forked from extern/shorewall_code
Add 2.6 IPSEC documentation
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
4292ef2e98
commit
bac33d7c78
File diff suppressed because it is too large
Load Diff
294
Shorewall-docs2/IPSEC-2.6.xml
Normal file
294
Shorewall-docs2/IPSEC-2.6.xml
Normal file
@ -0,0 +1,294 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<article id="IPSEC">
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>IPSEC using Linux Kernel 2.6</title>
|
||||
|
||||
<authorgroup>
|
||||
<author>
|
||||
<firstname>Tom</firstname>
|
||||
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2004-08-15</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||
License</ulink></quote>.</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<warning>
|
||||
<para>To use this support, your kernel and iptables must include the
|
||||
Netfilter+ipsec patches and policy match support and you must be running
|
||||
Shorewall 2.1.4 or later.</para>
|
||||
</warning>
|
||||
|
||||
<warning>
|
||||
<para>As of this writing, the Netfilter+ipsec and policy match support are
|
||||
broken when used with a bridge device. The problem has been reported to
|
||||
the responsible Netfilter developer who has confirmed the problem.</para>
|
||||
</warning>
|
||||
|
||||
<section>
|
||||
<title>IPSec Gateway on the Firewall System</title>
|
||||
|
||||
<para>Suppose that we have the following sutuation:</para>
|
||||
|
||||
<graphic fileref="images/TwoNets1.png" />
|
||||
|
||||
<para>We want systems in the 192.168.1.0/24 sub-network to be able to
|
||||
communicate with systems in the 10.0.0.0/8 network. We assume that on both
|
||||
systems A and B, eth0 is the internet interface.</para>
|
||||
|
||||
<para>To make this work, we need to do two things:</para>
|
||||
|
||||
<orderedlist numeration="loweralpha">
|
||||
<listitem>
|
||||
<para>Open the firewall so that the IPSEC tunnel can be established
|
||||
(allow the ESP and AH protocols and UDP Port 500).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Allow traffic through the tunnel.</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>Opening the firewall for the IPSEC tunnel is accomplished by adding
|
||||
an entry to the <filename>/etc/shorewall/tunnels</filename> file.</para>
|
||||
|
||||
<para>In <filename>/etc/shorewall/tunnels</filename> on system A, we need
|
||||
the following</para>
|
||||
|
||||
<blockquote>
|
||||
<para><filename>/etc/shorewall/tunnels</filename> — System A:</para>
|
||||
|
||||
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
|
||||
ipsec net 134.28.54.2
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/tunnels</filename> — System B:</para>
|
||||
|
||||
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
|
||||
ipsec net 206.161.148.9
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
|
||||
<note>
|
||||
<para>If either of the endpoints is behind a NAT gateway then the
|
||||
tunnels file entry on the <emphasis role="bold">other</emphasis>
|
||||
endpoint should specify a tunnel type of ipsecnat rather than ipsec and
|
||||
the GATEWAY address should specify the external address of the NAT
|
||||
gateway.</para>
|
||||
</note>
|
||||
|
||||
<para>You need to define a zone for the remote subnet or include it in
|
||||
your local zone. In this example, we'll assume that you have created a
|
||||
zone called <quote>vpn</quote> to represent the remote subnet.</para>
|
||||
|
||||
<blockquote>
|
||||
<para><filename>/etc/shorewall/zones</filename> — Systems A and
|
||||
B:</para>
|
||||
|
||||
<programlisting>#ZONE DISPLAY COMMENTS
|
||||
net Internet The big bad internet
|
||||
vpn VPN Virtual Private Network
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
