# # Shorewall version 1.4 - Sample Rules File For One Interface # # /etc/shorewall/rules # # Rules in this file govern connection establishment. Requests and # responses are automatically allowed using connection tracking. # # In most places where an IP address or subnet is allowed, you # can preceed the address/subnet with "!" (e.g., !192.168.1.0/24) to # indicate that the rule matches all addresses except the address/subnet # given. Notice that no white space is permitted between "!" and the # address/subnet. # # Columns are: # # # ACTION ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, # REDIRECT-, CONTINUE or LOG. # # ACCEPT # Allow the connection request # DROP # Ignore the request # REJECT # Disallow the request and return an # icmp-unreachable or an RST packet. # DNAT # Forward the request to another # system (and optionally another # port). # DNAT- # Advanced users only. # Like DNAT but only generates the # DNAT iptables rule and not # the companion ACCEPT rule. # REDIRECT # Redirect the request to a local # port on the firewall. # REDIRECT- # Advanced users only. # Like REDIRECT but only generates the # REDIRECT iptables rule and not the # companion ACCEPT rule. # CONTINUE # (For experts only). Do Not Process # any of the following rules for this # (source zone,destination zone). If # the source and/or destination IP # address falls into a zone defined # later in /etc/shorewall/zones, this # connection request will be passed # to the rules defined for that # (those) zones(s). # LOG # Simply log the packet and continue. # # May optionally be followed by ":" and a syslog log # level (e.g, REJECT:info). This causes the packet to be # logged at the specified level. # # You may also specify ULOG (must be in upper case) as a # log level. This will log to the ULOG target for routing # to a separate log through use of ulogd. # (http://www.gnumonks.org/projects/ulogd). # # SOURCE Source hosts to which the rule applies. May be a zone # defined in /etc/shorewall/zones, $FW to indicate the # firewall itself, or "all" If the ACTION is DNAT or # REDIRECT, sub-zones of the specified zone may be # excluded from the rule by following the zone name with # "!' and a comma-separated list of sub-zone names. # # Except when "all" is specified, clients may be further # restricted to a list of subnets and/or hosts by # appending ":" and a comma-separated list of subnets # and/or hosts. Hosts may be specified by IP or MAC # address; mac addresses must begin with "~" and must use # "-" as a separator. # # Some Examples: # # net:155.186.235.1 # Host 155.186.235.1 on the Internet # # net:155.186.235.0/24 # Subnet 155.186.235.0/24 on the # Internet # # net:155.186.235.1,155.186.235.2 # Hosts 155.186.235.1 and # 155.186.235.2 on the Internet. # # net:~00-A0-C9-15-39-78 # Host on the Internet with # MAC address 00:A0:C9:15:39:78. # # Alternatively, clients may be specified by interface # by appending ":" to the zone name followed by the # interface name. For example, net:eth0 specifies a # client that communicates with the firewall system # through eth0. This may be optionally followed by # another colon (":") and an IP/MAC/subnet address # as described above (e.g., net:eth0:192.168.1.5). # # DEST Location of Server. May be a zone defined in # /etc/shorewall/zones, $FW to indicate the firewall # itself or "all" # # Except when "all" is specified, the server may be # further restricted to a particular subnet, host or # interface by appending ":" and the subnet, host or # interface. See above. # # Restrictions: # # 1. MAC addresses are not allowed. # 2. In DNAT rules, only IP addresses are # allowed; no FQDNs or subnet addresses # are permitted. # 3. You may not specify both an interface and # an address # # Unlike in the SOURCE column, you may specify a range of # up to 256 IP addresses using the syntax # -. When the ACTION is DNAT or DNAT-, # the connections will be assigned to addresses in the # range in a round-robin fashion. # # The port that the server is listening on may be # included and separated from the server's IP address by # ":". If omitted, the firewall will not modifiy the # destination port. A destination port may only be # included if the ACTION is DNAT or REDIRECT. # # Example: net:155.186.235.1:25 specifies a Internet # server at IP address 155.186.235.1 and listening on port # 25. The port number MUST be specified as an integer # and not as a name from /etc/services. # # If the ACTION is REDIRECT, this column needs only to # contain the port number on the firewall that the # request should be redirected to. # # PROTO Protocol - Must be "tcp", "udp", "icmp", a number or # "all". # # DEST PORT(S) Destination Ports. A comma-separated list of Port # names (from /etc/services), port numbers or port # ranges; if the protocol is "icmp", this column is # interpreted as the destination icmp-type(s). # # A port range is expressed as :. # # This column is ignored if PROTOCOL = all but must be # entered if any of the following fields are supplied. # In that case, it is suggested that this field contain # "-" # # If your kernel contains multi-port match support, then # only a single Netfilter rule will be generated if in # this list and the CLIENT PORT(S) list below: # 1. There are 15 or less ports listed. # 2. No port ranges are included. # Otherwise, a separate rule will be generated for each # port. # # CLIENT PORT(S) (Optional) Port(s) used by the client. If omitted, # any source port is acceptable. Specified as a comma- # separated list of port names, port numbers or port # ranges. # # If you don't want to restrict client ports but need to # specify an ADDRESS in the next column, then place "-" # in this column. # # If your kernel contains multiport match support, then # only a single Netfilter rule will be generated if in # this list and the DEST PORT(S) list above: # 1. There are 15 or less ports listed. # 2. No port ranges are included. # Otherwise, a separate rule will be generated for each # port. # # ORIGINAL DEST (0ptional -- only allowed if ACTION is DNAT[-] or # REDIRECT[-}) If included and different from the IP # address given in the SERVER column, this is an address # on some interface on the firewall and connections to # that address will be forwarded to the IP and port # specified in the DEST column. # # A comma-separated list of addresses may also be used. # This is usually most useful with the REDIRECT target # where you want to redirect traffic destined for # a particular set of hosts. # # Finally, if the list of addresses begins with "!" then # the rule will be followed only if the original # destination address in the connection request does not # match any of the addresses listed. # # The address may optionally be followed by # a colon (":") and a second IP address. This causes # Shorewall to use the second IP address as the source # address in forwarded packets. See the Shorewall # documentation for restrictions concerning this feature. # If no source IP address is given, the original source # address is not altered. # # Note: Most one interface rules are of the type ACCEPT, REDIRECT or REJECT. # DNAT, DNAT-, CONTINUE rules are for multiple interface firewall. # Also by default all outbound fw -> net communications are allowed. # (One Interface Only) You can change this behavior in the sample policy file. # # Example: Accept www requests to the one interface server. # # #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL # # PORT PORT(S) DEST # ACCEPT net fw tcp http # # Example: Redirect port 88 Internet traffic to fw port 80 # #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL # # PORT PORT(S) DEST # REDIRECT net 80 tcp 88 # ############################################################################## #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL # PORT PORT(S) DEST ACCEPT net fw icmp 8 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE