mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-21 05:41:07 +01:00
254 lines
10 KiB
XML
254 lines
10 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall6-tunnels</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>tunnels</refname>
|
|
|
|
<refpurpose>Shorewall6 VPN definition file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall6/tunnels</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>The tunnels file is used to define rules for encapsulated (usually
|
|
encrypted) traffic to pass between the Shorewall6 system and a remote
|
|
gateway. Traffic flowing through the tunnel is handled using the normal
|
|
zone/policy/rule mechanism. See <ulink
|
|
url="http://www.shorewall.net/VPNBasics.html">http://www.shorewall.net/VPNBasics.html</ulink>
|
|
for details.</para>
|
|
|
|
<para>The columns in the file are as follows (where the column name is
|
|
followed by a different name in parentheses, the different name is used in
|
|
the alternate specification syntax).</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">TYPE</emphasis> - {<emphasis
|
|
role="bold">ipsec</emphasis>[<emphasis
|
|
role="bold">:{noah</emphasis>|ah}]|<emphasis
|
|
role="bold">ipsecnat</emphasis>|<emphasis
|
|
role="bold">gre</emphasis>|l2tp|<emphasis
|
|
role="bold">pptpclient</emphasis>|<emphasis
|
|
role="bold">pptpserver</emphasis>|{<emphasis
|
|
role="bold">openvpn</emphasis>|<emphasis
|
|
role="bold">openvpnclient</emphasis>|<emphasis
|
|
role="bold">openvpnserver</emphasis>}[:{<emphasis
|
|
role="bold">tcp</emphasis>|<emphasis
|
|
role="bold">udp</emphasis>}]<emphasis
|
|
role="bold">[</emphasis>:<emphasis>port</emphasis>]|<emphasis
|
|
role="bold">generic</emphasis><emphasis
|
|
role="bold">:</emphasis><emphasis>protocol</emphasis>[<emphasis
|
|
role="bold">:</emphasis><emphasis>port</emphasis>]}</term>
|
|
|
|
<listitem>
|
|
<para>Types are as follows:</para>
|
|
|
|
<programlisting> <emphasis role="bold">ipsec</emphasis> - IPv6 IPSEC
|
|
<emphasis role="bold">ipsecnat</emphasis> - IPv6 IPSEC with NAT Traversal (UDP port 4500 encapsulation)
|
|
<emphasis role="bold">gre</emphasis> - Generalized Routing Encapsulation (Protocol 47)
|
|
<emphasis role="bold">l2tp</emphasis> - Layer 2 Tunneling Protocol (UDP port 1701)
|
|
<emphasis role="bold">openvpn</emphasis> - OpenVPN in point-to-point mode
|
|
<emphasis role="bold">openvpnclient</emphasis> - OpenVPN client runs on the firewall
|
|
<emphasis role="bold">openvpnserver</emphasis> - OpenVPN server runs on the firewall
|
|
<emphasis role="bold">generic</emphasis> - Other tunnel type</programlisting>
|
|
|
|
<para>If the type is <emphasis role="bold">ipsec</emphasis>, it may
|
|
be followed by <emphasis role="bold">:ah</emphasis> to indicate that
|
|
the Authentication Headers protocol (51) is used by the tunnel (the
|
|
default is <option>:noah</option> which means that protocol 51 is
|
|
not used). NAT traversal is only supported with ESP (protocol 50) so
|
|
<emphasis role="bold">ipsecnat</emphasis> tunnels don't allow the
|
|
<emphasis role="bold">ah</emphasis> option (<emphasis
|
|
role="bold">ipsecnat:noah</emphasis> may be specified but is
|
|
redundant).</para>
|
|
|
|
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
|
|
role="bold">openvpnclient</emphasis> or <emphasis
|
|
role="bold">openvpnserver</emphasis> it may optionally be followed
|
|
by ":" and <emphasis role="bold">tcp</emphasis> or <emphasis
|
|
role="bold">udp</emphasis> to specify the protocol to be used. If
|
|
not specified, <emphasis role="bold">udp</emphasis> is assumed.
|
|
Note: At this writing, OpenVPN does not support IPv6.</para>
|
|
|
|
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
|
|
role="bold">openvpnclient</emphasis> or <emphasis
|
|
role="bold">openvpnserver</emphasis> it may optionally be followed
|
|
by ":" and the port number used by the tunnel. if no ":" and port
|
|
number are included, then the default port of 1194 will be used. .
