My Current Network
Warning 1: I
use a combination of Static NAT and Proxy ARP, neither of which are relevant
to a simple configuration with a single public IP address.
If you have just a single public IP address, most of what you see here
won't apply to your setup so beware of copying parts of this configuration
and expecting them to work for you. What you copy may or may not work in
your configuration.
Warning 2: My
configuration uses features introduced in Shorewall version 1.4.1.
I have DSL service and have 5 static IP addresses (206.124.146.176-180).
My DSL "modem" (Fujitsu Speedport)
is connected to eth0. I have a local network connected to eth2 (subnet
192.168.1.0/24) and a DMZ connected to eth1 (192.168.2.0/24).
I use:
- Static NAT for Ursa (my XP System) - Internal address
192.168.1.5 and external address 206.124.146.178.
- Static NAT for Wookie (my Linux System). Internal address
192.168.1.3 and external address 206.124.146.179.
- SNAT through the primary gateway address (206.124.146.176)
for my Wife's system (Tarry) and our laptop (Tipper) which connects
through the Wireless Access Point (wap) via a Wireless Bridge (bridge).
Note: While the distance between the WAP and where I usually use the
laptop isn't very far (25 feet or so), using a WAC11 (CardBus wireless card)
has proved very unsatisfactory (lots of lost connections). By replacing the
WAC11 with the WET11 wireless bridge, I have virtually eliminated these problems
(I was also able to eliminate them by hanging a piece of aluminum foil on
the family room wall but Tarry rejected that as a permanent solution :-).
The firewall runs on a 256MB PII/233 with RH8.0.
Wookie runs Samba and acts as the a WINS server. Wookie is in its
own 'whitelist' zone called 'me'.
My work laptop (easteplaptop) is connected to eth3 using a cross-over
cable. It runs its own Sygate
firewall software and is managed by Proxy ARP. It connects to the local
network through a PPTP server. running on Ursa.
The single system in the DMZ (address 206.124.146.177) runs postfix,
Courier IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP
server (Pure-ftpd). The system also runs fetchmail to fetch our email
from our old and current ISPs. That server is managed through Proxy
ARP.
The firewall system itself runs a DHCP server that serves the local
network.
All administration and publishing is done using ssh/scp. I have X installed
on both the firewall and the server but no X server or desktop is installed.
X applications tunnel through SSH to XWin.exe running on Ursa.
I run an SNMP server on my firewall to serve MRTG running
in the DMZ.
The ethernet interface in the Server is configured with IP address
206.124.146.177, netmask 255.255.255.0. The server's default gateway is
206.124.146.254 (Router at my ISP. This is the same default
gateway used by the firewall itself). On the firewall,
Shorewall automatically adds a host route to
206.124.146.177 through eth1 (192.168.2.1) because of
the entry in /etc/shorewall/proxyarp (see below).
A similar setup is used on eth3 (192.168.3.1) which interfaces
to my laptop (206.124.146.180).
Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior
access.
Shorewall.conf
SHARED_DIR=/usr/share/shorewall
LOGFILE=/var/log/firewall
LOGRATE=
LOGBURST=
LOGUNCLEAN=info
BLACKLIST_LOGLEVEL=
LOGNEWNOTSYN=
MACLIST_LOG_LEVEL=$LOG
TCP_FLAGS_LOG_LEVEL=$LOG
RFC1918_LOG_LEVEL=$LOG
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
SUBSYSLOCK=/var/lock/subsys/shorewall
STATEDIR=/var/state/shorewall
MODULESDIR=
FW=fw
NAT_ENABLED=Yes
MANGLE_ENABLED=Yes
IP_FORWARDING=On
ADD_IP_ALIASES=Yes
ADD_SNAT_ALIASES=Yes
TC_ENABLED=Yes
CLEAR_TC=No
MARK_IN_FORWARD_CHAIN=No
CLAMPMSS=Yes
ROUTE_FILTER=No
NAT_BEFORE_RULES=No
MULTIPORT=Yes
DETECT_DNAT_IPADDRS=Yes
MUTEX_TIMEOUT=60
NEWNOTSYN=Yes
BLACKLIST_DISPOSITION=DROP
MACLIST_DISPOSITION=REJECT
TCP_FLAGS_DISPOSITION=DROP
Params File (Edited):
MIRRORS=<list of shorewall mirror ip addresses>
NTPSERVERS=<list of the NTP servers I sync with>
TEXAS=<ip address of gateway in Dallas>
LOG=ULOG
Zones File
#ZONE DISPLAY COMMENTS
net Internet Internet
me Wookie My Linux Workstation
dmz DMZ Demilitarized zone
loc Local Local networks
tx Texas Peer Network in Dallas
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Interfaces File:
This is set up so that I can start the firewall before bringing up my
Ethernet interfaces.
#ZONE INERFACE BROADCAST OPTIONS
net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags
loc eth2 192.168.1.255 dhcp,maclist
dmz eth1 192.168.2.255
net eth3 206.124.146.255
- texas 192.168.9.255
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Hosts File:
#ZONE HOST(S) OPTIONS
me eth2:192.168.1.3
tx texas:192.168.8.0/22
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Routestopped File:
#INTERFACQ HOST(S)
eth1 206.124.146.177
eth2 -
eth3 206.124.146.180
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Policy File:
#SOURCE DESTINATION POLICY LOG LEVEL BURST:LIMIT
me loc NONE
loc me NONE
me all ACCEPT
tx me ACCEPT
all me CONTINUE - 2/sec:5
loc net ACCEPT
$FW loc ACCEPT
$FW tx ACCEPT
loc tx ACCEPT
loc fw REJECT $LOG
net all DROP $LOG 10/sec:40
all all REJECT $LOG
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Masq File:
Although most of our internal systems use static NAT, my wife's system
(192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors
with laptops. Also, I masquerade wookie to the peer subnet in Texas.
