mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-28 09:08:48 +01:00
417 lines
17 KiB
XML
417 lines
17 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall6-policy</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
|
|
<refmiscinfo>Configuration Files</refmiscinfo>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>policy</refname>
|
|
|
|
<refpurpose>shorewall6 policy file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall6/policy</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>This file defines the high-level policy for connections between
|
|
zones defined in <ulink
|
|
url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5).</para>
|
|
|
|
<important>
|
|
<para>The order of entries in this file is important</para>
|
|
|
|
<para>This file determines what to do with a new connection request if
|
|
we don't get a match from the /etc/shorewall6/rules file . For each
|
|
source/destination pair, the file is processed in order until a match is
|
|
found ("all" will match any source or destination).</para>
|
|
</important>
|
|
|
|
<important>
|
|
<para>Intra-zone policies are pre-defined</para>
|
|
|
|
<para>For $FW and for all of the zones defined in /etc/shorewall6/zones,
|
|
the POLICY for connections from the zone to itself is ACCEPT (with no
|
|
logging or TCP connection rate limiting but may be overridden by an
|
|
entry in this file. The overriding entry must be explicit (specifying
|
|
the zone name on both SOURCE and DEST) or it must use "all+ or it must
|
|
use "all+" (Shorewall 4.5.17 or later).</para>
|
|
|
|
<para>Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall6.conf,
|
|
then the implicit policy to/from any sub-zone is CONTINUE. These
|
|
implicit CONTINUE policies may also be overridden by an explicit entry
|
|
in this file.</para>
|
|
</important>
|
|
|
|
<para>The columns in the file are as follows (where the column name is
|
|
followed by a different name in parentheses, the different name is used in
|
|
the alternate specification syntax).</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">SOURCE</emphasis> -
|
|
<emphasis>zone</emphasis>[,...[+]]|<emphasis
|
|
role="bold">$FW</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis
|
|
role="bold">all+</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Source zone. Must be the name of a zone defined in <ulink
|
|
url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5),
|
|
$FW, "all" or "all+".</para>
|
|
|
|
<para>Support for "all+" was added in Shorewall 4.5.17. "all" does
|
|
not override the implicit intra-zone ACCEPT policy while "all+"
|
|
does.</para>
|
|
|
|
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed
|
|
separated by commas. As above, if '+' is specified after two or more
|
|
zone names, then the policy overrides the implicit intra-zone ACCEPT
|
|
policy if the same <replaceable>zone</replaceable> appears in both
|
|
the SOURCE and DEST columns.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DEST</emphasis> -
|
|
<emphasis>zone</emphasis>[,...[+]]|<emphasis
|
|
role="bold">$FW</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis
|
|
role="bold">all+</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Destination zone. Must be the name of a zone defined in <ulink
|
|
url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5),
|
|
$FW, "all" or "all+". If the DEST is a bport zone, then the SOURCE
|
|
must be "all", "all+", another bport zone associated with the same
|
|
bridge, or it must be an ipv4 zone that is associated with only the
|
|
same bridge.</para>
|
|
|
|
<para>Support for "all+" was added in Shorewall 4.5.17. "all" does
|
|
not override the implicit intra-zone ACCEPT policy while "all+"
|
|
does.</para>
|
|
|
|
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed
|
|
separated by commas. As above, if '+' is specified after two or more
|
|
zone names, then the policy overrides the implicit intra-zone ACCEPT
|
|
policy if the same <replaceable>zone</replaceable> appears in both
|
|
the SOURCE and DEST columns.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">POLICY</emphasis> - {<emphasis
|
|
role="bold">ACCEPT</emphasis>|<emphasis
|
|
role="bold">DROP</emphasis>|<emphasis
|
|
role="bold">REJECT</emphasis>|BLACKLIST|<emphasis
|
|
role="bold">CONTINUE</emphasis>|<emphasis
|
|
role="bold">QUEUE</emphasis>|<emphasis
|
|
role="bold">NFQUEUE</emphasis>[(<emphasis>queuenumber1</emphasis>[:<replaceable>queuenumber2</replaceable>])]|<emphasis
|
|
role="bold">NONE</emphasis>}[<emphasis
|
|
role="bold">:</emphasis>{[+]<emphasis>policy-action</emphasis>[:level][,...]|<emphasis
|
|
role="bold">None</emphasis>}]</term>
|
|
|
|
<listitem>
|
|
<para>Policy if no match from the rules file is found.</para>
|
|
|
|
<para>If the policy is neither CONTINUE nor NONE then the policy may
|
|
be followed by ":" and one of the following:</para>
|
|
|
|
<orderedlist numeration="loweralpha">
|
|
<listitem>
|
|
