shorewall_code/Shorewall-docs/myfiles.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
    
  <meta http-equiv="Content-Type"
 content="text/html; charset=windows-1252">
  <title>My Shorewall Configuration</title>
        
  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
    
  <meta name="ProgId" content="FrontPage.Editor.Document">
    
  <meta name="Microsoft Theme" content="none">
</head>
  <body>
  
<table border="0" cellpadding="0" cellspacing="0"
 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 bgcolor="#400169" height="90">
                     <tbody>
                <tr>
                       <td width="100%">        
      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
                       </td>
                     </tr>
    
  </tbody> 
</table>
  
<blockquote> </blockquote>
  
<h1>My Current Network </h1>
  
<blockquote>   
  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small> 
  use a combination of Static NAT and Proxy ARP, neither of which are relevant 
  to a simple configuration with a single public IP address.</small></b></big><big><b><small> 
  If you have just a single public IP address, most of what you see here won't
  apply to your setup so beware of copying parts of this configuration and
 expecting them to work for you. What you copy may or may not work in your
configuration.<br>
   </small></b></big></p>
   
  <p><big><b><small><big><font color="#ff0000">Warning 2:</font></big> </small></b></big><b>My 
configuration uses features introduced in Shorewall version 1.4.1.</b><br>
       </p>
    
  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180). 
      My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> Speedport) 
     is connected to eth0. I have a local network connected to eth2 (subnet 
  192.168.1.0/24)     and a DMZ connected to eth1 (192.168.2.0/24).<2E></p>
    
  <p> I use:<br>
              </p>
    
  <ul>
                <li>Static NAT for Ursa (my XP System) - Internal address 
192.168.1.5      and external address 206.124.146.178.</li>
                <li>Static NAT for Wookie (my Linux System). Internal address 
 192.168.1.3 and external address 206.124.146.179.</li>
                <li>SNAT through the primary gateway address (206.124.146.176) 
  for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
through the Wireless Access Point (wap)</li>
    
  </ul>
    
  <p> The firewall runs on a 256MB PII/233 with RH8.0.</p>
    
  <p> Wookie  runs Samba and acts as the a WINS server.<2E> Wookie is in its 
     own 'whitelist' zone  called 'me'.</p>
    
  <p> My laptop (eastept1) is connected to eth3 using a cross-over cable. 
     It runs its own <a href="http://www.sygate.com"> Sygate</a> firewall 
software     and is managed by Proxy ARP. It connects to the  local network 
through a PPTP server running on Ursa. </p>
    
  <p> The single system in the DMZ (address 206.124.146.177) runs postfix, 
     Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP 
 server    (Pure-ftpd). The system   also runs fetchmail to fetch our email 
 from our    old and current ISPs. That server is managed through Proxy ARP.</p>
    
  <p> The firewall system itself runs a DHCP server that serves the local 
       network.</p>
    
  <p> All administration and publishing is done using ssh/scp. I have X installed 
 on both the firewall and the server but no X server or desktop is installed. 
 X applications tunnel through SSH to XWin.exe running on Ursa.</p>
    
  <p> I run an SNMP server on my firewall to serve <a
 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running 
     in the DMZ.</p>
    
  <p align="center">                           <img border="0"
 src="images/network.png" width="764" height="846">
              </p>
    
  <p><EFBFBD></p>
    
  <p>The ethernet interface in the Server is configured         with IP address
206.124.146.177, netmask    255.255.255.0. The server's default gateway is 
    206.124.146.254 (Router at my ISP. This is the same           default
gateway used by the firewall itself). On the firewall,                  
              Shorewall automatically adds a host route to              
              206.124.146.177 through eth1 (192.168.2.1) because     of 
                         the entry in /etc/shorewall/proxyarp (see  below).</p>
    
  <p>A similar setup is used on eth3 (192.168.3.1) which           interfaces
to my laptop (206.124.146.180).<br>
         </p>
    
  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior 
   access.<br>
         </p>
    
