2002-09-16 19:13:10 +02:00
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<meta http-equiv="Content-Language" content="en-us">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
|
content="text/html; charset=windows-1252">
|
|
|
|
|
|
<title>Three-Interface Firewall</title>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</head>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<body>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
id="AutoNumber5" bgcolor="#3366ff" height="90">
|
|
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td width="100%">
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<h1 align="center"><font color="#ffffff">Three-Interface Firewall</font></h1>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-08-22 23:21:41 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<h2 align="center">Version 2.0.1</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">Setting up a Linux system as a firewall for a small network
|
|
|
|
|
|
with DMZ is a fairly straight-forward task if you understand the
|
2003-07-04 18:41:22 +02:00
|
|
|
|
basics and follow the documentation.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>This guide doesn't attempt to acquaint you with all of the features of
|
|
|
|
|
|
Shorewall. It rather focuses on what is required to configure Shorewall
|
2003-07-04 18:41:22 +02:00
|
|
|
|
in one of its more popular configurations:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>Linux system used as a firewall/router for a small
|
|
|
|
|
|
local network.</li>
|
|
|
|
|
|
<li>Single public IP address.</li>
|
|
|
|
|
|
<li>DMZ connected to a separate ethernet interface.</li>
|
|
|
|
|
|
<li>Connection through DSL, Cable Modem, ISDN, Frame
|
|
|
|
|
|
Relay, dial-up, ...</li>
|
|
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p align="left">Here is a schematic of a typical installation.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="center"> <img border="0" src="images/dmz1.png" width="692"
|
|
|
|
|
|
height="635">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>Shorewall requires that you have the iproute/iproute2 package installed
|
|
|
|
|
|
(on RedHat, the package is called <i>iproute</i>)<i>. </i>You can
|
|
|
|
|
|
tell if this package is installed by the presence of an <b>ip</b>
|
|
|
|
|
|
program on your firewall system. As root, you can use the 'which' command
|
|
|
|
|
|
to check for this program:</p>
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>I recommend that you first read through the guide to familiarize yourself
|
|
|
|
|
|
with what's involved then go back through it again making your configuration
|
|
|
|
|
|
changes. Points at which configuration changes are recommended
|
|
|
|
|
|
are flagged with <img border="0" src="images/BD21298_.gif"
|
|
|
|
|
|
width="13" height="13">
|
|
|
|
|
|
.<2E>Configuration notes that are unique to LEAF/Bering are marked with<74><img
|
2003-01-31 22:50:51 +01:00
|
|
|
|
src="images/leaflogo.gif" alt="(LEAF Logo)" width="49" height="36">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> If you edit your configuration files on a Windows
|
|
|
|
|
|
system, you must save them as Unix files if your editor supports
|
|
|
|
|
|
that option or you must run them through dos2unix before trying to
|
|
|
|
|
|
use them. Similarly, if you copy a configuration file from your Windows
|
|
|
|
|
|
hard drive to a floppy disk, you must run dos2unix against the copy before
|
|
|
|
|
|
using it with Shorewall.</p>
|
|
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li><a
|
|
|
|
|
|
href="http://www.simtel.net/pub/pd/51438.html">Windows Version of
|
|
|
|
|
|
dos2unix</a></li>
|
|
|
|
|
|
<li><a
|
|
|
|
|
|
href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version of
|
2003-05-28 21:20:23 +02:00
|
|
|
|
dos2unix</a></li>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<h2 align="left">Shorewall Concepts</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
|
|
|
|
|
alt="">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> The configuration files for Shorewall are contained in the
|
|
|
|
|
|
directory /etc/shorewall -- for simple setups, you will only need to
|
|
|
|
|
|
deal with a few of these as described in this guide. After you have <a
|
|
|
|
|
|
href="Install.htm">installed Shorewall</a>, <b>download the <a
|
|
|
|
|
|
href="http://www.shorewall.net/pub/shorewall/Samples/">three-interface
|
|
|
|
|
|
sample</a>, un-tar it (tar -zxvf three-interfaces.tgz) and and copy
|
|
|
|
|
|
the files to /etc/shorewall (the files will replace files with the
|
2003-07-04 18:41:22 +02:00
|
|
|
|
same names that were placed in /etc/shorewall when Shorewall was installed)</b>.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>As each file is introduced, I suggest that you look through the actual
|
|
|
|
|
|
file on your system -- each file contains detailed configuration
|
2003-07-04 18:41:22 +02:00
|
|
|
|
instructions and default entries.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>Shorewall views the network where it is running as being composed of a
|
|
|
|
|
|
set of <i>zones.</i> In the three-interface sample configuration,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
the following zone names are used:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
|
|
|
|
|
cellspacing="0" id="AutoNumber2">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>Name</b></u></td>
|
|
|
|
|
|
<td><u><b>Description</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><b>net</b></td>
|
|
|
|
|
|
<td><b>The Internet</b></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><b>loc</b></td>
|
|
|
|
|
|
<td><b>Your Local Network</b></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><b>dmz</b></td>
|
|
|
|
|
|
<td><b>Demilitarized Zone</b></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p>Zone names are defined in <a href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>Shorewall also recognizes the firewall system as its own zone - by default,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
the firewall itself is known as <b>fw</b>.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>Rules about what traffic to allow and what traffic to deny are expressed
|
2003-07-04 18:41:22 +02:00
|
|
|
|
in terms of zones.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>You express your default policy for connections
|
2003-07-04 18:41:22 +02:00
|
|
|
|
from one zone to another zone in the<a
|
2003-01-31 22:50:51 +01:00
|
|
|
|
href="Documentation.htm#Policy"> /etc/shorewall/policy </a>file.</li>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>You define exceptions to those default policies
|
2003-07-04 18:41:22 +02:00
|
|
|
|
in the <a href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>For each connection request entering the firewall, the request is first
|
|
|
|
|
|
checked against the /etc/shorewall/rules file. If no rule in that
|
|
|
|
|
|
file matches the connection request then the first policy in /etc/shorewall/policy
|
|
|
|
|
|
that matches the request is applied. If that policy is REJECT or
|
|
|
|
|
|
DROP<4F> the request is first checked against the rules in /etc/shorewall/common
|
2003-07-04 18:41:22 +02:00
|
|
|
|
(the samples provide that file for you).</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p>The /etc/shorewall/policy file included with the three-interface sample
|
2003-07-04 18:41:22 +02:00
|
|
|
|
has the following policies:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber3">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>Source Zone</b></u></td>
|
|
|
|
|
|
<td><u><b>Destination Zone</b></u></td>
|
|
|
|
|
|
<td><u><b>Policy</b></u></td>
|
|
|
|
|
|
<td><u><b>Log Level</b></u></td>
|
|
|
|
|
|
<td><u><b>Limit:Burst</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>all</td>
|
|
|
|
|
|
<td>DROP</td>
|
|
|
|
|
|
<td>info</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>all</td>
|
|
|
|
|
|
<td>all</td>
|
|
|
|
|
|
<td>REJECT</td>
|
|
|
|
|
|
<td>info</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>In the three-interface sample, the line below is included but commented
|
|
|
|
|
|
out. If you want your firewall system to have full access to servers
|
2003-07-04 18:41:22 +02:00
|
|
|
|
on the internet, uncomment that line.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber3">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>Source Zone</b></u></td>
|
|
|
|
|
|
<td><u><b>Destination Zone</b></u></td>
|
|
|
|
|
|
<td><u><b>Policy</b></u></td>
|
|
|
|
|
|
<td><u><b>Log Level</b></u></td>
|
|
|
|
|
|
<td><u><b>Limit:Burst</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>The above policy will:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>allow all connection requests from your local network
|
2003-07-04 18:41:22 +02:00
|
|
|
|
to the internet</li>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>drop (ignore) all connection requests from the
|
|
|
|
|
|
internet to your firewall or local network</li>
|
|
|
|
|
|
<li>optionally accept all connection requests from
|
|
|
|
|
|
the firewall to the internet (if you uncomment the additional
|
|
|
|
|
|
policy)</li>
|
|
|
|
|
|
<li>reject all other connection requests.</li>
|
|
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p><img border="0" src="images/BD21298_1.gif" width="13" height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> At this point, edit your /etc/shorewall/policy file
|
2003-07-04 18:41:22 +02:00
|
|
|
|
and make any changes that you wish.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<h2 align="left">Network Interfaces</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="center"> <img border="0" src="images/dmz1.png" width="692"
|
|
|
|
|
|
height="635">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">The firewall has three network interfaces. Where Internet
|
|
|
|
|
|
connectivity is through a cable or DSL "Modem", the <i>External
|
|
|
|
|
|
Interface</i> will be the ethernet adapter that is connected to that
|
|
|
|
|
|
"Modem" (e.g., <b>eth0</b>)<29> <u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint
|
|
|
|
|
|
<u>P</u>rotocol over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint
|
|
|
|
|
|
<u>T</u>unneling <u>P</u>rotocol </i>(PPTP) in which case the External
|
|
|
|
|
|
Interface will be a ppp interface (e.g., <b>ppp0</b>). If you connect
|
|
|
|
|
|
via a regular modem, your External Interface will also be <b>ppp0</b>.
|
2003-07-04 18:41:22 +02:00
|
|
|
|
If you connect using ISDN, you external interface will be <b>ippp0.</b></p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_1.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> If your external interface is <b>ppp0</b> or <b>ippp0
|
2003-07-04 18:41:22 +02:00
|
|
|
|
</b>then you will want to set CLAMPMSS=yes in <a
|
2002-11-24 21:08:19 +01:00
|
|
|
|
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf.</a></p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">Your <i>Local Interface</i> will be an ethernet adapter (eth0,
|
|
|
|
|
|
eth1 or eth2) and will be connected to a hub or switch. Your local
|
|
|
|
|
|
computers will be connected to the same switch (note: If you have
|
|
|
|
|
|
only a single local system, you can connect the firewall directly to
|
|
|
|
|
|
the computer using a <i>cross-over </i> cable).</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">Your <i>DMZ Interface</i> will also be an ethernet adapter
|
|
|
|
|
|
(eth0, eth1 or eth2) and will be connected to a hub or switch. Your
|
|
|
|
|
|
DMZ computers will be connected to the same switch (note: If you
|
|
|
|
|
|
have only a single DMZ system, you can connect the firewall directly
|
2003-07-04 18:41:22 +02:00
|
|
|
|
to the computer using a <i>cross-over </i> cable).</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><u><b> <img border="0" src="images/j0213519.gif"
|
|
|
|
|
|
width="60" height="60">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</b></u>Do not connect more than one interface to the
|
|
|
|
|
|
same hub or switch (even for testing). It won't work the way that
|
|
|
|
|
|
you expect it to and you will end up confused and believing that Shorewall
|
2003-07-04 18:41:22 +02:00
|
|
|
|
doesn't work at all.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> The Shorewall three-interface sample configuration
|
|
|
|
|
|
assumes that the external interface is <b>eth0, </b>the local interface
|
|
|
|
|
|
is <b>eth1 </b>and the DMZ interface is <b> eth2</b>. If your configuration
|
|
|
|
|
|
is different, you will have to modify the sample /etc/shorewall/interfaces
|
|
|
|
|
|
file accordingly. While you are there, you may wish to review the
|
2003-07-04 18:41:22 +02:00
|
|
|
|
list of options that are specified for the interfaces. Some hints:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>
|
|
|
|
|
|
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>,
|
|
|
|
|
|
you can replace the "detect" in the second column with "-".
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>
|
|
|
|
|
|
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>
|
|
|
|
|
|
or if you have a static IP address, you can remove "dhcp" from
|
2003-07-04 18:41:22 +02:00
|
|
|
|
the option list. </p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-02-21 23:22:19 +01:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<h2 align="left">IP Addresses</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">Before going further, we should say a few words about Internet
|
|
|
|
|
|
Protocol (IP) <i>addresses</i>. Normally, your ISP will assign you
|
|
|
|
|
|
a single <i> Public</i> IP address. This address may be assigned via
|
|
|
|
|
|
the<i> Dynamic Host Configuration Protocol</i> (DHCP) or as part of
|
|
|
|
|
|
establishing your connection when you dial in (standard modem) or establish
|
|
|
|
|
|
your PPP connection. In rare cases, your ISP may assign you a<i> static</i>
|
|
|
|
|
|
IP address; that means that you configure your firewall's external interface
|
|
|
|
|
|
to use that address permanently.<i> </i>Regardless of how the address
|
|
|
|
|
|
is assigned, it will be shared by all of your systems when you access
|
|
|
|
|
|
the Internet. You will have to assign your own addresses for your internal
|
|
|
|
|
|
network (the local and DMZ Interfaces on your firewall plus your other
|
|
|
|
|
|
computers). RFC 1918 reserves several <i>Private </i>IP address ranges
|
|
|
|
|
|
for this purpose:</p>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> Before starting Shorewall, you should look at the
|
|
|
|
|
|
IP address of your external interface and if it is one of the above
|
|
|
|
|
|
ranges, you should remove the 'norfc1918' option from the external
|
|
|
|
|
|
interface's entry in /etc/shorewall/interfaces.</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">You will want to assign your local addresses from one <i>
