################################################################################################################
|
||||
###############################################################################################################################################################################
|
||||
# Local Network to DMZ
|
||||
#
|
||||
DROP loc:!192.168.1.0/24 dmz
|
||||
REJECT loc dmz tcp 465
|
||||
ACCEPT loc dmz udp domain,xdmcp
|
||||
ACCEPT loc dmz tcp www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3 -
|
||||
################################################################################################################################################################
|
||||
# Me to DMZ (This compensates for the broken RH kernel running in the DMZ -- that kernel's REJECT target is broken and Evolution requires a REJECT from smtps).
|
||||
#
|
||||
REJECT me dmz tcp 465
|
||||
################################################################################################################################################################
|
||||
ACCEPT loc dmz tcp www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,10027,pop3 -
|
||||
###############################################################################################################################################################################
|
||||
# Internet to DMZ
|
||||
#
|
||||
ACCEPT net dmz tcp smtp,www,ftp,imaps,domain,cvspserver,https -
|
||||
DNAT- net dmz:206.124.146.177 tcp smtp - 206.124.146.179,206.124.146.178
|
||||
ACCEPT net dmz tcp smtp,www,ftp,imaps,domain,cvspserver,https -
|
||||
ACCEPT net dmz udp domain
|
||||
Mirrors net dmz tcp rsync
|
||||
################################################################################################################################################################
|
||||
ACCEPT net dmz udp 33434:33436
|
||||
Mirrors net dmz tcp rsync
|
||||
#ACCEPT:$LOG net dmz tcp 32768:61000 20
|
||||
###############################################################################################################################################################################
|
||||
#
|
||||
# Net to Local
|
||||
#
|
||||
@ -403,17 +403,17 @@ ACCEPT net loc:192.168.1.5 tcp
|
||||
# Real Audio
|
||||
#
|
||||
ACCEPT net loc:192.168.1.5 udp 6970:7170
|
||||
DNAT net loc:192.168.1.3 udp 6970:7170 - 206.124.146.179
|
||||
################################################################################################################################################################
|
||||
# Net to me
|
||||
#
|
||||
ACCEPT net loc:192.168.1.3 tcp 4000:4100
|
||||
################################################################################################################################################################
|
||||
# Overnet
|
||||
#
|
||||
#ACCEPT net loc:192.168.1.5 tcp 4662
|
||||
#ACCEPT net loc:192.168.1.5 udp 12112
|
||||
###############################################################################################################################################################################
|
||||
# DMZ to Internet
|
||||
#
|
||||
ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh
|
||||
ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh,8080
|
||||
ACCEPT dmz net udp domain
|
||||
#ACCEPT dmz net:$POPSERVERS tcp pop3
|
||||
ACCEPT dmz net:$POPSERVERS tcp pop3
|
||||
#ACCEPT dmz net:206.191.151.2 tcp pop3
|
||||
#ACCEPT dmz net:66.216.26.115 tcp pop3
|
||||
#
|
||||
@ -422,82 +422,99 @@ ACCEPT dmz net udp
|
||||
# the following works around the problem.
|
||||
#
|
||||
ACCEPT:$LOG dmz net tcp 1024: 20
|
||||
################################################################################################################################################################
|
||||
###############################################################################################################################################################################
|
||||
# DMZ to Firewall -- ntp & snmp, Silently reject Auth
|
||||
#
|
||||
ACCEPT dmz fw udp ntp ntp
|
||||
ACCEPT dmz fw tcp snmp,ssh
|
||||
ACCEPT dmz fw udp snmp
|
||||
REJECT dmz fw tcp auth
|
||||
################################################################################################################################################################
|
||||
###############################################################################################################################################################################