  <p><font color="#ff0000" size="5"></font></p>
       </blockquote>
  
<h3>Shorewall.conf</h3>
  
<blockquote>   
  <pre>SHARED_DIR=/usr/share/shorewall<br>LOGFILE=/var/log/firewall<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=info<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>NAT_ENABLED=Yes<br>MANGLE_ENABLED=Yes<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>MULTIPORT=Yes<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP</pre>
   </blockquote>
  
<h4> </h4>
  
<h3>Params File (Edited):</h3>
  
<blockquote>
  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
TEXAS=<i>&lt;ip address of gateway in Dallas&gt;<br></i>LOG=ULOG<br></pre>
</blockquote>
  
<h3>Zones File</h3>
  
<blockquote>   
  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font></pre>
   </blockquote>
  
<h3>Interfaces File: </h3>
  
<blockquote>    
  <p> This is set up so that I can start the firewall before bringing up
my Ethernet  interfaces. </p>
                 </blockquote>
  
<blockquote>   
  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp,maclist<br>dmz     eth1            192.168.2.255<br>net     eth3            206.124.146.255<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2"><br></font>                </pre>
   </blockquote>
  
<h3>Hosts File: </h3>
  
<blockquote>   
  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
   </blockquote>
  
<h3>Routestopped File:</h3>
  
<blockquote>   
  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            206.124.146.180<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 face="Courier" size="2">	</font></pre>
   </blockquote>
  
<h3>Policy File:</h3>
  
<blockquote>   
  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me		loc		NONE<br>loc		me		NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
   </blockquote>
  
<h3>Masq File: </h3>
  
<blockquote>    
  <p> Although most of our internal systems use static NAT, my wife's system 
      (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with 
   laptops. Also, I masquerade wookie to the peer subnet in Texas.</p>
              </blockquote>
  
<blockquote>   
  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0:0.0.0.0/0          eth2            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br><font
 size="2" face="Courier">	</font></pre>
   </blockquote>
  
<h3>NAT File: </h3>
  
<blockquote>   
  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<font
 size="2" face="Courier"></font></pre>
   </blockquote>
  
<h3>Proxy ARP File:</h3>
  
<blockquote>   
  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>206.124.146.180         eth3            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
 face="Courier" size="2">     	</font></pre>
   </blockquote>
  
<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
  
<blockquote>   
  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br><small>	</small></pre>
   </blockquote>
  
<h3>Common File:</h3>
  
<blockquote>   
  <pre>. /etc/shorewall/common.def<br>run_iptables -A common -p tcp --dport auth -j REJECT<br></pre>
   </blockquote>
  
<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
  
<blockquote>   
  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>LOG:$LOG        loc                             net                     tcp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000<br>ACCEPT          loc                             fw                      udp     snmp<br>ACCEPT          loc                             fw                      udp     ntp<br>################################################################################################################################################################<br># Local Network to DMZ (10027 is our SMTP backdoor that bypasses virus/spam filtering)<br>#<br>ACCEPT          loc                             dmz                     udp     domain<br>ACCEPT          loc                             dmz                     tcp     smtp,domain,ssh,imap,https,imaps,cvspserver,www,ftp,10027,10000,8080    -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,smtp,ftp,imaps,domain,cvspserver,https,imap -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># My laptop isn't NATTED when in its docking station. To allow access to the local lan, I need a VPN to Ursa which is enabled by the following "half"-rules.<br>#<br>DNAT-           net                             loc:192.168.1.5         tcp     1723                                    -               206.124.146.178<br>DNAT-           net                             loc:192.168.1.5         gre     -                                       -               206.124.146.178<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ to Ursa<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             me:192.168.1.3          tcp     4000:4100<br>###################################################################################
   </blockquote>
  
<p><font size="2"><a href="support.htm">Tom Eastep</a></font>        </p>
               <a href="copyright.htm"><font size="2">Copyright</font>  
<EFBFBD>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
</body>
</html>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 								<html>
 								<head>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta http-equiv="Content-Type"
 								 content="text/html; charset=windows-1252">
 								  <title>My Shorewall Configuration</title>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								  <meta name="ProgId" content="FrontPage.Editor.Document">
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <meta name="Microsoft Theme" content="none">
 								</head>
 								  <body>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<table border="0" cellpadding="0" cellspacing="0"
 								 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 								 bgcolor="#400169" height="90">
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								                     <tbody>
 								                <tr>
 								                       <td width="100%">
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								      <h1 align="center"><font color="#ffffff">About My Network</font></h1>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								                       </td>
 								                     </tr>
 								  </tbody>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</table>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<blockquote> </blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h1>My Current Network </h1>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
 								  <p><big><font color="#ff0000"><b>Warning 1: </b></font><b><small>I</small></b></big><big><b><small>
 								  use a combination of Static NAT and Proxy ARP, neither of which are relevant
 								  to a simple configuration with a single public IP address.</small></b></big><big><b><small>
 								  If you have just a single public IP address, most of what you see here won't
 								  apply to your setup so beware of copying parts of this configuration and
 								 expecting them to work for you. What you copy may or may not work in your
 								configuration.<br>
 								   </small></b></big></p>
 								  <p><big><b><small><big><font color="#ff0000">Warning 2:</font></big> </small></b></big><b>My
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								configuration uses features introduced in Shorewall version 1.4.1.</b><br>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								       </p>
 								  <p> I have DSL service and have 5 static IP addresses (206.124.146.176-180).
 								      My DSL   "modem" (<a href="http://www.fujitsu.com">Fujitsu</a> Speedport)
 								     is connected to eth0. I have a local network connected to eth2 (subnet
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+.168.1.0/24)     and a DMZ connected to eth1 (192.168.2.0/24).<2E></p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I use:<br>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								              </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <ul>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								                <li>Static NAT for Ursa (my XP System) - Internal address
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+.168.1.5      and external address 206.124.146.178.</li>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								                <li>Static NAT for Wookie (my Linux System). Internal address
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+.168.1.3 and external address 206.124.146.179.</li>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								                <li>SNAT through the primary gateway address (206.124.146.176)
 								  for<6F>   my Wife's system (Tarry) and our<75> laptop (Tipper) which connects
 								through the Wireless Access Point (wap)</li>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  </ul>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								  <p> The firewall runs on a 256MB PII/233 with RH8.0.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p> Wookie  runs Samba and acts as the a WINS server.<2E> Wookie is in its
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								     own 'whitelist' zone  called 'me'.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p> My laptop (eastept1) is connected to eth3 using a cross-over cable.
 								     It runs its own <a href="http://www.sygate.com"> Sygate</a> firewall
 								software     and is managed by Proxy ARP. It connects to the  local network
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								through a PPTP server running on Ursa. </p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p> The single system in the DMZ (address 206.124.146.177) runs postfix,
 								     Courier  IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP
 								 server    (Pure-ftpd). The system   also runs fetchmail to fetch our email
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								 from our    old and current ISPs. That server is managed through Proxy ARP.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p> The firewall system itself runs a DHCP server that serves the local
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								       network.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p> All administration and publishing is done using ssh/scp. I have X installed
