shorewall_code/Shorewall-docs/myfiles.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
                                            
  <meta http-equiv="Content-Type"
 content="text/html; charset=windows-1252">
  <title>My Shorewall Configuration</title>
                                                                        
     
  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                                            
  <meta name="ProgId" content="FrontPage.Editor.Document">
                                            
  <meta name="Microsoft Theme" content="none">
</head>
  <body>
                      
<table border="0" cellpadding="0" cellspacing="0"
 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 bgcolor="#3366ff" height="90">
                               <tbody>
                          <tr>
                                 <td width="100%">                      
                                                       
      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
                                 </td>
                               </tr>
                                            
  </tbody>           
</table>
                      
<blockquote> </blockquote>
                      
<h1>My Current Network </h1>
                      
<blockquote>                                 
  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small> 
       use a combination of Static NAT and Proxy ARP, neither of which are 
 relevant      to a simple configuration with a single public IP address.</small></b></big><big><b><small> 
       If you have just a single public IP address, most of what you see here
    won't   apply to your setup so beware of copying parts of this configuration 
    and  expecting them to work for you. What you copy may or may not work 
 in   your configuration.<br>
             </small></b></big></p>
                                           
  <p><big><b><small><big><font color="#ff0000">Warning 2: </font><small>The 
configuration shown here corresponds to Snapshot 1.4.5_20030629 plus a couple 
of patches.</small></big></small></b></big><br>
                 </p>
                                            
  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180). 
           My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> 
Speedport)          is connected to eth0. I have a local network connected 
to eth2 (subnet       192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24) 
and a Wireless   network connected to eth3 (192.168.3.0/24).</p>
                                            
  <p> I use:<br>
                        </p>
                                            
  <ul>
                          <li>Static NAT for Ursa (my XP System) - Internal 
 address     192.168.1.5      and external address 206.124.146.178.</li>
                          <li>Static NAT for Wookie (my Linux System). Internal 
   address    192.168.1.3 and external address 206.124.146.179.</li>
           <li>Static NAT for EastepLaptop (My work system). Internal address 
  192.168.1.7  and external address 206.124.146.180.<br>
           </li>
                          <li>SNAT through the primary gateway address (206.124.146.176) 
       for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
     through the Wireless Access Point (wap) via a Wireless Bridge (bridge).
         <b><br>
               <br>
         Note:</b> While the distance between the WAP and where I usually 
use   the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus 
wireless   card)   has proved very unsatisfactory (lots of lost connections). 
By replacing   the  WAC11 with the WET11 wireless bridge, I have virtually 
eliminated these   problems  (Being an old radio tinkerer (K7JPV), I was also
able to eliminate   the disconnects by hanging a piece of aluminum foil on
the family room wall.   Needless to say, my wife Tarry rejected that as a
permanent solution :-).</li>
                                            
  </ul>
                                            
  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
                                            
  <p> Wookie  and the Firewall both run Samba and the Firewall acts as a WINS
server.<br>
       </p>
                   
  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
in the local zone.</p>
                                            
  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional 
   to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit 
prefix),   I use <a href="MAC_Validation.html">MAC verification.</a> This 
is still a  weak combination and if I lived near a wireless "hot spot", I 
would probably   add IPSEC or something similar to my WiFi-&gt;local connections.<br>
         </p>
                                            
  <p> The single system in the DMZ (address 206.124.146.177) runs postfix, 
          Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an
  FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch 
our  email    from our    old and current ISPs. That server is managed through 
  Proxy ARP.</p>
                                            
  <p> The firewall system itself runs a DHCP server that serves the local 
            network. It also runs Postfix which is configured as a Virus and
   Spam filter with all incoming mail then being forwarded to the MTA in
the    DMZ.</p>
                                            
  <p> All administration and publishing is done using ssh/scp. I have X installed 
      on the firewall but no X server or desktop is installed.     X applications
  tunnel through SSH to XWin.exe running on Ursa. The server does have a
desktop   environment installed and that desktop environment is available
via XDMCP   from the local zone. For the most part though, X tunneled through
SSH is  used for server administration and the server runs at run level 3
(multi-user  console mode on RedHat).</p>
                                            
  <p> I run an SNMP server on my firewall to serve <a
 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running 
          in the DMZ.</p>
                                            
  <p align="center">                           <img border="0"
 src="images/network.png" width="764" height="846"
 alt="(My network layout)">
                        </p>
                                            
  <p><EFBFBD></p>
                                            
  <p>The ethernet interface in the Server is configured         with IP address
     206.124.146.177, netmask    255.255.255.0. The server's default gateway
   is      206.124.146.254 (Router at my ISP. This is the same          
default      gateway used by the firewall itself). On the firewall,     
                           Shorewall automatically adds a host route to 
                           206.124.146.177 through eth1 (192.168.2.1) because
    of                            the entry in /etc/shorewall/proxyarp (see
 below).</p>
                                                            
  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior 
        access.<br>
                   </p>
                                            
  <p><font color="#ff0000" size="5"></font></p>
                 </blockquote>
                      
<h3>Shorewall.conf</h3>
                      
<blockquote>                                 
  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SHOREWALL_SHELL=/bin/ash<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
        </blockquote>
               
<h3>Params File (Edited):</h3>
                      
<blockquote>                              
  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
          </blockquote>
                      
<h3>Zones File</h3>
                      
<blockquote>                                 
  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font></pre>
             </blockquote>
                      
<h3>Interfaces File: </h3>
                      
<blockquote>                                  
  <p> This is set up so that I can start the firewall before bringing up
my Ethernet  interfaces. </p>
                           </blockquote>
                      
<blockquote>                                 
  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font>                </pre>
             </blockquote>
                      
<h3>Hosts File: </h3>
                      
<blockquote>                                 
  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
             </blockquote>
                      
<h3>Routestopped File:</h3>
                      
<blockquote>                                 
  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2">	</font></pre>
             </blockquote>
                      
<h3>Policy File:</h3>
                      
<blockquote>                                 
  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
             </blockquote>
                      
<h3>Masq File: </h3>
                      
<blockquote>                                  
  <p> Although most of our internal systems use static NAT, my wife's system 
           (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors 
   with     laptops. Also, I masquerade systems connected through the wireless
   network.</p>
                        </blockquote>
                      
<blockquote>                                 
  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
       </blockquote>
             
<h3>NAT File: </h3>
             
<blockquote>                                 
  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
             </blockquote>
                                      
<h3>Proxy ARP File:</h3>
                      
<blockquote>                                 
  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
 face="Courier" size="2">     	</font></pre>
             </blockquote>
                      
<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
                      
<blockquote>                                 
  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
             </blockquote>
                      
<h3></h3>
                      
<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
                      
<blockquote>                                 
  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp 
             </blockquote>
                      
<p><font size="2">Last updated 6/30/2003 - <a href="support.htm">Tom Eastep</a></font> 
       </p>
                         <a href="copyright.htm"><font size="2">Copyright</font>
      <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
     <br>
    <br>
   <br>
  <br>
 <br>
</body>
</html>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 								<html>
 								<head>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta http-equiv="Content-Type"
 								 content="text/html; charset=windows-1252">
 								  <title>My Shorewall Configuration</title>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								  <meta name="ProgId" content="FrontPage.Editor.Document">
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="Microsoft Theme" content="none">
 								</head>
 								  <body>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<table border="0" cellpadding="0" cellspacing="0"
 								 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								 bgcolor="#3366ff" height="90">
 								                               <tbody>
 								                          <tr>
 								                                 <td width="100%">
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                                 </td>
 								                               </tr>
 								  </tbody>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</table>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<blockquote> </blockquote>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h1>My Current Network </h1>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
 								  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small>
 								       use a combination of Static NAT and Proxy ARP, neither of which are
 								 relevant      to a simple configuration with a single public IP address.</small></b></big><big><b><small>
 								       If you have just a single public IP address, most of what you see here
 								    won't   apply to your setup so beware of copying parts of this configuration
 								    and  expecting them to work for you. What you copy may or may not work
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								 in   your configuration.<br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </small></b></big></p>
 								  <p><big><b><small><big><font color="#ff0000">Warning 2: </font><small>The
 								configuration shown here corresponds to Snapshot 1.4.5_20030629 plus a couple
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								of patches.</small></big></small></b></big><br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                 </p>
 								  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180).
 								           My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a>
 								Speedport)          is connected to eth0. I have a local network connected
 								to eth2 (subnet       192.168.1.0/24), a DMZ connected to eth1 (192.168.2.0/24)
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								and a Wireless   network connected to eth3 (192.168.3.0/24).</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I use:<br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                        </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <ul>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                          <li>Static NAT for Ursa (my XP System) - Internal
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								 address     192.168.1.5      and external address 206.124.146.178.</li>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                          <li>Static NAT for Wookie (my Linux System). Internal
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								   address    192.168.1.3 and external address 206.124.146.179.</li>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								           <li>Static NAT for EastepLaptop (My work system). Internal address
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+.168.1.7  and external address 206.124.146.180.<br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								           </li>
 								                          <li>SNAT through the primary gateway address (206.124.146.176)
 								       for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
 								     through the Wireless Access Point (wap) via a Wireless Bridge (bridge).
 								         <b><br>
 								               <br>
 								         Note:</b> While the distance between the WAP and where I usually
 								use   the   laptop isn't very far (25 feet or so), using a WAC11 (CardBus
 								wireless   card)   has proved very unsatisfactory (lots of lost connections).
 								By replacing   the  WAC11 with the WET11 wireless bridge, I have virtually
 								eliminated these   problems  (Being an old radio tinkerer (K7JPV), I was also
 								able to eliminate   the disconnects by hanging a piece of aluminum foil on
 								the family room wall.   Needless to say, my wife Tarry rejected that as a
 								permanent solution :-).</li>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  </ul>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <p> The firewall runs on a 256MB PII/233 with RH9.0.</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								  <p> Wookie  and the Firewall both run Samba and the Firewall acts as a WINS
 								server.<br>
 								       </p>
 								  <p>Wookie is in its         own 'whitelist' zone  called 'me' which is embedded
 								in the local zone.</p>
 								  <p>The wireless network connects to eth3 via a LinkSys WAP11.<2E> In additional
 								   to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit
 								prefix),   I use <a href="MAC_Validation.html">MAC verification.</a> This
 								is still a  weak combination and if I lived near a wireless "hot spot", I
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								would probably   add IPSEC or something similar to my WiFi-&gt;local connections.<br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								         </p>
 								  <p> The single system in the DMZ (address 206.124.146.177) runs postfix,
 								          Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an
 								  FTP    server    (Pure-ftpd). The system   also runs fetchmail to fetch
 								our  email    from our    old and current ISPs. That server is managed through
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								  Proxy ARP.</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								  <p> The firewall system itself runs a DHCP server that serves the local
 								            network. It also runs Postfix which is configured as a Virus and
 								   Spam filter with all incoming mail then being forwarded to the MTA in
 								the    DMZ.</p>
 								  <p> All administration and publishing is done using ssh/scp. I have X installed
 								      on the firewall but no X server or desktop is installed.     X applications
 								  tunnel through SSH to XWin.exe running on Ursa. The server does have a
 								desktop   environment installed and that desktop environment is available
 								via XDMCP   from the local zone. For the most part though, X tunneled through
 								SSH is  used for server administration and the server runs at run level 3
 								(multi-user  console mode on RedHat).</p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I run an SNMP server on my firewall to serve <a
