Shorewall QuickStart Guides
Version 3.1

With thanks to Richard who reminded me once again that we must all first walk before we can run.

The Guides

These guides provide step-by-step instructions for configuring Shorewall in common firewall setups.

The following guides are for users who have a single public IP address:

• Standalone Linux System
• Two-interface Linux System acting as a firewall/router for a small local network
• Three-interface Linux System acting as a firewall/router for a small local network and a DMZ.

The above guides are designed to get your first firewall up and running quickly in the three most common Shorewall configurations.

The Shorewall Setup Guide outlines the steps necessary to set up a firewall where there are multiple public IP addresses involved or if you want to learn more about Shorewall than is explained in the single-address guides above.

• 1.0 Introduction
• 2.0 Shorewall Concepts
• 3.0 Network Interfaces
• 4.0 Addressing, Subnets and Routing
  • 4.1 IP Addresses
  • 4.2 Subnets
  • 4.3 Routing
  • 4.4 Address Resolution Protocol
  • 4.5 RFC 1918
• 5.0 Setting up your Network
  • 5.1 Routed
  • 5.2 Non-routed
    • 5.2.1 SNAT
    • 5.2.2 DNAT
    • 5.2.3 Proxy ARP
    • 5.2.4 Static NAT
  • 5.3 Rules
  • 5.4 Odds and Ends
• 6.0 DNS
• 7.0 Starting and Stopping the Firewall

Additional Documentation

The following documentation covers a variety of topics and supplements the QuickStart Guides described above.

• Blacklisting
  • Static Blacklisting using /etc/shorewall/blacklist
  • Dynamic Blacklisting using /sbin/shorewall
• Common configuration file features
  • Comments in configuration files
  • Line Continuation
  • Port Numbers/Service Names
  • Port Ranges
  • Using Shell Variables
  • Complementing an IP address or Subnet
  • Shorewall Configurations (making a test configuration)
  • Using MAC Addresses in Shorewall
• Configuration File Reference Manual
  • params
  • zones
  • interfaces
  • hosts
  • policy
  • rules
  • common
  • masq
  • proxyarp
  • nat
  • tunnels
  • tcrules
  • shorewall.conf
  • modules
  • tos
  • blacklist
  • rfc1918
  • routestopped
• DHCP
• Extension Scripts (How to extend Shorewall without modifying Shorewall code)
• Fallback/Uninstall
• Firewall Structure
• Kernel Configuration
• My Configuration Files (How I personally use Shorewall)
• Port Information
  • Which applications use which ports
  • Ports used by Trojans
• Proxy ARP
• Samba
• Starting/stopping the Firewall
• Static NAT
• Traffic Shaping/Control
• VPN
  • IPSEC
  • GRE and IPIP
  • PPTP
  • IPSEC/PPTP from a system behind your firewall to a remote network.
• White List Creation

If you use one of these guides and have a suggestion for improvement please let me know.

Last modified 9/16/2002 - Tom Eastep

Copyright 2002 Thomas M. Eastep