diff --git a/Shorewall-docs/Documentation.htm b/Shorewall-docs/Documentation.htm index 8964733a5..8df5e20c0 100644 --- a/Shorewall-docs/Documentation.htm +++ b/Shorewall-docs/Documentation.htm @@ -1,2712 +1,2862 @@ - - - - - Shorewall 1.3 Documentation - - - - - - - - - - - -
-

Shorewall 1.3 Reference

-
- - - -

This documentation is intended primarily for reference. - Step-by-step instructions for configuring Shorewall in common setups may - be found in the QuickStart Guides.

- - - -

Components

- -

Shorewall consists of the following components:

- - - - -

- /etc/shorewall/params

- -

You may use the file /etc/shorewall/params - file to set shell variables that you can then use in some of the other - configuration files.

- -

It is suggested that variable names begin with an upper case letter - to distinguish them from variables used internally within the -Shorewall programs

- -

Example:

- - 
 	NET_IF=eth0
-	NET_BCAST=130.252.100.255
-	NET_OPTIONS=noping,norfc1918
-

Example (/etc/shorewall/interfaces record):

- 
	net $NET_IF $NET_BCAST $NET_OPTIONS
-

The result will be the same as if the record had been written

- 
	net eth0 130.252.100.255 noping,norfc1918
-

Variables may be used anywhere in the - other configuration files.

- -

- /etc/shorewall/zones

- -

This file is used - to define the network zones. There is one entry in /etc/shorewall/zones - for each zone; Columns in an entry are:

- - - - -

The /etc/shorewall/zones file released with Shorewall - is as follows:

- - - - - - - - - - - - - - - - - - - - - - - - - - -
- ZONE - DISPLAY - COMMENTS
netNetInternet
locLocalLocal networks
dmzDMZDemilitarized zone
-

You may -add, delete and modify entries in the /etc/shorewall/zones file as desired -so long as you have at least one zone defined.

- -

- Warning 1: If you rename or delete a zone, -you should perform "shorewall stop; shorewall start" to install the change -rather than "shorewall restart".

- -

Warning 2: The - order of entries in the /etc/shorewall/zones file is significant in - some cases.

- -

- /etc/shorewall/interfaces

- -

This file -is used to tell the firewall which of your firewall's network interfaces -are connected to which zone. There will be one entry in /etc/shorewall/interfaces -for each of your interfaces. Columns in an entry are:

- - -

Example - 1: You have a conventional firewall setup in which eth0 connects to a -Cable or DSL modem and eth1 connects to your local network and eth0 gets - its IP address via DHCP. You want to ignore ping requests from the internet - and you want to check all packets entering from the internet - against the black list. Your /etc/shorewall/interfaces file would be as follows:

- -
- - - - - - - - - - - - - - - - - - - - - - -
- ZONE - INTERFACE - BROADCAST - OPTIONS
neteth0detectdhcp,noping,norfc1918,blacklist
loceth1detect 
- -

Example - 2: You have a standalone dialup GNU/Linux System. Your /etc/shorewall/interfaces - file would be:

- -
- - - - - - - - - - - - - - - - - - -
- ZONE - INTERFACE - BROADCAST - OPTIONS
netppp0  
- -

Example 3: You have local interface eth1 with two IP - addresses - 192.168.1.1/24 and 192.168.12.1/24

- -
- - - - - - - - - - - - - - - -
- ZONE - INTERFACE - BROADCAST - OPTIONS
loceth1192.168.1.255,192.168.12.255 
-
- -

- /etc/shorewall/hosts Configuration

- -

For most applications, specifying zones entirely - in terms of network interfaces is sufficient. There may be times though - where you need to define a zone to be a more general collection of hosts. - This is the purpose of the /etc/shorewall/hosts file.

- - -

WARNING: 90% of - Shorewall users don't need to put entries in this file and - 80% of those who try to add such entries do it wrong. - Unless you are ABSOLUTELY SURE that you need entries in - this file, don't touch it.

- - -

Columns in this -file are:

- - - - - -
- -
    - -
  1. An IP address (example - eth1:192.168.1.3)
    2. - -
  2. A subnet in the form <subnet address>/<width> - (example - eth2:192.168.2.0/2)
    3. - -
- -

The interface name much match an entry in - /etc/shorewall/interfaces.

-
- - - - -
- -

routestopped - Beginning with Shorewall - 1.3.4, this option is deprecated in favor of the - /etc/shorewall/routestopped - file. When the firewall is stopped, - traffic to and from this host (these hosts) will be accepted and routing - will occur between this host and other routestopped interfaces - and hosts.

-
- -

If you don't define any hosts for a zone, the - hosts in the zone default to i0:0.0.0.0/0 , i1:0.0.0.0/0, ... where i0, - i1, ... are the interfaces to the zone.

- -

Note 1: - You probably DON'T want to specify any hosts for your internet zone -since the hosts that you specify will be the only ones that you will be -able to access without adding additional rules.

- -

Note 2: - - - The setting of the MERGE_HOSTS variable in - /etc/shorewall/shorewall.conf has - an important effect on how the host file is processed. - Please read the description of that variable - carefully.

- -

Example:

- -

Your local interface is eth1 and you have two - groups of local hosts that you want to make into separate zones:

- - - - -

- Your /etc/shorewall/interfaces file might look like:

- -
- - - - - - - - - - - - - - - - - - - - - - - -
- ZONE - INTERFACE - BROADCAST - OPTIONS
neteth0detectdhcp,noping,norfc1918
-eth1detect 
- -

- The '-' in the ZONE column for eth1 tells Shorewall that eth1 interfaces - to multiple zones.

- -

- Your /etc/shorewall/hosts file might look like:

- -
- - - - - - - - - - - - - - - - - - - - - - - - -
- ZONE - HOST(S) - OPTIONS
loc1eth1:192.168.1.0/25 
loc2eth1:192.168.1.128/25routestopped
- -

- Hosts in 'loc2' can communicate with the firewall while Shorewall is stopped - -- those in 'loc1' cannot.

- -

- Nested and Overlapping Zones

- -

- The /etc/shorewall/interfaces and /etc/shorewall/hosts file allow you -to define nested or overlapping zones. Such overlapping/nested zones are - allowed and Shorewall processes zones in the order that they appear in -the /etc/shorewall/zones file. So if you have nested zones, you want the -sub-zone to appear before the super-zone and in the case of overlapping -zones, the rules that will apply to hosts that belong to both zones is determined -by which zone appears first in /etc/shorewall/zones.

- -

- Hosts that belong to more than -one zone may be managed by the rules of all of those zones. This is done through - use of the special CONTINUE policy - described below.

- -

- /etc/shorewall/policy Configuration.

- -

This file is used to describe the firewall - policy regarding establishment of connections. Connection establishment - is described in terms of clients who initiate connections and - servers who receive those connection requests. Policies defined in - /etc/shorewall/policy describe which zones are allowed to establish connections - with other zones.

- -

Policies established in /etc/shorewall/policy - can be viewed as default policies. If no rule in /etc/shorewall/rules -applies to a particular connection request then the policy from /etc/shorewall/policy - is applied.

- -

Four policies are defined:

- - - - -

- For each policy specified in /etc/shorewall/policy, you can indicate -that you want a message sent to your system log each time that the policy -is applied.

- -

- Entries in /etc/shorewall/policy have four columns as follows:

- -
    - -
  1. - - SOURCE - The name of a client zone (a zone defined in the - /etc/shorewall/zones file - , the name of the firewall zone or "all").
    2. - -
  2. - - DEST - The name of a destination zone (a zone defined in the - /etc/shorewall/zones file - , the name of the firewall zone or "all").
    3. - -
  3. - - POLICY - The default policy for connection requests from the SOURCE - zone to the DESTINATION zone.
    4. - -
  4. - - LOG LEVEL - Optional. If left empty, no log message is generated when - the policy is applied. Otherwise, this column should contain an integer - or name indicating a syslog level. See the syslog.conf man page for - a description of each log level.
    5. - -
  5. - LIMIT:BURST - Optional. If left empty, TCP - connection requests from the SOURCE zone to the DEST zone will - not be rate-limited. Otherwise, this column specifies the maximum rate at - which TCP connection requests will be accepted followed by a colon (":") - followed by the maximum burst size that will be tolerated. Example: - 10/sec:40 specifies that the maximum rate of TCP connection requests - allowed will be 10 per second and a burst of 40 connections will be tolerated. - Connection requests in excess of these limits will be dropped.
    6. - -
- -

- In the SOURCE and DEST columns, you can enter "all" to indicate all -zones. 

- -

- The policy file installed by default is as follows:

- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SOURCEDEST - POLICY - LOG LEVELLIMIT:BURST
locnetACCEPT  
netallDROPinfo 
allallREJECTinfo 
- -

- This table may be interpreted as follows:

- - -

- WARNING:

-

- The firewall script processes  the /etc/shorewall/policy file -from top to bottom and uses the first applicable policy that it finds. - For example, in the following policy file, the policy for (loc, loc) - connections would be ACCEPT as specified in the first entry even though - the third entry in the file specifies REJECT.

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + Shorewall 1.3 Documentation + + + + + + + +
SOURCEDESTPOLICYLOG LEVELLIMIT:BURST
locallACCEPT  
netallDROPinfo 
loclocREJECTinfo 
+ + + + - + +
+

Shorewall 1.3 Reference

+
+ +

This documentation is intended primarily for reference. + Step-by-step instructions for configuring Shorewall in common setups +may be found in the QuickStart +Guides.

+ +

Components

+ +

Shorewall consists of the following components:

+ + + +

/etc/shorewall/params

+ +

You may use the file /etc/shorewall/params file to set shell variables +that you can then use in some of the other configuration files.

+ +

It is suggested that variable names begin with an upper case letter to distinguish them from variables used internally +within the Shorewall programs

+ +

Example:

+ +
 	NET_IF=eth0
	NET_BCAST=130.252.100.255
	NET_OPTIONS=noping,norfc1918
+ +

Example (/etc/shorewall/interfaces record):

+ +
	net $NET_IF $NET_BCAST $NET_OPTIONS
+ +

The result will be the same as if the record had been written

+ +
	net eth0 130.252.100.255 noping,norfc1918
+ +

Variables may be used anywhere in the other configuration +files.

+ +

/etc/shorewall/zones

+ +

This file is used to define the network zones. There is one entry +in /etc/shorewall/zones for each zone; Columns in an entry are:

+ + + +

The /etc/shorewall/zones file released with Shorewall is as follows:

+ + + + + + + + + + + + + + + + + + + + + + + + + +
ZONE DISPLAY COMMENTS
netNetInternet
locLocalLocal networks
dmzDMZDemilitarized zone
-
-

- The CONTINUE policy

-

- Where zones are nested or overlapping - , the CONTINUE policy allows hosts that are within multiple zones to be -managed under the rules of all of these zones. Let's look at an example:

-

- /etc/shorewall/zones:

-
- - - - - - - +

You may add, delete and modify entries in the /etc/shorewall/zones file + as desired so long as you have at least one zone defined.

+ +

Warning 1: If you rename or delete a zone, you should perform "shorewall +stop; shorewall start" to install the change rather than "shorewall restart".

+ +

Warning 2: The order of entries in the /etc/shorewall/zones file is +significant in some cases.

+ +

/etc/shorewall/interfaces

+ +

This file is used to tell the firewall which of your firewall's network + interfaces are connected to which zone. There will be one entry in /etc/shorewall/interfaces + for each of your interfaces. Columns in an entry are:

+ + + +

Example 1: You have a conventional firewall setup in which eth0 connects + to a Cable or DSL modem and eth1 connects to your local network and eth0 +gets its IP address via DHCP. You want to ignore ping requests from the +internet and you want to check all packets entering from +the internet against the black list. +Your /etc/shorewall/interfaces file would be as follows:

+ +
+
- ZONE - DISPLAY - COMMENTS
+ + + + + + + + + + + + + + + + + + + + + + + +
ZONE INTERFACE BROADCAST OPTIONS
neteth0detectdhcp,noping,norfc1918,blacklist
loceth1detect 
+
+ +

Example 2: You have a standalone dialup GNU/Linux System. Your /etc/shorewall/interfaces + file would be:

+ +
+ + + + + + + + + + + + + + + + + + +
ZONE INTERFACE BROADCAST OPTIONS
netppp0  
+
+ + +

Example 3: You have local interface eth1 with two IP + addresses - 192.168.1.1/24 and 192.168.12.1/24

+ +
+ + - - - - - - - - - - - - - - + + + + + + + + + + + + + + +
samSamSam's system at home
netInternetThe Internet
locLocLocal Network
ZONE INTERFACE BROADCAST OPTIONS
loceth1192.168.1.255,192.168.12.255 
+
+ + +

/etc/shorewall/hosts +Configuration

+ +

For most applications, specifying zones entirely in terms of network + interfaces is sufficient. There may be times though where you need to define +a zone to be a more general collection of hosts. This is the purpose of +the /etc/shorewall/hosts file.

+ + +

WARNING: 90% of +Shorewall users don't need to put entries in this file and + 80% of those who try to add such entries do it wrong. + Unless you are ABSOLUTELY SURE that you need entries in + this file, don't touch it.

+ + +

Columns in this file are:

+ + + + +
+ +
    + +
  1. An IP address (example - eth1:192.168.1.3)
    2. + +
  2. A subnet in the form <subnet address>/<width> + (example - eth2:192.168.2.0/2)
    3. + + +
+ + +

The interface name much match an entry in /etc/shorewall/interfaces.

+
+ + - - - -

- /etc/shorewall/interfaces:

-
- - - - - - - - - - - - - - - - - - - - +
+ +

routestopped - Beginning with Shorewall + 1.3.4, this option is deprecated in favor of the + /etc/shorewall/routestopped + file. When the firewall is stopped, traffic to and from + this host (these hosts) will be accepted and routing will occur between +this host and other routestopped interfaces and hosts.

+
- - - -
- ZONE - INTERFACE - BROADCAST - OPTIONS
-eth0detectdhcp,noping,norfc1918
loceth1detectroutestopped
-

- /etc/shorewall/hosts:

-
- - - - - - - - - - - - - - - - - - - + +

If you don't define any hosts for a zone, the hosts in the zone default + to i0:0.0.0.0/0 , i1:0.0.0.0/0, ... where i0, i1, ... are the interfaces +to the zone.

- - - -
- ZONE - HOST(S) - OPTIONS
neteth0:0.0.0.0/0 
sameth0:206.191.149.197routestopped
-

- Note that Sam's home system is a member of both the sam zone and -the net zone and - as described above - , that means that sam must be listed before net  in /etc/shorewall/zones.

-

- /etc/shorewall/policy:

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +

Note 1: You probably DON'T +want to specify any hosts for your internet zone since the hosts that +you specify will be the only ones that you will be able to access without +adding additional rules.

- - - -
- SOURCE - DEST - POLICY - LOG LEVEL
locnetACCEPT 
samallCONTINUE 
netallDROPinfo
allallREJECTinfo
-

- The second entry above says that when Sam is the client, connection requests - should first be process under rules where the source zone is sam and -if there is no match then the connection request should be treated under - rules where the source zone is net. It is important that this policy - be listed BEFORE the next policy (net to all).

-

- Partial /etc/shorewall/rules:

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
...      
DNATsamloc:192.168.1.3tcpssh- 
DNATnetloc:192.168.1.5tcpwww- 
...      
-

- Given these two rules, Sam can connect to the firewall's internet interface - with ssh and the connection request will be forwarded to 192.168.1.3. Like - all hosts in the net zone, Sam can connect to the firewall's internet - interface on TCP port 80 and the connection request will be forwarded to -192.168.1.5. The order of the rules is not significant.

- -

- Sometimes it is necessary to suppress port forwarding - for a sub-zone. For example, suppose that all hosts can SSH to the firewall - and be forwarded to 192.168.1.5 EXCEPT Sam. When Sam connects to the - firewall's external IP, he should be connected to the firewall itself. Because - of the way that Netfilter is constructed, this requires two rules as follows:

- -
-

-  

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
       
...      
DNATsamfwtcpssh- 
DNATnet!samloc:192.168.1.3tcpssh- 
...      
-
- -

The first rule allows Sam SSH - access to the firewall. The second - rule says that any clients from the - net zone with the exception of those - in the 'sam' zone should have their - connection port forwarded to - 192.168.1.3. If you need to exclude - more than one zone in this way, you - can list the zones separated by - commas (e.g., net!sam,joe,fred). - This technique also may be used when - the ACTION is REDIRECT.

- - -

- /etc/shorewall/rules

- - -

The /etc/shorewall/rules file - defines exceptions to the policies established in the /etc/shorewall/policy - file. There is one entry in /etc/shorewall/rules for each of these rules. 

- - -

Entries in the file have the - following columns:

- - - -

- - - Example 1. You wish to forward all ssh connection requests from the - internet to local system 192.168.1.3. 

- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
DNATnetloc:192.168.1.3tcpssh  
- -

- Example 2. You want to redirect all local www connection requests EXCEPT - those to your own http server - (206.124.146.177) to a Squid - transparent proxy running on the firewall and listening on port 3128. Squid - will of course require access to remote web servers. This example shows yet - another use for the ORIGINAL - DEST column; here, connection - requests that were NOT - - (notice the "!") originally - destined to 206.124.146.177 are - redirected to local port 3128.

- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +

Note 2: + The setting of the MERGE_HOSTS variable +in /etc/shorewall/shorewall.conf +has an important effect on how the host file is +processed. Please read the description of that +variable carefully.

-
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
REDIRECTloc3128tcpwww !206.124.146.177
ACCEPTfwnettcpwww  
- -

- Example 3. You want to run a web server at 155.186.235.222 in your -DMZ and have it accessible remotely and locally. the DMZ is managed by -Proxy ARP or by classical sub-netting.

- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Example:

- - + +

Your local interface is eth1 and you have two groups of local hosts that +you want to make into separate zones:

+ + + + +

Your /etc/shorewall/interfaces file might look like:

+ + +
+
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
ACCEPTnetdmz:155.186.235.222tcpwww- 
ACCEPTlocdmz:155.186.235.222tcpwww  
+ + + + + + + + + + + + + + + + + + + + + + + +
ZONE INTERFACE BROADCAST OPTIONS
neteth0detectdhcp,noping,norfc1918
-eth1detect 
+
+ + +

The '-' in the ZONE column for eth1 tells Shorewall that eth1 interfaces + to multiple zones.

- - -

- Example 4. You want to run wu-ftpd on 192.168.2.2 in your masqueraded - DMZ. Your internet interface address is 155.186.235.151 and you want the - FTP server to be accessible from the internet in addition to the local 192.168.1.0/24 and dmz 192.168.2.0/24 - subnetworks. Note that since the server is in the 192.168.2.0/24 subnetwork, - we can assume that access to the server from that subnet will not involve - the firewall (but see FAQ 2). Note that unless you - have more than one external - IP address, you can leave - the ORIGINAL DEST column - blank in the first rule. You - cannot leave it blank in the - second rule though because - then all ftp connections - originating in the local - subnet 192.168.1.0/24 would - be sent to 192.168.2.2 - regardless of the site that - the user was trying to - connect to. That is - clearly not what you want - .

- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Your /etc/shorewall/hosts file might look like:

- - - - -
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
DNATnetdmz:192.168.2.2tcpftp  
DNATloc:192.168.1.0/24dmz:192.168.2.2tcpftp-155.186.235.151
- - -

If you are running - wu-ftpd, you should restrict the range of passive in your /etc/ftpaccess - file. I only need a few simultaneous FTP sessions so I use port range -65500-65535. In /etc/ftpaccess, this entry is appropriate:

- - -
+ +
+ + + + + + + + + + + + + + + + + + -

passive ports  - 0.0.0.0/0 65500 65534

- - - -

If you are running - pure-ftpd, you would include "-p 65500:65534" on the pure-ftpd runline.

- - -

The important -point here is to ensure that the port range used for FTP passive connections -is unique and will not overlap with any usage on the firewall system.

- - -

Example 5. You - wish to allow unlimited - DMZ access to the host - with MAC address - 02:00:08:E3:FA:55.

- - -
-
ZONE HOST(S) OPTIONS
loc1eth1:192.168.1.0/25 
loc2eth1:192.168.1.128/25routestopped
- - - - - - - - - - - - - - - - - - - - - + -
ACTIONSOURCEDEST - PROTODEST
- PORT(S)		SOURCE
- PORT(S)		ORIGINAL
- DEST
ACCEPTloc:~02-00-08-E3-FA-55dmzall   
+
- -

- Look here for information on other services. -

+ +

Hosts in 'loc2' can communicate with the firewall while Shorewall is +stopped -- those in 'loc1' cannot.

+ + +

Nested and Overlapping Zones

+ + +

The /etc/shorewall/interfaces and /etc/shorewall/hosts file allow +you to define nested or overlapping zones. Such overlapping/nested zones +are allowed and Shorewall processes zones in the order that they appear +in the /etc/shorewall/zones file. So if you have nested zones, you want +the sub-zone to appear before the super-zone and in the case of overlapping + zones, the rules that will apply to hosts that belong to both zones is +determined by which zone appears first in /etc/shorewall/zones.

+ + +

Hosts that belong to more than one zone may be managed by the rules +of all of those zones. This is done through use of the special CONTINUE policy described below.

+ + +

+ /etc/shorewall/policy Configuration.

+ + +

This file is used to describe the firewall policy regarding establishment +of connections. Connection establishment is described in terms of clients +who initiate connections and servers who receive those connection +requests. Policies defined in /etc/shorewall/policy describe which zones +are allowed to establish connections with other zones.

+ + +

Policies established in /etc/shorewall/policy can be viewed as default + policies. If no rule in /etc/shorewall/rules applies to a particular +connection request then the policy from /etc/shorewall/policy is applied.

+ + +

Four policies are defined:

+ + + + +

For each policy specified in /etc/shorewall/policy, you can indicate + that you want a message sent to your system log each time that the policy + is applied.

+ + +

Entries in /etc/shorewall/policy have four columns as follows:

+ + +
    + +
  1. SOURCE - The name of a client +zone (a zone defined in the /etc/shorewall/zones + file , the name of the firewall zone or "all").
    2. + +
  2. DEST - The name of a destination +zone (a zone defined in the /etc/shorewall/zones + file , the name of the firewall zone or "all").
    3. + +
  3. POLICY - The default policy +for connection requests from the SOURCE zone to the DESTINATION zone.
    4. + +
  4. LOG LEVEL - Optional. If left +empty, no log message is generated when the policy is applied. Otherwise, +this column should contain an integer or name indicating a syslog level. +See the syslog.conf man page for a description of each log level.
    5. + +
  5. LIMIT:BURST - Optional. If left +empty, TCP connection requests from the SOURCE zone to the DEST +zone will not be rate-limited. Otherwise, this column specifies the maximum +rate at which TCP connection requests will be accepted followed by a colon +(":") followed by the maximum burst size that will be tolerated. Example: + 10/sec:40 specifies that the maximum rate of TCP connection +requests allowed will be 10 per second and a burst of 40 connections will +be tolerated. Connection requests in excess of these limits will be dropped.
    6. + + +
+ + +

In the SOURCE and DEST columns, you can enter "all" to indicate all + zones. 

+ + +

The policy file installed by default is as follows:

+ + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -

- /etc/shorewall/common

- - -

Shorewall allows - definition of rules that - apply between all zones. - By default, these rules - are defined in the file - /etc/shorewall/common.def - but may be modified to - suit individual - requirements. Rather - than modify - /etc/shorewall/common.def, - you should copy that - file to - /etc/shorewall/common - and modify that file.

- - -

The - /etc/shorewall/common - file is expected to - contain iptables - commands; rather than - running iptables - directly, you should run - it indirectly using the - Shorewall function 'run_iptables'. - That way, if iptables - encounters an error, the - firewall will be safely - stopped.

- - -

- /etc/shorewall/masq

- - -

The /etc/shorewall/masq - file is used to define classical IP Masquerading and Source Network Address Translation  (SNAT). There is one entry in - the file for each subnet that you want to masquerade. In order to make -use of this feature, you must have NAT enabled - .

- - -

Columns are:

- - -

- Example 1: You have eth0 connected to a cable modem and eth1 connected - to your local subnetwork 192.168.9.0/24. Your /etc/shorewall/masq file -would look like:    

- -
-
SOURCEDEST POLICY LOG LEVELLIMIT:BURST
locnetACCEPT  
netallDROPinfo 
allallREJECTinfo 
- - - - - - - - - - - - - - - - -
- INTERFACE - SUBNETADDRESS
eth0192.168.9.0/24 
- -

- Example 2: You have a number of IPSEC tunnels through ipsec0 and -you want to masquerade traffic from your 192.168.9.0/24 subnet to the -remote subnet 10.1.0.0/16 only.

- -
- - - - - - - - - - - - - - - + + +
- INTERFACE - SUBNETADDRESS
ipsec0:10.1.0.0/16192.168.9.0/24 
+
+ +

This table may be interpreted as follows:

-
- -

- Example 3: You have a DSL line connected on eth0 and a local network - (192.168.10.0/24) - connected to eth1. You - want all local->net - connections to use - source address - 206.124.146.176.

- -
- - - - - - - - - - - + + +

WARNING:

+ +

The firewall script processes  the +/etc/shorewall/policy file from top to bottom and uses the first applicable +policy that it finds. For example, in the following policy file, +the policy for (loc, loc) connections would be ACCEPT as specified in the +first entry even though the third entry in the file specifies REJECT.

+ +
+
- INTERFACE - SUBNETADDRESS
eth0192.168.10.0/24206.124.146.176
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + - -
SOURCEDESTPOLICYLOG LEVELLIMIT:BURST
locallACCEPT  
netallDROPinfo 
loclocREJECTinfo 
+ + + +
- -

Example 4: - Same as example 3 - except that you wish - to exclude - 192.168.10.44 and - 192.168.10.45 from - the SNAT rule.

- - -
- - - - - - - - - - - - - -
- INTERFACE - SUBNETADDRESS
eth0192.168.10.0/24!192.168.10.44,192.168.10.45206.124.146.176
-
- -

- /etc/shorewall/proxyarp

- - -

If you want to - use proxy ARP on an - entire sub-network, - I suggest that you - look at - - http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/. - If you decide to use - the technique - described in that - HOWTO, you can set - the proxy_arp flag - for an interface - (/proc/sys/net/ipv4/conf/<interface>/proxy_arp) - by including the - proxyarp option - in the interface's - record in - - /etc/shorewall/interfaces. - When using Proxy ARP - sub-netting, you do - NOT include - any entries in - /etc/shorewall/proxyarp.

- - -

The /etc/shorewall/proxyarp - file is used to define Proxy ARP. The file is - typically used for - enabling Proxy ARP - on a small set of - systems since you - need one entry in - this file for each - system using proxy - ARP. Columns are:

- -

Note: After you have made a change to the - /etc/shorewall/proxyarp file, you may need to flush the ARP cache of all - routers on the LAN segment connected to the interface specified in the EXTERNAL - column of the change/added entry(s). If you are having problems communicating - between an individual host (A) on that segment and a system whose entry has - changed, you may need to flush the ARP cache on host A as well.

- - -

ISPs typically have ARP configured with long TTL - (hours!) so if your ISPs router has a stale cache entry (as seen using "tcpdump - -nei <external interface> host <IP addr>"), it may take a long while to time - out. I personally have had to contact my ISP and ask them to delete a stale - entry in order to restore a system to working order after changing my proxy ARP - settings.

- - -

Example: - You have - public IP addresses 155.182.235.0/28. You configure your firewall as follows:

- - -

- In your DMZ, you want to install a Web/FTP server with public address - 155.186.235.4. On the Web server, you subnet just like the firewall's eth0 -and you configure 155.186.235.1 as the default gateway. In your /etc/shorewall/proxyarp -file, you will have:

- -
- - - - - - - - - - - - - - - - - - - -
- ADDRESS - INTERFACE - EXTERNALHAVEROUTE
155.186.235.4eth2eth0No
- -

- Note: You may want to configure the servers in your DMZ with a subnet -that is smaller than the subnet of your internet interface. See the Proxy -ARP Subnet Mini HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/) for details. In this case you will want to place - "Yes" in the HAVEROUTE column.

- -

To learn how I use Proxy ARP - in my DMZ, see my configuration files.

- -

Warning: Do not use Proxy ARP and - FreeS/Wan on the same system unless you are prepared to suffer the - consequences. If you start or restart Shorewall with an IPSEC tunnel active, - the proxied IP addresses are mistakenly assigned to the IPSEC tunnel device - (ipsecX) rather than to the interface that you specify in the INTERFACE column - of /etc/shorewall/proxyarp. I haven't had the time to debug this problem so I - can't say if it is a bug in the Kernel or in FreeS/Wan. 

-

You might be able to work around this problem using the following (I - haven't tried it):

-

In /etc/shorewall/init, include:

-

     qt service ipsec stop

-

In /etc/shorewall/start, include:

-

    qt service ipsec start

- -

- /etc/shorewall/nat

+ +

+ The CONTINUE policy

+ +

Where zones are nested or overlapping , the +CONTINUE policy allows hosts that are within multiple zones to be managed +under the rules of all of these zones. Let's look at an example:

+ +

/etc/shorewall/zones:

+ +
+ + + + + + + + + + + + + + + + + + + + + + -

The /etc/shorewall/nat - file is used to define static NAT. There is one entry in the file for -each static NAT relationship that you wish to define. In order to make -use of this feature, you must have NAT enabled - .

+ + +
ZONE DISPLAY COMMENTS
samSamSam's system at home
netInternetThe Internet
locLocLocal Network
+
+ +

/etc/shorewall/interfaces:

+ +
+ + + + + + + + + + + + + + + + + + + + + + -

- - IMPORTANT: If - all you want to do - is forward ports - to servers behind - your firewall, you - do NOT want to use - static NAT. Port - forwarding can be - accomplished with - simple entries in - the - - rules file. - Also, in most - cases - - Proxy ARP - provides a - superior solution - to static NAT - because the - internal systems - are accessed using - the same IP - address internally - and externally.

+
ZONE INTERFACE BROADCAST OPTIONS
-eth0detectdhcp,noping,norfc1918
loceth1detectroutestopped
+
+ +

/etc/shorewall/hosts:

+ +
+ + + + + + + + + + + + + + + + + + + + +
ZONE HOST(S) OPTIONS
neteth0:0.0.0.0/0 
sameth0:206.191.149.197routestopped
+
+ +

Note that Sam's home system is a member of both the sam zone +and the net zone and as described above , that means that sam must +be listed before net  in /etc/shorewall/zones.

+ +

/etc/shorewall/policy:

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SOURCE DEST POLICY LOG LEVEL
locnetACCEPT 
samallCONTINUE 
netallDROPinfo
allallREJECTinfo
+
+ +

The second entry above says that when Sam is the client, connection +requests should first be process under rules where the source zone is sam +and if there is no match then the connection request should be treated under + rules where the source zone is net. It is important that this policy + be listed BEFORE the next policy (net to all).

+ +

Partial /etc/shorewall/rules:

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
...      
DNATsamloc:192.168.1.3tcpssh- 
DNATnetloc:192.168.1.5tcpwww- 
...      
+
+ +

Given these two rules, Sam can connect to the firewall's internet interface + with ssh and the connection request will be forwarded to 192.168.1.3. Like + all hosts in the net zone, Sam can connect to the firewall's internet + interface on TCP port 80 and the connection request will be forwarded to + 192.168.1.5. The order of the rules is not significant.

+ +

Sometimes it is necessary to suppress port forwarding + for a sub-zone. For example, suppose that all hosts can SSH to the firewall + and be forwarded to 192.168.1.5 EXCEPT Sam. When Sam connects to the + firewall's external IP, he should be connected to the firewall itself. +Because of the way that Netfilter is constructed, this requires two rules +as follows:

+ +
+

 

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
       
...      
DNATsamfwtcpssh- 
DNATnet!samloc:192.168.1.3tcpssh- 
...      
+
+ +

The first rule allows Sam SSH + access to the firewall. The second + rule says that any clients from the + net zone with the exception of those + in the 'sam' zone should have their + connection port forwarded to + 192.168.1.3. If you need to exclude + more than one zone in this way, +you can list the zones separated +by commas (e.g., net!sam,joe,fred). + This technique also may be used +when the ACTION is REDIRECT.

+ + +

+ /etc/shorewall/rules

+ + +

The /etc/shorewall/rules file defines exceptions to the policies established +in the /etc/shorewall/policy file. There is one entry in /etc/shorewall/rules +for each of these rules. 

+ + +

Entries in the file have the following columns:

+ + + + + +

Example 1. You wish to forward all +ssh connection requests from the internet to local system 192.168.1.3. 

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
DNATnetloc:192.168.1.3tcpssh  
+
-

Columns -in an entry are:

- -

- Look here for additional information and an example. -

+

Example 2. You want to redirect all local www connection requests +EXCEPT those to your own +http server (206.124.146.177) +to a Squid transparent proxy +running on the firewall and listening on port 3128. Squid will of course +require access to remote web servers. This example shows yet + another use for the ORIGINAL + DEST column; here, connection + requests that were NOT + + (notice the "!") originally + destined to 206.124.146.177 +are redirected to local port +3128.

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
REDIRECTloc3128tcpwww !206.124.146.177
ACCEPTfwnettcpwww  
+
+ +

Example 3. You want to run a web server at 155.186.235.222 in +your DMZ and have it accessible remotely and locally. the DMZ is managed +by Proxy ARP or by classical sub-netting.

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
ACCEPTnetdmz:155.186.235.222tcpwww- 
ACCEPTlocdmz:155.186.235.222tcpwww  
+
+ +

Example 4. You want to run wu-ftpd on 192.168.2.2 in your masqueraded + DMZ. Your internet interface address is 155.186.235.151 and you want the + FTP server to be accessible from the internet in addition to the local +192.168.1.0/24 and dmz 192.168.2.0/24 subnetworks. Note that since the +server is in the 192.168.2.0/24 subnetwork, we can assume that access to +the server from that subnet will not involve the firewall (but see FAQ 2). Note that unless you + have more than one external + IP address, you can leave + the ORIGINAL DEST column + blank in the first rule. +You cannot leave it blank +in the second rule though +because then all +ftp connections +originating in the local + subnet 192.168.1.0/24 would + be sent to 192.168.2.2 + regardless of the site that + the user was trying to + connect to. That is + clearly not what you want + + .

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -

- /etc/shorewall/tunnels

- -

- The /etc/shorewall/tunnels file allows you to define IPSec, GRE and IPIP tunnels - with end-points on your firewall. To use ipsec, you must install version - 1.9, 1.91 or the current FreeS/WAN - development snapshot. 

- -

- Note: For kernels 2.4.4 and above, you will need to use version 1.91 or -a development snapshot as patching with version 1.9 results in kernel compilation - errors.

- -

- Instructions for setting up IPSEC tunnels may be found here - and instructions for IPIP tunnels are here - . Look here for information about setting up PPTP - tunnels under - Shorewall.