|
||||
<para>Remember the assumption that both systems A and B have eth0 as their
|
||||
internet interface.</para>
|
||||
|
||||
<para>You must define the vpn zone using the
|
||||
<filename>/etc/shorewall/hosts</filename> file.</para>
|
||||
|
||||
<blockquote>
|
||||
<para>/etc/shorewall/hosts — System A</para>
|
||||
|
||||
<programlisting>#ZONE HOSTS OPTIONS
|
||||
vpn eth0:10.0.0.0/8 <emphasis role="bold">ipsec</emphasis>
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para>/etc/shorewall/hosts — System B</para>
|
||||
|
||||
<programlisting>#ZONE HOSTS OPTIONS
|
||||
vpn eth0:192.168.1.0/24 <emphasis role="bold">ipsec</emphasis>
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
|
||||
<para>Once you have these entries in place, restart Shorewall (type
|
||||
shorewall restart); you are now ready to configure IPSEC.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Mobile System (Road Warrior)</title>
|
||||
|
||||
<para>Suppose that you have a laptop system (B) that you take with you
|
||||
when you travel and you want to be able to establish a secure connection
|
||||
back to your local network.</para>
|
||||
|
||||
<graphic fileref="images/Mobile.png" />
|
||||
|
||||
<example>
|
||||
<title>Road Warrior VPN</title>
|
||||
|
||||
<para>You need to define a zone for the laptop or include it in your
|
||||
local zone. In this example, we'll assume that you have created a zone
|
||||
called <quote>vpn</quote> to represent the remote host.</para>
|
||||
|
||||
<blockquote>
|
||||
<para>/etc/shorewall/zones — System A</para>
|
||||
|
||||
<programlisting>#ZONE DISPLAY COMMENTS
|
||||
net Internet The big bad internet
|
||||
vpn VPN Road Warriors
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
|
||||
<para>In this instance, the mobile system (B) has IP address 134.28.54.2
|
||||
but that cannot be determined in advance. In the
|
||||
<filename>/etc/shorewall/tunnels</filename> file on system A, the
|
||||
following entry should be made:<blockquote>
|
||||
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
|
||||
ipsec net 0.0.0.0/0 vpn
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote></para>
|
||||
|
||||
<para><note>
|
||||
<para>the GATEWAY ZONE column contains the name of the zone
|
||||
corresponding to peer subnetworks. This indicates that the gateway
|
||||
system itself comprises the peer subnetwork; in other words, the
|
||||
remote gateway is a standalone system.</para>
|
||||
</note></para>
|
||||
|
||||
<para>The VPN zone is defined using the /etc/shorewall/hosts
|
||||
file:</para>
|
||||
|
||||
<blockquote>
|
||||
<para>/etc/shorewall/hosts — System A:</para>
|
||||
|
||||
<programlisting>#ZONE HOSTS OPTIONS
|
||||
vpn eth0:0.0.0.0/0 <emphasis role="bold"> ipsec</emphasis>
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
</blockquote>
|
||||
|
||||
<para>You will need to configure your <quote>through the tunnel</quote>
|
||||
policy as shown under the first example above.</para>
|
||||
</example>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Transport Mode</title>
|
||||
|
||||
<para>In today's wireless world, it is often the case that individual
|
||||
hosts in a network need to establish secure connections with the other
|
||||
hosts in that network. In that case, IPSEC transport mode is an
|
||||
appropriate solution.</para>
|
||||
|
||||
<para><graphic fileref="images/TransportMode.png" />Here's an example
|
||||
using the ipsec-tools package. The files shown are from host
|
||||
192.168.20.10; the configuration of the other nodes is similar.</para>
|
||||
|
||||
<blockquote>
|
||||
<para><filename>/etc/racoon/racoon.conf</filename>:</para>
|
||||
|
||||