|
|
|
|
|
|
sub-network </i>or <i>subnet</i> and your DMZ addresses from another
|
|
|
|
|
|
subnet. For our purposes, we can consider a subnet to consists of
|
|
|
|
|
|
a range of addresses x.y.z.0 - x.y.z.255. Such a subnet will have
|
|
|
|
|
|
a <i>Subnet Mask </i>of 255.255.255.0. The address x.y.z.0 is reserved
|
|
|
|
|
|
as the <i>Subnet Address</i> and x.y.z.255 is reserved as the <i>Subnet
|
2003-07-04 18:41:22 +02:00
|
|
|
|
Broadcast</i> <i>Address</i>. In Shorewall, a subnet is described using<6E><a
|
2003-07-16 20:59:33 +02:00
|
|
|
|
href="shorewall_setup_guide.htm#Subnets"><i>Classless InterDomain Routing
|
|
|
|
|
|
</i>(CIDR)</a> notation with consists of the subnet address followed
|
|
|
|
|
|
by "/24". The "24" refers to the number of consecutive "1" bits
|
2003-07-04 18:41:22 +02:00
|
|
|
|
from the left of the subnet mask. </p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left">Example sub-network:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="1" style="border-collapse: collapse;" id="AutoNumber1"
|
|
|
|
|
|
cellpadding="2">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><b>Range:</b></td>
|
|
|
|
|
|
<td>10.10.10.0 - 10.10.10.255</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><b>Subnet Address:</b></td>
|
|
|
|
|
|
<td>10.10.10.0</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><b>Broadcast Address:</b></td>
|
|
|
|
|
|
<td>10.10.10.255</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><b>CIDR<EFBFBD>Notation:</b></td>
|
|
|
|
|
|
<td>10.10.10.0/24</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">It is conventional to assign the internal interface either
|
|
|
|
|
|
the first usable address in the subnet (10.10.10.1 in the above
|
2003-07-04 18:41:22 +02:00
|
|
|
|
example) or the last usable address (10.10.10.254).</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">One of the purposes of subnetting is to allow all computers
|
|
|
|
|
|
in the subnet to understand which other computers can be communicated
|
|
|
|
|
|
with directly. To communicate with systems outside of the subnetwork,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
systems send packets through a<i><EFBFBD> gateway</i><EFBFBD> (router).</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_1.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> Your local computers (Local Computers 1 &
|
|
|
|
|
|
2) should be configured with their<i> default gateway</i> set
|
|
|
|
|
|
to the IP address of the firewall's internal interface and your
|
|
|
|
|
|
DMZ computers ( DMZ Computers 1 & 2) should be configured with
|
|
|
|
|
|
their default gateway set to the IP address of the firewall's DMZ
|
|
|
|
|
|
interface.<2E><> </p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">The foregoing short discussion barely scratches the surface
|
|
|
|
|
|
regarding subnetting and routing. If you are interested in learning
|
|
|
|
|
|
more about IP addressing and routing, I highly recommend <i>"IP Fundamentals:
|
|
|
|
|
|
What Everyone Needs to Know about Addressing & Routing",</i>
|
|
|
|
|
|
Thomas A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">The remainder of this quide will assume that you have configured
|
2003-07-04 18:41:22 +02:00
|
|
|
|
your network as shown here:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="center"> <img border="0" src="images/dmz2.png" width="721"
|
|
|
|
|
|
height="635">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">The default gateway for the DMZ computers would be 10.10.11.254
|
2003-07-04 18:41:22 +02:00
|
|
|
|
and the default gateway for the Local computers would be 10.10.10.254.<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
2003-01-22 01:37:23 +01:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_.gif" width="13"
|
|
|
|
|
|
height="13" alt="">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> <font color="#ff0000"><b>WARNING: </b></font><b>Your ISP<53> might
|
|
|
|
|
|
assign your external interface an RFC 1918 address. If that address is
|
|
|
|
|
|
in the 10.10.10.0/24 subnet then you will need to select a DIFFERENT RFC
|
|
|
|
|
|
1918 subnet for your local network and if it is in the 10.10.11.0/24 subnet
|
|
|
|
|
|
then you will need to select a different RFC 1918 subnet for your DMZ.</b><br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
2003-01-22 01:37:23 +01:00
|
|
|
|
<p align="left">IP Masquerading (SNAT)</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">The addresses reserved by RFC 1918 are sometimes referred
|
|
|
|
|
|
to as <i>non-routable</i> because the Internet backbone routers don't
|
|
|
|
|
|
forward packets which have an RFC-1918 destination address. When
|
|
|
|
|
|
one of your local systems (let's assume local computer 1) sends a
|
|
|
|
|
|
connection request to an internet host, the firewall must perform <i>Network
|
|
|
|
|
|
Address Translation </i>(NAT). The firewall rewrites the source address
|
|
|
|
|
|
in the packet to be the address of the firewall's external interface;
|
|
|
|
|
|
in other words, the firewall makes it look as if the firewall itself
|
|
|
|
|
|
is initiating the connection.<2E> This is necessary so that the destination
|
|
|
|
|
|
host will be able to route return packets back to the firewall (remember
|
|
|
|
|
|
that packets whose destination address is reserved by RFC 1918 can't
|
|
|
|
|
|
be routed accross the internet). When the firewall receives a return
|
|
|
|
|
|
packet, it rewrites the destination address back to 10.10.10.1 and forwards
|
|
|
|
|
|
the packet on to local computer 1. </p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">On Linux systems, the above process is often referred to as<i>
|
|
|
|
|
|
IP Masquerading</i> and you will also see the term <i>Source Network Address
|
|
|
|
|
|
Translation </i>(SNAT) used. Shorewall follows the convention used with
|
|
|
|
|
|
Netfilter:</p>
|
|
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>
|
|
|
|
|
|
<p align="left"><i>Masquerade</i> describes the case where you let your
|
|
|
|
|
|
firewall system automatically detect the external interface address.
|
2003-07-04 18:41:22 +02:00
|
|
|
|
</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</li>
|
|
|
|
|
|
<li>
|
|
|
|
|
|
<p align="left"><i>SNAT</i> refers to the case when you explicitly specify
|
|
|
|
|
|
the source address that you want outbound packets from your local
|
2003-07-04 18:41:22 +02:00
|
|
|
|
network to use. </p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-02-21 23:22:19 +01:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">In Shorewall, both Masquerading and SNAT are configured with
|
2003-07-04 18:41:22 +02:00
|
|
|
|
entries in the /etc/shorewall/masq file.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> If your external firewall interface is <b>eth0</b>,
|
|
|
|
|
|
your local interface <b>eth1 </b>and your DMZ interface is <b>eth2</b>
|
|
|
|
|
|
then you do not need to modify the file provided with the sample. Otherwise,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
edit /etc/shorewall/masq and change it to match your configuration.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> If your external IP is static, you can enter it in
|
|
|
|
|
|
the third column in the /etc/shorewall/masq entry if you like although
|
|
|
|
|
|
your firewall will work fine if you leave that column empty. Entering
|
2003-07-04 18:41:22 +02:00
|
|
|
|
your static IP in column 3 makes <br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
processing outgoing packets a little more efficient.<br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_.gif" width="13"
|
|
|
|
|
|
height="13" alt="">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> If you are using the Debian package, please check your shorewall.conf
|
|
|
|
|
|
file to ensure that the following are set correctly; if they are not,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
change them appropriately:<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>NAT_ENABLED=Yes (Shorewall versions earlier than 1.4.6)</li>
|
|
|
|
|
|
<li>IP_FORWARDING=On<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<h2 align="left">Port Forwarding (DNAT)</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">One of your goals will be to run one or more servers on your
|
|
|
|
|
|
DMZ computers. Because these computers have RFC-1918 addresses, it
|
|
|
|
|
|
is not possible for clients on the internet to connect directly to
|
|
|
|
|
|
them. It is rather necessary for those clients to address their connection
|
|
|
|
|
|
requests to your firewall who rewrites the destination address to
|
|
|
|
|
|
the address of your server and forwards the packet to that server.