- -

- /etc/shorewall/shorewall.conf

- -

- This file is used to set the following firewall parameters:

-
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
DNATnetdmz:192.168.2.2tcpftp  
DNATloc:192.168.1.0/24dmz:192.168.2.2tcpftp-155.186.235.151
- - - - - - - - - - - - - - - - - - -
ZONEHOSTSBROADCASTOPTIONS
loceth1-dhcp
-ppp+  
-


- Hosts File:
- 

- - - - - - - - - -
ZONEHOSTS
locppp+:192.168.12.0/24
-


- With MERGE_HOSTS=No, the loc zone consists of only ppp+:192.168.12.0/24; - with MERGE_HOSTS=Yes, it includes eth1:0.0.0.0/0 and ppp+:192.168.12.0/24.
-  + + + + +

+ + + +

If you are running wu-ftpd, you should restrict the range of passive + in your /etc/ftpaccess file. I only need a few simultaneous FTP sessions +so I use port range 65500-65535. In /etc/ftpaccess, this entry is appropriate:

+ + + +
+ + +

passive ports  0.0.0.0/0 65500 65534

+
+ + + +

If you are running pure-ftpd, you would include "-p 65500:65534" on +the pure-ftpd runline.

+ + + +

The important point here is to ensure that the port range used for FTP + passive connections is unique and will not overlap with any usage on the + firewall system.

+ + + +

Example 5. You + wish to allow unlimited + DMZ access to the host + with MAC address + 02:00:08:E3:FA:55.

+ + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDEST PROTODEST
+ PORT(S)		SOURCE
+ PORT(S)		ORIGINAL
+ DEST
ACCEPTloc:~02-00-08-E3-FA-55dmzall   
+
+ + + +

Look here for information on other services. +

+ + + +

+ /etc/shorewall/common

+ + + +

Shorewall allows + definition of rules that + apply between all zones. + By default, these rules + are defined in the file + /etc/shorewall/common.def + but may be modified to + suit individual + requirements. Rather + than modify + /etc/shorewall/common.def, + you should copy that + file to + /etc/shorewall/common + and modify that file.

+ + + +

The /etc/shorewall/common + file is expected +to contain iptables + commands; rather +than running iptables + directly, you should +run it indirectly +using the Shorewall +function 'run_iptables'. + That way, if iptables + encounters an error, the + firewall will be safely + stopped.

+ + + +

+ /etc/shorewall/masq

+ + + +

The /etc/shorewall/masq file is used to define classical IP Masquerading +and Source Network Address Translation  (SNAT). There is one entry in the +file for each subnet that you want to masquerade. In order to make use of +this feature, you must have NAT enabled .

+ + + +

Columns are:

+ + + + +

Example 1: You have eth0 connected to a cable modem and eth1 +connected to your local subnetwork 192.168.9.0/24. Your /etc/shorewall/masq +file would look like:    

+ + +
+ + + + + + + + + + + + + + + + + + + +
INTERFACE SUBNETADDRESS
eth0192.168.9.0/24 
+
+ + +

Example 2: You have a number of IPSEC tunnels through ipsec0 + and you want to masquerade traffic from your 192.168.9.0/24 subnet to the + remote subnet 10.1.0.0/16 only.

+ + +
+ + + + + + + + + + + + + + + + + + + +
INTERFACE SUBNETADDRESS
ipsec0:10.1.0.0/16192.168.9.0/24 
+
+ + +

Example 3: You have a DSL line connected on eth0 and a local +network (192.168.10.0/24) + connected to eth1. +You want all local->net + connections to +use source address + 206.124.146.176.

+ +
+ + + + + + + + + + + + + + + + +
INTERFACE SUBNETADDRESS
eth0192.168.10.0/24206.124.146.176
+
+ + +

Example 4: + Same as example 3 + except that you wish + to exclude + 192.168.10.44 and + 192.168.10.45 from + the SNAT rule.

+ + + +
+ + + + + + + + + + + + + + + + + +
INTERFACE SUBNETADDRESS
eth0192.168.10.0/24!192.168.10.44,192.168.10.45206.124.146.176
+
+ + +

+ /etc/shorewall/proxyarp

+ + + +

If you want to + use proxy ARP on an + entire sub-network, + I suggest that you + look at + + http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/. + If you decide +to use the technique + described in +that HOWTO, you +can set the +proxy_arp flag + for an interface + (/proc/sys/net/ipv4/conf/<interface>/proxy_arp) + by including the + proxyarp +option in the +interface's record +in + /etc/shorewall/interfaces. + When using Proxy ARP + sub-netting, you do + NOT include + any entries in + /etc/shorewall/proxyarp. +

+ + + +

The /etc/shorewall/proxyarp file is used to define Proxy ARP. The file is + typically used for + enabling Proxy ARP + on a small set of + systems since you + need one entry +in this file +for each system +using proxy ARP. +Columns are:

+ + + +

Note: After you have made a change to the /etc/shorewall/proxyarp +file, you may need to flush the ARP cache of all routers on the LAN segment +connected to the interface specified in the EXTERNAL column of the change/added +entry(s). If you are having problems communicating between an individual +host (A) on that segment and a system whose entry has changed, you may need +to flush the ARP cache on host A as well.

+ + +

ISPs typically have ARP configured with long TTL + (hours!) so if your ISPs router has a stale cache entry (as seen using "tcpdump + -nei <external interface> host <IP addr>"), it may take a long +while to time out. I personally have had to contact my ISP and ask them +to delete a stale entry in order to restore a system to working order after +changing my proxy ARP settings.

+ + + +

Example: + You have public IP addresses 155.182.235.0/28. You configure your +firewall as follows:

+ + + + +

In your DMZ, you want to install a Web/FTP server with public address + 155.186.235.4. On the Web server, you subnet just like the firewall's eth0 + and you configure 155.186.235.1 as the default gateway. In your /etc/shorewall/proxyarp + file, you will have:

+ + +
+ + + + + + + + + + + + + + + + + + + + + +
ADDRESS INTERFACE EXTERNALHAVEROUTE
155.186.235.4eth2eth0No
+
+ +

Note: You may want to configure the servers in your DMZ with a subnet + that is smaller than the subnet of your internet interface. See the Proxy + ARP Subnet Mini HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/) +for details. In this case you will want to place "Yes" in the HAVEROUTE +column.

+ +

To learn how I use Proxy ARP in my DMZ, see my configuration +files.

+ +

Warning: Do not use Proxy ARP and + FreeS/Wan on the same system unless you are prepared to suffer the consequences. +If you start or restart Shorewall with an IPSEC tunnel active, the proxied +IP addresses are mistakenly assigned to the IPSEC tunnel device (ipsecX) +rather than to the interface that you specify in the INTERFACE column of +/etc/shorewall/proxyarp. I haven't had the time to debug this problem so I + can't say if it is a bug in the Kernel or in FreeS/Wan. 

+ +

You might be able to work around this problem using the following +(I haven't tried it):

+ +

In /etc/shorewall/init, include:

+ +

     qt service ipsec stop

+ +

In /etc/shorewall/start, include:

+ +

    qt service ipsec start

+ + +

+ /etc/shorewall/nat

+ + + +

The /etc/shorewall/nat file is used to define static NAT. There is one + entry in the file for each static NAT relationship that you wish to define. +In order to make use of this feature, you must have NAT enabled .

+ + + +

+ IMPORTANT: If + all you want to do + is forward ports + to servers behind + your firewall, you + do NOT want to use + static NAT. Port + forwarding can +be accomplished +with simple +entries in +the + rules file. + Also, in most + cases + + Proxy ARP + provides a + superior solution + to static NAT + because the + internal systems + are accessed using + the same IP + address internally + and externally.

+ + + +

Columns in an entry are:

+ + + +

Look here for additional information and an example. +

+ + +

+ /etc/shorewall/tunnels

+ + +

The /etc/shorewall/tunnels file allows you to define IPSec, GRE and +IPIP tunnels with end-points on your firewall. To use ipsec, you must install +version 1.9, 1.91 or the current FreeS/WAN development snapshot. 

+ + +

Note: For kernels 2.4.4 and above, you will need to use version 1.91 +or a development snapshot as patching with version 1.9 results in kernel +compilation errors.

+ + +

Instructions for setting up IPSEC tunnels may +be found here and instructions for IPIP +tunnels are here . Look here for information +about setting up PPTP + tunnels under + Shorewall.

+ + +

+ /etc/shorewall/shorewall.conf

+ + +

This file is used to set the following firewall parameters:

+ + - - - -

- /etc/shorewall/modules Configuration

- - -

The file - /etc/shorewall/modules contains commands for loading the kernel modules - required by Shorewall-defined firewall rules. Shorewall will source this - file during start/restart provided that it exists and that the directory - specified by the MODULESDIR parameter exists (see /etc/shorewall/shorewall.conf - above).

- - -

The file - that is released with Shorewall calls the Shorewall function "loadmodule" - for the set of modules that I load.

- - -

The loadmodule - function is called as follows:

- - -
- - -

loadmodule - <modulename> - [ - <module parameters> ]

-
- - -

where

- - -
- - -

<modulename>                

- - -
+ If you +do not +assign a value + or if you + assign an + empty value + then packets + from + blacklisted + hosts are not + logged. +
  • CLAMPMSS
    + This +parameter + enables the + TCP Clamp MSS + to PMTU + feature of + Netfilter and + is usually + required when + your internet + connection is + through PPPoE + or PPTP. If + set to + "Yes" + or + "yes", + the feature is + enabled. +If left +blank or + set to + "No" + or "no", + the feature +is not +enabled. + Note: This + option + requires + CONFIG_IP_NF_TARGET_TCPMSS + in + your kernel.
    • +
  • ROUTE_FILTER
    + If this parameter is given the value "Yes" or "yes" then route filtering + (anti-spoofing) is enabled on all network interfaces. The default +value is "no".
    • + + - -

    is - the name of the modules without the trailing ".o" (example ip_conntrack).

    + +

    + /etc/shorewall/modules Configuration

    + + + +

    The file /etc/shorewall/modules contains commands for loading the kernel + modules required by Shorewall-defined firewall rules. Shorewall will source + this file during start/restart provided that it exists and that the directory + specified by the MODULESDIR parameter exists (see /etc/shorewall/shorewall.conf + above).

    + + + +

    The file that is released with Shorewall calls the Shorewall function +"loadmodule" for the set of modules that I load.

    + + + +

    The loadmodule function is called as follows:

    + + + +
    + + +

    loadmodule + <modulename> + [ <module parameters> ]

    -

    - <module parameters>

    + +

    where

    -
    + +
    - -

    - Optional parameters to the insmod utility.

    + +

    <modulename>                

    + + + +
    + + + +

    is the name of the modules without the trailing ".o" (example + ip_conntrack).

    +
    + + + +

    <module parameters>

    + + + +
    + + + +

    Optional parameters to the insmod utility.

    +
    -
    + -

    - The function determines if the module named by <modulename> - is already loaded and if not then the function determines if the ".o" - file corresponding to the module exists in the moduledirectory; if -so, then the following command is executed:

    +

    The function determines if the module named by <modulename> + is already loaded and if not then the function determines if the +".o" file corresponding to the module exists in the moduledirectory; +if so, then the following command is executed:

    + -
    +
    - -

    - insmod moduledirectory/<modulename>.o <module + +

    insmod moduledirectory/<modulename>.o <module + parameters>

    +
    + + + + +

    If the file doesn't exist, the function determines of the ".o.gz" +file corresponding to the module exists in the moduledirectory. If +it does, the function assumes that the running configuration supports compressed + modules and execute the following command:

    + + + + +
    + + + +

    insmod moduledirectory/<modulename>.o.gz <module parameters>

    -
    +
    - -

    - If the file doesn't exist, the function determines of the ".o.gz" file - corresponding to the module exists in the moduledirectory. If it - does, the function assumes that the running configuration supports compressed - modules and execute the following command:

    + + +

    + /etc/shorewall/tos Configuration

    - -
    + + +

    The /etc/shorewall/tos file allows you to set the Type of Service field + in packet headers based on packet source, packet destination, protocol, + source port and destination port. In order for this file to be processed + by Shorewall, you must have mangle support enabled + .

    - -

    - insmod moduledirectory/<modulename>.o.gz <module - parameters>

    -
    + + +

    Entries in the file have the following columns:

    + + +
      +
    • SOURCE -- The source zone. May be qualified by following +the zone name with a colon (":") and either an IP address, an IP subnet, +a MAC address in Shorewall Format or the name +of an interface. This column may also contain the name of + the firewall + zone to + indicate packets originating on the firewall itself or "all" to + indicate any source.
      • +
    • DEST -- The destination zone. May be qualified by following +the zone name with a colon (":") and either an IP address or an IP + subnet. Because packets are marked prior to routing, you may not specify + the name of an interface. This column may also contain  "all" +to indicate any destination.
      • +
    • PROTOCOL -- The name of a protocol in /etc/protocols or +the protocol's number.
      • +
    • SOURCE PORT(S) -- The source port or a port range. For +all ports, place a hyphen ("-") in this column.
      • +
    • DEST PORT(S)  -- The destination port or a port range. +To indicate all ports, place a hyphen ("-") in this column.
      • +
    • TOS -- The type of service. Must be one of the following:
      • + +
    - -

    - /etc/shorewall/tos Configuration

    + +
    + + +
    + + +

    Minimize-Delay (16)
    + Maximize-Throughput (8)
    + Maximize-Reliability (4)
    + Minimize-Cost (2)
    + Normal-Service (0)

    +
    +
    - -

    - The /etc/shorewall/tos file allows you to set the Type of Service field -in packet headers based on packet source, packet destination, protocol, -source port and destination port. In order for this file to be processed -by Shorewall, you must have mangle support enabled - .

    + +

    The /etc/shorewall/tos file that is included with Shorewall contains +the following entries.

    - -

    - Entries in the file have the following columns:

    - - -
      -
    • - SOURCE -- The source zone. May be qualified by following the zone name - with a colon (":") and either an IP address, an IP subnet, a MAC address - in Shorewall Format or the - name of an interface. This column may also contain the name of - the firewall - zone to indicate - packets originating on the firewall itself or "all" to indicate any - source.
      • -
    • - DEST -- The destination zone. May be qualified by following the zone - name with a colon (":") and either an IP address or an IP subnet. - Because packets are marked prior to routing, you may not specify the - name of an interface. This column may also contain  "all" to indicate - any destination.
      • -
    • - PROTOCOL -- The name of a protocol in /etc/protocols or the protocol's - number.
      • -
    • - SOURCE PORT(S) -- The source port or a port range. For all ports, place - a hyphen ("-") in this column.
      • -
    • - DEST PORT(S)  -- The destination port or a port range. To indicate - all ports, place a hyphen ("-") in this column.
      • -
    • - TOS -- The type of service. Must be one of the following:
      • -
    + +
    + + -
    - -
    - -

    - Minimize-Delay (16)
    - Maximize-Throughput (8)
    - Maximize-Reliability (4)
    - Minimize-Cost (2)
    - Normal-Service (0)

    -
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SOURCEDESTPROTOCOLSOURCE
    + PORT(S)    		DEST PORT(S)TOS
    allalltcp-ssh16
    allalltcpssh-16
    allalltcp-ftp16
    allalltcpftp-16
    allalltcp-ftp-data8
    allalltcpftp-data-8
    - -

    - The /etc/shorewall/tos file that is included with Shorewall contains the - following entries.

    - -
    - - + + + +

    WARNING: Users have reported that odd routing problems result from +adding the ESP and AH protocols to the /etc/shorewall/tos file.

    + + + +

    /etc/shorewall/blacklist

    + + + +

    Each + line + in + /etc/shorewall/blacklist + contains + + an + IP + address, a MAC address in Shorewall +Format + or + subnet + address. + Example:

    + + +
          130.252.100.69
          206.124.146.0/24
    + + + +

    Packets + from + hosts + listed + in + + the + blacklist + file + will + be + disposed + + of + according + to + the + value + assigned + + to + the BLACKLIST_DISPOSITION + and +BLACKLIST_LOGLEVEL variables + in + /etc/shorewall/shorewall.conf. + + Only + packets + arriving + on + interfaces + + that + have + the + 'blacklist' + + option + in + /etc/shorewall/interfaces + are + + checked + against + the + blacklist. The black list is +designed to prevent listed hosts/subnets from accessing services on your +network.
    +

    +

    Beginning with Shorewall 1.3.8, the blacklist file has three columns:
    +

    +
      +
    • ADDRESS/SUBNET - As described above.
      • +
    • PROTOCOL - Optional. If specified, only packets specifying this +protocol will be blocked.
      • +
    • PORTS - Optional; may only be given if PROTOCOL is tcp, udp +or icmp. Expressed as a comma-separated list of port numbers or service names +(from /etc/services). If present, only packets destined for the specified +protocol and one of the listed ports are blocked. When the PROTOCOL is icmp, +the PORTS column contains a comma-separated list of ICMP type numbers or +names (see "iptables -h icmp").
      +
      • +
    + + + +

    Shorewall also has a dynamic blacklist +capability.

    + + + +

    IMPORTANT: The Shorewall blacklist file is NOT +designed to police your users' web browsing -- to do that, I suggest that +you install and configure Squid (http://www.squid-cache.org). +

    + + + + +

    /etc/shorewall/rfc1918 (Added in Version 1.3.1)

    + + + + +

    This file lists the subnets affected by the norfc1918 +interface option. Columns in the file are:

    + + + + +
      + +
    • SUBNET - The subnet using VLSM notation (e.g., 192.168.0.0/16).
      • + +
    • TARGET - What to do with packets to/from the +SUBNET: +
        + +
      • RETURN - Process the packet normally thru the rules +and policies.
        • + +
      • DROP - Silently drop the packet.
        • + +
      • logdrop - Log then drop the packet.
        • + + +
      + +
      • + +
    + + + + +

    25. /etc/shorewall/routestopped (Added in Version +1.3.4)

    + + + + +

    This fine defines the hosts that are accessible from the firewall when +the firewall is stopped.  Columns in the file are:

    + + + + +
      + +
    • INTERFACE - The firewall interface through which the +host(s) comminicate with the firewall.
      • + +
    • HOST(S) - (Optional) - A comma-separated list of IP/Subnet +addresses. If not supplied or supplied as "-" then 0.0.0.0/0 is assumed.
      • + +
    + + + + +

    Example: When your firewall is stopped, you want firewall accessibility +from local hosts 192.168.1.0/24 and from your DMZ. Your DMZ interfaces through +eth1 and your local hosts through eth2.

    + + + + +
    + +
    + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + +
    INTERFACEHOST(S)
    SOURCEDESTPROTOCOLSOURCE
    - PORT(S)    		DEST PORT(S)TOS
    allalltcp-ssh16
    allalltcpssh-16
    allalltcp-ftp16
    allalltcpftp-16
    allalltcp-ftp-data8
    allalltcpftp-data-8
    eth2192.168.1.0/24
    eth1-
    +
    - - + + +

    Updated 9/16/2002 - Tom Eastep +

    - -
    - -

    WARNING: Users have reported that odd routing problems result from adding the ESP and AH protocols to the /etc/shorewall/tos file. -

    - -

    /etc/shorewall/blacklist

    - -

    Each - line - in - /etc/shorewall/blacklist - contains - an - IP - address, a MAC address in Shorewall Format - or - subnet - address. - Example:

    - - 
          130.252.100.69
-      206.124.146.0/24
    - -

    Packets - from - hosts - listed - in - the - blacklist - file - will - be - disposed - of - according - to - the - value - assigned - to - the BLACKLIST_DISPOSITION - and BLACKLIST_LOGLEVEL variables - in - /etc/shorewall/shorewall.conf. - Only - packets - arriving - on - interfaces - that - have - the - 'blacklist' - option - in - /etc/shorewall/interfaces - are - checked - against - the - blacklist. The black list is designed to prevent listed hosts/subnets from accessing services on your network.

    - -

    Shorewall also has a dynamic blacklist capability.

    - -

    IMPORTANT: The Shorewall blacklist file is NOT designed to police your users' web browsing -- to do that, I suggest that you install and configure Squid (http://www.squid-cache.org).

    + +

    Copyright + © 2001, 2002 Thomas M. Eastep.

    - -

    /etc/shorewall/rfc1918 (Added in Version 1.3.1)

    + - -

    This file lists the subnets affected by the norfc1918 interface option. Columns in the file are:

    - - -
      -
    • SUBNET - The subnet using VLSM notation (e.g., 192.168.0.0/16).
      • -
    • TARGET - What to do with packets to/from the SUBNET:
        -
      • RETURN - Process the packet normally thru the rules and policies.
        • -
      • DROP - Silently drop the packet.
        • -
      • logdrop - Log then drop the packet.
        • -
      -
      • -
    - - - -

    25. /etc/shorewall/routestopped (Added in Version 1.3.4)

    - - - -

    This fine defines the hosts that are accessible from the firewall when the firewall is stopped.  Columns in the file are:

    - - - -
      -
    • INTERFACE - The firewall interface through which the host(s) comminicate with the firewall.
      • -
    • HOST(S) - (Optional) - A comma-separated list of IP/Subnet addresses. If not supplied or supplied as "-" then 0.0.0.0/0 is assumed.
      • -
    - - - -

    Example: When your firewall is stopped, you want firewall accessibility from local hosts 192.168.1.0/24 and from your DMZ. Your DMZ interfaces through eth1 and your local hosts through eth2.

    - - - -
    - - - - - - - - - - - - - -
    INTERFACEHOST(S)
    eth2192.168.1.0/24
    eth1-
    -
    - - - -

    - Updated 8/22/2002 - Tom -Eastep -

    - - - -

    Copyright - © 2001, 2002 Thomas M. Eastep.

    - - - - - - - - \ No newline at end of file +
    +
    + + diff --git a/Shorewall-docs/FAQ.htm b/Shorewall-docs/FAQ.htm index caaaa7527..ccbd6292c 100644 --- a/Shorewall-docs/FAQ.htm +++ b/Shorewall-docs/FAQ.htm @@ -533,7 +533,9 @@ problem are:

    over my console making it unusable!

    Answer: "man dmesg" -- add a suitable 'dmesg' command to your startup - scripts or place it in /etc/shorewall/start.

    + scripts or place it in /etc/shorewall/start. Under RedHat, the max log level + that is sent to the console is specified in /etc/sysconfig/init in the + LOGLEVEL variable.

    17. Why can't Shorewall detect my interfaces properly?

    @@ -566,7 +568,7 @@ over my console making it unusable! zone is defined as all hosts connected through eth1.

    Last updated -8/15/2002 - Tom +8/24/2002 - Tom Eastep

    Copyright diff --git a/Shorewall-docs/IPIP.htm b/Shorewall-docs/IPIP.htm index c8c0e7a75..a0a350ea7 100644 --- a/Shorewall-docs/IPIP.htm +++ b/Shorewall-docs/IPIP.htm @@ -42,7 +42,25 @@ parameter to the type of tunnel that you want to create.

    tunnel_type=gre

    -

    On system A, the 10.0.0.0/8 will comprise the gw zone. In +

    On each firewall, you will need to declare a zone to represent +the remote subnet. We'll assume that this zone is called 'vpn' and declare it in +/etc/shorewall/zones on both systems as follows.

    +
    + + + + + + + + + + + + +
    ZONEDISPLAYCOMMENTS
    vpnVPNRemote Subnet
    +
    +

    On system A, the 10.0.0.0/8 will comprise the vpn zone. In /etc/shorewall/interfaces:

    @@ -53,7 +71,7 @@ parameter to the type of tunnel that you want to create.

    - + @@ -88,7 +106,7 @@ encapsulation protocol (4) will be accepted to/from the remote gateway.

    gateway=134.28.54.2
    subnet=10.0.0.0/8

    -

    Similarly, On system B the 192.168.1.0/24 subnet will comprise the gw +

    Similarly, On system B the 192.168.1.0/24 subnet will comprise the vpn zone. In /etc/shorewall/interfaces:

    OPTIONS
    gwvpn tosysb 10.255.255.255  
    @@ -99,7 +117,7 @@ zone. In /etc/shorewall/interfaces:

    - + @@ -135,7 +153,7 @@ zone. In /etc/shorewall/interfaces:

    You can rename the modified tunnel scripts if you like; be sure that they are secured so that root can execute them.

    -

    You will need to allow traffic between the "gw" zone and +

    You will need to allow traffic between the "vpn" zone and the "loc" zone on both systems -- if you simply want to admit all traffic in both directions, you can use the policy file:

    @@ -150,13 +168,13 @@ secured so that root can execute them.

    - + - + @@ -168,7 +186,7 @@ secured so that root can execute them.

    run the modified tunnel script with the "start" argument on each system. The systems in the two masqueraded subnetworks can now talk to each other

    -

    Updated 5/18/2002 - Tom +

    Updated 8/22/2002 - Tom Eastep

    Copyright © 2001, 2002 Thomas M. Eastep.

    diff --git a/Shorewall-docs/Install.htm b/Shorewall-docs/Install.htm index 468f4b2e7..4e68cef62 100644 --- a/Shorewall-docs/Install.htm +++ b/Shorewall-docs/Install.htm @@ -11,11 +11,14 @@
    OPTIONS
    gwvpn tosysa 192.168.1.255  
    locgwvpn ACCEPT  
    gwvpn loc ACCEPT  
    -

    Shorewall Installation

    +

    Shorewall Installation and Upgrade
    +

    Before upgrading, be sure to review the +Upgrade Issues

    +

    Install using RPM
    Install using tarball
    @@ -163,7 +166,7 @@ QuickStart Guides contain all of the information you need.

    the firewall system.
  • /etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC addresses.
    • -

    Updated 8/7/2002 - Tom +

    Updated 9/13/2002 - Tom Eastep

    Copyright © 2001, 2002 Thomas M. Eastep.

    diff --git a/Shorewall-docs/News.htm b/Shorewall-docs/News.htm index 78ec4d63d..b7bf7a75a 100644 --- a/Shorewall-docs/News.htm +++ b/Shorewall-docs/News.htm @@ -1,1033 +1,1239 @@ + - - -Shorewall News - - + + + Shorewall News + + + + - - - - - - - + + +
    -

    Shorewall News Archive

    -
    + + + + + +
    +

    Shorewall News Archive

    +
    - -

    8/22/2002 - Shorewall 1.3.7 Released 8/13/2002

    - -

    Features in this release include:

    - -
      -
    • The 'icmp.def' file is now empty! The rules in that file were required in - ipchains firewalls but are not required in Shorewall. Users who have - ALLOWRELATED=No in shorewall.conf should - see the Upgrade Issues.
      • -
    • A 'FORWARDPING' option has been added to - shorewall.conf. The effect of setting this variable to Yes is the same as - the effect of adding an ACCEPT rule for ICMP echo-request in - /etc/shorewall/icmpdef. Users - who have such a rule in icmpdef are encouraged to switch to FORWARDPING=Yes.
      • -
    • The loopback CLASS A Network (127.0.0.0/8) has been added to the rfc1918 - file.
      • -
    • Shorewall now works with iptables 1.2.7
      • -
    • The documentation and web site no longer uses FrontPage themes.
      • + +

      9/16/2002 - Shorewall 1.3.8

      +

      In this version:
      +

      +
        +
      • A NEWNOTSYN option has been added to shorewall.conf. This option determines +whether Shorewall accepts TCP packets which are not part of an established +connection and that are not 'SYN' packets (SYN flag on and ACK flag off).
        • +
      • The need for the 'multi' option to communicate between zones za and +zb on the same interface is removed in the case where the chain 'za2zb' and/or +'zb2za' exists. 'za2zb' will exist if:
        • +
          +
        • +
          There is a policy for za to zb; or
          +
          • +
        • +
          There is at least one rule for za to zb.
          +
          • +
      - -

      I would like to thank John Distler for his valuable input regarding TCP SYN - and ICMP treatment in Shorewall. That input has led to marked improvement in - Shorewall in the last two releases.

      - -

      8/13/2002 - Documentation in the CVS Repository

      - -

      The Shorewall-docs project now contains just the HTML and image files - the - Frontpage files have been removed.

      - -

      8/7/2002 - STABLE branch added to CVS Repository

      - -

      This branch will only be updated after I release a new version of Shorewall - so you can always update from this branch to get the latest stable tree.

      - -

      8/7/2002 - Upgrade Issues section added - to the Errata Page

      - -

      Now there is one place to go to look for issues involved with upgrading to - recent versions of Shorewall.

      - -

      8/7/2002 - Shorewall 1.3.6

      - -

      This is primarily a bug-fix rollup with a couple of new features:

      - -
        -
      • The latest QuickStart Guides - including the Shorewall Setup Guide.
        • -
      • Shorewall will now DROP TCP packets that are not part of or - related to an existing connection and that are not SYN packets. These "New - not SYN" packets may be optionally logged by setting the LOGNEWNOTSYN option - in /etc/shorewall/shorewall.conf.
        • -
      • The processing of "New not SYN" packets may be extended by commands in - the new newnotsyn extension script.
        • +
          +
        • The /etc/shorewall/blacklist file now contains three columns. In addition +to the SUBNET/ADDRESS column, there are optional PROTOCOL and PORT columns +to block only certain applications from the blacklisted addresses.
          +
        - -

        7/30/2002 - Shorewall 1.3.5b Released

        - -

        This interim release:

        - -
          -
        • Causes the firewall script to remove the lock file if it is killed.
          • -
        • Once again allows lists in the second column of the - /etc/shorewall/hosts file.
          • -
        • Includes the latest QuickStart - Guides.
          • +

          9/11/2002 - Debian 1.3.7c Packages Available

          + +

          Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

          + +

          9/2/2002 - Shorewall 1.3.7c

          + +

          This is a role up of a fix for "DNAT" rules where the source zone is $FW + (fw).

          + +

          8/31/2002 - I'm not available

          + +

          I'm currently on vacation  -- please respect my need for a couple of +weeks free of Shorewall problem reports.

          + +

          -Tom

          + +

          8/26/2002 - Shorewall 1.3.7b

          + +

          This is a role up of the "shorewall refresh" bug fix and the change which + reverses the order of "dhcp" and "norfc1918" checking.

          + +

          8/26/2002 - French FTP Mirror is Operational

          + +

          ftp://france.shorewall.net/pub/mirrors/shorewall +is now available.

          + +

          8/25/2002 - Shorewall Mirror in France

          + +

          Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored + at http://france.shorewall.net.

          + +

          8/25/2002 - Shorewall 1.3.7a Debian Packages Available

          + +

          Lorenzo Martignoni reports that the packages for version 1.3.7a are available +at http://security.dsi.unimi.it/~lorenzo/debian.html.

          + +

          8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author +-- Shorewall 1.3.7a released +

          + +

          1.3.7a corrects problems occurring in rules file processing when starting +Shorewall 1.3.7.

          + +

          8/22/2002 - Shorewall 1.3.7 Released 8/13/2002

          + +

          Features in this release include:

          + +
            +
          • The 'icmp.def' file is now empty! The rules in that file were required +in ipchains firewalls but are not required in Shorewall. Users who have + ALLOWRELATED=No in shorewall.conf +should see the Upgrade Issues.
            • +
          • A 'FORWARDPING' option has been added to shorewall.conf. The effect of setting +this variable to Yes is the same as the effect of adding an ACCEPT rule +for ICMP echo-request in /etc/shorewall/icmpdef. +Users who have such a rule in icmpdef are encouraged to switch to FORWARDPING=Yes.
            • +
          • The loopback CLASS A Network (127.0.0.0/8) has been added to the +rfc1918 file.
            • +
          • Shorewall now works with iptables 1.2.7
            • +
          • The documentation and web site no longer uses FrontPage themes.
            • +
          - -

          7/29/2002 - New Shorewall Setup Guide Available

          - -

          The first draft of this guide is available at - - http://www.shorewall.net/shorewall_setup_guide.htm. The guide is intended - for use by people who are setting up Shorewall to manage multiple public IP - addresses and by people who want to learn more about Shorewall than is - described in the single-address guides. Feedback on the new guide is welcome.

          - -

          7/28/2002 - Shorewall 1.3.5 Debian Package Available

          - -

          Lorenzo Martignoni reports that the packages are version 1.3.5a and are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

          - -

          7/27/2002 - Shorewall 1.3.5a Released

          - -

          This interim release restores correct handling of REDIRECT rules.

          - -

          7/26/2002 - Shorewall 1.3.5 Released

          - -

          This will be the last Shorewall release for a while. I'm going to be - focusing on rewriting a lot of the documentation.

          - -

           In this version:

          - -
            -
          • Empty and invalid source and destination qualifiers are now detected in - the rules file. It is a good idea to use the 'shorewall check' command before - you issue a 'shorewall restart' command be be sure that you don't have any - configuration problems that will prevent a successful restart.
            • -
          • Added MERGE_HOSTS variable in - shorewall.conf to provide saner behavior of the /etc/shorewall/hosts - file.
            • -
          • The time that the counters were last reset is now displayed in the - heading of the 'status' and 'show' commands.
            • -
          • A proxyarp option has been added for entries in - /etc/shorewall/interfaces. This - option facilitates Proxy ARP sub-netting as described in the Proxy ARP - subnetting mini-HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/). - Specifying the proxyarp option for an interface causes Shorewall to set - /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
            • -
          • The Samples have been updated to reflect the new capabilities in this - release.
            • + +

            I would like to thank John Distler for his valuable input regarding TCP +SYN and ICMP treatment in Shorewall. That input has led to marked improvement +in Shorewall in the last two releases.

            + +

            8/13/2002 - Documentation in the CVS Repository

            + +

            The Shorewall-docs project now contains just the HTML and image files +- the Frontpage files have been removed.

            + +

            8/7/2002 - STABLE branch added to CVS Repository

            + +

            This branch will only be updated after I release a new version of Shorewall + so you can always update from this branch to get the latest stable tree.

            + +

            8/7/2002 - Upgrade Issues section +added to the Errata Page

            + +

            Now there is one place to go to look for issues involved with upgrading +to recent versions of Shorewall.

            + +

            8/7/2002 - Shorewall 1.3.6

            + +

            This is primarily a bug-fix rollup with a couple of new features:

            + + - -

            7/16/2002 - New Mirror in Argentina

            - -

            Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in - Argentina. Thanks Buanzo!!!

            - -

            7/16/2002 - Shorewall 1.3.4 Released

            - -

            In this version:

            - -
              -
            • A new - /etc/shorewall/routestopped file has been added. This file is intended to - eventually replace the routestopped option in the - /etc/shorewall/interface and /etc/shorewall/hosts files. This new file makes - remote firewall administration easier by allowing any IP or subnet to be - enabled while Shorewall is stopped.
              • -
            • An /etc/shorewall/stopped extension - script has been added. This script is invoked after Shorewall has - stopped.
              • -
            • A DETECT_DNAT_ADDRS option has been added to - /etc/shoreall/shorewall.conf. When this - option is selected, DNAT rules only apply when the destination address is the - external interface's primary IP address.
              • -
            • The QuickStart Guide has - been broken into three guides and has been almost entirely rewritten.
              • -
            • The Samples have been updated to reflect the new capabilities in this - release.
              • + +

              7/30/2002 - Shorewall 1.3.5b Released

              + +

              This interim release:

              + +
                +
              • Causes the firewall script to remove the lock file if it is killed.
                • +
              • Once again allows lists in the second column of the /etc/shorewall/hosts file.
                • +
              • Includes the latest QuickStart + Guides.
                • +
              - -

              7/8/2002 - Shorewall 1.3.3 Debian Package Available

              - -

              Lorenzo Marignoni reports that the packages are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

              - -

              7/6/2002 - Shorewall 1.3.3 Released

              - -

              In this version:

              - -
                -
              • Entries in /etc/shorewall/interface that use the wildcard character ("+") - now have the "multi" option assumed.
                • -
              • The 'rfc1918' chain in the mangle table has been renamed 'man1918' to - make log messages generated from that chain distinguishable from those - generated by the 'rfc1918' chain in the filter table.
                • -
              • Interface names appearing in the hosts file are now validated against the - interfaces file.
                • -
              • The TARGET column in the rfc1918 file is now checked for correctness.
                • -
              • The chain structure in the nat table has been changed to reduce the - number of rules that a packet must traverse and to correct problems with - NAT_BEFORE_RULES=No
                • -
              • The "hits" command has been enhanced.
                • + +

                7/29/2002 - New Shorewall Setup Guide Available

                + +

                The first draft of this guide is available at http://www.shorewall.net/shorewall_setup_guide.htm. +The guide is intended for use by people who are setting up Shorewall to +manage multiple public IP addresses and by people who want to learn more +about Shorewall than is described in the single-address guides. Feedback +on the new guide is welcome.

                + +

                7/28/2002 - Shorewall 1.3.5 Debian Package Available

                + +

                Lorenzo Martignoni reports that the packages are version 1.3.5a and are +available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                + +

                7/27/2002 - Shorewall 1.3.5a Released

                + +

                This interim release restores correct handling of REDIRECT rules.

                + +

                7/26/2002 - Shorewall 1.3.5 Released

                + +

                This will be the last Shorewall release for a while. I'm going to be +focusing on rewriting a lot of the documentation.

                + +

                 In this version:

                + +
                  +
                • Empty and invalid source and destination qualifiers are now detected +in the rules file. It is a good idea to use the 'shorewall check' command +before you issue a 'shorewall restart' command be be sure that you don't +have any configuration problems that will prevent a successful restart.
                  • +
                • Added MERGE_HOSTS variable in shorewall.conf to provide saner behavior +of the /etc/shorewall/hosts file.
                  • +
                • The time that the counters were last reset is now displayed in the + heading of the 'status' and 'show' commands.
                  • +
                • A proxyarp option has been added for entries in /etc/shorewall/interfaces. This + option facilitates Proxy ARP sub-netting as described in the Proxy ARP + subnetting mini-HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/). + Specifying the proxyarp option for an interface causes Shorewall to set + /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
                  • +
                • The Samples have been updated to reflect the new capabilities in +this release.
                  • +
                - -

                6/25/2002 - Samples Updated for 1.3.2

                - -

                The comments in the sample configuration files have been updated to reflect - new features introduced in Shorewall 1.3.2.

                - -

                6/25/2002 - Shorewall 1.3.1 Debian Package Available

                - -

                Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                - -

                6/19/2002 - Documentation Available in PDF Format

                - -

                Thanks to Mike Martinez, the Shorewall Documentation is now available for - download in Adobe - PDF format.

                - -

                6/16/2002 - Shorewall 1.3.2 Released

                - -

                In this version:

                - -
                  -
                • A logwatch command has been - added to /sbin/shorewall.
                  • -
                • A dynamic blacklist facility has - been added.
                  • -
                • Support for the Netfilter multiport - match function has been added.
                  • -
                • The files firewall, functions and version have been moved - from /etc/shorewall to /var/lib/shorewall.
                  • + +

                  7/16/2002 - New Mirror in Argentina

                  + +

                  Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in + Argentina. Thanks Buanzo!!!

                  + +

                  7/16/2002 - Shorewall 1.3.4 Released

                  + +

                  In this version:

                  + +
                    +
                  • A new /etc/shorewall/routestopped +file has been added. This file is intended to eventually replace the + routestopped option in the /etc/shorewall/interface and /etc/shorewall/hosts +files. This new file makes remote firewall administration easier by allowing +any IP or subnet to be enabled while Shorewall is stopped.
                    • +
                  • An /etc/shorewall/stopped extension + script has been added. This script is invoked after Shorewall has + stopped.
                    • +
                  • A DETECT_DNAT_ADDRS option has been added to /etc/shoreall/shorewall.conf. When this + option is selected, DNAT rules only apply when the destination address +is the external interface's primary IP address.
                    • +
                  • The QuickStart Guide +has been broken into three guides and has been almost entirely rewritten.
                    • +
                  • The Samples have been updated to reflect the new capabilities in +this release.
                    • +
                  - -

                  6/6/2002 - Why CVS Web access is Password Protected

                  - -

                  Last weekend, I installed the CVS Web package to provide brower-based access - to the Shorewall CVS repository. Since then, I have had several instances where - my server was almost unusable due to the high load generated by website copying - tools like HTTrack and WebStripper. These mindless tools:

                  - -
                    -
                  • Ignore robot.txt files.
                    • -
                  • Recursively copy everything that they find.
                    • -
                  • Should be classified as weapons rather than tools.
                    • + +

                    7/8/2002 - Shorewall 1.3.3 Debian Package Available

                    + +

                    Lorenzo Marignoni reports that the packages are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                    + +

                    7/6/2002 - Shorewall 1.3.3 Released

                    + +

                    In this version:

                    + +
                      +
                    • Entries in /etc/shorewall/interface that use the wildcard character +("+") now have the "multi" option assumed.
                      • +
                    • The 'rfc1918' chain in the mangle table has been renamed 'man1918' +to make log messages generated from that chain distinguishable from those + generated by the 'rfc1918' chain in the filter table.
                      • +
                    • Interface names appearing in the hosts file are now validated against +the interfaces file.
                      • +
                    • The TARGET column in the rfc1918 file is now checked for correctness.
                      • +
                    • The chain structure in the nat table has been changed to reduce the + number of rules that a packet must traverse and to correct problems with + NAT_BEFORE_RULES=No
                      • +
                    • The "hits" command has been enhanced.
                      • +
                    - -

                    These tools/weapons are particularly damaging when combined with CVS Web - because they doggedly follow every link in the cgi-generated HTML resulting in - 1000s of executions of the cvsweb.cgi script. Yesterday, I spend several hours - implementing measures to block these tools but unfortunately, these measures - resulted in my server OOM-ing under even moderate load.

                    - -

                    Until I have the time to understand the cause of the OOM (or until I buy - more RAM if that is what is required), CVS Web access will remain Password - Protected.

                    - -

                    6/5/2002 - Shorewall 1.3.1 Debian Package Available

                    - -

                    Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                    - -

                    6/2/2002 - Samples Corrected

                    - -

                    The 1.3.0 samples configurations had several serious problems that prevented - DNS and SSH from working properly. These problems have been corrected in the - 1.3.1 samples.

                    - -

                    6/1/2002 - Shorewall 1.3.1 Released

                    - -

                    Hot on the heels of 1.3.0, this release:

                    - -
                      -
                    • Corrects a serious problem with "all <zone> CONTINUE" policies. - This problem is present in all versions of Shorewall that support the - CONTINUE policy. These previous versions optimized away the "all2<zone>" - chain and replaced it with the "all2all" chain with the usual result that a - policy of REJECT was enforced rather than the intended CONTINUE policy.
                      • -
                    • Adds an /etc/shorewall/rfc1918 - file for defining the exact behavior of the - 'norfc1918' interface option.
                      • + +

                      6/25/2002 - Samples Updated for 1.3.2

                      + +

                      The comments in the sample configuration files have been updated to reflect + new features introduced in Shorewall 1.3.2.

                      + +

                      6/25/2002 - Shorewall 1.3.1 Debian Package Available

                      + +

                      Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                      + +

                      6/19/2002 - Documentation Available in PDF Format

                      + +

                      Thanks to Mike Martinez, the Shorewall Documentation is now available +for download in Adobe PDF format.

                      + +

                      6/16/2002 - Shorewall 1.3.2 Released

                      + +

                      In this version:

                      + + - -

                      5/29/2002 - Shorewall 1.3.0 Released

                      - -

                      In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 - includes:

                      - -
                        -
                      • A 'filterping' interface option that allows ICMP echo-request (ping) - requests addressed to the firewall to be handled by entries in - /etc/shorewall/rules and /etc/shorewall/policy.
                        • + +

                        6/6/2002 - Why CVS Web access is Password Protected

                        + +

                        Last weekend, I installed the CVS Web package to provide brower-based +access to the Shorewall CVS repository. Since then, I have had several +instances where my server was almost unusable due to the high load generated +by website copying tools like HTTrack and WebStripper. These mindless tools:

                        + +
                          +
                        • Ignore robot.txt files.
                          • +
                        • Recursively copy everything that they find.
                          • +
                        • Should be classified as weapons rather than tools.
                          • +
                        - -

                        5/23/2002 - Shorewall 1.3 RC1 Available

                        - -

                        In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) - incorporates the following:

                        - -
                          -
                        • Support for the /etc/shorewall/whitelist file has been withdrawn. If you - need whitelisting, see these - instructions.
                          • + +

                          These tools/weapons are particularly damaging when combined with CVS Web + because they doggedly follow every link in the cgi-generated HTML resulting +in 1000s of executions of the cvsweb.cgi script. Yesterday, I spend several +hours implementing measures to block these tools but unfortunately, these +measures resulted in my server OOM-ing under even moderate load.

                          + +

                          Until I have the time to understand the cause of the OOM (or until I buy + more RAM if that is what is required), CVS Web access will remain Password + Protected.

                          + +

                          6/5/2002 - Shorewall 1.3.1 Debian Package Available

                          + +

                          Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                          + +

                          6/2/2002 - Samples Corrected

                          + +

                          The 1.3.0 samples configurations had several serious problems that prevented + DNS and SSH from working properly. These problems have been corrected in +the 1.3.1 samples.

                          + +

                          6/1/2002 - Shorewall 1.3.1 Released

                          + +

                          Hot on the heels of 1.3.0, this release:

                          + +
                            +
                          • Corrects a serious problem with "all <zone> CONTINUE" +policies. This problem is present in all versions of Shorewall that support +the CONTINUE policy. These previous versions optimized away the "all2<zone>" + chain and replaced it with the "all2all" chain with the usual result +that a policy of REJECT was enforced rather than the intended CONTINUE +policy.
                            • +
                          • Adds an /etc/shorewall/rfc1918 + file for defining the exact behavior of the 'norfc1918' interface option.
                            • +
                          - -

                          5/19/2002 - Shorewall 1.3 Beta 2 Available

                          - -

                          In addition to the changes in Beta 1, this release which carries the - designation 1.2.91 adds:

                          - -
                            -
                          • The structure of the firewall is changed markedly. There is now an INPUT - and a FORWARD chain for each interface; this reduces the number of rules that - a packet must traverse, especially in complicated setups.
                            • -
                          • Sub-zones may now be excluded from - DNAT and REDIRECT rules.
                            • -
                          • The names of the columns in a number of the configuration files have been - changed to be more consistent and self-explanatory and the documentation has - been updated accordingly.
                            • -
                          • The sample configurations have been updated for 1.3.
                            • + +

                            5/29/2002 - Shorewall 1.3.0 Released

                            + +

                            In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 + includes:

                            + +
                              +
                            • A 'filterping' interface option that allows ICMP echo-request (ping) + requests addressed to the firewall to be handled by entries in /etc/shorewall/rules +and /etc/shorewall/policy.
                              • +
                            - -

                            5/17/2002 - Shorewall 1.3 Beta 1 Available

                            - -

                            Beta 1 carries the version designation 1.2.90 and implements the following - features:

                            - -
                              -
                            • Simplified rule syntax which makes the intent of each rule clearer and - hopefully makes Shorewall easier to learn.
                              • -
                            • Upward compatibility with 1.2 configuration files has been maintained so - that current users can migrate to the new syntax at their convenience.
                              • -
                            • WARNING:  Compatibility with the old - parameterized sample configurations has NOT been maintained. Users still - running those configurations should migrate to the new sample configurations - before upgrading to 1.3 Beta 1.
                              • + +

                              5/23/2002 - Shorewall 1.3 RC1 Available

                              + +

                              In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) + incorporates the following:

                              + +
                                +
                              • Support for the /etc/shorewall/whitelist file has been withdrawn. +If you need whitelisting, see these instructions.
                                • +
                              - -

                              5/4/2002 - Shorewall 1.2.13 is Available

                              - -

                              In this version:

                              - -
                                -
                              • White-listing is supported.
                                • -
                              • SYN-flood protection is added.
                                • -
                              • IP addresses added under ADD_IP_ALIASES - and ADD_SNAT_ALIASES now inherit the VLSM and Broadcast Address of the - interface's primary IP address.
                                • -
                              • The order in which port forwarding DNAT and Static DNAT - can now be reversed so that port - forwarding rules can override the contents of - /etc/shorewall/nat.
                                • + +

                                5/19/2002 - Shorewall 1.3 Beta 2 Available

                                + +

                                In addition to the changes in Beta 1, this release which carries the +designation 1.2.91 adds:

                                + +
                                  +
                                • The structure of the firewall is changed markedly. There is now an +INPUT and a FORWARD chain for each interface; this reduces the number +of rules that a packet must traverse, especially in complicated setups.
                                  • +
                                • Sub-zones may now be excluded +from DNAT and REDIRECT rules.
                                  • +
                                • The names of the columns in a number of the configuration files have +been changed to be more consistent and self-explanatory and the documentation +has been updated accordingly.
                                  • +
                                • The sample configurations have been updated for 1.3.
                                  • +
                                - -

                                4/30/2002 - Shorewall Debian News

                                - -

                                Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the - Debian - Testing Branch and the - Debian - Unstable Branch.

                                - -

                                4/20/2002 - Shorewall 1.2.12 is Available

                                - -
                                  -
                                • The 'try' command works again
                                  • -
                                • There is now a single RPM that also works with SuSE.
                                  • + +

                                  5/17/2002 - Shorewall 1.3 Beta 1 Available

                                  + +

                                  Beta 1 carries the version designation 1.2.90 and implements the following + features:

                                  + +
                                    +
                                  • Simplified rule syntax which makes the intent of each rule clearer +and hopefully makes Shorewall easier to learn.
                                    • +
                                  • Upward compatibility with 1.2 configuration files has been maintained +so that current users can migrate to the new syntax at their convenience.
                                    • +
                                  • WARNING:  Compatibility with the old + parameterized sample configurations has NOT been maintained. Users still + running those configurations should migrate to the new sample configurations + before upgrading to 1.3 Beta 1.
                                    • +
                                  - -

                                  4/17/2002 - Shorewall Debian News

                                  - -

                                  Lorenzo Marignoni reports that:

                                  - -
                                    -
                                  • Shorewall 1.2.10 is in the - Debian - Testing Branch
                                    • -
                                  • Shorewall 1.2.11 is in the - Debian - Unstable Branch
                                    • + +

                                    5/4/2002 - Shorewall 1.2.13 is Available

                                    + +

                                    In this version:

                                    + + - -

                                    Thanks, Lorenzo!

                                    - -

                                    4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE

                                    - -

                                    Thanks to Stefan Mohr, there is - now a Shorewall 1.2.11 - + +

                                    4/30/2002 - Shorewall Debian News

                                    + +

                                    Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the +Debian + Testing Branch and the Debian + Unstable Branch.

                                    + +

                                    4/20/2002 - Shorewall 1.2.12 is Available

                                    + +
                                      +
                                    • The 'try' command works again
                                      • +
                                    • There is now a single RPM that also works with SuSE.
                                      • + +
                                    + +

                                    4/17/2002 - Shorewall Debian News

                                    + +

                                    Lorenzo Marignoni reports that:

                                    + + + +

                                    Thanks, Lorenzo!

                                    + +

                                    4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE

                                    + +

                                    Thanks to Stefan Mohr, there +is now a Shorewall 1.2.11 SuSE RPM available.

                                    - -

                                    4/13/2002 - Shorewall 1.2.11 Available

                                    - -

                                    In this version:

                                    - -
                                      -
                                    • The 'try' command now accepts an optional timeout. If the timeout is - given in the command, the standard configuration will automatically be - restarted after the new configuration has been running for that length of - time. This prevents a remote admin from being locked out of the firewall in - the case where the new configuration starts but prevents access.
                                      • -
                                    • Kernel route filtering may now be enabled globally using the new - ROUTE_FILTER parameter in - /etc/shorewall/shorewall.conf.
                                      • -
                                    • Individual IP source addresses and/or subnets may now be excluded from - masquerading/SNAT.
                                      • -
                                    • Simple "Yes/No" and "On/Off" values are now case-insensitive in - /etc/shorewall/shorewall.conf.
                                      • + +

                                      4/13/2002 - Shorewall 1.2.11 Available

                                      + +

                                      In this version:

                                      + +
                                        +
                                      • The 'try' command now accepts an optional timeout. If the timeout +is given in the command, the standard configuration will automatically +be restarted after the new configuration has been running for that length +of time. This prevents a remote admin from being locked out of the firewall +in the case where the new configuration starts but prevents access.
                                        • +
                                      • Kernel route filtering may now be enabled globally using the new + ROUTE_FILTER parameter in /etc/shorewall/shorewall.conf.
                                        • +
                                      • Individual IP source addresses and/or subnets may now be excluded +from masquerading/SNAT.
                                        • +
                                      • Simple "Yes/No" and "On/Off" values are now case-insensitive in + /etc/shorewall/shorewall.conf.
                                        • +
                                      - -

                                      4/13/2002 - Hamburg Mirror now has FTP

                                      - -

                                      Stefan now has an FTP mirror at - - ftp://germany.shorewall.net/pub/shorewall.  Thanks Stefan!

                                      - -

                                      4/12/2002 - New Mirror in Hamburg

                                      - -

                                      Thanks to Stefan Mohr, there is - now a mirror of the Shorewall website at - - http://germany.shorewall.net.

                                      - -

                                      4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available

                                      - -

                                      Version 1.1 of the QuickStart Guide - is now available. Thanks to those who have read version 1.0 and offered their - suggestions. Corrections have also been made to the sample scripts.

                                      - -

                                      4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available

                                      - -

                                      Version 1.0 of the QuickStart Guide - is now available. This Guide and its accompanying sample configurations are - expected to provide a replacement for the recently withdrawn parameterized - samples.

                                      - -

                                      4/8/2002 - Parameterized Samples Withdrawn

                                      - -

                                      Although the parameterized - samples have allowed people to get a firewall up and running quickly, they - have unfortunately set the wrong level of expectation among those who have used - them. I am therefore withdrawing support for the samples and I am recommending - that they not be used in new Shorewall installations.

                                      - -

                                      4/2/2002 - Updated Log Parser

                                      - -

                                      John Lodge has provided an updated - version of his - CGI-based log parser with corrected date - handling.

                                      - -

                                      3/30/2002 - Shorewall Website Search Improvements

                                      - -

                                      The quick search on the home page now excludes the mailing list archives. - The Extended Search allows excluding the - archives or restricting the search to just the archives. An archive search form - is also available on the mailing list information - page.

                                      - -

                                      3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)

                                      - -
                                        -
                                      • The 1.2.10 Debian Package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.
                                        • -
                                      • Shorewall 1.2.9 is now in the - Debian - Unstable Distribution.
                                        • + +

                                        4/13/2002 - Hamburg Mirror now has FTP

                                        + +

                                        Stefan now has an FTP mirror at ftp://germany.shorewall.net/pub/shorewall.  +Thanks Stefan!

                                        + +

                                        4/12/2002 - New Mirror in Hamburg

                                        + +

                                        Thanks to Stefan Mohr, there +is now a mirror of the Shorewall website at http://germany.shorewall.net. +

                                        + +

                                        4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available

                                        + +

                                        Version 1.1 of the QuickStart +Guide is now available. Thanks to those who have read version 1.0 and +offered their suggestions. Corrections have also been made to the sample +scripts.

                                        + +

                                        4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available

                                        + +

                                        Version 1.0 of the QuickStart +Guide is now available. This Guide and its accompanying sample configurations +are expected to provide a replacement for the recently withdrawn parameterized + samples.

                                        + +

                                        4/8/2002 - Parameterized Samples Withdrawn

                                        + +

                                        Although the parameterized + samples have allowed people to get a firewall up and running quickly, +they have unfortunately set the wrong level of expectation among those +who have used them. I am therefore withdrawing support for the samples +and I am recommending that they not be used in new Shorewall installations.

                                        + +

                                        4/2/2002 - Updated Log Parser

                                        + +

                                        John Lodge has provided an updated + version of his CGI-based log parser +with corrected date handling.

                                        + +

                                        3/30/2002 - Shorewall Website Search Improvements

                                        + +

                                        The quick search on the home page now excludes the mailing list archives. + The Extended Search allows excluding the + archives or restricting the search to just the archives. An archive search +form is also available on the mailing list information + page.

                                        + +

                                        3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)

                                        + + - -

                                        3/25/2002 - Log Parser Available

                                        - -

                                        John Lodge has provided a - CGI-based log parser for Shorewall. Thanks - John.

                                        - -

                                        3/20/2002 - Shorewall 1.2.10 Released

                                        - -

                                        In this version:

                                        - -
                                          -
                                        • A "shorewall try" command has been added (syntax: shorewall try - <configuration directory>). This command attempts "shorewall -c - <configuration directory> start" and if that results in the firewall - being stopped due to an error, a "shorewall start" command is executed. The - 'try' command allows you to create a new - configuration and attempt to start it; if there is an error that leaves - your firewall in the stopped state, it will automatically be restarted using - the default configuration (in /etc/shorewall).
                                          • -
                                        • A new variable ADD_SNAT_ALIASES has been added to - /etc/shorewall/shorewall.conf. If this - variable is set to "Yes", Shorewall will automatically add IP addresses - listed in the third column of the - /etc/shorewall/masq file.
                                          • -
                                        • Copyright notices have been added to the documenation.
                                          • + +

                                          3/25/2002 - Log Parser Available

                                          + +

                                          John Lodge has provided a CGI-based log parser for Shorewall. Thanks + John.

                                          + +

                                          3/20/2002 - Shorewall 1.2.10 Released

                                          + +

                                          In this version:

                                          + +
                                            +
                                          • A "shorewall try" command has been added (syntax: shorewall try + <configuration directory>). This command attempts "shorewall +-c <configuration directory> start" and if that results +in the firewall being stopped due to an error, a "shorewall start" command +is executed. The 'try' command allows you to create a new configuration and attempt to start +it; if there is an error that leaves your firewall in the stopped state, +it will automatically be restarted using the default configuration (in +/etc/shorewall).
                                            • +
                                          • A new variable ADD_SNAT_ALIASES has been added to /etc/shorewall/shorewall.conf. If this + variable is set to "Yes", Shorewall will automatically add IP addresses + listed in the third column of the + /etc/shorewall/masq file.
                                            • +
                                          • Copyright notices have been added to the documenation.
                                            • +
                                          - -

                                          3/11/2002 - Shorewall 1.2.9 Released

                                          - -

                                          In this version:

                                          - -
                                            -
                                          • Filtering by MAC address has been added. - MAC addresses may be used as the source address in: -
                                            • -
                                          • Several bugs have been fixed
                                            • -
                                          • The 1.2.9 Debian Package is also available at http://security.dsi.unimi.it/~lorenzo/debian.html.
                                            • + +

                                            3/11/2002 - Shorewall 1.2.9 Released

                                            + +

                                            In this version:

                                            + + - -

                                            3/1/2002 - 1.2.8 Debian Package is Available

                                            - -

                                            See http://security.dsi.unimi.it/~lorenzo/debian.html

                                            - + +

                                            3/1/2002 - 1.2.8 Debian Package is Available

                                            + +

                                            See http://security.dsi.unimi.it/~lorenzo/debian.html

                                            +

                                            2/25/2002 - New Two-interface Sample

                                            -

                                            I've enhanced the two interface sample to allow access from the firewall to -servers in the local zone - - + +

                                            I've enhanced the two interface sample to allow access from the firewall +to servers in the local zone - http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

                                            - -

                                            2/23/2002 - Shorewall 1.2.8 Released

                                            - -

                                            Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects - problems associated with the lock file used to prevent multiple state-changing - operations from occuring simultaneously. My apologies for any inconvenience my - carelessness may have caused.

                                            - -

                                            2/22/2002 - Shorewall 1.2.7 Released

                                            - -

                                            In this version:

                                            - -
                                              -
                                            • UPnP probes (UDP destination port 1900) are now silently dropped in the - common chain
                                              • -
                                            • RFC 1918 checking in the mangle table has been streamlined to no longer - require packet marking. RFC 1918 checking in the filter table has been - changed to require half as many rules as previously.
                                              • -
                                            • A 'shorewall check' command has been added that does a cursory validation - of the zones, interfaces, hosts, rules and policy files.
                                              • + +

                                              2/23/2002 - Shorewall 1.2.8 Released

                                              + +

                                              Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects + problems associated with the lock file used to prevent multiple state-changing + operations from occuring simultaneously. My apologies for any inconvenience +my carelessness may have caused.

                                              + +

                                              2/22/2002 - Shorewall 1.2.7 Released

                                              + +

                                              In this version:

                                              + +
                                                +
                                              • UPnP probes (UDP destination port 1900) are now silently dropped +in the common chain
                                                • +
                                              • RFC 1918 checking in the mangle table has been streamlined to no +longer require packet marking. RFC 1918 checking in the filter table +has been changed to require half as many rules as previously.
                                                • +
                                              • A 'shorewall check' command has been added that does a cursory validation + of the zones, interfaces, hosts, rules and policy files.
                                                • +
                                              - -

                                              2/18/2002 - 1.2.6 Debian Package is Available

                                              - -

                                              See http://security.dsi.unimi.it/~lorenzo/debian.html

                                              - -

                                              2/8/2002 - Shorewall 1.2.6 Released

                                              - -

                                              In this version:

                                              - -
                                                -
                                              • $-variables may now be used anywhere in the configuration files except - /etc/shorewall/zones.
                                                • -
                                              • The interfaces and hosts files now have their contents validated before - any changes are made to the existing Netfilter configuration. The appearance - of a zone name that isn't defined in /etc/shorewall/zones causes "shorewall - start" and "shorewall restart" to abort without changing the Shorewall state. - Unknown options in either file cause a warning to be issued.
                                                • -
                                              • A problem occurring when BLACKLIST_LOGLEVEL was not set has been - corrected.
                                                • + +

                                                2/18/2002 - 1.2.6 Debian Package is Available

                                                + +

                                                See http://security.dsi.unimi.it/~lorenzo/debian.html

                                                + +

                                                2/8/2002 - Shorewall 1.2.6 Released

                                                + +

                                                In this version:

                                                + +
                                                  +
                                                • $-variables may now be used anywhere in the configuration files except + /etc/shorewall/zones.
                                                  • +
                                                • The interfaces and hosts files now have their contents validated +before any changes are made to the existing Netfilter configuration. +The appearance of a zone name that isn't defined in /etc/shorewall/zones +causes "shorewall start" and "shorewall restart" to abort without changing +the Shorewall state. Unknown options in either file cause a warning to +be issued.
                                                  • +
                                                • A problem occurring when BLACKLIST_LOGLEVEL was not set has been + corrected.
                                                  • +
                                                - -

                                                2/4/2002 - Shorewall 1.2.5 Debian Package Available

                                                - -

                                                see http://security.dsi.unimi.it/~lorenzo/debian.html

                                                - -

                                                2/1/2002 - Shorewall 1.2.5 Released

                                                - -

                                                Due to installation problems with Shorewall 1.2.4, I have released Shorewall + +

                                                2/4/2002 - Shorewall 1.2.5 Debian Package Available

                                                + +

                                                see http://security.dsi.unimi.it/~lorenzo/debian.html

                                                + +

                                                2/1/2002 - Shorewall 1.2.5 Released

                                                + +

                                                Due to installation problems with Shorewall 1.2.4, I have released Shorewall 1.2.5. Sorry for the rapid-fire development.

                                                - -

                                                In version 1.2.5:

                                                - + +

                                                In version 1.2.5:

                                                +
                                                  -
                                                • The installation problems have been corrected.
                                                  • -
                                                • SNAT is now supported.
                                                  • -
                                                • A "shorewall version" command has been added
                                                  • -
                                                • The default value of the STATEDIR variable in - /etc/shorewall/shorewall.conf has been changed to /var/lib/shorewall in - order to conform to the GNU/Linux File Hierarchy Standard, Version 2.2.
                                                  • +
                                                • The installation problems have been corrected.
                                                  • +
                                                • SNAT is now supported.
                                                  • +
                                                • A "shorewall version" command has been added
                                                  • +
                                                • The default value of the STATEDIR variable in /etc/shorewall/shorewall.conf +has been changed to /var/lib/shorewall in order to conform to the GNU/Linux +File Hierarchy Standard, Version 2.2.
                                                  • +
                                                - -

                                                1/28/2002 - Shorewall 1.2.4 Released

                                                - + +

                                                1/28/2002 - Shorewall 1.2.4 Released

                                                +
                                                  -
                                                • The "fw" zone may now be given a - different name.
                                                  • -
                                                • You may now place end-of-line comments (preceded by '#') in any of the - configuration files
                                                  • -
                                                • There is now protection against against two state changing operations - occuring concurrently. This is implemented using the 'lockfile' utility if - it is available (lockfile is part of procmail); otherwise, a less robust - technique is used. The lockfile is created in the STATEDIR defined in - /etc/shorewall/shorewall.conf and has the name "lock".
                                                  • -
                                                • "shorewall start" no longer fails if "detect" is - specified in /etc/shorewall/interfaces for an interface with subnet mask 255.255.255.255.
                                                  • +
                                                • The "fw" zone may now be given a + different name.
                                                  • +
                                                • You may now place end-of-line comments (preceded by '#') in any of +the configuration files
                                                  • +
                                                • There is now protection against against two state changing operations + occuring concurrently. This is implemented using the 'lockfile' utility +if it is available (lockfile is part of procmail); otherwise, a less +robust technique is used. The lockfile is created in the STATEDIR defined +in /etc/shorewall/shorewall.conf and has the name "lock".
                                                  • +
                                                • "shorewall start" no longer fails if "detect" is specified in + /etc/shorewall/interfaces +for an interface with subnet mask 255.255.255.255.
                                                  • +
                                                - -

                                                1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

                                                - -

                                                1/20/2002 - Corrected firewall script available 

                                                - -

                                                Corrects a problem with BLACKLIST_LOGLEVEL. See the + +

                                                1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

                                                + +

                                                1/20/2002 - Corrected firewall script available 

                                                + +

                                                Corrects a problem with BLACKLIST_LOGLEVEL. See the errata for details.

                                                - -

                                                1/19/2002 - Shorewall 1.2.3 Released

                                                - + +

                                                1/19/2002 - Shorewall 1.2.3 Released

                                                +

                                                This is a minor feature and bugfix release. The single new feature is:

                                                - +
                                                  -
                                                • Support for TCP MSS Clamp to PMTU -- This support is usually required when - the internet connection is via PPPoE or PPTP and may be enabled using the CLAMPMSS - option in /etc/shorewall/shorewall.conf.
                                                  • +
                                                • Support for TCP MSS Clamp to PMTU -- This support is usually required +when the internet connection is via PPPoE or PPTP and may be enabled +using the CLAMPMSS option in +/etc/shorewall/shorewall.conf.
                                                  • +
                                                +

                                                The following problems were corrected:

                                                +
                                                  -
                                                • The "shorewall status" command no longer hangs.
                                                  • -
                                                • The "shorewall monitor" command now displays the icmpdef chain
                                                  • -
                                                • The CLIENT PORT(S) column in tcrules is no longer ignored
                                                  • +
                                                • The "shorewall status" command no longer hangs.
                                                  • +
                                                • The "shorewall monitor" command now displays the icmpdef chain
                                                  • +
                                                • The CLIENT PORT(S) column in tcrules is no longer ignored
                                                  • +
                                                -

                                                1/18/2002 - Shorewall 1.2.2 packaged with new LEAF -release

                                                - -

                                                Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution -that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo + +

                                                1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release

                                                + +

                                                Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution +that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo for details.

                                                - -

                                                1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo -Martignoni, a 1.2.2 Shorewall Debian package is now available. There is a -link to Lorenzo's site from the Shorewall download page.

                                                - -

                                                1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This -corrected version restores the "shorewall status" command to -health.

                                                - -

                                                1/8/2002 - Shorewall 1.2.2 Released

                                                - + +

                                                1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 +Shorewall Debian package is now available. There is a link to Lorenzo's site +from the Shorewall download page.

                                                + +

                                                1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores +the "shorewall status" command to health.

                                                + +

                                                1/8/2002 - Shorewall 1.2.2 Released

                                                +

                                                In version 1.2.2

                                                - +
                                                  -
                                                • Support for IP blacklisting has been added -
                                                    -
                                                  • You specify whether you want packets from blacklisted hosts dropped or - rejected using the BLACKLIST_DISPOSITION +
                                                  • Support for IP blacklisting has been added + -
                                                    • -
                                                  • Use of TCP RST replies has been expanded  -
                                                      -
                                                    • TCP connection requests rejected because of a REJECT policy are now - replied with a TCP RST packet.
                                                      • -
                                                    • TCP connection requests rejected because of a protocol=all rule in - /etc/shorewall/rules are now replied with a TCP RST packet.
                                                      • -
                                                    -
                                                    • -
                                                  • A LOGFILE specification has been - added to /etc/shorewall/shorewall.conf. LOGFILE is used to tell the - /sbin/shorewall program where to look for Shorewall messages.
                                                    • +
                                                  • The black list is refreshed from /etc/shorewall/blacklist by the + "shorewall refresh" command.
                                                    • + +
                                                  +
                                                  • +
                                                • Use of TCP RST replies has been expanded  +
                                                    +
                                                  • TCP connection requests rejected because of a REJECT policy are +now replied with a TCP RST packet.
                                                    • +
                                                  • TCP connection requests rejected because of a protocol=all rule +in /etc/shorewall/rules are now replied with a TCP RST packet.
                                                    • + +
                                                  +
                                                  • +
                                                • A LOGFILE specification has +been added to /etc/shorewall/shorewall.conf. LOGFILE is used to tell +the /sbin/shorewall program where to look for Shorewall messages.
                                                  • +
                                                - -

                                                1/5/2002 - New Parameterized Samples (version -1.2.0) released. These are minor updates to the previously-released -samples. There are two new rules added:

                                                - + +

                                                1/5/2002 - New Parameterized Samples (version 1.2.0) released. These are minor updates +to the previously-released samples. There are two new rules added:

                                                +
                                                  -
                                                • Unless you have explicitly enabled Auth connections (tcp port 113) to your - firewall, these connections will be REJECTED rather than DROPPED. This - speeds up connection establishment to some servers.
                                                  • -
                                                • Orphan DNS replies are now silently dropped.
                                                  • +
                                                • Unless you have explicitly enabled Auth connections (tcp port 113) +to your firewall, these connections will be REJECTED rather than DROPPED. +This speeds up connection establishment to some servers.
                                                  • +
                                                • Orphan DNS replies are now silently dropped.
                                                  • +
                                                +

                                                See the README file for upgrade instructions.

                                                - -

                                                1/1/2002 - Shorewall Mailing List Moving

                                                - -

                                                The Shorewall mailing list hosted at Sourceforge is moving to Shorewall.net. - If you are a current subscriber to the list at Sourceforge, please see - these instructions. If you would like to subscribe to the new list, visit http://www.shorewall.net/mailman/listinfo/shorewall-users.

                                                - -

                                                12/31/2001 - Shorewall 1.2.1 Released

                                                - -

                                                In version 1.2.1:

                                                - + +

                                                1/1/2002 - Shorewall Mailing List Moving

                                                + +

                                                The Shorewall mailing list hosted at +Sourceforge is moving to Shorewall.net. If you are a current subscriber +to the list at Sourceforge, please see these instructions. +If you would like to subscribe to the new list, visit http://www.shorewall.net/mailman/listinfo/shorewall-users.

                                                + +

                                                12/31/2001 - Shorewall 1.2.1 Released

                                                + +

                                                In version 1.2.1:

                                                + - -

                                                12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist - releasing 1.2 on 12/21/2001

                                                - -

                                                Version 1.2 contains the following new features:

                                                - + +

                                                12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist +releasing 1.2 on 12/21/2001

                                                + +

                                                Version 1.2 contains the following new features:

                                                + -

                                                For the next month or so, I will continue to provide corrections to version - 1.1.18 as necessary so that current version 1.1.x users will not be forced into a - quick upgrade to 1.2.0 just to have access to bug fixes.

                                                -

                                                For those of you who have installed one of the Beta RPMS, you will need to - use the "--oldpackage" option when upgrading to 1.2.0:

                                                -
                                                + +

                                                For the next month or so, I will continue to provide corrections to version + 1.1.18 as necessary so that current version 1.1.x users will not be forced +into a quick upgrade to 1.2.0 just to have access to bug fixes.

                                                + +

                                                For those of you who have installed one of the Beta RPMS, you will need +to use the "--oldpackage" option when upgrading to 1.2.0:

                                                + +

                                                rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

                                                -
                                                - -

                                                12/19/2001 - Thanks to Steve -Cowles, there is now a Shorewall mirror in Texas. This web site is -mirrored at http://www.infohiiway.com/shorewall -and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

                                                - -

                                                11/30/2001 - A new set of the parameterized Sample - Configurations has been released. In this version:

                                                - +
                                                + +

                                                12/19/2001 - Thanks to Steve +Cowles, there is now a Shorewall mirror in Texas. This web site is +mirrored at http://www.infohiiway.com/shorewall +and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

                                                + +

                                                11/30/2001 - A new set of the parameterized Sample + Configurations has been released. In this version:

                                                +
                                                  -
                                                • Ping is now allowed between the zones.
                                                  • -
                                                • In the three-interface configuration, it is now possible to configure the - internet services that are to be available to servers in the DMZ. 
                                                  • +
                                                • Ping is now allowed between the zones.
                                                  • +
                                                • In the three-interface configuration, it is now possible to configure +the internet services that are to be available to servers in the DMZ. 
                                                  • +
                                                - -

                                                11/20/2001 - The current version of Shorewall is 1.1.18. 

                                                - -

                                                In this version:

                                                - + +

                                                11/20/2001 - The current version of Shorewall is 1.1.18. 

                                                + +

                                                In this version:

                                                +
                                                  -
                                                • The spelling of ADD_IP_ALIASES has been corrected in the shorewall.conf +
                                                • The spelling of ADD_IP_ALIASES has been corrected in the shorewall.conf file
                                                  • -
                                                • The logic for deleting user-defined chains has been simplified so that it - avoids a bug in the LRP version of the 'cut' utility.
                                                  • -
                                                • The /var/lib/lrpkg/shorwall.conf file has been corrected to properly +
                                                • The logic for deleting user-defined chains has been simplified so +that it avoids a bug in the LRP version of the 'cut' utility.
                                                  • +
                                                • The /var/lib/lrpkg/shorwall.conf file has been corrected to properly display the NAT entry in that file.
                                                  • +
                                                - -

                                                11/19/2001 - Thanks to Juraj - Ontkanin, there is now a Shorewall mirror in the Slovak Republic. The website is now mirrored at http://www.nrg.sk/mirror/shorewall - and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

                                                - -

                                                11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. + +

                                                11/19/2001 - Thanks to Juraj + Ontkanin, there is now a Shorewall mirror in the Slovak Republic. +The website is now mirrored at http://www.nrg.sk/mirror/shorewall + and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

                                                + +

                                                11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. There are three sample configurations:

                                                - +
                                                  -
                                                • One Interface -- for a standalone system.
                                                  • -
                                                • Two Interfaces -- A masquerading firewall.
                                                  • -
                                                • Three Interfaces -- A masquerading firewall with DMZ.
                                                  • +
                                                • One Interface -- for a standalone system.
                                                  • +
                                                • Two Interfaces -- A masquerading firewall.
                                                  • +
                                                • Three Interfaces -- A masquerading firewall with DMZ.
                                                  • +
                                                - - -

                                                Samples may be downloaded from - ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 + +

                                                Samples may be downloaded from ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 . See the README file for instructions.

                                                - -

                                                11/1/2001 - The current version of Shorewall is 1.1.17.  I intend + +

                                                11/1/2001 - The current version of Shorewall is 1.1.17.  I intend this to be the last of the 1.1 Shorewall releases.

                                                - -

                                                In this version:

                                                - + +

                                                In this version:

                                                + - -

                                                10/22/2001 - The current version of Shorewall is 1.1.16. In this + +

                                                10/22/2001 - The current version of Shorewall is 1.1.16. In this version:

                                                + +
                                                  +
                                                • A new "shorewall show connections" command has been added.
                                                  • +
                                                • In the "shorewall monitor" output, the currently tracked connections +are now shown on a separate page.
                                                  • +
                                                • Prior to this release, Shorewall unconditionally added the external +IP adddress(es) specified in /etc/shorewall/nat. Beginning with version + 1.1.16, a new parameter (ADD_IP_ALIASES) + may be set to "no" (or "No") to inhibit this behavior. This allows +IP aliases created using your distribution's network configuration +tools to be used in static NAT. 
                                                  • + +
                                                + +

                                                10/15/2001 - The current version of Shorewall is 1.1.15. In this +version:

                                                + +
                                                  +
                                                • Support for nested zones has been improved. See the documentation for details
                                                  • +
                                                • Shorewall now correctly checks the alternate configuration directory +for the 'zones' file.
                                                  • + +
                                                + +

                                                10/4/2001 - The current version of Shorewall is 1.1.14. In this +version

                                                  -
                                                • A new "shorewall show connections" command has been added.
                                                  • -
                                                • In the "shorewall monitor" output, the currently tracked - connections are now shown on a separate page.
                                                  • -
                                                • Prior to this release, Shorewall unconditionally added the external IP - adddress(es) specified in /etc/shorewall/nat. Beginning with version - 1.1.16, a new parameter (ADD_IP_ALIASES) - may be set to "no" (or "No") to inhibit this behavior. - This allows IP aliases created using your distribution's network - configuration tools to be used in static NAT. 
                                                  • -
                                                - -

                                                10/15/2001 - The current version of Shorewall is 1.1.15. In this -version:

                                                - -
                                                  -
                                                • Support for nested zones has been improved. See - the documentation - for details
                                                  • -
                                                • Shorewall now correctly checks the alternate configuration directory for - the 'zones' file.
                                                  • -
                                                - -

                                                10/4/2001 - The current version of Shorewall is 1.1.14. In this version

                                                - -
                                                  -
                                                • Shorewall now supports alternate configuration directories. When an - alternate directory is specified when starting or restarting Shorewall - (e.g., "shorewall -c /etc/testconf restart"), Shorewall will first - look for configuration files in the alternate directory then in - /etc/shorewall. To create an alternate configuration simply:
                                                  - 1. Create a New Directory
                                                  - 2. Copy to that directory any of your configuration files that you want to - change.
                                                  - 3. Modify the copied files as needed.
                                                  - 4. Restart Shorewall specifying the new directory.
                                                  • -
                                                • The rules for allowing/disallowing icmp echo-requests (pings) are now - moved after rules created when processing the rules file. This allows you to - add rules that selectively allow/deny ping based on source or destination - address.
                                                  • -
                                                • Rules that specify multiple client ip addresses or subnets no longer cause - startup failures.
                                                  • -
                                                • Zone names in the policy file are now validated against the zones file.
                                                  • -
                                                • If you have packet mangling - support enabled, the "norfc1918" - interface option now logs and drops any incoming packets on the interface +
                                                • Shorewall now supports alternate configuration directories. When an + alternate directory is specified when starting or restarting Shorewall + (e.g., "shorewall -c /etc/testconf restart"), Shorewall will first + look for configuration files in the alternate directory then in /etc/shorewall. +To create an alternate configuration simply:
                                                  + 1. Create a New Directory
                                                  + 2. Copy to that directory any of your configuration files that you want +to change.
                                                  + 3. Modify the copied files as needed.
                                                  + 4. Restart Shorewall specifying the new directory.
                                                  • +
                                                • The rules for allowing/disallowing icmp echo-requests (pings) are +now moved after rules created when processing the rules file. This allows +you to add rules that selectively allow/deny ping based on source or +destination address.
                                                  • +
                                                • Rules that specify multiple client ip addresses or subnets no longer +cause startup failures.
                                                  • +
                                                • Zone names in the policy file are now validated against the zones +file.
                                                  • +
                                                • If you have packet mangling + support enabled, the "norfc1918" + interface option now logs and drops any incoming packets on the interface that have an RFC 1918 destination address.
                                                  • +
                                                - -

                                                9/12/2001 - The current version of Shorewall is 1.1.13. In this version

                                                - + +

                                                9/12/2001 - The current version of Shorewall is 1.1.13. In this +version

                                                +
                                                  -
                                                • Shell variables can now be used to parameterize Shorewall rules.
                                                  • -
                                                • The second column in the hosts file may now contain a comma-separated +
                                                • Shell variables can now be used to parameterize Shorewall rules.
                                                  • +
                                                • The second column in the hosts file may now contain a comma-separated list.
                                                  -
                                                  - Example:
                                                  -     sea    - eth0:130.252.100.0/24,206.191.149.0/24
                                                  • -
                                                • Handling of multi-zone interfaces has been improved. See the documentation - for the /etc/shorewall/interfaces file.
                                                  • +
                                                  + Example:
                                                  +     sea    eth0:130.252.100.0/24,206.191.149.0/24 +
                                                • Handling of multi-zone interfaces has been improved. See the documentation for the /etc/shorewall/interfaces +file.
                                                  • +
                                                - -

                                                8/28/2001 - The current version of Shorewall is 1.1.12. In this version

                                                - + +

                                                8/28/2001 - The current version of Shorewall is 1.1.12. In this +version

                                                +
                                                  -
                                                • Several columns in the rules file may now contain comma-separated lists.
                                                  • -
                                                • Shorewall is now more rigorous in parsing the options in - /etc/shorewall/interfaces.
                                                  • -
                                                • Complementation using "!" is now supported in rules.
                                                  • +
                                                • Several columns in the rules file may now contain comma-separated +lists.
                                                  • +
                                                • Shorewall is now more rigorous in parsing the options in /etc/shorewall/interfaces.
                                                  • +
                                                • Complementation using "!" is now supported in rules.
                                                  • +
                                                - -

                                                7/28/2001 - The current version of Shorewall is 1.1.11. In this version

                                                - + +

                                                7/28/2001 - The current version of Shorewall is 1.1.11. In this +version

                                                +
                                                  -
                                                • A "shorewall refresh" command has been added to allow for - refreshing the rules associated with the broadcast address on a dynamic - interface. This command should be used in place of "shorewall - restart" when the internet interface's IP address changes.
                                                  • -
                                                • The /etc/shorewall/start file (if any) is now processed after all - temporary rules have been deleted. This change prevents the accidental +
                                                • A "shorewall refresh" command has been added to allow for refreshing +the rules associated with the broadcast address on a dynamic interface. +This command should be used in place of "shorewall restart" when the +internet interface's IP address changes.
                                                  • +
                                                • The /etc/shorewall/start file (if any) is now processed after all + temporary rules have been deleted. This change prevents the accidental removal of rules added during the processing of that file.
                                                  • -
                                                • The "dhcp" interface option is now applicable to firewall - interfaces used by a DHCP server running on the firewall.
                                                  • -
                                                • The RPM can now be built from the .tgz file using "rpm -tb" 
                                                  • +
                                                • The "dhcp" interface option is now applicable to firewall interfaces +used by a DHCP server running on the firewall.
                                                  • +
                                                • The RPM can now be built from the .tgz file using "rpm -tb" 
                                                  • +
                                                - -

                                                7/6/2001 - The current version of Shorewall is 1.1.10. In this version

                                                - + +

                                                7/6/2001 - The current version of Shorewall is 1.1.10. In this +version

                                                +
                                                  -
                                                • Shorewall now enables Ipv4 Packet Forwarding by default. Packet forwarding - may be disabled by specifying IP_FORWARD=Off in - /etc/shorewall/shorewall.conf. If you don't want Shorewall to enable or - disable packet forwarding, add IP_FORWARDING=Keep to your - /etc/shorewall/shorewall.conf file.
                                                  • -
                                                • The "shorewall hits" command no longer lists extraneous service - names in its last report.
                                                  • -
                                                • Erroneous instructions in the comments at the head of the firewall script - have been corrected.
                                                  • +
                                                • Shorewall now enables Ipv4 Packet Forwarding by default. Packet forwarding + may be disabled by specifying IP_FORWARD=Off in /etc/shorewall/shorewall.conf. +If you don't want Shorewall to enable or disable packet forwarding, add +IP_FORWARDING=Keep to your /etc/shorewall/shorewall.conf file.
                                                  • +
                                                • The "shorewall hits" command no longer lists extraneous service + names in its last report.
                                                  • +
                                                • Erroneous instructions in the comments at the head of the firewall +script have been corrected.
                                                  • +
                                                - -

                                                6/23/2001 - The current version of Shorewall is 1.1.9. In this version

                                                - + +

                                                6/23/2001 - The current version of Shorewall is 1.1.9. In this +version

                                                +
                                                  -
                                                • The "tunnels" file really is in the RPM now.
                                                  • -
                                                • SNAT can now be applied to port-forwarded connections.
                                                  • -
                                                • A bug which would cause firewall start failures in some dhcp configurations +
                                                • The "tunnels" file really is in the RPM now.
                                                  • +
                                                • SNAT can now be applied to port-forwarded connections.
                                                  • +
                                                • A bug which would cause firewall start failures in some dhcp configurations has been fixed.
                                                  • -
                                                • The firewall script now issues a message if you have the name of an - interface in the second column in an entry in /etc/shorewall/masq and that - interface is not up.
                                                  • -
                                                • You can now configure Shorewall so that it doesn't require the NAT and/or - mangle netfilter modules.
                                                  • -
                                                • Thanks to Alex  Polishchuk, the "hits" command - from seawall is now in shorewall.
                                                  • -
                                                • Support for IPIP tunnels has been added.
                                                  • +
                                                • The firewall script now issues a message if you have the name of an + interface in the second column in an entry in /etc/shorewall/masq and +that interface is not up.
                                                  • +
                                                • You can now configure Shorewall so that it doesn't require the NAT and/or +mangle netfilter modules.
                                                  • +
                                                • Thanks to Alex  Polishchuk, the "hits" command from seawall is +now in shorewall.
                                                  • +
                                                • Support for IPIP tunnels has been added.
                                                  • +
                                                - -

                                                6/18/2001 - The current version of Shorewall is 1.1.8. In this version

                                                - + +

                                                6/18/2001 - The current version of Shorewall is 1.1.8. In this +version

                                                + - +

                                                6/2/2001 - The current version of Shorewall is 1.1.7. In this version

                                                - +
                                                  -
                                                • The TOS rules are now deleted when the firewall is stopped.
                                                  • -
                                                • The .rpm will now install regardless of which version of iptables is - installed.
                                                  • -
                                                • The .rpm will now install without iproute2 being installed.
                                                  • -
                                                • The documentation has been cleaned up.
                                                  • -
                                                • The sample configuration files included in Shorewall have been formatted +
                                                • The TOS rules are now deleted when the firewall is stopped.
                                                  • +
                                                • The .rpm will now install regardless of which version of iptables +is installed.
                                                  • +
                                                • The .rpm will now install without iproute2 being installed.
                                                  • +
                                                • The documentation has been cleaned up.
                                                  • +
                                                • The sample configuration files included in Shorewall have been formatted to 80 columns for ease of editing on a VGA console.
                                                  • +
                                                - -

                                                5/25/2001 - The current version of Shorewall is 1.1.6. In this version

                                                - + +

                                                5/25/2001 - The current version of Shorewall is 1.1.6. In this +version

                                                +
                                                  -
                                                • You may now rate-limit the packet log.
                                                  • -
                                                •  Previous versions of - Shorewall have an implementation of Static NAT which violates the principle - of least surprise.  NAT only occurs for packets arriving at (DNAT) or - send from (SNAT) the interface named in the INTERFACE column of - /etc/shorewall/nat. Beginning with version 1.1.6, NAT effective regardless - of which interface packets come from or are destined to. To get - compatibility with prior versions, I have added a new "ALL "ALL - INTERFACES"  column to /etc/shorewall/nat. By placing - "no" or "No" in the new column, the NAT behavior of - prior versions may be retained. 
                                                  • -
                                                • The treatment of IPSEC Tunnels where the remote - gateway is a standalone system has been improved. Previously, it was - necessary to include an additional rule allowing UDP port 500 traffic to - pass through the tunnel. Shorewall will now create this rule automatically - when you place the name of the remote peer's zone in a new GATEWAY ZONE - column in /etc/shorewall/tunnels. 
                                                  • +
                                                • You may now rate-limit the packet +log.
                                                  • +
                                                •  Previous versions of + Shorewall have an implementation of Static NAT which violates the principle + of least surprise.  NAT only occurs for packets arriving at (DNAT) or + send from (SNAT) the interface named in the INTERFACE column of /etc/shorewall/nat. +Beginning with version 1.1.6, NAT effective regardless of which interface +packets come from or are destined to. To get compatibility with prior +versions, I have added a new "ALL "ALL + INTERFACES"  column to /etc/shorewall/nat. By placing "no" or "No" +in the new column, the NAT behavior of prior versions may be retained. 
                                                  • +
                                                • The treatment of IPSEC Tunnels where +the remote gateway is a standalone system has been improved. Previously, +it was necessary to include an additional rule allowing UDP port 500 +traffic to pass through the tunnel. Shorewall will now create this rule +automatically when you place the name of the remote peer's zone in a +new GATEWAY ZONE column in /etc/shorewall/tunnels. 
                                                  • +
                                                - -

                                                5/20/2001 - The current version of Shorewall is 1.1.5. In this version

                                                - + +

                                                5/20/2001 - The current version of Shorewall is 1.1.5. In this +version

                                                + - -

                                                5/10/2001 - The current version of Shorewall is 1.1.4. In this version

                                                - + +

                                                5/10/2001 - The current version of Shorewall is 1.1.4. In this +version

                                                +
                                                  -
                                                • Accepting RELATED connections is now - optional.
                                                  • -
                                                • Corrected problem where if "shorewall start" aborted early - (due to kernel configuration errors for example), superfluous 'sed' error - messages were reported.
                                                  • -
                                                • Corrected rules generated for port redirection.
                                                  • -
                                                • The order in which iptables kernel modules are loaded has been - corrected (Thanks to Mark Pavlidis). 
                                                  • +
                                                • Accepting RELATED connections is +now optional.
                                                  • +
                                                • Corrected problem where if "shorewall start" aborted early (due +to kernel configuration errors for example), superfluous 'sed' error + messages were reported.
                                                  • +
                                                • Corrected rules generated for port redirection.
                                                  • +
                                                • The order in which iptables kernel modules are loaded has been + corrected (Thanks to Mark Pavlidis). 
                                                  • +
                                                - -

                                                4/28/2001 - The current version of Shorewall is 1.1.3. In this version

                                                - + +

                                                4/28/2001 - The current version of Shorewall is 1.1.3. In this +version

                                                +
                                                  -
                                                • Correct message issued when Proxy ARP address added (Thanks to Jason Kirtland).
                                                  • -
                                                • /tmp/shorewallpolicy-$$ is now removed if there is an error while starting the firewall.
                                                  • -
                                                • /etc/shorewall/icmp.def and /etc/shorewall/common.def are now used to define the icmpdef and common chains unless overridden by the presence of /etc/shorewall/icmpdef or /etc/shorewall/common.
                                                  • -
                                                • In the .lrp, the file /var/lib/lrpkg/shorwall.conf has been corrected. An extra space after "/etc/shorwall/policy" has been removed and "/etc/shorwall/rules" has been added.
                                                  • -
                                                • When a sub-shell encounters a fatal error and has stopped the firewall, it now kills the main shell so that the main shell will not continue.
                                                  • -
                                                • A problem has been corrected where a sub-shell stopped the firewall and main shell continued resulting in a perplexing error message - referring to "common.so" resulted.
                                                  • -
                                                • Previously, placing "-" in the PORT(S) column in /etc/shorewall/rules resulted in an error message during start. This has been corrected.
                                                  • -
                                                • The first line of "install.sh" has been corrected -- I had inadvertently deleted the initial "#".
                                                  • +
                                                • Correct message issued when Proxy ARP address added (Thanks to Jason + Kirtland).
                                                  • +
                                                • /tmp/shorewallpolicy-$$ is now removed if there is an error while + starting the firewall.
                                                  • +
                                                • /etc/shorewall/icmp.def and /etc/shorewall/common.def are now used + to define the icmpdef and common chains unless overridden by the presence +of /etc/shorewall/icmpdef or /etc/shorewall/common.
                                                  • +
                                                • In the .lrp, the file /var/lib/lrpkg/shorwall.conf has been corrected. +An extra space after "/etc/shorwall/policy" has been removed and "/etc/shorwall/rules" +has been added.
                                                  • +
                                                • When a sub-shell encounters a fatal error and has stopped the firewall, +it now kills the main shell so that the main shell will not continue.
                                                  • +
                                                • A problem has been corrected where a sub-shell stopped the firewall + and main shell continued resulting in a perplexing error message +referring to "common.so" resulted.
                                                  • +
                                                • Previously, placing "-" in the PORT(S) column in /etc/shorewall/rules +resulted in an error message during start. This has been corrected.
                                                  • +
                                                • The first line of "install.sh" has been corrected -- I had inadvertently +deleted the initial "#".
                                                  • +
                                                -

                                                4/12/2001 - The current version of Shorewall is 1.1.2. In this version

                                                + +

                                                4/12/2001 - The current version of Shorewall is 1.1.2. In this +version

                                                +
                                                  -
                                                • Port redirection now works again.
                                                  • -
                                                • The icmpdef and common chains may +
                                                • Port redirection now works again.
                                                  • +
                                                • The icmpdef and common chains may now be user-defined.
                                                  • -
                                                • The firewall no longer fails to start if "routefilter" is - specified for an interface that isn't started. A warning message is now - issued in this case.
                                                  • -
                                                • The LRP Version is renamed "shorwall" for 8,3 MSDOS file - system compatibility.
                                                  • -
                                                • A couple of LRP-specific problems were corrected.
                                                  • +
                                                • The firewall no longer fails to start if "routefilter" is specified +for an interface that isn't started. A warning message is now issued +in this case.
                                                  • +
                                                • The LRP Version is renamed "shorwall" for 8,3 MSDOS file system +compatibility.
                                                  • +
                                                • A couple of LRP-specific problems were corrected.
                                                  • +
                                                -

                                                4/8/2001 - Shorewall is now affiliated with the Leaf - Project -

                                                -

                                                4/5/2001 - The current version of Shorewall is 1.1.1. In this version:

                                                - + +

                                                4/8/2001 - Shorewall is now affiliated with the Leaf Project +

                                                + +

                                                4/5/2001 - The current version of Shorewall is 1.1.1. In this version:

                                                +
                                                  -
                                                • The common chain is traversed from INPUT, OUTPUT and FORWARD before +
                                                • The common chain is traversed from INPUT, OUTPUT and FORWARD before logging occurs
                                                  • -
                                                • The source has been cleaned up dramatically
                                                  • -
                                                • DHCP DISCOVER packets with RFC1918 source addresses no longer - generate log messages. Linux DHCP clients generate such packets and it's - annoying to see them logged. 
                                                  • +
                                                • The source has been cleaned up dramatically
                                                  • +
                                                • DHCP DISCOVER packets with RFC1918 source addresses no longer + generate log messages. Linux DHCP clients generate such packets and it's + annoying to see them logged. 
                                                  • +
                                                -

                                                3/25/2001 - The current version of Shorewall is 1.1.0. In this version:

                                                - + +

                                                3/25/2001 - The current version of Shorewall is 1.1.0. In this version:

                                                +
                                                  -
                                                • Log messages now indicate the packet disposition.
                                                  • -
                                                • Error messages have been improved.
                                                  • -
                                                • The ability to define zones consisting of an enumerated set of hosts +
                                                • Log messages now indicate the packet disposition.
                                                  • +
                                                • Error messages have been improved.
                                                  • +
                                                • The ability to define zones consisting of an enumerated set of hosts and/or subnetworks has been added.
                                                  • -
                                                • The zone-to-zone chain matrix is now sparse so that only those chains +
                                                • The zone-to-zone chain matrix is now sparse so that only those chains that contain meaningful rules are defined.
                                                  • -
                                                • 240.0.0.0/4 and 169.254.0.0/16 have been added to the source - subnetworks whose packets are dropped under the norfc1918 interface +
                                                • 240.0.0.0/4 and 169.254.0.0/16 have been added to the source + subnetworks whose packets are dropped under the norfc1918 interface option.
                                                  • -
                                                • Exits are now provided for executing an user-defined script when a - chain is defined, when the firewall is initialized, when the firewall is - started, when the firewall is stopped and when the firewall is cleared.
                                                  • -
                                                • The Linux kernel's route filtering facility can now be specified - selectively on network interfaces.
                                                  • +
                                                • Exits are now provided for executing an user-defined script when a + chain is defined, when the firewall is initialized, when the firewall +is started, when the firewall is stopped and when the firewall is cleared.
                                                  • +
                                                • The Linux kernel's route filtering facility can now be specified + selectively on network interfaces.
                                                  • +
                                                -

                                                3/19/2001 - The current version of Shorewall is 1.0.4. This version:

                                                - + +

                                                3/19/2001 - The current version of Shorewall is 1.0.4. This version:

                                                +
                                                  -
                                                • Allows user-defined zones. Shorewall now has only one pre-defined - zone (fw) with the remaining zones being defined in the new configuration - file /etc/shorewall/zones. The /etc/shorewall/zones file released in this - version provides behavior that is compatible with Shorewall 1.0.3. 
                                                  • -
                                                • Adds the ability to specify logging in entries in the - /etc/shorewall/rules file.
                                                  • -
                                                • Correct handling of the icmp-def chain so that only ICMP packets are +
                                                • Allows user-defined zones. Shorewall now has only one pre-defined + zone (fw) with the remaining zones being defined in the new configuration + file /etc/shorewall/zones. The /etc/shorewall/zones file released in +this version provides behavior that is compatible with Shorewall 1.0.3. 
                                                  • +
                                                • Adds the ability to specify logging in entries in the /etc/shorewall/rules +file.
                                                  • +
                                                • Correct handling of the icmp-def chain so that only ICMP packets are sent through the chain.
                                                  • -
                                                • Compresses the output of "shorewall monitor" if awk is - installed. Allows the command to work if awk isn't installed (although - it's not pretty).
                                                  • +
                                                • Compresses the output of "shorewall monitor" if awk is installed. +Allows the command to work if awk isn't installed (although it's not +pretty).
                                                  • +
                                                -

                                                3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix + +

                                                3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix release with no new features.

                                                - +
                                                  -
                                                • The PATH variable in the firewall script now includes /usr/local/bin +
                                                • The PATH variable in the firewall script now includes /usr/local/bin and /usr/local/sbin.
                                                  • -
                                                • DMZ-related chains are now correctly deleted if the DMZ is deleted.
                                                  • -
                                                • The interface OPTIONS for "gw" interfaces are no longer - ignored.
                                                  • +
                                                • DMZ-related chains are now correctly deleted if the DMZ is deleted.
                                                  • +
                                                • The interface OPTIONS for "gw" interfaces are no longer ignored.
                                                  • +
                                                -

                                                3/8/2001 - The current version of Shorewall is 1.0.2. It supports an - additional "gw" (gateway) zone for tunnels and it supports IPSEC - tunnels with end-points on the firewall. There is also a .lrp available now.

                                                - -

                                                Updated 8/22/2002 - Tom -Eastep

                                                - -

                                                - Copyright © 2001, 2002 Thomas M. Eastep.

                                                - - \ No newline at end of file + +

                                                3/8/2001 - The current version of Shorewall is 1.0.2. It supports an + additional "gw" (gateway) zone for tunnels and it supports IPSEC tunnels +with end-points on the firewall. There is also a .lrp available now.

                                                + +

                                                Updated 9/16/2002 - Tom Eastep +

                                                + +

                                                +Copyright © 2001, 2002 Thomas M. Eastep.

                                                +
                                                + + diff --git a/Shorewall-docs/Shorewall_index_frame.htm b/Shorewall-docs/Shorewall_index_frame.htm index 707727ca4..df441534b 100644 --- a/Shorewall-docs/Shorewall_index_frame.htm +++ b/Shorewall-docs/Shorewall_index_frame.htm @@ -44,7 +44,9 @@
                                              • Troubleshooting
                                              • -Errata/Upgrade Issues
                                                • +Errata +
                                              • +Upgrade Issues
                                              • Support
                                              • @@ -55,6 +57,7 @@
                                              • Texas, USA
                                              • Germany
                                              • Argentina
                                                • +
                                              • France
                                            diff --git a/Shorewall-docs/blacklisting_support.htm b/Shorewall-docs/blacklisting_support.htm index d6f57f189..678186546 100644 --- a/Shorewall-docs/blacklisting_support.htm +++ b/Shorewall-docs/blacklisting_support.htm @@ -1,67 +1,95 @@ + - - - - - -Blacklisting Support + + + + + + + + + Blacklisting Support - - - - - - - + + +
                                            -

                                            Blacklisting Support

                                            -
                                            + + + + + +
                                            +

                                            Blacklisting Support

                                            +
                                            +

                                            Shorewall supports two different forms of blacklisting; static and dynamic.

                                            +

                                            Static Blacklisting

                                            -

                                            Shorewall -static blacklisting support has the following configuration parameters:

                                            + +

                                            Shorewall static blacklisting support has the following configuration +parameters:

                                            +
                                              -
                                            • You specify whether you want packets from blacklisted hosts dropped or - rejected using the BLACKLIST_DISPOSITION +
                                            • You specify whether you want packets from blacklisted hosts dropped +or rejected using the BLACKLIST_DISPOSITION setting in /etc/shorewall/shorewall.conf
                                              • -
                                            • You specify whether you want packets from blacklisted hosts logged and at - what syslog level using the BLACKLIST_LOGLEVEL - setting in /etc/shorewall/shorewall.conf
                                              • -
                                            • You list the IP addresses/subnets that you wish to blacklist in /etc/shorewall/blacklist
                                              • -
                                            • You specify the interfaces whose incoming packets you want checked against - the blacklist using the "blacklist" - option in /etc/shorewall/interfaces.
                                              • -
                                            • The black list is refreshed from /etc/shorewall/blacklist by the "shorewall - refresh" command.
                                              • +
                                            • You specify whether you want packets from blacklisted hosts logged +and at what syslog level using the BLACKLIST_LOGLEVEL setting in +/etc/shorewall/shorewall.conf
                                              • +
                                            • You list the IP addresses/subnets that you wish to blacklist in /etc/shorewall/blacklist. Beginning +with Shorewall version 1.3.8, you may also specify PROTOCOL and Port numbers/Service +names in the blacklist file.
                                              +
                                              • +
                                            • You specify the interfaces whose incoming packets you want checked +against the blacklist using the "blacklist" option in /etc/shorewall/interfaces.
                                              • +
                                            • The black list is refreshed from /etc/shorewall/blacklist by the "shorewall refresh" command.
                                              • +
                                            +

                                            Dynamic Blacklisting

                                            -

                                            Dynamic blacklisting support was added in version 1.3.2. Dynamic blacklisting -doesn't use any configuration parameters but is rather controlled using -/sbin/shorewall commands:

                                            + +

                                            Dynamic blacklisting support was added in version 1.3.2. Dynamic blacklisting + doesn't use any configuration parameters but is rather controlled using + /sbin/shorewall commands:

                                            +
                                              -
                                            • deny <ip address list> - causes packets from the listed IP - addresses to be silently dropped by the firewall.
                                              • -
                                            • reject <ip address list> - causes packets from the listed IP - addresses to be rejected by the firewall.
                                              • -
                                            • allow <ip address list> - re-enables receipt of packets from hosts - previously blacklisted by a deny or reject command.
                                              • -
                                            • save - save the dynamic blacklisting configuration so that it will be - automatically restored the next time that the firewall is restarted.
                                              • -
                                            • show dynamic - displays the dynamic blacklisting configuration.
                                              • +
                                            • deny <ip address list> - causes packets from the listed +IP addresses to be silently dropped by the firewall.
                                              • +
                                            • reject <ip address list> - causes packets from the listed +IP addresses to be rejected by the firewall.
                                              • +
                                            • allow <ip address list> - re-enables receipt of packets +from hosts previously blacklisted by a deny or reject command.
                                              • +
                                            • save - save the dynamic blacklisting configuration so that it will +be automatically restored the next time that the firewall is restarted.
                                              • +
                                            • show dynamic - displays the dynamic blacklisting configuration.
                                              • +
                                            +

                                            Example 1:

                                            + 
                                                 shorewall deny 192.0.2.124 192.0.2.125
                                            -

                                                Drops packets from hosts 192.0.2.124 and 192.0.2.125

                                            + +

                                                Drops packets from hosts 192.0.2.124 and 192.0.2.125

                                            +

                                            Example 2:

                                            + 
                                                 shorewall allow 192.0.2.125
                                            -

                                                Reenables access from 192.0.2.125.

                                            -

                                            Last updated 6/16/2002 - Tom -Eastep

                                            - -

                                            Copyright -© 2002 Thomas M. Eastep.

                                            - + +

                                                Reenables access from 192.0.2.125.

                                            + +

                                            Last updated 9/16/2002 - Tom Eastep

                                            + +

                                            Copyright + © 2002 Thomas M. Eastep.

                                            +
                                            - - \ No newline at end of file + diff --git a/Shorewall-docs/download.htm b/Shorewall-docs/download.htm index 73418d31b..8fb17e9e7 100644 --- a/Shorewall-docs/download.htm +++ b/Shorewall-docs/download.htm @@ -1,227 +1,305 @@ + - - - - - -Download + + + + + + + + + Download - - - - - - - + + +
                                            -

                                            Shorewall Download

                                            -
                                            + + + + + +
                                            +

                                            Shorewall Download

                                            +
                                            - -

                                            I strongly urge you to read and print a copy of the - Shorewall QuickStart Guide - for the configuration that most closely matches your own.

                                            - -

                                            Once you've done that, download one of the modules:

                                            - + +

                                            I strongly urge you to read and print a copy of the Shorewall QuickStart Guide + for the configuration that most closely matches your own.

                                            + +

                                            Once you've done that, download one of the modules:

                                            +
                                              -
                                            • If you run a RedHat, SuSE, Mandrake, Linux PPC or - TurboLinux distribution - with a 2.4 kernel, you can use the RPM version (note: the - RPM should also work with other distributions that store -init scripts in /etc/init.d and that include chkconfig or insserv). -If you find that it works in other cases, let - me - know so that I can mention them here. See the - Installation Instructions if you have problems - installing the RPM.
                                              • -
                                            • If you are running LRP, download the .lrp file (you might also want to - download the .tgz so you will have a copy of the documentation).
                                              • -
                                            • If you run Debian and would - like a .deb package, Shorewall is in both the - Debian - Testing Branch and the - Debian - Unstable Branch.
                                              • -
                                            • Otherwise, download the shorewall module (.tgz)
                                              • +
                                            • If you run a RedHat, SuSE, Mandrake, + Linux PPC or TurboLinux distribution with a 2.4 kernel, +you can use the RPM version (note: the RPM should also work +with other distributions that store init scripts in /etc/init.d +and that include chkconfig or insserv). If you find that it works +in other cases, let me + know so that I can mention them here. See the Installation Instructions if you have problems + installing the RPM.
                                              • +
                                            • If you are running LRP, download the .lrp file (you might also want +to download the .tgz so you will have a copy of the documentation).
                                              • +
                                            • If you run Debian and would + like a .deb package, Shorewall is in both the Debian +Testing Branch and the Debian + Unstable Branch.
                                              • +
                                            • Otherwise, download the shorewall module (.tgz)
                                              • +
                                            -

                                            The documentation in HTML format is included in the .tgz and .rpm files and -there is an documentation .deb that also contains the documentation.

                                            -

                                            Please verify the version that you have - downloaded -- during the release of a new version of Shorewall, the links - below may point to a newer or an older version than is shown below.

                                            + +

                                            The documentation in HTML format is included in the .tgz and .rpm files +and there is an documentation .deb that also contains the documentation.

                                            + +

                                            Please verify the version that you have downloaded -- during the +release of a new version of Shorewall, the links below may point +to a newer or an older version than is shown below.

                                            +
                                              -
                                            • RPM - "rpm -qip LATEST.rpm"
                                              • -
                                            • TARBALL - "tar -ztf LATEST.tgz" (the directory - name will contain the version)
                                              • -
                                            • LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar - -zxf <downloaded .lrp>; cat var/lib/lrpkg/shorwall.version"
                                              • +
                                            • RPM - "rpm -qip LATEST.rpm"
                                              • +
                                            • TARBALL - "tar -ztf LATEST.tgz" (the directory name will contain +the version)
                                              • +
                                            • LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar -zxf <downloaded +.lrp>; cat var/lib/lrpkg/shorwall.version"
                                              • +
                                            -

                                            Once you have verified the - version, check the errata - to see if there are updates that apply to the version that you have - downloaded.

                                            -

                                            WARNING - YOU CAN NOT SIMPLY INSTALL THE RPM -AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION IS REQUIRED BEFORE THE -FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND AND THE FIREWALL FAILS TO -START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY NETWORK TRAFFIC. IF THIS HAPPENS, -ISSUE A "shorewall clear" COMMAND TO RESTORE NETWORK CONNECTIVITY.

                                            -

                                            Download Latest Version (1.3.7): Remember that updates to the mirrors -occur 1-12 hours after an update to the primary site.

                                            -
                                            - - - - - - - - - - -
                                            SERVER LOCATIONDOMAINHTTPFTP
                                            Washington State, USAShorewall.netDownload .rpm
                                            - Download - .tgz 
                                            - Download + +

                                            Once you have verified the version, check the + errata to see if there are updates that apply to the version +that you have downloaded.

                                            + +

                                            WARNING - YOU CAN NOT SIMPLY +INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION +IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND +AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY NETWORK +TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO RESTORE NETWORK +CONNECTIVITY.

                                            + +

                                            Download Latest Version (1.3.8): Remember that updates to the +mirrors occur 1-12 hours after an update to the primary site.

                                            + +
                                            + + + + + + + + + + + + - - - - - - - + + + + + + - - - - - + + + + - - - - - - + + + + + + + + + + + + + + + + + - - - - - - - - + + + +
                                            SERVER LOCATIONDOMAINHTTPFTP
                                            Washington State, USAShorewall.netDownload +.rpm
                                            + Download + .tgz 
                                            + Download .lrp                                            		 - Download .rpm 
                                            - Download - .tgz 
                                            - Download - .lrp
                                            Slovak RepublicShorewall.netDownload .rpm
                                            - Download - .tgz 
                                            - Download - .lrp                                            		 - Download .rpm  
                                            - Download - .tgz 
                                            - Download +                                             		Download .rpm 
                                            + Download .tgz 
                                            + Download .lrp
                                            Slovak RepublicShorewall.netDownload .rpm
                                            + Download + .tgz 
                                            + Download + .lrp                                            		 Download +.rpm  
                                            + Download + .tgz 
                                            + Download .rpm
                                            Texas, USAInfohiiway.comDownload .rpm
                                            - Download - .tgz 
                                            - Download +
                                            Texas, USAInfohiiway.comDownload +.rpm
                                            + Download + .tgz 
                                            + Download .lrp                                            		 - Download .rpm  
                                            - Download - .tgz 
                                            - Download - .rpm
                                            Hamburg, GermanyShorewall.net - Download .rpm
                                            - Download - .tgz
                                            - Download +                                             		Download .rpm  
                                            + Download + .tgz 
                                            + Download +.lrp
                                            Hamburg, GermanyShorewall.net Download +.rpm
                                            + Download + .tgz
                                            + Download + .lrp                                            		 Download +.rpm  
                                            + Download + .tgz 
                                            + Download + .lrp
                                            Martinez (Zona Norte - GBA), ArgentinaCorreofuego.com.ar Download +.rpm  
                                            + Download + .tgz 
                                            + + Download .lrp                                            		 Download +.rpm  
                                            + Download + .tgz 
                                            + + Download .lrp
                                            Paris, FranceShorewall.netDownload +.rpm
                                            + Download + .tgz 
                                            + Download .lrp                                            		 - - Download .rpm  
                                            - Download - .tgz 
                                            - Download - .lrp
                                            Martinez (Zona Norte - GBA), ArgentinaCorreofuego.com.ar - Download .rpm  
                                            - Download - .tgz 
                                            - - Download .lrp                                            		 - Download .rpm  
                                            - Download - .tgz 
                                            - - Download .lrp
                                            Download +.rpm  
                                            + Download + .tgz 
                                            + Download +.lrp
                                            -
                                            + +

                                            Browse Download Sites:

                                            -
                                            - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +
                                            +
                                            SERVER LOCATIONDOMAINHTTPFTP
                                            Washington State, USAShorewall.netBrowseBrowse
                                            Slovak RepublicShorewall.netBrowse - Browse
                                            Texas, USAInfohiiway.comBrowseBrowse
                                            Hamburg, GermanyShorewall.netBrowseBrowse
                                            Martinez (Zona Norte - GBA), ArgentinaCorreofuego.com.arBrowse - - Browse
                                            California, USA (Incomplete)Sourceforge.netBrowseN/A
                                            + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                            SERVER LOCATIONDOMAINHTTPFTP
                                            Washington State, USAShorewall.netBrowseBrowse
                                            Slovak RepublicShorewall.netBrowse Browse
                                            Texas, USAInfohiiway.comBrowseBrowse
                                            Hamburg, GermanyShorewall.netBrowseBrowse
                                            Martinez (Zona Norte - GBA), ArgentinaCorreofuego.com.arBrowse Browse
                                            FranceShorewall.netBrowse Browse
                                            California, USA (Incomplete)Sourceforge.netBrowseN/A
                                            -
                                            + +

                                            CVS:

                                            - -
                                            -

                                            The -CVS -repository at cvs.shorewall.net contains the latest snapshots of the each -Shorewall component. There's no guarantee that what you find there will work at -all.

                                            - -
                                            -

                                            Last Updated 8/22/2002 - Tom -Eastep

                                            - -

                                            Copyright -© 2001, 2002 Thomas M. Eastep.

                                            - + +
                                            +

                                            The CVS repository at +cvs.shorewall.net contains the latest snapshots of the each Shorewall +component. There's no guarantee that what you find there will work at all.

                                            +
                                            + +

                                            Last Updated 9/2/2002 - Tom Eastep

                                            + +

                                            Copyright + © 2001, 2002 Thomas M. Eastep.

                                            +
                                            - - \ No newline at end of file + diff --git a/Shorewall-docs/errata.htm b/Shorewall-docs/errata.htm index 6adf735d5..09ce223e9 100644 --- a/Shorewall-docs/errata.htm +++ b/Shorewall-docs/errata.htm @@ -63,17 +63,17 @@ dos2unix
                                            -

                                            Upgrade Issues

                                            +

                                            Problems in Version 1.3

                                            -

                                            Version >= 1.3.7

                                            +

                                            Version 1.3.7b

                                            -

                                            Users specifying ALLOWRELATED=No in - /etc/shorewall.conf will need to include the - following rules in their /etc/shorewall/icmpdef - file (creating this file if necessary):

                                            +

                                            DNAT rules where the source zone is 'fw' ($FW) + result in an error message. Installing + + this corrected firewall script in /var/lib/shorewall/firewall + as described above corrects this problem.

                                            - 
                                            	run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
-	run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
-	run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
-	run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
-	run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT
                                            -

                                            Users having an /etc/shorewall/icmpdef file may remove the ". - /etc/shorewall/icmp.def" command from that file since the icmp.def file is now - empty.

                                            -

                                            Upgrading Bering to - Shorewall >= 1.3.3

                                            +

                                            Version 1.3.7a

                                            -

                                            To properly upgrade with Shorewall version - 1.3.3 and later:

                                            +

                                            "shorewall refresh" is not creating the proper + rule for FORWARDPING=Yes. Consequently, after + "shorewall refresh", the firewall will not forward + icmp echo-request (ping) packets. Installing + + this corrected firewall script in /var/lib/shorewall/firewall + as described above corrects this problem.

                                            + +

                                            Version <= 1.3.7a

                                            + +

                                            If "norfc1918" and "dhcp" are both specified as + options on a given interface then RFC 1918 + checking is occurring before DHCP checking. This + means that if a DHCP client broadcasts using an + RFC 1918 source address, then the firewall will + reject the broadcast (usually logging it). This + has two problems:

                                              -
                                            1. Be sure you have a backup -- you will need - to transcribe any Shorewall configuration - changes that you have made to the new - configuration.
                                              2. -
                                            2. Replace the shorwall.lrp package provided on - the Bering floppy with the later one. If you did - not obtain the later version from Jacques's - site, see additional instructions below.
                                              3. -
                                            3. Edit the /var/lib/lrpkg/root.exclude.list - file and remove the /var/lib/shorewall entry if - present. Then do not forget to backup root.lrp !
                                              4. +
                                            4. If the firewall is running a DHCP server, + the client won't be able to obtain an IP address + lease from that server.
                                              5. +
                                            5. With this order of checking, the "dhcp" + option cannot be used as a noise-reduction + measure where there are both dynamic and static + clients on a LAN segment.
                                            -

                                            The .lrp that I release isn't set up for a two-interface firewall like - Jacques's. You need to follow the instructions for - setting up a two-interface firewall plus you also need to add the following - two Bering-specific rules to /etc/shorewall/rules:

                                            -
                                            - 
                                            # Bering specific rules:
-# allow loc to fw udp/53 for dnscache to work
-# allow loc to fw tcp/80 for weblet to work
-#
-ACCEPT loc fw udp 53
-ACCEPT loc fw tcp 80
                                            -
                                            -

                                            Version >= 1.3.6

                                            - -

                                            If you have a pair of firewall systems configured for - failover, you will need to modify your firewall setup slightly under - Shorewall versions >= 1.3.6.

                                            - -
                                              -
                                            1. - -

                                              Create the file /etc/shorewall/newnotsyn and in it add - the following rule
                                              -
                                              - run_iptables -A newnotsyn -j RETURN # So that the - connection tracking table can be rebuilt
                                              -                                    - # from non-SYN packets after takeover.
                                              - 

                                              2. -
                                            2. - -

                                              Create /etc/shorewall/common (if you don't already - have that file) and include the following:
                                              -
                                              - run_iptables -A common -p tcp --tcp-flags - ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection
                                              -                                                                    - #tracking table.
                                              - . /etc/shorewall/common.def

                                              3. -
                                            - -

                                            Versions >= 1.3.5

                                            - -

                                            Some forms of pre-1.3.0 rules file syntax are no - longer supported.

                                            - -

                                            Example 1:

                                            - -
                                            - 
                                            	ACCEPT    net    loc:192.168.1.12:22    tcp    11111    -    all
                                            -
                                            - -

                                            Must be replaced with:

                                            - -
                                            - 
                                            	DNAT	net	loc:192.168.1.12:22	tcp	11111
                                            -
                                            -
                                            -

                                            Example 2:

                                            -
                                            - 
                                            	ACCEPT	loc	fw::3128	tcp	80	-	all
                                            -
                                            -
                                            -

                                            Must be replaced with:

                                            -
                                            - 
                                            	REDIRECT	loc	3128	tcp	80
                                            -
                                            - -

                                            Problems in Version 1.3

                                            +

                                            + + This version of the 1.3.7a firewall script + corrects the problem. It must be installed in /var/lib/shorewall + as described above.

                                            + +

                                            Version 1.3.7

                                            + +

                                            Version 1.3.7 dead on arrival -- please use + version 1.3.7a and check your version against + these md5sums -- if there's a difference, please + download again.

                                            + + 
                                            	d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz
+	6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm
+	3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp
                                            +

                                            In other words, type "md5sum <whatever package you downloaded> and + compare the result with what you see above.

                                            +

                                            I'm embarrassed to report that 1.2.7 was also DOA -- maybe I'll skip the .7 + version in each sequence from now on.

                                            Version 1.3.6

                                            @@ -352,6 +306,13 @@ ACCEPT loc fw tcp 80 corrected version is here. +
                                            + +

                                            Upgrade Issues

                                            + +

                                            The upgrade issues have moved to + a separate page.

                                            +

                                            @@ -435,9 +396,9 @@ Aborted (core dumped) installed, simply use the "--nodeps" option to rpm.

                                            -

                                            Installing: rpm -ivh <shorewall rpm>

                                            +

                                            Installing: rpm -ivh --nodeps <shorewall rpm>

                                            -

                                            Upgrading: rpm -Uvh <shorewall rpm>

                                            +

                                            Upgrading: rpm -Uvh --nodeps <shorewall rpm>

                                            Problems with iptables version 1.2.7 and MULTIPORT=Yes

                                            @@ -445,7 +406,8 @@ Aborted (core dumped)

                                            The iptables 1.2.7 release of iptables has made an incompatible change to the syntax used to specify multiport match rules; as a consequence, - if you install iptables 1.2.7 you must

                                            + if you install iptables 1.2.7 you must be running + Shorewall 1.3.7a or later or:

                                            • set MULTIPORT=No in @@ -457,7 +419,7 @@ Aborted (core dumped) as described above.

                                            - Last updated 8/22/2002 - + Last updated 9/1/2002 - Tom Eastep

                                            Copyright diff --git a/Shorewall-docs/gnu_mailman.htm b/Shorewall-docs/gnu_mailman.htm index 702ff74be..e6e3076d7 100644 --- a/Shorewall-docs/gnu_mailman.htm +++ b/Shorewall-docs/gnu_mailman.htm @@ -1,62 +1,76 @@ + - - - - - -GNU Mailman + + + + + + + + + GNU Mailman - - - - - - - + + +
                                            -

                                            GNU Mailman/Postfix -the Easy Way

                                            -
                                            + + + + + +
                                            +

                                            GNU Mailman/Postfix the Easy +Way

                                            +
                                            - -

                                             

                                            -

                                            The following was posted on the Postfix mailing list on 5/4/2002 by Michael -Tokarev as a suggested addition to the Postfix FAQ.

                                            + +

                                             

                                            + +

                                            The following was posted on the Postfix mailing list on 5/4/2002 by Michael + Tokarev as a suggested addition to the Postfix FAQ.

                                            +

                                            Q: Mailman does not work with Postfix, complaining about GID mismatch
                                            -
                                            -A: Mailman uses a setgid wrapper that is designed to be used in system-wide -aliases file so that rest of mailman's mail handling processes will run with -proper uid/gid. Postfix has an ability to run a command specified in an alias as -owner of that alias, thus mailman's wrapper is not needed here. The best method -to invoke mailman's mail handling via aliases is to use separate alias file -especially for mailman, and made it owned by mailman and group mailman. Like:
                                            -
                                            -alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases
                                            -
                                            -Make sure that /var/mailman/aliases.db is owned by mailman user (this may be -done by executing postalias as mailman userid).
                                            -
                                            -Next, instead of using mailman-suggested aliases entries with wrapper, use the -following:
                                            -
                                            -instead of
                                            -mailinglist: /var/mailman/mail/wrapper post mailinglist
                                            -mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist
                                            -mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist
                                            -...
                                            -
                                            -use
                                            -mailinglist: /var/mailman/scripts/post mailinglist
                                            -mailinglist-admin: /var/mailman/scripts/mailowner mailinglist
                                            -mailinglist-request: /var/mailman/scripts/mailcmd mailinglist
                                            -...

                                            -

                                            The Shorewall mailing lists are currently running Postfix 1.1.7 together -with the stock RedHat Mailman-2.0.8 RPM configured as shown above.

                                            -

                                            Last updated 5/4/2002 - Tom -Eastep

                                            -

                                            -Copyright © 2001, 2002 Thomas M. Eastep.

                                            - +
                                            + A: Mailman uses a setgid wrapper that is designed to be used in system-wide + aliases file so that rest of mailman's mail handling processes will run +with proper uid/gid. Postfix has an ability to run a command specified in +an alias as owner of that alias, thus mailman's wrapper is not needed here. +The best method to invoke mailman's mail handling via aliases is to use +separate alias file especially for mailman, and made it owned by mailman +and group mailman. Like:
                                            +
                                            + alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases
                                            +
                                            + Make sure that /var/mailman/aliases.db is owned by mailman user (this may +be done by executing postalias as mailman userid).
                                            +
                                            + Next, instead of using mailman-suggested aliases entries with wrapper, use +the following:
                                            +
                                            + instead of
                                            + mailinglist: /var/mailman/mail/wrapper post mailinglist
                                            + mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist
                                            + mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist
                                            + ...
                                            +
                                            + use
                                            + mailinglist: /var/mailman/scripts/post mailinglist
                                            + mailinglist-admin: /var/mailman/scripts/mailowner mailinglist
                                            + mailinglist-request: /var/mailman/scripts/mailcmd mailinglist
                                            + ...

                                            + +

                                            The Shorewall mailing lists are currently running Postfix 1.1.11 together + with the stock RedHat Mailman-2.0.13 RPM configured as shown above.

                                            + +

                                            Last updated 9/14/2002 - Tom Eastep

                                            + +

                                            Copyright © 2001, 2002 Thomas M. Eastep.

                                            +
                                            - - \ No newline at end of file + diff --git a/Shorewall-docs/mailing_list.htm b/Shorewall-docs/mailing_list.htm index 7a0d25340..831a5be39 100644 --- a/Shorewall-docs/mailing_list.htm +++ b/Shorewall-docs/mailing_list.htm @@ -6,16 +6,18 @@ Shorewall Mailing Lists - + - +

                                            Shorewall Mailing Lists

                                            +

                                            Powered by Postfix      +

                                            diff --git a/Shorewall-docs/mailing_list_problems.htm b/Shorewall-docs/mailing_list_problems.htm index 4c76f9a6d..7c7f80ba7 100644 --- a/Shorewall-docs/mailing_list_problems.htm +++ b/Shorewall-docs/mailing_list_problems.htm @@ -26,6 +26,7 @@ to at least one address in each of the following domains:

                                            2020ca - delivery to this domain has been disabled (cause unknown)
 excite.com - delivery to this domain has been disabled (cause unknown)
 epacificglobal.com - delivery to this domain has been disabled (no MX record for domain)
+familie-fleischhacker.de - (connection timed out)
 gmx.net - delivery to this domain has been disabled (cause unknown)
 hotmail.com - delivery to this domain has been disabled (Mailbox over quota)
 intercom.net - delivery to this domain has been disabled (cause unknown)
@@ -33,6 +34,7 @@ initialcs.com - delivery to this domain has been disabled (cause unknown)
 intelligents.2y.net - delivery to this domain has been disabled (Name Service Problem -- Host not Found).
 khp-inc.com - delivery to this domain has been disabled (anti-virus problems)
 kieninger.de - delivery to this domain has been disabled (relaying to <xxxxx@kieninger.de> prohibited by administrator)
+littleblue.de - (connection timed out)
 opermail.net - delivery to this domain has been disabled (cause unknown)
 penquindevelopment.com - delivery to this domain has been disabled (connection timed out)
 scip-online.de - delivery to this domain has been disabled (cause unknown)
@@ -42,7 +44,7 @@ yahoo.com - delivery to this domain has been disabled (Mailbox over quota)
                                            -

                                            Last updated 7/26/2002 19:39 GMT - +

                                            Last updated 8/23/2002 17:16 GMT - Tom Eastep

                                            diff --git a/Shorewall-docs/myfiles.htm b/Shorewall-docs/myfiles.htm index d39dd4de6..160d09ee6 100644 --- a/Shorewall-docs/myfiles.htm +++ b/Shorewall-docs/myfiles.htm @@ -1,297 +1,165 @@ - - + + My Shorewall Configuration - + - + - - + - - - - -
                                            -

                                            About My Network

                                            -
                                            - -
                                            - -

                                            My Current Network

                                            - -
                                            -

                                            -I have DSL service and have 5 static IP addresses (206.124.146.176-180). -My DSL "modem" (Fujitsu Speedport) is connected to eth0. I have -a local network connected to eth2 (subnet 192.168.1.0/24) and a DMZ connected -to eth1 (192.168.2.0/24). 

                                            -

                                            -I use Static NAT for all internal systems (those connected to the switch) except my Wife's system (tarry) -and the Wireless Access Point (wap) which are -masqueraded through the primary gateway address (206.124.146.176).

                                            -

                                            -The firewall runs on a 128MB PII/233 with RH7.2 and Kernel 2.4.19.

                                            -

                                            -My personal GNU/Linux System (wookie) is 192.168.1.3 and my personal Windows XP system (ursa) -is 192.168.1.5. Wookie -runs Samba and acts as the a WINS server.  Wookie is in its own 'whitelist' zone -called 'me'.

                                            -

                                            -My laptop (eastept1) is connected to eth3 using a cross-over cable. It runs its own -Sygate firewall software and is managed by Proxy ARP. It connects to the -local network through the PopTop server running on my firewall.

                                            -

                                            -The single system in the DMZ (address 206.124.146.177) runs postfix, Courier -IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP server -(Pure-ftpd). The system also runs fetchmail to fetch our email from our + + + + + + + + +
                                            +

                                            About My Network

                                            +
                                            + +

                                            + +

                                            My Current Network

                                            + +
                                            +

                                            I have DSL service and have 5 static IP addresses (206.124.146.176-180). +My DSL "modem" (Fujitsu Speedport) +is connected to eth0. I have a local network connected to eth2 (subnet 192.168.1.0/24) + and a DMZ connected to eth1 (192.168.2.0/24). 

                                            + +

                                            I use:
                                            +

                                            +
                                              +
                                            • Static NAT for ursa (my XP System) - Internal address 192.168.1.5 +and external address 206.124.146.178.
                                              • +
                                            • Proxy ARP for wookie (my Linux System). This system has two IP addresses: +192.168.1.3/24 and 206.124.146.179/24.
                                              • +
                                            • SNAT through the primary gateway address (206.124.146.176) for  my +Wife's system (tarry) and the Wireless Access Point (wap)
                                              • +
                                            + +

                                            The firewall runs on a 128MB PII/233 with RH7.2 and Kernel 2.4.19.

                                            + +

                                            Wookie runs Samba and acts as the a WINS server.  Wookie is in its +own 'whitelist' zone called 'me'.

                                            + +

                                            My laptop (eastept1) is connected to eth3 using a cross-over cable. +It runs its own Sygate firewall software +and is managed by Proxy ARP. It connects to the local network through the +PopTop server running on my firewall.

                                            + +

                                            The single system in the DMZ (address 206.124.146.177) runs postfix, +Courier IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP server +(Pure-ftpd). The system also runs fetchmail to fetch our email from our old and current ISPs. That server is managed through Proxy ARP.

                                            -

                                            -The firewall system itself runs a DHCP server that serves the local network.

                                            -

                                            -All administration and publishing is done using ssh/scp.

                                            -

                                            -I run an SNMP server on my firewall to serve -MRTG running in the DMZ.

                                            -

                                            -

                                            -

                                             

                                            -

                                            The ethernet interface in the Server is configured - with IP address 206.124.146.177, netmask - 255.255.255.0. The server's default gateway is - 206.124.146.254 (Router at my ISP. This is the same - default gateway used by the firewall itself). On the firewall, - Shorewall automatically adds a host route to - 206.124.146.177 through eth1 (192.168.2.1) because of - the entry in /etc/shorewall/proxyarp (see below).

                                            -

                                            A similar setup is used on eth3 (192.168.3.1) which - interfaces to my laptop (206.124.146.180).

                                            -

                                            - Note: My files use features not available before - Shorewall version 1.3.4.

                                            -
                                            -

                                            Shorewall.conf

                                            - - 
                                            	SUBSYSLOCK=/var/lock/subsys/shorewall
-	STATEDIR=/var/state/shorewall
-
-	LOGRATE=
-	LOGBURST=
-
-	ADD_IP_ALIASES="Yes"
-
-	CLAMPMSS=Yes
-
-	MULTIPORT=Yes
                                            -

                                            Zones File:

                                            - 
                                            	#ZONE 	DISPLAY 	COMMENTS
-	net	Internet	Internet
-	me	Eastep		My Workstation
-	loc	Local		Local networks
-	dmz	DMZ		Demilitarized zone
-	tx	Texas		Peer Network in Dallas Texas
-	#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
                                            -

                                            Interfaces File:

                                            - -
                                            -

                                            -This is set up so that I can start the firewall before bringing up my Ethernet -interfaces.

                                            - -
                                            - - 
                                            	#ZONE    INTERFACE	BROADCAST 	OPTIONS
-	net	eth0 		206.124.146.255	routefilter,norfc1918,blacklist,filterping
-	loc	eth2 		192.168.1.255	dhcp
-	dmz	eth1 		206.124.146.255	-
-	net	eth3		206.124.146.255 norfc1918
-	-	texas 		-
-	loc	ppp+
-	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            -

                                            Hosts File:

                                            - - 
                                            	#ZONE 		HOST(S)			OPTIONS
-	me		eth2:192.168.1.3
-	tx 		texas:192.168.9.0/24
-	#LAST LINE -- ADD YOUR ENTRIES ABOVE -- DO NOT REMOVE
                                            - -

                                            Routestopped File:

                                            - - 
                                            	#INTERFACE	HOST(S)
-	eth1		206.124.146.177
-	eth2 		-
-	eth3 		206.124.146.180
                                            -

                                            Common File:

                                            - 
                                            	. /etc/shorewall/common.def
-	run_iptables -A common -p udp --sport 53 -mstate --state NEW -j DROP
-	run_iptables -A common -p tcp --dport 113 -j REJECT
                                            - -

                                            Policy File:

                                            - - 
                                            
+                           
+  
                                             The firewall system itself runs a DHCP server that serves the local
+  network.
                                            
+                           
+  
                                             All administration and publishing is done using ssh/scp.
                                            
+                           
+  
                                             I run an SNMP server on my firewall to serve  MRTG running
+in the DMZ.
                                            
+                           
+  
                                                                       
+  
                                            
+                           
+  
                                             
                                            
+                           
+  
                                            The ethernet interface in the Server is configured                 
+         with IP address 206.124.146.177, netmask                       
+    255.255.255.0. The server's default gateway is                      
+     206.124.146.254 (Router at my ISP. This is the same                
+           default gateway used by the firewall itself). On the firewall, 
+                          Shorewall automatically adds a host route to  
+                        206.124.146.177 through eth1 (192.168.2.1) because
+of                           the entry in /etc/shorewall/proxyarp (see below).
                                            
+                           
+  
                                            A similar setup is used on eth3 (192.168.3.1) which                
+           interfaces to my laptop (206.124.146.180).
                                            
+                           
+  
                                                                       Note: My files
+ use features not available before                            Shorewall version
+1.3.4.
                                            
+
                                            + +

                                            Shorewall.conf

                                            + +
                                            	SUBSYSLOCK=/var/lock/subsys/shorewall
                                            	STATEDIR=/var/state/shorewall

                                            	LOGRATE=
                                            	LOGBURST=

                                            	ADD_IP_ALIASES="Yes"

                                            	CLAMPMSS=Yes

                                            	MULTIPORT=Yes
                                            + +

                                            Zones File:

                                            + +
                                            	#ZONE 	DISPLAY 	COMMENTS
                                            	net	Internet	Internet
                                            	me	Eastep		My Workstation
                                            	loc	Local		Local networks
                                            	dmz	DMZ		Demilitarized zone
                                            	tx	Texas		Peer Network in Dallas Texas
                                            	#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
                                            + +

                                            Interfaces File:

                                            + +
                                            +

                                            This is set up so that I can start the firewall before bringing up +my Ethernet interfaces.

                                            +
                                            + +
                                            	#ZONE    INTERFACE	BROADCAST 	OPTIONS
                                            	net	eth0 		206.124.146.255	routefilter,norfc1918,blacklist,filterping
                                            	loc	eth2 		192.168.1.255	dhcp
                                            	dmz	eth1 		206.124.146.255	-
                                            	net	eth3		206.124.146.255 norfc1918
                                            	-	texas 		-
                                            	loc	ppp+
                                            	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            + +

                                            Hosts File:

                                            + +
                                            	#ZONE 		HOST(S)			OPTIONS
                                            	me		eth2:192.168.1.3,eth2:206.124.146.179
                                            	tx 		texas:192.168.9.0/24
                                            	#LAST LINE -- ADD YOUR ENTRIES ABOVE -- DO NOT REMOVE
                                            + +

                                            Routestopped File:

                                            + +
                                            	#INTERFACE	HOST(S)
                                            	eth1		206.124.146.177
                                            	eth2 		-
                                            	eth3 		206.124.146.180
                                            + +

                                            Common File:

                                            + +
                                            	. /etc/shorewall/common.def
                                            	run_iptables -A common -p udp --sport 53 -mstate --state NEW -j DROP
                                            	run_iptables -A common -p tcp --dport 113 -j REJECT
                                            + +

                                            Policy File:

                                            + +
                                            
 	#SOURCE	DEST	POLICY	LOG LEVEL	LIMIT:BURST
 	me	all	ACCEPT
 	tx	me	ACCEPT		#Give Texas access to my personal system
-	all	me	CONTINUE	#WARNING: You must be running Shorewall 1.3.1 or later for
-					#	  this policy to work as expected!!!	
-	loc 	loc 	ACCEPT
-	loc 	net	ACCEPT
-	$FW	loc	ACCEPT
-	$FW	tx	ACCEPT
-	loc	tx	ACCEPT
-	loc	fw	REJECT
-	net	net	ACCEPT
-	net	all	DROP	info		10/sec:40
-	all	all	REJECT	info
-	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOTE
                                            -

                                            Masq File:

                                            - -
                                            -

                                            -Although most of our internal systems use static NAT, my wife's system -(192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with laptops.

                                            -
                                            - - 
                                            	#INTERFACE 	SUBNET		ADDRESS
-	eth0 		192.168.1.0/24	206.124.146.176
-	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
                                            -

                                            NAT File:

                                            - 
                                            	#EXTERNAL	INTERFACE	INTERNAL	ALL	LOCAL
-	206.124.146.178 eth0 		192.168.1.5 	No 	No
-	206.124.146.179 eth0 		192.168.1.3 	No 	No
-	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
                                            - -

                                            Proxy ARP File:

                                            - 
                                                 	#ADDRESS	INTERFACE	EXTERNAL	HAVEROUTE
-	206.124.146.177 eth1 		eth0 		No
-	206.124.146.180	eth3		eth0		No
-	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            - -

                                            Rules File (The shell variables - are set in /etc/shorewall/params):

                                            - - 
                                                 	#ACTION		SOURCE 		DEST 			PROTO	DEST 	SOURCE  ORIGINAL
-	#                       				PORT(S) PORT(S)	PORT(S)	DEST
-	#
-	# Local Network to Internet - Reject attempts by Trojans to call home
-	#
-	REJECT:info 	loc 		net 			tcp	6667
-	#
-	# Local Network to Firewall 
-	#
-	ACCEPT		loc		fw 			tcp 	ssh
-	ACCEPT		loc		fw			tcp	time
-	#
-	# Local Network to DMZ 
-	#
-	ACCEPT 		loc 		dmz 			udp	domain
-	ACCEPT		loc		dmz			tcp	smtp
-	ACCEPT		loc		dmz			tcp	domain
-	ACCEPT		loc		dmz			tcp	ssh
-	ACCEPT		loc		dmz			tcp	auth
-	ACCEPT		loc		dmz			tcp	imap
-	ACCEPT		loc		dmz			tcp	https
-	ACCEPT		loc		dmz			tcp	imaps
-	ACCEPT		loc		dmz			tcp	cvspserver
-	ACCEPT 		loc 		dmz 			tcp 	www
-	ACCEPT		loc		dmz			tcp	ftp
-	ACCEPT		loc		dmz			tcp	pop3
-	ACCEPT		loc		dmz			icmp	echo-request
-	#
-	# Internet to DMZ 
-	#
-	ACCEPT		net		dmz 			tcp	www
-	ACCEPT		net		dmz			tcp	smtp
-	ACCEPT		net		dmz			tcp	ftp
-	ACCEPT		net		dmz			tcp	auth
-	ACCEPT		net		dmz			tcp	https
-	ACCEPT		net		dmz			tcp	imaps
-	ACCEPT		net		dmz			tcp	domain
-	ACCEPT		net		dmz			tcp	cvspserver
-	ACCEPT		net		dmz			udp	domain
-	ACCEPT		net		dmz			icmp	echo-request
-	ACCEPT 		net:$MIRRORS	dmz			tcp	rsync
-	#
-	# Net to Me (ICQ chat and file transfers) 
-	#
-	ACCEPT		net		me			tcp	4000:4100
-	#
-	# Net to Local 
-	#
-	ACCEPT		net		loc			tcp	auth
-	REJECT		net		loc			tcp	www
-	#
-	# DMZ to Internet
-	#
-	ACCEPT		dmz		net			icmp	echo-request
-	ACCEPT		dmz		net			tcp	smtp
-	ACCEPT		dmz		net			tcp	auth
-	ACCEPT		dmz		net			tcp	domain
-	ACCEPT		dmz		net			tcp	www
-	ACCEPT		dmz		net			tcp	https
-	ACCEPT		dmz		net			tcp	whois
-	ACCEPT		dmz		net			tcp	echo
-	ACCEPT		dmz		net			udp	domain
-	ACCEPT		dmz 		net:$NTPSERVERS		udp	ntp
-	ACCEPT 		dmz 		net:$POPSERVERS		tcp	pop3
-	#
-	# The following compensates for a bug, either in some FTP clients or in the
-	# Netfilter connection tracking code that occasionally denies active mode
-	# FTP clients
-	#
-	ACCEPT:info 	dmz 		net			tcp	1024:	20
-	#
-	# DMZ to Firewall -- snmp
-	#
-	ACCEPT 		dmz 		fw 			tcp	snmp
-	ACCEPT		dmz		fw			udp	snmp
-	#
-	# DMZ to Local Network 
-	#
-	ACCEPT 		dmz 		loc			tcp	smtp
-	ACCEPT		dmz		loc			tcp	auth
-	ACCEPT		dmz		loc			icmp	echo-request
-	# Internet to Firewall
-	#
-	ACCEPT		net		fw			tcp	1723
-	ACCEPT		net		fw			gre
-	REJECT 		net		fw			tcp	www
-	#
-	# Firewall to Internet
-	#
-	ACCEPT 		fw 		net:$NTPSERVERS		udp	ntp
-	ACCEPT		fw		net			udp	domain
-	ACCEPT		fw		net			tcp	domain
-	ACCEPT		fw		net			tcp	www
-	ACCEPT		fw		net			tcp	https
-	ACCEPT		fw		net			tcp	ssh
-	ACCEPT		fw		net			tcp	whois
-	ACCEPT		fw		net 			icmp	echo-request
-	#
-	# Firewall to DMZ
-	#
-	ACCEPT 		fw 		dmz 			tcp 	www
-	ACCEPT 		fw 		dmz 			tcp 	ftp
-	ACCEPT 		fw 		dmz 			tcp 	ssh
-	ACCEPT 		fw 		dmz 			tcp 	smtp
-	ACCEPT 		fw 		dmz 			udp 	domain
-	#
-	# Let Texas Ping
-	#
-	ACCEPT 		tx 		fw 			icmp 	echo-request
-	ACCEPT		tx 		loc 			icmp 	echo-request
-
-	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            - -

                                            -Last updated 8/9/2002 - - - Tom Eastep + all me CONTINUE #WARNING: You must be running Shorewall 1.3.1 or later for
                                            # this policy to work as expected!!!
                                            loc loc ACCEPT
                                            loc net ACCEPT
                                            $FW loc ACCEPT
                                            $FW tx ACCEPT
                                            loc tx ACCEPT
                                            loc fw REJECT
                                            net net ACCEPT
                                            net all DROP info 10/sec:40
                                            all all REJECT info
                                            #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOTE                                             + +

                                            Masq File:

                                            + +
                                            +

                                            Although most of our internal systems use static NAT, my wife's system + (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with laptops.

                                            +
                                            + +
                                            	#INTERFACE 	SUBNET		ADDRESS
                                            	eth0 		192.168.1.0/24	206.124.146.176
                                            	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
                                            + +

                                            NAT File:

                                            + +
                                            	#EXTERNAL	INTERFACE	INTERNAL	ALL	LOCAL
                                            	206.124.146.178 eth0 		192.168.1.5 	No 	No
                                            	206.124.146.179 eth0 		192.168.1.3 	No 	No
                                            	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
                                            + +

                                            Proxy ARP File:

                                            + +
                                                 	#ADDRESS	INTERFACE	EXTERNAL	HAVEROUTE
                                            	206.124.146.177 eth1 		eth0 		No
                                            	206.124.146.180	eth3		eth0		No
                                            	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            + +

                                            Rules File (The shell variables + are set in /etc/shorewall/params):

                                            + +
                                                 	#ACTION		SOURCE 		DEST 			PROTO	DEST 	SOURCE  ORIGINAL
                                            	#                       				PORT(S) PORT(S)	PORT(S)	DEST
                                            	#
                                            	# Local Network to Internet - Reject attempts by Trojans to call home
                                            	#
                                            	REJECT:info 	loc 		net 			tcp	6667
                                            	#
                                            	# Local Network to Firewall 
                                            	#
                                            	ACCEPT		loc		fw 			tcp 	ssh
                                            	ACCEPT		loc		fw			tcp	time
                                            	#
                                            	# Local Network to DMZ 
                                            	#
                                            	ACCEPT 		loc 		dmz 			udp	domain
                                            	ACCEPT		loc		dmz			tcp	smtp
                                            	ACCEPT		loc		dmz			tcp	domain
                                            	ACCEPT		loc		dmz			tcp	ssh
                                            	ACCEPT		loc		dmz			tcp	auth
                                            	ACCEPT		loc		dmz			tcp	imap
                                            	ACCEPT		loc		dmz			tcp	https
                                            	ACCEPT		loc		dmz			tcp	imaps
                                            	ACCEPT		loc		dmz			tcp	cvspserver
                                            	ACCEPT 		loc 		dmz 			tcp 	www
                                            	ACCEPT		loc		dmz			tcp	ftp
                                            	ACCEPT		loc		dmz			tcp	pop3
                                            	ACCEPT		loc		dmz			icmp	echo-request
                                            	#
                                            	# Internet to DMZ 
                                            	#
                                            	ACCEPT		net		dmz 			tcp	www
                                            	ACCEPT		net		dmz			tcp	smtp
                                            	ACCEPT		net		dmz			tcp	ftp
                                            	ACCEPT		net		dmz			tcp	auth
                                            	ACCEPT		net		dmz			tcp	https
                                            	ACCEPT		net		dmz			tcp	imaps
                                            	ACCEPT		net		dmz			tcp	domain
                                            	ACCEPT		net		dmz			tcp	cvspserver
                                            	ACCEPT		net		dmz			udp	domain
                                            	ACCEPT		net		dmz			icmp	echo-request
                                            	ACCEPT 		net:$MIRRORS	dmz			tcp	rsync
                                            	#
                                            	# Net to Me (ICQ chat and file transfers) 
                                            	#
                                            	ACCEPT		net		me			tcp	4000:4100
                                            	#
                                            	# Net to Local 
                                            	#
                                            	ACCEPT		net		loc			tcp	auth
                                            	REJECT		net		loc			tcp	www
                                            	#
                                            	# DMZ to Internet
                                            	#
                                            	ACCEPT		dmz		net			icmp	echo-request
                                            	ACCEPT		dmz		net			tcp	smtp
                                            	ACCEPT		dmz		net			tcp	auth
                                            	ACCEPT		dmz		net			tcp	domain
                                            	ACCEPT		dmz		net			tcp	www
                                            	ACCEPT		dmz		net			tcp	https
                                            	ACCEPT		dmz		net			tcp	whois
                                            	ACCEPT		dmz		net			tcp	echo
                                            	ACCEPT		dmz		net			udp	domain
                                            	ACCEPT		dmz 		net:$NTPSERVERS		udp	ntp
                                            	ACCEPT 		dmz 		net:$POPSERVERS		tcp	pop3
                                            	#
                                            	# The following compensates for a bug, either in some FTP clients or in the
                                            	# Netfilter connection tracking code that occasionally denies active mode
                                            	# FTP clients
                                            	#
                                            	ACCEPT:info 	dmz 		net			tcp	1024:	20
                                            	#
                                            	# DMZ to Firewall -- snmp
                                            	#
                                            	ACCEPT 		dmz 		fw 			tcp	snmp
                                            	ACCEPT		dmz		fw			udp	snmp
                                            	#
                                            	# DMZ to Local Network 
                                            	#
                                            	ACCEPT 		dmz 		loc			tcp	smtp
                                            	ACCEPT		dmz		loc			tcp	auth
                                            	ACCEPT		dmz		loc			icmp	echo-request
                                            	# Internet to Firewall
                                            	#
                                            	ACCEPT		net		fw			tcp	1723
                                            	ACCEPT		net		fw			gre
                                            	REJECT 		net		fw			tcp	www
                                            	#
                                            	# Firewall to Internet
                                            	#
                                            	ACCEPT 		fw 		net:$NTPSERVERS		udp	ntp
                                            	ACCEPT		fw		net			udp	domain
                                            	ACCEPT		fw		net			tcp	domain
                                            	ACCEPT		fw		net			tcp	www
                                            	ACCEPT		fw		net			tcp	https
                                            	ACCEPT		fw		net			tcp	ssh
                                            	ACCEPT		fw		net			tcp	whois
                                            	ACCEPT		fw		net 			icmp	echo-request
                                            	#
                                            	# Firewall to DMZ
                                            	#
                                            	ACCEPT 		fw 		dmz 			tcp 	www
                                            	ACCEPT 		fw 		dmz 			tcp 	ftp
                                            	ACCEPT 		fw 		dmz 			tcp 	ssh
                                            	ACCEPT 		fw 		dmz 			tcp 	smtp
                                            	ACCEPT 		fw 		dmz 			udp 	domain
                                            	#
                                            	# Let Texas Ping
                                            	#
                                            	ACCEPT 		tx 		fw 			icmp 	echo-request
                                            	ACCEPT		tx 		loc 			icmp 	echo-request

                                            	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
                                            + +

                                            Last updated 9/14/2002 - + Tom Eastep

                                            - Copyright - © 2001, 2002 Thomas M. Eastep. \ No newline at end of file + Copyright + © 2001, 2002 Thomas M. Eastep.
                                            + + diff --git a/Shorewall-docs/seattlefirewall_index.htm b/Shorewall-docs/seattlefirewall_index.htm index 81e76436c..06a198d73 100644 --- a/Shorewall-docs/seattlefirewall_index.htm +++ b/Shorewall-docs/seattlefirewall_index.htm @@ -1,161 +1,256 @@ - - + + Shoreline Firewall (Shorewall) 1.3 - + - + - - - + - - - - - -
                                            -

                                            - - Shorewall 1.3 - "iptables made easy"

                                            -
                                            - -
                                            -
                                            - - - + + + + +
                                            - -

                                            What is it?

                                            - -

                                            The Shoreline Firewall, more commonly known as "Shorewall",  is a - Netfilter (iptables) based firewall - that can be used on a dedicated firewall system, a multi-function - gateway/router/server or on a standalone GNU/Linux system.

                                            - -

                                            This program is free software; you can redistribute it and/or modify it - under the terms of Version - 2 of the GNU General Public License as published by the Free Software - Foundation.
                                            -
                                            - This program is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - for more details.
                                            -
                                            - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software Foundation, - Inc., 675 Mass Ave, Cambridge, MA 02139, USA

                                            - + + + + + + + + + +
                                            +

                                            + + Shorewall 1.3 - "iptables made easy"

                                            +
                                            + +
                                            +
                                            + + + + - - -
                                            + +

                                            What is it?

                                            + +

                                            The Shoreline Firewall, more commonly known as "Shorewall",  is +a Netfilter (iptables) based +firewall that can be used on a dedicated firewall system, a multi-function + gateway/router/server or on a standalone GNU/Linux system.

                                            + +

                                            This program is free software; you can redistribute it and/or modify +it under the terms of Version 2 of the GNU +General Public License as published by the Free Software Foundation.
                                            +
                                            + This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + for more details.
                                            +
                                            + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software Foundation, + Inc., 675 Mass Ave, Cambridge, MA 02139, USA

                                            +

                                            Copyright 2001, 2002 Thomas M. Eastep

                                            - - -

                                             Jacques - Nilo and Eric Wolzak have a LEAF distribution called Bering that - features Shorewall-1.3.3 and Kernel-2.4.18. You can find their work at: - - http://leaf.sourceforge.net/devel/jnilo

                                            - - + +

                                              + Jacques Nilo and Eric Wolzak have a LEAF distribution called + Bering that features Shorewall-1.3.3 and Kernel-2.4.18. +You can find their work at: http://leaf.sourceforge.net/devel/jnilo

                                            +

                                            News

                                            - -

                                            8/22/2002 - Shorewall 1.3.7 Released 8/13/2002 -

                                            - -

                                            Features in this release include:

                                            - + +

                                            9/16/2002 - Shorewall 1.3.8  +

                                            + +

                                            In this version:
                                            +

                                            +
                                              -
                                            • The 'icmp.def' file is now empty! The rules in that file were - required in ipchains firewalls but are not required in Shorewall. Users - who have ALLOWRELATED=No in - shorewall.conf should see the Upgrade - Issues.
                                              • -
                                            • A 'FORWARDPING' option has been added to - shorewall.conf. The effect of - setting this variable to Yes is the same as the effect of adding an - ACCEPT rule for ICMP echo-request in - /etc/shorewall/icmpdef. - Users who have such a rule in icmpdef are encouraged to switch to - FORWARDPING=Yes.
                                              • -
                                            • The loopback CLASS A Network (127.0.0.0/8) has been added to the - rfc1918 file.
                                              • -
                                            • Shorewall now works with iptables 1.2.7.
                                              • -
                                            • The documentation and Web site no longer use FrontPage themes.
                                              • +
                                            • A NEWNOTSYN option has been added to shorewall.conf. This option +determines whether Shorewall accepts TCP packets which are not part of an +established connection and that are not 'SYN' packets (SYN flag on and ACK +flag off).
                                              • +
                                            • The need for the 'multi' option to communicate between zones +za and zb on the same interface is removed in the case where the chain 'za2zb' +and/or 'zb2za' exists. 'za2zb' will exist if:
                                              • +
                                                +
                                              • +
                                                There is a policy for za to zb; or
                                                +
                                                • +
                                              • +
                                                There is at least one rule for za to zb.
                                                +
                                                • +
                                            - -

                                            I would like to thank John Distler for his valuable input regarding TCP SYN - and ICMP treatment in Shorewall. That input has led to marked improvement in - Shorewall in the last two releases.

                                            - -

                                            8/13/2002 - Documentation in the - CVS Repository

                                            - -

                                            The Shorewall-docs project now contains just the HTML and image files - the - Frontpage files have been removed.

                                            - -

                                            8/7/2002 - STABLE branch added to - CVS Repository

                                            - -

                                            This branch will only be updated after I release a new version of Shorewall - so you can always update from this branch to get the latest stable tree.

                                            - -

                                            8/7/2002 - Upgrade Issues section added - to the Errata Page

                                            - -

                                            Now there is one place to go to look for issues involved with upgrading to - recent versions of Shorewall.

                                            - -

                                            8/7/2002 - Shorewall 1.3.6

                                            - -

                                            This is primarily a bug-fix rollup with a couple of new features:

                                            - - - - + +
                                              +
                                            • The /etc/shorewall/blacklist file now contains three columns. +In addition to the SUBNET/ADDRESS column, there are optional PROTOCOL and +PORT columns to block only certain applications from the blacklisted addresses.
                                              +
                                              • +
                                            + +

                                            9/11/2002 - Debian 1.3.7c Packages Available

                                            + +

                                            Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

                                            + +

                                            9/2/2002 - Shorewall 1.3.7c

                                            + +

                                            This is a role up of a fix for "DNAT" rules where the source zone +is $FW (fw).

                                            + +

                                            8/26/2002 - Shorewall 1.3.7b

                                            + +

                                            This is a role up of the "shorewall refresh" bug fix and the change +which reverses the order of "dhcp" and "norfc1918" checking.

                                            + +

                                            8/26/2002 - French FTP Mirror is Operational

                                            + +

                                            ftp://france.shorewall.net/pub/mirrors/shorewall +is now available.

                                            + +

                                            8/25/2002 - Shorewall Mirror in France

                                            + +

                                            Thanks to a Shorewall user in Paris, the Shorewall web site is now +mirrored at http://france.shorewall.net.

                                            + +

                                            8/25/2002 - Shorewall 1.3.7a Debian Packages Available

                                            + +

                                            Lorenzo Martignoni reports that the packages for version 1.3.7a + are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

                                            + +

                                            8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for +its Author -- Shorewall 1.3.7a released +

                                            + +

                                            1.3.7a corrects problems occurring in rules file processing when +starting Shorewall 1.3.7.

                                            + +

                                            8/22/2002 - Shorewall 1.3.7 Released

                                            + +

                                            Features in this release include:

                                            + +
                                              +
                                            • The 'icmp.def' file is now empty! The rules in that file were + required in ipchains firewalls but are not required in Shorewall. +Users who have ALLOWRELATED=No in shorewall.conf should see the + Upgrade Issues.
                                              • +
                                            • A 'FORWARDPING' option has been added to shorewall.conf. The effect of + setting this variable to Yes is the same as the effect of adding an + ACCEPT rule for ICMP echo-request in /etc/shorewall/icmpdef. + Users who have such a rule in icmpdef are encouraged to switch to + FORWARDPING=Yes.
                                              • +
                                            • The loopback CLASS A Network (127.0.0.0/8) has been added to +the rfc1918 file.
                                              • +
                                            • Shorewall now works with iptables 1.2.7.
                                              • +
                                            • The documentation and Web site no longer use FrontPage themes.
                                              • + +
                                            + +

                                            I would like to thank John Distler for his valuable input regarding +TCP SYN and ICMP treatment in Shorewall. That input has led to marked improvement +in Shorewall in the last two releases.

                                            + +

                                            8/13/2002 - Documentation in the CVS Repository

                                            + +

                                            The Shorewall-docs project now contains just the HTML and image +files - the Frontpage files have been removed.

                                            + +

                                            8/7/2002 - STABLE branch added to CVS +Repository

                                            + +

                                            This branch will only be updated after I release a new version of +Shorewall so you can always update from this branch to get the latest stable +tree.

                                            + +

                                            8/7/2002 - Upgrade Issues section +added to the Errata Page

                                            + +

                                            Now there is one place to go to look for issues involved with upgrading +to recent versions of Shorewall.

                                            + +

                                            8/7/2002 - Shorewall 1.3.6

                                            + +

                                            This is primarily a bug-fix rollup with a couple of new features:

                                            + + +

                                            More News

                                            - - +

                                            Donations

                                            - -                                             		- SourceForge Logo
                                            -
                                            -
                                            - - - - - -
                                            -

                                            -

                                            -

                                            Shorewall is free but if - you try it and find it useful, please consider making a donation to - Starlight Children's Foundation. Thanks!

                                            - -

                                            Updated - 8/22/2002 - Tom Eastep - - - -

                                            - - - - \ No newline at end of file +                                             		M
                                            +
                                            +
                                            + + + + + + + + +
                                            +

                                            + +

                                            + +

                                            Shorewall is free +but if you try it and find it useful, please consider making a donation +to Starlight +Children's Foundation. Thanks!

                                            +
                                            + +

                                            Updated 9/16/2002 - Tom Eastep + +

                                            +
                                            + + diff --git a/Shorewall-docs/shoreline.htm b/Shorewall-docs/shoreline.htm index 3e6239b7f..5bf26bd34 100644 --- a/Shorewall-docs/shoreline.htm +++ b/Shorewall-docs/shoreline.htm @@ -73,17 +73,20 @@ Washington
                                            • 1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB & 8GB IDE HDs and LNE100TX (Tulip) NIC - My personal Windows system.
                                              • -
                                            • Celeron 1.4Gz, RH7.3, 256MB RAM, 60GB HD, LNE100TX(Tulip) NIC - My - personal Linux System which runs Samba configured as a WINS server.
                                              • +
                                            • Celeron 1.4Gz, RH7.3, 384MB RAM, 60GB HD, LNE100TX(Tulip) NIC - My + personal Linux System which runs Samba configured as a WINS server. This + system also has VMware installed and + can run both Debian and + SuSE in virtual machines.
                                            • K6-2/350, RH7.3, 384MB RAM, 8GB IDE HD, EEPRO100 NIC  - Mail (Postfix & Courier-IMAP), HTTP (Apache), FTP (Pure_ftpd), DNS server (Bind).
                                              • -
                                            • PII/233, RH7.3 with 2.4.19 kernel, 256MB MB RAM, 2GB SCSI HD - 3 +
                                            • PII/233, RH7.3 with 2.4.20-pre2 kernel, 256MB MB RAM, 2GB SCSI HD - 3 LNE100TX  (Tulip) and 1 TLAN NICs  - Firewall running Shorewall 1.3.6 and a DHCP server.  Also runs PoPToP for road warrior access.
                                            • Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139 NIC - My wife's personal system.
                                            • PII/400 Laptop, Win2k SP2, 224MB RAM, 12GB HD, onboard EEPRO100 and EEPRO100 -in expansion base - My main work system.
                                              • +in expansion base and LinkSys WAC11 - My main work system.

                                            For more about our network see my Shorewall Configuration.

                                            diff --git a/Shorewall-docs/shorewall_features.htm b/Shorewall-docs/shorewall_features.htm index e2dff314f..02ac60f3d 100644 --- a/Shorewall-docs/shorewall_features.htm +++ b/Shorewall-docs/shorewall_features.htm @@ -50,7 +50,7 @@
                                          • Blacklisting of individual IP addresses and subnetworks is supported.
                                            • -
                                          • Operational support: +
                                          • Operational support:
                                            • Commands to start, stop and clear the firewall
                                            • Supports status monitoring diff --git a/Shorewall-docs/shorewall_firewall_structure.htm b/Shorewall-docs/shorewall_firewall_structure.htm index ffdfd6b46..a82e5bfe0 100644 --- a/Shorewall-docs/shorewall_firewall_structure.htm +++ b/Shorewall-docs/shorewall_firewall_structure.htm @@ -43,7 +43,11 @@ from the internet and from the DMZ and in some cases, from each other.

                                              • While zones are normally disjoint (no two zones have a host in common), there are cases where nested or overlapping zone definitions are appropriate.

                                              -

                                              Packets entering the firewall first pass through the mangle table's +

                                              For a general picture of how packets traverse a Netfilter firewall, see + + http://www.netfilter.org/documentation/tutorials/blueflux/iptables-tutorial.html#TRAVERSINGOFTABLES.
                                              +
                                              + Packets entering the firewall first pass through the mangle table's PREROUTING chain (you can see the mangle table by typing "shorewall show mangle"). If the packet entered through an interface that has the norfc1918 option, then the packet is sent down the man1918  which will drop @@ -55,10 +59,25 @@ from the internet and from the DMZ and in some cases, from each other.

                                              Next, if the packet isn't part of an established connection, it passes through the nat table's PREROUTING chain (you can see the nat table by - typing "shorewall show nat").

                                              + typing "shorewall show nat"). If you are doing both static nat and + port forwarding, the order in which chains are traversed is dependent on the + setting of NAT_BEFORE_RULES in shorewall.conf. If NAT_BEFORE_RULES is on then + packets will ender a chain called interface_in where interface is + the name of the interface on which the packet entered. Here it's destination IP + is compared to each of the EXTERNAL IP addresses from /etc/shorewall/nat + that correspond to this interface; if there is a match, DNAT is applied and the + packet header is modified to the IP in the INTERNAL column of the nat + file record. If the destination address doesn't match any of the rules in the + interface_in chain then the packet enters a chain called sourcezone_dnat + where sourcezone is the source zone of the packet. There it is compared + for a match against each of the DNAT records in the rules file that specify + sourcezone as the source zone. If a match is found, the destination IP + address (and possibly the destination port) is modified based on the rule + matched. If NAT_BEFORE_RULES is off, then the order of traversal of the + interface_in and sourcezone_dnat is reversed.

                                              - Traffic entering the - firewall is sent to an input chain. If the traffic is destined for the + Traffic is next sent to an input chain in the mail Netfilter table + (called 'filter'). If the traffic is destined for the firewall itself, the name of the input chain is formed by appending "_in" to the interface name. So traffic on eth0 destined for the firewall will enter a chain called eth0_in. The input chain for traffic that will be routed to @@ -151,6 +170,6 @@ its own separate connection from the firewall to zone B.

                                              zone and you are having problems connecting from a local client to an internet server, adding a rule won't help (see point 3 above).

                                              -

                                              Last modified 7/26/2002 - Tom +

                                              Last modified 8/22/2002 - Tom Eastep

                                              Copyright © 2001, 2002 Thomas M. Eastep. \ No newline at end of file diff --git a/Shorewall-docs/shorewall_mirrors.htm b/Shorewall-docs/shorewall_mirrors.htm index a99d161ed..c57155bd6 100644 --- a/Shorewall-docs/shorewall_mirrors.htm +++ b/Shorewall-docs/shorewall_mirrors.htm @@ -36,6 +36,8 @@ It is mirrored at:

                                            • http://germany.shorewall.net (Hamburg, Germany)
                                            • http://shorewall.correofuego.com.ar (Martinez (Zona Norte - GBA), Argentina)
                                              • +
                                            • http://france.shorewall.net + (Paris, France)

                                            The main Shorewall FTP Site is ftp://ftp.shorewall.net/pub/shorewall/ and is located in Washington State, USA.  @@ -50,8 +52,11 @@ It is mirrored at:

                                            ftp://germany.shorewall.net/pub/shorewall (Hamburg, Germany)
                                          • ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall (Martinez (Zona Norte - GBA), Argentina)
                                            • +
                                          • + ftp://france.shorewall.net/pub/mirrors/shorewall + (Paris, France)
                                            • -

                                            Last Updated 7/16/2002 - Tom +

                                            Last Updated 8/26/2002 - Tom Eastep

                                            diff --git a/Shorewall-docs/shorewall_prerequisites.htm b/Shorewall-docs/shorewall_prerequisites.htm index 56067978f..0790156da 100644 --- a/Shorewall-docs/shorewall_prerequisites.htm +++ b/Shorewall-docs/shorewall_prerequisites.htm @@ -18,7 +18,7 @@

                                            -

                                            Last updated 8/4/2002 - Tom +

                                            Last updated 8/24/2002 - Tom Eastep

                                            diff --git a/Shorewall-docs/shorewall_quickstart_guide.htm b/Shorewall-docs/shorewall_quickstart_guide.htm index bcd097d68..69a086fe8 100644 --- a/Shorewall-docs/shorewall_quickstart_guide.htm +++ b/Shorewall-docs/shorewall_quickstart_guide.htm @@ -1,150 +1,202 @@ + - - - - - -Shorewall QuickStart Guide - + + + + + + + + + Shorewall QuickStart Guide + + - - - - - - - + + +
                                            -

                                            Shorewall QuickStart Guides
                                            -Version 3.0

                                            -
                                            + + + + + +
                                            +

                                            Shorewall QuickStart Guides
                                            + Version 3.1

                                            +
                                            - -

                                            With thanks to Richard who reminded me once again that we must -all first walk before we can run.

                                            - + +

                                            With thanks to Richard who reminded me once again that +we must all first walk before we can run.

                                            +

                                            The Guides

                                            -

                                            These guides provide step-by-step instructions for configuring Shorewall in -common firewall setups.

                                            -

                                            The following guides are for firewalls with a single external IP address:

                                            + +

                                            These guides provide step-by-step instructions for configuring Shorewall +in common firewall setups.

                                            + +

                                            The following guides are for users who have a single public IP address:

                                            +
                                              -
                                            • Standalone Linux System
                                              • -
                                            • Two-interface Linux System acting as a - firewall/router for a small local network
                                              • -
                                            • Three-interface Linux System acting as a - firewall/router for a small local network and a DMZ.
                                              • +
                                            • Standalone Linux System
                                              • +
                                            • Two-interface Linux System acting +as a firewall/router for a small local network
                                              • +
                                            • Three-interface Linux System acting +as a firewall/router for a small local network and a DMZ.
                                              • +
                                            -

                                            The above guides are designed to get your first firewall up and running -quickly in the three most common Shorewall configurations.

                                            -

                                            The Shorewall Setup Guide outlines -the steps necessary to set up a firewall where there are multiple public IP -addresses involved or if you want to learn more about Shorewall than is -explained in the single-address guides above.

                                            + +

                                            The above guides are designed to get your first firewall up and running + quickly in the three most common Shorewall configurations.

                                            + +

                                            The Shorewall Setup Guide outlines + the steps necessary to set up a firewall where there are multiple public +IP addresses involved or if you want to learn more about Shorewall than +is explained in the single-address guides above.

                                            +
                                              -
                                            • 1.0 Introduction
                                              • -
                                            • 2.0 Shorewall Concepts
                                              • -
                                            • 3.0 Network Interfaces
                                              • -
                                            • 4.0 Addressing, Subnets and Routing - -
                                              • -
                                            • 5.0 Setting up your Network - +

                                              Additional Documentation

                                              -

                                              The following documentation covers a variety of topics and supplements the -QuickStart Guides described above.

                                              + +

                                              The following documentation covers a variety of topics and supplements +the QuickStart Guides described +above.

                                              + -

                                              If you use one of these guides and have a suggestion for improvement -please let me know.

                                              + +

                                              If you use one of these guides and have a suggestion for improvement please let me know.

                                              + +

                                              Last modified 9/16/2002 - Tom Eastep

                                              +

                                              Copyright 2002 Thomas M. Eastep

                                              - +
                                              - - \ No newline at end of file + diff --git a/Shorewall-docs/support.htm b/Shorewall-docs/support.htm index 79ce8991f..81b759efb 100644 --- a/Shorewall-docs/support.htm +++ b/Shorewall-docs/support.htm @@ -1,127 +1,147 @@ + - - - - - -Support - + + + + + + + + + Support + + - - - - - - - + + +
                                              -

                                              Shorewall Support

                                              -
                                              + + + + + +
                                              +

                                              Shorewall Support

                                              +
                                              - + +

                                              "It +is easier to post a problem than to use your own brain" -- Weitse Venema (creator of Postfix)

                                              + +

                                              "Any sane computer with tell you how it works -- you +just have to ask it the right questions" -- Tom Eastep

                                              + +
                                              +

                                              "It irks me when people believe that +free software comes at no cost. The cost is incredibly high." +- Weitse Venema

                                              +

                                              Before Reporting a Problem

                                              -
                                              - -

                                              -"It is easier to post a problem than to use your own brain" -- -Weitse Venema (creator of Postfix)

                                              -
                                              +

                                              There are a number of sources for problem solution information.

                                              +
                                                -
                                              • The Troubleshooting Information contains a - number of tips to help you solve common problems.
                                                • -
                                              • The Errata has links to download updated - components.
                                                • -
                                              • The FAQ has solutions to common problems.
                                                • -
                                              • The Mailing List Archives are a useful source of problem solving - information.
                                                • +
                                              • The FAQ has solutions to common problems.
                                                • +
                                              • The Troubleshooting Information contains +a number of tips to help you solve common problems.
                                                • +
                                              • The Errata has links to download updated + components.
                                                • +
                                              • The Mailing List Archives are a useful source of problem solving + information.
                                                • +
                                              -
                                              -

                                              The archives from the mailing List are at http://www.shorewall.net/pipermail/shorewall-users.

                                              - -

                                              Search the Mailing List Archives at Shorewall.net

                                              - -
                                              -

                                              - -Match: -Format: -Sort by: - - - - -
                                              -Search: - -

                                              -
                                              - -
                                              - -

                                              Problem Reporting Guidelines

                                              - + +
                                              +

                                              The archives from the mailing List are at http://www.shorewall.net/pipermail/shorewall-users.

                                              + +

                                              Search the Mailing List Archives at Shorewall.net

                                              + +
                                              +

                                              Match: + + Format: + + Sort by: + +
                                              + Search:

                                              +
                                              +
                                              + +

                                              Problem Reporting Guidelines

                                              +
                                                -
                                              • When reporting a problem, give as much information as you can. Reports -that say "I tried XYZ and it didn't work" are not at all helpful.
                                                • -
                                              • Please don't describe your environment and then ask us to send you - custom configuration files. We're here to answer your questions but we - can't do your job for you.
                                                • -
                                              • Do you see any "Shorewall" messages in /var/log/messages when you exercise -the function that is giving you problems?
                                                • -
                                              • Have you looked at the packet flow with a tool like tcpdump to try to -understand what is going on?
                                                • -
                                              • Have you tried using the diagnostic capabilities of the application that -isn't working? For example, if "ssh" isn't able to connect, using the -"-v" option gives you a lot of valuable diagnostic information.
                                                • -
                                              • Please include any of the Shorewall configuration files (especially the - /etc/shorewall/hosts file if you have modified that file) that you think are - relevant. If an error occurs when you try to "shorewall start", include a - trace (See the Troubleshooting section for - instructions).
                                                • -
                                              • The list server limits posts to 120kb so don't post GIFs of your - network layout, etc to the Mailing List -- your post will be rejected.
                                                • +
                                              • When reporting a problem, give as much information as you can. Reports +that say "I tried XYZ and it didn't work" are not at all helpful.
                                                • +
                                              • Please don't describe your environment and then ask us to send you + custom configuration files. We're here to answer your questions +but we can't do your job for you.
                                                • +
                                              • Do you see any "Shorewall" messages in /var/log/messages when +you exercise the function that is giving you problems?
                                                • +
                                              • Have you looked at the packet flow with a tool like tcpdump to +try to understand what is going on?
                                                • +
                                              • Have you tried using the diagnostic capabilities of the application +that isn't working? For example, if "ssh" isn't able to connect, using +the "-v" option gives you a lot of valuable diagnostic information.
                                                • +
                                              • Please include any of the Shorewall configuration files (especially +the /etc/shorewall/hosts file if you have modified that file) that you +think are relevant. If an error occurs when you try to "shorewall start", +include a trace (See the Troubleshooting +section for instructions).
                                                • +
                                              • The list server limits posts to 120kb so don't post GIFs of your + network layout, etc to the Mailing List -- your post will be rejected.
                                                • +
                                              -

                                              Where to Send your Problem -Report or to Ask for Help

                                              -

                                              If you run Shorewall under Bering -- please -post your question or problem to the -LEAF Users mailing list.

                                              -

                                              Otherwise, please post your question or problem to the -Shorewall users mailing list; -there are lots of folks there who are willing to help you. Your question/problem -description and their responses will be placed in the mailing list archives to -help people who have a similar question or problem in the future.

                                              -
                                              -

                                              "It irks me when people believe that free software - comes at no cost. The cost is incredibly high." - - Weitse Venema

                                              -
                                              -

                                              I do not answer questions or work on problems sent to me personally but I try -to respond promptly to mailing list posts.   -Tom

                                              -

                                              To Subscribe to the mailing list go to http://www.shorewall.net/mailman/listinfo/shorewall-users + +

                                              Where to Send your Problem Report or to Ask for Help

                                              + +

                                              If you run Shorewall under Bering -- please + post your question or problem to the LEAF Users mailing list.

                                              + +

                                              Otherwise, please post your question or problem to the Shorewall users mailing list; + there are lots of folks there who are willing to help you. Your question/problem + description and their responses will be placed in the mailing list archives +to help people who have a similar question or problem in the future.

                                              + +

                                              I don't look at problems sent to me directly but I try to spend some amount + of time each day responding to problems posted on the mailing list.

                                              + +

                                              -Tom

                                              + +

                                              To Subscribe to the mailing list go to http://www.shorewall.net/mailman/listinfo/shorewall-users .

                                              - -

                                              Last Updated 8/17/2002 - Tom -Eastep

                                              - -

                                              -Copyright © 2001, 2002 Thomas M. Eastep.

                                              - + +

                                              Last Updated 9/14/2002 - Tom Eastep

                                              + +

                                              Copyright © 2001, 2002 Thomas M. Eastep.

                                              +
                                              - - \ No newline at end of file + diff --git a/Shorewall-docs/three-interface.htm b/Shorewall-docs/three-interface.htm index ad554638d..59dec79e5 100644 --- a/Shorewall-docs/three-interface.htm +++ b/Shorewall-docs/three-interface.htm @@ -1,856 +1,1080 @@ + - - - - - -Three-Interface Firewall + + + + + + + + + Three-Interface Firewall - - - - - - - + + +
                                              -

                                              Three-Interface Firewall

                                              -
                                              + + + + + +
                                              +

                                              Three-Interface Firewall

                                              +
                                              - +

                                              Version 2.0.1

                                              -

                                              Setting up a Linux system as a firewall for a small network with -DMZ is a -fairly straight-forward task if you understand the basics and follow the -documentation.

                                              -

                                              This guide doesn't attempt to acquaint you with all of the features of -Shorewall. It rather focuses on what is required to configure Shorewall in one -of its more popular configurations:

                                              + +

                                              Setting up a Linux system as a firewall for a small network +with DMZ is a fairly straight-forward task if you understand the basics +and follow the documentation.

                                              + +

                                              This guide doesn't attempt to acquaint you with all of the features of + Shorewall. It rather focuses on what is required to configure Shorewall +in one of its more popular configurations:

                                              +
                                                -
                                              • Linux system used as a firewall/router for a small local network.
                                                • -
                                              • Single external IP address.
                                                • -
                                              • DMZ connected to a separate ethernet interface.
                                                • -
                                              • Connection through DSL, Cable Modem, ISDN, Frame Relay, dial-up, ...
                                                • +
                                              • Linux system used as a firewall/router for a small local network.
                                                • +
                                              • Single public IP address.
                                                • +
                                              • DMZ connected to a separate ethernet interface.
                                                • +
                                              • Connection through DSL, Cable Modem, ISDN, Frame Relay, dial-up, ...
                                                • +
                                              +

                                              Here is a schematic of a typical installation.

                                              -

                                              -

                                              -

                                              This guide assumes that you have the iproute/iproute2 package installed (on -RedHat, the package is called iproute). You can tell if this -package is installed by the presence of an ip program on your firewall -system. As root, you can use the 'which' command to check for this program:

                                              -
                                                   [root@gateway root]# which ip
-     /sbin/ip
-     [root@gateway root]#

                                              I recommend that you first read through the guide -to familiarize yourself with what's involved then go back through it again -making your configuration changes. Points at which configuration changes are -recommended are flagged with

                                              -

                                                  -If you edit your configuration files on a Windows system, you must save them as -Unix files if your editor supports that option or you must run them through -dos2unix before trying to use them. Similarly, if you copy a configuration file -from your Windows hard drive to a floppy disk, you must run dos2unix against the -copy before using it with Shorewall.

                                              +

                                              +

                                              + +

                                              This guide assumes that you have the iproute/iproute2 package installed +(on RedHat, the package is called iproute). You can tell if +this package is installed by the presence of an ip program on your +firewall system. As root, you can use the 'which' command to check for this +program:

                                              + +
                                                   [root@gateway root]# which ip
                                                   /sbin/ip
                                                   [root@gateway root]#
                                              +

                                              I recommend that you first read through the guide to familiarize yourself +with what's involved then go back through it again making your configuration +changes. Points at which configuration changes are recommended are flagged +with +

                                              + +

                                              +    If you edit your configuration files on a Windows system, you must save +them as Unix files if your editor supports that option or you must run them +through dos2unix before trying to use them. Similarly, if you copy a configuration +file from your Windows hard drive to a floppy disk, you must run dos2unix +against the copy before using it with Shorewall.

                                              + +

                                              Shorewall Concepts

                                              -

                                              The configuration files for Shorewall are contained in the directory -/etc/shorewall -- for simple setups, you will only need to deal with a few of -these as described in this guide. After you have installed Shorewall, -download the three-interface sample, un-tar it -(tar -zxvf three-interfaces.tgz) and and copy the files to /etc/shorewall -(the files will replace files with the same names that were placed in -/etc/shorewall when Shorewall was installed).

                                              -

                                              As each file is introduced, I suggest that you -look through the actual file on your system -- each file contains detailed -configuration instructions and default entries.

                                              -

                                              Shorewall views the network where it is running as being composed of a set of -zones. In the three-interface sample configuration, the following zone names are used:

                                              - - - - - - - - - - - - - - - - - -
                                              NameDescription
                                              netThe Internet
                                              locYour Local Network
                                              dmzDemilitarized Zone
                                              -

                                              Zone names are defined in -/etc/shorewall/zones.

                                              -

                                              Shorewall also recognizes the firewall system as its own zone - by default, -the firewall itself is known as fw.

                                              -

                                              Rules about what traffic to allow and what traffic to deny are expressed in -terms of zones.

                                              - -

                                              For each connection request entering the firewall, the request is first checked against the -/etc/shorewall/rules file. If no rule in that file matches the connection -request then the first policy in /etc/shorewall/policy that matches the -request is applied. If that policy is REJECT or DROP  the request is first -checked against the rules in /etc/shorewall/common (the samples provide that -file for you).

                                              -

                                              The /etc/shorewall/policy file included with the three-interface sample has the -following policies:

                                              -
                                              - +

                                              The configuration files for Shorewall are contained in the directory /etc/shorewall +-- for simple setups, you will only need to deal with a few of these as +described in this guide. After you have installed +Shorewall, download the three-interface +sample, un-tar it (tar -zxvf three-interfaces.tgz) and and copy the +files to /etc/shorewall (the files will replace files with the same names +that were placed in /etc/shorewall when Shorewall was installed).

                                              + +

                                              As each file is introduced, I suggest that you look through the actual +file on your system -- each file contains detailed configuration instructions +and default entries.

                                              + +

                                              Shorewall views the network where it is running as being composed of a +set of zones. In the three-interface sample configuration, the following +zone names are used:

                                              + +
                                              + - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                              Source ZoneDestination ZonePolicyLog LevelLimit:Burst
                                              locnetACCEPT  
                                              netallDROPinfo 
                                              allallREJECTinfo 
                                              -
                                              -
                                              -

                                              In the three-interface sample, the line below is included but commented out. If -you want your firewall system to have full access to servers on the internet, -uncomment that line.

                                              - - - - - - - - - - - - - - - -
                                              Source ZoneDestination ZonePolicyLog LevelLimit:Burst
                                              fwnetACCEPT  
                                              -
                                              -

                                              The above policy will:

                                              -
                                                -
                                              1. allow all connection requests from your local network to the internet
                                                2. -
                                              2. drop (ignore) all connection requests from the internet to your firewall - or local network
                                                3. -
                                              3. optionally accept all connection requests from the firewall to the - internet (if you uncomment the additional policy)
                                                4. -
                                              4. reject all other connection requests.
                                                5. -
                                              -

                                                  At this point, edit your /etc/shorewall/policy -file and make any changes that you -wish.

                                              -

                                              Network Interfaces

                                              -

                                              -

                                              -

                                              The firewall has three network interfaces. Where Internet -connectivity is through a cable or DSL "Modem", the External Interface -will be the ethernet adapter that is connected to that "Modem" (e.g., eth0)  -unless you connect via Point-to-Point Protocol -over Ethernet (PPPoE) or Point-to-Point Tunneling -Protocol (PPTP) in which case the External Interface will be a ppp -interface (e.g., ppp0). If you connect via a regular modem, your External -Interface will also be ppp0. If you connect using ISDN, you external -interface will be ippp0.

                                              -

                                                  If your external interface is ppp0 -or ippp0 then you will want to -set CLAMPMSS=yes in -/etc/shorewall/shorewall.conf.

                                              -

                                              Your Local Interface will be an ethernet adapter (eth0, -eth1 or eth2) and will be connected to a hub or switch. Your local computers -will be connected to the same switch (note: If you have only a single local system, -you can connect the firewall directly to the computer using a cross-over -cable).

                                              -

                                              Your DMZ Interface will also be an ethernet adapter (eth0, -eth1 or eth2) and will be connected to a hub or switch. Your DMZ computers will -be connected to the same switch (note: If you have only a single DMZ system, -you can connect the firewall directly to the computer using a cross-over -cable).

                                              -

                                              -Do not connect more than one interface -to the same hub or switch (even for testing). It won't work the way that you -expect it to and you will end up confused and -believing that Shorewall doesn't work at all.

                                              -

                                                  The Shorewall three-interface sample configuration assumes that -the external interface is eth0, the local interface is eth1 and -the DMZ interface is -eth2. -If your configuration is different, you will have to modify the sample -/etc/shorewall/interfaces file accordingly. While you are there, you may wish to -review the list of options that are specified for the interfaces. Some hints:

                                              + Name + Description + + + net + The Internet + + + loc + Your Local Network + + + dmz + Demilitarized Zone + + + + + +

                                              Zone names are defined in /etc/shorewall/zones.

                                              + +

                                              Shorewall also recognizes the firewall system as its own zone - by default, + the firewall itself is known as fw.

                                              + +

                                              Rules about what traffic to allow and what traffic to deny are expressed +in terms of zones.

                                              +
                                                -
                                              • -

                                                If your external interface is ppp0 or ippp0, you can replace the - "detect" in the second column with "-".

                                                • -
                                              • -

                                                If your external interface is ppp0 or ippp0 or if you have a static IP - address, you can remove "dhcp" from the option list.

                                                • +
                                              • You express your default policy for connections from one zone to another + zone in the /etc/shorewall/policy file.
                                                • +
                                              • You define exceptions to those default policies in the /etc/shorewall/rules file.
                                                • +
                                              -

                                              IP Addresses

                                              -

                                              Before going further, we should say a few words about Internet -Protocol (IP) addresses. Normally, your ISP will assign you a single -Public IP address. This address may be assigned via the Dynamic Host -Configuration Protocol (DHCP) or as part of establishing your connection -when you dial in (standard modem) or establish your PPP connection. In rare -cases, your ISP may assign you a static IP address; that means that you -configure your firewall's external interface to use that address permanently. -Regardless of how the address is assigned, it will be shared by all of your -systems when you access the Internet. You will have to assign your own addresses -for your internal network (the local and DMZ Interfaces on your firewall plus your other -computers). RFC 1918 reserves several Private IP address ranges for this -purpose:

                                              -
                                              - 
                                                   10.0.0.0    - 10.255.255.255
-     172.16.0.0  - 172.31.255.255
-     192.168.0.0 - 192.168.255.255
                                              -
                                              -
                                              -

                                                  - Before starting Shorewall, you should look at the IP address of your external - interface and if it is one of the above ranges, you should remove the - 'norfc1918' option from the external interface's entry in - /etc/shorewall/interfaces.

                                              -
                                              -

                                              You will want to assign your local addresses from one - sub-network or subnet and your DMZ addresses from another subnet. For our purposes, we can consider a subnet - to consists of a range of addresses x.y.z.0 - x.y.z.255. Such a subnet will - have a Subnet Mask of 255.255.255.0. The address x.y.z.0 is reserved as - the Subnet Address and x.y.z.255 is reserved as the Subnet Broadcast - Address. In Shorewall, a subnet is described using - Variable-Length - Subnet Mask (VLSM) notation with consists of the subnet address followed - by "/24". The "24" refers to the number of - consecutive "1" bits from the left of the subnet mask. -

                                              -
                                              -

                                              Example sub-network:

                                              -
                                              -
                                              - + +

                                              For each connection request entering the firewall, the request is first +checked against the /etc/shorewall/rules file. If no rule in that file matches +the connection request then the first policy in /etc/shorewall/policy that +matches the request is applied. If that policy is REJECT or DROP  the +request is first checked against the rules in /etc/shorewall/common (the +samples provide that file for you).

                                              + +

                                              The /etc/shorewall/policy file included with the three-interface sample +has the following policies:

                                              + +
                                              +
                                              + - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                              Range:10.10.10.0 - 10.10.10.255
                                              Source ZoneDestination ZonePolicyLog LevelLimit:Burst
                                              locnetACCEPT  
                                              netallDROPinfo 
                                              allallREJECTinfo 
                                              +
                                              + +
                                              +

                                              In the three-interface sample, the line below is included but commented +out. If you want your firewall system to have full access to servers on +the internet, uncomment that line.

                                              + + + - - - - - - - - - - - -
                                              Subnet Address:10.10.10.0
                                              Broadcast Address:10.10.10.255
                                              VLSM Notation:10.10.10.0/24
                                              -
                                              -
                                              -
                                              -

                                              It is conventional to assign the internal interface either the - first usable address in the subnet (10.10.10.1 in the above example) or the - last usable address (10.10.10.254).

                                              -
                                              -

                                              One of the purposes of subnetting is to allow all computers in the - subnet to understand which other computers can be communicated with directly. - To communicate with systems outside of the subnetwork, systems send packets - through a  gateway  (router).

                                              -
                                              -

                                                  Your local computers - (Local Computers 1 & 2) should be configured with their - default gateway set to the IP address of the firewall's internal interface - and your DMZ computers ( DMZ Computers 1 & 2) should be configured with their - default gateway set to the IP address of the firewall's DMZ interface.   -

                                              -

                                              The foregoing short discussion barely scratches the surface -regarding subnetting and routing. If you are interested in learning more about -IP addressing and routing, I highly recommend "IP Fundamentals: What Everyone -Needs to Know about Addressing & Routing", Thomas A. Maufer, Prentice-Hall, -1999, ISBN 0-13-975483-0.

                                              -

                                              The remainder of this quide will assume that you have configured -your network as shown here:

                                              -

                                              -

                                              -

                                              The default gateway for the DMZ computers would be 10.10.10.254 -and the default gateway for the Local computers would be 10.10.10.254.

                                              -

                                              IP Masquerading (SNAT)

                                              -

                                              The addresses reserved by RFC 1918 are sometimes referred to as -non-routable because the Internet backbone routers don't forward packets -which have an RFC-1918 destination address. When one of your local systems -(let's assume local computer 1) sends a connection request to an internet host, the -firewall must perform Network Address Translation (NAT). The firewall -rewrites the source address in the packet to be the address of the firewall's -external interface; in other words, the firewall makes it look as if the firewall -itself is initiating the connection.  This is necessary so that the -destination host will be able to route return packets back to the firewall -(remember that packets whose destination address is reserved by RFC 1918 can't -be routed accross the internet). When the firewall receives a return packet, it -rewrites the destination address back to 10.10.10.1 and -forwards the packet on to local computer 1.

                                              -

                                              On Linux systems, the above process is often referred to as -IP Masquerading and you will also see the term Source Network Address -Translation (SNAT) used. Shorewall follows the convention used with -Netfilter:

                                              + Source Zone + Destination Zone + Policy + Log Level + Limit:Burst + + + fw + net + ACCEPT +   +   + + + + +
                                            + +

                                            The above policy will:

                                            + +
                                              +
                                            1. allow all connection requests from your local network to the internet
                                              2. +
                                            2. drop (ignore) all connection requests from the internet to your firewall + or local network
                                              3. +
                                            3. optionally accept all connection requests from the firewall to the + internet (if you uncomment the additional policy)
                                              4. +
                                            4. reject all other connection requests.
                                              5. + +
                                            + +

                                            +    At this point, edit your /etc/shorewall/policy file and make any changes +that you wish.

                                            + +

                                            Network Interfaces

                                            + +

                                            +

                                            + +

                                            The firewall has three network interfaces. Where Internet + connectivity is through a cable or DSL "Modem", the External Interface + will be the ethernet adapter that is connected to that "Modem" (e.g., eth0)  +unless you connect via Point-to-Point Protocol + over Ethernet (PPPoE) or Point-to-Point Tunneling +Protocol (PPTP) in which case the External Interface will be a +ppp interface (e.g., ppp0). If you connect via a regular modem, your +External Interface will also be ppp0. If you connect using ISDN, +you external interface will be ippp0.

                                            + +

                                            +    If your external interface is ppp0 or ippp0 then you will +want to set CLAMPMSS=yes in /etc/shorewall/shorewall.conf.

                                            + +

                                            Your Local Interface will be an ethernet adapter (eth0, + eth1 or eth2) and will be connected to a hub or switch. Your local computers + will be connected to the same switch (note: If you have only a single local +system, you can connect the firewall directly to the computer using a cross-over + cable).

                                            + +

                                            Your DMZ Interface will also be an ethernet adapter +(eth0, eth1 or eth2) and will be connected to a hub or switch. Your DMZ +computers will be connected to the same switch (note: If you have only a +single DMZ system, you can connect the firewall directly to the computer +using a cross-over cable).

                                            + +

                                            +Do not connect more than one interface to the same hub or switch +(even for testing). It won't work the way that you expect it to and you +will end up confused and believing that Shorewall doesn't work at all.

                                            + +

                                            +    The Shorewall three-interface sample configuration assumes that the +external interface is eth0, the local interface is eth1 and + the DMZ interface is eth2. If your configuration is different, +you will have to modify the sample /etc/shorewall/interfaces file accordingly. +While you are there, you may wish to review the list of options that are +specified for the interfaces. Some hints:

                                            +
                                              -
                                            • -

                                              Masquerade describes the case where you let your - firewall system automatically detect the external interface address.

                                              • -
                                            • -

                                              SNAT refers to the case when you explicitly specify the - source address that you want outbound packets from your local network to use. +

                                            • +

                                              If your external interface is ppp0 or ippp0, +you can replace the "detect" in the second column with "-".

                                              +
                                              • +
                                            • +

                                              If your external interface is ppp0 or ippp0 +or if you have a static IP address, you can remove "dhcp" from the option +list.

                                            -

                                            In Shorewall, both Masquerading and SNAT are configured with -entries in the /etc/shorewall/masq file.

                                            -

                                                If your external firewall interface is eth0, your local -interface eth1 and your DMZ interface is eth2 then you do not -need to modify the file provided with the sample. Otherwise, edit -/etc/shorewall/masq and change it to match your configuration.

                                            -

                                                If your external IP -is static, you can enter it in the third column in the /etc/shorewall/masq entry -if you like although your firewall will work fine if you leave that column -empty. Entering your static IP in column 3 makes processing outgoing packets a -little more efficient.

                                            + +

                                            IP Addresses

                                            + +

                                            Before going further, we should say a few words about Internet + Protocol (IP) addresses. Normally, your ISP will assign you a single + Public IP address. This address may be assigned via the Dynamic +Host Configuration Protocol (DHCP) or as part of establishing your connection + when you dial in (standard modem) or establish your PPP connection. In rare + cases, your ISP may assign you a static IP address; that means that +you configure your firewall's external interface to use that address permanently. +Regardless of how the address is assigned, it will be shared by all of +your systems when you access the Internet. You will have to assign your +own addresses for your internal network (the local and DMZ Interfaces on +your firewall plus your other computers). RFC 1918 reserves several Private +IP address ranges for this purpose:

                                            + +
                                            +
                                                 10.0.0.0    - 10.255.255.255
                                                 172.16.0.0  - 172.31.255.255
                                                 192.168.0.0 - 192.168.255.255
                                            +
                                            + +
                                            +

                                            +    Before starting Shorewall, you should look at the IP address of your +external interface and if it is one of the above ranges, you should remove +the 'norfc1918' option from the external interface's entry in /etc/shorewall/interfaces.

                                            +
                                            + +
                                            +

                                            You will want to assign your local addresses from one + sub-network or subnet and your DMZ addresses from another subnet. +For our purposes, we can consider a subnet to consists of a range of addresses +x.y.z.0 - x.y.z.255. Such a subnet will have a Subnet Mask of 255.255.255.0. +The address x.y.z.0 is reserved as the Subnet Address and x.y.z.255 +is reserved as the Subnet Broadcast Address. In Shorewall, +a subnet is described using Variable-Length + Subnet Mask (VLSM) notation with consists of the subnet address +followed by "/24". The "24" refers to the number of consecutive "1" +bits from the left of the subnet mask.

                                            +
                                            + +
                                            +

                                            Example sub-network:

                                            +
                                            + +
                                            +
                                            + + + + + + + + + + + + + + + + + + + + +
                                            Range:10.10.10.0 - 10.10.10.255
                                            Subnet Address:10.10.10.0
                                            Broadcast Address:10.10.10.255
                                            VLSM Notation:10.10.10.0/24
                                            +
                                            +
                                            + +
                                            +

                                            It is conventional to assign the internal interface either +the first usable address in the subnet (10.10.10.1 in the above example) +or the last usable address (10.10.10.254).

                                            +
                                            + +
                                            +

                                            One of the purposes of subnetting is to allow all computers +in the subnet to understand which other computers can be communicated +with directly. To communicate with systems outside of the subnetwork, +systems send packets through a  gateway  (router).

                                            +
                                            + +
                                            +

                                            +    Your local computers (Local Computers 1 & 2) should be configured +with their default gateway set to the IP address of the firewall's +internal interface and your DMZ computers ( DMZ Computers 1 & 2) should +be configured with their default gateway set to the IP address of the +firewall's DMZ interface.  

                                            +
                                            + +

                                            The foregoing short discussion barely scratches the surface + regarding subnetting and routing. If you are interested in learning more +about IP addressing and routing, I highly recommend "IP Fundamentals: +What Everyone Needs to Know about Addressing & Routing", Thomas +A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.

                                            + +

                                            The remainder of this quide will assume that you have configured + your network as shown here:

                                            + +

                                            +

                                            + +

                                            The default gateway for the DMZ computers would be 10.10.10.254 + and the default gateway for the Local computers would be 10.10.10.254.

                                            + +

                                            IP Masquerading (SNAT)

                                            + +

                                            The addresses reserved by RFC 1918 are sometimes referred +to as non-routable because the Internet backbone routers don't forward +packets which have an RFC-1918 destination address. When one of your local +systems (let's assume local computer 1) sends a connection request to an +internet host, the firewall must perform Network Address Translation +(NAT). The firewall rewrites the source address in the packet to be +the address of the firewall's external interface; in other words, the firewall +makes it look as if the firewall itself is initiating the connection.  This +is necessary so that the destination host will be able to route return packets +back to the firewall (remember that packets whose destination address is +reserved by RFC 1918 can't be routed accross the internet). When the firewall +receives a return packet, it rewrites the destination address back to 10.10.10.1 +and forwards the packet on to local computer 1.

                                            + +

                                            On Linux systems, the above process is often referred to +as IP Masquerading and you will also see the term Source Network +Address Translation (SNAT) used. Shorewall follows the convention used +with Netfilter:

                                            + +
                                              +
                                            • +

                                              Masquerade describes the case where you let your + firewall system automatically detect the external interface address. +

                                              +
                                              • +
                                            • +

                                              SNAT refers to the case when you explicitly specify +the source address that you want outbound packets from your local network +to use.

                                              +
                                              • +
                                            + +

                                            In Shorewall, both Masquerading and SNAT are configured with + entries in the /etc/shorewall/masq file.

                                            + +

                                            +    If your external firewall interface is eth0, your local interface +eth1 and your DMZ interface is eth2 then you do not need to +modify the file provided with the sample. Otherwise, edit /etc/shorewall/masq +and change it to match your configuration.

                                            + +

                                            +    If your external IP is static, you can enter it in the third column +in the /etc/shorewall/masq entry if you like although your firewall will +work fine if you leave that column empty. Entering your static IP in column +3 makes processing outgoing packets a little more efficient.

                                            +

                                            Port Forwarding (DNAT)

                                            -

                                            One of your goals will be to run one or more servers on your DMZ computers. Because these computers have RFC-1918 addresses, it is not -possible for clients on the internet to connect directly to them. It is rather -necessary for those clients to address their connection requests to your firewall -who rewrites the destination address to the address of your server and forwards -the packet to that server. When your server responds, the firewall automatically -performs SNAT to rewrite the source address in the response.

                                            -

                                            The above process is called Port Forwarding or -Destination Network Address Translation (DNAT). You configure port -forwarding using DNAT rules in the /etc/shorewall/rules file.

                                            -

                                            The general form of a simple port forwarding rule in -/etc/shorewall/rules is:

                                            -
                                            - - - - - - - - - - - - - - - - - - - + +

                                            One of your goals will be to run one or more servers on your +DMZ computers. Because these computers have RFC-1918 addresses, it is not + possible for clients on the internet to connect directly to them. It is +rather necessary for those clients to address their connection requests +to your firewall who rewrites the destination address to the address of +your server and forwards the packet to that server. When your server responds, +the firewall automatically performs SNAT to rewrite the source address in +the response.

                                            + +

                                            The above process is called Port Forwarding or +Destination Network Address Translation (DNAT). You configure port forwarding +using DNAT rules in the /etc/shorewall/rules file.

                                            + +

                                            The general form of a simple port forwarding rule in /etc/shorewall/rules +is:

                                            + +
                                            +
                                            ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
                                            DNATnetdmz:<server local ip address> [:<server port>]<protocol><port>  
                                            + + + + + + + + + + + + + + + + + + + + +
                                            ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
                                            DNATnetdmz:<server local ip address> [:<server port>]<protocol><port>  
                                            -
                                            -

                                            If you don't specify the <server port>, it is assumed to be the same -as <port>.

                                            -

                                            Example - you run a Web Server on DMZ 2 and you want to forward incoming -TCP port 80 to that system:

                                            -
                                            - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +

                                            If you don't specify the <server port>, it is assumed to +be the same as <port>.

                                            + +

                                            Example - you run a Web Server on DMZ 2 and you want to forward incoming + TCP port 80 to that system:

                                            + +
                                            +
                                            ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
                                            DNATnetdmz:10.10.11.2tcp80# Forward port 80from the internet
                                            ACCEPTlocdmz:10.10.11.2tcp80#Allow connections from the local network
                                            + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                            ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
                                            DNATnetdmz:10.10.11.2tcp80# Forward port 80from the internet
                                            ACCEPTlocdmz:10.10.11.2tcp80#Allow connections from the local network
                                            -
                                            -

                                            A -couple of important points -to keep in mind:

                                            +
    + +

    A couple of important points to keep in mind:

    +
      -
    • When you are connecting to your server from your local systems, you must - use the server's internal IP address (10.10.11.2).
      • -
    • Many ISPs block incoming connection requests to port 80. If you have - problems connecting to your web server, try the following rule and try - connecting to port 5000 (e.g., connect to - http://w.x.y.z:5000 where w.x.y.z is your external IP).
      • +
    • When you are connecting to your server from your local systems, you +must use the server's internal IP address (10.10.11.2).
      • +
    • Many ISPs block incoming connection requests to port 80. If you have + problems connecting to your web server, try the following rule and try + connecting to port 5000 (e.g., connect to http://w.x.y.z:5000 where w.x.y.z is your +external IP).
      • +
    -
    - - - - - - - - - - - - - - - - - - - + +
    +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp5000  
    + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp5000  
    -
    -

    If you want to be able -to access your server from the local network using your external address, then -if you have a static external IP you can replace the loc->dmz rule above with:

    -
    - - - - - - - - - - - - - - - - - - - + + +

    If you want to be able to access your server from the local network using +your external address, then if you have a static external IP you can replace +the loc->dmz rule above with:

    + +
    +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp80-<external IP>
    + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp80-<external IP>
    -
    -

    If you have a dynamic ip then you must ensure that your external interface is -up before starting Shorewall and you must take steps as follows (assume that -your external interface is eth0):

    +
    + +

    If you have a dynamic ip then you must ensure that your external interface +is up before starting Shorewall and you must take steps as follows (assume +that your external interface is eth0):

    +
      -
    1. Include the following in /etc/shorewall/params:
      -
      - ETH0_IP=`find_interface_address eth0`
      - 
      2. -
    2. Make your loc->dmz rule:
      3. +
    3. Include the following in /etc/shorewall/params:
      +
      + ETH0_IP=`find_interface_address eth0`
      +  
      4. +
    4. Make your loc->dmz rule:
      5. +
    -
    - - - - - - - - - - - - - - - - - - - + +
    +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp80-$ETH0_IP
    + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    DNATnetdmz:10.10.11.2:80tcp80-$ETH0_IP
    -
    -

    If you want to access your server from the DMZ using your external IP -address, see FAQ 2a.

    -

        At this point, add the DNAT and -ACCEPT rules for your servers.

    + + +

    If you want to access your server from the DMZ using your external IP + address, see FAQ 2a.

    + +

    +    At this point, add the DNAT and ACCEPT rules for your servers.

    +

    Domain Name Server (DNS)

    -

    Normally, when you connect to your ISP, as part of getting an IP -address your firewall's Domain Name Service (DNS) resolver will be -automatically configured (e.g., the /etc/resolv.conf file will be written). -Alternatively, your ISP may have given you the IP address of a pair of DNS -name servers for you to manually configure as your primary and secondary -name servers. It is your responsibility to configure the resolver in your -internal systems. You can take one of two approaches:

    + +

    Normally, when you connect to your ISP, as part of getting +an IP address your firewall's Domain Name Service (DNS) resolver +will be automatically configured (e.g., the /etc/resolv.conf file will be +written). Alternatively, your ISP may have given you the IP address of a +pair of DNS name servers for you to manually configure as your primary +and secondary name servers. It is your responsibility to configure +the resolver in your internal systems. You can take one of two approaches:

    +
      -
    • -

      You can configure your internal systems to use your ISP's name - servers. If you ISP gave you the addresses of their servers or if those - addresses are available on their web site, you can configure your internal - systems to use those addresses. If that information isn't available, look in - /etc/resolv.conf on your firewall system -- the name servers are given in - "nameserver" records in that file.

      • -
    • -

          You can configure a Caching Name Server on your - firewall or in your DMZ. Red Hat has an RPM for a caching name server (which also - requires the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you - take this approach, you configure your internal systems to use the caching - name server as their primary (and only) name server. You use the internal IP - address of the firewall (10.10.10.254 in the example above) for the name - server address if you choose to run the name server on your firewall. To allow your local systems to talk to your caching name - server, you must open port 53 (both UDP and TCP) from the local network to the - server; you do that by adding the rules in /etc/shorewall/rules.

      • +
    • +

      You can configure your internal systems to use your ISP's +name servers. If you ISP gave you the addresses of their servers or if +those addresses are available on their web site, you can configure your +internal systems to use those addresses. If that information isn't available, +look in /etc/resolv.conf on your firewall system -- the name servers are +given in "nameserver" records in that file.

      +
      • +
    • +

      +    You can configure a Caching Name Server on your firewall or +in your DMZ. Red Hat has an RPM for a caching name server (which also + requires the 'bind' RPM) and for Bering users, there is dnscache.lrp. +If you take this approach, you configure your internal systems to use +the caching name server as their primary (and only) name server. You use +the internal IP address of the firewall (10.10.10.254 in the example above) +for the name server address if you choose to run the name server on your +firewall. To allow your local systems to talk to your caching name server, +you must open port 53 (both UDP and TCP) from the local network to the + server; you do that by adding the rules in /etc/shorewall/rules.

      +
    -
    -

    If you run the name server on the firewall: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +
    +

    If you run the name server on the firewall: +

    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTlocfwtcp53  
    ACCEPTlocfwudp53  
    ACCEPTdmzfwtcp53  
    ACCEPTdmzfwudp53  
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTlocfwtcp53  
    ACCEPTlocfwudp53  
    ACCEPTdmzfwtcp53  
    ACCEPTdmzfwudp53  
    +

    -
    -
    -

    Run name server on DMZ computer 1

    - + +
    +
    +

    Run name server on DMZ computer 1

    + +
    + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTlocdmz:10.10.11.1tcp53  
    ACCEPTlocdmz:10.10.11.1udp53  
    ACCEPTfwdmz:10.10.10.1tcp53  
    ACCEPTfwdmz:10.10.10.1udp53  
    -
    + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + loc + dmz:10.10.11.1 + tcp + 53 +   +   + + + ACCEPT + loc + dmz:10.10.11.1 + udp + 53 +   +   + + + ACCEPT + fw + dmz:10.10.10.1 + tcp + 53 +   +   + + + ACCEPT + fw + dmz:10.10.10.1 + udp + 53 +   +   + + + + + +
    + +
    +

    Other Connections

    +
    + +
    +

    The three-interface sample includes the following rules:

    -
    -

    Other Connections

    + +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTfwnetudp53  
    ACCEPTfwnettcp53  
    +
    +
    + +
    +

    Those rules allow DNS access from your firewall and may be + removed if you commented out the line in /etc/shorewall/policy allowing +all connections from the firewall to the internet.

    -
    -

    The three-interface sample includes the following rules:

    -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTfwnetudp53  
    ACCEPTfwnettcp53  
    -
    + +
    +

    The sample also includes:

    -
    -

    Those rules allow DNS access from your firewall and may be - removed if you commented out the line in /etc/shorewall/policy allowing all - connections from the firewall to the internet.

    -
    -

    The sample also includes:

    -
    -
    - + +
    +
    +
    + - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTlocfwtcp22  
    ACCEPTlocdmztcp22  
    -
    + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + loc + fw + tcp + 22 +   +   + + + ACCEPT + loc + dmz + tcp + 22 +   +   + + + + + +
    + +
    +

    That rule allows you to run an SSH server on your firewall +and in each of your DMZ systems and to connect to those servers from +your local systems.

    -
    -

    That rule allows you to run an SSH server on your firewall and - in each of your DMZ systems and - to connect to those servers from your local systems.

    -
    -

    If you wish to enable other connections between your systems, the general format is:

    -
    -
    - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPT<source zone><destination zone><protocol><port>  
    -
    + +
    +

    If you wish to enable other connections between your systems, +the general format is:

    -
    -

    Example - You want to run a publicly-available DNS server on your firewall - system:

    -
    -
    - + +
    +
    +
    + - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTnetfwtcp53#Allow DNS accessfrom the internet
    ACCEPTnetfwtcp53#Allow DNS accessfrom the internet
    -
    + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + <source zone> + <destination zone> + <protocol> + <port> +   +   + + + + + +
    + +
    +

    Example - You want to run a publicly-available DNS server +on your firewall system:

    -
    -

    Those two rules would of course be in addition to the rules - listed above under "If you run the name server on your firewall".

    -
    -

    If you don't know what port and protocol a particular - application uses, look here.

    -
    -

    Important: I don't recommend enabling telnet to/from - the internet because it uses clear text (even for login!). If you want shell - access to your firewall from the internet, use SSH:

    -
    -
    - + +
    +
    +
    + - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
    ACCEPTnetfwtcp53#Allow DNS accessfrom the internet
    ACCEPTnetfwtcp53#Allow DNS accessfrom the internet
    +
    +
    + +
    +

    Those two rules would of course be in addition to the rules + listed above under "If you run the name server on your firewall".

    +
    + +
    +

    If you don't know what port and protocol a particular +application uses, look here.

    +
    + +
    +

    Important: I don't recommend enabling telnet to/from + the internet because it uses clear text (even for login!). If you want +shell access to your firewall from the internet, use SSH:

    +
    + +
    +
    + + - - - - - - - - -
    ACCEPTnetfwtcp22  
    -
    + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + net + fw + tcp + 22 +   +   + + + + + +
    + +
    +

    +    Now modify /etc/shorewall/rules to add or remove other connections +as required.

    -
    -

        Now modify - /etc/shorewall/rules to add or remove other connections as required.

    -
    -

    Starting and Stopping Your Firewall

    + +
    +

    Starting and Stopping Your Firewall

    +
    + +
    +

    The installation procedure configures +your system to start Shorewall at system boot.

    -
    -

    The installation procedure - configures your system to start Shorewall at system boot.