<programlisting>path pre_shared_key "/etc/racoon/psk.txt" ;
|
||||
|
||||
remote anonymous
|
||||
{
|
||||
exchange_mode aggressive ;
|
||||
my_identifier user_fqdn "teastep@shorewall.net" ;
|
||||
lifetime time 24 hour ;
|
||||
proposal {
|
||||
encryption_algorithm 3des;
|
||||
hash_algorithm sha1;
|
||||
authentication_method pre_shared_key ;
|
||||
dh_group 2 ;
|
||||
}
|
||||
}
|
||||
|
||||
sainfo anonymous
|
||||
{
|
||||
pfs_group 2;
|
||||
lifetime time 12 hour ;
|
||||
encryption_algorithm 3des, blowfish, des, rijndael ;
|
||||
authentication_algorithm hmac_sha1, hmac_md5 ;
|
||||
compression_algorithm deflate ;
|
||||
}
|
||||
</programlisting>
|
||||
|
||||
<para><filename>/etc/racoon/setkey.conf</filename>:</para>
|
||||
|
||||
<programlisting># First of all flush the SPD database
|
||||
spdflush;
|
||||
|
||||
# Add some SPD rules
|
||||
|
||||
spdadd 192.168.20.10/32 192.168.20.20/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.20/require;
|
||||
spdadd 192.168.20.20/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.20-192.168.20.10/require;
|
||||
spdadd 192.168.20.10/32 192.168.20.30/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.30/require;
|
||||
spdadd 192.168.20.30/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.30-192.168.20.10/require;
|
||||
spdadd 192.168.20.10/32 192.168.20.40/32 any -P out ipsec esp/transport/192.168.20.10-192.168.20.40/require;
|
||||
spdadd 192.168.20.40/32 192.168.20.10/32 any -P in ipsec esp/transport/192.168.20.40-192.168.20.10/require;
|
||||
</programlisting>
|
||||
|
||||
<para>/etc/racoon/psk.txt:</para>
|
||||
|
||||
<programlisting>teastep@shorewall.net <key></programlisting>
|
||||
</blockquote>
|
||||
|
||||
<para>Shorewall configuration goes as follows:</para>
|
||||
|
||||
<blockquote>
|
||||
<para><filename>/etc/shorewall/zones</filename>:</para>
|
||||
|
||||
<programlisting>#ZONE DISPLAY COMMENTS
|
||||
loc Local Local Network
|
||||
net Net Internet
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/interfaces</filename>:</para>
|
||||
|
||||
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
||||
net eth0 detect routefilter,dhcp,tcpflags
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/hosts</filename>:</para>
|
||||
|
||||
<programlisting>#ZONE HOST(S) OPTIONS
|
||||
loc eth0:192.168.20.0/24 ipsec
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/policy</filename>:</para>
|
||||
|
||||
<programlisting>#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
|
||||
fw all ACCEPT
|
||||
loc fw ACCEPT
|
||||
net loc NONE
|
||||
loc net NONE
|
||||
net all DROP info
|
||||
# The FOLLOWING POLICY MUST BE LAST
|
||||
all all REJECT info
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para>Since there are no cases where net<->loc traffic should
|
||||
occur, NONE policies are used.</para>
|
||||
</blockquote>
|
||||
</section>
|
||||
</article>
|
||||
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2004-08-13</pubdate>
|
||||
<pubdate>2004-08-15</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2004</year>
|
||||
@ -39,6 +39,12 @@
|
||||
Kernel. Netfilter currently lacks full support for the 2.6 kernel's
|
||||
implementation of IPSEC. Until that implementation is complete, only a
|
||||
simple network-network tunnel is described for 2.6.</para>
|
||||
|
||||
<para>UPDATE: Some distributions such as <trademark>SuSE</trademark> are
|
||||
now shipping Kernels and iptables with the IPSEC-Netfilter patches and
|
||||
policy match support. Check <ulink url="IPSEC-2.6.html">this
|
||||
article</ulink> for information concerning this support and
|
||||
Shorewall.</para>
|
||||
</warning>
|
||||
|
||||
<section>
|
||||
|
||||
Binary file not shown.
