forked from extern/shorewall_code
Minor code cleanups.
Adding <?dbtimestamp format="Y/m/d"?> to pubdate(s) to reflect date which document itself was built. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1038 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
pauls
parent
e4b9496129
commit
5b01e057df
@ -1,425 +1,386 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<!-- $Id$ -->
|
||||
<article id="whitelisting_under_shorewall">
|
||||
<!-- $Id$ -->
|
||||
|
||||
<articleinfo>
|
||||
<title>Whitelisting Under Shorewall</title>
|
||||
|
||||
<author>
|
||||
<firstname>Tom</firstname>
|
||||
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
|
||||
<pubdate>2003-12-22</pubdate>
|
||||
|
||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||
<copyright>
|
||||
<year>2002</year>
|
||||
<year>2003</year>
|
||||
|
||||
<year>2004</year>
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||||
<para>
|
||||
Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled <quote><ulink url="copyright.htm" type="">GNU Free Documentation License</ulink></quote>.
|
||||
</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<para>For a brief time, the 1.2 version of Shorewall supported an
|
||||
<literal>/etc/shorewall/whitelist</literal> file. This file was intended to
|
||||
contain a list of IP addresses of hosts whose POLICY to all zones was
|
||||
ACCEPT. The whitelist file was implemented as a stop-gap measure until the
|
||||
facilities necessary for implementing white lists using zones was in place.
|
||||
As of Version <literal>1.3 RC1</literal>, those facilities were available.</para>
|
||||
|
||||
<para>White lists are most often used to give special privileges to a set of
|
||||
hosts within an organization. Let us suppose that we have the following
|
||||
environment:</para>
|
||||
|
||||
<para>
|
||||
For a brief time, the 1.2 version of Shorewall supported an <literal>/etc/shorewall/whitelist</literal> file. This file was intended to contain a
|
||||
list of IP addresses of hosts whose POLICY to all zones was ACCEPT. The whitelist file was implemented as a stop-gap measure until the
|
||||
facilities necessary for implementing white lists using zones was in place. As of Version <literal>1.3 RC1</literal>, those facilities were available.
|
||||
</para>
|
||||
<para>
|
||||
White lists are most often used to give special privileges to a set of hosts within an organization. Let us suppose that we have the following environment:
|
||||
</para>
|
||||
<itemizedlist mark="bullet" spacing="compact">
|
||||
<listitem>
|
||||
<para>A firewall with three interfaces -- one to the Internet, one to a
|
||||
local network and one to a <acronym>DMZ</acronym>.</para>
|
||||
<para>
|
||||
A firewall with three interfaces -- one to the Internet, one to a local network and one to a <acronym>DMZ</acronym>.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>The local network uses <acronym>SNAT</acronym> to the internet and
|
||||
is comprised of the Class B network <literal>10.10.0.0/16</literal>
|
||||
(Note: While this example uses an RFC 1918 local network, the technique
|
||||
described here in no way depends on that or on <acronym>SNAT</acronym>.
|
||||
It may be used with Proxy <acronym>ARP</acronym>, Subnet Routing, Static
|
||||
NAT, etc.).</para>
|
||||
<para>
|
||||
The local network uses <acronym>SNAT</acronym> to the internet and is comprised of the Class B network <literal>10.10.0.0/16</literal> (Note: While this example uses an RFC 1918 local network, the technique described here in no way depends on that or on <acronym>SNAT</acronym>. It may be used with Proxy <acronym>ARP</acronym>, Subnet Routing, Static NAT, etc.).
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>The network operations staff have workstations with IP addresses
|
||||
in the Class C network <literal>10.10.10.0/24</literal>.</para>
|
||||
<para>
|
||||
The network operations staff have workstations with IP addresses in the Class C network <literal>10.10.10.0/24</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>We want the network operations staff to have full access to all
|
||||
other hosts.</para>
|
||||
<para>
|
||||
We want the network operations staff to have full access to all other hosts.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>We want the network operations staff to bypass the transparent
|
||||
<acronym>HTTP</acronym> proxy running on our firewall.</para>
|
||||
<para>
|
||||
We want the network operations staff to bypass the transparent <acronym>HTTP</acronym> proxy running on our firewall.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>The basic approach will be that we will place the operations
|
||||
staff's class C in its own zone called ops. Here are the appropriate
|
||||
configuration files:</para>
|
||||
|
||||
<!-- Zone File -->
|
||||
|
||||
<para>
|
||||
The basic approach will be that we will place the operations staff's class C in its own zone called ops. Here are the appropriate configuration files:
|
||||
</para>
|
||||
<!-- Zone File -->
|
||||
<bridgehead renderas="sect4">Zone File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="3">
|
||||
<tgroup cols="3" align="left">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">ZONE</entry>
|
||||
|
||||
<entry align="left">DISPLAY</entry>
|
||||
|
||||
<entry align="left">COMMENTS</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>net</literal></entry>
|
||||
|
||||
<entry align="left">
|
||||
<literal>net</literal>
|
||||
</entry>
|
||||
<entry align="left">Net</entry>
|
||||
|
||||
<entry align="left">Internet</entry>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>ops</literal></entry>
|
||||
|
||||
<entry align="left">
|
||||
<literal>ops</literal>
|
||||
</entry>
|
||||
<entry align="left">Operations</entry>
|
||||
|
||||
<entry align="left">Operations Staff's Class C</entry>
|
||||
<entry align="left">Operations Staff's Class C</entry>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>loc</literal></entry>
|
||||
|
||||
<entry align="left">
|
||||
<literal>loc</literal>
|
||||
</entry>
|
||||
<entry align="left">Local</entry>
|
||||
|
||||
<entry align="left">Local Class B</entry>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>dmz</literal></entry>
|
||||
|
||||
<entry align="left">
|
||||
<literal>dmz</literal>
|
||||
</entry>
|
||||
<entry align="left">DMZ</entry>
|
||||
|
||||
<entry align="left">Demilitarized zone</entry>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>The <literal>ops</literal> zone has been added to the standard 3-zone
|
||||
zones file -- since <literal>ops</literal> is a sub-zone of
|
||||
<literal>loc</literal>, we list it <emphasis>BEFORE</emphasis>
|
||||
<literal>loc</literal>.</para>
|
||||
|
||||
<!-- Interfaces File -->
|
||||
|
||||
<para>
|
||||
The <literal>ops</literal> zone has been added to the standard 3-zone zones
|
||||
file -- since <literal>ops</literal> is a sub-zone of <literal>loc</literal>, we list it <emphasis>BEFORE</emphasis>
|
||||
<literal>loc</literal>.
|
||||
</para>
|
||||
<!-- Interfaces File -->
|
||||
<bridgehead renderas="sect4">Interfaces File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="4">
|
||||
<tgroup cols="4" align="left">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">ZONE</entry>
|
||||
|
||||
<entry align="left">INTERFACE</entry>
|
||||
|
||||
<entry align="left">BROADCAST</entry>
|
||||
|
||||
<entry align="left">OPTIONS</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>net</literal></entry>
|
||||
|
||||
<entry align="left"><literal>eth0</literal></entry>
|
||||
|
||||
<entry align="left"><whatever></entry>
|
||||
|
||||
<entry align="left"><options></entry>
|
||||
<entry align="left">
|
||||
<literal>net</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>eth0</literal>
|
||||
</entry>
|
||||
<entry align="left"><whatever></entry>
|
||||
<entry align="left"><options></entry>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>dmz</literal></entry>
|
||||
|
||||
<entry align="left"><literal>eth1</literal></entry>
|
||||
|
||||
<entry align="left"><whatever></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>dmz</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>eth1</literal>
|
||||
</entry>
|
||||
<entry align="left"><whatever></entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry align="left"><literal>-</literal></entry>
|
||||
|
||||
<entry align="left"><literal>eth2</literal></entry>
|
||||
|
||||
<entry align="left"><literal>10.10.255.255</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>-</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>eth2</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>10.10.255.255</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>Because <literal>eth2</literal> interfaces to two zones (<literal>ops</literal>
|
||||
and <literal>loc</literal>), we don't specify a zone for it here.</para>
|
||||
|
||||
<!-- Hosts File -->
|
||||
|
||||
<para>
|
||||
Because <literal>eth2</literal> interfaces to two zones (<literal>ops</literal> and <literal>loc</literal>), we don't specify a zone for it here.
|
||||
</para>
|
||||
<!-- Hosts File -->
|
||||
<bridgehead renderas="sect4">Hosts File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="3">
|
||||
<tgroup cols="3" align="left">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">ZONE</entry>
|
||||
|
||||
<entry align="left">HOST(S)</entry>
|
||||
|
||||
<entry align="left">OPTIONS</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>ops</literal></entry>
|
||||
|
||||
<entry align="left"><literal>eth2:10.10.10.0/24</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>ops</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>eth2:10.10.10.0/24</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>loc</literal></entry>
|
||||
|
||||
<entry align="left"><literal>eth2:0.0.0.0/0</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>loc</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>eth2:0.0.0.0/0</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>Here we define the <literal>ops</literal> and <literal>loc</literal>
|
||||
zones. When Shorewall is stopped, only the hosts in the <literal>ops</literal>
|
||||
zone will be allowed to access the firewall and the <acronym>DMZ</acronym>.
|
||||
I use <literal>0.0.0.0/0</literal> to define the <literal>loc</literal> zone
|
||||
rather than <literal>10.10.0.0/16</literal> so that the limited broadcast
|
||||
address (<literal>255.255.255.255</literal>) falls into that zone. If I used
|
||||
<literal>10.10.0.0/16</literal> then I would have to have a separate entry
|
||||
for that special address.</para>
|
||||
|
||||
<!-- Policy File -->
|
||||
|
||||
<para>
|
||||
Here we define the <literal>ops</literal> and <literal>loc</literal> zones. When Shorewall is stopped, only the hosts in the <literal>ops</literal> zone will be allowed to access the firewall and the <acronym>DMZ</acronym>. I use <literal>0.0.0.0/0</literal> to define the <literal>loc</literal> zone rather than <literal>10.10.0.0/16</literal> so that the limited broadcast address (<literal>255.255.255.255</literal>) falls into that zone. If I used <literal>10.10.0.0/16</literal> then I would have to have a separate entry for that special address.
|
||||
</para>
|
||||
<!-- Policy File -->
|
||||
<bridgehead renderas="sect4">Policy File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="5">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">SOURCE</entry>
|
||||
|
||||
<entry align="left">DEST</entry>
|
||||
|
||||
<entry align="left">POLICY</entry>
|
||||
|
||||
<entry align="left">LOG LEVEL</entry>
|
||||
|
||||
<entry align="left">LIMIT BURST</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody>
|
||||
<row valign="middle">
|
||||
<entry align="left"><!-- To color the cell grey, uncomment the following 2 lines
|
||||
<entry align="left">
|
||||
<!-- To color the cell grey, uncomment the following 2 lines
|
||||
<?dbhtml bgcolor="#EEEEEE" ?>
|
||||
<?dbfo bgcolor="#EEEEEE" ?>
|
||||
--> <emphasis role="bold"> <literal>ops</literal> </emphasis></entry>
|
||||
|
||||
<entry align="left"><emphasis role="bold"> <literal>all</literal>
|
||||
</emphasis></entry>
|
||||
|
||||
<entry align="left"><emphasis role="bold"> <literal>ACCEPT</literal>
|
||||
</emphasis></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
-->
|
||||
<emphasis role="bold">
|
||||
<literal>ops</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<emphasis role="bold">
|
||||
<literal>all</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<emphasis role="bold">
|
||||
<literal>ACCEPT</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><emphasis role="bold"> <literal>all</literal>
|
||||
</emphasis></entry>
|
||||
|
||||
<entry align="left"><emphasis role="bold"> <literal>ops</literal>
|
||||
</emphasis></entry>
|
||||
|
||||
<entry align="left"><emphasis role="bold"> <literal>CONTINUE</literal>
|
||||
</emphasis></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<emphasis role="bold">
|
||||
<literal>all</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<emphasis role="bold">
|
||||
<literal>ops</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<emphasis role="bold">
|
||||
<literal>CONTINUE</literal>
|
||||
</emphasis>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>loc</literal></entry>
|
||||
|
||||
<entry align="left"><literal>net</literal></entry>
|
||||
|
||||
<entry align="left"><literal>ACCEPT</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>loc</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>net</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>ACCEPT</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>net</literal></entry>
|
||||
|
||||
<entry align="left"><literal>all</literal></entry>
|
||||
|
||||
<entry align="left"><literal>DROP</literal></entry>
|
||||
|
||||
<entry align="left"><literal>info</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>net</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>all</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>DROP</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>info</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>all</literal></entry>
|
||||
|
||||
<entry align="left"><literal>all</literal></entry>
|
||||
|
||||
<entry align="left"><literal>REJECT</literal></entry>
|
||||
|
||||
<entry align="left"><literal>info</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>all</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>all</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>REJECT</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>info</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>Two entries for <literal>ops</literal> (in bold) have been added to
|
||||
the standard 3-zone policy file.</para>
|
||||
|
||||
<!-- Rules File -->
|
||||
|
||||
<para>
|
||||
Two entries for <literal>ops</literal> (in bold) have been added to the standard 3-zone policy file.
|
||||
</para>
|
||||
<!-- Rules File -->
|
||||
<bridgehead renderas="sect4">Rules File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="7">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">ACTION</entry>
|
||||
|
||||
<entry align="left">SOURCE</entry>
|
||||
|
||||
<entry align="left">DEST</entry>
|
||||
|
||||
<entry align="left">PROTO</entry>
|
||||
|
||||
<entry align="left">DEST PORT(S)</entry>
|
||||
|
||||
<entry align="left">SOURCE PORT(S)</entry>
|
||||
|
||||
<entry align="left">ORIGINAL DEST</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody>
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>REDIRECT</literal></entry>
|
||||
|
||||
<entry align="left"><literal>loc!ops</literal></entry>
|
||||
|
||||
<entry align="left"><literal>3128</literal></entry>
|
||||
|
||||
<entry align="left"><literal>tcp</literal></entry>
|
||||
|
||||
<entry align="left"><literal>http</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>REDIRECT</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>loc!ops</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>3128</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>tcp</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>http</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>...</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>...</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>This is the rule that transparently redirects web traffic to the
|
||||
transparent proxy running on the firewall. The <emphasis role="bold">SOURCE</emphasis>
|
||||
column explicitly excludes the <literal>ops</literal> zone from the rule.</para>
|
||||
|
||||
<!-- Routestopped File -->
|
||||
|
||||
<para>
|
||||
This is the rule that transparently redirects web traffic to the transparent proxy running on the firewall. The <emphasis role="bold">SOURCE</emphasis> column explicitly excludes the <literal>ops</literal> zone from the rule.
|
||||
</para>
|
||||
<!-- Routestopped File -->
|
||||
<bridgehead renderas="sect4">Routestopped File</bridgehead>
|
||||
|
||||
<informaltable colsep="1" pgwide="0">
|
||||
<tgroup align="left" cols="2">
|
||||
<thead valign="middle">
|
||||
<row valign="middle">
|
||||
<entry align="left">INTERFACE</entry>
|
||||
|
||||
<entry align="left">HOST(S))</entry>
|
||||
</row>
|
||||
</thead>
|
||||
|
||||
<tbody>
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>eth1</literal></entry>
|
||||
|
||||
<entry align="left"></entry>
|
||||
<entry align="left">
|
||||
<literal>eth1</literal>
|
||||
</entry>
|
||||
<entry align="left"/>
|
||||
</row>
|
||||
|
||||
<row valign="middle">
|
||||
<entry align="left"><literal>eth2</literal></entry>
|
||||
|
||||
<entry align="left"><literal>10.10.10.0/24</literal></entry>
|
||||
<entry align="left">
|
||||
<literal>eth2</literal>
|
||||
</entry>
|
||||
<entry align="left">
|
||||
<literal>10.10.10.0/24</literal>
|
||||
</entry>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
</article>
|
||||
</article>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user