From 8fd7de3900924477900178d2a4d0d42c946a3e99 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Thu, 18 Feb 2016 15:57:40 -0800 Subject: [PATCH] Update the ports article for 5.0 Signed-off-by: Tom Eastep --- docs/ports.xml | 82 +++++++++++++++++++++++++------------------------- 1 file changed, 41 insertions(+), 41 deletions(-) diff --git a/docs/ports.xml b/docs/ports.xml index 500d41f73..03890e9d7 100644 --- a/docs/ports.xml +++ b/docs/ports.xml @@ -61,7 +61,7 @@ from the dmz zone to the net zone: - #ACTION SOURCE DESTINATION + #ACTION SOURCE DEST DNS(ACCEPT) dmz net @@ -74,12 +74,12 @@ DNS(ACCEPT) dmz net Example: You want to port forward FTP from the net to your server at 192.168.1.4 in your DMZ. The FTP section below gives you: - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DEST PROTO DPORT FTP(ACCEPT) <source> <destination> You would code your rule as follows: - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT FTP(DNAT) net dmz:192.168.1.4 @@ -93,7 +93,7 @@ FTP(DNAT) net dmz:192.168.1.4 anymore. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Auth(ACCEPT) <source> <destination> @@ -110,14 +110,14 @@ Auth(ACCEPT) <source> <destination& port(s) - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT BitTorrent(ACCEPT)<source> <destination>
DNS - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT DNS(ACCEPT) <source> <destination> Note that if you are setting up a DNS server that supports recursive @@ -128,7 +128,7 @@ DNS(ACCEPT) <source> <destination& a public DNS server in your DMZ that supports recursive resolution for local clients then you would need: - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT DNS(ACCEPT) all dmz DNS(ACCEPT) dmz net @@ -174,7 +174,7 @@ DNS(ACCEPT) dmz net /etc/shorewall/rules: - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Edonkey(DNAT) net loc:192.168.1.4 #if you wish to enable the Emule webserver, add this rule too. DNAT net loc:192.168.1.4 tcp 4711 @@ -183,7 +183,7 @@ DNAT net loc:192.168.1.4 tcp 4711
FTP - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT FTP(ACCEPT) <source> <destination> Look here for much more @@ -212,14 +212,14 @@ FTP(ACCEPT) <source> <destination> Your loc->net policy is ACCEPT - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Gnutella(DNAT) net loc:192.168.1.4
ICQ/AIM - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ICQ(ACCEPT) <source> net
@@ -236,7 +236,7 @@ ICQ(ACCEPT) <source> net This information is valid only for Shorewall 3.2 or later. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT IMAP(ACCEPT) <source> <destination> # Unsecure IMAP IMAPS(ACCEPT) <source> <destination> # IMAP over SSL.
@@ -244,7 +244,7 @@ IMAPS(ACCEPT) <source> <destination> # IMAP over SSL. IPSEC - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT <source> <destination> 50 ACCEPT <source> <destination> 51 ACCEPT <source> <destination> udp 500 @@ -263,9 +263,9 @@ ACCEPT <destination> <source>This information is valid only for Shorewall 3.2 or later. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT LDAP(ACCEPT) <source> <destination> #Insecure LDAP -LDAPS(ACCEPT) <source> <destination> # LDAP over SSL +LDAPS(ACCEPT) <source> <destination> # LDAP over SSL
@@ -284,14 +284,14 @@ LDAPS(ACCEPT) <source> & how to deal with the consequences, you have been warned. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT MySQL(ACCEPT) <source> <destination>
NFS - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT <z1>:<list of client IPs> <z2>:a.b.c.d tcp 111 ACCEPT <z1>:<list of client IPs> <z2>:a.b.c.d udp @@ -302,14 +302,14 @@ ACCEPT <z1>:<list of client IPs> NTP (Network Time Protocol) - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT NTP(ACCEPT) <source> <destination>
<trademark>PCAnywhere</trademark> - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT PCA(ACCEPT) <source> <destination>