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2004-07-31</pubdate>
|
||||
<pubdate>2004-08-10</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2002-2004</year>
|
||||
@ -29,7 +29,8 @@
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||
License</ulink></quote>.</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
@ -40,9 +41,9 @@
|
||||
is a fairly straight-forward task if you understand the basics and follow
|
||||
the documentation.</para>
|
||||
|
||||
<para>This guide doesn't attempt to acquaint you with all of the
|
||||
features of Shorewall. It rather focuses on what is required to configure
|
||||
Shorewall in one of its more popular configurations:</para>
|
||||
<para>This guide doesn't attempt to acquaint you with all of the features
|
||||
of Shorewall. It rather focuses on what is required to configure Shorewall
|
||||
in one of its more popular configurations:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
@ -55,8 +56,9 @@
|
||||
|
||||
<note>
|
||||
<para>If you have more than one public IP address, this is not the
|
||||
guide you want -- see the <ulink url="shorewall_setup_guide.htm">Shorewall
|
||||
Setup Guide</ulink> instead.</para>
|
||||
guide you want -- see the <ulink
|
||||
url="shorewall_setup_guide.htm">Shorewall Setup Guide</ulink>
|
||||
instead.</para>
|
||||
</note>
|
||||
</listitem>
|
||||
|
||||
@ -85,12 +87,13 @@
|
||||
<section>
|
||||
<title>Requirements</title>
|
||||
|
||||
<para>Shorewall requires that you have the <command>iproute</command>/<command>iproute2</command>
|
||||
package installed (on <trademark>RedHat</trademark>, the package is
|
||||
called <command>iproute</command>). You can tell if this package is
|
||||
installed by the presence of an <command>ip</command> program on your
|
||||
firewall system. As <systemitem class="username">root</systemitem>, you
|
||||
can use the <command>which</command> command to check for this program:</para>
|
||||
<para>Shorewall requires that you have the
|
||||
<command>iproute</command>/<command>iproute2</command> package installed
|
||||
(on <trademark>RedHat</trademark>, the package is called
|
||||
<command>iproute</command>). You can tell if this package is installed
|
||||
by the presence of an <command>ip</command> program on your firewall
|
||||
system. As <systemitem class="username">root</systemitem>, you can use
|
||||
the <command>which</command> command to check for this program:</para>
|
||||
|
||||
<programlisting>[root@gateway root]# <command>which ip</command>
|
||||
/sbin/ip
|
||||
@ -101,8 +104,8 @@
|
||||
<title>Before you start</title>
|
||||
|
||||
<para>I recommend that you first read through the guide to familiarize
|
||||
yourself with what's involved then go back through it again making
|
||||
your configuration changes.</para>
|
||||
yourself with what's involved then go back through it again making your
|
||||
configuration changes.</para>
|
||||
|
||||
<caution>
|
||||
<para>If you edit your configuration files on a
|
||||
@ -121,7 +124,8 @@
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
<para><ulink
|
||||
url="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||
Version of dos2unix</ulink></para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
@ -132,7 +136,8 @@
|
||||
<title>Conventions</title>
|
||||
|
||||
<para>Points at which configuration changes are recommended are flagged
|
||||
with <inlinegraphic fileref="images/BD21298_.gif" format="GIF" />.</para>
|
||||
with <inlinegraphic fileref="images/BD21298_.gif"
|
||||
format="GIF" />.</para>
|
||||
|
||||
<para>Configuration notes that are unique to LEAF/Bering are marked with
|
||||
<inlinegraphic fileref="images/leaflogo.gif" format="GIF" />.</para>
|
||||
@ -145,9 +150,10 @@
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>If you have an ADSL Modem and you use PPTP to communicate with a
|
||||
server in that modem, you must make the <ulink url="PPTP.htm#PPTP_ADSL">changes
|
||||
recommended here</ulink> in addition to those detailed below. ADSL with
|
||||
PPTP is most commonly found in Europe, notably in Austria.</para>
|
||||
server in that modem, you must make the <ulink
|
||||
url="PPTP.htm#PPTP_ADSL">changes recommended here</ulink> in addition to
|
||||
those detailed below. ADSL with PPTP is most commonly found in Europe,
|
||||
notably in Austria.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@ -157,23 +163,30 @@
|
||||
|
||||
<para>The configuration files for Shorewall are contained in the directory
|
||||
<filename>/etc/shorewall</filename> -- for simple setups, you will only
|
||||
need to deal with a few of these as described in this guide.<warning><para><emphasis
|
||||
role="bold">Note to Debian Users</emphasis></para><para>If you install
|
||||
using the .deb, you will find that your <filename class="directory">/etc/shorewall</filename>
|
||||
directory is empty. This is intentional. The released configuration file
|
||||
skeletons may be found on your system in the directory <filename
|
||||
class="directory">/usr/share/doc/shorewall/default-config</filename>.