 								 on both the firewall and the server but no X server or desktop is installed.
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								 X applications tunnel through SSH to XWin.exe running on Ursa.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p> I run an SNMP server on my firewall to serve <a
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								 href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG</a> running
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								     in the DMZ.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p align="center">                           <img border="0"
 								 src="images/network.png" width="764" height="846">
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								              </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><EFBFBD></p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								  <p>The ethernet interface in the Server is configured         with IP address
 .124.146.177, netmask    255.255.255.0. The server's default gateway is
 .124.146.254 (Router at my ISP. This is the same           default
 								gateway used by the firewall itself). On the firewall,
 								              Shorewall automatically adds a host route to
 .124.146.177 through eth1 (192.168.2.1) because     of
 								                         the entry in /etc/shorewall/proxyarp (see  below).</p>
 								  <p>A similar setup is used on eth3 (192.168.3.1) which           interfaces
 								to my laptop (206.124.146.180).<br>
 								         </p>
 								  <p>Ursa (192.168.1.5 AKA 206.124.146.178) runs a PPTP server for Road Warrior
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								   access.<br>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								         </p>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <p><font color="#ff0000" size="5"></font></p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								       </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Shorewall.conf</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>SHARED_DIR=/usr/share/shorewall<br>LOGFILE=/var/log/firewall<br>LOGRATE=<br>LOGBURST=<br>LOGUNCLEAN=info<br>BLACKLIST_LOGLEVEL=<br>LOGNEWNOTSYN=<br>MACLIST_LOG_LEVEL=$LOG<br>TCP_FLAGS_LOG_LEVEL=$LOG<br>RFC1918_LOG_LEVEL=$LOG<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin<br>SUBSYSLOCK=/var/lock/subsys/shorewall<br>STATEDIR=/var/state/shorewall<br>MODULESDIR=<br>FW=fw<br>NAT_ENABLED=Yes<br>MANGLE_ENABLED=Yes<br>IP_FORWARDING=On<br>ADD_IP_ALIASES=Yes<br>ADD_SNAT_ALIASES=Yes<br>TC_ENABLED=Yes<br>CLEAR_TC=No<br>MARK_IN_FORWARD_CHAIN=No<br>CLAMPMSS=Yes<br>ROUTE_FILTER=No<br>NAT_BEFORE_RULES=No<br>MULTIPORT=Yes<br>DETECT_DNAT_IPADDRS=Yes<br>MUTEX_TIMEOUT=60<br>NEWNOTSYN=Yes<br>BLACKLIST_DISPOSITION=DROP<br>MACLIST_DISPOSITION=REJECT<br>TCP_FLAGS_DISPOSITION=DROP</pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								<h4> </h4>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Params File (Edited):</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
-												Shorewall-1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@519 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-23 19:47:54 +01:00
+								<blockquote>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								  <pre>MIRRORS=<i>&lt;list of shorewall mirror ip addresses&gt;</i><br>NTPSERVERS=<i>&lt;list of the NTP servers I sync with&gt;</i>
 								TEXAS=<i>&lt;ip address of gateway in Dallas&gt;<br></i>LOG=ULOG<br></pre>
 								</blockquote>
 								<h3>Zones File</h3>
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ZONE	DISPLAY		COMMENTS<br>net     Internet        Internet<br>me      Wookie          My Linux Workstation<br>dmz     DMZ             Demilitarized zone<br>loc     Local           Local networks<br>tx      Texas           Peer Network in Dallas<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 								 face="Courier" size="2"><br></font></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								<h3>Interfaces File: </h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
 								  <p> This is set up so that I can start the firewall before bringing up
 								my Ethernet  interfaces. </p>
 								                 </blockquote>
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ZONE	INERFACE	BROADCAST	OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp,maclist<br>dmz     eth1            192.168.2.255<br>net     eth3            206.124.146.255<br>-       texas           192.168.9.255<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 								 face="Courier" size="2"><br></font>                </pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Hosts File: </h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ZONE		HOST(S)			OPTIONS<br>me<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2:192.168.1.3<br>tx<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> texas:192.168.8.0/22<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE</pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Routestopped File:</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#INTERFACQ	HOST(S)<br>eth1            206.124.146.177<br>eth2            -<br>eth3            206.124.146.180<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<font
 								 face="Courier" size="2">	</font></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Policy File:</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												Shorewall 1.4.1