|
|
|
|
|
|
When your server responds, the firewall automatically performs SNAT
|
|
|
|
|
|
to rewrite the source address in the response.</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p align="left">The above process is called<i> Port Forwarding</i> or <i>
|
|
|
|
|
|
Destination Network Address Translation</i> (DNAT). You configure
|
|
|
|
|
|
port forwarding using DNAT rules in the /etc/shorewall/rules file.</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>The general form of a simple port forwarding rule in /etc/shorewall/rules
|
2003-07-04 18:41:22 +02:00
|
|
|
|
is:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>DNAT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>dmz:<i><server local ip address> </i>[:<i><server
|
2003-07-04 18:41:22 +02:00
|
|
|
|
port></i>]</td>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><i><protocol></i></td>
|
|
|
|
|
|
<td><i><port></i></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<p>If you don't specify the <i><server port></i>, it is assumed to be
|
|
|
|
|
|
the same as <i><port></i>.</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>Example - you run a Web Server on DMZ 2 and you want to forward incoming
|
2003-07-04 18:41:22 +02:00
|
|
|
|
TCP port 80 to that system:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>DNAT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>dmz:10.10.11.2</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>80</td>
|
|
|
|
|
|
<td># Forward port 80</td>
|
|
|
|
|
|
<td>from the internet</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>dmz:10.10.11.2</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>80</td>
|
|
|
|
|
|
<td>#Allow connections </td>
|
|
|
|
|
|
<td>from the local network</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<p>A couple of important points to keep in mind:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>When you are connecting to your server from your
|
|
|
|
|
|
local systems, you must use the server's internal IP address (10.10.11.2).</li>
|
|
|
|
|
|
<li>Many ISPs block incoming connection requests to
|
|
|
|
|
|
port 80. If you have problems connecting to your web server, try
|
|
|
|
|
|
the following rule and try connecting to port 5000 (e.g., connect
|
|
|
|
|
|
to <a href="http://w.x.y.z:5000"> http://w.x.y.z:5000</a> where w.x.y.z
|
|
|
|
|
|
is your external IP).</li>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>DNAT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>dmz:10.10.11.2:80</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>5000</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<p>If you want to be able to access your server from the local network using
|
|
|
|
|
|
your external address, then if you have a static external IP you
|
2003-07-04 18:41:22 +02:00
|
|
|
|
can replace the loc->dmz rule above with:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>DNAT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>dmz:10.10.11.2:80</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>80</td>
|
|
|
|
|
|
<td>-</td>
|
|
|
|
|
|
<td><i><external IP></i></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<p>If you have a dynamic ip then you must ensure that your external interface
|
|
|
|
|
|
is up before starting Shorewall and you must take steps as follows
|
2003-07-04 18:41:22 +02:00
|
|
|
|
(assume that your external interface is <b>eth0</b>):</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>Include the following in /etc/shorewall/params:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
ETH0_IP=`find_interface_address eth0`<br>
|
|
|
|
|
|
<20></li>
|
|
|
|
|
|
<li>Make your loc->dmz rule:</li>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>DNAT</td>
|
|
|
|
|
|
<td>loc<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td>dmz:10.10.11.2:80</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>80</td>
|
|
|
|
|
|
<td>-</td>
|
|
|
|
|
|
<td>$ETH0_IP</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<p>If you want to access your server from the DMZ using your external IP
|
|
|
|
|
|
address, see <a href="FAQ.htm#faq2a">FAQ 2a</a>.</p>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<p><img border="0" src="images/BD21298_2.gif" width="13" height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> At this point, add the DNAT and ACCEPT rules for
|
|
|
|
|
|
your servers. </p>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<h2 align="left">Domain Name Server (DNS)</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left">Normally, when you connect to your ISP, as part of getting
|
|
|
|
|
|
an IP address your firewall's <i>Domain Name Service </i>(DNS) resolver
|
|
|
|
|
|
will be automatically configured (e.g., the /etc/resolv.conf file
|
|
|
|
|
|
will be written). Alternatively, your ISP may have given you the IP
|
|
|
|
|
|
address of a pair of DNS <i> name servers</i> for you to manually configure
|
|
|
|
|
|
as your primary and secondary name servers. It is <u>your</u> responsibility
|
|
|
|
|
|
to configure the resolver in your internal systems. You can take
|
|
|
|
|
|
one of two approaches:</p>
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<li>
|
|
|
|
|
|
<p align="left">You can configure your internal systems to use your ISP's
|
|
|
|
|
|
name servers. If you ISP gave you the addresses of their servers
|
|
|
|
|
|
or if those addresses are available on their web site, you can configure
|
|
|
|
|
|
your internal systems to use those addresses. If that information
|
|
|
|
|
|
isn't available, look in /etc/resolv.conf on your firewall system
|
|
|
|
|
|
-- the name servers are given in "nameserver" records in that file.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif"
|
|
|
|
|
|
width="13" height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> You can configure a<i> Caching Name Server </i>on
|
|
|
|
|
|
your firewall or in your DMZ.<i> </i>Red Hat has an RPM for a caching
|
|
|
|
|
|
name server (which also requires the 'bind' RPM) and for Bering
|
|
|
|
|
|
users, there is dnscache.lrp. If you take this approach, you configure
|
|
|
|
|
|
your internal systems to use the caching name server as their primary
|
|
|
|
|
|
(and only) name server. You use the internal IP address of the firewall
|
|
|
|
|
|
(10.10.10.254 in the example above) for the name server address if
|
|
|
|
|
|
you choose to run the name server on your firewall. To allow your local
|
|
|
|
|
|
systems to talk to your caching name server, you must open port 53
|
|
|
|
|
|
(both UDP and TCP) from the local network to the server; you do that
|
2003-07-04 18:41:22 +02:00
|
|
|
|
by adding the rules in /etc/shorewall/rules. </p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-02-21 23:22:19 +01:00
|
|
|
|
</ul>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p align="left">If you run the name server on the firewall:
|
|
|
|
|
|
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>udp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>dmz</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>dmz</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>udp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>Run name server on DMZ computer 1</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-01-22 01:37:23 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>dmz:10.10.11.1</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>dmz:10.10.11.1</td>
|
|
|
|
|
|
<td>udp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>dmz:10.10.10.1</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>dmz:10.10.10.1</td>
|
|
|
|
|
|
<td>udp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-22 01:37:23 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<h2 align="left">Other Connections</h2>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<p align="left">The three-interface sample includes the following rules:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>udp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">Those rules allow DNS access from your firewall and may be
|
|
|
|
|
|
removed if you commented out the line in /etc/shorewall/policy
|
2003-07-04 18:41:22 +02:00
|
|
|
|
allowing all connections from the firewall to the internet.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<p align="left">The sample also includes:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>22</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>dmz</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>22</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">That rule allows you to run an SSH server on your firewall
|
|
|
|
|
|
and in each of your DMZ systems and to connect to those servers
|
2003-07-04 18:41:22 +02:00
|
|
|
|
from your local systems.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">If you wish to enable other connections between your systems,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
the general format is:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td><i><source zone></i></td>
|
|
|
|
|
|
<td><i><destination zone></i></td>
|
|
|
|
|
|
<td><i><protocol></i></td>
|
|
|
|
|
|
<td><i><port></i></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">Example - You want to run a publicly-available DNS server
|
2003-07-04 18:41:22 +02:00
|
|
|
|
on your firewall system:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td>#Allow DNS access</td>
|
|
|
|
|
|
<td>from the internet</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>udp<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td>53</td>
|
|
|
|
|
|
<td>#Allow DNS access</td>
|
|
|
|
|
|
<td>from the internet</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-24 21:08:19 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">Those two rules would of course be in addition to the rules
|
2003-07-04 18:41:22 +02:00
|
|
|
|
listed above under "If you run the name server on your firewall".</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">If you don't know what port and protocol a particular application
|
|
|
|
|
|
uses, look <a href="ports.htm">here</a>.</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left"><b>Important: </b>I don't recommend enabling telnet to/from
|
|
|
|
|
|
the internet because it uses clear text (even for login!). If
|
2003-07-04 18:41:22 +02:00
|
|
|
|
you want shell access to your firewall from the internet, use SSH:</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>net</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>22</td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