|
||||
Simply copy the files you need from that directory to <filename
|
||||
class="directory">/etc/shorewall</filename> and modify the copies.</para><para>Note
|
||||
that you must copy <filename class="directory">/usr/share/doc/shorewall/default-config/shorewall.conf</filename>
|
||||
and /usr/share/doc/shorewall/default-config/modules to /etc/shorewall even
|
||||
if you do not modify those files.</para></warning></para>
|
||||
need to deal with a few of these as described in this guide.<warning>
|
||||
<para><emphasis role="bold">Note to Debian Users</emphasis></para>
|
||||
|
||||
<para>If you install using the .deb, you will find that your <filename
|
||||
class="directory">/etc/shorewall</filename> directory is empty. This
|
||||
is intentional. The released configuration file skeletons may be found
|
||||
on your system in the directory <filename
|
||||
class="directory">/usr/share/doc/shorewall/default-config</filename>.
|
||||
Simply copy the files you need from that directory to <filename
|
||||
class="directory">/etc/shorewall</filename> and modify the
|
||||
copies.</para>
|
||||
|
||||
<para>Note that you must copy <filename
|
||||
class="directory">/usr/share/doc/shorewall/default-config/shorewall.conf</filename>
|
||||
and /usr/share/doc/shorewall/default-config/modules to /etc/shorewall
|
||||
even if you do not modify those files.</para>
|
||||
</warning></para>
|
||||
|
||||
<para>After you have installed Shorewall, download the <ulink
|
||||
url="http://shorewall.net/pub/shorewall/Samples">three-interface sample</ulink>,
|
||||
un-tar it (<command>tar <option>-zxvf</option> <filename>three-interfaces.tgz</filename></command>)
|
||||
and and copy the files to <filename>/etc/shorewall</filename> (the files
|
||||
will replace files with the same names that were placed in
|
||||
url="http://shorewall.net/pub/shorewall/Samples">three-interface
|
||||
sample</ulink>, un-tar it (<command>tar <option>-zxvf</option>
|
||||
<filename>three-interfaces.tgz</filename></command>) and and copy the
|
||||
files to <filename>/etc/shorewall</filename> (the files will replace files
|
||||
with the same names that were placed in
|
||||
<filename>/etc/shorewall</filename> when Shorewall was installed).</para>
|
||||
|
||||
<para>As each file is introduced, I suggest that you look through the
|
||||
@ -216,7 +229,8 @@
|
||||
</tgroup>
|
||||
</informaltable>
|
||||
|
||||
<para>Zone names are defined in <filename>/etc/shorewall/zones</filename>.</para>
|
||||
<para>Zone names are defined in
|
||||
<filename>/etc/shorewall/zones</filename>.</para>
|
||||
|
||||
<para>Shorewall also recognizes the firewall system as its own zone - by
|
||||
default, the firewall itself is known as <varname>fw</varname>.</para>
|
||||
@ -227,7 +241,8 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>You express your default policy for connections from one zone to
|
||||
another zone in the <filename>/etc/shorewall/policy</filename> file.</para>
|
||||
another zone in the <filename>/etc/shorewall/policy</filename>
|
||||
file.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -311,31 +326,37 @@ fw net ACCEPT</programlisting>
|
||||
<quote>Modem</quote> (e.g., <filename class="devicefile">eth0</filename>)
|
||||
unless you connect via <emphasis>Point-to-Point Protocol</emphasis> over
|
||||
Ethernet (PPPoE) or <emphasis>Point-to-Point Tunneling Protocol</emphasis>
|
||||
(PPTP) in which case the External Interface will be a <literal>ppp</literal>
|
||||
interface (e.g., <filename class="devicefile">ppp0</filename>). If you
|
||||
connect via a regular modem, your External Interface will also be
|
||||
<filename class="devicefile">ppp0</filename>. If you connect using ISDN,
|
||||
you external interface will be <filename class="devicefile">ippp0</filename>.</para>
|
||||
(PPTP) in which case the External Interface will be a
|
||||
<literal>ppp</literal> interface (e.g., <filename
|
||||
class="devicefile">ppp0</filename>). If you connect via a regular modem,
|
||||
your External Interface will also be <filename
|
||||
class="devicefile">ppp0</filename>. If you connect using ISDN, you
|
||||
external interface will be <filename
|
||||
class="devicefile">ippp0</filename>.</para>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>If your external interface is <filename class="devicefile">ppp0</filename>
|
||||
or <filename class="devicefile">ippp0</filename> then you will want to set
|
||||
<varname>CLAMPMSS=yes</varname> in <filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
||||
<para>If your external interface is <filename
|
||||
class="devicefile">ppp0</filename> or <filename
|
||||
class="devicefile">ippp0</filename> then you will want to set
|
||||
<varname>CLAMPMSS=yes</varname> in
|
||||
<filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
||||
|
||||
<para>Your Local Interface will be an ethernet adapter (<filename
