shorewall_code/STABLE/documentation/myfiles.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
                            
  <meta http-equiv="Content-Type"
 content="text/html; charset=windows-1252">
  <title>My Shorewall Configuration</title>
                                                  
  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                            
  <meta name="ProgId" content="FrontPage.Editor.Document">
                            
  <meta name="Microsoft Theme" content="none">
</head>
  <body>
              
<table border="0" cellpadding="0" cellspacing="0"
 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 bgcolor="#400169" height="90">
                           <tbody>
                      <tr>
                             <td width="100%">                          
                       
      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
                             </td>
                           </tr>
                            
  </tbody>       
</table>
              
<blockquote> </blockquote>
              
<h1>My Current Network </h1>
              
<blockquote>                     
  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small> 
     use a combination of Static NAT and Proxy ARP, neither of which are relevant
     to a simple configuration with a single public IP address.</small></b></big><big><b><small> 
     If you have just a single public IP address, most of what you see here 
  won't   apply to your setup so beware of copying parts of this configuration 
  and  expecting them to work for you. What you copy may or may not work in
  your configuration.<br>
         </small></b></big></p>
                           
  <p><big><b><small><big><font color="#ff0000">Warning 2:</font></big> </small></b></big><b>My 
   configuration uses features introduced in Shorewall version 1.4.4b.</b><br>
             </p>
                            
  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180). 
         My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> Speedport) 
        is connected to eth0. I have a local network connected to eth2 (subnet 
     192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) and a Wireless 
 network connected to eth3 (192.168.3.0/24).</p>
                            
  <p> I use:<br>
                    </p>
                            
  <ul>
                      <li>Static NAT for Ursa (my XP System) - Internal address 
   192.168.1.5      and external address 206.124.146.178.</li>
                      <li>Static NAT for Wookie (my Linux System). Internal 
 address    192.168.1.3 and external address 206.124.146.179.</li>
       <li>Static NAT for EastepLaptop (My work system). Internal address 
192.168.1.7  and external address 206.124.146.180.<br>
       </li>
                      <li>SNAT through the primary gateway address (206.124.146.176) 
     for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
   through the Wireless Access Point (wap) via a Wireless Bridge (bridge).
       <b><br>
           <br>
     Note:</b> While the distance between the WAP and where I usually use 
the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus wireless 
card)   has proved very unsatisfactory (lots of lost connections). By replacing 
the  WAC11 with the WET11 wireless bridge, I have virtually eliminated these 
problems  (Being an old radio tinkerer (K7JPV), I was also able to eliminate 
the disconnects by hanging a piece of aluminum foil on the family room wall. 
Needless to say, my wife Tarry rejected that as a permanent solution :-).</li>
                            
  </ul>
                            
  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
                            
  <p> Wookie  and the Firewall both run Samba and the Firewall acts as the 
a WINS server.<br>
   </p>
   
  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
in the local zone.</p>
                            
  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional 
 to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit prefix), 
 I use <a href="MAC_Validation.html">MAC verification.</a> This is still a
 weak combination and if I lived near a wireless "hot spot", I would probably 
 add IPSEC or something similar to my WiFi-&gt;local connections.<br>
     </p>
                            
  <p> The single system in the DMZ (address 206.124.146.177) runs postfix, 
        Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an 
FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch our 
email    from our    old and current ISPs. That server is managed through 
Proxy ARP.</p>
                            
  <p> The firewall system itself runs a DHCP server that serves the local 
          network. It also runs Postfix which is configured as a Virus and
  Spam filter with all incoming mail then being forwarded to the MTA in the
  DMZ.</p>
                            
  <p> All administration and publishing is done using ssh/scp. I have X installed 
    on the firewall but no X server or desktop is installed.     X applications
tunnel through SSH to XWin.exe running on Ursa. The server does have a desktop
environment installed and that desktop environment is available via XDMCP
from the local zone. For the most part though, X tunneled through SSH is
used for server administration and the server runs at run level 3 (multi-user
console mode on RedHat).</p>
                            
  <p> I run an SNMP server on my firewall to serve <a
 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running 
        in the DMZ.</p>
                            
  <p align="center">                           <img border="0"
 src="images/network.png" width="764" height="846"
 alt="(My network layout)">
                    </p>
                            
  <p><EFBFBD></p>
                            
  <p>The ethernet interface in the Server is configured         with IP address
   206.124.146.177, netmask    255.255.255.0. The server's default gateway
 is      206.124.146.254 (Router at my ISP. This is the same           default
   gateway used by the firewall itself). On the firewall,               
                 Shorewall automatically adds a host route to           
                 206.124.146.177 through eth1 (192.168.2.1) because     of
                          the entry in /etc/shorewall/proxyarp (see  below).</p>
                                            
  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior 
      access.<br>
               </p>
                            