|
|
Where both the protocol and port are specified, the protocol must be
|
|
given first (e.g., openvpn:tcp:4444).</para>
|
|
|
|
<para>If type is <emphasis role="bold">generic</emphasis>, it must
|
|
be followed by ":" and a protocol name (from /etc/protocols) or a
|
|
protocol number. If the protocol is <emphasis
|
|
role="bold">tcp</emphasis> or <emphasis role="bold">udp</emphasis>
|
|
(6 or 17), then it may optionally be followed by ":" and a port
|
|
number.</para>
|
|
|
|
<para>Comments may be attached to Netfilter rules generated from
|
|
entries in this file through the use of COMMENT lines. These lines
|
|
begin with the word COMMENT; the remainder of the line is treated as
|
|
a comment which is attached to subsequent rules until another
|
|
COMMENT line is found or until the end of the file is reached. To
|
|
stop adding comments to rules, use a line with only the word
|
|
COMMENT.</para>
|
|
|
|
<note>
|
|
<para>Beginning with Shorewall 4.5.11, ?COMMENT is a synonym for
|
|
COMMENT and is preferred.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ZONE</emphasis> -
|
|
<emphasis>zone</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The <emphasis>zone</emphasis> of the physical interface
|
|
through which tunnel traffic passes. This is normally your internet
|
|
zone.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">GATEWAY</emphasis>(S) (gateway or
|
|
gateways) - <emphasis>address-or-range</emphasis> <emphasis
|
|
role="bold">[ , ... ]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The IP address of the remote tunnel gateway. If the remote
|
|
gateway has no fixed address (Road Warrior) then specify the gateway
|
|
as <emphasis role="bold">::/0</emphasis>. May be specified as a
|
|
network address and if your kernel and ip6tables include iprange
|
|
match support then IP address ranges are also allowed.</para>
|
|
|
|
<para>Beginning with Shorewall 4.5.3, a list of addresses or ranges
|
|
may be given. Exclusion (<ulink
|
|
url="shorewall6-exclusion.html">shorewall6-exclusion</ulink> (5) )
|
|
is not supported.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">GATEWAY ZONE(S)</emphasis> (gateway_zone
|
|
or gateway_zones) - [<emphasis>zone</emphasis>[<emphasis
|
|
role="bold">,</emphasis><emphasis>zone</emphasis>]...]</term>
|
|
|
|
<listitem>
|
|
<para>Optional. If the gateway system specified in the third column
|
|
is a standalone host then this column should contain a
|
|
comma-separated list of the names of the zones that the host might
|
|
be in. This column only applies to IPSEC tunnels where it enables
|
|
ISAKMP traffic to flow through the tunnel to the remote
|
|
gateway(s).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Example</title>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>Example 1:</term>
|
|
|
|
<listitem>
|
|
<para>IPSec tunnel.</para>
|
|
|
|
<para>The remote gateway is 2001:cec792b4:1::44. The tunnel does not
|
|
use the AH protocol</para>
|
|
|
|
<programlisting> #TYPE ZONE GATEWAY
|
|
ipsec:noah net 2002:cec792b4:1::44</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 2:</term>
|
|
|
|
<listitem>
|
|
<para>Road Warrior (LapTop that may connect from anywhere) where the
|
|
"gw" zone is used to represent the remote LapTop</para>
|
|
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
|
ipsec net ::/0 gw</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 3:</term>
|
|
|
|
<listitem>
|
|
<para>Host 2001:cec792b4:1::44 is a standalone system connected via
|
|
an ipsec tunnel to the firewall system. The host is in zone
|
|
gw.</para>
|
|
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
|
ipsec net 2001:cec792b4:1::44 gw</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 4:</term>
|
|
|
|
<listitem>
|
|
<para>OPENVPN tunnel. The remote gateway is 2001:cec792b4:1::44 and
|
|
openvpn uses port 7777.</para>
|
|
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
|
openvpn:7777 net 2001:cec792b4:1::44</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 8:</term>
|
|
|
|
<listitem>
|
|
<para>You have a tunnel that is not one of the supported types. Your
|
|
tunnel uses UDP port 4444. The other end of the tunnel is
|
|
2001:cec792b4:1::44.</para>
|
|
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
|
generic:udp:4444 net 2001:cec792b4:1::44</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall6/tunnels</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para><ulink
|
|
url="http://shorewall.net/configuration_file_basics.htm#Pairs">http://shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
|
|
|
|
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
|
|
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
|
|
shorewall6-maclist(5), shoewall6-netmap(5),shorewall6-params(5),
|
|
shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5),
|
|
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
|
|
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
|
|
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-zones(5)</para>
|
|
</refsect1>
|
|
</refentry>
|