<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"> <article id="Multiple_Zones"> <!--$Id$--> <articleinfo> <title>Routing on One Interface</title> <authorgroup> <author> <firstname>Tom</firstname> <surname>Eastep</surname> </author> </authorgroup> <pubdate><?dbtimestamp format="Y/m/d"?></pubdate> <copyright> <year>2003-2005</year> <holder>Thomas M. Eastep</holder> </copyright> <legalnotice> <para>Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled <quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para> </legalnotice> </articleinfo> <caution> <para><emphasis role="bold">This article applies to Shorewall 4.3 and later. If you are running a version of Shorewall earlier than Shorewall 4.3.5 then please see the documentation for that release.</emphasis></para> </caution> <section id="Intro"> <title>Introduction</title> <para>While most configurations can be handled with each of the firewall's network interfaces assigned to a single zone, there are cases where you will want to divide the hosts accessed through an interface between two or more zones.</para> <itemizedlist> <listitem> <para>The interface has multiple addresses on multiple subnetworks. This case is covered in the <ulink url="Shorewall_and_Aliased_Interfaces.html">Aliased Interface documentation</ulink>.</para> </listitem> <listitem> <para>You are using some form of NAT and want to access a server by its external IP address from the same LAN segment. This is covered in <ulink url="FAQ.htm#faq2">FAQs 2 and 2a</ulink>.</para> </listitem> <listitem> <para>There are routers accessible through the interface and you want to treat the networks accessed through that router as a separate zone.</para> </listitem> <listitem> <para>Some of the hosts accessed through an interface have significantly different firewalling requirements from the others so you want to assign them to a different zone.</para> </listitem> </itemizedlist> <para>The key points to keep in mind when setting up multiple zones per interface are:</para> <itemizedlist> <listitem> <para>Shorewall generates rules for zones in the order that the zone declarations appear in /etc/shorewall/zones unless you modify the processing order using the explicit <emphasis>child-zone</emphasis>:<emphasis>parent-zone</emphasis> syntax, in which case the child zone rules are generated first.</para> </listitem> <listitem> <para>The order of entries in /etc/shorewall/hosts is immaterial as far as the generated rule set is concerned.</para> </listitem> </itemizedlist> <para><emphasis role="bold">These examples use the local zone but the same technique works for any zone.</emphasis> Remember that Shorewall doesn't have any conceptual knowledge of <quote>Internet</quote>, <quote>Local</quote>, or <quote>DMZ</quote> so all zones except the firewall itself ($FW) are the same as far as Shorewall is concerned. Also, the examples use private (RFC 1918) addresses but public IP addresses can be used in exactly the same way.</para> </section> <section id="Router"> <title>Router in the Local Zone</title> <para>Here is an example of a router in the local zone.</para> <note> <para>the <emphasis role="bold">box called <quote>Router</quote> could be a VPN server</emphasis> or other such device; from the point of view of this discussion, it makes no difference.</para> </note> <graphic fileref="images/MultiZone1.png" /> <section id="Standard"> <title>Can You Use the Standard Configuration?</title> <para>In many cases, the <ulink url="two-interface.htm">standard two-interface Shorewall setup</ulink> will work fine in this configuration. It will work if:</para> <itemizedlist> <listitem> <para>The firewall requirements to/from the Internet are the same for 192.168.1.0/24 and 192.168.2.0/24.</para> </listitem> <listitem> <para>The hosts in 192.168.1.0/24 know that the route to 192.168.2.0/24 is through the <emphasis role="bold">router</emphasis>.</para> </listitem> </itemizedlist> <para>All you have to do on the firewall is add a route to 192.168.2.0/24 through the <emphasis role="bold">router</emphasis> and restart Shorewall.</para> </section> <section id="Enough"> <title>Will One Zone be Enough?</title> <para>If the firewalling requirements for the two local networks is the same but the hosts in 192.168.1.0/24 don't know how to route to 192.168.2.0/24 then you need to configure the firewall slightly differently. This type of configuration is rather stupid from an IP networking point of view but it is sometimes necessary because you simply don't want to have to reconfigure all of the hosts in 192.168.1.0/24 to add a persistent route to 192.168.2.0/24. On the firewall:</para> <orderedlist> <listitem> <para>Add a route to 192.168.2.0/24 through the <emphasis role="bold">Router</emphasis>.</para> </listitem> <listitem> <para>Set the <quote>routeback</quote> option for eth1 (the local firewall interface) in /etc/shorewall/interfaces.</para> </listitem> <listitem> <para>Restart Shorewall.</para> </listitem> </orderedlist> </section> <section id="Separate"> <title>I Need Separate Zones</title> <para>If you need to make 192.168.2.0/24 into its own zone, you can do it one of two ways; Nested Zones or Parallel Zones.</para> <section id="Nested"> <title>Nested Zones</title> <para>You can define one zone (called it <quote>loc</quote>) as being all hosts connected to eth1 and a second zone <quote>loc1</quote> (192.168.2.0/24) as a sub-zone.</para> <graphic fileref="images/MultiZone1A.png" /> <para><note> <para>The Router in the above diagram is assumed to NOT be doing SNAT for the hosts in the 192.168.2.0/24 network.