|
||||
# DMZ to Internet
|
||||
#
|
||||
ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh,8080
|
||||
ACCEPT dmz net udp domain
|
||||
ACCEPT dmz net:$POPSERVERS tcp pop3
|
||||
#ACCEPT dmz net:206.191.151.2 tcp pop3
|
||||
#ACCEPT dmz net:66.216.26.115 tcp pop3
|
||||
#
|
||||
# Something is wrong with the FTP connection tracking code or there is some client out there
|
||||
# that is sending a PORT command which that code doesn't understand. Either way,
|
||||
# the following works around the problem.
|
||||
#
|
||||
ACCEPT:$LOG dmz net tcp 1024: 20
|
||||
###############################################################################################################################################################################
|
||||
# DMZ to Firewall -- ntp & snmp, Silently reject Auth
|
||||
#
|
||||
ACCEPT dmz fw udp ntp ntp
|
||||
ACCEPT dmz fw tcp snmp,ssh
|
||||
ACCEPT dmz fw udp snmp
|
||||
REJECT dmz fw tcp auth
|
||||
###############################################################################################################################################################################
|
||||
#
|
||||
# DMZ to Local Network
|
||||
#
|
||||
ACCEPT dmz loc tcp smtp,6001:6010
|
||||
################################################################################################################################################################
|
||||
#
|
||||
# DMZ to Me -- NFS
|
||||
#
|
||||
ACCEPT dmz me tcp 111
|
||||
ACCEPT dmz me udp 111
|
||||
ACCEPT dmz me udp 2049
|
||||
ACCEPT dmz me udp 32700:
|
||||
################################################################################################################################################################
|
||||
ACCEPT dmz loc tcp 111
|
||||
ACCEPT dmz loc udp
|
||||
###############################################################################################################################################################################
|
||||
# Internet to Firewall
|
||||
#
|
||||
REJECT net fw tcp www
|
||||
DROP net fw tcp 1433
|
||||
################################################################################################################################################################
|
||||
# WiFi to Firewall (SMB and NTP)
|
||||
ACCEPT net dmz udp 33434:33435
|
||||
###############################################################################################################################################################################
|
||||
# WIFI to Firewall
|
||||
#
|
||||
ACCEPT WiFi fw tcp ssh,137,139,445
|
||||
ACCEPT WiFi fw udp 137:139,445
|
||||
ACCEPT
|
||||
###############################################################################################################################################################
|
||||
# WIFI to loc
|
||||
#
|
||||
ACCEPT WiFi loc udp 137:139
|
||||
ACCEPT WiFi loc tcp 22,80,137,139,445,3389
|
||||
ACCEPT WiFi loc udp 1024: 137
|
||||
ACCEPT WiFi loc udp 177
|
||||
###############################################################################################################################################################
|
||||
# loc to WiFi
|
||||
#
|
||||
ACCEPT loc WiFi udp 137:139
|
||||
ACCEPT loc WiFi tcp 137,139,445
|
||||
ACCEPT loc WiFi udp 1024: 137
|
||||
ACCEPT loc WiFi tcp 6000:6010
|
||||
WiFi fw udp 1024: 137
|
||||
ACCEPT WiFi fw udp 1024: 137
|
||||
ACCEPT WiFi fw udp ntp ntp
|
||||
################################################################################################################################################################
|
||||
# Firewall to WiFi (SMB)
|
||||
###############################################################################################################################################################################
|
||||
# Firewall to WIFI
|
||||
#
|
||||
ACCEPT fw WiFi tcp 137,139,445
|
||||
ACCEPT fw WiFi udp 137:139,445
|
||||
ACCEPT fw WiFi udp 1024: 137
|
||||
###############################################################################################################################################################
|
