extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-08-10 16:15:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

Changes for 1.3.7

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@208 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
2002-08-22 21:33:54 +00:00
parent 72f67478b2
commit f158c11a41
97 changed files with 6516 additions and 5133 deletions
Download Patch File Download Diff File Expand all files Collapse all files

568
STABLE/documentation/two-interface.htm
View File

@ -6,33 +6,40 @@
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Two-Interface Firewall</title>
<meta name="Microsoft Theme" content="radial 011, default">
<meta name="Microsoft Theme" content="none">
</head>
<body background="_themes/radial/radbkgnd.gif" bgcolor="#FFFFFF" text="#000000" link="#6666FF" vlink="#993333" alink="#66CCCC"><!--mstheme--><font face="arial, Arial, Helvetica">
<body>
<h1 align="center"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Basic Two-Interface Firewall<!--mstheme--></font></h1>
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" width="100%" id="AutoNumber5" bgcolor="#400169" height="90">
<tr>
<td width="100%">
<h1 align="center"><font color="#FFFFFF">Basic Two-Interface Firewall</font></h1>
</td>
</tr>
</table>
<p align="left">Setting up a Linux system as a firewall for a small network is a
fairly straight-forward task if you understand the basics and follow the
documentation.</p>
<p>This guide doesn't attempt to acquaint you with all of the features of
Shorewall. It rather focuses on what is required to configure Shorewall in its
most common configuration:</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Linux system used as a firewall/router for a small local network.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Single external IP address.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Internet connection through cable modem, DSL, ISDN, Frame Relay, dial-up
...<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
<ul>
<li>Linux system used as a firewall/router for a small local network.</li>
<li>Single external IP address.</li>
<li>Internet connection through cable modem, DSL, ISDN, Frame Relay, dial-up
...</li>
</ul>
<p align="left">Here is a schematic of a typical installation.</p>
<p align="center"><img border="0" src="images/basics.jpg" width="592" height="394"></p>
<p align="center">
<img border="0" src="images/basics.png" width="444" height="635"></p>
<p>This guide assumes that you have the iproute/iproute2 package installed (on
RedHat, the package is called <i>iproute</i>)<i>. </i>You can tell if this
package is installed by the presence of an <b>ip</b> program on your firewall
system. As root, you can use the 'which' command to check for this program:</p>
<!--mstheme--></font><pre> [root@gateway root]# which ip
<pre> [root@gateway root]# which ip
/sbin/ip
[root@gateway root]#</pre><!--mstheme--><font face="arial, Arial, Helvetica"><p>I recommend that you first read through the
[root@gateway root]#</pre><p>I recommend that you first read through the
guide to familiarize yourself with what's involved then go back through it again
making your configuration changes. Points at which configuration changes are
recommended are flagged with <img border="0" src="images/BD21298_.gif" width="13" height="13">.</p>
@ -42,50 +49,49 @@ Unix files if your editor supports that option or you must run them through
dos2unix before trying to use them. Similarly, if you copy a configuration file
from your Windows hard drive to a floppy disk, you must run dos2unix against the
copy before using it with Shorewall.</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica"><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version of
dos2unix</a><!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica"><a href="http://www.megaloman.com/~hany/software/hd2u/">Linux Version of
dos2unix</a><!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Shorewall Concepts<!--mstheme--></font></h2>
<ul>
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version of
dos2unix</a></li>
<li><a href="http://www.megaloman.com/~hany/software/hd2u/">Linux Version of
dos2unix</a></li>
</ul>
<h2 align="left">Shorewall Concepts</h2>
<p>The configuration files for Shorewall are contained in the directory
/etc/shorewall -- for simple setups, you will only need to deal with a few of
these as described in this guide. After you have <a href="Install.htm">installed Shorewall</a>,
download the <a href="/pub/shorewall/LATEST.samples/two-interfaces.tgz">
two-interface sample</a>, un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall
download the <a href="/pub/shorewall/LATEST.samples/two-interfaces.tgz">two-interface sample</a>, un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall
(these files will replace files with the same name).</p>
<p>As each file is introduced, I suggest that you
look through the actual file on your system -- each file contains detailed
configuration instructions and default entries.</p>
<p>Shorewall views the network where it is running as being composed of a set of
<i>zones.</i> In the two-interface sample configuration, the following zone names are used:</p>
<!--mstheme--></font><table border="0" style="border-collapse: collapse" cellpadding="3" cellspacing="0" id="AutoNumber2">
