forked from extern/shorewall_code
238 lines
9.9 KiB
XML
238 lines
9.9 KiB
XML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||
|
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||
|
|
<article>
|
||
|
|
<!--$Id$-->
|
||
|
|
|
||
|
|
<articleinfo>
|
||
|
|
<title>User-defined Actions</title>
|
||
|
|
|
||
|
|
<authorgroup>
|
||
|
|
<author>
|
||
|
|
<firstname>Tom</firstname>
|
||
|
|
|
||
|
|
<surname>Eastep</surname>
|
||
|
|
</author>
|
||
|
|
</authorgroup>
|
||
|
|
|
||
|
|
<pubdate>2004-02-08</pubdate>
|
||
|
|
|
||
|
|
<copyright>
|
||
|
|
<year>2003-2004</year>
|
||
|
|
|
||
|
|
<holder>Thomas M. Eastep</holder>
|
||
|
|
</copyright>
|
||
|
|
|
||
|
|
<legalnotice>
|
||
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
||
|
|
document under the terms of the GNU Free Documentation License, Version
|
||
|
|
1.2 or any later version published by the Free Software Foundation; with
|
||
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||
|
|
Texts. A copy of the license is included in the section entitled
|
||
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||
|
|
</legalnotice>
|
||
|
|
</articleinfo>
|
||
|
|
|
||
|
|
<para>Prior to Shorewall version 1.4.9, rules in <filename>/etc/shorewall/rules</filename>
|
||
|
|
were limited to those defined by Netfilter (ACCEPT, DROP, REJECT, etc.).
|
||
|
|
Beginning with Shorewall version 1.4.9, users may use sequences of these
|
||
|
|
elementary operations to define more complex actions.</para>
|
||
|
|
|
||
|
|
<para>To define a new action:</para>
|
||
|
|
|
||
|
|
<orderedlist>
|
||
|
|
<listitem>
|
||
|
|
<para>Add a line to <filename><filename>/etc/shorewall/actions</filename></filename>
|
||
|
|
that names your new action. Action names must be valid shell variable
|
||
|
|
names as well as valid Netfilter chain names. It is recommended that the
|
||
|
|
name you select for a new action begins with with a capital letter; that
|
||
|
|
way, the name won't conflict with a Shorewall-defined chain name.</para>
|
||
|
|
|
||
|
|
<para>Beginning with Shorewall-2.0.0-Beta1, the name of the action may
|
||
|
|
be optionally followed by a colon (<quote>:</quote>) and ACCEPT, DROP or
|
||
|
|
REJECT. When this is done, the named action will become the
|
||
|
|
<emphasis>common action </emphasis>for policies of type ACCEPT, DROP or
|
||
|
|
REJECT respectively. The common action is applied immediately before the
|
||
|
|
policy is enforced (before any logging is done under that policy) and is
|
||
|
|
used mainly to suppress logging of uninteresting traffic which would
|
||
|
|
otherwise clog your logs. The same policy name can appear in multiple
|
||
|
|
actions; the last such action for each policy name is the one which
|
||
|
|
Shorewall will use.</para>
|
||
|
|
|
||
|
|
<para>Shorewall includes pre-defined actions for DROP and REJECT -- see
|
||
|
|
below.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Once you have defined your new action name (ActionName), then copy
|
||
|
|
/etc/shorewall/action.template to <filename>/etc/shorewall/action.ActionName</filename>
|
||
|
|
(for example, if your new action name is <quote>Foo</quote> then copy
|
||
|
|
<filename>/etc/shorewall/action.template</filename> to
|
||
|
|
<filename>/etc/shorewall/action.Foo</filename>).</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>Now modify the new file to define the new action.</para>
|
||
|
|
</listitem>
|
||
|
|
</orderedlist>
|
||
|
|
|
||
|
|
<para>Columns in the action.template file are as follows:</para>
|
||
|
|
|
||
|
|
<itemizedlist>
|
||
|
|