|
||||
class="devicefile">eth0</filename>, <filename class="devicefile">eth1</filename>
|
||||
or <filename class="devicefile">eth2</filename>) and will be connected to
|
||||
a hub or switch. Your local computers will be connected to the same switch
|
||||
(note: If you have only a single local system, you can connect the
|
||||
firewall directly to the computer using a cross-over cable).</para>
|
||||
class="devicefile">eth0</filename>, <filename
|
||||
class="devicefile">eth1</filename> or <filename
|
||||
class="devicefile">eth2</filename>) and will be connected to a hub or
|
||||
switch. Your local computers will be connected to the same switch (note:
|
||||
If you have only a single local system, you can connect the firewall
|
||||
directly to the computer using a cross-over cable).</para>
|
||||
|
||||
<para>Your DMZ Interface will also be an ethernet adapter (<filename
|
||||
class="devicefile">eth0</filename>, <filename class="devicefile">eth1</filename>
|
||||
or <filename class="devicefile">eth2</filename>) and will be connected to
|
||||
a hub or switch. Your DMZ computers will be connected to the same switch
|
||||
(note: If you have only a single DMZ system, you can connect the firewall
|
||||
directly to the computer using a cross-over cable).</para>
|
||||
class="devicefile">eth0</filename>, <filename
|
||||
class="devicefile">eth1</filename> or <filename
|
||||
class="devicefile">eth2</filename>) and will be connected to a hub or
|
||||
switch. Your DMZ computers will be connected to the same switch (note: If
|
||||
you have only a single DMZ system, you can connect the firewall directly
|
||||
to the computer using a cross-over cable).</para>
|
||||
|
||||
<caution>
|
||||
<para>Do not connect the internal and external interface to the same hub
|
||||
@ -359,23 +380,25 @@ fw net ACCEPT</programlisting>
|
||||
for the interfaces. Some hints:</para>
|
||||
|
||||
<tip>
|
||||
<para>If your external interface is <filename class="devicefile">ppp0</filename>
|
||||
or <filename class="devicefile">ippp0</filename>, you can replace the
|
||||
<para>If your external interface is <filename
|
||||
class="devicefile">ppp0</filename> or <filename
|
||||
class="devicefile">ippp0</filename>, you can replace the
|
||||
<quote>detect</quote> in the second column with <quote>-</quote>
|
||||
(without the quotes).</para>
|
||||
</tip>
|
||||
|
||||
<tip>
|
||||
<para>If your external interface is <filename class="devicefile">ppp0</filename>
|
||||
or <filename class="devicefile">ippp0</filename> or if you have a static
|
||||
IP address, you can remove <quote>dhcp</quote> from the option list.</para>
|
||||
<para>If your external interface is <filename
|
||||
class="devicefile">ppp0</filename> or <filename
|
||||
class="devicefile">ippp0</filename> or if you have a static IP address,
|
||||
you can remove <quote>dhcp</quote> from the option list.</para>
|
||||
</tip>
|
||||
|
||||
<tip>
|
||||
<para>If you specify <emphasis>nobogons</emphasis> for your external
|
||||
interface, you will want to check the <ulink url="errata.htm">Shorewall
|
||||
Errata</ulink> periodically for updates to the <filename>/usr/share/shorewall/bogons
|
||||
file</filename>.</para>
|
||||
Errata</ulink> periodically for updates to the
|
||||
<filename>/usr/share/shorewall/bogons file</filename>.</para>
|
||||
</tip>
|
||||
</section>
|
||||
|
||||
@ -388,7 +411,7 @@ fw net ACCEPT</programlisting>
|
||||
Configuration Protocol (DHCP) or as part of establishing your connection
|
||||
when you dial in (standard modem) or establish your PPP connection. In
|
||||
rare cases, your ISP may assign you a static IP address; that means that
|
||||
you configure your firewall's external interface to use that address
|
||||
you configure your firewall's external interface to use that address
|
||||
permanently. Regardless of how the address is assigned, it will be shared
|
||||
by all of your systems when you access the Internet. You will have to
|
||||
assign your own addresses for your internal network (the local and DMZ
|
||||
@ -403,16 +426,17 @@ fw net ACCEPT</programlisting>
|
||||
|
||||
<para>Before starting Shorewall, you should look at the IP address of your
|
||||
external interface and if it is one of the above ranges, you should remove
|
||||
the <varname>norfc1918</varname> option from the external interface's
|
||||
the <varname>norfc1918</varname> option from the external interface's
|
||||
entry in <filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
|
||||
<para>You will want to assign your local addresses from one sub-network or
|
||||
subnet and your DMZ addresses from another subnet. For our purposes, we
|
||||
can consider a subnet to consists of a range of addresses <systemitem
|
||||
class="ipaddress">x.y.z.0</systemitem> - <systemitem class="ipaddress">x.y.z.255</systemitem>.