<table border="0" style="border-collapse: collapse" cellpadding="3" cellspacing="0" id="AutoNumber2">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Name</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Description</b></u><!--mstheme--></font></td>
<td><u><b>Name</b></u></td>
<td><u><b>Description</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>net</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>The Internet</b><!--mstheme--></font></td>
<td><b>net</b></td>
<td><b>The Internet</b></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>loc</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>Your Local Network</b><!--mstheme--></font></td>
<td><b>loc</b></td>
<td><b>Your Local Network</b></td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
<p>Zones are defined in the <a href="Documentation.htm#Zones">
/etc/shorewall/zones</a> file.</p>
<p>Shorewall also recognizes the firewall system as its own zone - by default,
the firewall itself is known as <b>fw.</b></p>
<p>Rules about what traffic to allow and what traffic to deny are expressed in
terms of zones.</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">You express your default policy for connections from one zone to another
zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy </a>file.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">You define exceptions to those default policies in the
<a href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
<ul>
<li>You express your default policy for connections from one zone to another
zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy </a>file.</li>
<li>You define exceptions to those default policies in the
<a href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
</ul>
<p>For each connection request entering the firewall, the request is first checked against the
/etc/shorewall/rules file. If no rule in that file matches the connection
request then the first policy in /etc/shorewall/policy that matches the
@ -96,57 +102,57 @@ file for you).</p>
<p>The /etc/shorewall/policy file included with the two-interface sample has the
following policies:</p>
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber3" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber3">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Source Zone</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Destination Zone</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Policy</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Log Level</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Limit:Burst</b></u><!--mstheme--></font></td>
<td><u><b>Source Zone</b></u></td>
<td><u><b>Destination Zone</b></u></td>
<td><u><b>Policy</b></u></td>
<td><u><b>Log Level</b></u></td>
<td><u><b>Limit:Burst</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>loc</td>
<td>net</td>
<td>ACCEPT</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">all<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">DROP<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">info<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>net</td>
<td>all</td>
<td>DROP</td>
<td>info</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">all<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">all<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">REJECT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">info<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>all</td>
<td>all</td>
<td>REJECT</td>
<td>info</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<blockquote>
<p>In the two-interface sample, the line below is included but commented out. If
you want your firewall system to have full access to servers on the internet,
uncomment that line.</p>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber3" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber3">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Source Zone</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Destination Zone</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Policy</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Log Level</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>Limit:Burst</b></u><!--mstheme--></font></td>
<td><u><b>Source Zone</b></u></td>
<td><u><b>Destination Zone</b></u></td>
<td><u><b>Policy</b></u></td>
<td><u><b>Log Level</b></u></td>
<td><u><b>Limit:Burst</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>fw</td>
<td>net</td>
<td>ACCEPT</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<p>The above policy will:</p>
<ol>
@ -159,8 +165,9 @@ uncomment that line.</p>
</ol>
<p><img border="0" src="images/BD21298_.gif" width="13" height="13">&nbsp;&nbsp;&nbsp; At this point, edit your /etc/shorewall/policy and make any changes that you
wish.</p>
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Network Interfaces<!--mstheme--></font></h2>
<p align="center"><img border="0" src="images/basics.jpg" width="592" height="394"></p>
<h2 align="left">Network Interfaces</h2>
<p align="center">
<img border="0" src="images/basics.png" width="444" height="635"></p>
<p align="left">The firewall has two network interfaces. Where Internet
connectivity is through a cable or DSL &quot;Modem&quot;, the <i>External Interface</i>
will be the ethernet adapter that is connected to that &quot;Modem&quot; (e.g., <b>eth0</b>)&nbsp;
@ -188,15 +195,15 @@ the external interface is <b>eth0</b> and the internal interface is <b>eth1</b>.