<td><EFBFBD></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2003-01-31 22:50:51 +01:00
|
|
|
|
<p align="left"> </p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-01-31 22:50:51 +01:00
|
|
|
|
<p align="left"><img src="images/leaflogo.gif" alt="(LEAF Logo)"
|
|
|
|
|
|
width="49" height="36">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> Bering users will want to add the following two rules to be compatible
|
2003-07-04 18:41:22 +02:00
|
|
|
|
with Jacques's Shorewall configuration.<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<blockquote>
|
2003-01-31 22:50:51 +01:00
|
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
|
|
|
|
|
id="AutoNumber4">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<tbody>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<tr>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<td><u><b>ACTION</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE</b></u></td>
|
|
|
|
|
|
<td><u><b>DESTINATION</b></u></td>
|
|
|
|
|
|
<td><u><b>PROTOCOL</b></u></td>
|
|
|
|
|
|
<td><u><b>PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>SOURCE PORT</b></u></td>
|
|
|
|
|
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>udp<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td>53<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td>#Allow DNS Cache to</td>
|
|
|
|
|
|
<td>work<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
|
<td>80</td>
|
|
|
|
|
|
<td>#Allow weblet to work</td>
|
|
|
|
|
|
<td><br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-31 22:50:51 +01:00
|
|
|
|
</table>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> Now modify /etc/shorewall/rules to add or remove
|
|
|
|
|
|
other connections as required.</p>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
</div>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<h2 align="left">Starting and Stopping Your Firewall</h2>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-29 23:42:38 +02:00
|
|
|
|
<p align="left"> <img border="0" src="images/BD21298_2.gif"
|
|
|
|
|
|
width="13" height="13" alt="Arrow">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> The <a href="Install.htm">installation procedure </a>
|
|
|
|
|
|
configures your system to start Shorewall at system boot<6F> but beginning
|
|
|
|
|
|
with Shorewall version 1.3.9 startup is disabled so that your system
|
|
|
|
|
|
won't try to start Shorewall before configuration is complete. Once
|
|
|
|
|
|
you have completed configuration of your firewall, you can enable Shorewall
|
|
|
|
|
|
startup by removing the file /etc/shorewall/startup_disabled.<br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: </font><font
|
2003-07-16 20:59:33 +02:00
|
|
|
|
color="#ff0000">Users of the .deb package must edit /etc/default/shorewall
|
2003-07-04 18:41:22 +02:00
|
|
|
|
and set 'startup=1'.</font><br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left">The firewall is started using the "shorewall start" command
|
|
|
|
|
|
and stopped using "shorewall stop". When the firewall is stopped,
|
2003-07-04 18:41:22 +02:00
|
|
|
|
routing is enabled on those hosts that have an entry in <a
|
2003-07-16 20:59:33 +02:00
|
|
|
|
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. A
|
|
|
|
|
|
running firewall may be restarted using the "shorewall restart"
|
|
|
|
|
|
command. If you want to totally remove any trace of Shorewall from
|
|
|
|
|
|
your Netfilter configuration, use "shorewall clear".</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="left"><img border="0" src="images/BD21298_2.gif" width="13"
|
|
|
|
|
|
height="13">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<20><><EFBFBD> The three-interface sample assumes that you want to
|
|
|
|
|
|
enable routing to/from <b>eth1 (</b>your local network) and<b>
|
|
|
|
|
|
eth2 </b>(DMZ) when Shorewall is stopped. If these two interfaces
|
|
|
|
|
|
don't connect to your local network and DMZ or if you want to enable
|
|
|
|
|
|
a different set of hosts, modify /etc/shorewall/routestopped accordingly.</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div align="left">
|
|
|
|
|
|
<p align="left"><b>WARNING: </b>If you are connected to your firewall from
|
|
|
|
|
|
the internet, do not issue a "shorewall stop" command unless you
|
|
|
|
|
|
have added an entry for the IP address that you are connected from
|
|
|
|
|
|
to <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
|
|
|
|
|
Also, I don't recommend using "shorewall restart"; it is better to
|
|
|
|
|
|
create an <i><a href="configuration_file_basics.htm#Configs">alternate
|
2003-07-04 18:41:22 +02:00
|
|
|
|
configuration</a></i> and test it using the <a
|
2002-11-24 21:08:19 +01:00
|
|
|
|
href="starting_and_stopping_shorewall.htm">"shorewall try" command</a>.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p align="left"><font size="2">Last updated 6/27/2003 - <a
|
2002-09-16 19:13:10 +02:00
|
|
|
|
href="support.htm">Tom Eastep</a></font></p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
|
|
|
|
|
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002, 2003
|
2003-07-04 18:41:22 +02:00
|
|
|
|
Thomas M. Eastep</font></a><br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
<br>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</body>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</html>
|
