mirror of
https://gitlab.com/shorewall/code.git
synced 2025-08-17 20:26:47 +02:00
Dup Samples to Samples6
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8966 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
30
Samples6/three-interfaces/README.txt
Normal file
30
Samples6/three-interfaces/README.txt
Normal file
@@ -0,0 +1,30 @@
|
||||
For instructions on using these sample configurations, please see
|
||||
|
||||
http://www.shorewall.net/three-interface.htm
|
||||
|
||||
Shorewall Samples
|
||||
Copyright (C) 2006 by the following authors:
|
||||
Thomas M. Eastep
|
||||
Paul D. Gear
|
||||
Cristian Rodriguez
|
||||
Francesca Smith
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with this library; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
|
||||
02110-1301 USA
|
||||
|
||||
|
||||
Sample files are licensed under the LGPL, please see the LICENSE file or
|
||||
http://www.gnu.org/licenses/lgpl.html for more details.
|
||||
|
||||
22
Samples6/three-interfaces/interfaces
Normal file
22
Samples6/three-interfaces/interfaces
Normal file
@@ -0,0 +1,22 @@
|
||||
#
|
||||
# Shorewall version 4.0 - Sample Interfaces File for three-interface configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-interfaces"
|
||||
#
|
||||
# For additional information, see
|
||||
# http://shorewall.net/Documentation.htm#Interfaces
|
||||
#
|
||||
###############################################################################
|
||||
#ZONE INTERFACE BROADCAST OPTIONS
|
||||
net eth0 detect tcpflags,dhcp,routefilter,nosmurfs,logmartians
|
||||
loc eth1 detect tcpflags,nosmurfs
|
||||
dmz eth2 detect
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|
||||
20
Samples6/three-interfaces/masq
Normal file
20
Samples6/three-interfaces/masq
Normal file
@@ -0,0 +1,20 @@
|
||||
#
|
||||
# Shorewall version 3.4 - Sample Masq file for three-interface configuration.
|
||||
# Copyright (C) 2006,2007 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-masq"
|
||||
#
|
||||
# For additional information, see http://shorewall.net/Documentation.htm#Masq
|
||||
#
|
||||
##############################################################################
|
||||
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
|
||||
eth0 eth1
|
||||
eth0 eth2
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
|
||||
82
Samples6/three-interfaces/policy
Normal file
82
Samples6/three-interfaces/policy
Normal file
@@ -0,0 +1,82 @@
|
||||
#
|
||||
# Shorewall version 3.4 - Sample Policy File for three-interface configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-policy"
|
||||
#
|
||||
# See http://shorewall.net/Documentation.htm#Policy for additional information.
|
||||
#
|
||||
###############################################################################
|
||||
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
|
||||
|
||||
#
|
||||
# Note about policies and logging:
|
||||
# This file contains an explicit policy for every combination of
|
||||
# zones defined in this sample. This is solely for the purpose of
|
||||
# providing more specific messages in the logs. This is not
|
||||
# necessary for correct operation of the firewall, but greatly
|
||||
# assists in diagnosing problems. The policies below are logically
|
||||
# equivalent to:
|
||||
#
|
||||
# loc net ACCEPT
|
||||
# net all DROP info
|
||||
# all all REJECT info
|
||||
#
|
||||
# The Shorewall-perl compiler will generate the individual policies
|
||||
# below from the above general policies if you set
|
||||
# EXPAND_POLICIES=Yes in shorewall.conf.
|
||||
#
|
||||
|
||||
#
|
||||
# Policies for traffic originating from the local LAN (loc)
|
||||
#
|
||||
# If you want to force clients to access the Internet via a proxy server
|
||||
# in your DMZ, change the following policy to REJECT info.
|
||||
loc net ACCEPT
|
||||
# If you want open access to DMZ from loc, change the following policy
|
||||
# to ACCEPT. (If you chose not to do this, you will need to add a rule
|
||||
# for each service in the rules file.)
|
||||
loc dmz REJECT info
|
||||
loc $FW REJECT info
|
||||
loc all REJECT info
|
||||
|
||||
#
|
||||
# Policies for traffic originating from the firewall ($FW)
|
||||
#
|
||||
# If you want open access to the Internet from your firewall, change the
|
||||
# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.
|
||||
$FW net REJECT info
|
||||
$FW dmz REJECT info
|
||||
$FW loc REJECT info
|
||||
$FW all REJECT info
|
||||
|
||||
#
|
||||
# Policies for traffic originating from the De-Militarized Zone (dmz)
|
||||
#
|
||||
# If you want open access from DMZ to the Internet change the following
|
||||
# policy to ACCEPT. This may be useful if you run a proxy server in
|
||||
# your DMZ.
|
||||
dmz net REJECT info
|
||||
dmz $FW REJECT info
|
||||
dmz loc REJECT info
|
||||
dmz all REJECT info
|
||||
|
||||
#
|
||||
# Policies for traffic originating from the Internet zone (net)
|
||||
#
|
||||
net dmz DROP info
|
||||
net $FW DROP info
|
||||
net loc DROP info
|
||||
net all DROP info
|
||||
|
||||
# THE FOLLOWING POLICY MUST BE LAST
|
||||
all all REJECT info
|
||||
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
|
||||
22
Samples6/three-interfaces/routestopped
Normal file
22
Samples6/three-interfaces/routestopped
Normal file
@@ -0,0 +1,22 @@
|
||||
#
|
||||
# Shorewall version 4.0 - Sample Routestopped File for three-interface configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-routestopped"
|
||||
#
|
||||
# See http://shorewall.net/Documentation.htm#Routestopped and
|
||||
# http://shorewall.net/starting_and_stopping_shorewall.htm for additional
|
||||
# information.
|
||||
#
|
||||
##############################################################################
|
||||
#INTERFACE HOST(S)
|
||||
eth1 -
|
||||
eth2 -
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|
||||
60
Samples6/three-interfaces/rules
Normal file
60
Samples6/three-interfaces/rules
Normal file
@@ -0,0 +1,60 @@
|
||||
#
|
||||
# Shorewall version 4.0 - Sample Rules File for three-interface configuration.
|
||||
# Copyright (C) 2006,2007 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-rules"
|
||||
#
|
||||
# For additional information, see http://shorewall.net/Documentation.htm#Rules
|
||||
#
|
||||
#############################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
#
|
||||
# Accept DNS connections from the firewall to the Internet
|
||||
#
|
||||
DNS/ACCEPT $FW net
|
||||
#
|
||||
#
|
||||
# Accept SSH connections from the local network to the firewall and DMZ
|
||||
#
|
||||
SSH/ACCEPT loc $FW
|
||||
SSH/ACCEPT loc dmz
|
||||
#
|
||||
# DMZ DNS access to the Internet
|
||||
#
|
||||
DNS/ACCEPT dmz net
|
||||
|
||||
|
||||
# Drop Ping from the "bad" net zone.
|
||||
|
||||
Ping/DROP net $FW
|
||||
|
||||
#
|
||||
# Make ping work bi-directionally between the dmz, net, Firewall and local zone
|
||||
# (assumes that the loc-> net policy is ACCEPT).
|
||||
#
|
||||
|
||||
Ping/ACCEPT loc $FW
|
||||
Ping/ACCEPT dmz $FW
|
||||
Ping/ACCEPT loc dmz
|
||||
Ping/ACCEPT dmz loc
|
||||
Ping/ACCEPT dmz net
|
||||
|
||||
ACCEPT $FW net icmp
|
||||
ACCEPT $FW loc icmp
|
||||
ACCEPT $FW dmz icmp
|
||||
|
||||
# Uncomment this if using Proxy ARP and static NAT and you want to allow ping from
|
||||
# the net zone to the dmz and loc
|
||||
|
||||
#Ping/ACCEPT net dmz
|
||||
#Ping/ACCEPT net loc
|
||||
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|
||||
199
Samples6/three-interfaces/shorewall.conf
Normal file
199
Samples6/three-interfaces/shorewall.conf
Normal file
@@ -0,0 +1,199 @@
|
||||
s###############################################################################
|
||||
#
|
||||
# Shorewall version 4.0 - Sample shorewall.conf for three-interface
|
||||
# configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#
|
||||
# For information about the settings in this file, type "man shorewall.conf"
|
||||
#
|
||||
# The manpage is also online at
|
||||
# http://shorewall.net/manpages/shorewall.conf.html
|
||||
#
|
||||
###############################################################################
|
||||
# S T A R T U P E N A B L E D
|
||||
###############################################################################
|
||||
|
||||
STARTUP_ENABLED=No
|
||||
|
||||
###############################################################################
|
||||
# V E R B O S I T Y
|
||||
###############################################################################
|
||||
|
||||
VERBOSITY=1
|
||||
|
||||
###############################################################################
|
||||
# C O M P I L E R
|
||||
# (setting this to 'perl' requires installation of Shorewall-perl)
|
||||
###############################################################################
