Lots of changes to the IPv6 Samples

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@9148 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-12-20 16:00:29 +00:00
parent 14ea987385
commit e449432279
18 changed files with 193 additions and 207 deletions

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Interfaces File for one-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Interfaces File for one-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,11 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-interfaces"
#
# For additional information, see
# http://shorewall.net/Documentation.htm#Interfaces
#
# For information about entries in this file, type "man shorewall6-interfaces"
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect tcpflags

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Policy File for one-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Policy File for one-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,9 +9,7 @@
#
# See the file README.txt for further details.
#-----------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-policy"
#
# See http://shorewall.net/Documentation.htm#Policy for additional information.
# For information about entries in this file, type "man shorewall6-policy"
#
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Rules File for one-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Rules File for one-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,10 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------------------------------------
# For information on entries in this file, type "man shorewall-rules"
#
# For more information, see http://www.shorewall.net/Documentation.htm#Zones
#
# For information on entries in this file, type "man shorewall6-rules"
#############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP

View File

@ -0,0 +1,146 @@
###############################################################################
#
# Shorewall6 version 4 - Sample shorewall.conf for one-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#
# For information about the settings in this file, type "man shorewall6.conf"
#
# The manpage is also online at
# http://shorewall.net/manpages6/shorewall6.conf.html
###############################################################################
# S T A R T U P E N A B L E D
###############################################################################
STARTUP_ENABLED=No
###############################################################################
# V E R B O S I T Y
###############################################################################
VERBOSITY=1
###############################################################################
# L O G G I N G
###############################################################################
LOGFILE=/var/log/messages
STARTUP_LOG=
LOG_VERBOSITY=
LOGFORMAT="Shorewall:%s:%s:"
LOGTAGONLY=No
LOGRATE=
LOGBURST=
LOGALLNEW=
BLACKLIST_LOGLEVEL=
TCP_FLAGS_LOG_LEVEL=info
SMURF_LOG_LEVEL=info
###############################################################################
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
###############################################################################
IP6TABLES=
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
SHOREWALL_SHELL=/bin/sh
SUBSYSLOCK=/var/lock/subsys/shorewall
MODULESDIR=
CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
RESTOREFILE=
LOCKFILE=
###############################################################################
# D E F A U L T A C T I O N S / M A C R O S
###############################################################################
DROP_DEFAULT="Drop"
REJECT_DEFAULT="Reject"
ACCEPT_DEFAULT="none"
QUEUE_DEFAULT="none"
NFQUEUE_DEFAULT="none"
###############################################################################
# R S H / R C P C O M M A N D S
###############################################################################
RSH_COMMAND='ssh ${root}@${system} ${command}'
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
###############################################################################
# F I R E W A L L O P T I O N S
###############################################################################
IP_FORWARDING=Off
TC_ENABLED=No
TC_EXPERT=No
CLEAR_TC=Yes
MARK_IN_FORWARD_CHAIN=No
CLAMPMSS=No
MUTEX_TIMEOUT=60
ADMINISABSENTMINDED=Yes
BLACKLISTNEWONLY=Yes
MODULE_SUFFIX=
FASTACCEPT=No
IMPLICIT_CONTINUE=No
HIGH_ROUTE_MARKS=No
OPTIMIZE=1
EXPORTPARAMS=No
EXPAND_POLICIES=No
KEEP_RT_TABLES=Yes
DELETE_THEN_ADD=Yes
DONT_LOAD=
AUTO_COMMENT=Yes
MANGLE_ENABLED=Yes
###############################################################################
# P A C K E T D I S P O S I T I O N
###############################################################################
BLACKLIST_DISPOSITION=DROP
TCP_FLAGS_DISPOSITION=DROP
#LAST LINE -- DO NOT REMOVE

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Zones File for one-interface IPv6 configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Zones File for one-interface IPv6 configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -10,9 +10,6 @@
# See the file README.txt for further details.
#-----------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall6-zones"
#
# For more information, see http://www.shorewall.net/Documentation.htm#Zones
#
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS

View File

@ -1,5 +1,5 @@
#
# Shorewall6 version 4.0 - Sample Interfaces File for three-interface configuration.
# Shorewall6 version 4 - Sample Interfaces File for three-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
@ -9,11 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-interfaces"
#
# For additional information, see
# http://shorewall.net/Documentation.htm#Interfaces
#
# For information about entries in this file, type "man shorewall6-interfaces"
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect tcpflags

View File

@ -1,20 +0,0 @@
#
# Shorewall version 3.4 - Sample Masq file for three-interface configuration.
# Copyright (C) 2006,2007 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-masq"
#
# For additional information, see http://shorewall.net/Documentation.htm#Masq
#
##############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
eth0 eth1
eth0 eth2
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

View File

@ -1,6 +1,6 @@
#
# Shorewall version 3.4 - Sample Policy File for three-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 Version 4 - Sample Policy File for three-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,74 +9,12 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-policy"
#
# See http://shorewall.net/Documentation.htm#Policy for additional information.
#
# For information about entries in this file, type "man shorewall6-policy"
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
#
# Note about policies and logging:
# This file contains an explicit policy for every combination of
# zones defined in this sample. This is solely for the purpose of
# providing more specific messages in the logs. This is not
# necessary for correct operation of the firewall, but greatly
# assists in diagnosing problems. The policies below are logically
# equivalent to:
#
# loc net ACCEPT
# net all DROP info
# all all REJECT info
#
# The Shorewall-perl compiler will generate the individual policies
# below from the above general policies if you set
# EXPAND_POLICIES=Yes in shorewall.conf.
#
#
# Policies for traffic originating from the local LAN (loc)
#
# If you want to force clients to access the Internet via a proxy server
# in your DMZ, change the following policy to REJECT info.
loc net ACCEPT
# If you want open access to DMZ from loc, change the following policy
# to ACCEPT. (If you chose not to do this, you will need to add a rule
# for each service in the rules file.)
loc dmz REJECT info
loc $FW REJECT info
loc all REJECT info
#
# Policies for traffic originating from the firewall ($FW)
#
# If you want open access to the Internet from your firewall, change the
# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.
$FW net REJECT info
$FW dmz REJECT info
$FW loc REJECT info
$FW all REJECT info
#
# Policies for traffic originating from the De-Militarized Zone (dmz)
#
# If you want open access from DMZ to the Internet change the following
# policy to ACCEPT. This may be useful if you run a proxy server in
# your DMZ.
dmz net REJECT info
dmz $FW REJECT info
dmz loc REJECT info
dmz all REJECT info
#
# Policies for traffic originating from the Internet zone (net)
#
net dmz DROP info
net $FW DROP info
net loc DROP info
net all DROP info
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT info
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Routestopped File for three-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Routestopped File for three-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,10 +9,9 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-routestopped"
# For information about entries in this file, type "man shorewall6-routestopped"
#
# See http://shorewall.net/Documentation.htm#Routestopped and
# http://shorewall.net/starting_and_stopping_shorewall.htm for additional
# See http://shorewall.net/starting_and_stopping_shorewall.htm for additional
# information.
#
##############################################################################

View File

@ -9,10 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-rules"
#
# For additional information, see http://shorewall.net/Documentation.htm#Rules
#
# For information about entries in this file, type "man shorewall6-rules"
#############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP

View File

@ -1,7 +1,7 @@
###############################################################################
#
# Shorewall version 3.4 - Sample shorewall.conf for one-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample shorewall.conf for one-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -10,10 +10,10 @@
#
# See the file README.txt for further details.
#
# For information about the settings in this file, type "man shorewall.conf"
# For information about the settings in this file, type "man shorewall6.conf"
#
# The manpage is also online at
# http://shorewall.net/manpages/shorewall.conf.html
# http://shorewall.net/manpages6/shorewall6.conf.html
###############################################################################
# S T A R T U P E N A B L E D
###############################################################################
@ -123,7 +123,7 @@ OPTIMIZE=1
EXPORTPARAMS=No
EXPAND_POLICIES=No
EXPAND_POLICIES=Yes
KEEP_RT_TABLES=Yes

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Zones File for three-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Zones File for three-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,9 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-zones"
#
# For more information, see http://www.shorewall.net/Documentation.htm#Zones
# For information about entries in this file, type "man shorewall6-zones"
#
###############################################################################
#ZONE TYPE OPTIONS IN OUT

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Interfaces File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4.0 - Sample Interfaces File for two-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,11 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-interfaces"
#
# For additional information, see
# http://shorewall.net/Documentation.htm#Interfaces
#
# For information about entries in this file, type "man shorewall6-interfaces"
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect tcpflags

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Policy File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4 - Sample Policy File for two-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,57 +9,12 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-policy"
#
# See http://shorewall.net/Documentation.htm#Policy for additional information.
#
# For information about entries in this file, type "man shorewall6-policy"
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
#
# Note about policies and logging:
# This file contains an explicit policy for every combination of
# zones defined in this sample. This is solely for the purpose of
# providing more specific messages in the logs. This is not
# necessary for correct operation of the firewall, but greatly
# assists in diagnosing problems. The policies below are logically
# equivalent to:
#
# loc net ACCEPT
# net all DROP info
# all all REJECT info
#
# The Shorewall-perl compiler will generate the individual policies
# below from the above general policies if you set
# EXPAND_POLICIES=Yes in shorewall.conf.
#
# Policies for traffic originating from the local LAN (loc)
#
# If you want to force clients to access the Internet via a proxy server
# on your firewall, change the loc to net policy to REJECT info.
loc net ACCEPT
loc $FW REJECT info
loc all REJECT info
#
# Policies for traffic originating from the firewall ($FW)
#
# If you want open access to the Internet from your firewall, change the
# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.
# This may be useful if you run a proxy server on the firewall.
$FW net REJECT info
$FW loc REJECT info
$FW all REJECT info
#
# Policies for traffic originating from the Internet zone (net)
#
net $FW DROP info
net loc DROP info
net all DROP info
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT info
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Routestopped File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4.0 - Sample Routestopped File for two-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,10 +9,9 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-routestopped"
# For information about entries in this file, type "man shorewall6-routestopped"
#
# See http://shorewall.net/Documentation.htm#Routestopped and
# http://shorewall.net/starting_and_stopping_shorewall.htm for additional
# See http://shorewall.net/starting_and_stopping_shorewall.htm for additional
# information.
#
##############################################################################

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
# Copyright (C) 2006,2007 by the Shorewall Team
# Shorewall6 version 4.0 - Sample Rules File for two-interface configuration.
# Copyright (C) 2006-2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,10 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-rules"
#
# For more information, see http://www.shorewall.net/Documentation.htm#Rules
#
# For information about entries in this file, type "man shorewall6-rules"
#############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP

View File

@ -10,10 +10,10 @@
#
# See the file README.txt for further details.
#
# For information about the settings in this file, type "man shorewall.conf"
# For information about the settings in this file, type "man shorewall6.conf"
#
# The manpage is also online at
# http://shorewall.net/manpages/shorewall.conf.html
# http://shorewall.net/manpages6/shorewall6.conf.html
###############################################################################
# S T A R T U P E N A B L E D
###############################################################################

View File

@ -1,6 +1,6 @@
#
# Shorewall version 4.0 - Sample Zones File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# Shorewall6 version 4.0 - Sample Zones File for two-interface configuration.
# Copyright (C) 2006,2008 by the Shorewall Team
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@ -9,10 +9,7 @@
#
# See the file README.txt for further details.
#------------------------------------------------------------------------------
# For information about entries in this file, type "man shorewall-zones"
#
# For more information, see http://www.shorewall.net/Documentation.htm#Zones
#
# For information about entries in this file, type "man shorewall6-zones"
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS