mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-07 16:24:01 +01:00
025e97c8bb
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8670 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
645 lines
26 KiB
XML
645 lines
26 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
|
|
<article id="standalone">
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Standalone Firewall</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2002-2007</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<caution>
|
|
<para><emphasis role="bold">This article applies to Shorewall 4.0 and
|
|
later. If you are running a version of Shorewall earlier than Shorewall
|
|
4.0.0 then please see the documentation for that
|
|
release.</emphasis></para>
|
|
</caution>
|
|
|
|
<caution>
|
|
<para><emphasis role="bold">Do not attempt to install Shorewall on a
|
|
remote system. You are virtually assured to lock yourself out of that
|
|
system.</emphasis></para>
|
|
</caution>
|
|
|
|
<section id="Introduction">
|
|
<title>Introduction</title>
|
|
|
|
<para>Setting up Shorewall on a standalone Linux system is very easy if
|
|
you understand the basics and follow the documentation.</para>
|
|
|
|
<para>This guide doesn't attempt to acquaint you with all of the features
|
|
of Shorewall. It rather focuses on what is required to configure Shorewall
|
|
in one of its most common configurations:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Linux system</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Single external <acronym>IP</acronym> address</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Connection through Cable Modem, <acronym>DSL</acronym>,
|
|
<acronym>ISDN</acronym>, Frame Relay, dial-up... or connected to a
|
|
<acronym>LAN</acronym> and you simply wish to protect your Linux
|
|
system from other systems on that <acronym>LAN</acronym>.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<section id="System">
|
|
<title>System Requirements</title>
|
|
|
|
<para>Shorewall requires that you have the
|
|
<command>iproute</command>/<command>iproute2</command> package installed
|
|
(on<trademark> RedHat</trademark>, the package is called
|
|
<command>iproute</command>). You can tell if this package is installed
|
|
by the presence of an <command>ip</command> program on your firewall
|
|
system. As root, you can use the <command>which</command> command to
|
|
check for this program:</para>
|
|
|
|
<programlisting>[root@gateway root]# <command>which ip</command>
|
|
/sbin/ip
|
|
[root@gateway root]#</programlisting>
|
|
</section>
|
|
|
|
<section id="Before">
|
|
<title>Before you start</title>
|
|
|
|
<para>I recommend that you read through the guide first to familiarize
|
|
yourself with what's involved then go back through it again making your
|
|
configuration changes.</para>
|
|
|
|
<caution>
|
|
<para>If you edit your configuration files on a
|
|
<trademark>Windows</trademark> system, you must save them as
|
|
<trademark>Unix</trademark> files if your editor supports that option
|
|
or you must run them through <command>dos2unix</command> before trying
|
|
to use them. Similarly, if you copy a configuration file from your
|
|
<trademark>Windows</trademark> hard drive to a floppy disk, you must
|
|
run <command>dos2unix</command> against the copy before using it with
|
|
Shorewall. <itemizedlist>
|
|
<listitem>
|
|
<para><ulink
|
|
url="http://www.simtel.net/pub/pd/51438.html"><trademark>Windows</trademark>
|
|
Version of <command>dos2unix</command></ulink></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><ulink
|
|
url="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
|
Version of <command>dos2unix</command></ulink></para>
|
|
</listitem>
|
|
</itemizedlist></para>
|
|
</caution>
|
|
</section>
|
|
|
|
<section id="Conventions">
|
|
<title>Conventions</title>
|
|
|
|
<para>Points at which configuration changes are recommended are flagged
|
|
with <inlinegraphic fileref="images/BD21298_.gif"
|
|
format="GIF" />.</para>
|
|
</section>
|
|
</section>
|
|
|
|
<section id="PPTP">
|
|
<title>PPTP/ADSL</title>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>If you have an <acronym>ADSL</acronym> Modem and you use
|
|
<acronym>PPTP</acronym> to communicate with a server in that modem, you
|
|
must make the changes recommended <ulink
|
|
url="PPTP.htm#PPTP_ADSL">here</ulink> in addition to those detailed below.
|
|
<acronym>ADSL</acronym> with <acronym>PPTP</acronym> is most commonly
|
|
found in Europe, notably in Austria.</para>
|
|
</section>
|
|
|
|
<section id="Concepts">
|
|
<title>Shorewall Concepts</title>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>The configuration files for Shorewall are contained in the directory
|
|
<filename class="directory">/etc/shorewall</filename> -- for simple
|
|
setups, you only need to deal with a few of these as described in this
|
|
guide. After you have <ulink url="Install.htm">installed
|
|
Shorewall</ulink>, you can find the Samples as follows:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>If you installed using an <acronym>RPM</acronym>, the samples
|
|
will be in the <filename
|
|
class="directory">Samples/one-interface</filename> subdirectory of the
|
|
Shorewall documentation directory. If you don't know where the
|
|
Shorewall documentation directory is, you can find the samples using
|
|
this command:</para>
|
|
|
|
<programlisting>~# rpm -ql shorewall-common | fgrep one-interface
|
|
/usr/share/doc/packages/shorewall/Samples/one-interface
|
|
/usr/share/doc/packages/shorewall/Samples/one-interface/interfaces
|
|
/usr/share/doc/packages/shorewall/Samples/one-interface/policy
|
|
/usr/share/doc/packages/shorewall/Samples/one-interface/rules
|
|
/usr/share/doc/packages/shorewall/Samples/one-interface/zones
|
|
~#</programlisting>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you installed using the tarball, the samples are in the
|
|
<filename class="directory">Samples/one-interface</filename> directory
|
|
in the tarball.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you installed using a Shorewall 3.x .deb, the samples are in
|
|
<filename
|
|
class="directory">/usr/share/doc/shorewall/examples/one-interface</filename>.
|
|
You must install the shorewall-doc package.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you installed using a Shorewall 4.x .deb, the samples are in
|
|
<filename
|
|
class="directory">/usr/share/doc/shorewall-common/examples/one-interface</filename>..
|
|
You do not need the shorewall-doc package to have access to the
|
|
samples.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<warning>
|
|
<para><emphasis role="bold">Note to Debian Users</emphasis></para>
|
|
|
|
<para>If you install using the .deb, you will find that your <filename
|
|
class="directory">/etc/shorewall</filename> directory is empty. This is
|
|
intentional. The released configuration file skeletons may be found on
|
|
your system in the directory <filename
|
|
class="directory">/usr/share/doc/shorewall-common/default-config</filename>.
|
|
Simply copy the files you need from that directory to <filename
|
|
class="directory">/etc/shorewall</filename> and modify the
|
|
copies.</para>
|
|
</warning>
|
|
|
|
<para>If you are installing Shorewall version 3.4.0 or later then as each
|
|
file is introduced, I suggest that you look at the actual file on your
|
|
system and that you look at the <ulink
|
|
url="configuration_file_basics.htm#Manpages">man page</ulink> for that
|
|
file. For example, to look at the man page for the
|
|
<filename>/etc/shorewall/zones</filename> file, type <command>man
|
|
shorewall-zones</command> at a shell prompt.</para>
|
|
|
|
<para>If you are installing a Shorewall version earlier than 3.4.0, then
|
|
as each file is introduced, I suggest that you look through the actual
|
|
file on your system -- each file contains detailed configuration
|
|
instructions and default entries.</para>
|
|
|
|
<para>Shorewall views the network where it is running as being composed of
|
|
a set of <emphasis>zones</emphasis>. In the one-interface sample
|
|
configuration, only two zones are defined:</para>
|
|
|
|
<programlisting>#ZONE TYPE OPTIONS IN OUT
|
|
# OPTIONS OPTIONS
|
|
fw firewall
|
|
net ipv4</programlisting>
|
|
|
|
<para>Shorewall zones are defined in <ulink
|
|
url="manpages/shorewall-zones.html"><filename>/etc/shorewall/zones</filename></ulink>.</para>
|
|
|
|
<para>Note that Shorewall recognizes the firewall system as its own zone.
|
|
When the <filename>/etc/shorewall/zones</filename> file is processed, the
|
|
name of the firewall zone (<quote>fw</quote> in the above example) is
|
|
stored in the shell variable <firstterm>$FW</firstterm> which may be used
|
|
to refer to the firewall zone throughout the Shorewall
|
|
configuration.</para>
|
|
|
|
<para>Rules about what traffic to allow and what traffic to deny are
|
|
expressed in terms of zones.</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>You express your default policy for connections from one zone to
|
|
another zone in the <ulink
|
|
url="manpages/shorewall-policy.html"><filename>/etc/shorewall/policy</filename></ulink>
|
|
file.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>You define exceptions to those default policies in the <ulink
|
|
url="manpages/shorewall-rules.html"><filename>/etc/shorewall/rules</filename></ulink>
|
|
file.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>For each connection request entering the firewall, the request is
|
|
first checked against the
|
|
<filename><filename>/etc/shorewall/rules</filename></filename> file. If no
|
|
rule in that file matches the connection request then the first policy in
|
|
<filename>/etc/shorewall/policy</filename> that matches the request is
|
|
applied. If there is a <ulink url="shorewall_extension_scripts.htm">common
|
|
action</ulink> defined for the policy in
|
|
<filename>/etc/shorewall/actions</filename> or
|
|
<filename>/usr/share/shorewall/actions.std</filename> then that action is
|
|
performed before the policy is applied. The purpose of the common action is
|
|
two-fold:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>It silently drops or rejects harmless common traffic that would
|
|
otherwise clutter up your log — Broadcasts for example.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If ensures that traffic critical to correct operation is allowed
|
|
through the firewall — ICMP <emphasis>fragmentation-needed</emphasis>
|
|
for example.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>The <filename>/etc/shorewall/policy</filename> file included with
|
|
the one-interface sample has the following policies:</para>
|
|
|
|
<programlisting>#SOURCE ZONE DESTINATION ZONE POLICY LOG LEVEL LIMIT:BURST
|
|
$FW net ACCEPT
|
|
net all DROP info
|
|
all all REJECT info</programlisting>
|
|
|
|
<para>The above policy will:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>allow all connection requests from the firewall to the
|
|
Internet</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>drop (ignore) all connection requests from the Internet to your
|
|
firewall</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>reject all other connection requests (Shorewall requires this
|
|
catchall policy).</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para>The word <firstterm>info</firstterm> in the LOG LEVEL column for the
|
|
last two policies indicates that packets dropped or rejected under those
|
|
policies should be <ulink url="shorewall_logging.html">logged at that
|
|
level</ulink>.</para>
|
|
|
|
<para>At this point, edit your <filename>/etc/shorewall/policy</filename>
|
|
and make any changes that you wish.</para>
|
|
</section>
|
|
|
|
<section id="External">
|
|
<title>External Interface</title>
|
|
|
|
<para>The firewall has a single network interface. Where Internet
|
|
connectivity is through a cable or <acronym>DSL</acronym>
|
|
<quote>Modem</quote>, the <emphasis>External Interface</emphasis> will be
|
|
the Ethernet adapter (<filename class="devicefile">eth0</filename>) that
|
|
is connected to that <quote>Modem</quote> <emphasis
|
|
role="underline">unless</emphasis> you connect via
|
|
<emphasis>Point-to-Point Protocol over Ethernet</emphasis>
|
|
(<acronym>PPPoE</acronym>) or <emphasis>Point-to-Point Tunneling
|
|
Protocol</emphasis> (<acronym>PPTP</acronym>) in which case the External
|
|
Interface will be a <acronym>PPP</acronym> interface (e.g., <filename
|
|
class="devicefile">ppp0</filename>). If you connect via a regular modem,
|
|
your External Interface will also be <filename
|
|
class="devicefile">ppp0</filename>. If you connect using
|
|
<acronym>ISDN</acronym>, your external interface will be <filename
|
|
class="devicefile">ippp0</filename>.</para>
|
|
|
|
<caution>
|
|
<para>Be sure you know which interface is your external interface. Many
|
|
hours have been spent floundering by users who have configured the wrong
|
|
interface. If you are unsure, then as root type <command>ip route
|
|
ls</command> at the command line. The device listed in the last
|
|
(default) route should be your external interface.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<programlisting>root@lists:~# ip route ls
|
|
192.168.2.2 dev tun0 proto kernel scope link src 192.168.2.1
|
|
10.13.10.0/24 dev tun1 scope link
|
|
192.168.2.0/24 via 192.168.2.2 dev tun0
|
|
206.124.146.0/24 dev eth0 proto kernel scope link src 206.124.146.176
|
|
10.10.10.0/24 dev tun1 scope link
|
|
default via 206.124.146.254 dev <emphasis role="bold">eth0</emphasis>
|
|
root@lists:~# </programlisting>
|
|
|
|
<para>In that example, <filename class="devicefile">eth0</filename> is
|
|
the external interface.</para>
|
|
</caution>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>The Shorewall one-interface sample configuration assumes that the
|
|
external interface is <filename class="devicefile">eth0</filename>. If
|
|
your configuration is different, you will have to modify the sample
|
|
<filename>/etc/shorewall/interfaces</filename> file accordingly. While you
|
|
are there, you may wish to review the list of options that are specified
|
|
for the interface. Some hints:</para>
|
|
|
|
<tip>
|
|
<para>If your external interface is <filename
|
|
class="devicefile">ppp0</filename> or <filename
|
|
class="devicefile">ippp0</filename>, you can replace the
|
|
<quote>detect</quote> in the second column with <quote>-</quote> (minus
|
|
the quotes).</para>
|
|
</tip>
|
|
|
|
<tip>
|
|
<para>If your external interface is <filename
|
|
class="devicefile">ppp0</filename> or <filename
|
|
class="devicefile">ippp0</filename> or if you have a static IP address,
|
|
you can remove <quote>dhcp</quote> from the option list.</para>
|
|
</tip>
|
|
</section>
|
|
|
|
<section id="Addresses">
|
|
<title>IP Addresses</title>
|
|
|
|
<para>Before going further, we should say a few words about
|
|
<emphasis>Internet Protocol</emphasis> (<acronym>IP</acronym>) addresses.
|
|
Normally, your <emphasis>Internet Service Provider</emphasis>
|
|
(<acronym>ISP</acronym>) will assign you a single <acronym>IP</acronym>
|
|
address. That address can be assigned statically, by the <emphasis>Dynamic
|
|
Host Configuration Protocol</emphasis> (<acronym>DHCP</acronym>), through
|
|
the establishment of your dial-up connection, or during establishment of
|
|
your other type of <acronym>PPP</acronym> (<acronym>PPPoA</acronym>,
|
|
<acronym>PPPoE</acronym>, etc.) connection.</para>
|
|
|
|
<para><emphasis role="bold">RFC-1918</emphasis> reserves several
|
|
<emphasis>Private</emphasis> <acronym>IP</acronym> address ranges for use
|
|
in private networks:</para>
|
|
|
|
<programlisting>10.0.0.0 - 10.255.255.255
|
|
172.16.0.0 - 172.31.255.255
|
|
192.168.0.0 - 192.168.255.255</programlisting>
|
|
|
|
<para>These addresses are sometimes referred to as
|
|
<emphasis>non-routable</emphasis> because the Internet backbone routers
|
|
will not forward a packet whose destination address is reserved by
|
|
<emphasis role="bold">RFC-1918</emphasis>. In some cases though,
|
|
<acronym>ISP</acronym>s are assigning these addresses then using
|
|
<emphasis>Network Address Translation</emphasis> <emphasis>-
|
|
</emphasis><acronym>NAT</acronym>) to rewrite packet headers when
|
|
forwarding to/from the Internet.</para>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>Before starting Shorewall, <emphasis role="bold">you should look at
|
|
the IP address of your external interface and if it is in one of the above
|
|
ranges, you should remove the <quote>norfc1918</quote> option from the
|
|
entry in <filename>/etc/shorewall/interfaces</filename>.</emphasis><tip>
|
|
<para>To determine the IP address of your external interface, as root
|
|
type <command>ip addr ls dev <interface></command> at the
|
|
command line where <<emphasis>interface</emphasis>> is your
|
|
external interface. The line beginning with <emphasis>inet</emphasis>
|
|