<para>The word "None" or "none". This causes any default action
|
|
defined in <ulink
|
|
url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)
|
|
to be omitted for this policy.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The name of an action. The action will be invoked before
|
|
the policy is enforced.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para>Actions can have parameters specified.</para>
|
|
|
|
<para>Beginning with Shorewall 4.5.10, the action name can be
|
|
followed optionally by a colon and a log level. The level will be
|
|
applied to each rule in the action or body that does not already
|
|
have a log level.</para>
|
|
|
|
<para>Beginning with Shorewall 5.1.2, multiple
|
|
<replaceable>action</replaceable>[:<replaceable>level</replaceable>]
|
|
pairs may be specified, separated by commas. The actions are invoked
|
|
in the order listed. Also beginning with Shorewall 5.1.2, the
|
|
policy-action list can be prefixed with a plus sign ("+") indicating
|
|
that the listed actions are in addition to those listed in the
|
|
related _DEFAULT setting in <ulink
|
|
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
|
|
|
|
<para>Possible policies are:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ACCEPT</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Accept the connection.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DROP</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Ignore the connection request.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">REJECT</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>For TCP, send RST. For all other, send an "unreachable"
|
|
ICMP.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">BLACKLIST</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.1.1 and requires that the
|
|
DYNAMIC_BLACKLIST setting in <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall6.conf</ulink>(5)
|
|
specifies ipset-based dynamic blacklisting. The SOURCE IP
|
|
address is added to the blacklist ipset and the connection
|
|
request is ignored.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">QUEUE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Queue the request for a user-space application such as
|
|
Snort-inline.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">NFQUEUE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Queue the request for a user-space application using the
|
|
nfnetlink_queue mechanism. If a
|
|
<replaceable>queuenumber1</replaceable> is not given, queue
|
|
zero (0) is assumed. Beginning with Shorewall 4.6.10, a second
|
|
queue number (queuenumber2) may be given. This specifies a
|
|
range of queues to use. Packets are then balanced across the
|
|
given queues. This is useful for multicore systems: start
|
|
multiple instances of the userspace program on queues x, x+1,
|
|
.. x+n and use "x:x+n". Packets belonging to the same
|
|
connection are put into the same nfqueue.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">CONTINUE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Pass the connection request past any other rules that it
|
|
might also match (where the source or destination zone in
|
|
those rules is a superset of the SOURCE or DEST in this
|
|
policy). See <ulink
|
|
url="/manpages6/shorewall6-nesting.html">shorewall6-nesting</ulink>(5)
|
|
for additional information.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">NONE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Assume that there will never be any packets from this
|
|
SOURCE to this DEST. shorewall6 will not create any
|
|
infrastructure to handle such packets and you may not have any
|
|
rules with this SOURCE and DEST in the /etc/shorewall6/rules
|
|
file. If such a packet <emphasis role="bold">is</emphasis>
|
|
received, the result is undefined. NONE may not be used if the
|
|
SOURCE or DEST columns contain the firewall zone ($FW) or
|
|
"all".</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">LOGLEVEL</emphasis> (loglevel) -
|
|
[<emphasis>log-level</emphasis>|<emphasis
|
|
role="bold">NFLOG</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>Optional - if supplied, each connection handled under the
|
|
default POLICY is logged at that level. If not supplied, no log
|
|
message is generated. See syslog.conf(5) for a description of log
|
|
levels.</para>
|
|
|
|
<para>You may also specify NFLOG (must be in upper case). This will
|
|
log to the NFLOG target and will send to a separate log through use
|
|
of ulogd (<ulink
|
|
url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>).</para>
|
|
|
|
<para>For a description of log levels, see <ulink
|
|
url="/shorewall_logging.html.">http://www.shorewall.net/shorewall_logging.html.</ulink></para>
|
|
|
|
<para>If you don't want to log but need to specify the following
|
|
column, place "-" here.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">RATE</emphasis> (rate) -
|
|
[-|<replaceable>limit</replaceable>]</term>
