diff --git a/STABLE/documentation/FAQ.htm b/STABLE/documentation/FAQ.htm index 3003c5a68..030efb9d2 100644 --- a/STABLE/documentation/FAQ.htm +++ b/STABLE/documentation/FAQ.htm @@ -1,693 +1,734 @@ - + - + - + - + Shorewall FAQ - + - + - - - + + - - - + + + +
+

Shorewall FAQs

-
- -

1.  I want to forward UDP - port 7777 to my my personal PC with IP address 192.168.1.5. I've looked - everywhere and can't find how to do it.

- + +

1. I want to forward UDP + port 7777 to my my personal PC with IP address 192.168.1.5. I've looked + everywhere and can't find how to do it.

+

1a. Ok -- I followed those instructions - but it doesn't work.

- + but it doesn't work.

+

2. I port forward www requests -to www.mydomain.com (IP 130.151.100.69) to system 192.168.1.5 in my local -network. External clients can browse http://www.mydomain.com but internal -clients can't.

- + to www.mydomain.com (IP 130.151.100.69) to system 192.168.1.5 in my local + network. External clients can browse http://www.mydomain.com but internal + clients can't.

+

2a. I have a zone "Z" with an RFC1918 - subnet and I use static NAT to assign non-RFC1918 addresses to hosts -in Z. Hosts in Z cannot communicate with each other using their external - (non-RFC1918 addresses) so they can't access each other using their DNS - names.

- + subnet and I use static NAT to assign non-RFC1918 addresses to hosts + in Z. Hosts in Z cannot communicate with each other using their external + (non-RFC1918 addresses) so they can't access each other using their DNS + names.

+

3. I want to use Netmeeting/MSN -Messenger with Shorewall. What do I do?

- + Messenger with Shorewall. What do I do?

+

4. I just used an online port scanner -to check my firewall and it shows some ports as 'closed' rather than 'blocked'. - Why?

- + to check my firewall and it shows some ports as 'closed' rather than +'blocked'. Why?

+

4a. I just ran an nmap UDP scan - of my firewall and it showed 100s of ports as open!!!!

- + of my firewall and it showed 100s of ports as open!!!!

+

5. I've installed Shorewall and now -I can't ping through the firewall

- + I can't ping through the firewall

+

6. Where are the log messages - written and  how do I change the destination?

- + written and how do I change the destination?

+

6a. Are there any log parsers - that work with Shorewall?

- + that work with Shorewall?

+

7. When I stop Shorewall using 'shorewall stop', I can't connect to anything. Why doesn't that command - work?

- + work?

+

8. When I try to start Shorewall -on RedHat 7.x, I get messages about insmod failing -- what's wrong?

- + on RedHat 7.x, I get messages about insmod failing -- what's wrong?

+

9. Why can't Shorewall detect -my interfaces properly?

- + my interfaces properly?

+

10. What distributions does -it work with?

- + it work with?

+

11. What features does it support?

- +

12. Why isn't there a GUI

- +

13. Why do you call it "Shorewall"?

- -

14. I'm connected via a cable modem -and it has an internel web server that allows me to configure/monitor it -but as expected if I enable rfc1918 blocking for my eth0 interface, -it also blocks the cable modems web server.

- -

14a. Even though it assigns public -IP addresses, my ISP's DHCP server has an RFC 1918 address. If I enable RFC -1918 filtering on my external interface, my DHCP client cannot renew its -lease.

- -

15. My local systems can't see -out to the net

- -

16. Shorewall is writing log messages - all over my console making it unusable!

-
+

14. I'm connected via a cable modem + and it has an internel web server that allows me to configure/monitor it + but as expected if I enable rfc1918 blocking for my eth0 interface, + it also blocks the cable modems web server.

+ +

14a. Even though it assigns public + IP addresses, my ISP's DHCP server has an RFC 1918 address. If I enable +RFC 1918 filtering on my external interface, my DHCP client cannot renew +its lease.

+ +

15. My local systems can't see + out to the net

+ +

16. Shorewall is writing log messages + all over my console making it unusable!

+ +

1. I want to forward UDP port 7777 to -my my personal PC with IP address 192.168.1.5. I've looked everywhere and -can't find how to do it.

- + my my personal PC with IP address 192.168.1.5. I've looked everywhere and + can't find how to do it. +

Answer: The first example in the rules file documentation shows how to -do port forwarding under Shorewall. Assuming that you have a dynamic external -IP address, the format of a port-forwarding rule to a local system is as follows:

- -
+ do port forwarding under Shorewall. Assuming that you have a dynamic external + IP address, the format of a port-forwarding rule to a local system is as +follows:

+ +
- - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:<local IP address>[:<local port>]<protocol><port #>  
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:<local IP address>[:<local port>]<protocol><port #>
+
+
-
- +
+

So to forward UDP port 7777 to internal system 192.168.1.5, -the rule is:

- -
+ the rule is:

+ +
- - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:192.168.1.5udp7777  
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:192.168.1.5udp7777
+
+
-
- -
+
+ +
     DNAT net loc:192.168.1.5 udp 7777
-
- + +

If you want to forward requests directed to a particular address ( <external IP> ) on your firewall to an internal system:

- -
+ +
- - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:<local IP address>[:<local port>]<protocol><port #>-<external IP>
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATnetloc:<local IP address>[:<local port>]<protocol><port #>-<external IP>
-
- +
+

1a. Ok -- I followed those instructions -but it doesn't work

- + but it doesn't work +

Answer: That is usually the result of one of two things:

- + - +

2. I port forward www requests to www.mydomain.com -(IP 130.151.100.69) to system 192.168.1.5 in my local network. External clients -can browse http://www.mydomain.com but internal clients can't.

- + (IP 130.151.100.69) to system 192.168.1.5 in my local network. External clients + can browse http://www.mydomain.com but internal clients can't. +

Answer: I have two objections to this setup.

- + - +

If you insist on an IP solution to the accessibility problem - rather than a DNS solution, then assuming that your external interface is -eth0 and your internal interface is eth1 and that eth1 has IP address 192.168.1.254 -with subnet 192.168.1.0/24, do the following:

- + rather than a DNS solution, then assuming that your external interface is + eth0 and your internal interface is eth1 and that eth1 has IP address 192.168.1.254 + with subnet 192.168.1.0/24, do the following:

+

a) In /etc/shorewall/interfaces, specify "multi" as an option - for eth1.

- -
+ for eth1.

+ +

b) In /etc/shorewall/rules, add:

-
- -
-
+
+ +
+
- - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATloc:192.168.1.0/24loc:192.168.1.5tcpwww-130.151.100.69:192.168.1.254
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATloc:192.168.1.0/24loc:192.168.1.5tcpwww-130.151.100.69:192.168.1.254
-
-
- -
-
     DNAT    loc:192.168.1.0/24    loc:192.168.1.5    tcp    www    -    130.151.100.69:192.168.1.254
-
- -
+ +
+ +
+
     DNAT    loc:192.168.1.0/24    loc:192.168.1.5    tcp    www    -    130.151.100.69:192.168.1.254
+
+ +

That rule only works of course if you have a static external -IP address. If you have a dynamic IP address and are running Shorewall 1.3.4 -or later then include this in /etc/shorewall/params:

-
- -
+ IP address. If you have a dynamic IP address and are running Shorewall +1.3.4 or later then include this in /etc/shorewall/params:

+
+ +
     ETH0_IP=`find_interface_address eth0`
-
- -
+
+ +

and make your DNAT rule:

-
- -
-
+
+ +
+
- - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATloc:192.168.1.0/24loc:192.168.1.5tcpwww-$ETH0_IP:192.168.1.254
ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIG. DEST.
DNATloc:192.168.1.0/24loc:192.168.1.5tcpwww-$ETH0_IP:192.168.1.254
-
-
- -
+ +
+ +

Using this technique, you will want to configure your DHCP/PPPoE - client to automatically restart Shorewall each time that you get a new IP - address.

-
- + client to automatically restart Shorewall each time that you get a new IP + address.

+
+

2a. I have a zone "Z" with an RFC1918 -subnet and I use static NAT to assign non-RFC1918 addresses to hosts in Z. -Hosts in Z cannot communicate with each other using their external (non-RFC1918 -addresses) so they can't access each other using their DNS names.

- + subnet and I use static NAT to assign non-RFC1918 addresses to hosts in Z. + Hosts in Z cannot communicate with each other using their external (non-RFC1918 + addresses) so they can't access each other using their DNS names. +

Answer: This is another problem that is best solved -using Bind Version 9 "views". It allows both external and internal clients -to access a NATed host using the host's DNS name.

- + using Bind Version 9 "views". It allows both external and internal clients + to access a NATed host using the host's DNS name.

+

Another good way to approach this problem is to switch from - static NAT to Proxy ARP. That way, the hosts in Z have non-RFC1918 addresses -and can be accessed externally and internally using the same address. 

- + static NAT to Proxy ARP. That way, the hosts in Z have non-RFC1918 addresses + and can be accessed externally and internally using the same address.

+

If you don't like those solutions and prefer routing all Z->Z traffic through your firewall then:

- +

a) Specify "multi" on the entry for Z's interface in /etc/shorewall/interfaces.
- b) Set the Z->Z policy to ACCEPT.
- c) Masquerade Z to itself.
-
- Example:

- + b) Set the Z->Z policy to ACCEPT.
+ c) Masquerade Z to itself.
+
+ Example:

+

Zone: dmz
- Interface: eth2
- Subnet: 192.168.2.0/24

- + Interface: eth2
+ Subnet: 192.168.2.0/24

+

In /etc/shorewall/interfaces:

- -
+ +
- - - - - - - - - - - - - - - + + + + + + + + + + + + + + +
ZONEINTERFACEBROADCASTOPTIONS
dmzeth2192.168.2.255multi
ZONEINTERFACEBROADCASTOPTIONS
dmzeth2192.168.2.255multi
-
- +
+

In /etc/shorewall/policy:

- -
+ +
- - - - - - - - - - - - - - - + + + + + + + + + + + + + + +
SOURCE DESTINATIONPOLICYLIMIT:BURST
dmzdmzACCEPT 
SOURCE DESTINATIONPOLICYLIMIT:BURST
dmzdmzACCEPT
+
-
- -
-
     dmz    dmz    ACCEPT
-
- +
+ +
+
     dmz    dmz    ACCEPT
+
+

In /etc/shorewall/masq:

- -
+ +
- - - - - - - - - - - - - + + + + + + + + + + + + +
INTERFACE SUBNETADDRESS
eth2192.168.2.0/24 
INTERFACE SUBNETADDRESS
eth2192.168.2.0/24
+
-
- +
+

3. I want to use Netmeeting/MSN Messenger -with Shorewall. What do I do?

- + with Shorewall. What do I do? +

Answer: There is an H.323 connection -tracking/NAT module that may help. Also check the Netfilter mailing list -archives at http://netfilter.samba.org. -

- + tracking/NAT module that may help. Also check the Netfilter mailing list + archives at http://netfilter.samba.org. +

+

4. I just used an online port scanner -to check my firewall and it shows some ports as 'closed' rather than 'blocked'. - Why?

- + to check my firewall and it shows some ports as 'closed' rather than 'blocked'. + Why? +

Answer: The common.def included with version 1.3.x -always rejects connection requests on TCP port 113 rather than dropping -them. This is necessary to prevent outgoing connection problems to services -that use the 'Auth' mechanism for identifying requesting users. Shorewall -also rejects TCP ports 135, 137 and 139 as well as UDP ports 137-139. These -are ports that are used by Windows (Windows can be configured to -use the DCE cell locator on port 135). Rejecting these connection requests -rather than dropping them cuts down slightly on the amount of Windows chatter -on LAN segments connected to the Firewall.

- + always rejects connection requests on TCP port 113 rather than dropping + them. This is necessary to prevent outgoing connection problems to services + that use the 'Auth' mechanism for identifying requesting users. Shorewall + also rejects TCP ports 135, 137 and 139 as well as UDP ports 137-139. +These are ports that are used by Windows (Windows can be configured +to use the DCE cell locator on port 135). Rejecting these connection requests + rather than dropping them cuts down slightly on the amount of Windows +chatter on LAN segments connected to the Firewall.

+

If you are seeing port 80 being 'closed', that's probably -your ISP preventing you from running a web server in violation of your -Service Agreement.

- + your ISP preventing you from running a web server in violation of your + Service Agreement.

+

4a. I just ran an nmap UDP scan of my - firewall and it showed 100s of ports as open!!!!

- + firewall and it showed 100s of ports as open!!!! +

Answer: Take a deep breath and read the nmap man page -section about UDP scans. If nmap gets nothing back from your firewall -then it reports the port as open. If you want to see which UDP ports are -really open, temporarily change your net->all policy to REJECT, restart -Shorewall and do the nmap UDP scan again.

- + section about UDP scans. If nmap gets nothing back from your firewall + then it reports the port as open. If you want to see which UDP ports are + really open, temporarily change your net->all policy to REJECT, restart + Shorewall and do the nmap UDP scan again.

+

5. I've installed Shorewall and now I -can't ping through the firewall

- + can't ping through the firewall +

Answer: If you want your firewall to be totally open -for "ping":

- + for "ping":

+

a) Do NOT specify 'noping' on any interface in /etc/shorewall/interfaces.
- b) Copy /etc/shorewall/icmp.def to /etc/shorewall/icmpdef
- c) Add the following to /etc/shorewall/icmpdef:

- -
+ b) Copy /etc/shorewall/icmp.def to /etc/shorewall/icmpdef
+ c) Add the following to /etc/shorewall/icmpdef:

+ +

run_iptables -A icmpdef -p ICMP --icmp-type echo-request --j ACCEPT

-
- + -j ACCEPT

+
+

6. Where are the log messages written - and  how do I change the destination?

- + and how do I change the destination? +

Answer: NetFilter uses the kernel's equivalent of syslog (see "man syslog") to log messages. It always uses the LOG_KERN (kern) facility (see "man openlog") and you get to choose the log level (again, see "man syslog") in your policies and rules. The destination for messaged logged -by syslog is controlled by /etc/syslog.conf (see "man syslog.conf"). When -you have changed /etc/syslog.conf, be sure to restart syslogd (on a RedHat + href="Documentation.htm#Rules">rules. The destination for messaged +logged by syslog is controlled by /etc/syslog.conf (see "man syslog.conf"). +When you have changed /etc/syslog.conf, be sure to restart syslogd (on a RedHat system, "service syslog restart").

- +

By default, older versions of Shorewall ratelimited log messages -through settings in /etc/shorewall/shorewall.conf --- If you want to log all messages, set:

- -
+ through settings in /etc/shorewall/shorewall.conf + -- If you want to log all messages, set:

+ +
     LOGLIMIT=""
     LOGBURST=""
-
- +
+

6a. Are there any log parsers that work - with Shorewall?

- + with Shorewall? +

Answer: Here are several links that may be helpful: -

- -
+

+ +

http://www.shorewall.net/pub/shorewall/parsefw/
- http://www.fireparse.com
- http://cert.uni-stuttgart.de/projects/fwlogwatch

-
- + http://www.fireparse.com
+ http://cert.uni-stuttgart.de/projects/fwlogwatch

+
+

7. When I stop Shorewall using 'shorewall - stop', I can't connect to anything. Why doesn't that command work?

- + stop', I can't connect to anything. Why doesn't that command work? +

The 'stop' command is intended to place your firewall into -a safe state whereby only those interfaces/hosts having the 'routestopped' -option in /etc/shorewall/interfaces and /etc/shorewall/hosts are activated. -If you want to totally open up your firewall, you must use the 'shorewall -clear' command.

- + a safe state whereby only those interfaces/hosts having the 'routestopped' + option in /etc/shorewall/interfaces and /etc/shorewall/hosts are activated. + If you want to totally open up your firewall, you must use the 'shorewall + clear' command.

+

8. When I try to start Shorewall on RedHat - 7.x, I get messages about insmod failing -- what's wrong?

- + 7.x, I get messages about insmod failing -- what's wrong? +

Answer: The output you will see looks something like -this:

- + this:

+ 
     /lib/modules/2.4.17/kernel/net/ipv4/netfilter/ip_tables.o: init_module: Device or resource busy
     Hint: insmod errors can be caused by incorrect module parameters, including invalid IO or IRQ parameters
     /lib/modules/2.4.17/kernel/net/ipv4/netfilter/ip_tables.o: insmod
     /lib/modules/2.4.17/kernel/net/ipv4/netfilter/ip_tables.o failed
     /lib/modules/2.4.17/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed
     iptables v1.2.3: can't initialize iptables table `nat': iptables who? (do you need to insmod?)
     Perhaps iptables or your kernel needs to be upgraded.
- +

This is usually cured by the following sequence of commands: -

- -
+

+ +
     service ipchains stop
     chkconfig --delete ipchains
     rmmod ipchains
-
- -
+
+ +

Also, be sure to check the errata -for problems concerning the version of iptables (v1.2.3) shipped with RH7.2.

-
- -

+ for problems concerning the version of iptables (v1.2.3) shipped with RH7.2.

+

+ +

+

9. Why can't Shorewall detect my interfaces -properly?

- + properly? +

I just installed Shorewall and when I issue the start command, - I see the following:

- -
+ I see the following:

+ +
     Processing /etc/shorewall/shorewall.conf ...
     Processing /etc/shorewall/params ...
     Starting Shorewall...
     Loading Modules...
     Initializing...
     Determining Zones...
     Zones: net loc
     Validating interfaces file...
     Validating hosts file...
     Determining Hosts in Zones...
     Net Zone: eth0:0.0.0.0/0
     Local Zone: eth1:0.0.0.0/0
     Deleting user chains...
     Creating input Chains...
     ...
-
- -
+
+ +

Why can't Shorewall detect my interfaces properly?

-
- -
+
+ +

Answer: The above output is perfectly normal. The Net zone is defined as all hosts that are connected through eth0 and the local zone is defined as all hosts connected through eth1

-
- +
+

10. What Distributions does it work with?

- +

Shorewall works with any GNU/Linux distribution that includes - the proper prerequisites.

- + the proper prerequisites.

+

11. What Features does it have?

- +

Answer: See the Shorewall -Feature List.

- + Feature List.

+

12. Why isn't there a GUI?

- +

Answer: Every time I've started to work on one, I find myself doing other things. I guess I just don't care enough if Shorewall has a GUI to invest the effort to create one myself. There are several Shorewall GUI projects underway however and I will publish links to them when the authors feel that they are ready.

- +

13. Why do you call it "Shorewall"?

- +

Answer: Shorewall is a concatenation of "Shoreline" -(the city where I live) -and "Firewall".

- -

14.  I'm connected via a cable modem -and it has an internal web server that allows me to configure/monitor it -but as expected if I enable rfc1918 blocking for my eth0 interface (the internet -one), it also blocks the cable modems web server.

- + (the city where I live) + and "Firewall".

+ +

14. I'm connected via a cable modem + and it has an internal web server that allows me to configure/monitor it + but as expected if I enable rfc1918 blocking for my eth0 interface (the +internet one), it also blocks the cable modems web server.

+

Is there any way it can add a rule before the rfc1918 blocking -that will let all traffic to and from the 192.168.100.1 address of the modem -in/out but still block all other rfc1918 addresses.

- + that will let all traffic to and from the 192.168.100.1 address of the modem + in/out but still block all other rfc1918 addresses.

+

Answer: If you are running a version of Shorewall earlier than 1.3.1, create /etc/shorewall/start and in it, place the following:

- -
+ +
     run_iptables -I rfc1918 -s 192.168.100.1 -j ACCEPT
-
- -
+
+ +

If you are running version 1.3.1 or later, simply add the - following to /etc/shorewall/rfc1918:

-
- -
-
+ following to /etc/shorewall/rfc1918:

+
+ +
+
- + + + + + + + + + + + +
SUBNET TARGET
192.168.100.1RETURN
+
+
+ +
+

Be sure that you add the entry ABOVE the entry for 192.168.0.0/16.
+

+ +

Note: If you add a second IP address to your external firewall +interface to correspond to the modem address, you must also make an entry +in /etc/shorewall/rfc1918 for that address. For example, if you configure +the address 192.168.100.2 on your firewall, then you would add two entries +to /etc/shorewall/rfc1918:
+

+ +
+ + - - - - - - - - + + + + + + + + + + + +
SUBNET TARGET
192.168.100.1RETURN
SUBNET
+ 		TARGET
+
192.168.100.1
+ 		RETURN
+
192.168.100.2
+ 		RETURN
+
-
-
- -
-

Be sure that you add the entry ABOVE the entry for 192.168.0.0/16.

-
- -
+ +
+ +

14a. Even though it assigns public IP addresses, my ISP's DHCP server has an RFC 1918 address. If I enable RFC 1918 filtering on my external interface, my DHCP client cannot renew its lease.

-
- -
+
+ +

The solution is the same as FAQ 14 above. Simply substitute - the IP address of your ISPs DHCP server.

-
- + the IP address of your ISPs DHCP server.

+
+

15. My local systems can't see out to -the net

- + the net +

Answer: Every time I read "systems can't see out to -the net", I wonder where the poster bought computers with eyes and what those -computers will "see" when things are working properly. That aside, the most -common causes of this problem are:

- + the net", I wonder where the poster bought computers with eyes and what +those computers will "see" when things are working properly. That aside, +the most common causes of this problem are:

+
    -
  1. +

  2. The default gateway on each local system isn't set to -the IP address of the local firewall interface.

    -
    3. -
  3. + the IP address of the local firewall interface.

    +
    4. +

  4. The entry for the local network in the /etc/shorewall/masq - file is wrong or missing.

    -
    5. -
  5. + file is wrong or missing.

    +
    6. +

  6. The DNS settings on the local systems are wrong or the - user is running a DNS server on the firewall and hasn't enabled UDP and -TCP port 53 from the firewall to the internet.

    -
    7. - + user is running a DNS server on the firewall and hasn't enabled UDP and + TCP port 53 from the firewall to the internet.

    + +
- +

16. Shorewall is writing log messages -all over my console making it unusable!

- + all over my console making it unusable! +

Answer: "man dmesg" -- add a suitable 'dmesg' command -to your startup scripts or place it in /etc/shorewall/start. Under RedHat, -the max log level that is sent to the console is specified in /etc/sysconfig/init -in the LOGLEVEL variable.

- -
-

-
- -

Last updated 9/23/2002 - + +

+ +

Last updated 10/8/2002 - Tom Eastep

- +

Copyright - © 2001, 2002 Thomas M. Eastep.

-
-
+ © 2001, 2002 Thomas M. Eastep.
+

+ diff --git a/STABLE/documentation/Install.htm b/STABLE/documentation/Install.htm index 4e68cef62..9b5b55523 100644 --- a/STABLE/documentation/Install.htm +++ b/STABLE/documentation/Install.htm @@ -1,174 +1,207 @@ + - - -Shorewall Installation - - + + + Shorewall Installation + + + + - - - - - - + + +
-

Shorewall Installation and Upgrade

-
+ + + + + +
+

Shorewall Installation and +Upgrade

+
- -

Before upgrading, be sure to review the -Upgrade Issues

- + +

Before upgrading, be sure to review the Upgrade Issues

+

Install using RPM
-Install -using tarball
-Upgrade using RPM
-Upgrade -using tarball
-Configuring Shorewall
-Uninstall/Fallback

+ Install using tarball
+ Upgrade using RPM
+ Upgrade using tarball
+ Configuring Shorewall
+ Uninstall/Fallback

+

To install Shorewall using the RPM:

-

If you have RedHat 7.2 and are running iptables version 1.2.3 (at a shell -prompt, type "/sbin/iptables --version"), you must upgrade to version 1.2.4 -either from the -RedHat update -site or from the Shorewall Errata page before -attempting to start Shorewall.

+ +

If you have RedHat 7.2 and are running iptables version 1.2.3 (at a +shell prompt, type "/sbin/iptables --version"), you must upgrade to version +1.2.4 either from the RedHat update + site or from the Shorewall Errata page before + attempting to start Shorewall.

+ -

To - install Shorewall using the tarball and install - script:

+ +

To install Shorewall using the tarball +and install script:

+ -

If you already have the Shorewall RPM installed and are upgrading to a new -version:

-

If you are upgrading from a 1.2 version of Shorewall to a 1.3 version and you -have entries in the /etc/shorewall/hosts file then please check your -/etc/shorewall/interfaces file to be sure that it contains an entry for each -interface mentioned in the hosts file. Also, there are certain 1.2 rule forms -that are no longer supported under 1.3 (you must use the new 1.3 syntax). See -the upgrade issues for details. You can check your rules and -host file for 1.3 compatibility using the "shorewall check" command after -installing the latest version of 1.3.

+ +

If you already have the Shorewall RPM installed +and are upgrading to a new version:

+ +

If you are upgrading from a 1.2 version of Shorewall to a 1.3 version +and you have entries in the /etc/shorewall/hosts file then please check +your /etc/shorewall/interfaces file to be sure that it contains an entry +for each interface mentioned in the hosts file. Also, there are certain +1.2 rule forms that are no longer supported under 1.3 (you must use the +new 1.3 syntax). See the upgrade issues for +details. You can check your rules and host file for 1.3 compatibility using +the "shorewall check" command after installing the latest version of 1.3.

+ -

If you already have Shorewall installed and are upgrading to a new version -using the tarball:

-

If you are upgrading from a 1.2 version of Shorewall to a 1.3 version and you -have entries in the /etc/shorewall/hosts file then please check your -/etc/shorewall/interfaces file to be sure that it contains an entry for each -interface mentioned in the hosts file.  Also, there are certain 1.2 rule -forms that are no longer supported under 1.3 (you must use the new 1.3 syntax). -See the upgrade issues for details. You can check your rules -and host file for 1.3 compatibility using the "shorewall check" command after -installing the latest version of 1.3.

+ +

If you already have Shorewall installed +and are upgrading to a new version using the tarball:

+ +

If you are upgrading from a 1.2 version of Shorewall to a 1.3 version +and you have entries in the /etc/shorewall/hosts file then please check +your /etc/shorewall/interfaces file to be sure that it contains an entry +for each interface mentioned in the hosts file.  Also, there are certain +1.2 rule forms that are no longer supported under 1.3 (you must use the +new 1.3 syntax). See the upgrade issues +for details. You can check your rules and host file for 1.3 compatibility +using the "shorewall check" command after installing the latest version +of 1.3.

+ -

Configuring Shorewall

-

You will need to edit some or all of these configuration files to match your -setup. In most cases, the Shorewall -QuickStart Guides contain all of the information you need.

+ +

Configuring Shorewall

+ +

You will need to edit some or all of these configuration files to match +your setup. In most cases, the Shorewall + QuickStart Guides contain all of the information you need.

+ -

Updated 9/13/2002 - Tom -Eastep

-

Copyright -© 2001, 2002 Thomas M. Eastep.

- - \ No newline at end of file + +

Updated 10/9/2002 - Tom Eastep +

+ +

Copyright + © 2001, 2002 Thomas M. Eastep.

+
+ + diff --git a/STABLE/documentation/News.htm b/STABLE/documentation/News.htm index a777b333e..46a69385d 100644 --- a/STABLE/documentation/News.htm +++ b/STABLE/documentation/News.htm @@ -1,1342 +1,1359 @@ - + Shorewall News - + + - + - + - - - + + - - - + + + +
- +
+

Shorewall News Archive

-
- -

9/30/2002 - Shorewall 1.3.9a

-Roles up the fix for broken tunnels.
+ +

10/9/2002 - Shorewall 1.3.9b

+This release rolls up fixes to the installer and to the firewall script.
+

10/6/2002 - Shorewall.net now running on RH8.0
+
+ The firewall and server here at shorewall.net are now running RedHat release +8.0.
+
+ 9/30/2002 - Shorewall 1.3.9a

+ Roles up the fix for broken tunnels.
+

9/30/2002 - TUNNELS Broken in 1.3.9!!!

-There is an updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall --- copy that file to /usr/lib/shorewall/firewall.
- + -- copy that file to /usr/lib/shorewall/firewall.
+

9/28/2002 - Shorewall 1.3.9

- -

In this version:
-

- - - -

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
-

- Brown Paper Bag - A couple of recent configuration changes at www.shorewall.net broke - the Search facility:
- -
-
    -
  1. Mailing List Archive Search was not available.
    2. -
  2. The Site Search index was incomplete
    3. -
  3. Only one page of matches was presented.
    4. - -
-
- Hopefully these problems are now corrected. -

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
-

- A couple of recent configuration changes at www.shorewall.net had the - negative effect of breaking the Search facility:
- -
    -
  1. Mailing List Archive Search was not available.
    2. -
  2. The Site Search index was incomplete
    3. -
  3. Only one page of matches was presented.
    4. - -
- Hopefully these problems are now corrected.
- -

9/18/2002 -  Debian 1.3.8 Packages Available
-

+

In this version:
+

+ + + +

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
+

+ Brown Paper Bag + A couple of recent configuration changes at www.shorewall.net broke + the Search facility:
+ +
+
    +
  1. Mailing List Archive Search was not available.
    2. +
  2. The Site Search index was incomplete
    3. +
  3. Only one page of matches was presented.
    4. + +
+
+ Hopefully these problems are now corrected. +

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
+

+ A couple of recent configuration changes at www.shorewall.net had +the negative effect of breaking the Search facility:
+ +
    +
  1. Mailing List Archive Search was not available.
    2. +
  2. The Site Search index was incomplete
    3. +
  3. Only one page of matches was presented.
    4. + +
+ Hopefully these problems are now corrected.
+ +

9/18/2002 -  Debian 1.3.8 Packages Available
+

+

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

9/16/2002 - Shorewall 1.3.8

- +

In this version:
-

- +

+ - + - +

9/11/2002 - Debian 1.3.7c Packages Available

- +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

9/2/2002 - Shorewall 1.3.7c

- +

This is a role up of a fix for "DNAT" rules where the source zone is $FW - (fw).

- + (fw).

+

8/31/2002 - I'm not available

- +

I'm currently on vacation  -- please respect my need for a couple of weeks free of Shorewall problem reports.

- +

-Tom

- +

8/26/2002 - Shorewall 1.3.7b

- +

This is a role up of the "shorewall refresh" bug fix and the change which - reverses the order of "dhcp" and "norfc1918" checking.

- + reverses the order of "dhcp" and "norfc1918" checking.

+

8/26/2002 - French FTP Mirror is Operational

- +

ftp://france.shorewall.net/pub/mirrors/shorewall - is now available.

- + is now available.

+

8/25/2002 - Shorewall Mirror in France

- +

Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored - at http://france.shorewall.net.

- + at http://france.shorewall.net.

+

8/25/2002 - Shorewall 1.3.7a Debian Packages Available

- +

Lorenzo Martignoni reports that the packages for version 1.3.7a are available - at http://security.dsi.unimi.it/~lorenzo/debian.html.

- + at http://security.dsi.unimi.it/~lorenzo/debian.html.

+

8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author - -- Shorewall 1.3.7a released -

- +

+

1.3.7a corrects problems occurring in rules file processing when starting - Shorewall 1.3.7.

- + Shorewall 1.3.7.

+

8/22/2002 - Shorewall 1.3.7 Released 8/13/2002

- +

Features in this release include:

- + - +

I would like to thank John Distler for his valuable input regarding TCP - SYN and ICMP treatment in Shorewall. That input has led to marked improvement - in Shorewall in the last two releases.

- + SYN and ICMP treatment in Shorewall. That input has led to marked improvement + in Shorewall in the last two releases.

+

8/13/2002 - Documentation in the CVS Repository

- +

The Shorewall-docs project now contains just the HTML and image files - the Frontpage files have been removed.

- +

8/7/2002 - STABLE branch added to CVS Repository

- +

This branch will only be updated after I release a new version of Shorewall - so you can always update from this branch to get the latest stable tree.

- + so you can always update from this branch to get the latest stable +tree.

+

8/7/2002 - Upgrade Issues section added to the Errata Page

- +

Now there is one place to go to look for issues involved with upgrading - to recent versions of Shorewall.

- + to recent versions of Shorewall.

+

8/7/2002 - Shorewall 1.3.6

- +

This is primarily a bug-fix rollup with a couple of new features:

- + - +

7/30/2002 - Shorewall 1.3.5b Released

- +

This interim release:

- + - +

7/29/2002 - New Shorewall Setup Guide Available

- +

The first draft of this guide is available at http://www.shorewall.net/shorewall_setup_guide.htm. - The guide is intended for use by people who are setting up Shorewall - to manage multiple public IP addresses and by people who want to learn - more about Shorewall than is described in the single-address guides. -Feedback on the new guide is welcome.

- + The guide is intended for use by people who are setting up Shorewall + to manage multiple public IP addresses and by people who want to learn + more about Shorewall than is described in the single-address guides. + Feedback on the new guide is welcome.

+

7/28/2002 - Shorewall 1.3.5 Debian Package Available

- +

Lorenzo Martignoni reports that the packages are version 1.3.5a and are - available at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

7/27/2002 - Shorewall 1.3.5a Released

- +

This interim release restores correct handling of REDIRECT rules.

- +

7/26/2002 - Shorewall 1.3.5 Released

- +

This will be the last Shorewall release for a while. I'm going to be focusing on rewriting a lot of the documentation.

- +

 In this version:

- + - +

7/16/2002 - New Mirror in Argentina

- +

Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in - Argentina. Thanks Buanzo!!!

- + Argentina. Thanks Buanzo!!!

+

7/16/2002 - Shorewall 1.3.4 Released

- +

In this version:

- + - +

7/8/2002 - Shorewall 1.3.3 Debian Package Available

- +

Lorenzo Marignoni reports that the packages are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

7/6/2002 - Shorewall 1.3.3 Released

- +

In this version:

- + - +

6/25/2002 - Samples Updated for 1.3.2

- +

The comments in the sample configuration files have been updated to reflect - new features introduced in Shorewall 1.3.2.

- + new features introduced in Shorewall 1.3.2.

+

6/25/2002 - Shorewall 1.3.1 Debian Package Available

- +

Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

6/19/2002 - Documentation Available in PDF Format

- +

Thanks to Mike Martinez, the Shorewall Documentation is now available for download in Adobe PDF format.

- +

6/16/2002 - Shorewall 1.3.2 Released

- +

In this version:

- + - +

6/6/2002 - Why CVS Web access is Password Protected

- +

Last weekend, I installed the CVS Web package to provide brower-based access to the Shorewall CVS repository. Since then, I have had several instances where my server was almost unusable due to the high load generated by website copying tools like HTTrack and WebStripper. These mindless tools:

- + - +

These tools/weapons are particularly damaging when combined with CVS Web - because they doggedly follow every link in the cgi-generated HTML resulting - in 1000s of executions of the cvsweb.cgi script. Yesterday, I spend -several hours implementing measures to block these tools but unfortunately, -these measures resulted in my server OOM-ing under even moderate load.

- + because they doggedly follow every link in the cgi-generated HTML resulting + in 1000s of executions of the cvsweb.cgi script. Yesterday, I spend + several hours implementing measures to block these tools but unfortunately, + these measures resulted in my server OOM-ing under even moderate load.

+

Until I have the time to understand the cause of the OOM (or until I buy - more RAM if that is what is required), CVS Web access will remain Password - Protected.

- + more RAM if that is what is required), CVS Web access will remain Password + Protected.

+

6/5/2002 - Shorewall 1.3.1 Debian Package Available

- +

Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

6/2/2002 - Samples Corrected

- +

The 1.3.0 samples configurations had several serious problems that prevented - DNS and SSH from working properly. These problems have been corrected - in the 1.3.1 samples.

- + DNS and SSH from working properly. These problems have been corrected + in the 1.3.1 samples.

+

6/1/2002 - Shorewall 1.3.1 Released

- +

Hot on the heels of 1.3.0, this release:

- + - +

5/29/2002 - Shorewall 1.3.0 Released

- +

In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 includes:

- + - +

5/23/2002 - Shorewall 1.3 RC1 Available

- +

In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) incorporates the following:

- + - +

5/19/2002 - Shorewall 1.3 Beta 2 Available

- +

In addition to the changes in Beta 1, this release which carries the designation 1.2.91 adds:

- + - +

5/17/2002 - Shorewall 1.3 Beta 1 Available

- +

Beta 1 carries the version designation 1.2.90 and implements the following - features:

- + features:

+ - +

5/4/2002 - Shorewall 1.2.13 is Available

- +

In this version:

- + - +

4/30/2002 - Shorewall Debian News

- +

Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the Debian Testing Branch and the Debian Unstable Branch.

- +

4/20/2002 - Shorewall 1.2.12 is Available

- + - +

4/17/2002 - Shorewall Debian News

- +

Lorenzo Marignoni reports that:

- + - +

Thanks, Lorenzo!

- +

4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE

- +

Thanks to Stefan Mohr, there - is now a Shorewall 1.2.11 - SuSE RPM available.

- + SuSE RPM available.

+

4/13/2002 - Shorewall 1.2.11 Available

- +

In this version:

- + - +

4/13/2002 - Hamburg Mirror now has FTP

- +

Stefan now has an FTP mirror at ftp://germany.shorewall.net/pub/shorewall.  - Thanks Stefan!

- + Thanks Stefan!

+

4/12/2002 - New Mirror in Hamburg

- +

Thanks to Stefan Mohr, there - is now a mirror of the Shorewall website at http://germany.shorewall.net.

- +

4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available

- +

Version 1.1 of the QuickStart - Guide is now available. Thanks to those who have read version 1.0 - and offered their suggestions. Corrections have also been made to the - sample scripts.

- + Guide is now available. Thanks to those who have read version 1.0 + and offered their suggestions. Corrections have also been made to the + sample scripts.

+

4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available

- +

Version 1.0 of the QuickStart - Guide is now available. This Guide and its accompanying sample configurations - are expected to provide a replacement for the recently withdrawn parameterized - samples.

- + Guide is now available. This Guide and its accompanying sample +configurations are expected to provide a replacement for the recently +withdrawn parameterized samples.

+

4/8/2002 - Parameterized Samples Withdrawn

- +

Although the parameterized - samples have allowed people to get a firewall up and running quickly, - they have unfortunately set the wrong level of expectation among those - who have used them. I am therefore withdrawing support for the samples - and I am recommending that they not be used in new Shorewall installations.

- + samples have allowed people to get a firewall up and running quickly, + they have unfortunately set the wrong level of expectation among those + who have used them. I am therefore withdrawing support for the samples + and I am recommending that they not be used in new Shorewall installations.

+

4/2/2002 - Updated Log Parser

- +

John Lodge has provided an updated - version of his CGI-based log parser - with corrected date handling.

- + version of his CGI-based log parser + with corrected date handling.

+

3/30/2002 - Shorewall Website Search Improvements

- +

The quick search on the home page now excludes the mailing list archives. - The Extended Search allows excluding - the archives or restricting the search to just the archives. An archive - search form is also available on the mailing - list information page.

- + The Extended Search allows excluding + the archives or restricting the search to just the archives. An archive + search form is also available on the mailing + list information page.

+

3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)

- + - +

3/25/2002 - Log Parser Available

- +

John Lodge has provided a CGI-based log parser for Shorewall. Thanks - John.

- + John.

+

3/20/2002 - Shorewall 1.2.10 Released

- +

In this version:

- + - +

3/11/2002 - Shorewall 1.2.9 Released

- +

In this version:

- + - +

3/1/2002 - 1.2.8 Debian Package is Available

- +

See http://security.dsi.unimi.it/~lorenzo/debian.html

- +

2/25/2002 - New Two-interface Sample

- +

I've enhanced the two interface sample to allow access from the firewall - to servers in the local zone - - http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

- + http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

+

2/23/2002 - Shorewall 1.2.8 Released

- +

Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects problems associated with the lock file used to prevent multiple state-changing - operations from occuring simultaneously. My apologies for any inconvenience - my carelessness may have caused.

- + operations from occuring simultaneously. My apologies for any inconvenience + my carelessness may have caused.

+

2/22/2002 - Shorewall 1.2.7 Released

- +

In this version:

- + - +

2/18/2002 - 1.2.6 Debian Package is Available

- +

See http://security.dsi.unimi.it/~lorenzo/debian.html

- +

2/8/2002 - Shorewall 1.2.6 Released

- +

In this version:

- + - +

2/4/2002 - Shorewall 1.2.5 Debian Package Available

- +

see http://security.dsi.unimi.it/~lorenzo/debian.html

- +

2/1/2002 - Shorewall 1.2.5 Released

- +

Due to installation problems with Shorewall 1.2.4, I have released Shorewall - 1.2.5. Sorry for the rapid-fire development.

- + 1.2.5. Sorry for the rapid-fire development.

+

In version 1.2.5:

- + - +

1/28/2002 - Shorewall 1.2.4 Released

- + - +

1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

- +

1/20/2002 - Corrected firewall script available 

- +

Corrects a problem with BLACKLIST_LOGLEVEL. See the - errata for details.

- + errata for details.

+

1/19/2002 - Shorewall 1.2.3 Released

- +

This is a minor feature and bugfix release. The single new feature is:

- + - +

The following problems were corrected:

- + - +

1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release

- +

Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution - that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo - for details.

- + for details.

+

1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 - Shorewall Debian package is now available. There is a link to Lorenzo's - site from the Shorewall download page.

- + Shorewall Debian package is now available. There is a link to Lorenzo's + site from the Shorewall download page.

+

1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores - the "shorewall status" command to health.

- + the "shorewall status" command to health.

+

1/8/2002 - Shorewall 1.2.2 Released

- +

In version 1.2.2

- + - +

1/5/2002 - New Parameterized Samples (version 1.2.0) released. These are minor updates - to the previously-released samples. There are two new rules added:

- + to the previously-released samples. There are two new rules added:

+ - +

See the README file for upgrade instructions.

- +

1/1/2002 - Shorewall Mailing List Moving

- +

The Shorewall mailing list hosted at - Sourceforge is moving to Shorewall.net. If you are a current subscriber - to the list at Sourceforge, please is moving to Shorewall.net. If you are a current subscriber + to the list at Sourceforge, please see these instructions. - If you would like to subscribe to the new list, visit http://www.shorewall.net/mailman/listinfo/shorewall-users.

- +

12/31/2001 - Shorewall 1.2.1 Released

- +

In version 1.2.1:

- + - +

12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist releasing 1.2 on 12/21/2001

- +

Version 1.2 contains the following new features:

- + - +

For the next month or so, I will continue to provide corrections to version - 1.1.18 as necessary so that current version 1.1.x users will not be -forced into a quick upgrade to 1.2.0 just to have access to bug fixes.

- + 1.1.18 as necessary so that current version 1.1.x users will not be + forced into a quick upgrade to 1.2.0 just to have access to bug fixes.

+

For those of you who have installed one of the Beta RPMS, you will need - to use the "--oldpackage" option when upgrading to 1.2.0:

- -
+ to use the "--oldpackage" option when upgrading to 1.2.0:

+ +

rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

-
- +
+

12/19/2001 - Thanks to Steve - Cowles, there is now a Shorewall mirror in Texas. This web site - is mirrored at , there is now a Shorewall mirror in Texas. This web +site is mirrored at http://www.infohiiway.com/shorewall and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

- +

11/30/2001 - A new set of the parameterized Sample Configurations has been released. In this version:

- + - +

11/20/2001 - The current version of Shorewall is 1.1.18. 

- +

In this version:

- + - +

11/19/2001 - Thanks to Juraj - Ontkanin, there is now a Shorewall mirror in the Slovak Republic. - The website is now mirrored at , there is now a Shorewall mirror in the Slovak Republic. + The website is now mirrored at http://www.nrg.sk/mirror/shorewall - and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

- +

11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. - There are three sample configurations:

- + There are three sample configurations:

+ - +

Samples may be downloaded from ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 - . See the README file for instructions.

- + . See the README file for instructions.

+

11/1/2001 - The current version of Shorewall is 1.1.17.  I intend - this to be the last of the 1.1 Shorewall releases.

- + this to be the last of the 1.1 Shorewall releases.

+

In this version:

- + - +

10/22/2001 - The current version of Shorewall is 1.1.16. In this - version:

- - + version:

+ +

10/15/2001 - The current version of Shorewall is 1.1.15. In this - version:

- + version:

+ - +

10/4/2001 - The current version of Shorewall is 1.1.14. In this - version

- + version

+ - +

9/12/2001 - The current version of Shorewall is 1.1.13. In this - version

- + version

+ - +

8/28/2001 - The current version of Shorewall is 1.1.12. In this - version

- + version

+ - +

7/28/2001 - The current version of Shorewall is 1.1.11. In this - version

- + version

+ - -

7/6/2001 - The current version of Shorewall is 1.1.10. In this version

- - - -

6/23/2001 - The current version of Shorewall is 1.1.9. In this version

- + +

7/6/2001 - The current version of Shorewall is 1.1.10. In this version

+ + +

6/23/2001 - The current version of Shorewall is 1.1.9. In this version

+ + - +

6/18/2001 - The current version of Shorewall is 1.1.8. In this version

- + - +

6/2/2001 - The current version of Shorewall is 1.1.7. In this version

- + - +

5/25/2001 - The current version of Shorewall is 1.1.6. In this version

- + - +

5/20/2001 - The current version of Shorewall is 1.1.5. In this version

- + - +

5/10/2001 - The current version of Shorewall is 1.1.4. In this version

- + - +

4/28/2001 - The current version of Shorewall is 1.1.3. In this version

- + - +

4/12/2001 - The current version of Shorewall is 1.1.2. In this version

- + - +

4/8/2001 - Shorewall is now affiliated with the Leaf Project -

- +

+

4/5/2001 - The current version of Shorewall is 1.1.1. In this version:

- + - +

3/25/2001 - The current version of Shorewall is 1.1.0. In this version:

- + - +

3/19/2001 - The current version of Shorewall is 1.0.4. This version:

- + - +

3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix - release with no new features.

- + release with no new features.

+ - +

3/8/2001 - The current version of Shorewall is 1.0.2. It supports an - additional "gw" (gateway) zone for tunnels and it supports IPSEC - tunnels with end-points on the firewall. There is also a .lrp available -now.

- -

Updated 9/23/2002 - Tom Eastep -

- + additional "gw" (gateway) zone for tunnels and it supports IPSEC + tunnels with end-points on the firewall. There is also a .lrp available + now.

+ +

Updated 10/9/2002 - Tom Eastep +

+

Copyright © 2001, 2002 Thomas M. Eastep.

+

+



diff --git a/STABLE/documentation/Shorewall_index_frame.htm b/STABLE/documentation/Shorewall_index_frame.htm index 1df2d16c8..2bb250bd1 100644 --- a/STABLE/documentation/Shorewall_index_frame.htm +++ b/STABLE/documentation/Shorewall_index_frame.htm @@ -1,106 +1,110 @@ - + - + - + - + Shorewall Index - + - + - - - + + - - - + + + - - - + + + +
- +
+

Shorewall

-
- +
+ - + -
- +

- Note: Search is unavailable Daily 0100-0200 GMT.
- + Note: Search is unavailable Daily 0200-0330 GMT.
+

Quick Search
-

-
- +

Extended Search

- +

Copyright © 2001, 2002 Thomas M. Eastep.

- +

-

+

+

+



diff --git a/STABLE/documentation/blacklisting_support.htm b/STABLE/documentation/blacklisting_support.htm index 678186546..8999e2eb9 100644 --- a/STABLE/documentation/blacklisting_support.htm +++ b/STABLE/documentation/blacklisting_support.htm @@ -1,95 +1,95 @@ - + - + - + - + Blacklisting Support - + - - - + + - - - + + + +
+

Blacklisting Support

-
- +

Shorewall supports two different forms of blacklisting; static and dynamic.

- +

Static Blacklisting

- -

Shorewall static blacklisting support has the following configuration -parameters:

- + +

Shorewall static blacklisting support has the following configuration parameters:

+ - +

Dynamic Blacklisting

- -

Dynamic blacklisting support was added in version 1.3.2. Dynamic blacklisting - doesn't use any configuration parameters but is rather controlled using - /sbin/shorewall commands:

- + +

Dynamic blacklisting support was added in version 1.3.2. Dynamic blacklisting + doesn't use any configuration parameters but is rather controlled using +/sbin/shorewall commands:

+ - +

Example 1:

- -
     shorewall deny 192.0.2.124 192.0.2.125
- + +
     shorewall drop 192.0.2.124 192.0.2.125
+

    Drops packets from hosts 192.0.2.124 and 192.0.2.125

- +

Example 2:

- + 
     shorewall allow 192.0.2.125
- +

    Reenables access from 192.0.2.125.

- -

Last updated 9/16/2002 - Tom Eastep

- -

Copyright + +

Last updated 10/7/2002 - Tom Eastep

+ +

Copyright © 2002 Thomas M. Eastep.

-
+
+
diff --git a/STABLE/documentation/errata.htm b/STABLE/documentation/errata.htm index e8693fed0..5331d3557 100644 --- a/STABLE/documentation/errata.htm +++ b/STABLE/documentation/errata.htm @@ -1,440 +1,500 @@ - + Shorewall 1.3 Errata - + - + - + - + - - - + + - - - + + + +
+
+

Shorewall Errata/Upgrade Issues

-
- +

IMPORTANT

- +
    -
  1. -

    If you use a Windows system to download - a corrected script, be sure to run the script through +

    If you use a Windows system to download + a corrected script, be sure to run the script through dos2unix after you have moved - it to your Linux system.

    -
    2. -
  2. -

    If you are installing Shorewall for the first -time and plan to use the .tgz and install.sh script, you can untar -the archive, replace the 'firewall' script in the untarred directory - with the one you downloaded below, and then run install.sh.

    -
    3. -
  3. -

    When the instructions say to install a corrected - firewall script in /etc/shorewall/firewall, /usr/lib/shorewall/firewall -or /var/lib/shorewall/firewall, use the 'cp' (or 'scp') utility to overwrite -the existing file. DO NOT REMOVE OR RENAME THE OLD /etc/shorewall/firewall - or /var/lib/shorewall/firewall before you do that. /etc/shorewall/firewall - and /var/lib/shorewall/firewall are symbolic links that point - to the 'shorewall' file used by your system initialization scripts to - start Shorewall during boot. It is that file that must be overwritten - with the corrected script.

    -
    4. - + style="text-decoration: none;"> dos2unix     after you have moved + it to your Linux system.

    + +
  4. +

    If you are installing Shorewall for the +first time and plan to use the .tgz and install.sh script, you can +untar the archive, replace the 'firewall' script in the untarred directory + with the one you downloaded below, and then run install.sh.

    +
    5. +
  5. +

    When the instructions say to install a corrected + firewall script in /etc/shorewall/firewall, /usr/lib/shorewall/firewall + or /var/lib/shorewall/firewall, use the 'cp' (or 'scp') utility to overwrite + the existing file. DO NOT REMOVE OR RENAME THE OLD /etc/shorewall/firewall + or /var/lib/shorewall/firewall before you do that. /etc/shorewall/firewall + and /var/lib/shorewall/firewall are symbolic links that point + to the 'shorewall' file used by your system initialization scripts +to start Shorewall during boot. It is that file that must be overwritten + with the corrected script.

    +
    6. +
  6. +

    DO NOT INSTALL CORRECTED COMPONENTS +ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW. For example, +do NOT install the 1.3.9a firewall script if you are running 1.3.7c.
    +

    +
- + - -
-

Problems in Version 1.3

- -

Version 1.3.9

-TUNNELS Broken in 1.3.9!!! There is an updated firewall script at -ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall --- copy that file to /usr/lib/shorewall/firewall as descripbed above.
-
-Version 1.3.8 - - Installing - this corrected firewall script in /var/lib/shorewall/firewall - as described above corrects these problems. - + +
+

Problems in Version 1.3

+ +

Version 1.3.9a

+
    +
  • If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No then +the following message appears during "shorewall [re]start":
    • +
+ +
          recalculate_interfacess: command not found
+
The updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall +corrects this problem.Copy the script to /usr/lib/shorewall/firewall as described +above.
+
+
Alternatively, edit /usr/lob/shorewall/firewall and change the +single occurence (line 483 in version 1.3.9a) of 'recalculate_interefacess' +to 'recalculate_interface'.
+
+
    +
  • The installer (install.sh) issues a misleading message "Common functions +installed in /var/lib/shorewall/functions" whereas the file is installed +in /usr/lib/shorewall/functions. The installer also performs incorrectly +when updating old configurations that had the file /etc/shorewall/functions. + Here +is an updated version that corrects these problems.
    +
    • +
+ +

Version 1.3.9

+ TUNNELS Broken in 1.3.9!!! There is an updated firewall script +at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall +-- copy that file to /usr/lib/shorewall/firewall as described above.
+
+ Version 1.3.8 +
    +
  • Use of shell variables in the LOG LEVEL or SYNPARMS columns of + the policy file doesn't work.
    • +
  • A DNAT rule with the same original and new IP addresses but with + different port numbers doesn't work (e.g., "DNAT loc dmz:10.1.1.1:24 tcp + 25 - 10.1.1.1")
    +
    • + +
+ Installing + this corrected firewall script in /var/lib/shorewall/firewall + as described above corrects these problems. +

Version 1.3.7b

- -

DNAT rules where the source zone is 'fw' ($FW) - result in an error message. Installing - - this corrected firewall script in /var/lib/shorewall/firewall - as described above corrects this problem.

- + +

DNAT rules where the source zone is 'fw' ($FW) + result in an error message. Installing + + this corrected firewall script in /var/lib/shorewall/firewall + as described above corrects this problem.

+

Version 1.3.7a

- -

"shorewall refresh" is not creating the proper - rule for FORWARDPING=Yes. Consequently, after - "shorewall refresh", the firewall will not forward - icmp echo-request (ping) packets. Installing - - this corrected firewall script in /var/lib/shorewall/firewall - as described above corrects this problem.

- + +

"shorewall refresh" is not creating the proper + rule for FORWARDPING=Yes. Consequently, after + "shorewall refresh", the firewall will not forward + icmp echo-request (ping) packets. Installing + + this corrected firewall script in /var/lib/shorewall/firewall + as described above corrects this problem.

+

Version <= 1.3.7a

- -

If "norfc1918" and "dhcp" are both specified as - options on a given interface then RFC 1918 - checking is occurring before DHCP checking. This - means that if a DHCP client broadcasts using an - RFC 1918 source address, then the firewall will - reject the broadcast (usually logging it). This - has two problems:

- + +

If "norfc1918" and "dhcp" are both specified as + options on a given interface then RFC 1918 + checking is occurring before DHCP checking. This + means that if a DHCP client broadcasts using an + RFC 1918 source address, then the firewall will + reject the broadcast (usually logging it). This + has two problems:

+
    -
  1. If the firewall is running a DHCP -server, the client won't be able to obtain -an IP address lease from that server.
    2. -
  2. With this order of checking, the -"dhcp" option cannot be used as a noise-reduction - measure where there are both dynamic and - static clients on a LAN segment.
    3. - +
  3. If the firewall is running a DHCP + server, the client won't be able to obtain + an IP address lease from that server.
    4. +
  4. With this order of checking, the + "dhcp" option cannot be used as a noise-reduction + measure where there are both dynamic +and static clients on a LAN segment.
    5. +
- +

- This version of the 1.3.7a firewall script - corrects the problem. It must be installed - in /var/lib/shorewall as described above.

- + href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall"> + This version of the 1.3.7a firewall script + corrects the problem. It must be installed + in /var/lib/shorewall as described above.

+

Version 1.3.7

- -

Version 1.3.7 dead on arrival -- please use - version 1.3.7a and check your version against - these md5sums -- if there's a difference, please - download again.

- + +

Version 1.3.7 dead on arrival -- please use + version 1.3.7a and check your version against + these md5sums -- if there's a difference, please + download again.

+ 
	d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz
	6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm
	3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp
- -

In other words, type "md5sum <whatever package you downloaded> - and compare the result with what you see above.

- -

I'm embarrassed to report that 1.2.7 was also DOA -- maybe I'll skip the - .7 version in each sequence from now on.

- + +

In other words, type "md5sum <whatever package you downloaded> + and compare the result with what you see above.

+ +

I'm embarrassed to report that 1.2.7 was also DOA -- maybe I'll skip the + .7 version in each sequence from now on.

+

Version 1.3.6

- +
    -
  • -

    If ADD_SNAT_ALIASES=Yes is specified in /etc/shorewall/shorewall.conf, - an error occurs when the firewall script attempts to add an SNAT - alias.

    -
    • -
  • -

    The logunclean and dropunclean options - cause errors during startup when Shorewall is run with iptables - 1.2.7.

    -
    • - +
  • + +

    If ADD_SNAT_ALIASES=Yes is specified in /etc/shorewall/shorewall.conf, + an error occurs when the firewall script attempts to add an +SNAT alias.

    +
    • +
  • +

    The logunclean and dropunclean options + cause errors during startup when Shorewall is run with iptables + 1.2.7.

    +
    • +
- +

These problems are fixed in - this correct firewall script which must be installed in - /var/lib/shorewall/ as described above. These problems are also - corrected in version 1.3.7.

- + href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall"> + this correct firewall script which must be installed in + /var/lib/shorewall/ as described above. These problems are also + corrected in version 1.3.7.

+

Two-interface Samples 1.3.6 (file two-interfaces.tgz)

- -

A line was inadvertently deleted from the "interfaces - file" -- this line should be added back in if the version that you - downloaded is missing it:

- + +

A line was inadvertently deleted from the "interfaces + file" -- this line should be added back in if the version that you + downloaded is missing it:

+

net    eth0    detect    routefilter,dhcp,norfc1918

- -

If you downloaded two-interfaces-a.tgz then the above - line should already be in the file.

- + +

If you downloaded two-interfaces-a.tgz then the above + line should already be in the file.

+

Version 1.3.5-1.3.5b

- -

The new 'proxyarp' interface option doesn't work :-( - This is fixed in - this corrected firewall script which must be installed in - /var/lib/shorewall/ as described above.

- + +

The new 'proxyarp' interface option doesn't work :-( + This is fixed in + this corrected firewall script which must be installed in + /var/lib/shorewall/ as described above.

+

Versions 1.3.4-1.3.5a

- -

Prior to version 1.3.4, host file entries such as the - following were allowed:

- -
+ +

Prior to version 1.3.4, host file entries such as the + following were allowed:

+ +
	adm	eth0:1.2.4.5,eth0:5.6.7.8
-
- -
-

That capability was lost in version 1.3.4 so that it is only - possible to  include a single host specification on each line. This - problem is corrected by this - modified 1.3.5a firewall script. Install the script in /var/lib/pub/shorewall/firewall - as instructed above.

-
- -
+
+ +
+

That capability was lost in version 1.3.4 so that it is only + possible to  include a single host specification on each line. This + problem is corrected by this + modified 1.3.5a firewall script. Install the script in /var/lib/pub/shorewall/firewall + as instructed above.

+
+ +

This problem is corrected in version 1.3.5b.

-
- +
+

Version 1.3.5

- -

REDIRECT rules are broken in this version. Install - - this corrected firewall script in /var/lib/pub/shorewall/firewall - as instructed above. This problem is corrected in version 1.3.5a.

- + +

REDIRECT rules are broken in this version. Install + + this corrected firewall script in /var/lib/pub/shorewall/firewall + as instructed above. This problem is corrected in version 1.3.5a.

+

Version 1.3.n, n < 4

- -

The "shorewall start" and "shorewall restart" commands - to not verify that the zones named in the /etc/shorewall/policy file - have been previously defined in the /etc/shorewall/zones file. -The "shorewall check" command does perform this verification so -it's a good idea to run that command after you have made configuration - changes.

- + +

The "shorewall start" and "shorewall restart" commands + to not verify that the zones named in the /etc/shorewall/policy +file have been previously defined in the /etc/shorewall/zones +file. The "shorewall check" command does perform this verification +so it's a good idea to run that command after you have made configuration + changes.

+

Version 1.3.n, n < 3

- -

If you have upgraded from Shorewall 1.2 and after - "Activating rules..." you see the message: "iptables: No chains/target/match - by that name" then you probably have an entry in /etc/shorewall/hosts - that specifies an interface that you didn't include in /etc/shorewall/interfaces. - To correct this problem, you must add an entry to /etc/shorewall/interfaces. - Shorewall 1.3.3 and later versions produce a clearer error message - in this case.

- + +

If you have upgraded from Shorewall 1.2 and after + "Activating rules..." you see the message: "iptables: No chains/target/match + by that name" then you probably have an entry in /etc/shorewall/hosts + that specifies an interface that you didn't include in /etc/shorewall/interfaces. + To correct this problem, you must add an entry to /etc/shorewall/interfaces. + Shorewall 1.3.3 and later versions produce a clearer error +message in this case.

+

Version 1.3.2

- -

Until approximately 2130 GMT on 17 June 2002, the - download sites contained an incorrect version of the .lrp file. That - file can be identified by its size (56284 bytes). The correct version - has a size of 38126 bytes.

- + +

Until approximately 2130 GMT on 17 June 2002, the + download sites contained an incorrect version of the .lrp file. That + file can be identified by its size (56284 bytes). The correct +version has a size of 38126 bytes.

+
    -
  • The code to detect a duplicate interface entry in - /etc/shorewall/interfaces contained a typo that prevented it from - working correctly.
    • -
  • "NAT_BEFORE_RULES=No" was broken; it behaved just like - "NAT_BEFORE_RULES=Yes".
    • - +
  • The code to detect a duplicate interface entry in + /etc/shorewall/interfaces contained a typo that prevented it from + working correctly.
    • +
  • "NAT_BEFORE_RULES=No" was broken; it behaved just +like "NAT_BEFORE_RULES=Yes".
    • +
- +

Both problems are corrected in - this script which should be installed in /var/lib/shorewall - as described above.

- + href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/firewall"> + this script which should be installed in /var/lib/shorewall + as described above.

+
    -
  • -

    The IANA have just announced the allocation of subnet - 221.0.0.0/8. This - updated rfc1918 file reflects that allocation.

    -
    • +
  • +

    The IANA have just announced the allocation of subnet + 221.0.0.0/8. This + updated rfc1918 file reflects that allocation.

    +
    • +
- +

Version 1.3.1

- +
    -
  • TCP SYN packets may be double counted when - LIMIT:BURST is included in a CONTINUE or ACCEPT policy (i.e., each - packet is sent through the limit chain twice).
    • -
  • An unnecessary jump to the policy chain is sometimes - generated for a CONTINUE policy.
    • -
  • When an option is given for more than one interface in - /etc/shorewall/interfaces then depending on the option, Shorewall - may ignore all but the first appearence of the option. For example:
    -
    - net    eth0    dhcp
    - loc    eth1    dhcp
    -
    - Shorewall will ignore the 'dhcp' on eth1.
    • -
  • Update 17 June 2002 - The bug described in the prior -bullet affects the following options: dhcp, dropunclean, logunclean, - norfc1918, routefilter, multi, filterping and noping. An additional - bug has been found that affects only the 'routestopped' option.
    -
    - Users who downloaded the corrected script prior to 1850 GMT - today should download and install the corrected script again - to ensure that this second problem is corrected.
    • - +
  • TCP SYN packets may be double counted when + LIMIT:BURST is included in a CONTINUE or ACCEPT policy (i.e., each + packet is sent through the limit chain twice).
    • +
  • An unnecessary jump to the policy chain is sometimes + generated for a CONTINUE policy.
    • +
  • When an option is given for more than one interface + in /etc/shorewall/interfaces then depending on the option, +Shorewall may ignore all but the first appearence of the option. +For example:
    +
    + net    eth0    dhcp
    + loc    eth1    dhcp
    +
    + Shorewall will ignore the 'dhcp' on eth1.
    • +
  • Update 17 June 2002 - The bug described in the prior + bullet affects the following options: dhcp, dropunclean, logunclean, + norfc1918, routefilter, multi, filterping and noping. An +additional bug has been found that affects only the 'routestopped' +option.
    +
    + Users who downloaded the corrected script prior to 1850 + GMT today should download and install the corrected script + again to ensure that this second problem is corrected.
    • +
- +

These problems are corrected in - this firewall script which should be installed in /etc/shorewall/firewall - as described above.

- + href="http://www.shorewall.net/pub/shorewall/errata/1.3.1/firewall"> + this firewall script which should be installed in /etc/shorewall/firewall + as described above.

+

Version 1.3.0

- +
    -
  • Folks who downloaded 1.3.0 from the links on the download - page before 23:40 GMT, 29 May 2002 may have downloaded 1.2.13 - rather than 1.3.0. The "shorewall version" command will tell - you which version that you have installed.
    • -
  • The documentation NAT.htm file uses non-existent - wallpaper and bullet graphic files. The - corrected version is here.
    • - +
  • Folks who downloaded 1.3.0 from the links on the download + page before 23:40 GMT, 29 May 2002 may have downloaded 1.2.13 + rather than 1.3.0. The "shorewall version" command will tell + you which version that you have installed.
    • +
  • The documentation NAT.htm file uses non-existent + wallpaper and bullet graphic files. The + corrected version is here.
    • +
- -
+ +

Upgrade Issues

- +

The upgrade issues have moved to a separate page.

- -
-

Problem with - iptables version 1.2.3

- -
-

There are a couple of serious bugs in iptables 1.2.3 that - prevent it from working with Shorewall. Regrettably, RedHat released - this buggy iptables in RedHat 7.2. 

- + +
+

Problem with + iptables version 1.2.3

+ +
+

There are a couple of serious bugs in iptables 1.2.3 that + prevent it from working with Shorewall. Regrettably, RedHat released + this buggy iptables in RedHat 7.2. 

+

I have built a - corrected 1.2.3 rpm which you can download here  and I have also built - an - iptables-1.2.4 rpm which you can download here. If you are currently - running RedHat 7.1, you can install either of these RPMs before - you upgrade to RedHat 7.2.

- -

Update 11/9/2001: RedHat - has released an iptables-1.2.4 RPM of their own which you can download -from http://www.redhat.com/support/errata/RHSA-2001-144.html. - I have installed this RPM on my firewall and it works fine.

- -

If you would like to patch iptables 1.2.3 yourself, - the patches are available for download. This patch - which corrects a problem with parsing of the --log-level specification - while this patch - corrects a problem in handling the  TOS target.

- + href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm"> + corrected 1.2.3 rpm which you can download here  and I have also built + an +iptables-1.2.4 rpm which you can download here. If you are currently + running RedHat 7.1, you can install either of these RPMs before + you upgrade to RedHat 7.2.

+ +

Update 11/9/2001: RedHat + has released an iptables-1.2.4 RPM of their own which you can download + from http://www.redhat.com/support/errata/RHSA-2001-144.html. + I have installed this RPM on my firewall and it works fine.

+ +

If you would like to patch iptables 1.2.3 yourself, + the patches are available for download. This patch + which corrects a problem with parsing of the --log-level specification + while this patch + corrects a problem in handling the  TOS target.

+

To install one of the above patches:

- +
    -
  • cd iptables-1.2.3/extensions
    • -
  • patch -p0 < the-patch-file
    • - +
  • cd iptables-1.2.3/extensions
    • +
  • patch -p0 < the-patch-file
    • +
-
- -

Problems with kernels >= 2.4.18 - and RedHat iptables

- -
-

Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19 - may experience the following:

- -
+
+ +

Problems with kernels >= 2.4.18 + and RedHat iptables

+ +
+

Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19 + may experience the following:

+ + 
# shorewall start
Processing /etc/shorewall/shorewall.conf ...
Processing /etc/shorewall/params ...
Starting Shorewall...
Loading Modules...
Initializing...
Determining Zones...
Zones: net
Validating interfaces file...
Validating hosts file...
Determining Hosts in Zones...
Net Zone: eth0:0.0.0.0/0
iptables: libiptc/libip4tc.c:380: do_check: Assertion
`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.
Aborted (core dumped)
iptables: libiptc/libip4tc.c:380: do_check: Assertion
`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.
Aborted (core dumped)
-
- -

The RedHat iptables RPM is compiled with debugging enabled but the - user-space debugging code was not updated to reflect recent changes in - the Netfilter 'mangle' table. You can correct the problem by installing - - this iptables RPM. If you are already running a 1.2.5 version of - iptables, you will need to specify the --oldpackage option to rpm (e.g., - "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").

-
+
+ +

The RedHat iptables RPM is compiled with debugging enabled but the + user-space debugging code was not updated to reflect recent changes in + the Netfilter 'mangle' table. You can correct the problem by installing + + this iptables RPM. If you are already running a 1.2.5 version of + iptables, you will need to specify the --oldpackage option to rpm (e.g., + "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").

+
-

Problems installing/upgrading - RPM on SuSE

- -

If you find that rpm complains about a conflict - with kernel <= 2.2 yet you have a 2.4 kernel - installed, simply use the "--nodeps" option to - rpm.

- + +

Problems installing/upgrading + RPM on SuSE

+ +

If you find that rpm complains about a conflict + with kernel <= 2.2 yet you have a 2.4 kernel + installed, simply use the "--nodeps" option to + rpm.

+

Installing: rpm -ivh --nodeps <shorewall rpm>

- +

Upgrading: rpm -Uvh --nodeps <shorewall rpm>

- -

Problems with - iptables version 1.2.7 and MULTIPORT=Yes

- -

The iptables 1.2.7 release of iptables has made - an incompatible change to the syntax used to - specify multiport match rules; as a consequence, - if you install iptables 1.2.7 you must be running - Shorewall 1.3.7a or later or:

- + +

Problems with + iptables version 1.2.7 and MULTIPORT=Yes

+ +

The iptables 1.2.7 release of iptables has made + an incompatible change to the syntax used to + specify multiport match rules; as a consequence, + if you install iptables 1.2.7 you must be running + Shorewall 1.3.7a or later or:

+
    -
  • set MULTIPORT=No in - /etc/shorewall/shorewall.conf; or
    • -
  • if you are running Shorewall 1.3.6 - you may install +
  • set MULTIPORT=No in + /etc/shorewall/shorewall.conf; or
    • +
  • if you are running Shorewall 1.3.6 + you may install - this firewall script in /var/lib/shorewall/firewall - as described above.
    • - + href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall"> + this firewall script in /var/lib/shorewall/firewall + as described above. +
- -

Last updated 9/28/2002 - - Tom Eastep

- -

Copyright - © 2001, 2002 Thomas M. Eastep.

+ +

Problems with RH Kernel 2.4.18-10 and NAT
+

+ /etc/shorewall/nat entries of the following form will result in Shorewall + being unable to start:
+
+ +
#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL
192.0.2.22      eth0            192.168.9.22    yes                     yes
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
+ Error message is:
+ +
Setting up NAT...
iptables: Invalid argument
Terminated

+ The solution is to put "no" in the LOCAL column. Kernel support for LOCAL=yes + has never worked properly and 2.4.18-10 has disabled it. The 2.4.19 kernel + contains corrected support under a new kernel configuraiton option; see +http://www.shorewall.net/Documentation.htm#NAT
+ +

Last updated 10/9/2002 - + Tom Eastep

+ +

Copyright + © 2001, 2002 Thomas M. Eastep.

+
+

+



diff --git a/STABLE/documentation/mailing_list_problems.htm b/STABLE/documentation/mailing_list_problems.htm index 7c7f80ba7..95adcd8c2 100644 --- a/STABLE/documentation/mailing_list_problems.htm +++ b/STABLE/documentation/mailing_list_problems.htm @@ -1,59 +1,49 @@ + - - - - - -Mailing List Problems + + + + + + + + + Mailing List Problems - - - - - - - + + +
-

Mailing List Problems

-
+ + + + + +
+

Mailing List Problems

+
- +

Shorewall.net is currently experiencing mail delivery problems -to at least one address in each of the following domains:

- -
-
- 
2020ca - delivery to this domain has been disabled (cause unknown)
-excite.com - delivery to this domain has been disabled (cause unknown)
-epacificglobal.com - delivery to this domain has been disabled (no MX record for domain)
-familie-fleischhacker.de - (connection timed out)
-gmx.net - delivery to this domain has been disabled (cause unknown)
-hotmail.com - delivery to this domain has been disabled (Mailbox over quota)
-intercom.net - delivery to this domain has been disabled (cause unknown)
-initialcs.com - delivery to this domain has been disabled (cause unknown)
-intelligents.2y.net - delivery to this domain has been disabled (Name Service Problem -- Host not Found).
-khp-inc.com - delivery to this domain has been disabled (anti-virus problems)
-kieninger.de - delivery to this domain has been disabled (relaying to <xxxxx@kieninger.de> prohibited by administrator)
-littleblue.de - (connection timed out)
-opermail.net - delivery to this domain has been disabled (cause unknown)
-penquindevelopment.com - delivery to this domain has been disabled (connection timed out)
-scip-online.de - delivery to this domain has been disabled (cause unknown)
-spctnet.com - connection timed out - delivery to this domain has been disabled
-telusplanet.net - delivery to this domain has been disabled (cause unknown)
-yahoo.com - delivery to this domain has been disabled (Mailbox over quota)
-
-
- -

Last updated 8/23/2002 17:16 GMT - -Tom -Eastep

- -

- -Copyright © 2002 Thomas M. Eastep.

- -

 

- + to at least one address in each of the following domains: + +
+
+ 
2020ca - delivery to this domain has been disabled (cause unknown)
arundel.homelinux.org - delivery to this domain has been disabled (connection timed out, connection refused)
excite.com - delivery to this domain has been disabled (cause unknown)
epacificglobal.com - delivery to this domain has been disabled (no MX record for domain)
familie-fleischhacker.de - (connection timed out)
gmx.net - delivery to this domain has been disabled (cause unknown)
hotmail.com - delivery to this domain has been disabled (Mailbox over quota)
intercom.net - delivery to this domain has been disabled (cause unknown)
ionsphere.org - (connection timed out)
initialcs.com - delivery to this domain has been disabled (cause unknown)
intelligents.2y.net - delivery to this domain has been disabled (Name Service Problem -- Host not Found).
khp-inc.com - delivery to this domain has been disabled (anti-virus problems)
kieninger.de - delivery to this domain has been disabled (relaying to <xxxxx@kieninger.de> prohibited by administrator)
littleblue.de - (connection timed out)
navair.navy.mil - delivery to this domain has been disabled (A restriction in the system prevented delivery of the message)
opermail.net - delivery to this domain has been disabled (cause unknown)
penquindevelopment.com - delivery to this domain has been disabled (connection timed out)
scip-online.de - delivery to this domain has been disabled (cause unknown)
spctnet.com - connection timed out - delivery to this domain has been disabled
telusplanet.net - delivery to this domain has been disabled (cause unknown)
yahoo.com - delivery to this domain has been disabled (Mailbox over quota)
+
+
+ +

Last updated 10/6/2002 20:30 GMT - Tom Eastep

+ +

Copyright © 2002 Thomas M. Eastep.

+ +

 

+
+
- - \ No newline at end of file + diff --git a/STABLE/documentation/myfiles.htm b/STABLE/documentation/myfiles.htm index 4a57eaecd..ed93a3856 100644 --- a/STABLE/documentation/myfiles.htm +++ b/STABLE/documentation/myfiles.htm @@ -1,133 +1,133 @@ - + My Shorewall Configuration - + - - + + - + - - - + + - - - + + + +
+

About My Network

-
- -
- -

My Current Network

-
-

I have DSL service and have 5 static IP addresses (206.124.146.176-180). - My DSL "modem" (Fujitsu Speedport) -is connected to eth0. I have a local network connected to eth2 (subnet 192.168.1.0/24) - and a DMZ connected to eth1 (192.168.2.0/24). 

+
+ +

My Current Network

+
+

I have DSL service and have 5 static IP addresses (206.124.146.176-180). + My DSL "modem" (Fujitsu Speedport) + is connected to eth0. I have a local network connected to eth2 (subnet 192.168.1.0/24) + and a DMZ connected to eth1 (192.168.2.0/24). 

+

I use:
-

- +

+
    -
  • Static NAT for ursa (my XP System) - Internal address 192.168.1.5 -and external address 206.124.146.178.
    • -
  • Proxy ARP for wookie (my Linux System). This system has two IP addresses: -192.168.1.3/24 and 206.124.146.179/24.
    • -
  • SNAT through the primary gateway address (206.124.146.176) for  +
  • Static NAT for ursa (my XP System) - Internal address 192.168.1.5 + and external address 206.124.146.178.
    • +
  • Proxy ARP for wookie (my Linux System). This system has two IP +addresses: 192.168.1.3/24 and 206.124.146.179/24.
    • +
  • SNAT through the primary gateway address (206.124.146.176) for  my Wife's system (tarry) and the Wireless Access Point (wap)
    • - +
- +

The firewall runs on a 128MB PII/233 with RH7.2 and Kernel 2.4.20-pre6.

- -

Wookie runs Samba and acts as the a WINS server.  Wookie is in its -own 'whitelist' zone called 'me'.

- -

My laptop (eastept1) is connected to eth3 using a cross-over cable. -It runs its own Sygate firewall software -and is managed by Proxy ARP. It connects to the local network through the -PopTop server running on my firewall.

- -

The single system in the DMZ (address 206.124.146.177) runs postfix, -Courier IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP server - (Pure-ftpd). The system also runs fetchmail to fetch our email from our + +

Wookie runs Samba and acts as the a WINS server.  Wookie is in its + own 'whitelist' zone called 'me'.

+ +

My laptop (eastept1) is connected to eth3 using a cross-over cable. + It runs its own Sygate firewall software + and is managed by Proxy ARP. It connects to the local network through the + PopTop server running on my firewall.

+ +

The single system in the DMZ (address 206.124.146.177) runs postfix, + Courier IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP server + (Pure-ftpd). The system also runs fetchmail to fetch our email from our old and current ISPs. That server is managed through Proxy ARP.

- -

The firewall system itself runs a DHCP server that serves the local - network.

- + +

The firewall system itself runs a DHCP server that serves the local + network.

+

All administration and publishing is done using ssh/scp.

- +

I run an SNMP server on my firewall to serve MRTG running -in the DMZ.

- + href="http://www.ee.ethz.ch/%7Eoetiker/webtools/mrtg/"> MRTG running + in the DMZ.

+

-

- +

+

 

+ +

The ethernet interface in the Server is configured + with IP address 206.124.146.177, netmask + 255.255.255.0. The server's default gateway is + 206.124.146.254 (Router at my ISP. This is the same + default gateway used by the firewall itself). On the firewall, + Shorewall automatically adds a host route to + 206.124.146.177 through eth1 (192.168.2.1) because + of the entry in /etc/shorewall/proxyarp (see below).

+ +

A similar setup is used on eth3 (192.168.3.1) which + interfaces to my laptop (206.124.146.180).

+ +

Note: My files + use features not available before Shorewall +version 1.3.4.

+
-

The ethernet interface in the Server is configured - with IP address 206.124.146.177, netmask - 255.255.255.0. The server's default gateway is - 206.124.146.254 (Router at my ISP. This is the same - default gateway used by the firewall itself). On the firewall, - Shorewall automatically adds a host route to - 206.124.146.177 through eth1 (192.168.2.1) because -of the entry in /etc/shorewall/proxyarp (see below).

- -

A similar setup is used on eth3 (192.168.3.1) which - interfaces to my laptop (206.124.146.180).

- -

Note: My files - use features not available before Shorewall version -1.3.4.

-
-

Shorewall.conf

- + 
	SUBSYSLOCK=/var/lock/subsys/shorewall
	STATEDIR=/var/state/shorewall

	LOGRATE=
	LOGBURST=

	ADD_IP_ALIASES="Yes"

	CLAMPMSS=Yes

	MULTIPORT=Yes
- +

Zones File:

- + 
	#ZONE 	DISPLAY 	COMMENTS
	net	Internet	Internet
	me	Eastep		My Workstation
	loc	Local		Local networks
	dmz	DMZ		Demilitarized zone
	tx	Texas		Peer Network in Dallas Texas
	#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
- +

Interfaces File:

- -
-

This is set up so that I can start the firewall before bringing up my -Ethernet interfaces.

-
- + +
+

This is set up so that I can start the firewall before bringing up +my Ethernet interfaces.

+
+ 
	#ZONE    INTERFACE	BROADCAST 	OPTIONS
	net	eth0 		206.124.146.255	routefilter,norfc1918,blacklist,filterping
	loc	eth2 		192.168.1.255	dhcp
	dmz	eth1 		206.124.146.255	-
	net	eth3		206.124.146.255 norfc1918
	-	texas 		-
	loc	ppp+
	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
- +

Hosts File:

- + 
	#ZONE 		HOST(S)			OPTIONS
	me		eth2:192.168.1.3,eth2:206.124.146.179
	tx 		texas:192.168.9.0/24
	#LAST LINE -- ADD YOUR ENTRIES ABOVE -- DO NOT REMOVE
- +

Routestopped File:

- + 
	#INTERFACE	HOST(S)
	eth1		206.124.146.177
	eth2 		-
	eth3 		206.124.146.180
- +

Common File:

- + 
	. /etc/shorewall/common.def
	run_iptables -A common -p udp --sport 53 -mstate --state NEW -j DROP
	run_iptables -A common -p tcp --dport 113 -j REJECT
- +

Policy File:

- + 

 	#SOURCE	DEST	POLICY	LOG LEVEL	LIMIT:BURST
 	me	all	ACCEPT
@@ -135,34 +135,38 @@ Ethernet  interfaces. 

 	all	me	CONTINUE	#WARNING: You must be running Shorewall 1.3.1 or later for
					#	  this policy to work as expected!!!	
	loc 	loc 	ACCEPT
	loc 	net	ACCEPT
	$FW	loc	ACCEPT
	$FW	tx	ACCEPT
	loc	tx	ACCEPT
	loc	fw	REJECT
	net	net	ACCEPT
	net	all	DROP	info		10/sec:40
	all	all	REJECT	info
	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOTE
- +

Masq File:

- -
-

Although most of our internal systems use static NAT, my wife's system - (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with laptops.

-
+ +
+

Although most of our internal systems use static NAT, my wife's system + (192.168.1.4) uses IP Masquerading (actually SNAT) as do visitors with +laptops. Also, I masquerade wookie to the peer subnet in Texas.

+
+ +
	#INTERFACE 	SUBNET		ADDRESS
	eth0 		192.168.1.0/24	206.124.146.176
        texas           206.124.146.179 192.168.1.254
	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-
	#INTERFACE 	SUBNET		ADDRESS
	eth0 		192.168.1.0/24	206.124.146.176
	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-

NAT File:

- -
	#EXTERNAL	INTERFACE	INTERNAL	ALL	LOCAL
	206.124.146.178 eth0 		192.168.1.5 	No 	No
	206.124.146.179 eth0 		192.168.1.3 	No 	No
	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
- -

Proxy ARP File:

- -
     	#ADDRESS	INTERFACE	EXTERNAL	HAVEROUTE
	206.124.146.177 eth1 		eth0 		No
	206.124.146.180	eth3		eth0		No
	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
- -

Rules File (The shell variables - are set in /etc/shorewall/params):

+
	#EXTERNAL	INTERFACE	INTERNAL	ALL	LOCAL
	206.124.146.178 eth0 		192.168.1.5 	No 	No
	206.124.146.179 eth0 		192.168.1.3 	No 	No
	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
+ +

Proxy ARP File:

+ +
     	#ADDRESS	INTERFACE	EXTERNAL	HAVEROUTE
	206.124.146.177 eth1 		eth0 		No
	206.124.146.180	eth3		eth0		No
        206.124.146.179 eth2            eth0            No
	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
+ +

Rules File (The shell variables + are set in /etc/shorewall/params):

+ 
     	#ACTION		SOURCE 		DEST 			PROTO	DEST 	SOURCE  ORIGINAL
	#                       				PORT(S) PORT(S)	PORT(S)	DEST
	#
	# Local Network to Internet - Reject attempts by Trojans to call home
	#
	REJECT:info 	loc 		net 			tcp	6667
	#
	# Local Network to Firewall 
	#
	ACCEPT		loc		fw 			tcp 	ssh
	ACCEPT		loc		fw			tcp	time
	#
	# Local Network to DMZ 
	#
	ACCEPT 		loc 		dmz 			udp	domain
	ACCEPT		loc		dmz			tcp	smtp
	ACCEPT		loc		dmz			tcp	domain
	ACCEPT		loc		dmz			tcp	ssh
	ACCEPT		loc		dmz			tcp	auth
	ACCEPT		loc		dmz			tcp	imap
	ACCEPT		loc		dmz			tcp	https
	ACCEPT		loc		dmz			tcp	imaps
	ACCEPT		loc		dmz			tcp	cvspserver
	ACCEPT 		loc 		dmz 			tcp 	www
	ACCEPT		loc		dmz			tcp	ftp
	ACCEPT		loc		dmz			tcp	pop3
	ACCEPT		loc		dmz			icmp	echo-request
	#
	# Internet to DMZ 
	#
	ACCEPT		net		dmz 			tcp	www
	ACCEPT		net		dmz			tcp	smtp
	ACCEPT		net		dmz			tcp	ftp
	ACCEPT		net		dmz			tcp	auth
	ACCEPT		net		dmz			tcp	https
	ACCEPT		net		dmz			tcp	imaps
	ACCEPT		net		dmz			tcp	domain
	ACCEPT		net		dmz			tcp	cvspserver
	ACCEPT		net		dmz			udp	domain
	ACCEPT		net		dmz			icmp	echo-request
	ACCEPT 		net:$MIRRORS	dmz			tcp	rsync
	#
	# Net to Me (ICQ chat and file transfers) 
	#
	ACCEPT		net		me			tcp	4000:4100
	#
	# Net to Local 
	#
	ACCEPT		net		loc			tcp	auth
	REJECT		net		loc			tcp	www
	#
	# DMZ to Internet
	#
	ACCEPT		dmz		net			icmp	echo-request
	ACCEPT		dmz		net			tcp	smtp
	ACCEPT		dmz		net			tcp	auth
	ACCEPT		dmz		net			tcp	domain
	ACCEPT		dmz		net			tcp	www
	ACCEPT		dmz		net			tcp	https
	ACCEPT		dmz		net			tcp	whois
	ACCEPT		dmz		net			tcp	echo
	ACCEPT		dmz		net			udp	domain
	ACCEPT		dmz 		net:$NTPSERVERS		udp	ntp
	ACCEPT 		dmz 		net:$POPSERVERS		tcp	pop3
	#
	# The following compensates for a bug, either in some FTP clients or in the
	# Netfilter connection tracking code that occasionally denies active mode
	# FTP clients
	#
	ACCEPT:info 	dmz 		net			tcp	1024:	20
	#
	# DMZ to Firewall -- snmp
	#
	ACCEPT 		dmz 		fw 			tcp	snmp
	ACCEPT		dmz		fw			udp	snmp
	#
	# DMZ to Local Network 
	#
	ACCEPT 		dmz 		loc			tcp	smtp
	ACCEPT		dmz		loc			tcp	auth
	ACCEPT		dmz		loc			icmp	echo-request
	# Internet to Firewall
	#
	ACCEPT		net		fw			tcp	1723
	ACCEPT		net		fw			gre
	REJECT 		net		fw			tcp	www
	#
	# Firewall to Internet
	#
	ACCEPT 		fw 		net:$NTPSERVERS		udp	ntp
	ACCEPT		fw		net			udp	domain
	ACCEPT		fw		net			tcp	domain
	ACCEPT		fw		net			tcp	www
	ACCEPT		fw		net			tcp	https
	ACCEPT		fw		net			tcp	ssh
	ACCEPT		fw		net			tcp	whois
	ACCEPT		fw		net 			icmp	echo-request
	#
	# Firewall to DMZ
	#
	ACCEPT 		fw 		dmz 			tcp 	www
	ACCEPT 		fw 		dmz 			tcp 	ftp
	ACCEPT 		fw 		dmz 			tcp 	ssh
	ACCEPT 		fw 		dmz 			tcp 	smtp
	ACCEPT 		fw 		dmz 			udp 	domain
	#
	# Let Texas Ping
	#
	ACCEPT 		tx 		fw 			icmp 	echo-request
	ACCEPT		tx 		loc 			icmp 	echo-request

	#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
- -

Last updated 9/19/2002 - - Tom Eastep + +

Last updated 10/1/2002 - + Tom Eastep

- Copyright - © 2001, 2002 Thomas M. Eastep.
+ Copyright + © 2001, 2002 Thomas M. Eastep.
+

diff --git a/STABLE/documentation/quotes.htm b/STABLE/documentation/quotes.htm index 9144c69cd..452dd5537 100644 --- a/STABLE/documentation/quotes.htm +++ b/STABLE/documentation/quotes.htm @@ -1,101 +1,104 @@ - + - + - + - + Quotes from Shorewall Users - + - - - + + - - - + + + +
+

Quotes from Shorewall Users

-
- -

"I just installed Shorewall after weeks of messing with ipchains/iptables + +

"I just installed Shorewall after weeks of messing with ipchains/iptables and I had it up and running in under 20 minutes!" -- JL, Ohio
-

-"My case was almost like [the one above]. Well. instead of 'weeks' it was +

+ "My case was almost like [the one above]. Well. instead of 'weeks' it was 'months' for me, and I think I needed two minutes more:
+
    -
  • One to see that I had no Internet access from the firewall itself.
    • -
  • Other to see that this was the default configuration, and it was enough +
  • One to see that I had no Internet access from the firewall itself.
    • +
  • Other to see that this was the default configuration, and it was enough to uncomment a line in /etc/shorewall/policy.
    -
    • + +
-Minutes instead of months! Congratulations and thanks for such a simple and -well documented thing for something as huge as iptables." -- JV, Spain. - -

"I downloaded Shorewall 1.2.0 and installed it on Mandrake 8.1 without -any problems. Your documentation is great and I really appreciate your -network configuration info. That really helped me out alot. THANKS!!!" + Minutes instead of months! Congratulations and thanks for such a simple +and well documented thing for something as huge as iptables." -- JV, Spain. + +

"I downloaded Shorewall 1.2.0 and installed it on Mandrake 8.1 without +any problems. Your documentation is great and I really appreciate your +network configuration info. That really helped me out alot. THANKS!!!" -- MM.

- -

"[Shorewall is a] great, great project. I've used/tested may firewall -scripts but this one is till now the best." -- B.R, Netherlands -

- -

"Never in my +12 year career as a sys admin have I witnessed someone -so relentless in developing a secure, state of the art, save and useful -product as the Shorewall firewall package for no cost or obligation - involved." -- Mario Kericki, Toronto

- -

"one time more to report, that your great shorewall in the latest - release 1.2.9 is working fine for me with SuSE Linux 7.3! I now -have 7 machines up and running with shorewall on several versions - -starting with 1.2.2 up to the new 1.2.9 and I never have encountered -any problems!" -- SM, Germany

- -

"You have the best support of any other package I've ever used." + +

"[Shorewall is a] great, great project. I've used/tested may firewall +scripts but this one is till now the best." -- B.R, Netherlands +

+ +

"Never in my +12 year career as a sys admin have I witnessed someone +so relentless in developing a secure, state of the art, safe and useful +product as the Shorewall firewall package for no cost or obligation +involved." -- Mario Kerecki, Toronto

+ +

"one time more to report, that your great shorewall in the latest + release 1.2.9 is working fine for me with SuSE Linux 7.3! I now have +7 machines up and running with shorewall on several versions - starting +with 1.2.2 up to the new 1.2.9 and I never have encountered any problems!" +-- SM, Germany

+ +

"You have the best support of any other package I've ever used." -- SE, US

- -

"Because our company has information which has been classified by the - national government as secret, our security doesn't stop by putting a fence - around our company. Information security is a hot issue. We also make use -of checkpoint firewalls, but not all of the internet servers are guarded -by checkpoint, some of them are running....Shorewall." -- Name withheld -by request, Europe

- -

"thanx for all your efforts you put into shorewall - this product stands -out against a lot of commercial stuff i´ve been working with in terms of + +

"Because our company has information which has been classified by the +national government as secret, our security doesn't stop by putting a fence + around our company. Information security is a hot issue. We also make use +of checkpoint firewalls, but not all of the internet servers are guarded +by checkpoint, some of them are running....Shorewall." -- Name withheld by +request, Europe

+ +

"thanx for all your efforts you put into shorewall - this product stands +out against a lot of commercial stuff i´ve been working with in terms of flexibillity, quality & support" -- RM, Austria

- -

"I have never seen such a complete firewall package that is so easy to - configure. I searched the Debian package system for firewall scripts and + +

"I have never seen such a complete firewall package that is so easy to + configure. I searched the Debian package system for firewall scripts and Shorewall won hands down." -- RG, Toronto

- -

"My respects... I've just found and installed Shorewall 1.3.3-1 and it -is a wonderful piece of software. I've just sent out an email to about 30 + +

"My respects... I've just found and installed Shorewall 1.3.3-1 and it +is a wonderful piece of software. I've just sent out an email to about 30 people recommending it. :-)
- While I had previously taken the time (maybe 40 hours) to really understand - ipchains, then spent at least an hour per server customizing and carefully - scrutinizing firewall rules, I've got shorewall running on my home firewall, - with rulesets and policies that I know make sense, in under 20 minutes." + While I had previously taken the time (maybe 40 hours) to really understand + ipchains, then spent at least an hour per server customizing and carefully + scrutinizing firewall rules, I've got shorewall running on my home firewall, + with rulesets and policies that I know make sense, in under 20 minutes." -- RP, Guatamala
-
-  

- -

Updated 9/24/2002 -- Tom Eastep -

- -

Copyright - © 2001, 2002 Thomas M. Eastep.


+  

+ +

Updated 10/9/2002 +- Tom Eastep +

+ +

Copyright + © 2001, 2002 Thomas M. Eastep.

+
+
diff --git a/STABLE/documentation/seattlefirewall_index.htm b/STABLE/documentation/seattlefirewall_index.htm index 641ace03e..1a87a34cc 100644 --- a/STABLE/documentation/seattlefirewall_index.htm +++ b/STABLE/documentation/seattlefirewall_index.htm @@ -2,299 +2,362 @@ - + Shoreline Firewall (Shorewall) 1.3 - + - + - - - + + - + +
+ + - - + +
+
- + +

Shorwall Logo - Shorewall 1.3 - - "iptables made easy"

+ Shorewall + 1.3 - "iptables made easy" - + -
-
- -
-
+ +
+
- - - + + - - + - - + +
+
+

What is it?

- -

The Shoreline Firewall, more commonly known as "Shorewall", is -a Netfilter (iptables) based -firewall that can be used on a dedicated firewall system, a multi-function - gateway/router/server or on a standalone GNU/Linux system.

+ + +

The Shoreline Firewall, more commonly known as "Shorewall", is a + Netfilter (iptables) based firewall + that can be used on a dedicated firewall system, a multi-function + gateway/router/server or on a standalone GNU/Linux system.

- -

This program is free software; you can redistribute it and/or modify - it under the terms of Version 2 of the GNU -General Public License as published by the Free Software Foundation.
-
- This program is distributed in the hope that -it will be useful, but WITHOUT ANY WARRANTY; without even the - implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR - PURPOSE. See the GNU General Public License for more details.
-
- You should have received a copy of the GNU General - Public License along with this program; if not, write to the - Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA -02139, USA

+ + +

This program is free software; you can redistribute it and/or modify + it under the terms of Version 2 of the GNU General +Public License as published by the Free Software Foundation.
+
+ This program is distributed in the hope + that it will be useful, but WITHOUT ANY WARRANTY; without + even the implied warranty of MERCHANTABILITY or FITNESS FOR + A PARTICULAR PURPOSE. See the GNU General Public License for + more details.
+
+ You should have received a copy of the + GNU General Public License along with this program; if +not, write to the Free Software Foundation, Inc., 675 Mass +Ave, Cambridge, MA 02139, USA

- + +

Copyright 2001, 2002 Thomas M. Eastep

- + +

- Jacques Nilo and Eric Wolzak have a LEAF - distribution called Bering that features Shorewall-1.3.3 - and Kernel-2.4.18. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

+ Jacques Nilo and Eric Wolzak have + a LEAF distribution called Bering that features + Shorewall-1.3.3 and Kernel-2.4.18. You can find their work at: + http://leaf.sourceforge.net/devel/jnilo

- + +

News

+ + +

+ +

10/9/2002 - Shorewall 1.3.9b (New) +

+This release rolls up fixes to the installer and to the firewall script.
+
+10/6/2002 - Shorewall.net now running on RH8.0 (New) +
+
+ The firewall and server here at shorewall.net are now running RedHat release + 8.0.
-

9/30/2002 - Shorewall 1.3.9a (New) -

- Roles up the fix for broken tunnels.
- -

9/30/2002 - TUNNELS Broken in 1.3.9!!! (New) -

-There is an updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall --- copy that file to /usr/lib/shorewall/firewall.
-

9/28/2002 - Shorewall 1.3.9 (New) -

- -

In this version:
-

- -
    -
  • DNS Names - are now allowed in Shorewall config files (although I recommend against -using them).
    • -
  • The connection SOURCE may now be qualified by both interface - and IP address in a Shorewall rule.
    • -
  • Shorewall startup is now disabled after initial installation - until the file /etc/shorewall/startup_disabled is removed. This avoids nasty - surprises at reboot for users who install Shorewall but don't configure -it.
    • -
  • The 'functions' and 'version' files and the 'firewall' symbolic - link have been moved from /var/lib/shorewall to /usr/lib/shorewall to appease - the LFS police at Debian.
    -
    • - -
- -

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
-

+

9/30/2002 - Shorewall 1.3.9a +

+ Roles up the fix for broken tunnels.
+ +

9/30/2002 - TUNNELS Broken in 1.3.9!!! +

Brown Paper Bag - A couple of recent configuration changes at www.shorewall.net broke - the Search facility:
- -
+ There is an updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall + -- copy that file to /usr/lib/shorewall/firewall.
+ +


+

+ +


+

+ +


+ 9/28/2002 - Shorewall 1.3.9 

+ + +

In this version:
+

+ + +
    +
  • DNS + Names are now allowed in Shorewall config files (although I recommend + against using them).
    • +
  • The connection SOURCE may now be qualified by both + interface and IP address in a Shorewall + rule.
    • +
  • Shorewall startup is now disabled after initial installation + until the file /etc/shorewall/startup_disabled is removed. This avoids + nasty surprises at reboot for users who install Shorewall but don't +configure it.
    • +
  • The 'functions' and 'version' files and the 'firewall' + symbolic link have been moved from /var/lib/shorewall to /usr/lib/shorewall + to appease the LFS police at Debian.
    +
    • + + +
+ + +

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
+

+ Brown Paper Bag + A couple of recent configuration changes at www.shorewall.net + broke the Search facility:
+ + +
+
    -
  1. Mailing List Archive Search was not available.
    2. -
  2. The Site Search index was incomplete
    3. -
  3. Only one page of matches was presented.
    4. +
  4. Mailing List Archive Search was not available.
    5. +
  5. The Site Search index was incomplete
    6. +
  6. Only one page of matches was presented.
    7. + -
-
- Hopefully these problems are now corrected. - -

9/18/2002 - Debian 1.3.8 Packages Available  -
-

+
+ Hopefully these problems are now corrected. - + +

9/18/2002 - Debian 1.3.8 Packages Available  +
+

+ + +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html

- - + + +

9/16/2002 - Shorewall 1.3.8

- + +

In this version:
-

+

- + +
    -
  • A NEWNOTSYN option has been added to shorewall.conf. - This option determines whether Shorewall accepts TCP packets which - are not part of an established connection and that are not 'SYN' packets - (SYN flag on and ACK flag off).
    • -
  • The need for the 'multi' option to communicate - between zones za and zb on the same interface is removed in the -case where the chain 'za2zb' and/or 'zb2za' exists. 'za2zb' will exist -if: +
  • A NEWNOTSYN option has been added to +shorewall.conf. This option determines whether Shorewall accepts +TCP packets which are not part of an established connection and +that are not 'SYN' packets (SYN flag on and ACK flag off).
    • +
  • The need for the 'multi' option to communicate + between zones za and zb on the same interface is removed in the + case where the chain 'za2zb' and/or 'zb2za' exists. 'za2zb' will +exist if: - + +
      -
    • There is a policy for za to zb; or
      • -
    • There is at least one rule for za to zb. -
      • +
    • There is a policy for za to zb; or
      • +
    • There is at least one rule for za +to zb.
      • - + +
    -
    • + - + +
- + +
    -
  • The /etc/shorewall/blacklist file now contains - three columns. In addition to the SUBNET/ADDRESS column, there are - optional PROTOCOL and PORT columns to block only certain applications - from the blacklisted addresses.
    -
    • +
  • The /etc/shorewall/blacklist file now + contains three columns. In addition to the SUBNET/ADDRESS column, + there are optional PROTOCOL and PORT columns to block only certain + applications from the blacklisted addresses.
    +
    • - + +
- + +

9/11/2002 - Debian 1.3.7c Packages Available

- + +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- + +

9/2/2002 - Shorewall 1.3.7c

- -

This is a role up of a fix for "DNAT" rules where the source zone - is $FW (fw).

+ + +

This is a role up of a fix for "DNAT" rules where the source zone + is $FW (fw).

- + +

8/26/2002 - Shorewall 1.3.7b

- -

This is a role up of the "shorewall refresh" bug fix and the change - which reverses the order of "dhcp" and "norfc1918" checking.

+ + +

This is a role up of the "shorewall refresh" bug fix and the change + which reverses the order of "dhcp" and "norfc1918" checking.

- + +

8/26/2002 - French FTP Mirror is Operational

- + +

ftp://france.shorewall.net/pub/mirrors/shorewall - is now available.

+ href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall + is now available.

- + +

8/25/2002 - Shorewall Mirror in France

- -

Thanks to a Shorewall user in Paris, the Shorewall web site is now - mirrored at Thanks to a Shorewall user in Paris, the Shorewall web site is now + mirrored at http://france.shorewall.net.

- + +

More News

- + +

Donations

- 		+ M
-
-
- +
+
+ + - - - + + - + + - - + +
+
+ - +

-  

+  

- -

Shorewall is free -but if you try it and find it useful, please consider making a donation - to Shorewall is free but +if you try it and find it useful, please consider making a donation + to Starlight Children's Foundation. Thanks!

-
- -

Updated 9/30/2002 - Tom Eastep - + + +

Updated 10/9/2002 - Tom Eastep + +
+


-

diff --git a/STABLE/documentation/shoreline.htm b/STABLE/documentation/shoreline.htm index d6cf381a9..51c72836f 100644 --- a/STABLE/documentation/shoreline.htm +++ b/STABLE/documentation/shoreline.htm @@ -1,111 +1,115 @@ - + About the Shorewall Author - + - + - + - + - - - + + - - - + + + +
+

Tom Eastep

-
- +

Tom on the PCT - 1991 -

- -

Tom on the Pacific Crest Trail north of Stevens Pass, - Washington  -- Sept 1991.
- Photo by Ken Mazawa

- +

+ +

Tom on the Pacific Crest Trail north of Stevens Pass, + Washington  -- Sept 1991.
+ Photo by Ken Mazawa

+ - -

I am currently a member of the design team for the next-generation - operating system from the NonStop Enterprise Division of HP.

- -

I became interested in Internet Security when I established a home office -in 1999 and had DSL service installed in our home. I investigated ipchains -and developed the scripts which are now collectively known as Seattle Firewall. Expanding -on what I learned from Seattle Firewall, I then designed and wrote + +

I am currently a member of the design team for the next-generation + operating system from the NonStop Enterprise Division of HP.

+ +

I became interested in Internet Security when I established a home office + in 1999 and had DSL service installed in our home. I investigated ipchains + and developed the scripts which are now collectively known as Seattle Firewall. Expanding + on what I learned from Seattle Firewall, I then designed and wrote Shorewall.

- -

I telework from our home in Shoreline, - Washington where I live with my wife Tarry.

- + +

I telework from our home in Shoreline, + Washington where I live with my wife Tarry.

+

Our current home network consists of:

- +
    -
  • 1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB & 8GB IDE HDs -and LNE100TX (Tulip) NIC - My personal Windows system.
    • -
  • Celeron 1.4Gz, RH7.3, 384MB RAM, 60GB HD, LNE100TX(Tulip) NIC - -My personal Linux System which runs Samba configured as a WINS server. -This system also has VMware installed -and can run both Debian and +
  • 1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB & 8GB IDE HDs + and LNE100TX (Tulip) NIC - My personal Windows system. Also has SuSE + 8.0 installed.
    • +
  • Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, LNE100TX(Tulip) NIC +- My personal Linux System which runs Samba configured as a WINS server. + This system also has VMware installed + and can run both Debian and SuSE in virtual machines.
    • -
  • K6-2/350, RH7.3, 384MB RAM, 8GB IDE HD, EEPRO100 NIC  - Mail (Postfix -& Courier-IMAP), HTTP (Apache), FTP (Pure_ftpd), DNS server (Bind).
    • -
  • PII/233, RH7.3 with 2.4.20-pre6 kernel, 256MB MB RAM, 2GB SCSI HD -- 3 LNE100TX  (Tulip) and 1 TLAN NICs  - Firewall running Shorewall -1.3.9 (Yep -- I run them before I release them) and a DHCP server.  Also - runs PoPToP for road warrior access.
    • -
  • Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139 NIC - My wife's - personal system.
    • -
  • PII/400 Laptop, Win2k SP2, 224MB RAM, 12GB HD, onboard EEPRO100 -and EEPRO100 in expansion base and LinkSys WAC11 - My main work system.
    • - -
- -

For more about our network see my Shorewall Configuration.

+
  • K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100 NIC  - Mail +(Postfix & Courier-IMAP), HTTP (Apache), FTP (Pure_ftpd), DNS server + (Bind).
    • +
  • PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD - 3 LNE100TX  +(Tulip) and 1 TLAN NICs  - Firewall running Shorewall 1.3.9a  and a DHCP + server.  Also runs PoPToP for road warrior access.
    • +
  • Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139 NIC - My wife's + personal system.
    • +
  • PII/400 Laptop, Win2k SP2, 224MB RAM, 12GB HD, onboard EEPRO100 + and EEPRO100 in expansion base and LinkSys WAC11 - My main work system.
    • + + +

    For more about our network see my Shorewall Configuration.

    +

    All of our other systems are made by Compaq (part of the new HP).. All of our Tulip NICs are Netgear FA310TXs.

    - +

    - - - -

    - -

    Last updated 9/19/2002 -

    + +

    Last updated 10/6/2002 - Tom Eastep

    - Copyright - © 2001, 2002 Thomas M. Eastep.
    + Copyright + © 2001, 2002 Thomas M. Eastep.
    +
    +
    +
    diff --git a/STABLE/documentation/shorewall_quickstart_guide.htm b/STABLE/documentation/shorewall_quickstart_guide.htm index 1ba0675b0..f3c896786 100644 --- a/STABLE/documentation/shorewall_quickstart_guide.htm +++ b/STABLE/documentation/shorewall_quickstart_guide.htm @@ -1,209 +1,211 @@ - + - + - + - + Shorewall QuickStart Guide - + - + - - - + + - - - + Version 3.1 + + + +
    +

    Shorewall QuickStart Guides
    - Version 3.1

    -
    - -

    With thanks to Richard who reminded me once again that we -must all first walk before we can run.

    - + +

    With thanks to Richard who reminded me once again that +we must all first walk before we can run.

    +

    The Guides

    - -

    These guides provide step-by-step instructions for configuring Shorewall -in common firewall setups.

    - + +

    These guides provide step-by-step instructions for configuring Shorewall + in common firewall setups.

    +

    The following guides are for users who have a single public IP address:

    - +
      -
    • Standalone Linux System
      • -
    • Two-interface Linux System acting -as a firewall/router for a small local network
      • -
    • Three-interface Linux System acting -as a firewall/router for a small local network and a DMZ.
      • - +
    • Standalone Linux System
      • +
    • Two-interface Linux System acting + as a firewall/router for a small local network
      • +
    • Three-interface Linux System acting + as a firewall/router for a small local network and a DMZ.
      • +
    - -

    The above guides are designed to get your first firewall up and running - quickly in the three most common Shorewall configurations.

    - -

    The Shorewall Setup Guide outlines - the steps necessary to set up a firewall where there are multiple public -IP addresses involved or if you want to learn more about Shorewall than is - explained in the single-address guides above.

    - + +

    The above guides are designed to get your first firewall up and running + quickly in the three most common Shorewall configurations.

    + +

    The Shorewall Setup Guide outlines + the steps necessary to set up a firewall where there are multiple public + IP addresses involved or if you want to learn more about Shorewall than +is explained in the single-address guides above.

    +
      -
    • 1.0 Introduction
      • -
    • 2.0 Shorewall Concepts
      • -
    • 3.0 Network Interfaces
      • -
    • 4.0 Addressing, Subnets -and Routing +
    • 1.0 Introduction
      • +
    • 2.0 Shorewall Concepts
      • +
    • 3.0 Network Interfaces
      • +
    • 4.0 Addressing, Subnets + and Routing - - -
      • -
    • 5.0 Setting up your Network - - - - - +

      Additional Documentation

      - -

      The following documentation covers a variety of topics and supplements -the QuickStart Guides described -above.

      - + +

      The following documentation covers a variety of topics and supplements + the QuickStart Guides described + above. Please review the appropriate guide before trying to use this documentation +directly.

      + - +

      If you use one of these guides and have a suggestion for improvement please let me know.

      - -

      Last modified 9/16/2002 - Last modified 10/5/2002 - Tom Eastep

      - +

      Copyright 2002 Thomas M. Eastep

      -
      +
      +

      diff --git a/STABLE/documentation/two-interface.htm b/STABLE/documentation/two-interface.htm index c3ede11b8..d5b723f73 100644 --- a/STABLE/documentation/two-interface.htm +++ b/STABLE/documentation/two-interface.htm @@ -1,917 +1,920 @@ - + - + - + - + Two-Interface Firewall - + - + - - - + + - - - + + + +
      +

      Basic Two-Interface Firewall

      -
      - -

      Setting up a Linux system as a firewall for a small network - is a fairly straight-forward task if you understand the basics and follow - the documentation.

      - -

      This guide doesn't attempt to acquaint you with all of the features of - Shorewall. It rather focuses on what is required to configure Shorewall -in its most common configuration:

      - + +

      Setting up a Linux system as a firewall for a small network + is a fairly straight-forward task if you understand the basics and follow + the documentation.

      + +

      This guide doesn't attempt to acquaint you with all of the features of + Shorewall. It rather focuses on what is required to configure Shorewall + in its most common configuration:

      +
        -
      • Linux system used as a firewall/router for a small local network.
        • -
      • Single public IP address.
        • -
      • Internet connection through cable modem, DSL, ISDN, Frame Relay, +
      • Linux system used as a firewall/router for a small local network.
        • +
      • Single public IP address.
        • +
      • Internet connection through cable modem, DSL, ISDN, Frame Relay, dial-up ...
        • - +
      - +

      Here is a schematic of a typical installation.

      - +

      -

      - -

      This guide assumes that you have the iproute/iproute2 package installed - (on RedHat, the package is called iproute). You can tell if - this package is installed by the presence of an ip program on your - firewall system. As root, you can use the 'which' command to check for -this program:

      - +

      + +

      This guide assumes that you have the iproute/iproute2 package installed + (on RedHat, the package is called iproute). You can tell +if this package is installed by the presence of an ip program on +your firewall system. As root, you can use the 'which' command to check +for this program:

      + 
           [root@gateway root]# which ip
           /sbin/ip
           [root@gateway root]#
      - -

      I recommend that you first read through the guide to familiarize yourself - with what's involved then go back through it again making your configuration - changes. Points at which configuration changes are recommended are flagged - with - .

      +

      I recommend that you first read through the guide to familiarize yourself + with what's involved then go back through it again making your configuration + changes. Points at which configuration changes are recommended are flagged + with + .

      +

      -     If you edit your configuration files on a Windows system, you must - save them as Unix files if your editor supports that option or you must -run them through dos2unix before trying to use them. Similarly, if you copy -a configuration file from your Windows hard drive to a floppy disk, you -must run dos2unix against the copy before using it with Shorewall.

      - +     If you edit your configuration files on a Windows system, you must + save them as Unix files if your editor supports that option or you must +run them through dos2unix before trying to use them. Similarly, if you copy +a configuration file from your Windows hard drive to a floppy disk, you must +run dos2unix against the copy before using it with Shorewall.

      + - +

      Shorewall Concepts

      - -

      The configuration files for Shorewall are contained in the directory -/etc/shorewall -- for simple setups, you will only need to deal with a few -of these as described in this guide. After you have installed Shorewall, download the two-interface sample, - un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall - (these files will replace files with the same name).

      - -

      As each file is introduced, I suggest that you look through the actual - file on your system -- each file contains detailed configuration instructions - and default entries.

      - -

      Shorewall views the network where it is running as being composed of a - set of zones. In the two-interface sample configuration, the following - zone names are used:

      - + +

      The configuration files for Shorewall are contained in the directory /etc/shorewall +-- for simple setups, you will only need to deal with a few of these as +described in this guide. After you have installed +Shorewall, download the two-interface sample, + un-tar it (tar -zxvf two-interfaces.tgz) and and copy the files to /etc/shorewall + (these files will replace files with the same name).

      + +

      As each file is introduced, I suggest that you look through the actual + file on your system -- each file contains detailed configuration instructions + and default entries.

      + +

      Shorewall views the network where it is running as being composed of a + set of zones. In the two-interface sample configuration, the following + zone names are used:

      + - + + + + + - - - - - - - - - - - - - + + + + + + + + +
      NameDescription
      NameDescription
      netThe Internet
      locYour Local Network
      netThe Internet
      locYour Local Network
      - -

      Zones are defined in the /etc/shorewall/zones - file.

      - -

      Shorewall also recognizes the firewall system as its own zone - by default, - the firewall itself is known as fw.

      - -

      Rules about what traffic to allow and what traffic to deny are expressed - in terms of zones.

      - + +

      Zones are defined in the /etc/shorewall/zones + file.

      + +

      Shorewall also recognizes the firewall system as its own zone - by default, + the firewall itself is known as fw.

      + +

      Rules about what traffic to allow and what traffic to deny are expressed + in terms of zones.

      + - -

      For each connection request entering the firewall, the request is first - checked against the /etc/shorewall/rules file. If no rule in that file matches - the connection request then the first policy in /etc/shorewall/policy that - matches the request is applied. If that policy is REJECT or DROP  the -request is first checked against the rules in /etc/shorewall/common (the -samples provide that file for you).

      - -

      The /etc/shorewall/policy file included with the two-interface sample has -the following policies:

      - -
      + +

      For each connection request entering the firewall, the request is first + checked against the /etc/shorewall/rules file. If no rule in that file +matches the connection request then the first policy in /etc/shorewall/policy +that matches the request is applied. If that policy is REJECT or DROP  +the request is first checked against the rules in /etc/shorewall/common +(the samples provide that file for you).

      + +

      The /etc/shorewall/policy file included with the two-interface sample +has the following policies:

      + +
      - + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + +
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      locnetACCEPT  
      netallDROPinfo 
      allallREJECTinfo 
      locnetACCEPT  
      netallDROPinfo 
      allallREJECTinfo 
      -
      - -
      -

      In the two-interface sample, the line below is included but commented - out. If you want your firewall system to have full access to servers on -the internet, uncomment that line.

      - +
      + +
      +

      In the two-interface sample, the line below is included but commented + out. If you want your firewall system to have full access to servers on + the internet, uncomment that line.

      + - + + + + + + + + - - - - - - - - - - - - - - - + + + + + + + +
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      Source ZoneDestination ZonePolicyLog LevelLimit:Burst
      fwnetACCEPT  
      fwnetACCEPT  
      -
      - +
      +

      The above policy will:

      - +
        -
      1. allow all connection requests from your local network to the internet
        2. -
      2. drop (ignore) all connection requests from the internet to your -firewall or local network
        3. -
      3. optionally accept all connection requests from the firewall to +
      4. allow all connection requests from your local network to the internet
        5. +
      5. drop (ignore) all connection requests from the internet to your + firewall or local network
        6. +
      6. optionally accept all connection requests from the firewall to the internet (if you uncomment the additional policy)
        7. -
      7. reject all other connection requests.
        8. - +
      8. reject all other connection requests.
        9. +
      - +

      -     At this point, edit your /etc/shorewall/policy and make any changes +     At this point, edit your /etc/shorewall/policy and make any changes that you wish.

      - +

      Network Interfaces

      - +

      -

      - -

      The firewall has two network interfaces. Where Internet -connectivity is through a cable or DSL "Modem", the External Interface - will be the ethernet adapter that is connected to that "Modem" (e.g., eth0)  - unless you connect via Point-to-Point Protocol - over Ethernet (PPPoE) or Point-to-Point Tunneling - Protocol (PPTP) in which case the External Interface will be -a ppp interface (e.g., ppp0). If you connect via a regular modem, -your External Interface will also be ppp0. If you connect via ISDN, +

      + +

      The firewall has two network interfaces. Where Internet connectivity +is through a cable or DSL "Modem", the External Interface will be +the ethernet adapter that is connected to that "Modem" (e.g., eth0)  + unless you connect via Point-to-Point Protocol + over Ethernet (PPPoE) or Point-to-Point Tunneling + Protocol (PPTP) in which case the External Interface will be +a ppp interface (e.g., ppp0). If you connect via a regular modem, +your External Interface will also be ppp0. If you connect via ISDN, your external interface will be ippp0.

      - +

      -     If your external interface is ppp0 or ippp0  then you - will want to set CLAMPMSS=yes in /etc/shorewall/shorewall.conf.

      - -

      Your Internal Interface will be an ethernet adapter - (eth1 or eth0) and will be connected to a hub or switch. Your other computers - will be connected to the same hub/switch (note: If you have only a single - internal system, you can connect the firewall directly to the computer using - a cross-over cable).

      - +     If your external interface is ppp0 or ippp0  then +you will want to set CLAMPMSS=yes in +/etc/shorewall/shorewall.conf.

      + +

      Your Internal Interface will be an ethernet adapter + (eth1 or eth0) and will be connected to a hub or switch. Your other computers + will be connected to the same hub/switch (note: If you have only a single + internal system, you can connect the firewall directly to the computer +using a cross-over cable).

      +

      - Do not connect the internal and external interface to the same - hub or switch (even for testing). It won't work the way that you think that - it will and you will end up confused and believing that Shorewall doesn't + Do not connect the internal and external interface to the same + hub or switch (even for testing). It won't work the way that you think that + it will and you will end up confused and believing that Shorewall doesn't work at all.

      - +

      -     The Shorewall two-interface sample configuration assumes that the -external interface is eth0 and the internal interface is eth1. - If your configuration is different, you will have to modify the sample -/etc/shorewall/interfaces file -accordingly. While you are there, you may wish to review the list of options -that are specified for the interfaces. Some hints:

      - +     The Shorewall two-interface sample configuration assumes that the + external interface is eth0 and the internal interface is eth1. + If your configuration is different, you will have to modify the sample + /etc/shorewall/interfaces file + accordingly. While you are there, you may wish to review the list of options + that are specified for the interfaces. Some hints:

      +
        -
      • -

        If your external interface is ppp0 or ippp0, - you can replace the "detect" in the second column with "-".

        -
        • -
      • -

        If your external interface is ppp0 or ippp0 - or if you have a static IP address, you can remove "dhcp" from the option - list.

        -
        • - +
      • +

        If your external interface is ppp0 or ippp0, + you can replace the "detect" in the second column with "-".

        +
        • +
      • +

        If your external interface is ppp0 or ippp0 + or if you have a static IP address, you can remove "dhcp" from the option + list.

        +
        • +
      - +

      IP Addresses

      - -

      Before going further, we should say a few words about Internet - Protocol (IP) addresses. Normally, your ISP will assign you a single - Public IP address. This address may be assigned via the Dynamic - Host Configuration Protocol (DHCP) or as part of establishing your connection - when you dial in (standard modem) or establish your PPP connection. In -rare cases, your ISP may assign you a static IP address; that means -that you configure your firewall's external interface to use that address -permanently. However your external address is assigned, it will be -shared by all of your systems when you access the Internet. You will have -to assign your own addresses in your internal network (the Internal Interface -on your firewall plus your other computers). RFC 1918 reserves several -Private IP address ranges for this purpose:

      - -
      + +

      Before going further, we should say a few words about Internet + Protocol (IP) addresses. Normally, your ISP will assign you a single + Public IP address. This address may be assigned via the Dynamic + Host Configuration Protocol (DHCP) or as part of establishing your +connection when you dial in (standard modem) or establish your PPP connection. +In rare cases, your ISP may assign you a static IP address; that +means that you configure your firewall's external interface to use that +address permanently. However your external address is assigned, it +will be shared by all of your systems when you access the Internet. You +will have to assign your own addresses in your internal network (the Internal +Interface on your firewall plus your other computers). RFC 1918 reserves +several Private IP address ranges for this purpose:

      + +
           10.0.0.0    - 10.255.255.255
           172.16.0.0  - 172.31.255.255
           192.168.0.0 - 192.168.255.255
      -
      - -
      +
      + +

      -     Before starting Shorewall, you should look at the IP address of -your external interface and if it is one of the above ranges, you should -remove the 'norfc1918' option from the external interface's entry in - /etc/shorewall/interfaces.

      -
      - -
      -

      You will want to assign your addresses from the same - sub-network (subnet).  For our purposes, we can consider a subnet - to consists of a range of addresses x.y.z.0 - x.y.z.255. Such a subnet - will have a Subnet Mask of 255.255.255.0. The address x.y.z.0 is - reserved as the Subnet Address and x.y.z.255 is reserved as the - Subnet Broadcast Address. In Shorewall, a subnet is described - using Classless InterDomain Routing (CIDR) - notation with consists of the subnet address followed by "/24". The - "24" refers to the number of consecutive leading "1" bits from the left - of the subnet mask.

      -
      - -
      +     Before starting Shorewall, you should look at the IP address of + your external interface and if it is one of the above ranges, you should + remove the 'norfc1918' option from the external interface's entry in + /etc/shorewall/interfaces.

      +
      + +
      +

      You will want to assign your addresses from the same + sub-network (subnet).  For our purposes, we can consider a subnet + to consists of a range of addresses x.y.z.0 - x.y.z.255. Such a subnet + will have a Subnet Mask of 255.255.255.0. The address x.y.z.0 +is reserved as the Subnet Address and x.y.z.255 is reserved as +the Subnet Broadcast Address. In Shorewall, a subnet is +described using Classless InterDomain Routing +(CIDR) notation with consists of the subnet address followed +by "/24". The "24" refers to the number of consecutive leading "1" bits +from the left of the subnet mask.

      +
      + +

      Example sub-network:

      -
      - -
      -
      +
      + +
      +
      - - - - - + - - - - - - - - - - - - - + + + + + + + + + + + + + + + + +
      Range:10.10.10.0 - 10.10.10.255
      Subnet Address:10.10.10.0
      Broadcast Address:10.10.10.255
      CIDR Notation:10.10.10.0/24
      Range:10.10.10.0 - 10.10.10.255
      Subnet Address:10.10.10.0
      Broadcast Address:10.10.10.255
      CIDR Notation:10.10.10.0/24
      -
      + +
      + +
      +

      It is conventional to assign the internal interface either + the first usable address in the subnet (10.10.10.1 in the above example) + or the last usable address (10.10.10.254).

      - -
      -

      It is conventional to assign the internal interface either - the first usable address in the subnet (10.10.10.1 in the above example) - or the last usable address (10.10.10.254).

      -
      - -
      -

      One of the purposes of subnetting is to allow all computers - in the subnet to understand which other computers can be communicated -with directly. To communicate with systems outside of the subnetwork, systems -send packets through a  gateway  (router).

      -
      - -
      + +
      +

      One of the purposes of subnetting is to allow all computers + in the subnet to understand which other computers can be communicated + with directly. To communicate with systems outside of the subnetwork, +systems send packets through a  gateway  (router).

      +
      + +

      -     Your local computers (computer 1 and computer 2 in the above diagram) - should be configured with their default gateway to be the IP address - of the firewall's internal interface.     

      -
      - -

      The foregoing short discussion barely scratches the surface - regarding subnetting and routing. If you are interested in learning more - about IP addressing and routing, I highly recommend "IP Fundamentals: - What Everyone Needs to Know about Addressing & Routing", Thomas -A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.

      - -

      The remainder of this quide will assume that you have configured - your network as shown here:

      - +     Your local computers (computer 1 and computer 2 in the above diagram) + should be configured with their default gateway to be the IP +address of the firewall's internal interface.     

      +
      + +

      The foregoing short discussion barely scratches the surface + regarding subnetting and routing. If you are interested in learning more + about IP addressing and routing, I highly recommend "IP Fundamentals: + What Everyone Needs to Know about Addressing & Routing", Thomas + A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.

      + +

      The remainder of this quide will assume that you have configured + your network as shown here:

      +

      -

      - +

      +

      The default gateway for computer's 1 & 2 would be 10.10.10.254.

      - +

      IP Masquerading (SNAT)

      - -

      The addresses reserved by RFC 1918 are sometimes referred - to as non-routable because the Internet backbone routers don't forward - packets which have an RFC-1918 destination address. When one of your local - systems (let's assume computer 1) sends a connection request to an internet - host, the firewall must perform Network Address Translation (NAT). - The firewall rewrites the source address in the packet to be the address - of the firewall's external interface; in other words, the firewall makes - it look as if the firewall itself is initiating the connection.  This is - necessary so that the destination host will be able to route return packets - back to the firewall (remember that packets whose destination address is - reserved by RFC 1918 can't be routed across the internet so the remote host - can't address its response to computer 1). When the firewall receives a -return packet, it rewrites the destination address back to 10.10.10.1 and - forwards the packet on to computer 1.

      - -

      On Linux systems, the above process is often referred to as - IP Masquerading but you will also see the term Source Network Address - Translation (SNAT) used. Shorewall follows the convention used with - Netfilter:

      - + +

      The addresses reserved by RFC 1918 are sometimes referred + to as non-routable because the Internet backbone routers don't forward + packets which have an RFC-1918 destination address. When one of your local + systems (let's assume computer 1) sends a connection request to an internet + host, the firewall must perform Network Address Translation (NAT). + The firewall rewrites the source address in the packet to be the address + of the firewall's external interface; in other words, the firewall makes + it look as if the firewall itself is initiating the connection.  This +is necessary so that the destination host will be able to route return +packets back to the firewall (remember that packets whose destination +address is reserved by RFC 1918 can't be routed across the internet so +the remote host can't address its response to computer 1). When the firewall +receives a return packet, it rewrites the destination address back to 10.10.10.1 +and forwards the packet on to computer 1.

      + +

      On Linux systems, the above process is often referred to +as IP Masquerading but you will also see the term Source Network +Address Translation (SNAT) used. Shorewall follows the convention used +with Netfilter:

      +
        -
      • -

        Masquerade describes the case where you let your - firewall system automatically detect the external interface address. -

        -
        • -
      • -

        SNAT refers to the case when you explicitly specify - the source address that you want outbound packets from your local network - to use.

        -
        • - +
      • +

        Masquerade describes the case where you let your + firewall system automatically detect the external interface address. +

        +
        • +
      • +

        SNAT refers to the case when you explicitly specify + the source address that you want outbound packets from your local network + to use.

        +
        • +
      - -

      In Shorewall, both Masquerading and SNAT are configured with - entries in the /etc/shorewall/masq file. You will normally use Masquerading - if your external IP is dynamic and SNAT if the IP is static.

      - + +

      In Shorewall, both Masquerading and SNAT are configured with + entries in the /etc/shorewall/masq file. You will normally use Masquerading + if your external IP is dynamic and SNAT if the IP is static.

      +

      -     If your external firewall interface is eth0, you do not need - to modify the file provided with the sample. Otherwise, edit /etc/shorewall/masq - and change the first column to the name of your external interface and the - second column to the name of your internal interface.

      - +     If your external firewall interface is eth0, you do not need + to modify the file provided with the sample. Otherwise, edit /etc/shorewall/masq + and change the first column to the name of your external interface and +the second column to the name of your internal interface.

      +

      -     If your external IP is static, you can enter it in the third column - in the /etc/shorewall/masq entry if you like although your firewall will - work fine if you leave that column empty. Entering your static IP in column - 3 makes processing outgoing packets a little more efficient.

      - +     If your external IP is static, you can enter it in the third column + in the /etc/shorewall/masq entry if you like although your firewall will + work fine if you leave that column empty. Entering your static IP in column + 3 makes processing outgoing packets a little more efficient.

      +

      Port Forwarding (DNAT)

      - -

      One of your goals may be to run one or more servers on your - local computers. Because these computers have RFC-1918 addresses, it is -not possible for clients on the internet to connect directly to them. It -is rather necessary for those clients to address their connection requests -to the firewall who rewrites the destination address to the address of your - server and forwards the packet to that server. When your server responds, - the firewall automatically performs SNAT to rewrite the source address in - the response.

      - -

      The above process is called Port Forwarding or - Destination Network Address Translation (DNAT). You configure port - forwarding using DNAT rules in the /etc/shorewall/rules file.

      - -

      The general form of a simple port forwarding rule in /etc/shorewall/rules - is:

      - -
      + +

      One of your goals may be to run one or more servers on your + local computers. Because these computers have RFC-1918 addresses, it is + not possible for clients on the internet to connect directly to them. It + is rather necessary for those clients to address their connection requests + to the firewall who rewrites the destination address to the address of +your server and forwards the packet to that server. When your server responds, + the firewall automatically performs SNAT to rewrite the source address +in the response.

      + +

      The above process is called Port Forwarding or + Destination Network Address Translation (DNAT). You configure port +forwarding using DNAT rules in the /etc/shorewall/rules file.

      + +

      The general form of a simple port forwarding rule in /etc/shorewall/rules + is:

      + +
      - + + + + + + + + + + - - - - - - - - - - - - + + - - - - - - - + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:<server local ip address> [:<server + DNATnetloc:<server local ip address> [:<server port>]<protocol><port>  
      <protocol><port>  
      -
      - -

      Example - you run a Web Server on computer 2 and you want to forward incoming - TCP port 80 to that system:

      - -
      +
      + +

      Example - you run a Web Server on computer 2 and you want to forward incoming + TCP port 80 to that system:

      + +
      - + + + + + + + + + + - - - - - - - - - - - - - - - - - - - + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2tcp80  
      DNATnetloc:10.10.10.2tcp80  
      -
      - +
      +

      A couple of important points to keep in mind:

      - + - -
      + +
      - + + + + + + + + + + - - - - - - - - - - - - - - - - - - - + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      DNATnetloc:10.10.10.2:80tcp5000  
      DNATnetloc:10.10.10.2:80tcp5000  
      -
      - +
      +

      -     At this point, modify /etc/shorewall/rules to add any DNAT rules +     At this point, modify /etc/shorewall/rules to add any DNAT rules that you require.

      - +

      Domain Name Server (DNS)

      - -

      Normally, when you connect to your ISP, as part of getting - an IP address your firewall's Domain Name Service (DNS) resolver -will be automatically configured (e.g., the /etc/resolv.conf file will be -written). Alternatively, your ISP may have given you the IP address of a -pair of DNS name servers for you to manually configure as your primary -and secondary name servers. Regardless of how DNS gets configured on your -firewall, it is your responsibility to configure the resolver in your - internal systems. You can take one of two approaches:

      - + +

      Normally, when you connect to your ISP, as part of getting + an IP address your firewall's Domain Name Service (DNS) resolver + will be automatically configured (e.g., the /etc/resolv.conf file will +be written). Alternatively, your ISP may have given you the IP address +of a pair of DNS name servers for you to manually configure as your +primary and secondary name servers. Regardless of how DNS gets configured +on your firewall, it is your responsibility to configure the resolver +in your internal systems. You can take one of two approaches:

      +
        -
      • -

        You can configure your internal systems to use your ISP's - name servers. If you ISP gave you the addresses of their servers or if - those addresses are available on their web site, you can configure your - internal systems to use those addresses. If that information isn't available, - look in /etc/resolv.conf on your firewall system -- the name servers are - given in "nameserver" records in that file.

        -
        • -
      • +
      • +

        You can configure your internal systems to use your ISP's + name servers. If you ISP gave you the addresses of their servers or +if those addresses are available on their web site, you can configure +your internal systems to use those addresses. If that information isn't +available, look in /etc/resolv.conf on your firewall system -- the name +servers are given in "nameserver" records in that file.

        +
        • +

      • -     You can configure a Caching Name Server on your firewall. - Red Hat has an RPM for a caching name server (the RPM also requires - the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you take - this approach, you configure your internal systems to use the firewall - itself as their primary (and only) name server. You use the internal IP - address of the firewall (10.10.10.254 in the example above) for the name - server address. To allow your local systems to talk to your caching name - server, you must open port 53 (both UDP and TCP) from the local network - to the firewall; you do that by adding the following rules in /etc/shorewall/rules. -

        -
        • - +     You can configure a Caching Name Server on your firewall. + Red Hat has an RPM for a caching name server (the RPM also requires + the 'bind' RPM) and for Bering users, there is dnscache.lrp. If you +take this approach, you configure your internal systems to use the firewall + itself as their primary (and only) name server. You use the internal IP + address of the firewall (10.10.10.254 in the example above) for the name + server address. To allow your local systems to talk to your caching +name server, you must open port 53 (both UDP and TCP) from the local +network to the firewall; you do that by adding the following rules in +/etc/shorewall/rules.

        + +
      - -
      + +
      - + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp53  
      ACCEPTlocfwudp53  
      ACCEPTlocfwtcp53  
      ACCEPTlocfwudp53  
      -
      - -
      +
      + +

      Other Connections

      -
      - -
      +
      + +

      The two-interface sample includes the following rules:

      -
      - -
      -
      +
      + +
      +
      - - - - - - - - - - + - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTfwnettcp53  
      ACCEPTfwnetudp53  
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTfwnettcp53  
      ACCEPTfwnetudp53  
      -
      + +
      + +
      +

      Those rules allow DNS access from your firewall and may be + removed if you uncommented the line in /etc/shorewall/policy allowing + all connections from the firewall to the internet.

      - -
      -

      Those rules allow DNS access from your firewall and may be - removed if you commented out the line in /etc/shorewall/policy allowing - all connections from the firewall to the internet.

      -
      - -
      + +

      The sample also includes:

      -
      - -
      -
      +
      + +
      +
      - - - - - - - - - - + - - - - - - - - - - + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp22  
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTlocfwtcp22  
      -
      + +
      + +
      +

      That rule allows you to run an SSH server on your firewall + and connect to that server from your local systems.

      - -
      -

      That rule allows you to run an SSH server on your firewall - and connect to that server from your local systems.

      -
      - -
      -

      If you wish to enable other connections between your firewall - and other systems, the general format is:

      -
      - -
      -
      + +
      +

      If you wish to enable other connections between your firewall + and other systems, the general format is:

      +
      + +
      +
      - - - - - - - - - - + - - - - - - - - - - + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPT<source zone><destination zone><protocol><port>  
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPT<source zone><destination zone><protocol><port>  
      -
      +
      +
      + +
      +

      Example - You want to run a Web Server on your firewall + system:

      - -
      -

      Example - You want to run a Web Server on your firewall - system:

      -
      - -
      -
      + +
      +
      - - - - - - - - - - + - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp80#Allow web accessfrom the internet
      ACCEPTlocfwtcp80#Allow web accessfrom the local network
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp80#Allow web accessfrom the internet
      ACCEPTlocfwtcp80#Allow web accessfrom the local network
      -
      +
      +
      + +
      +

      Those two rules would of course be in addition to the rules + listed above under "You can configure a Caching Name Server on your +firewall"

      - -
      -

      Those two rules would of course be in addition to the rules - listed above under "You can configure a Caching Name Server on your firewall"

      -
      - -
      -

      If you don't know what port and protocol a particular application -uses, look here.

      -
      - -
      -

      Important: I don't recommend enabling telnet to/from - the internet because it uses clear text (even for login!). If you want - shell access to your firewall from the internet, use SSH:

      -
      - -
      -
      + +
      +

      If you don't know what port and protocol a particular +application uses, look here.

      +
      + +
      +

      Important: I don't recommend enabling telnet to/from + the internet because it uses clear text (even for login!). If you want + shell access to your firewall from the internet, use SSH:

      +
      + +
      +
      - - - - - - - - - - + - - - - - - - - - - + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp22  
      ACTIONSOURCEDESTINATIONPROTOCOLPORTSOURCE PORTORIGINAL ADDRESS
      ACCEPTnetfwtcp22  
      -
      -
      - -
      +
      +
      + +

      -     Now edit your /etc/shorewall/rules file to add or delete other +     Now edit your /etc/shorewall/rules file to add or delete other connections as required.

      -
      - -
      -

      Starting and Stopping Your Firewall

      - -
      + +
      +

      Starting and Stopping Your Firewall

      +
      + +

      Arrow -     The installation procedure configures - your system to start Shorewall at system boot  but beginning with Shorewall -version 1.3.9 startup is disabled so that your system won't try to start -Shorewall before configuration is complete. Once you have completed configuration -of your firewall, you can enable Shorewall startup by removing the file /etc/shorewall/startup_disabled.
      -

      - +     The installation procedure configures + your system to start Shorewall at system boot  but beginning with Shorewall +version 1.3.9 startup is disabled so that your system won't try to start Shorewall +before configuration is complete. Once you have completed configuration of +your firewall, you can enable Shorewall startup by removing the file /etc/shorewall/startup_disabled.
      +

      +

      IMPORTANT: Users of the .deb package must edit /etc/default/shorewall + color="#ff0000">Users of the .deb package must edit /etc/default/shorewall and set 'startup=1'.
      -

      +

      +
      + +
      +

      The firewall is started using the "shorewall start" command + and stopped using "shorewall stop". When the firewall is stopped, routing + is enabled on those hosts that have an entry in /etc/shorewall/routestopped. A + running firewall may be restarted using the "shorewall restart" command. + If you want to totally remove any trace of Shorewall from your Netfilter + configuration, use "shorewall clear".

      - -
      -

      The firewall is started using the "shorewall start" command - and stopped using "shorewall stop". When the firewall is stopped, routing - is enabled on those hosts that have an entry in /etc/shorewall/routestopped. A - running firewall may be restarted using the "shorewall restart" command. - If you want to totally remove any trace of Shorewall from your Netfilter - configuration, use "shorewall clear".

      -
      - -
      + +

      -     The two-interface sample assumes that you want to enable routing - to/from eth1 (the local network) when Shorewall is stopped. If - your local network isn't connected to eth1 or if you wish to enable +     The two-interface sample assumes that you want to enable routing + to/from eth1 (the local network) when Shorewall is stopped. If +your local network isn't connected to eth1 or if you wish to enable access to/from other hosts, change /etc/shorewall/routestopped accordingly.

      -
      - -
      -

      WARNING: If you are connected to your firewall from - the internet, do not issue a "shorewall stop" command unless you have -added an entry for the IP address that you are connected from to /etc/shorewall/routestopped. - Also, I don't recommend using "shorewall restart"; it is better to create - an alternate configuration - and test it using the "shorewall -try" command.

      -
      - -

      Last updated 9/26/2002 - + +

      + +

      Last updated 10/9/2002 - Tom Eastep

      - -

      Copyright 2002 Thomas - M. Eastep

      -
      + +

      Copyright 2002 Thomas + M. Eastep

      +
      +



      diff --git a/STABLE/fallback.sh b/STABLE/fallback.sh index 1a5aa1179..ad7050f00 100755 --- a/STABLE/fallback.sh +++ b/STABLE/fallback.sh @@ -28,7 +28,7 @@ # shown below. Simply run this script to revert to your prior version of # Shoreline Firewall. -VERSION=1.3.9a +VERSION=1.3.9b usage() # $1 = exit status { diff --git a/STABLE/install.sh b/STABLE/install.sh index 6dd828f79..ebb36befc 100755 --- a/STABLE/install.sh +++ b/STABLE/install.sh @@ -54,7 +54,7 @@ # /etc/rc.d/rc.local file is modified to start the firewall. # -VERSION=1.3.9a +VERSION=1.3.9b usage() # $1 = exit status { @@ -166,6 +166,8 @@ while [ $# -gt 0 ] ; do shift ARGS="yes" done + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin # # Determine where to install the firewall script @@ -282,13 +284,18 @@ fi # Install the functions file # if [ -f ${PREFIX}/etc/shorewall/functions ]; then + backup_file ${PREFIX}/etc/shorewall/functions + rm -f ${PREFIX}/etc/shorewall/functions +fi + +if [ -f ${PREFIX}/var/lib/shorewall/functions ]; then backup_file ${PREFIX}/var/lib/shorewall/functions rm -f ${PREFIX}/var/lib/shorewall/functions fi install_file_with_backup functions ${PREFIX}/usr/lib/shorewall/functions 0444 -echo -e "\nCommon functions installed in ${PREFIX}/var/lib/shorewall/functions" +echo -e "\nCommon functions installed in ${PREFIX}/usr/lib/shorewall/functions" # # Install the common.def file # diff --git a/STABLE/uninstall.sh b/STABLE/uninstall.sh index 3062b966d..80d36dd05 100755 --- a/STABLE/uninstall.sh +++ b/STABLE/uninstall.sh @@ -26,7 +26,7 @@ # You may only use this script to uninstall the version # shown below. Simply run this script to remove Seattle Firewall -VERSION=1.3.9a +VERSION=1.3.9b usage() # $1 = exit status {