    -
    -

    The firewall is started using the "shorewall start" command - and stopped using "shorewall stop". When the firewall is stopped, routing is - enabled on those hosts that have an entry in - /etc/shorewall/routestopped. A - running firewall may be restarted using the "shorewall restart" command. If - you want to totally remove any trace of Shorewall from your Netfilter - configuration, use "shorewall clear".

    -
    -

        The three-interface sample assumes that you want to enable - routing to/from eth1 (your local network) and eth2 (DMZ) when Shorewall is stopped. - If these two interfaces don't connect to your local network and DMZ or if you - want to enable a different set of hosts, modify /etc/shorewall/routestopped - accordingly.

    -
    -

    WARNING: If you are connected to your firewall from the - internet, do not issue a "shorewall stop" command unless you have added an - entry for the IP address that you are connected from to - /etc/shorewall/routestopped. - Also, I don't recommend using "shorewall restart"; it is better to create an - alternate configuration and - test it using the "shorewall try" command.

    -

    Last updated -7/27/2002 - Tom -Eastep

    - -

    Copyright 2002 Thomas M. Eastep

    - + +
    +

    The firewall is started using the "shorewall start" command + and stopped using "shorewall stop". When the firewall is stopped, routing +is enabled on those hosts that have an entry in /etc/shorewall/routestopped. A + running firewall may be restarted using the "shorewall restart" command. +If you want to totally remove any trace of Shorewall from your Netfilter + configuration, use "shorewall clear".

    +
    + +
    +

    +    The three-interface sample assumes that you want to enable routing +to/from eth1 (your local network) and eth2 (DMZ) when Shorewall +is stopped. If these two interfaces don't connect to your local network +and DMZ or if you want to enable a different set of hosts, modify /etc/shorewall/routestopped + accordingly.

    +
    + +
    +

    WARNING: If you are connected to your firewall from +the internet, do not issue a "shorewall stop" command unless you have +added an entry for the IP address that you are connected from to /etc/shorewall/routestopped. + Also, I don't recommend using "shorewall restart"; it is better to create +an alternate configuration +and test it using the "shorewall +try" command.

    +
    + +

    Last updated 9/16/2002 - Tom Eastep

    + +

    Copyright 2002 Thomas +M. Eastep

    +
    - - \ No newline at end of file + diff --git a/Shorewall-docs/traffic_shaping.htm b/Shorewall-docs/traffic_shaping.htm index 22092ef11..4593e1f70 100644 --- a/Shorewall-docs/traffic_shaping.htm +++ b/Shorewall-docs/traffic_shaping.htm @@ -55,6 +55,9 @@ utilities.

    normally not required as Shorewall's method of clearing qdisc and filter definitions is pretty general. +

    Kernel Configuration

    +

    This screen shot show how I've configured QoS in my Kernel:

    +

    /etc/shorewall/tcrules

    The fwmark classifier provides a convenient way to classify packets for traffic shaping. The /etc/shorewall/tcrules file provides a means @@ -200,7 +203,7 @@ use to others.

    configuration to get an idea of why I want these particular rules.

    -

    Last Updated 6/18/2002 - Tom +

    Last Updated 8/24/2002 - Tom Eastep

    Copyright diff --git a/Shorewall-docs/troubleshoot.htm b/Shorewall-docs/troubleshoot.htm index 43ae1333e..964d3df21 100644 --- a/Shorewall-docs/troubleshoot.htm +++ b/Shorewall-docs/troubleshoot.htm @@ -126,6 +126,17 @@ policy

    Other Gotchas

      +
    • Seeing rejected/dropped packets logged out of the INPUT or FORWARD + chains? This means that:
        +
      1. your zone definitions are screwed up and the host that is sending the + packets or the destination host isn't in any zone (using an + /etc/shorewall/hosts file are you?); + or
        2. +
      2. the source and destination hosts are both connected to the same + interface and that interface doesn't have the 'multi' option specified in + /etc/shorewall/interfaces.
        3. +
      +
    • Remember that Shorewall doesn't automatically allow ICMP type 8 ("ping") requests to be sent between zones. If you want pings to be allowed between zones, you need a rule of the form:
      @@ -183,7 +194,7 @@ ADD_IP_ALIASES       -

      Last updated 7/27/2002 - +

      Last updated 9/13/2002 - Tom Eastep

      diff --git a/Shorewall-docs/two-interface.htm b/Shorewall-docs/two-interface.htm index b8867ba10..829a2f6cc 100644 --- a/Shorewall-docs/two-interface.htm +++ b/Shorewall-docs/two-interface.htm @@ -1,691 +1,898 @@ + - - - - - -Two-Interface Firewall - - - - - - - - - -
      -

      Basic Two-Interface Firewall

      -
      -

      Setting up a Linux system as a firewall for a small network is a -fairly straight-forward task if you understand the basics and follow the -documentation.

      -

      This guide doesn't attempt to acquaint you with all of the features of -Shorewall. It rather focuses on what is required to configure Shorewall in its -most common configuration:

      -
        -
      • Linux system used as a firewall/router for a small local network.
        • -
      • Single external IP address.
        • -
      • Internet connection through cable modem, DSL, ISDN, Frame Relay, dial-up - ...
        • -
      -

      Here is a schematic of a typical installation.

      -

      -

      -

      This guide assumes that you have the iproute/iproute2 package installed (on -RedHat, the package is called iproute). You can tell if this -package is installed by the presence of an ip program on your firewall -system. As root, you can use the 'which' command to check for this program:

      -
           [root@gateway root]# which ip
-     /sbin/ip
-     [root@gateway root]#

      I recommend that you first read through the -guide to familiarize yourself with what's involved then go back through it again -making your configuration changes. Points at which configuration changes are -recommended are flagged with .

      -

          -If you edit your configuration files on a Windows system, you must save them as -Unix files if your editor supports that option or you must run them through -dos2unix before trying to use them. Similarly, if you copy a configuration file -from your Windows hard drive to a floppy disk, you must run dos2unix against the -copy before using it with Shorewall.

      - -

      Shorewall Concepts

      -

      The configuration files for Shorewall are contained in the directory -/etc/shorewall -- for simple setups, you will only need to deal with a few of -these as described in this guide. After you have installed Shorewall, -download the two-interface sample, un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall -(these files will replace files with the same name).

      -

      As each file is introduced, I suggest that you -look through the actual file on your system -- each file contains detailed -configuration instructions and default entries.

      -

      Shorewall views the network where it is running as being composed of a set of -zones. In the two-interface sample configuration, the following zone names are used:

      - - - - - - - - - - - - - -
      NameDescription
      netThe Internet
      locYour Local Network
      -

      Zones are defined in the -/etc/shorewall/zones file.

      -

      Shorewall also recognizes the firewall system as its own zone - by default, -the firewall itself is known as fw.

      -

      Rules about what traffic to allow and what traffic to deny are expressed in -terms of zones.

      - -

      For each connection request entering the firewall, the request is first checked against the -/etc/shorewall/rules file. If no rule in that file matches the connection -request then the first policy in /etc/shorewall/policy that matches the -request is applied. If that policy is REJECT or DROP  the request is first -checked against the rules in /etc/shorewall/common (the samples provide that -file for you).

      -

      The /etc/shorewall/policy file included with the two-interface sample has the -following policies:

      -
      - + + + + + + + + Two-Interface Firewall + + + + + +
      + - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      locnetACCEPT  
      netallDROPinfo 
      allallREJECTinfo 
      -
      -
      -

      In the two-interface sample, the line below is included but commented out. If -you want your firewall system to have full access to servers on the internet, -uncomment that line.

      - - - - - - - - - - - - - - - -
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      fwnetACCEPT  
      -
      -

      The above policy will:

      -
        -
      1. allow all connection requests from your local network to the internet
        2. -
      2. drop (ignore) all connection requests from the internet to your firewall - or local network
        3. -
      3. optionally accept all connection requests from the firewall to the - internet (if you uncomment the additional policy)
        4. -
      4. reject all other connection requests.
        5. -
      -

          At this point, edit your /etc/shorewall/policy and make any changes that you -wish.

      -

      Network Interfaces

      -

      -

      -

      The firewall has two network interfaces. Where Internet -connectivity is through a cable or DSL "Modem", the External Interface -will be the ethernet adapter that is connected to that "Modem" (e.g., eth0)  -unless you connect via Point-to-Point Protocol -over Ethernet (PPPoE) or Point-to-Point Tunneling -Protocol (PPTP) in which case the External Interface will be a ppp -interface (e.g., ppp0). If you connect via a regular modem, your External -Interface will also be ppp0. If you connect via ISDN, your external -interface will be ippp0.

      -

          If your external interface is ppp0 -or ippp0  then you will want to -set CLAMPMSS=yes in -/etc/shorewall/shorewall.conf.

      -

      Your Internal Interface will be an ethernet adapter (eth1 -or eth0) and will be connected to a hub or switch. Your other computers will be -connected to the same hub/switch (note: If you have only a single internal system, -you can connect the firewall directly to the computer using a cross-over -cable).

      -

      -Do not connect the internal and external interface -to the same hub or switch (even for testing). It won't work the way that you think that it will and you will end up confused and -believing that Shorewall doesn't work at all.

      -

          The Shorewall two-interface sample configuration assumes that -the external interface is eth0 and the internal interface is eth1. -If your configuration is different, you will have to modify the sample -/etc/shorewall/interfaces file accordingly. While you are there, you may wish to -review the list of options that are specified for the interfaces. Some hints:

      + +

      Basic Two-Interface Firewall

      + + + + + + +

      Setting up a Linux system as a firewall for a small network +is a fairly straight-forward task if you understand the basics and follow +the documentation.

      + +

      This guide doesn't attempt to acquaint you with all of the features of + Shorewall. It rather focuses on what is required to configure Shorewall +in its most common configuration:

      +
        -
      • -

        If your external interface is ppp0 or ippp0, you can replace the - "detect" in the second column with "-".

        • -
      • -

        If your external interface is ppp0 or ippp0 or if you have a static IP - address, you can remove "dhcp" from the option list.

        • +
      • Linux system used as a firewall/router for a small local network.
        • +
      • Single public IP address.
        • +
      • Internet connection through cable modem, DSL, ISDN, Frame Relay, dial-up + ...
        • +
      -

      IP Addresses

      -

      Before going further, we should say a few words about Internet -Protocol (IP) addresses. Normally, your ISP will assign you a single -Public IP address. This address may be assigned via the Dynamic Host -Configuration Protocol (DHCP) or as part of establishing your connection -when you dial in (standard modem) or establish your PPP connection. In rare -cases, your ISP may assign you a static IP address; that means that you -configure your firewall's external interface to use that address permanently. -However your external address is assigned, it will be shared by all of your systems when you access the -Internet. You will have to assign your own addresses in your -internal network (the Internal Interface on your firewall plus your other -computers). RFC 1918 reserves several Private IP address ranges for this -purpose:

      -
      - 
           10.0.0.0    - 10.255.255.255
-     172.16.0.0  - 172.31.255.255
-     192.168.0.0 - 192.168.255.255
      -
      -
      -

          - Before starting Shorewall, you should look at the IP address of your external - interface and if it is one of the above ranges, you should remove the - 'norfc1918' option from the external interface's entry in - /etc/shorewall/interfaces.

      -
      -

      You will want to assign your addresses from the same - sub-network (subnet).  For our purposes, we can consider a subnet - to consists of a range of addresses x.y.z.0 - x.y.z.255. Such a subnet will - have a Subnet Mask of 255.255.255.0. The address x.y.z.0 is reserved as - the Subnet Address and x.y.z.255 is reserved as the Subnet Broadcast - Address. In Shorewall, a subnet is described using - Variable-Length - Subnet Mask (VLSM) notation with consists of the subnet address followed - by "/24". The "24" refers to the number of - consecutive leading "1" bits from the left of the subnet mask. -

      -
      -

      Example sub-network:

      -
      -
      - - - - - - - - - - - - - - - - - -
      Range:10.10.10.0 - 10.10.10.255
      Subnet Address:10.10.10.0
      Broadcast Address:10.10.10.255
      VLSM Notation:10.10.10.0/24
      -
      -
      -
      -

      It is conventional to assign the internal interface either the - first usable address in the subnet (10.10.10.1 in the above example) or the - last usable address (10.10.10.254).

      -
      -

      One of the purposes of subnetting is to allow all computers in the - subnet to understand which other computers can be communicated with directly. - To communicate with systems outside of the subnetwork, systems send packets - through a  gateway  (router).

      -
      -

          Your local computers (computer - 1 and computer 2 in the above diagram) should be configured with their - default gateway to be the IP address of the firewall's internal - interface.      -

      -

      The foregoing short discussion barely scratches the surface -regarding subnetting and routing. If you are interested in learning more about -IP addressing and routing, I highly recommend "IP Fundamentals: What Everyone -Needs to Know about Addressing & Routing", Thomas A. Maufer, Prentice-Hall, -1999, ISBN 0-13-975483-0.

      -

      The remainder of this quide will assume that you have configured -your network as shown here:

      -

      -

      -

      The default gateway for computer's 1 & 2 would be 10.10.10.254.

      -

      IP Masquerading (SNAT)

      -

      The addresses reserved by RFC 1918 are sometimes referred to as -non-routable because the Internet backbone routers don't forward packets -which have an RFC-1918 destination address. When one of your local systems -(let's assume computer 1) sends a connection request to an internet host, the -firewall must perform Network Address Translation (NAT). The firewall -rewrites the source address in the packet to be the address of the firewall's -external interface; in other words, the firewall makes it look as if the firewall -itself is initiating the connection.  This is necessary so that the -destination host will be able to route return packets back to the firewall -(remember that packets whose destination address is reserved by RFC 1918 can't -be routed across the internet so the remote host can't address its response to -computer 1). When the firewall receives a return packet, it -rewrites the destination address back to 10.10.10.1 and -forwards the packet on to computer 1.

      -

      On Linux systems, the above process is often referred to as -IP Masquerading but you will also see the term Source Network Address -Translation (SNAT) used. Shorewall follows the convention used with -Netfilter:

      + +

      Here is a schematic of a typical installation.

      + +

      +

      + +

      This guide assumes that you have the iproute/iproute2 package installed +(on RedHat, the package is called iproute). You can tell if +this package is installed by the presence of an ip program on your +firewall system. As root, you can use the 'which' command to check for this +program:

      + +
           [root@gateway root]# which ip
           /sbin/ip
           [root@gateway root]#
      +

      I recommend that you first read through the guide to familiarize yourself +with what's involved then go back through it again making your configuration +changes. Points at which configuration changes are recommended are flagged +with +.

      + +

      +    If you edit your configuration files on a Windows system, you must save +them as Unix files if your editor supports that option or you must run them +through dos2unix before trying to use them. Similarly, if you copy a configuration +file from your Windows hard drive to a floppy disk, you must run dos2unix +against the copy before using it with Shorewall.

      +
        -
      • -

        Masquerade describes the case where you let your - firewall system automatically detect the external interface address.

        • -
      • -

        SNAT refers to the case when you explicitly specify the - source address that you want outbound packets from your local network to use. +

      • Windows Version +of dos2unix
        • +
      • Linux Version +of dos2unix
        • + +
      + +

      Shorewall Concepts

      + +

      The configuration files for Shorewall are contained in the directory /etc/shorewall +-- for simple setups, you will only need to deal with a few of these as +described in this guide. After you have installed +Shorewall, download the two-interface sample, +un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall + (these files will replace files with the same name).

      + +

      As each file is introduced, I suggest that you look through the actual +file on your system -- each file contains detailed configuration instructions +and default entries.

      + +

      Shorewall views the network where it is running as being composed of a +set of zones. In the two-interface sample configuration, the following +zone names are used:

      + + + + + + + + + + + + + + + + + +
      NameDescription
      netThe Internet
      locYour Local Network
      + +

      Zones are defined in the /etc/shorewall/zones +file.

      + +

      Shorewall also recognizes the firewall system as its own zone - by default, + the firewall itself is known as fw.

      + +

      Rules about what traffic to allow and what traffic to deny are expressed +in terms of zones.

      + + + +

      For each connection request entering the firewall, the request is first +checked against the /etc/shorewall/rules file. If no rule in that file matches +the connection request then the first policy in /etc/shorewall/policy that +matches the request is applied. If that policy is REJECT or DROP  the +request is first checked against the rules in /etc/shorewall/common (the +samples provide that file for you).

      + +

      The /etc/shorewall/policy file included with the two-interface sample +has the following policies:

      + +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      locnetACCEPT  
      netallDROPinfo 
      allallREJECTinfo 
      +
      + +
      +

      In the two-interface sample, the line below is included but commented +out. If you want your firewall system to have full access to servers on +the internet, uncomment that line.

      + + + + + + + + + + + + + + + + + + + +
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      fwnetACCEPT  
      +
      + +

      The above policy will:

      + +
        +
      1. allow all connection requests from your local network to the internet
        2. +
      2. drop (ignore) all connection requests from the internet to your firewall + or local network
        3. +
      3. optionally accept all connection requests from the firewall to the + internet (if you uncomment the additional policy)
        4. +
      4. reject all other connection requests.
        5. + +
      + +

      +    At this point, edit your /etc/shorewall/policy and make any changes that +you wish.

      + +

      Network Interfaces

      + +

      +

      + +

      The firewall has two network interfaces. Where Internet connectivity +is through a cable or DSL "Modem", the External Interface will be +the ethernet adapter that is connected to that "Modem" (e.g., eth0)  +unless you connect via Point-to-Point Protocol + over Ethernet (PPPoE) or Point-to-Point Tunneling +Protocol (PPTP) in which case the External Interface will be a +ppp interface (e.g., ppp0). If you connect via a regular modem, your +External Interface will also be ppp0. If you connect via ISDN, your +external interface will be ippp0.

      + +

      +    If your external interface is ppp0 or ippp0  then you +will want to set CLAMPMSS=yes in /etc/shorewall/shorewall.conf.

      + +

      Your Internal Interface will be an ethernet adapter +(eth1 or eth0) and will be connected to a hub or switch. Your other computers +will be connected to the same hub/switch (note: If you have only a single +internal system, you can connect the firewall directly to the computer using +a cross-over cable).

      + +

      +Do not connect the internal and external interface to the same hub +or switch (even for testing). It won't work the way that you think that it +will and you will end up confused and believing that Shorewall doesn't work +at all.

      + +

      +    The Shorewall two-interface sample configuration assumes that the external +interface is eth0 and the internal interface is eth1. If your +configuration is different, you will have to modify the sample /etc/shorewall/interfaces file accordingly. +While you are there, you may wish to review the list of options that are +specified for the interfaces. Some hints:

      + +
        +
      • +

        If your external interface is ppp0 or ippp0, +you can replace the "detect" in the second column with "-".

        +
        • +
      • +

        If your external interface is ppp0 or ippp0 +or if you have a static IP address, you can remove "dhcp" from the option +list.

      -

      In Shorewall, both Masquerading and SNAT are configured with -entries in the /etc/shorewall/masq file. You will normally use Masquerading if -your external IP is dynamic and SNAT if the IP is static.

      -

          If your external firewall interface is eth0, you do not -need to modify the file provided with the sample. Otherwise, edit -/etc/shorewall/masq and change the first column to the name of your external -interface and the second column to the name of your internal interface.

      -

          If your external IP is -static, you can enter it in the third column in the /etc/shorewall/masq entry if -you like although your firewall will work fine if you leave that column empty. -Entering your static IP in column 3 makes processing outgoing packets a little -more efficient.

      + +

      IP Addresses

      + +

      Before going further, we should say a few words about Internet + Protocol (IP) addresses. Normally, your ISP will assign you a single + Public IP address. This address may be assigned via the Dynamic +Host Configuration Protocol (DHCP) or as part of establishing your connection + when you dial in (standard modem) or establish your PPP connection. In rare + cases, your ISP may assign you a static IP address; that means that +you configure your firewall's external interface to use that address permanently. +However your external address is assigned, it will be shared by all of +your systems when you access the Internet. You will have to assign your +own addresses in your internal network (the Internal Interface on your firewall +plus your other computers). RFC 1918 reserves several Private IP +address ranges for this purpose:

      + +
      +
           10.0.0.0    - 10.255.255.255
           172.16.0.0  - 172.31.255.255
           192.168.0.0 - 192.168.255.255
      +
      + +
      +

      +    Before starting Shorewall, you should look at the IP address of your +external interface and if it is one of the above ranges, you should remove +the 'norfc1918' option from the external interface's entry in /etc/shorewall/interfaces.

      +
      + +
      +

      You will want to assign your addresses from the same + sub-network (subnet).  For our purposes, we can consider a subnet + to consists of a range of addresses x.y.z.0 - x.y.z.255. Such a subnet +will have a Subnet Mask of 255.255.255.0. The address x.y.z.0 is +reserved as the Subnet Address and x.y.z.255 is reserved as the +Subnet Broadcast Address. In Shorewall, a subnet is described +using Variable-Length Subnet Mask (VLSM) +notation with consists of the subnet address followed by "/24". The +"24" refers to the number of consecutive leading "1" bits from the left +of the subnet mask.

      +
      + +
      +

      Example sub-network:

      +
      + +
      +
      + + + + + + + + + + + + + + + + + + + + +
      Range:10.10.10.0 - 10.10.10.255
      Subnet Address:10.10.10.0
      Broadcast Address:10.10.10.255
      VLSM Notation:10.10.10.0/24
      +
      +
      + +
      +

      It is conventional to assign the internal interface either +the first usable address in the subnet (10.10.10.1 in the above example) +or the last usable address (10.10.10.254).

      +
      + +
      +

      One of the purposes of subnetting is to allow all computers +in the subnet to understand which other computers can be communicated +with directly. To communicate with systems outside of the subnetwork, +systems send packets through a  gateway  (router).

      +
      + +
      +

      +    Your local computers (computer 1 and computer 2 in the above diagram) +should be configured with their default gateway to be the IP address +of the firewall's internal interface.     

      +
      + +

      The foregoing short discussion barely scratches the surface + regarding subnetting and routing. If you are interested in learning more +about IP addressing and routing, I highly recommend "IP Fundamentals: +What Everyone Needs to Know about Addressing & Routing", Thomas +A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.

      + +

      The remainder of this quide will assume that you have configured + your network as shown here:

      + +

      +

      + +

      The default gateway for computer's 1 & 2 would be 10.10.10.254.

      + +

      IP Masquerading (SNAT)

      + +

      The addresses reserved by RFC 1918 are sometimes referred +to as non-routable because the Internet backbone routers don't forward +packets which have an RFC-1918 destination address. When one of your local +systems (let's assume computer 1) sends a connection request to an internet +host, the firewall must perform Network Address Translation (NAT). +The firewall rewrites the source address in the packet to be the address +of the firewall's external interface; in other words, the firewall makes +it look as if the firewall itself is initiating the connection.  This is +necessary so that the destination host will be able to route return packets +back to the firewall (remember that packets whose destination address is +reserved by RFC 1918 can't be routed across the internet so the remote host +can't address its response to computer 1). When the firewall receives a +return packet, it rewrites the destination address back to 10.10.10.1 and + forwards the packet on to computer 1.

      + +

      On Linux systems, the above process is often referred to +as IP Masquerading but you will also see the term Source Network +Address Translation (SNAT) used. Shorewall follows the convention used +with Netfilter:

      + +
        +
      • +

        Masquerade describes the case where you let your + firewall system automatically detect the external interface address. +

        +
        • +
      • +

        SNAT refers to the case when you explicitly specify +the source address that you want outbound packets from your local network +to use.

        +
        • +
      + +

      In Shorewall, both Masquerading and SNAT are configured with + entries in the /etc/shorewall/masq file. You will normally use Masquerading +if your external IP is dynamic and SNAT if the IP is static.

      + +

      +    If your external firewall interface is eth0, you do not need +to modify the file provided with the sample. Otherwise, edit /etc/shorewall/masq +and change the first column to the name of your external interface and the +second column to the name of your internal interface.

      + +

      +    If your external IP is static, you can enter it in the third column +in the /etc/shorewall/masq entry if you like although your firewall will +work fine if you leave that column empty. Entering your static IP in column +3 makes processing outgoing packets a little more efficient.

      +

      Port Forwarding (DNAT)

      -

      One of your goals may be to run one or more servers on your -local computers. Because these computers have RFC-1918 addresses, it is not -possible for clients on the internet to connect directly to them. It is rather -necessary for those clients to address their connection requests to the firewall -who rewrites the destination address to the address of your server and forwards -the packet to that server. When your server responds, the firewall automatically -performs SNAT to rewrite the source address in the response.

      -

      The above process is called Port Forwarding or -Destination Network Address Translation (DNAT). You configure port -forwarding using DNAT rules in the /etc/shorewall/rules file.

      -

      The general form of a simple port forwarding rule in -/etc/shorewall/rules is:

      -
      - - - - - - - - - - - - - - - - - - - + +

      One of your goals may be to run one or more servers on your + local computers. Because these computers have RFC-1918 addresses, it is +not possible for clients on the internet to connect directly to them. It +is rather necessary for those clients to address their connection requests +to the firewall who rewrites the destination address to the address of your +server and forwards the packet to that server. When your server responds, +the firewall automatically performs SNAT to rewrite the source address in +the response.

      + +

      The above process is called Port Forwarding or +Destination Network Address Translation (DNAT). You configure port forwarding +using DNAT rules in the /etc/shorewall/rules file.

      + +

      The general form of a simple port forwarding rule in /etc/shorewall/rules +is:

      + +
      +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:<server local ip address> [:<server port>]<protocol><port>  
      + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:<server local ip address> [:<server port>]<protocol><port>  
      -
      -

      Example - you run a Web Server on computer 2 and you want to forward incoming -TCP port 80 to that system:

      -
      - - - - - - - - - - - - - - - - - - - + + +

      Example - you run a Web Server on computer 2 and you want to forward incoming + TCP port 80 to that system:

      + +
      +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2tcp80  
      + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2tcp80  
      -
      -

      A couple of important points -to keep in mind:

      + + +

      A couple of important points to keep in mind:

      +
        -
      • You must test the above rule from a client outside of your local network - (i.e., don't test from a browser running on computers 1 or 2 or on the - firewall). If you want to be able to access your web server using the IP - address of your external interface, see Shorewall FAQ - #2.
        • -
      • Many ISPs block incoming connection requests to port 80. If you have - problems connecting to your web server, try the following rule and try - connecting to port 5000.
        • +
      • You must test the above rule from a client outside of your local network + (i.e., don't test from a browser running on computers 1 or 2 or on the + firewall). If you want to be able to access your web server using the +IP address of your external interface, see Shorewall +FAQ #2.
        • +
      • Many ISPs block incoming connection requests to port 80. If you have + problems connecting to your web server, try the following rule and try + connecting to port 5000.
        • +
      -
      - - - - - - - - - - - - - - - - - - - + +
      +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2:80tcp5000  
      + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2:80tcp5000  
      -
      -

      -    At this point, modify -/etc/shorewall/rules to add any DNAT rules that you require.

      + + +

      +    At this point, modify /etc/shorewall/rules to add any DNAT rules that +you require.

      +

      Domain Name Server (DNS)

      -

      Normally, when you connect to your ISP, as part of getting an IP -address your firewall's Domain Name Service (DNS) resolver will be -automatically configured (e.g., the /etc/resolv.conf file will be written). -Alternatively, your ISP may have given you the IP address of a pair of DNS -name servers for you to manually configure as your primary and secondary -name servers. Regardless of how DNS gets configured on your firewall, it is your responsibility to configure the resolver in your -internal systems. You can take one of two approaches:

      + +

      Normally, when you connect to your ISP, as part of getting +an IP address your firewall's Domain Name Service (DNS) resolver +will be automatically configured (e.g., the /etc/resolv.conf file will be +written). Alternatively, your ISP may have given you the IP address of a +pair of DNS name servers for you to manually configure as your primary +and secondary name servers. Regardless of how DNS gets configured on your +firewall, it is your responsibility to configure the resolver in your + internal systems. You can take one of two approaches:

      +
        -
      • -

        You can configure your internal systems to use your ISP's name - servers. If you ISP gave you the addresses of their servers or if those - addresses are available on their web site, you can configure your internal - systems to use those addresses. If that information isn't available, look in - /etc/resolv.conf on your firewall system -- the name servers are given in - "nameserver" records in that file.

        • -
      • -

            You can configure a Caching Name Server on your - firewall. Red Hat has an RPM for a caching name server (the RPM also - requires the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you - take this approach, you configure your internal systems to use the firewall - itself as their primary (and only) name server. You use the internal IP - address of the firewall (10.10.10.254 in the example above) for the name - server address. To allow your local systems to talk to your caching name - server, you must open port 53 (both UDP and TCP) from the local network to the - firewall; you do that by adding the following rules in /etc/shorewall/rules.

        • +
      • +

        You can configure your internal systems to use your ISP's +name servers. If you ISP gave you the addresses of their servers or if +those addresses are available on their web site, you can configure your +internal systems to use those addresses. If that information isn't available, +look in /etc/resolv.conf on your firewall system -- the name servers are +given in "nameserver" records in that file.

        +
        • +
      • +

        +    You can configure a Caching Name Server on your firewall. + Red Hat has an RPM for a caching name server (the RPM also requires +the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you take +this approach, you configure your internal systems to use the firewall + itself as their primary (and only) name server. You use the internal IP + address of the firewall (10.10.10.254 in the example above) for the name + server address. To allow your local systems to talk to your caching name + server, you must open port 53 (both UDP and TCP) from the local network +to the firewall; you do that by adding the following rules in /etc/shorewall/rules. +

        +
      -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +
      +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp53  
      ACCEPTlocfwudp53  
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp53  
      ACCEPTlocfwudp53  
      -
      -
      -

      Other Connections

      + + +
      +

      Other Connections

      +
      + +
      +

      The two-interface sample includes the following rules:

      -
      -

      The two-interface sample includes the following rules:

      -
      -
      - + +
      +
      +
      + - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTfwnettcp53  
      ACCEPTfwnetudp53  
      -
      + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + fw + net + tcp + 53 +   +   + + + ACCEPT + fw + net + udp + 53 +   +   + + + + + +
      + +
      +

      Those rules allow DNS access from your firewall and may be + removed if you commented out the line in /etc/shorewall/policy allowing +all connections from the firewall to the internet.

      -
      -

      Those rules allow DNS access from your firewall and may be - removed if you commented out the line in /etc/shorewall/policy allowing all - connections from the firewall to the internet.

      -
      -

      The sample also includes:

      -
      -
      - - - - - - - - - - - - - - - - - - - -
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp22  
      -
      + +
      +

      The sample also includes:

      -
      -

      That rule allows you to run an SSH server on your firewall and - connect to that server from your local systems.

      -
      -

      If you wish to enable other connections between your firewall - and other systems, the general format is:

      -
      -
      - + +
      +
      +
      + - - - - - - - - - - - - - - - - - -
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPT<source zone><destination zone><protocol><port>  
      -
      + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + loc + fw + tcp + 22 +   +   + + + + + +
      + +
      +

      That rule allows you to run an SSH server on your firewall +and connect to that server from your local systems.

      -
      -

      Example - You want to run a Web Server on your firewall - system:

      -
      -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp80#Allow web accessfrom the internet
      ACCEPTlocfwtcp80#Allow web accessfrom the local network
      -
      + +
      +

      If you wish to enable other connections between your firewall + and other systems, the general format is:

      -
      -

      Those two rules would of course be in addition to the rules - listed above under "You can configure a Caching Name Server on your firewall"

      -
      -

      If you don't know what port and protocol a particular - application uses, look here.

      -
      -

      Important: I don't recommend enabling telnet to/from - the internet because it uses clear text (even for login!). If you want shell - access to your firewall from the internet, use SSH:

      -
      -
      - + +
      +
      +
      + - - - - - - - - + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPT<source zone><destination zone><protocol><port>  
      +
      +
      + +
      +

      Example - You want to run a Web Server on your firewall + system:

      +
      + +
      +
      + + - - - - - - - - -
      ACCEPTnetfwtcp22  
      -
      + ACTION + SOURCE + DESTINATION + PROTOCOL + PORT + SOURCE PORT + ORIGINAL ADDRESS + + + ACCEPT + net + fw + tcp + 80 + #Allow web access + from the internet + + + ACCEPT + loc + fw + tcp + 80 + #Allow web access + from the local network + + + + + +
      + +
      +

      Those two rules would of course be in addition to the rules + listed above under "You can configure a Caching Name Server on your firewall"

      -
      -

          Now edit your - /etc/shorewall/rules file to add or delete other connections as required.

      -
      -

      Starting and Stopping Your Firewall

      + +
      +

      If you don't know what port and protocol a particular +application uses, look here.

      -
      -

      The installation procedure - configures your system to start Shorewall at system boot.

      -
      -

      The firewall is started using the "shorewall start" command - and stopped using "shorewall stop". When the firewall is stopped, routing is - enabled on those hosts that have an entry in - /etc/shorewall/routestopped. A - running firewall may be restarted using the "shorewall restart" command. If - you want to totally remove any trace of Shorewall from your Netfilter - configuration, use "shorewall clear".

      -
      -

          The two-interface sample assumes that you want to enable - routing to/from eth1 (the local network) when Shorewall is stopped. If - your local network isn't connected to eth1 or if you wish to enable - access to/from other hosts, change /etc/shorewall/routestopped accordingly.

      -
      -

      WARNING: If you are connected to your firewall from the - internet, do not issue a "shorewall stop" command unless you have added an - entry for the IP address that you are connected from to - /etc/shorewall/routestopped. - Also, I don't recommend using "shorewall restart"; it is better to create an - alternate configuration and - test it using the "shorewall try" command.

      -

      Last updated -7/26/2002 - Tom -Eastep

      - -

      Copyright 2002 Thomas M. Eastep

      - + +
      +

      Important: I don't recommend enabling telnet to/from + the internet because it uses clear text (even for login!). If you want +shell access to your firewall from the internet, use SSH:

      +
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp22  
      +
      +
      + +
      +

      +    Now edit your /etc/shorewall/rules file to add or delete other connections +as required.

      +
      + +
      +

      Starting and Stopping Your Firewall

      +
      + +
      +

      The installation procedure configures +your system to start Shorewall at system boot.

      +
      + +
      +

      The firewall is started using the "shorewall start" command + and stopped using "shorewall stop". When the firewall is stopped, routing +is enabled on those hosts that have an entry in /etc/shorewall/routestopped. A + running firewall may be restarted using the "shorewall restart" command. +If you want to totally remove any trace of Shorewall from your Netfilter + configuration, use "shorewall clear".

      +
      + +
      +

      +    The two-interface sample assumes that you want to enable routing to/from +eth1 (the local network) when Shorewall is stopped. If your local +network isn't connected to eth1 or if you wish to enable access +to/from other hosts, change /etc/shorewall/routestopped accordingly.

      +
      + +
      +

      WARNING: If you are connected to your firewall from +the internet, do not issue a "shorewall stop" command unless you have +added an entry for the IP address that you are connected from to /etc/shorewall/routestopped. + Also, I don't recommend using "shorewall restart"; it is better to create +an alternate configuration +and test it using the "shorewall +try" command.

      +
      + +

      Last updated 9/16/2002 - Tom Eastep

      + +

      Copyright 2002 Thomas +M. Eastep

      +
      - - \ No newline at end of file +