|
|
|
|
<listitem>
|
|
<para>where limit is one of:</para>
|
|
|
|
<simplelist>
|
|
<member>[<emphasis
|
|
role="bold">-</emphasis>|[{<emphasis>s</emphasis>|<emphasis
|
|
role="bold">d</emphasis>}:[[<replaceable>name</replaceable>]:]]]<emphasis>rate</emphasis><emphasis
|
|
role="bold">/</emphasis>{<emphasis
|
|
role="bold">sec</emphasis>|<emphasis
|
|
role="bold">min</emphasis>|<emphasis
|
|
role="bold">hour</emphasis>|<emphasis
|
|
role="bold">day</emphasis>}[:<emphasis>burst</emphasis>]</member>
|
|
|
|
<member>[<replaceable>name</replaceable>1]:<emphasis>rate1</emphasis><emphasis
|
|
role="bold">/</emphasis>{<emphasis
|
|
role="bold">sec</emphasis>|<emphasis
|
|
role="bold">min</emphasis>|<emphasis
|
|
role="bold">hour</emphasis>|<emphasis
|
|
role="bold">day</emphasis>}[:<emphasis>burst1</emphasis>],[<replaceable>name</replaceable>2]:<emphasis>rate2</emphasis><emphasis
|
|
role="bold">/</emphasis>{<emphasis
|
|
role="bold">sec</emphasis>|<emphasis
|
|
role="bold">min</emphasis>|<emphasis
|
|
role="bold">hour</emphasis>|<emphasis
|
|
role="bold">day</emphasis>}[:<emphasis>burst2</emphasis>]</member>
|
|
</simplelist>
|
|
|
|
<para>If passed, specifies the maximum TCP connection
|
|
<emphasis>rate</emphasis> and the size of an acceptable
|
|
<emphasis>burst</emphasis>. If not specified, TCP connections are
|
|
not limited. If the <replaceable>burst</replaceable> parameter is
|
|
omitted, a value of 5 is assumed.</para>
|
|
|
|
<para>When <option>s:</option> or <option>d:</option> is specified,
|
|
the rate applies per source IP address or per destination IP address
|
|
respectively. The <replaceable>name</replaceable> may be chosen by
|
|
the user and specifies a hash table to be used to count matching
|
|
connections. If not give, the name <emphasis
|
|
role="bold">shorewall</emphasis> is assumed. Where more than one
|
|
POLICY or rule specifies the same name, the connections counts for
|
|
the policies are aggregated and the individual rates apply to the
|
|
aggregated count.</para>
|
|
|
|
<para>Beginning with Shorewall 4.6.5, two<replaceable>
|
|
limit</replaceable>s may be specified, separated by a comma. In this
|
|
case, the first limit (<replaceable>name1</replaceable>,
|
|
<replaceable>rate1</replaceable>, burst1) specifies the per-source
|
|
IP limit and the second limit specifies the per-destination IP
|
|
limit.</para>
|
|
|
|
<para>Example: <emphasis
|
|
role="bold">client:10/sec:20,:60/sec:100</emphasis></para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">CONNLIMIT</emphasis> -
|
|
<emphasis>limit</emphasis>[:<emphasis>mask</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>May be used to limit the number of simultaneous connections
|
|
from each individual host to <replaceable>limit</replaceable>
|
|
connections. While the limit is only checked on connections to which
|
|
this policy could apply, the number of current connections is
|
|
calculated over all current connections from the SOURCE host. By
|
|
default, the limit is applied to each host individually but can be
|
|
made to apply to networks of hosts by specifying a
|
|
<replaceable>mask</replaceable>. The <replaceable>mask</replaceable>
|
|
specifies the width of a VLSM mask to be applied to the source
|
|
address; the number of current connections is then taken over all
|
|
hosts in the subnet
|
|
<replaceable>source-address</replaceable>/<replaceable>mask</replaceable>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Example</title>
|
|
|
|
<orderedlist numeration="loweralpha">
|
|
<listitem>
|
|
<para>All connections from the local network to the internet are
|
|
allowed</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>All connections from the internet are ignored but logged at
|
|
syslog level KERNEL.INFO.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>All other connection requests are rejected and logged at level
|
|
KERNEL.INFO.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<programlisting> #SOURCE DEST POLICY LOG BURST:LIMIT
|
|
# LEVEL
|
|
loc net ACCEPT
|
|
net all DROP info
|
|
#
|
|
# THE FOLLOWING POLICY MUST BE LAST
|
|
#
|
|
all all REJECT info</programlisting>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall6/policy</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para><ulink
|
|
url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
|
|
|
|
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
|
|
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
|
|
shorewall6-ipsec(5), shorewall6-maclist(5), shorewall6-masq(5),
|
|
shorewall6-nat(5), shorewall6-netmap(5),
|
|
shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
|
|
shorewall6-providers(5), shorewall6-proxyarp(5), shorewall6-rtrules(5),
|
|
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
|
|
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
|
|
shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
|
|
shorewall6-zones(5)</para>
|
|
</refsect1>
|
|
</refentry>
|