  <p><font color="#ff0000" size="5"></font></p>
             </blockquote>
              
<h3>Shorewall.conf</h3>
              
<blockquote>                     
  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>NAT_ENABLED=Yes<br>MANGLE_ENABLED=Yes<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>MULTIPORT=Yes<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
    </blockquote>
       
<h3>Params File (Edited):</h3>
              
<blockquote>                  
  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
      </blockquote>
              
<h3>Zones File</h3>
              
<blockquote>                     
  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font></pre>
         </blockquote>
              
<h3>Interfaces File: </h3>
              
<blockquote>                      
  <p> This is set up so that I can start the firewall before bringing up
my Ethernet  interfaces. </p>
                       </blockquote>
              
<blockquote>                     
  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font>                </pre>
         </blockquote>
              
<h3>Hosts File: </h3>
              
<blockquote>                     
  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
         </blockquote>
              
<h3>Routestopped File:</h3>
              
<blockquote>                     
  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2">	</font></pre>
         </blockquote>
              
<h3>Policy File:</h3>
              
<blockquote>                     
  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
         </blockquote>
              
<h3>Masq File: </h3>
              
<blockquote>                      
  <p> Although most of our internal systems use static NAT, my wife's system 
         (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors 
 with     laptops. Also, I masquerade systems connected through the wireless
 network.</p>
                    </blockquote>
              
<blockquote>                     
  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
   </blockquote>
     
<h3>NAT File: </h3>
     
<blockquote>                     
  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
         </blockquote>
                              
<h3>Proxy ARP File:</h3>
              
<blockquote>                     
  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
 face="Courier" size="2">     	</font></pre>
         </blockquote>
              
<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
              
<blockquote>                     
  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
         </blockquote>
              
<h3></h3>
              
<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
              
<blockquote>                     
  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp 
         </blockquote>
              
<p><font size="2"><a href="support.htm">Tom Eastep</a></font>        </p>
                     <a href="copyright.htm"><font size="2">Copyright</font>
    <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
 <br>
</body>
</html>
-												Initial revision


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@182 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-07 16:28:04 +02:00
+								<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 								<html>
 								<head>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <meta http-equiv="Content-Type"
 								 content="text/html; charset=windows-1252">
-												Initial revision


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@182 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-07 16:28:04 +02:00
+								  <title>My Shorewall Configuration</title>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Initial revision


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@182 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-07 16:28:04 +02:00
+								  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Shorewall-1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@519 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-23 19:47:54 +01:00
+								  <meta name="ProgId" content="FrontPage.Editor.Document">
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Changes for 1.3.7


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@208 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-22 23:33:54 +02:00
+								  <meta name="Microsoft Theme" content="none">
-												Initial revision


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@182 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-07 16:28:04 +02:00
+								</head>
-												Changes for 1.3.7