If your configuration is different, you will have to modify the sample
<a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a> file accordingly. While you are there, you may wish to
review the list of options that are specified for the interfaces. Some hints:</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
<ul>
<li>
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>, you can replace the
&quot;detect&quot; in the second column with &quot;-&quot;.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
&quot;detect&quot; in the second column with &quot;-&quot;.</li>
<li>
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b> or if you have a static IP
address, you can remove &quot;dhcp&quot; from the option list.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">IP Addresses<!--mstheme--></font></h2>
address, you can remove &quot;dhcp&quot; from the option list.</li>
</ul>
<h2 align="left">IP Addresses</h2>
<p align="left">Before going further, we should say a few words about Internet
Protocol (IP) <i>addresses</i>. Normally, your ISP will assign you a single <i>
Public</i> IP address. This address may be assigned via the<i> Dynamic Host
@ -210,9 +217,9 @@ internal network (the Internal Interface on your firewall plus your other
computers). RFC 1918 reserves several <i>Private </i>IP address ranges for this
purpose:</p>
<div align="left">
<!--mstheme--></font><pre> 10.0.0.0 - 10.255.255.255
<pre> 10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255</pre><!--mstheme--><font face="arial, Arial, Helvetica">
192.168.0.0 - 192.168.255.255</pre>
</div>
<div align="left">
<p align="left"><img border="0" src="images/BD21298_.gif" width="13" height="13">&nbsp;&nbsp;&nbsp;
@ -236,24 +243,24 @@ purpose:</p>
<p align="left">Example sub-network:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" style="border-collapse: collapse" id="AutoNumber1" cellpadding="2" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" style="border-collapse: collapse" id="AutoNumber1" cellpadding="2">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>Range:</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.10.10.0 - 10.10.10.255<!--mstheme--></font></td>
<td><b>Range:</b></td>
<td>10.10.10.0 - 10.10.10.255</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>Subnet Address:</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.10.10.0<!--mstheme--></font></td>
<td><b>Subnet Address:</b></td>
<td>10.10.10.0</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>Broadcast Address:</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.10.10.255<!--mstheme--></font></td>
<td><b>Broadcast Address:</b></td>
<td>10.10.10.255</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>VLSM Notation:</b><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.10.10.0/24<!--mstheme--></font></td>
<td><b>VLSM Notation:</b></td>
<td>10.10.10.0/24</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
@ -278,9 +285,10 @@ Needs to Know about Addressing &amp; Routing&quot;,</i> Thomas A. Maufer, Prenti
1999, ISBN 0-13-975483-0.</p>
<p align="left">The remainder of this quide will assume that you have configured
your network as shown here:</p>
<p align="center"><img border="0" src="images/basics1.jpg" width="592" height="394"></p>
<p align="center">
<img border="0" src="images/basics1.png" width="444" height="635"></p>
<p align="left">The default gateway for computer's 1 &amp; 2 would be 10.10.10.254.</p>
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">IP Masquerading (SNAT)<!--mstheme--></font></h2>
<h2 align="left">IP Masquerading (SNAT)</h2>
<p align="left">The addresses reserved by RFC 1918 are sometimes referred to as
<i>non-routable</i> because the Internet backbone routers don't forward packets
which have an RFC-1918 destination address. When one of your local systems
@ -299,15 +307,15 @@ forwards the packet on to computer 1. </p>
IP Masquerading</i> but you will also see the term <i>Source Network Address
Translation </i>(SNAT) used. Shorewall follows the convention used with
Netfilter:</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
<ul>
<li>
<p align="left"><i>Masquerade</i> describes the case where you let your
firewall system automatically detect the external interface address.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
firewall system automatically detect the external interface address.</li>
<li>
<p align="left"><i>SNAT</i> refers to the case when you explicitly specify the
source address that you want outbound packets from your local network to use.
<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
</li>
</ul>
<p align="left">In Shorewall, both Masquerading and SNAT are configured with
entries in the /etc/shorewall/masq file. You will normally use Masquerading if
your external IP is dynamic and SNAT if the IP is static.</p>
@ -320,7 +328,7 @@ static, you can enter it in the third column in the /etc/shorewall/masq entry if
you like although your firewall will work fine if you leave that column empty.
Entering your static IP in column 3 makes processing outgoing packets a little
more efficient. </p>
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Port Forwarding (DNAT)<!--mstheme--></font></h2>
<h2 align="left">Port Forwarding (DNAT)</h2>
<p align="left">One of your goals may be to run one or more servers on your
local computers. Because these computers have RFC-1918 addresses, it is not
possible for clients on the internet to connect directly to them. It is rather
@ -334,89 +342,89 @@ forwarding using DNAT rules in the /etc/shorewall/rules file.</p>
<p>The general form of a simple port forwarding rule in
/etc/shorewall/rules is:</p>
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">DNAT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc:<i>&lt;server local ip address&gt; </i>[:<i>&lt;server port&gt;</i>]<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;protocol&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;port&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>DNAT</td>
<td>net</td>
<td>loc:<i>&lt;server local ip address&gt; </i>[:<i>&lt;server port&gt;</i>]</td>
<td><i>&lt;protocol&gt;</i></td>
<td><i>&lt;port&gt;</i></td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<p>Example - you run a Web Server on computer 2 and you want to forward incoming
TCP port 80 to that system:</p>
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">DNAT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc:10.10.10.2<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">80<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>DNAT</td>
<td>net</td>
<td>loc:10.10.10.2</td>
<td>tcp</td>
<td>80</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<p>A couple of important points
to keep in mind:</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">You must test the above rule from a client outside of your local network
<ul>
<li>You must test the above rule from a client outside of your local network
(i.e., don't test from a browser running on computers 1 or 2 or on the
firewall). If you want to be able to access your web server using the IP
address of your external interface, see <a href="FAQ.htm#faq2">Shorewall FAQ
#2</a>.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Many ISPs block incoming connection requests to port 80. If you have
#2</a>.</li>
<li>Many ISPs block incoming connection requests to port 80. If you have
problems connecting to your web server, try the following rule and try
connecting to port 5000.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
connecting to port 5000.</li>
</ul>
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">DNAT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc:10.10.10.2:80<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">5000<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>DNAT</td>
<td>net</td>
<td>loc:10.10.10.2:80</td>
<td>tcp</td>
<td>5000</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<p>
<img border="0" src="images/BD21298_.gif" width="13" height="13">&nbsp;&nbsp;&nbsp; At this point, modify
/etc/shorewall/rules to add any DNAT rules that you require.</p>
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Domain Name Server (DNS)<!--mstheme--></font></h2>
<h2 align="left">Domain Name Server (DNS)</h2>
<p align="left">Normally, when you connect to your ISP, as part of getting an IP
address your firewall's <i>Domain Name Service </i>(DNS) resolver will be
automatically configured (e.g., the /etc/resolv.conf file will be written).
@ -424,15 +432,15 @@ Alternatively, your ISP may have given you the IP address of a pair of DNS <i>
name servers</i> for you to manually configure as your primary and secondary
name servers. Regardless of how DNS gets configured on your firewall, it is <u>your</u> responsibility to configure the resolver in your
internal systems. You can take one of two approaches:</p>
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
<ul>
<li>
<p align="left">You can configure your internal systems to use your ISP's name
servers. If you ISP gave you the addresses of their servers or if those
addresses are available on their web site, you can configure your internal
systems to use those addresses. If that information isn't available, look in
/etc/resolv.conf on your firewall system -- the name servers are given in
&quot;nameserver&quot; records in that file.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">
&quot;nameserver&quot; records in that file.</li>
<li>
<p align="left"><img border="0" src="images/BD21298_.gif" width="13" height="13">&nbsp;&nbsp;&nbsp; You can configure a<i> Caching Name Server </i>on your
firewall.<i> </i>Red Hat has an RPM for a caching name server (the RPM also
requires the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you
@ -441,75 +449,75 @@ internal systems. You can take one of two approaches:</p>
address of the firewall (10.10.10.254 in the example above) for the name
server address. To allow your local systems to talk to your caching name
server, you must open port 53 (both UDP and TCP) from the local network to the
firewall; you do that by adding the following rules in /etc/shorewall/rules.<!--mstheme--></font><!--msthemelist--></td></tr>
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
firewall; you do that by adding the following rules in /etc/shorewall/rules.</li>
</ul>