<listitem>
|
||
|
|
<para>TARGET - Must be ACCEPT, DROP, REJECT, LOG, QUEUE or <<emphasis>action</emphasis>>
|
||
|
|
where <<emphasis>action</emphasis>> is a previously-defined
|
||
|
|
action (that is, it must precede the action being defined in this file
|
||
|
|
in your <filename>/etc/shorewall/actions</filename> file). The TARGET
|
||
|
|
may optionally be followed by a colon (<quote>:</quote>) and a syslog
|
||
|
|
log level (e.g, REJECT:info or ACCEPT:debugging). This causes the packet
|
||
|
|
to be logged at the specified level. You may also specify ULOG (must be
|
||
|
|
in upper case) as a log level.This will log to the ULOG target for
|
||
|
|
routing to a separate log through use of ulogd (<ulink
|
||
|
|
url="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</ulink>).</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>SOURCE - Source hosts to which the rule applies. A comma-separated
|
||
|
|
list of subnets and/or hosts. Hosts may be specified by IP or MAC
|
||
|
|
address; mac addresses must begin with <quote>~</quote> and must use
|
||
|
|
<quote>-</quote> as a separator.</para>
|
||
|
|
|
||
|
|
<para>Alternatively, clients may be specified by interface name. For
|
||
|
|
example, eth1 specifies a client that communicates with the firewall
|
||
|
|
system through eth1. This may be optionally followed by another colon (<quote>:</quote>)
|
||
|
|
and an IP/MAC/subnet address as described above (e.g.,
|
||
|
|
eth1:192.168.1.5).</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>DEST - Location of Server. Same as above with the exception that
|
||
|
|
MAC addresses are not allowed.</para>
|
||
|
|
|
||
|
|
<para>Unlike in the SOURCE column, you may specify a range of up to 256
|
||
|
|
IP addresses using the syntax <<emphasis>first ip</emphasis>>-<<emphasis>last
|
||
|
|
ip</emphasis>>.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>PROTO - Protocol - Must be <quote>tcp</quote>, <quote>udp</quote>,
|
||
|
|
<quote>icmp</quote>, a number, or <quote>all</quote>.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>DEST PORT(S) - Destination Ports. A comma-separated list of Port
|
||
|
|
names (from <filename>/etc/services</filename>), port numbers or port
|
||
|
|
ranges; if the protocol is <quote>icmp</quote>, this column is
|
||
|
|
interpreted as the destination icmp-type(s).</para>
|
||
|
|
|
||
|
|
<para>A port range is expressed as <<emphasis>low port</emphasis>>:<<emphasis>high
|
||
|
|
port</emphasis>>.</para>
|
||
|
|
|
||
|
|
<para>This column is ignored if PROTOCOL = all but must be entered if
|
||
|
|
any of the following ields are supplied. In that case, it is suggested
|
||
|
|
that this field contain <quote>-</quote>.</para>
|
||
|
|
|
||
|
|
<para>If your kernel contains multi-port match support, then only a
|
||
|
|
single Netfilter rule will be generated if in this list and in the
|
||
|
|
CLIENT PORT(S) list below:</para>
|
||
|
|
|
||
|
|
<orderedlist>
|
||
|
|
<listitem>
|
||
|
|
<para>There are 15 or less ports listed.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>No port ranges are included.</para>
|
||
|
|
</listitem>
|
||
|
|
</orderedlist>
|
||
|
|
|
||
|
|
<para>Otherwise, a separate rule will be generated for each port.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>SOURCE PORT(S) - Port(s) used by the client. If omitted, any
|
||
|
|
source port is acceptable. Specified as a comma-separated list of port
|
||
|
|
names, port numbers or port ranges.</para>
|
||
|
|
|
||
|
|
<para>If you don't want to restrict client ports but need to specify
|
||