||||
# WiFi to DMZ
|
||||
ACCEPT fw WiFi udp ntp ntp
|
||||
##############################################################################################################################################################################
|
||||
# WIFI to DMZ
|
||||
#
|
||||
DNAT- WiFi dmz:206.124.146.177 all - - 192.168.1.193
|
||||
ACCEPT WiFi dmz tcp smtp,www,ftp,imaps,domain,https,ssh -
|
||||
ACCEPT WiFi dmz tcp smtp,www,ftp,imaps,domain,https,ssh,8080 -
|
||||
ACCEPT WiFi dmz udp domain
|
||||
################################################################################################################################################################
|
||||
##############################################################################################################################################################################
|
||||
# WIFI to loc
|
||||
#
|
||||
ACCEPT WiFi loc udp 137:139
|
||||
ACCEPT WiFi loc tcp 22,80,137,139,445,901,3389
|
||||
ACCEPT WiFi loc udp 1024: 137
|
||||
ACCEPT WiFi loc udp 177
|
||||
##############################################################################################################################################################################
|
||||
# loc to WiFi
|
||||
#
|
||||
ACCEPT loc WiFi udp 137:139
|
||||
ACCEPT loc WiFi tcp 137,139,445
|
||||
ACCEPT loc WiFi udp 1024: 137
|
||||
ACCEPT loc WiFi tcp 6000:6010
|
||||
###############################################################################################################################################################################
|
||||
# Firewall to Internet
|
||||
#
|
||||
ACCEPT fw net:$NTPSERVERS udp ntp ntp
|
||||
ACCEPT fw net:$POPSERVERS tcp pop3
|
||||
#ACCEPT fw net:$POPSERVERS tcp pop3
|
||||
ACCEPT fw net udp domain
|
||||
ACCEPT fw net tcp domain,www,https,ssh,1723,whois,1863,ftp,2702,2703,7
|
||||
ACCEPT fw net udp 33435:33535
|
||||
ACCEPT fw net icmp 8
|
||||
################################################################################################################################################################
|
||||
ACCEPT fw net icmp
|
||||
###############################################################################################################################################################################
|
||||
# Firewall to DMZ
|
||||
#
|
||||
ACCEPT fw dmz tcp www,ftp,ssh,smtp
|
||||
ACCEPT fw dmz udp domain
|
||||
ACCEPT fw dmz icmp 8
|
||||
REJECT fw dmz udp 137:139
|
||||
|
||||
###############################################################################################################################################################################
|
||||
# Ping
|
||||
#
|
||||
ACCEPT all all icmp 8
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
</section>
|
||||
@ -579,20 +596,18 @@ gre net $TEXAS
|
||||
<title>Newnotsyn file (/etc/shorewall/newnotsyn):</title>
|
||||
|
||||
<blockquote>
|
||||
<para>I prefer to allow SYN, FIN and RST packets unconditionally
|
||||
rather than just on <quote>newnotsyn</quote> interfaces as is the case
|
||||
with the standard Shorewall ruleset. This file deletes the
|
||||
<para>I prefer to allow FIN and RST packets unconditionally rather
|
||||
than just on <quote>newnotsyn</quote> interfaces as is the case with
|
||||
the standard Shorewall ruleset. This file deletes the
|
||||
Shorewall-generated rules for these packets and creates my own.</para>
|
||||
|
||||
<programlisting>#!/bin/sh
|
||||
|
||||
for interface in `find_interfaces_by_option newnotsyn`; do
|
||||
run_iptables -D newnotsyn -i $interface -p tcp --tcp-flags ACK ACK -j ACCEPT
|
||||
run_iptables -D newnotsyn -i $interface -p tcp --tcp-flags RST RST -j ACCEPT
|
||||
run_iptables -D newnotsyn -i $interface -p tcp --tcp-flags FIN FIN -j ACCEPT
|
||||
done
|
||||
|
||||
run_iptables -A newnotsyn -p tcp --tcp-flags ACK ACK -j ACCEPT
|
||||
|
||||
run_iptables -A newnotsyn -p tcp --tcp-flags RST RST -j ACCEPT
|
||||
run_iptables -A newnotsyn -p tcp --tcp-flags FIN FIN -j ACCEPT</programlisting>
|
||||
</blockquote>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user