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">53<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>loc</td>
<td>fw</td>
<td>tcp</td>
<td>53</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">udp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">53<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>loc</td>
<td>fw</td>
<td>udp</td>
<td>53</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
<div align="left">
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Other Connections<!--mstheme--></font></h2>
<h2 align="left">Other Connections</h2>
</div>
<div align="left">
<p align="left">The two-interface sample includes the following rules:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">53<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>fw</td>
<td>net</td>
<td>tcp</td>
<td>53</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">udp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">53<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>fw</td>
<td>net</td>
<td>udp</td>
<td>53</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
@ -520,26 +528,26 @@ internal systems. You can take one of two approaches:</p>
<p align="left">The sample also includes:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">22<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>loc</td>
<td>fw</td>
<td>tcp</td>
<td>22</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
@ -550,26 +558,26 @@ internal systems. You can take one of two approaches:</p>
and other systems, the general format is:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;source zone&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;destination zone&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;protocol&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><i>&lt;port&gt;</i><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td><i>&lt;source zone&gt;</i></td>
<td><i>&lt;destination zone&gt;</i></td>
<td><i>&lt;protocol&gt;</i></td>
<td><i>&lt;port&gt;</i></td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
@ -577,35 +585,35 @@ internal systems. You can take one of two approaches:</p>
system:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">80<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">#Allow web access<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">from the internet<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>net</td>
<td>fw</td>
<td>tcp</td>
<td>80</td>
<td>#Allow web access</td>
<td>from the internet</td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">loc<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">80<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">#Allow web access<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">from the local network<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>loc</td>
<td>fw</td>
<td>tcp</td>
<td>80</td>
<td>#Allow web access</td>
<td>from the local network</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
@ -620,33 +628,33 @@ internal systems. You can take one of two approaches:</p>
access to your firewall from the internet, use SSH:</div>
<div align="left">
<blockquote>
<!--mstheme--></font><table border="1" cellpadding="2" style="border-collapse: collapse" bordercolor="#111111" id="AutoNumber4" bordercolordark="#666666" bordercolorlight="#CCCCCC">
<table border="1" cellpadding="2" style="border-collapse: collapse" id="AutoNumber4">
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ACTION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>DESTINATION</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PROTOCOL</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>SOURCE PORT</b></u><!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica"><u><b>ORIGINAL ADDRESS</b></u><!--mstheme--></font></td>
<td><u><b>ACTION</b></u></td>
<td><u><b>SOURCE</b></u></td>
<td><u><b>DESTINATION</b></u></td>
<td><u><b>PROTOCOL</b></u></td>
<td><u><b>PORT</b></u></td>
<td><u><b>SOURCE PORT</b></u></td>
<td><u><b>ORIGINAL ADDRESS</b></u></td>
</tr>
<tr>
<td><!--mstheme--><font face="arial, Arial, Helvetica">ACCEPT<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">net<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">fw<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">tcp<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">22<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td><!--mstheme--><font face="arial, Arial, Helvetica">&nbsp;<!--mstheme--></font></td>
<td>ACCEPT</td>
<td>net</td>
<td>fw</td>
<td>tcp</td>
<td>22</td>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table><!--mstheme--><font face="arial, Arial, Helvetica">
</table>
</blockquote>
</div>
<div align="left">
<p align="left"><img border="0" src="images/BD21298_.gif" width="13" height="13">&nbsp;&nbsp;&nbsp; Now edit your
/etc/shorewall/rules file to add or delete other connections as required.</div>
<div align="left">
<h2 align="left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Starting and Stopping Your Firewall<!--mstheme--></font></h2>
<h2 align="left">Starting and Stopping Your Firewall</h2>
</div>
<div align="left">
<p align="left">The <a href="Install.htm">installation procedure </a>
@ -678,6 +686,6 @@ Eastep</a></font></p>
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002 Thomas M. Eastep</font></a></p>
<!--mstheme--></font></body>
</body>
</html>