@@ -325,7 +325,7 @@ PCA(ACCEPT) <source> <destination> This information is valid only for Shorewall 3.2 or later - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT POP3(ACCEPT) <source> <destination> # Secure POP3S(ACCEPT) <source> <destination> #Unsecure Pop3 @@ -333,7 +333,7 @@ POP3S(ACCEPT) <source> <destination> #Unsecure Pop3 PPTP - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT <source> <destination> 47 ACCEPT <source> <destination> tcp 1723 @@ -344,14 +344,14 @@ ACCEPT <source> <destination> rdate - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Rdate(ACCEPT) <source> <destination>
rsync - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Rsync(ACCEPT) <source> <destination>
@@ -363,16 +363,16 @@ Rsync(ACCEPT) <source> <destination& firewall and is using the default ports. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT REDIRECT loc 5060 udp 5060 ACCEPT net fw udp 5060 -ACCEPT net fw udp 7070:7089 +ACCEPT net fw udp 7070:7089
SSH/SFTP - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT SSH(ACCEPT)<source> <destination>
@@ -380,7 +380,7 @@ SSH(ACCEPT)<source> <destination>SMB/NMB (Samba/Windows Browsing/File Sharing) - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT SMB(ACCEPT) <source> <destination> SMB(ACCEPT) <destination> <source> @@ -394,7 +394,7 @@ SMB(ACCEPT) <destination> <source> This information is valid only for Shorewall 3.2 or later. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT SMTP(ACCEPT) <source> <destination> #Insecure SMTP SMTPS(ACCEPT) <source> <destination> #SMTP over SSL (TLS) @@ -402,7 +402,7 @@ SMTPS(ACCEPT) <source> <destination&
SNMP - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT SNMP(ACCEPT) <source> <destination>
@@ -418,7 +418,7 @@ SNMP(ACCEPT) <source> <destination&g role="bold">svnserve mode only. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT SVN(ACCEPT) <source> <destination> @@ -430,7 +430,7 @@ SVN(ACCEPT) <source> <destination> insecure, don't use it. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Telnet(ACCEPT) <source> <destination> @@ -447,14 +447,14 @@ Telnet(ACCEPT) <source> <destination that the /etc/shorewall/modules file released with recent Shorewall versions contains entries for these modules. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT <source> <destination> udp 69
Traceroute - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Trcrt(ACCEPT) <source> <destination> #Good for 10 hops UDP traceroute uses ports 33434 through 33434+<max number of @@ -464,7 +464,7 @@ Trcrt(ACCEPT) <source> <destination& automatically since those sample configurations enable all ICMP packet types originating on the firewall itself. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT fw net icmp ACCEPT fw loc icmp ACCEPT fw ... @@ -473,7 +473,7 @@ ACCEPT fw ...
Usenet (NNTP) - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT NNTP(ACCEPT) <source> <destination> NNTPS(ACCEPT) <source> <destination> # secure NNTP @@ -493,13 +493,13 @@ NNTPS(ACCEPT) <source> <destination> # secure NNTPthe following rule handles VNC traffic for VNC displays 0 - 9. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT VNC(ACCEPT) <source> <destination> Vncserver to Vncviewer in listen mode -- TCP port 5500. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT VNCL(ACCEPT) <source> <destination>
@@ -519,7 +519,7 @@ VNCL(ACCEPT) <source> <destination&g This information is valid for Shorewall 3.2 or later. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT HTTP(ACCEPT) <source> <destination> #Insecure HTTP HTTPS(ACCEPT) <source> <destination> #Secure HTTP
@@ -527,7 +527,7 @@ HTTPS(ACCEPT) <source> <destination> #Secure HTTP Webmin - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Webmin(ACCEPT) <source> <destination> Webmin use TCP port 10000. @@ -535,7 +535,7 @@ Webmin(ACCEPT) <source> <destination
Whois - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT Whois(ACCEPT) <source> <destination>
@@ -546,7 +546,7 @@ Whois(ACCEPT) <source> <destination& <chooser> and the Display Manager/X applications are running at <apps>. - #ACTION SOURCE DESTINATION PROTO DEST PORT(S) + #ACTION SOURCE DESTINATION PROTO DPORT ACCEPT <chooser> <apps> udp 177 #XDMCP ACCEPT <apps> <chooser> tcp 6000:6009 #X Displays 0-9