diff --git a/Shorewall-docs/whitelisting_under_shorewall.xml b/Shorewall-docs/whitelisting_under_shorewall.xml index 737718047..52099a9b7 100644 --- a/Shorewall-docs/whitelisting_under_shorewall.xml +++ b/Shorewall-docs/whitelisting_under_shorewall.xml @@ -63,335 +63,323 @@ The basic approach will be that we will place the operations staff's class C in its own zone called ops. Here are the appropriate configuration files: - - Zone File - - - - - ZONE - DISPLAY - COMMENTS - - - - - - net - - Net - Internet - - - - ops - - Operations - Operations Staff's Class C - - - - loc - - Local - Local Class B - - - - dmz - - DMZ - Demilitarized zone - - - - - + Zone File + + + + + ZONE + DISPLAY + COMMENTS + + + + + + net + + Net + Internet + + + + ops + + Operations + Operations Staff's Class C + + + + loc + + Local + Local Class B + + + + dmz + + DMZ + Demilitarized zone + + + + + The ops zone has been added to the standard 3-zone zones file -- since ops is a sub-zone of loc, we list it BEFORE loc. - - - Interfaces File - - - - - ZONE - INTERFACE - BROADCAST - OPTIONS - - - - - - net - - - eth0 - - <whatever> - <options> - - - - dmz - - - eth1 - - <whatever> - - - - - - - - - eth2 - - - 10.10.255.255 - - - - - - - + Interfaces File + + + + + ZONE + INTERFACE + BROADCAST + OPTIONS + + + + + + net + + + eth0 + + <whatever> + <options> + + + + dmz + + + eth1 + + <whatever> + + + + + - + + + eth2 + + + 10.10.255.255 + + + + + + + Because eth2 interfaces to two zones (ops and loc), we don't specify a zone for it here. - - - Hosts File - - - - - ZONE - HOST(S) - OPTIONS - - - - - - ops - - - eth2:10.10.10.0/24 - - - - - - loc - - - eth2:0.0.0.0/0 - - - - - - - + Hosts File + + + + + ZONE + HOST(S) + OPTIONS + + + + + + ops + + + eth2:10.10.10.0/24 + + + + + + loc + + + eth2:0.0.0.0/0 + + + + + + + Here we define the ops and loc zones. When Shorewall is stopped, only the hosts in the ops zone will be allowed to access the firewall and the DMZ. I use 0.0.0.0/0 to define the loc zone rather than 10.10.0.0/16 so that the limited broadcast address (255.255.255.255) falls into that zone. If I used 10.10.0.0/16 then I would have to have a separate entry for that special address. - - - Policy File - - - - - SOURCE - DEST - POLICY - LOG LEVEL - LIMIT BURST - - - - - + Policy File + + + + + SOURCE + DEST + POLICY + LOG LEVEL + LIMIT BURST + + + + + - - ops - - - - - all - - - - - ACCEPT - - - - - - - - - all - - - - - ops - - - - - CONTINUE - - - - - - - - loc - - - net - - + + ops + + + + + all + + + + ACCEPT - - - - - - - net - - + + + + + + + + all - - - DROP - - - info - - - - - - all - - - all - - - REJECT - - - info - - - - - - - + + + + + ops + + + + + CONTINUE + + + + + + + + loc + + + net + + + ACCEPT + + + + + + + net + + + all + + + DROP + + + info + + + + + + all + + + all + + + REJECT + + + info + + + + + + + Two entries for ops (in bold) have been added to the standard 3-zone policy file. - - - Rules File - - - - - ACTION - SOURCE - DEST - PROTO - DEST PORT(S) - SOURCE PORT(S) - ORIGINAL DEST - - - - - - REDIRECT - - - loc!ops - - - 3128 - - - tcp - - - http - - - - - - - ... - - - - - - - - - - - - + Rules File + + + + + ACTION + SOURCE + DEST + PROTO + DEST PORT(S) + SOURCE PORT(S) + ORIGINAL DEST + + + + + + REDIRECT + + + loc!ops + + + 3128 + + + tcp + + + http + + + + + + + ... + + + + + + + + + + + + This is the rule that transparently redirects web traffic to the transparent proxy running on the firewall. The SOURCE column explicitly excludes the ops zone from the rule. - - - Routestopped File - - - - - INTERFACE - HOST(S)) - - - - - - eth1 - - - - - - eth2 - - - 10.10.10.0/24 - - - - - - + Routestopped File + + + + + INTERFACE + HOST(S)) + + + + + + eth1 + + + + + + eth2 + + + 10.10.10.0/24 + + + + +