#INTERFACE SUBNET ADDRESS
eth0:0.0.0.0/0 eth2 206.124.146.176
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
NAT File:
#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL
206.124.146.178 eth0:0 192.168.1.5 No No
206.124.146.179 eth0:1 192.168.1.3 No No
192.168.1.193 eth2:0 206.124.146.177 No No
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
Proxy ARP File:
#ADDRESS INTERFACE EXTERNAL HAVEROUTE
206.124.146.177 eth1 eth0 No
206.124.146.180 eth3 eth0 No
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):
#TYPE ZONE GATEWAY GATEWAY ZONE PORT
gre net $TEXAS
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
Common File:
. /etc/shorewall/common.def
run_iptables -A common -p tcp --dport auth -j REJECT
Rules File (The shell variables are set in /etc/shorewall/params):
################################################################################################################################################################
#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT ORIGINAL DEST:SNAT
################################################################################################################################################################
# Local Network to Internet - Reject attempts by Trojans to call home
#
REJECT:$LOG loc net tcp 6667
#
# Stop NETBIOS crap since our policy is ACCEPT
#
REJECT loc net tcp 137,445
REJECT loc net udp 137:139
LOG:$LOG loc net tcp 137:139
################################################################################################################################################################
# Local Network to Firewall
#
ACCEPT loc fw tcp ssh,time,10000
ACCEPT loc fw udp snmp
ACCEPT loc fw udp ntp
################################################################################################################################################################
# Local Network to DMZ (10027 is our SMTP backdoor that bypasses virus/spam filtering)
#
ACCEPT loc dmz udp domain
ACCEPT loc dmz tcp smtp,domain,ssh,imap,https,imaps,cvspserver,www,ftp,10027,10000,8080 -
################################################################################################################################################################
# Internet to DMZ
#
ACCEPT net dmz tcp www,smtp,ftp,imaps,domain,cvspserver,https,imap -
ACCEPT net dmz udp domain
ACCEPT net:$MIRRORS dmz tcp rsync
ACCEPT:$LOG net dmz tcp 32768:61000 20
DROP net dmz tcp 1433
################################################################################################################################################################
#
# Net to Local
#
# My laptop isn't NATTED when in its docking station. To allow access to the local lan, I need a VPN to Ursa which is enabled by the following "half"-rules.
#
DNAT- net loc:192.168.1.5 tcp 1723 - 206.124.146.178
DNAT- net loc:192.168.1.5 gre - - 206.124.146.178
#
# When I'm "on the road", the following two rules allow me VPN access back home.
#
ACCEPT net loc:192.168.1.5 tcp 1723
ACCEPT net loc:192.168.1.5 gre
#
# ICQ to Ursa
#
ACCEPT net loc:192.168.1.5 tcp 4000:4100
################################################################################################################################################################
# Net to me
#
ACCEPT net me:192.168.1.3 tcp 4000:4100
################################################################################################################################################################
# DMZ to Internet
#
ACCEPT dmz net tcp smtp,domain,www,https,whois,echo,2702,21,2703,ssh
ACCEPT dmz net udp domain
ACCEPT dmz net:206.124.128.8 tcp pop3
ACCEPT dmz net:66.216.26.115 tcp pop3
#
# Something is wrong with the FTP connection tracking code or there is some client out there
# that is sending a PORT command which that code doesn't understand. Either way,
# the following works around the problem.
#
ACCEPT:$LOG dmz net tcp 1024: 20
################################################################################################################################################################
# DMZ to Firewall -- ntp & snmp
#
ACCEPT dmz fw udp ntp ntp
ACCEPT dmz fw tcp snmp
ACCEPT dmz fw udp snmp
################################################################################################################################################################
#
# DMZ to Local Network
#
ACCEPT dmz loc tcp smtp
################################################################################################################################################################
#
# DMZ to Me -- NFS
#
ACCEPT dmz me tcp 111
ACCEPT dmz me udp 111
ACCEPT dmz me udp 2049
ACCEPT dmz me udp 32700:
################################################################################################################################################################
# Internet to Firewall
#
ACCEPT net:eth3:206.124.146.180 fw udp ntp ntp
REJECT net fw tcp www
DROP net fw tcp 1433
DROP net:eth3:!206.124.146.180 fw all
################################################################################################################################################################
# Firewall to Internet
#
ACCEPT fw net:$NTPSERVERS udp ntp ntp
ACCEPT fw net udp domain
ACCEPT fw net tcp domain,www,https,ssh,1723,whois,1863
ACCEPT fw net udp 33435:33535
ACCEPT fw net icmp 8
################################################################################################################################################################
# Firewall to DMZ
#
ACCEPT fw dmz tcp www,ftp,ssh,smtp
ACCEPT fw dmz udp domain
ACCEPT fw dmz icmp 8
REJECT fw dmz udp 137:139
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
Tom Eastep
Copyright
© 2001, 2002, 2003 Thomas M. Eastep.