identifies your IP address.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<programlisting>root@lists:~# ip addr ls dev eth0
|
|
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc htb qlen 1000
|
|
link/ether 00:02:e3:08:48:4c brd ff:ff:ff:ff:ff:ff
|
|
inet <emphasis role="bold">206.124.146.176</emphasis>/24 brd 206.124.146.255 scope global eth0
|
|
inet6 fe80::202:e3ff:fe08:484c/64 scope link
|
|
valid_lft forever preferred_lft forever
|
|
root@lists:~# </programlisting>
|
|
|
|
<para>In this example, the IP address of the external interface is
|
|
206.124.146.176</para>
|
|
</tip></para>
|
|
</section>
|
|
|
|
<section id="Logging">
|
|
<title>Logging</title>
|
|
|
|
<para>Shorewall does not maintain a log itself but rather relies on your
|
|
<ulink url="shorewall_logging.html">system's logging
|
|
configuration</ulink>. The following <ulink
|
|
url="manpages/shorewall.html">commands</ulink> rely on knowing where
|
|
Netfilter messages are logged:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><command>shorewall show log</command> (Displays the last 20
|
|
Netfilter log messages)</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>shorewall logwatch</command> (Polls the log at a
|
|
settable interval</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>shorewall dump</command> (Produces an extensive report
|
|
for inclusion in Shorewall problem reports)</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>It is important that these commands work properly because when you
|
|
encounter connection problems when Shorewall is running, the first thing
|
|
that you should do is to look at the Netfilter log; with the help of
|
|
<ulink url="FAQ.htm#faq17">Shorewall FAQ 17</ulink>, you can usually
|
|
resolve the problem quickly.</para>
|
|
|
|
<para>Most commonly, Netfilter messages are logged to
|
|
<filename>/var/log/messages</filename>. Recent
|
|
<trademark>SuSE/OpenSuSE</trademark> releases come preconfigured with
|
|
syslog-ng and log Netfilter messages to
|
|
<filename>/var/log/firewall</filename>.</para>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>If you are running a distribution that logs Netfilter messages to a
|
|
log other than <filename>/var/log/messages</filename>, then modify the
|
|
LOGFILE setting in <filename>/etc/shorewall/shorewall.conf</filename> to
|
|
specify the name of your log.</para>
|
|
|
|
<important>
|
|
<para>The LOGFILE setting does not control where the Netfilter log is
|
|
maintained -- it simply tells the /sbin/<filename>shorewall</filename>
|
|
utility where to find the log.</para>
|
|
</important>
|
|
</section>
|
|
|
|
<section id="Open">
|
|
<title>Enabling other Connections</title>
|
|
|
|
<para>Shorewall includes a collection of macros that can be used to
|
|
quickly allow or deny services. You can find a list of the macros included
|
|
in your version of Shorewall using the command <command>ls
|
|
<filename>/usr/share/shorewall/macro.*</filename></command>.</para>
|
|
|
|
<para>If you wish to enable connections from the Internet to your firewall
|
|
and you find an appropriate macro in
|
|
<filename>/etc/shorewall/macro.*</filename>, the general format of a rule
|
|
in <filename>/etc/shorewall/rules</filename> is:</para>
|
|
|
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
|
<<emphasis>macro</emphasis>>/ACCEPT net $FW</programlisting>
|
|
|
|
<important>
|
|
<para>Be sure to add your rules after the line that reads <emphasis
|
|
role="bold">SECTION NEW.</emphasis></para>
|
|
</important>
|
|
|
|
<example id="Example1">
|
|
<title>You want to run a Web Server and a IMAP Server on your firewall
|
|
system:</title>
|
|
|
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
|
Web/ACCEPT net $FW
|
|
IMAP/ACCEPT net $FW</programlisting>
|
|
</example>
|
|
|
|
<para>You may also choose to code your rules directly without using the
|
|
pre-defined macros. This will be necessary in the event that there is not
|
|
a pre-defined macro that meets your requirements. In that case the general
|
|
format of a rule in <filename>/etc/shorewall/rules</filename> is:</para>
|
|
|
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
|
ACCEPT net $FW <emphasis><protocol></emphasis> <emphasis><port></emphasis></programlisting>
|
|
|