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@208 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-08-22 23:33:54 +02:00
+								  <body>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<table border="0" cellpadding="0" cellspacing="0"
 								 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 								 bgcolor="#400169" height="90">
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								                           <tbody>
 								                      <tr>
 								                             <td width="100%">
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								                             </td>
 								                           </tr>
 								  </tbody>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								</table>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<blockquote> </blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h1>My Current Network </h1>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small>
 								     use a combination of Static NAT and Proxy ARP, neither of which are relevant
 								     to a simple configuration with a single public IP address.</small></b></big><big><b><small>
 								     If you have just a single public IP address, most of what you see here
 								  won't   apply to your setup so beware of copying parts of this configuration
 								  and  expecting them to work for you. What you copy may or may not work in
 								  your configuration.<br>
 								         </small></b></big></p>
 								  <p><big><b><small><big><font color="#ff0000">Warning 2:</font></big> </small></b></big><b>My
 								   configuration uses features introduced in Shorewall version 1.4.4b.</b><br>
 								             </p>
 								  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180).
 								         My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> Speedport)
 								        is connected to eth0. I have a local network connected to eth2 (subnet
 .168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) and a Wireless
 								 network connected to eth3 (192.168.3.0/24).</p>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <p> I use:<br>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								                    </p>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <ul>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								                      <li>Static NAT for Ursa (my XP System) - Internal address
 .168.1.5      and external address 206.124.146.178.</li>
 								                      <li>Static NAT for Wookie (my Linux System). Internal
 								 address    192.168.1.3 and external address 206.124.146.179.</li>
 								       <li>Static NAT for EastepLaptop (My work system). Internal address
 .168.1.7  and external address 206.124.146.180.<br>
 								       </li>
 								                      <li>SNAT through the primary gateway address (206.124.146.176)
 								     for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
 								   through the Wireless Access Point (wap) via a Wireless Bridge (bridge).
 								       <b><br>
 								           <br>
 								     Note:</b> While the distance between the WAP and where I usually use
 								the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus wireless
 								card)   has proved very unsatisfactory (lots of lost connections). By replacing
 								the  WAC11 with the WET11 wireless bridge, I have virtually eliminated these
 								problems  (Being an old radio tinkerer (K7JPV), I was also able to eliminate
 								the disconnects by hanging a piece of aluminum foil on the family room wall.
 								Needless to say, my wife Tarry rejected that as a permanent solution :-).</li>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  </ul>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
 								  <p> Wookie  and the Firewall both run Samba and the Firewall acts as the
 								a WINS server.<br>
 								   </p>
 								  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
 								in the local zone.</p>
 								  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional
 								 to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit prefix),
 								 I use <a href="MAC_Validation.html">MAC verification.</a> This is still a
 								 weak combination and if I lived near a wireless "hot spot", I would probably
 								 add IPSEC or something similar to my WiFi-&gt;local connections.<br>
 								     </p>
 								  <p> The single system in the DMZ (address 206.124.146.177) runs postfix,
 								        Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an
 								FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch our
 								email    from our    old and current ISPs. That server is managed through
 								Proxy ARP.</p>
 								  <p> The firewall system itself runs a DHCP server that serves the local
 								          network. It also runs Postfix which is configured as a Virus and
 								  Spam filter with all incoming mail then being forwarded to the MTA in the
 								  DMZ.</p>
 								  <p> All administration and publishing is done using ssh/scp. I have X installed
 								    on the firewall but no X server or desktop is installed.     X applications
 								tunnel through SSH to XWin.exe running on Ursa. The server does have a desktop
 								environment installed and that desktop environment is available via XDMCP
 								from the local zone. For the most part though, X tunneled through SSH is
 								used for server administration and the server runs at run level 3 (multi-user
 								console mode on RedHat).</p>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <p> I run an SNMP server on my firewall to serve <a
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running
 								        in the DMZ.</p>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <p align="center">                           <img border="0"
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								 src="images/network.png" width="764" height="846"
 								 alt="(My network layout)">
 								                    </p>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								  <p><EFBFBD></p>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								  <p>The ethernet interface in the Server is configured         with IP address
 .124.146.177, netmask    255.255.255.0. The server's default gateway
 								 is      206.124.146.254 (Router at my ISP. This is the same           default
 								   gateway used by the firewall itself). On the firewall,
 								                 Shorewall automatically adds a host route to
 .124.146.177 through eth1 (192.168.2.1) because     of
 								                          the entry in /etc/shorewall/proxyarp (see  below).</p>
 								  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior
 								      access.<br>
 								               </p>
-												Changes for 1.3.13


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@402 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-01-14 21:32:45 +01:00
+								  <p><font color="#ff0000" size="5"></font></p>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								             </blockquote>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h3>Shorewall.conf</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>NAT_ENABLED=Yes<br>MANGLE_ENABLED=Yes<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>MULTIPORT=Yes<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
-												Shorewall 1.4.4b


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@576 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-29 16:48:09 +02:00
+								    </blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								<h3>Params File (Edited):</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
-												Shoreall 1.4.3


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@555 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-18 20:38:34 +02:00
+								  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
 								      </blockquote>
-												Shoreall 1.4.3


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@555 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-18 20:38:34 +02:00
+								<h3>Zones File</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								 face="Courier" size="2"><br></font></pre>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								         </blockquote>
-												Shorewall-1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@519 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-23 19:47:54 +01:00
+								<h3>Interfaces File: </h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <p> This is set up so that I can start the firewall before bringing up
 								my Ethernet  interfaces. </p>
 								                       </blockquote>
 								<blockquote>
 								  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								 face="Courier" size="2"><br></font>                </pre>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								         </blockquote>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								<h3>Hosts File: </h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								         </blockquote>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h3>Routestopped File:</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								 face="Courier" size="2">	</font></pre>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								         </blockquote>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h3>Policy File:</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
 								         </blockquote>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								<h3>Masq File: </h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <p> Although most of our internal systems use static NAT, my wife's system
 								         (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors
 								 with     laptops. Also, I masquerade systems connected through the wireless
 								 network.</p>
 								                    </blockquote>
 								<blockquote>
 								  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
 								   </blockquote>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h3>NAT File: </h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
 								         </blockquote>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								<h3>Proxy ARP File:</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								 face="Courier" size="2">     	</font></pre>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								         </blockquote>
-												Changes for 1.3.13


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@402 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-01-14 21:32:45 +01:00
+								<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
 								         </blockquote>
 								<h3></h3>
-												Shoreall 1.4.3


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@555 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-18 20:38:34 +02:00
+								<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
 								<blockquote>
 								  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp
 								         </blockquote>
-												Shorwall 1.4.0


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@507 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-18 16:16:33 +01:00
+								<p><font size="2"><a href="support.htm">Tom Eastep</a></font>        </p>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@612 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-23 22:24:51 +02:00
+								                     <a href="copyright.htm"><font size="2">Copyright</font>
 								    <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-												Shorewall 1.4.4b


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@576 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-29 16:48:09 +02:00
+								 <br>
-												Documentation changes for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@240 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:02:45 +02:00
+								</body>
 								</html>