|
||||
|
||||
SHOREWALL_COMPILER=
|
||||
|
||||
###############################################################################
|
||||
# L O G G I N G
|
||||
###############################################################################
|
||||
|
||||
LOGFILE=/var/log/messages
|
||||
|
||||
STARTUP_LOG=
|
||||
|
||||
LOG_VERBOSITY=
|
||||
|
||||
LOGFORMAT="Shorewall:%s:%s:"
|
||||
|
||||
LOGTAGONLY=No
|
||||
|
||||
LOGRATE=
|
||||
|
||||
LOGBURST=
|
||||
|
||||
LOGALLNEW=
|
||||
|
||||
BLACKLIST_LOGLEVEL=
|
||||
|
||||
MACLIST_LOG_LEVEL=info
|
||||
|
||||
TCP_FLAGS_LOG_LEVEL=info
|
||||
|
||||
RFC1918_LOG_LEVEL=info
|
||||
|
||||
SMURF_LOG_LEVEL=info
|
||||
|
||||
LOG_MARTIANS=Yes
|
||||
|
||||
###############################################################################
|
||||
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
|
||||
###############################################################################
|
||||
|
||||
IPTABLES=
|
||||
|
||||
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
|
||||
|
||||
SHOREWALL_SHELL=/bin/sh
|
||||
|
||||
SUBSYSLOCK=/var/lock/subsys/shorewall
|
||||
|
||||
MODULESDIR=
|
||||
|
||||
CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
|
||||
|
||||
RESTOREFILE=
|
||||
|
||||
IPSECFILE=zones
|
||||
|
||||
LOCKFILE=
|
||||
|
||||
###############################################################################
|
||||
# D E F A U L T A C T I O N S / M A C R O S
|
||||
###############################################################################
|
||||
|
||||
DROP_DEFAULT="Drop"
|
||||
REJECT_DEFAULT="Reject"
|
||||
ACCEPT_DEFAULT="none"
|
||||
QUEUE_DEFAULT="none"
|
||||
NFQUEUE_DEFAULT="none"
|
||||
|
||||
###############################################################################
|
||||
# R S H / R C P C O M M A N D S
|
||||
###############################################################################
|
||||
|
||||
RSH_COMMAND='ssh ${root}@${system} ${command}'
|
||||
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L O P T I O N S
|
||||
###############################################################################
|
||||
|
||||
IP_FORWARDING=On
|
||||
|
||||
ADD_IP_ALIASES=Yes
|
||||
|
||||
ADD_SNAT_ALIASES=No
|
||||
|
||||
RETAIN_ALIASES=No
|
||||
|
||||
TC_ENABLED=Internal
|
||||
|
||||
TC_EXPERT=No
|
||||
|
||||
CLEAR_TC=Yes
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
CLAMPMSS=No
|
||||
|
||||
ROUTE_FILTER=No
|
||||
|
||||
DETECT_DNAT_IPADDRS=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
ADMINISABSENTMINDED=Yes
|
||||
|
||||
BLACKLISTNEWONLY=Yes
|
||||
|
||||
DELAYBLACKLISTLOAD=No
|
||||
|
||||
MODULE_SUFFIX=
|
||||
|
||||
DISABLE_IPV6=Yes
|
||||
|
||||
BRIDGING=No
|
||||
|
||||
DYNAMIC_ZONES=No
|
||||
|
||||
PKTTYPE=Yes
|
||||
|
||||
RFC1918_STRICT=No
|
||||
|
||||
MACLIST_TABLE=filter
|
||||
|
||||
MACLIST_TTL=
|
||||
|
||||
SAVE_IPSETS=No
|
||||
|
||||
MAPOLDACTIONS=No
|
||||
|
||||
FASTACCEPT=No
|
||||
|
||||
IMPLICIT_CONTINUE=No
|
||||
|
||||
HIGH_ROUTE_MARKS=No
|
||||
|
||||
USE_ACTIONS=Yes
|
||||
|
||||
OPTIMIZE=1
|
||||
|
||||
EXPORTPARAMS=No
|
||||
|
||||
EXPAND_POLICIES=No
|
||||
|
||||
KEEP_RT_TABLES=No
|
||||
|
||||
DELETE_THEN_ADD=Yes
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
DONT_LOAD=
|
||||
|
||||
AUTO_COMMENT=Yes
|
||||
|
||||
MANGLE_ENABLED=Yes
|
||||
|
||||
###############################################################################
|
||||
# P A C K E T D I S P O S I T I O N
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_DISPOSITION=DROP
|
||||
|
||||
MACLIST_DISPOSITION=REJECT
|
||||
|
||||
TCP_FLAGS_DISPOSITION=DROP
|
||||
|
||||
#LAST LINE -- DO NOT REMOVE
|
||||
23
Samples6/three-interfaces/zones
Normal file
23
Samples6/three-interfaces/zones
Normal file
@@ -0,0 +1,23 @@
|
||||
#
|
||||
# Shorewall version 4.0 - Sample Zones File for three-interface configuration.
|
||||
# Copyright (C) 2006 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-zones"
|
||||
#
|
||||
# For more information, see http://www.shorewall.net/Documentation.htm#Zones
|
||||
#
|
||||
###############################################################################
|
||||
#ZONE TYPE OPTIONS IN OUT
|
||||
# OPTIONS OPTIONS
|
||||
fw firewall
|
||||
net ipv4
|
||||
loc ipv4
|
||||
dmz ipv4
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
|
||||
Reference in New Issue
Block a user