|
<example id="Example2">
|
|
<title>You want to run a Web Server and a IMAP Server on your firewall
|
|
system:</title>
|
|
|
|
<para><programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
|
ACCEPT net $FW tcp 80
|
|
ACCEPT net $FW tcp 143</programlisting></para>
|
|
</example>
|
|
|
|
<para>If you don't know what port and protocol a particular application
|
|
uses, see <ulink url="ports.htm">here</ulink>.</para>
|
|
|
|
<important>
|
|
<para>I don't recommend enabling telnet to/from the Internet because it
|
|
uses clear text (even for login!). If you want shell access to your
|
|
firewall from the Internet, use <acronym>SSH</acronym>:</para>
|
|
|
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
|
SSH/ACCEPT net $FW </programlisting>
|
|
</important>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>At this point, edit <filename>/etc/shorewall/rules</filename> to add
|
|
other connections as desired.</para>
|
|
</section>
|
|
|
|
<section id="Starting">
|
|
<title>Starting and Stopping Your Firewall</title>
|
|
|
|
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
|
|
|
<para>The <ulink url="Install.htm">installation procedure</ulink>
|
|
configures your system to start Shorewall at system boot but startup is
|
|
disabled so that your system won't try to start Shorewall before
|
|
configuration is complete. Once you have completed configuration of your
|
|
firewall, you must edit /etc/shorewall/shorewall.conf and set
|
|
STARTUP_ENABLED=Yes.</para>
|
|
|
|
<important>
|
|
<para>Users of the .deb package must edit
|
|
<filename>/etc/default/shorewall</filename> and set
|
|
<varname>STARTUP=1.</varname></para>
|
|
</important>
|
|
|
|
<important>
|
|
<para>You must enable startup by editing
|
|
<filename>/etc/shorewall/shorewall.conf</filename> and setting
|
|
<varname>STARTUP_ENABLED=Yes.</varname></para>
|
|
</important>
|
|
|
|
<para>The firewall is started using the <quote><command>shorewall
|
|
start</command></quote> command and stopped using
|
|
<quote><command>shorewall stop</command></quote>. When the firewall is
|
|
stopped, routing is enabled on those hosts that have an entry in
|
|
<filename><ulink
|
|
url="manpages/shorewall-routestopped.html">/etc/shorewall/routestopped</ulink></filename>.
|
|
A running firewall may be restarted using the <quote><command>shorewall
|
|
restart</command></quote> command. If you want to totally remove any trace
|
|
of Shorewall from your Netfilter configuration, use
|
|
<quote><command>shorewall clear</command></quote>.</para>
|
|
|
|
<warning>
|
|
<para>If you are connected to your firewall from the Internet, do not
|
|
issue a <quote><command>shorewall stop</command></quote> command unless
|
|
you have added an entry for the IP address that you are connected from
|
|
to <ulink
|
|
url="manpages/shorewall-routestopped.html"><filename>/etc/shorewall/routestopped</filename></ulink>.
|
|
Also, I don't recommend using <quote><command>shorewall
|
|
restart</command></quote>; it is better to create an <emphasis><ulink
|
|
url="configuration_file_basics.htm#Configs">alternate
|
|
configuration</ulink></emphasis> and test it using the <ulink
|
|
url="starting_and_stopping_shorewall.htm"><quote><command>shorewall
|
|
try</command></quote></ulink> command.</para>
|
|
</warning>
|
|
</section>
|
|
|
|
<section id="Problems">
|
|
<title>If it Doesn't Work</title>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Re-check each of the items flagged with a red arrow
|
|
above.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Check your <ulink
|
|
url="shorewall_logging.html">log</ulink>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Check the <ulink url="troubleshoot.htm">Troubleshooting
|
|
Guide</ulink>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Check the <ulink url="FAQ.htm">FAQ</ulink>.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section id="Other">
|
|
<title>Additional Recommended Reading</title>
|
|
|
|
<para>I highly recommend that you review the <ulink
|
|
url="configuration_file_basics.htm">Common Configuration File Features
|
|
page</ulink> -- it contains helpful tips about Shorewall features than
|
|
make administering your firewall easier.</para>
|
|
</section>
|
|
</article>
|