<pre>#ZONE DISPLAY COMMENTS<br>net Internet Internet<br>WiFi Wireless Wireless Network on eth3<br>me Wookie My Linux Workstation<br>dmz DMZ Demilitarized zone<br>loc Local Local networks<br>tx Texas Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
<p> This is set up so that I can start the firewall before bringing
up
my Ethernet interfaces. </p>
</blockquote>
<blockquote>
<pre>#ZONE INERFACE BROADCAST OPTIONS<br>net eth0 206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc eth2 192.168.1.255 dhcp,newnotsyn<br>dmz eth1 192.168.2.255 newnotsyn<br>WiFi eth3 192.168.3.255 dhcp,maclist,newnotsyn<br>- texas 192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
<pre>#ZONE HOST(S) OPTIONS<br>me eth2:192.168.1.3<br>tx texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
<pre>#SOURCE DESTINATION POLICY LOG LEVEL BURST:LIMIT<br>me loc NONE # 'me' and 'loc' are in the same network<br>me all ACCEPT # Allow my workstation unlimited access<br>tx me ACCEPT # Alow Texas access to my workstation<br>WiFi loc ACCEPT # Allow the wireless new access<br>all me CONTINUE # Use all->loc rules for my WS also<br>loc net ACCEPT # Allow all net traffic from local net<br>$FW loc ACCEPT # Allow local access from the firewall<br>$FW tx ACCEPT # Allow firewall access to texas<br>loc tx ACCEPT # Allow local net access to texas<br>loc fw REJECT $LOG # Reject loc->fw and log<br>WiFi net ACCEPT # Allow internet access from wirless<br>net all DROP $LOG 10/sec:40 # Rate limit and<br> # DROP net->dmz<br>all all REJECT $LOG # Reject and log the rest<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
system (192.168.1.4) uses IP Masquerading (actually SNAT) as does my
personal system (192.168.1.3), our laptop (192.168.3.8) and
visitors with laptops.<br>
</p>
</blockquote>
<blockquote>
<pre>#INTERFACE SUBNET ADDRESS<br>eth0 eth2 206.124.146.176,206.124.146.179<br>eth0 eth3 206.124.146.176,206.124.146.179<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>206.124.146.178 eth0:0 192.168.1.5 No No<br>206.124.146.180 eth0:2 192.168.1.7 No No<br>#<br># The following entry allows the server to be accessed through an address in<br># the local network. This is convenient when I'm on the road and connected<br># to the PPTP server. By doing this, I don't need to set my client's default<br># gateway to route through the tunnel.<br>#<br>192.168.1.193 eth2:0 206.124.146.177 No No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
<h3>Rules File (The shell variables are set in /etc/shorewall/params):</h3>
<blockquote>
<pre>################################################################################################################################################################<br>#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG loc net tcp 6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT loc net tcp 137,445<br>REJECT loc net udp 137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP loc:!192.168.1.0/24 fw<br>ACCEPT loc fw tcp ssh,time,10000,swat,137,139,445<br>ACCEPT loc fw udp snmp,ntp,445<br>ACCEPT loc fw udp 137:139<br>ACCEPT loc fw udp 1024: 137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT loc dmz udp domain,xdmcp<br>ACCEPT loc dmz tcp www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3 -<br>################################################################################################################################################################<br># Me to DMZ (This compensates for the broken RH kernel running in the DMZ -- that kernel's REJECT target is broken and Evolution requires a REJECT from smtps).<br>#<br>REJECT me dmz tcp 465<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT net dmz tcp smtp,www,ftp,imaps,domain,cvspserver,https -<br>ACCEPT net dmz udp domain<br>ACCEPT net:$MIRRORS dmz tcp rsync<br>ACCEPT:$LOG net dmz tcp 32768:61000 20<br>DROP net dmz tcp 1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT net loc:192.168.1.5 tcp 1723<br>ACCEPT net loc:192.168.1.5 gre<br>#<br># ICQ<br>#<br>ACCEPT net loc:192.168.1.5 tcp 4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT net loc:192.168.1.5 udp 6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT net loc:192.168.1.3 tcp 4000:4100<br>####################################
</blockquote>
The next three files deal with redirecting html requests to Squid on
the DMZ server.<spanstyle="font-weight: bold;"><br>
<prestyle="margin-left: 40px;">#MARK SOURCE DEST PROTO PORT(S) CLIENT PORT(S)<br>#<br># In the PREROUTING chain, mark all HTML connection requests to external <br># servers with value 1<br>#<br>1:P eth2 !192.168.0.0/16 tcp 80<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
<prestyle="margin-left: 40px;">#<br># Add a second routing table with my server as the default gateway<br># Use this routing table with all packets marked with value 1<br># <br>if [ -z "`ip route list table 202 2> /dev/null`" ] ; then<br> run_ip rule add fwmark 1 table www.out<br> run_ip route add default via 206.124.146.177 dev eth1 table www.out<br> run_ip route flush cache<br>fi<br></pre>