|
|
an ADDRESS in the next column, then place "-" in this column.</para>
|
||
|
|
|
||
|
|
<para>If your kernel contains multi-port match support, then only a
|
||
|
|
single Netfilter rule will be generated if in this list and in the DEST
|
||
|
|
PORT(S) list above:</para>
|
||
|
|
|
||
|
|
<orderedlist>
|
||
|
|
<listitem>
|
||
|
|
<para>There are 15 or less ports listed.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>No port ranges are included.</para>
|
||
|
|
</listitem>
|
||
|
|
</orderedlist>
|
||
|
|
|
||
|
|
<para>Otherwise, a separate rule will be generated for each port.</para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>RATE LIMIT - You may rate-limit the rule by placing a value in
|
||
|
|
this column:</para>
|
||
|
|
|
||
|
|
<para><programlisting> <<emphasis>rate</emphasis>>/<<emphasis>interval</emphasis>>[:<<emphasis>burst</emphasis>>]</programlisting>where
|
||
|
|
<<emphasis>rate</emphasis>> is the number of connections per
|
||
|
|
<<emphasis>interval</emphasis>> (<quote>sec</quote> or
|
||
|
|
<quote>min</quote>) and <<emphasis>burst</emphasis>> is the
|
||
|
|
largest burst permitted. If no <<emphasis>burst</emphasis>> is
|
||
|
|
given, a value of 5 is assumed. There may be no whitespace embedded in
|
||
|
|
the specification.</para>
|
||
|
|
|
||
|
|
<para><programlisting> Example: 10/sec:20</programlisting></para>
|
||
|
|
</listitem>
|
||
|
|
|
||
|
|
<listitem>
|
||
|
|
<para>USER/GROUP - For output rules (those with the firewall as their
|
||
|
|
source), you may control connections based on the effective UID and/or
|
||
|
|
GID of the process requesting the connection. This column can contain
|
||
|
|
any of the following:</para>
|
||
|
|
|
||
|
|
<simplelist>
|
||
|
|
<member>[!]<<emphasis>user number</emphasis>>[:]</member>
|
||
|
|
|
||
|
|
<member>[!]<<emphasis>user name</emphasis>>[:]</member>
|
||
|
|
|
||
|
|
<member>[!]:<<emphasis>group number</emphasis>></member>
|
||
|
|
|
||
|
|
<member>[!]:<<emphasis>group name</emphasis>></member>
|
||
|
|
|
||
|
|
<member>[!]<<emphasis>user number</emphasis>>:<<emphasis>group
|
||
|
|
number</emphasis>></member>
|
||
|
|
|
||
|
|
<member>[!]<<emphasis>user name</emphasis>>:<<emphasis>group
|
||
|
|
number</emphasis>></member>
|
||
|
|
|
||
|
|
<member>[!]<<emphasis>user inumber</emphasis>>:<<emphasis>group
|
||
|
|
name</emphasis>></member>
|
||
|
|
|
||
|
|
<member>[!]<<emphasis>user name</emphasis>>:<<emphasis>group
|
||
|
|
name</emphasis>></member>
|
||
|
|
</simplelist>
|
||
|
|
</listitem>
|
||
|
|
</itemizedlist>
|
||
|
|
|
||
|
|
<para>Example:</para>
|
||
|
|
|
||
|
|
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||
|
|
|
||
|
|
<para><programlisting> LogAndAccept</programlisting><phrase><filename>/etc/shorewall/action.LogAndAccept</filename></phrase><programlisting> LOG:info
|
||
|
|
ACCEPT</programlisting></para>
|
||
|
|
|
||
|
|
<para>Beginning with Shorewall 2.0.0-Beta1, Shorewall includes a number of
|
||
|
|
defined actions. These defined actions are listed in <filename>/etc/shorewall/actions.std</filename>.
|
||
|
|
To ensure that all of these actions are included in the configuration, the
|
||
|
|
<filename>/etc/shorewall/actions</filename> file released with Shorewall
|
||
|
|
contains <quote><command>INCLUDE /etc/shorewall/actions.std</command></quote>.</para>
|
||
|
|
|
||
|
|
<para>The <filename>/etc/shorewall/actions.std</filename> file includes the
|
||
|
|
common actions <quote>Drop</quote> for DROP policies and <quote>Reject</quote>
|
||
|
|
for REJECT policies.</para>
|
||
|
|
</article>
|