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@518 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-22 01:25:40 +01:00
+								  <pre>#SOURCE		DESTINATION	POLICY		LOG LEVEL	BURST:LIMIT<br>me		loc		NONE<br>loc		me		NONE<br>me              all             ACCEPT<br>tx              me              ACCEPT<br>all             me              CONTINUE        -               2/sec:5<br>loc             net             ACCEPT<br>$FW             loc             ACCEPT<br>$FW             tx              ACCEPT<br>loc             tx              ACCEPT<br>loc             fw              REJECT          $LOG<br>net             all             DROP            $LOG            10/sec:40<br>all             all             REJECT          $LOG<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Masq File: </h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
 								  <p> Although most of our internal systems use static NAT, my wife's system
 								      (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with
-												More 1.4.0 Updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-03-07 00:41:31 +01:00
+								   laptops. Also, I masquerade wookie to the peer subnet in Texas.</p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								              </blockquote>
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#INTERFACE              SUBNET          ADDRESS<br>eth0:0.0.0.0/0          eth2            206.124.146.176<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br><font
 								 size="2" face="Courier">	</font></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>NAT File: </h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>206.124.146.178 eth0:0          192.168.1.5     No                      No<br>206.124.146.179 eth0:1          192.168.1.3     No                      No<br>192.168.1.193   eth2:0          206.124.146.177 No                      No<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<font
 								 size="2" face="Courier"></font></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Proxy ARP File:</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#ADDRESS                INTERFACE       EXTERNAL        HAVEROUTE<br>206.124.146.177         eth1            eth0            No<br>206.124.146.180         eth3            eth0            No<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<font
 								 face="Courier" size="2">     	</font></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Tunnels File (Shell variable TEXAS set in /etc/shorewall/params):</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>#TYPE			ZONE    GATEWAY         GATEWAY ZONE    PORT<br>gre                     net     $TEXAS<br>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br><small>	</small></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<h3>Common File:</h3>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>. /etc/shorewall/common.def<br>run_iptables -A common -p tcp --dport auth -j REJECT<br></pre>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
 								<h3>Rules File (The shell variables      are set in /etc/shorewall/params):</h3>
 								<blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								  <pre>################################################################################################################################################################<br>#RESULT         CLIENT(S)                       SERVER(S)               PROTO   PORT(S)                                 CLIENT          ORIGINAL DEST:SNAT<br>################################################################################################################################################################<br># Local Network to Internet - Reject attempts by Trojans to call home<br>#<br>REJECT:$LOG     loc                             net                     tcp     6667<br>#<br># Stop NETBIOS crap since our policy is ACCEPT<br>#<br>REJECT          loc                             net                     tcp     137,445<br>REJECT          loc                             net                     udp     137:139<br>LOG:$LOG        loc                             net                     tcp     137:139<br>################################################################################################################################################################<br># Local Network to Firewall<br>#<br>ACCEPT          loc                             fw                      tcp     ssh,time,10000<br>ACCEPT          loc                             fw                      udp     snmp<br>ACCEPT          loc                             fw                      udp     ntp<br>################################################################################################################################################################<br># Local Network to DMZ (10027 is our SMTP backdoor that bypasses virus/spam filtering)<br>#<br>ACCEPT          loc                             dmz                     udp     domain<br>ACCEPT          loc                             dmz                     tcp     smtp,domain,ssh,imap,https,imaps,cvspserver,www,ftp,10027,10000,8080    -<br>################################################################################################################################################################<br># Internet to DMZ<br>#<br>ACCEPT          net                             dmz                     tcp     www,smtp,ftp,imaps,domain,cvspserver,https,imap -<br>ACCEPT          net                             dmz                     udp     domain<br>ACCEPT          net:$MIRRORS                    dmz                     tcp     rsync<br>ACCEPT:$LOG     net                             dmz                     tcp     32768:61000                             20<br>DROP            net                             dmz                     tcp     1433<br>################################################################################################################################################################<br>#<br># Net to Local<br>#<br># My laptop isn't NATTED when in its docking station. To allow access to the local lan, I need a VPN to Ursa which is enabled by the following "half"-rules.<br>#<br>DNAT-           net                             loc:192.168.1.5         tcp     1723                                    -               206.124.146.178<br>DNAT-           net                             loc:192.168.1.5         gre     -                                       -               206.124.146.178<br>#<br># When I'm "on the road", the following two rules allow me VPN access back home.<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     1723<br>ACCEPT          net                             loc:192.168.1.5         gre<br>#<br># ICQ to Ursa<br>#<br>ACCEPT          net                             loc:192.168.1.5         tcp     4000:4100<br>################################################################################################################################################################<br># Net to me<br>#<br>ACCEPT          net                             me:192.168.1.3          tcp     4000:4100<br>###################################################################################
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								   </blockquote>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								<p><font size="2"><a href="support.htm">Tom Eastep</a></font>        </p>
-												Documentation updates


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-05-15 21:39:23 +02:00
+								               <a href="copyright.htm"><font size="2">Copyright</font>
 								<EFBFBD>  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-												'check' is back in


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@476 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-28 03:12:52 +01:00
+								</body>
 								</html>