forked from extern/shorewall_code
275 lines
11 KiB
XML
275 lines
11 KiB
XML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<refentry>
|
||
|
|
<refmeta>
|
||
|
|
<refentrytitle>shorewall-tunnels</refentrytitle>
|
||
|
|
|
||
|
|
<manvolnum>5</manvolnum>
|
||
|
|
</refmeta>
|
||
|
|
|
||
|
|
<refnamediv>
|
||
|
|
<refname>tunnels</refname>
|
||
|
|
|
||
|
|
<refpurpose>Shorewall VPN definition file</refpurpose>
|
||
|
|
</refnamediv>
|
||
|
|
|
||
|
|
<refsynopsisdiv>
|
||
|
|
<cmdsynopsis>
|
||
|
|
<command>/etc/shorewall/tunnels</command>
|
||
|
|
</cmdsynopsis>
|
||
|
|
</refsynopsisdiv>
|
||
|
|
|
||
|
|
<refsect1>
|
||
|
|
<title>Description</title>
|
||
|
|
|
||
|
|
<para>The tunnels file is used to define rules for encapsulated (usually
|
||
|
|
encrypted) traffic to pass between the Shorewall system and a remote
|
||
|
|
gateway. Traffic flowing through the tunnel is handled using the normal
|
||
|
|
zone/policy/rule mechanism. See <ulink
|
||
|
|
url="http://www.shorewall.net/VPNBasics.html">http://www.shorewall.net/VPNBasics.html</ulink>
|
||
|
|
for details.</para>
|
||
|
|
|
||
|
|
<para>The columns in the file are as follows.</para>
|
||
|
|
|
||
|
|
<variablelist>
|
||
|
|
<varlistentry>
|
||
|
|
<term><emphasis role="bold">TYPE</emphasis> - {<emphasis
|
||
|
|
role="bold">ipsec</emphasis>[<emphasis
|
||
|
|
role="bold">:{noah</emphasis>|ah}]|<emphasis
|
||
|
|
role="bold">ipsecnat</emphasis>|<emphasis
|
||
|
|
role="bold">ipip</emphasis>|<emphasis
|
||
|
|
role="bold">gre</emphasis>|l2tp|<emphasis
|
||
|
|
role="bold">pptpclient</emphasis>|<emphasis
|
||
|
|
role="bold">pptpserver</emphasis>|{<emphasis
|
||
|
|
role="bold">openvpn</emphasis>|<emphasis
|
||
|
|
role="bold">openvpnclient</emphasis>|<emphasis
|
||
|
|
role="bold">openvpnserver</emphasis>}[:{<emphasis
|
||
|
|
role="bold">tcp</emphasis>|<emphasis
|
||
|
|
role="bold">udp</emphasis>}]<emphasis
|
||
|
|
role="bold">[</emphasis>:<emphasis>port</emphasis>]|<emphasis
|
||
|
|
role="bold">generic</emphasis><emphasis
|
||
|
|
role="bold">:</emphasis><emphasis>protocol</emphasis>[<emphasis
|
||
|
|
role="bold">:</emphasis><emphasis>port</emphasis>]}</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Types are as follows:</para>
|
||
|
|
|
||
|
|
<programlisting> <emphasis role="bold">ipsec</emphasis> - IPv4 IPSEC
|
||
|
|
<emphasis role="bold">ipsecnat</emphasis> - IPv4 IPSEC with NAT Traversal (UDP port 4500 encapsulation)
|
||
|
|
<emphasis role="bold">ipip</emphasis> - IPv4 encapsulated in IPv4 (Protocol 4)
|
||
|
|
<emphasis role="bold">gre</emphasis> - Generalized Routing Encapsulation (Protocol 47)
|
||
|
|
<emphasis role="bold">l2tp</emphasis> - Layer 2 Tunneling Protocol (UDP port 1701)
|
||
|
|
<emphasis role="bold">pptpclient</emphasis> - PPTP Client runs on the firewall
|
||
|
|
<emphasis role="bold">pptpserver</emphasis> - PPTP Server runs on the firewall
|
||
|
|
<emphasis role="bold">openvpn</emphasis> - OpenVPN in point-to-point mode
|
||
|
|
<emphasis role="bold">openvpnclient</emphasis> - OpenVPN client runs on the firewall
|
||
|
|
<emphasis role="bold">openvpnserver</emphasis> - OpenVPN server runs on the firewall
|
||
|
|
<emphasis role="bold">generic</emphasis> - Other tunnel type</programlisting>
|
||
|
|
|
||
|
|
<para>If the type is <emphasis role="bold">ipsec</emphasis>, it may
|
||
|
|
be followed by <emphasis role="bold">:ah</emphasis> to indicate that
|
||
|
|
the Authentication Headers protocol (51) is used by the tunnel (the
|
||
|
|
default is <option>:noah</option> which means that protocol 51 is
|
||
|
|
not used). NAT traversal is only supported with ESP (protocol 50) so
|
||
|
|
<emphasis role="bold">ipsecnat</emphasis> tunnels don't allow the
|
||
|
|
<emphasis role="bold">ah</emphasis> option (<emphasis
|
||
|
|
role="bold">ipsecnat:noah</emphasis> may be specified but is
|
||
|
|
redundant).</para>
|
||
|
|
|
||
|
|
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
|
||
|
|
role="bold">openvpnclient</emphasis> or <emphasis
|
||
|
|
role="bold">openvpnserver</emphasis> it may optionally be followed
|
||
|
|
by ":" and <emphasis role="bold">tcp</emphasis> or <emphasis
|
||
|
|
role="bold">udp</emphasis> to specify the protocol to be used. If
|
||
|
|
not specified, <emphasis role="bold">udp</emphasis> is
|
||
|
|
assumed.</para>
|
||
|
|
|
||
|
|
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
|
||
|
|
role="bold">openvpnclient</emphasis> or <emphasis
|
||
|
|
role="bold">openvpnserver</emphasis> it may optionally be followed
|
||
|
|
by ":" and the port number used by the tunnel. if no ":" and port
|
||
|
|
number are included, then the default port of 1194 will be used. .
