2002-05-01 00:42:57 +02:00
|
|
|
#
|
2007-07-03 22:32:01 +02:00
|
|
|
# Shorewall version 4.0 - Sample Rules File for three-interface configuration.
|
|
|
|
|
# Copyright (C) 2006,2007 by the Shorewall Team
|
2006-03-17 03:07:39 +01:00
|
|
|
#
|
|
|
|
|
# This library is free software; you can redistribute it and/or
|
|
|
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
# License as published by the Free Software Foundation; either
|
|
|
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
#
|
|
|
|
|
# See the file README.txt for further details.
|
2007-02-23 19:51:55 +01:00
|
|
|
#------------------------------------------------------------------------------------------------------------
|
|
|
|
|
# For information about entries in this file, type "man shorewall-rules"
|
2012-12-13 18:26:09 +01:00
|
|
|
######################################################################################################################################################################################################
|
|
|
|
|
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
2005-09-12 19:42:30 +02:00
|
|
|
# PORT PORT(S) DEST LIMIT GROUP
|
2011-08-16 00:32:24 +02:00
|
|
|
#SECTION ALL
|
|
|
|
|
#SECTION ESTABLISHED
|
|
|
|
|
#SECTION RELATED
|
2013-01-25 00:42:01 +01:00
|
|
|
#SECTION INVALID
|
|
|
|
|
#SECTION UNTRACKED
|
2011-08-16 00:32:24 +02:00
|
|
|
SECTION NEW
|
|
|
|
|
|
2011-08-13 16:07:54 +02:00
|
|
|
# Don't allow connection pickup from the net
|
|
|
|
|
#
|
2012-06-28 00:16:16 +02:00
|
|
|
Invalid(DROP) net all tcp
|
2002-05-18 21:48:34 +02:00
|
|
|
#
|
2003-04-06 23:41:28 +02:00
|
|
|
# Accept DNS connections from the firewall to the Internet
|
2002-05-01 00:42:57 +02:00
|
|
|
#
|
2009-08-07 16:25:57 +02:00
|
|
|
DNS(ACCEPT) $FW net
|
2002-05-18 21:48:34 +02:00
|
|
|
#
|
2002-05-01 00:42:57 +02:00
|
|
|
#
|
2003-03-12 21:55:17 +01:00
|
|
|
# Accept SSH connections from the local network to the firewall and DMZ
|
2002-05-01 00:42:57 +02:00
|
|
|
#
|
2009-08-07 16:25:57 +02:00
|
|
|
SSH(ACCEPT) loc $FW
|
|
|
|
|
SSH(ACCEPT) loc dmz
|
2002-05-01 00:42:57 +02:00
|
|
|
#
|
2003-04-06 23:41:28 +02:00
|
|
|
# DMZ DNS access to the Internet
|
2002-05-01 00:42:57 +02:00
|
|
|
#
|
2009-08-07 16:25:57 +02:00
|
|
|
DNS(ACCEPT) dmz net
|
2005-08-22 05:34:26 +02:00
|
|
|
|
|
|
|
|
|
2008-05-17 02:15:26 +02:00
|
|
|
# Drop Ping from the "bad" net zone.
|
2005-08-22 05:34:26 +02:00
|
|
|
|
2009-08-07 16:25:57 +02:00
|
|
|
Ping(DROP) net $FW
|
2005-08-22 05:34:26 +02:00
|
|
|
|
|
|
|
|
#
|
|
|
|
|
# Make ping work bi-directionally between the dmz, net, Firewall and local zone
|
|
|
|
|
# (assumes that the loc-> net policy is ACCEPT).
|
|
|
|
|
#
|
|
|
|
|
|
2009-08-07 16:25:57 +02:00
|
|
|
Ping(ACCEPT) loc $FW
|
|
|
|
|
Ping(ACCEPT) dmz $FW
|
|
|
|
|
Ping(ACCEPT) loc dmz
|
|
|
|
|
Ping(ACCEPT) dmz loc
|
|
|
|
|
Ping(ACCEPT) dmz net
|
2005-08-22 05:34:26 +02:00
|
|
|
|
2005-09-12 19:42:30 +02:00
|
|
|
ACCEPT $FW net icmp
|
2005-09-21 18:26:16 +02:00
|
|
|
ACCEPT $FW loc icmp
|
|
|
|
|
ACCEPT $FW dmz icmp
|
2005-08-22 05:34:26 +02:00
|
|
|
|
|
|
|
|
# Uncomment this if using Proxy ARP and static NAT and you want to allow ping from
|
|
|
|
|
# the net zone to the dmz and loc
|
|
|
|
|
|
2009-08-07 16:25:57 +02:00
|
|
|
#Ping(ACCEPT) net dmz
|
|
|
|
|
#Ping(ACCEPT) net loc
|