</para> </note>The advantage of this approach is that the zone <quote>loc1</quote> can use CONTINUE policies such that if a connection request doesn't match a <quote>loc1</quote> rule, it will be matched against the <quote>loc</quote> rules. For example, if your loc1->net policy is CONTINUE then if a connection request from loc1 to the Internet doesn't match any rules for loc1->net then it will be checked against the loc->net rules.</para> <para><filename>/etc/shorewall/zones</filename></para> <programlisting>#ZONE TYPE OPTIONS loc ipv4 loc1:loc ipv4</programlisting> <note> <para>the Parent zone (loc) is defined first then the sub-zone (loc1) is defined using the special syntax shown.</para> </note> <para><filename>/etc/shorewall/interfaces</filename></para> <programlisting>#ZONE INTERFACE BROADCAST OPTIONS loc eth1 -</programlisting> <para><filename>/etc/shorewall/hosts</filename></para> <programlisting>#ZONE HOSTS OPTIONS loc1 eth1:192.168.2.0/24 -</programlisting> <para>If you don't need Shorewall to set up infrastructure to route traffic between <quote>loc</quote> and <quote>loc1</quote>, add these two policies.</para> <para>/etc/shorewall/policy</para> <programlisting>#SOURCE DEST POLICY loc loc1 NONE loc1 loc NONE</programlisting> </section> <section id="Parallel"> <title>Parallel Zones</title> <para>You define both zones in the /etc/shorewall/hosts file to create two disjoint zones.</para> <graphic fileref="images/MultiZone1B.png" /> <para><note> <para>The Router in the above diagram is assumed to NOT be doing SNAT for the hosts in the 192.168.2.0/24 network.</para> </note><filename>/etc/shorewall/zones</filename></para> <programlisting>#ZONE TYPE OPTIONS loc1 ipv4 loc2 ipv4</programlisting> <para><filename>/etc/shorewall/interfaces</filename></para> <programlisting>#ZONE INTERFACE BROADCAST - eth1 192.168.1.255 </programlisting> <para><filename>/etc/shorewall/hosts</filename></para> <programlisting>#ZONE HOSTS OPTIONS loc1 eth1:192.168.1.0/24 - loc2 eth1:192.168.2.0/24 -</programlisting> <para>You don't need Shorewall to set up infrastructure to route traffic between <quote>loc</quote> and <quote>loc1</quote>, so add these two policies:</para> <programlisting>#SOURCE DEST POLICY loc1 loc2 NONE loc2 loc1 NONE</programlisting> </section> </section> </section> <section id="Special"> <title>Some Hosts have Special Firewalling Requirements</title> <para>There are cases where a subset of the addresses associated with an interface need special handling. Here's an example.</para> <graphic fileref="images/MultiZone2.png" /> <para>In this example, addresses 192.168.1.8 - 192.168.1.15 (192.168.1.8/29) are to be treated as their own zone (loc1).</para> <para><filename>/etc/shorewall/zones</filename></para> <programlisting>#ZONE TYPE OPTIONS loc ipv4 loc1:loc ipv4</programlisting> <para><filename>/etc/shorewall/interfaces</filename></para> <programlisting>#ZONE INTERFACE BROADCAST loc eth1 -</programlisting> <para><filename>/etc/shorewall/hosts</filename><programlisting>#ZONE HOSTS OPTIONS loc1 eth1:192.168.1.8/29 broadcast</programlisting></para> <para>The <option>broadcast</option> option causes limited broadcasts (destination IP address 255.255.255.255) to be checked against the loc1 zone. If that zone allows the packet, then of course it will be seen by the mempers of loc that are outside of loc1 as well. If the broadcast is not specifically DROPped by the fw->loc1 rules then it will also be checked against the fw->loc rules, even if there is a DROP or REJECT fw->loc1 policy.</para> <para>You probably don't want Shorewall to set up infrastructure to route traffic between <quote>loc</quote> and <quote>loc1</quote> so you should add these two policies.</para> <para><filename>/etc/shorewall/policy</filename></para> <programlisting>#SOURCE DEST POLICY loc loc1 NONE loc1 loc NONE</programlisting> </section> <section id="OneArmed"> <title>One-armed Router</title> <para>Nested zones may also be used to configure a <quote>one-armed</quote> router (I don't call it a <quote>firewall</quote> because it is very insecure. For example, if you connect to the Internet via cable modem, your next door neighbor has full access to your local systems as does everyone else connected to the same cable modem head-end controller). Here eth0 is configured with both a public IP address and an RFC 1918 address (More on that topic may be found <ulink url="Shorewall_and_Aliased_Interfaces.html">here</ulink>). Hosts in the <quote>loc</quote> zone are configured with their default gateway set to the Shorewall router's RFC1918 address.</para> <para><graphic fileref="images/MultiZone3.png" /></para> <para><filename>/etc/shorewall/zones</filename></para> <programlisting>#ZONE TYPE OPTIONS net ipv4 loc:net ipv4</programlisting> <para><filename>/etc/shorewall/interfaces</filename></para> <programlisting>#ZONE INTERFACE BROADCAST OPTIONS net eth0 detect routefilter</programlisting> <para><filename>/etc/shorewall/hosts</filename></para> <programlisting>#ZONE HOSTS OPTIONS loc eth0:192.168.1.0/24 maclist</programlisting> <para><filename><filename>/etc/shorewall/masq</filename></filename></para> <programlisting>#INTERFACE SOURCE ADDRESS eth0:!192.168.1.0/24 192.168.1.0/24</programlisting> <para>Note that the <emphasis role="bold">maclist</emphasis> option is specified in <filename>/etc/shorewall/interfaces</filename>. This is to help protect your router from unauthorized access by your friends and neighbors. Start without <emphasis role="bold">maclist</emphasis> then add it and configure your <ulink url="MAC_Validation.html"><filename>/etc/shorewall/maclist</filename></ulink> file when everything else is working.</para> </section> </article>