|
||
|
|
Where both the protocol and port are specified, the protocol must be
|
||
|
|
given first (e.g., openvpn:tcp:4444).</para>
|
||
|
|
|
||
|
|
<para>If type is <emphasis role="bold">generic</emphasis>, it must
|
||
|
|
be followed by ":" and a protocol name (from /etc/protocols) or a
|
||
|
|
protocol number. If the protocol is <emphasis
|
||
|
|
role="bold">tcp</emphasis> or <emphasis role="bold">udp</emphasis>
|
||
|
|
(6 or 17), then it may optionally be followed by ":" and a port
|
||
|
|
number.</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term></term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para></para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term><emphasis role="bold">ZONE</emphasis> -
|
||
|
|
<emphasis>zone</emphasis></term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>The <emphasis>zone</emphasis> of the physical interface
|
||
|
|
through which tunnel traffic passes. This is normally your internet
|
||
|
|
zone.</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term><emphasis role="bold">GATEWAY</emphasis> -
|
||
|
|
<emphasis>address-or-range</emphasis></term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>The IP address of the remote tunnel gateway. If the remote
|
||
|
|
gateway has no fixed address (Road Warrior) then specify the gateway
|
||
|
|
as <emphasis role="bold">0.0.0.0/0</emphasis>. May be specified as a
|
||
|
|
network address and if your kernel and iptables include iprange
|
||
|
|
match support then IP address ranges are also allowed.</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term><emphasis role="bold">GATEWAY ZONES</emphasis> (Optional) -
|
||
|
|
[<emphasis>zone</emphasis>[<emphasis
|
||
|
|
role="bold">,</emphasis><emphasis>zone</emphasis>]...]</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>If the gateway system specified in the third column is a
|
||
|
|
standalone host then this column should contain a comma-separated
|
||
|
|
list of the names of the zones that the host might be in. This
|
||
|
|
column only applies to IPSEC tunnels where it enables ISAKMP traffic
|
||
|
|
to flow through the tunnel to the remote gateway.</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
</variablelist>
|
||
|
|
</refsect1>
|
||
|
|
|
||
|
|
<refsect1>
|
||
|
|
<title>Example</title>
|
||
|
|
|
||
|
|
<variablelist>
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 1:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>IPSec tunnel.</para>
|
||
|
|
|
||
|
|
<para>The remote gateway is 4.33.99.124 and the remote subnet is
|
||
|
|
192.168.9.0/24. The tunnel does not use the AH protocol</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY
|
||
|
|
ipsec:noah net 4.33.99.124</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 2:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Road Warrior (LapTop that may connect from anywhere) where the
|
||
|
|
"gw" zone is used to represent the remote LapTop</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
ipsec net 0.0.0.0/0 gw</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 3:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Host 4.33.99.124 is a standalone system connected via an ipsec
|
||
|
|
tunnel to the firewall system. The host is in zone gw.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
ipsec net 4.33.99.124 gw</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 4:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Road Warriors that may belong to zones vpn1, vpn2 or vpn3. The
|
||
|
|
FreeS/Wan _updown script will add the host to the appropriate zone
|
||
|
|
using the <command>shorewall add</command> command on connect and
|
||
|
|
will remove the host from the zone at disconnect time.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
ipsec net 0.0.0.0/0 vpn1,vpn2,vpn3</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 5:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>You run the Linux PPTP client on your firewall and connect to
|
||
|
|
server 192.0.2.221.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
pptpclient net 192.0.2.221</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 6:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>You run a PPTP server on your firewall.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
pptpserver net 0.0.0.0/0</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 7:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>OPENVPN tunnel. The remote gateway is 4.33.99.124 and openvpn
|
||
|
|
uses port 7777.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
openvpn:7777 net 4.33.99.124</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
|
||
|
|
<varlistentry>
|
||
|
|
<term>Example 8:</term>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>You have a tunnel that is not one of the supported types. Your
|
||
|
|
tunnel uses UDP port 4444. The other end of the tunnel is
|
||
|
|
4.3.99.124.</para>
|
||
|
|
|
||
|
|
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
|
||
|
|
generic:udp:4444 net 4.3.99.124</programlisting>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
</variablelist>
|
||
|
|
</refsect1>
|
||
|
|
|
||
|
|
<refsect1>
|
||
|
|
<title>FILES</title>
|
||
|
|
|
||
|
|
<para>/etc/shorewall/tunnels</para>
|
||
|
|
</refsect1>
|
||
|
|
|
||
|
|
<refsect1>
|
||
|
|
<title>See ALSO</title>
|
||
|
|
|
||
|
|
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
|
||
|
|
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
|
||
|
|
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||
|
|
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
|
||
|
|
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
|
||
|
|
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
|
||
|
|
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
|
||
|
|
shorewall-tcrules(5), shorewall-tos(5), shorewall-zones(5)</para>
|
||
|
|
</refsect1>
|
||
|
|
</refentry>
|