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								          in the DMZ.</p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p align="center">                           <img border="0"
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								 src="images/network.png" width="764" height="846"
 								 alt="(My network layout)">
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                        </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><EFBFBD></p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								  <p>The ethernet interface in the Server is configured         with IP address
 .124.146.177, netmask    255.255.255.0. The server's default gateway
 								   is      206.124.146.254 (Router at my ISP. This is the same
 								default      gateway used by the firewall itself). On the firewall,
 								                           Shorewall automatically adds a host route to
 .124.146.177 through eth1 (192.168.2.1) because
 								    of                            the entry in /etc/shorewall/proxyarp (see
 								 below).</p>
 								  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								        access.<br>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                   </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><font color="#ff0000" size="5"></font></p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                 </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Shorewall.conf</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								  <pre>LOGFILE=/var/log/messages<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=$LOG<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SHOREWALL_SHELL=/bin/ash<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP<br>SHARED_DIR=/usr/share/shorewall<br></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								        </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Params File (Edited):</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								TEXAS=<i>&lt;ip address of gateway in Dallas&gt;</i><br>LOG=info<br></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								          </blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								<h3>Zones File</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>WiFi    Wireless        Wireless Network on eth3<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2"><br></font></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								<h3>Interfaces File: </h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
 								  <p> This is set up so that I can start the firewall before bringing up
 								my Ethernet  interfaces. </p>
 								                           </blockquote>
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2"><br></font>                </pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Hosts File: </h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Routestopped File:</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            192.168.3.8<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2">	</font></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Policy File:</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me              loc             NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>WiFi            loc             ACCEPT<br>loc             WiFi            ACCEPT<br>loc             me              NONE<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>WiFi            net             ACCEPT<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Masq File: </h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
 								  <p> Although most of our internal systems use static NAT, my wife's system
 								           (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors
 								   with     laptops. Also, I masquerade systems connected through the wireless
 								   network.</p>
 								                        </blockquote>
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0                    eth2            206.124.146.176<br>eth0                    eth3            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								       </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>NAT File: </h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>206.124.146.180 eth0:2          192.168.1.7     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE\</pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Proxy ARP File:</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								 face="Courier" size="2">     	</font></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br></pre>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								<h3></h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
 								<blockquote>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>DROP            loc:!192.168.1.0/24             fw<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000,smtp,swat,137,139,445<br>ACCEPT          loc                             fw                      udp     snmp,ntp,445<br>ACCEPT          loc                             fw                      udp     137:139<br>ACCEPT          loc                             fw                      udp     1024:                                   137<br>################################################################################################################################################################<br># Local Network to DMZ<br>#<br>ACCEPT          loc                             dmz                     udp     domain,xdmcp<br>ACCEPT          loc                             dmz                     tcp     www,smtp,domain,ssh,imap,https,imaps,cvspserver,ftp,10000,8080,pop3     -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,ftp,imaps,domain,cvspserver,https   -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>#<br># Real Audio<br>#<br>ACCEPT          net                             loc:192.168.1.5         udp     6790<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             loc:192.168.1.3         tcp     4000:4100<br>################################################################################################################################################################<br># DMZ to Internet<br>#<br>ACCEPT          dmz                             net                     tcp     smtp,domain,www,https,whois,echo,2702,21,2703,ssh<br>ACCEPT          dmz                             net                     udp
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								             </blockquote>
 								<p><font size="2">Last updated 6/30/2003 - <a href="support.htm">Tom Eastep</a></font>
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								       </p>
-												Add Corporate Network Example


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@664 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-16 20:59:33 +02:00
+								                         <a href="copyright.htm"><font size="2">Copyright</font>
 								      <20>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
 								     <br>
-												Shorewall-1.4.6 Beta 1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@628 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-07-04 18:41:22 +02:00
+								    <br>
 								   <br>
 								  <br>
-												Shorewall 1.4.5


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@603 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-06-18 22:03:19 +02:00
+								 <br>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</body>
 								</html>