|
||||
Such a subnet will have a Subnet Mask of <systemitem class="netmask">255.255.255.0</systemitem>.
|
||||
The address <systemitem class="ipaddress">x.y.z.0</systemitem> is reserved
|
||||
as the Subnet Address and <systemitem class="netmask">x.y.z.255</systemitem>
|
||||
class="ipaddress">x.y.z.0</systemitem> - <systemitem
|
||||
class="ipaddress">x.y.z.255</systemitem>. Such a subnet will have a Subnet
|
||||
Mask of <systemitem class="netmask">255.255.255.0</systemitem>. The
|
||||
address <systemitem class="ipaddress">x.y.z.0</systemitem> is reserved as
|
||||
the Subnet Address and <systemitem class="netmask">x.y.z.255</systemitem>
|
||||
is reserved as the Subnet Broadcast Address. In Shorewall, a subnet is
|
||||
described using Classless InterDomain Routing (CIDR) notation with
|
||||
consists of the subnet address followed by <varname>/24</varname>. The
|
||||
@ -436,27 +460,31 @@ fw net ACCEPT</programlisting>
|
||||
<row>
|
||||
<entry>Subnet Address:</entry>
|
||||
|
||||
<entry><systemitem class="ipaddress">10.10.10.0</systemitem></entry>
|
||||
<entry><systemitem
|
||||
class="ipaddress">10.10.10.0</systemitem></entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>Broadcast Address:</entry>
|
||||
|
||||
<entry><systemitem class="ipaddress">10.10.10.255</systemitem></entry>
|
||||
<entry><systemitem
|
||||
class="ipaddress">10.10.10.255</systemitem></entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>CIDR Notation:</entry>
|
||||
|
||||
<entry><systemitem class="ipaddress">10.10.10.0/24</systemitem></entry>
|
||||
<entry><systemitem
|
||||
class="ipaddress">10.10.10.0/24</systemitem></entry>
|
||||
</row>
|
||||
</tbody>
|
||||
</tgroup>
|
||||
</table>
|
||||
|
||||
<para>It is conventional to assign the internal interface either the first
|
||||
usable address in the subnet (<systemitem class="ipaddress">10.10.10.1</systemitem>
|
||||
in the above example) or the last usable address (<systemitem
|
||||
usable address in the subnet (<systemitem
|
||||
class="ipaddress">10.10.10.1</systemitem> in the above example) or the
|
||||
last usable address (<systemitem
|
||||
class="ipaddress">10.10.10.254</systemitem>).</para>
|
||||
|
||||
<para>One of the purposes of subnetting is to allow all computers in the
|
||||
@ -466,17 +494,18 @@ fw net ACCEPT</programlisting>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>Your local computers (Local Computers 1 & 2) should be
|
||||
<para>Your local computers (Local Computers 1 & 2) should be
|
||||
configured with their default gateway set to the IP address of the
|
||||
firewall's internal interface and your DMZ computers (DMZ Computers 1
|
||||
& 2) should be configured with their default gateway set to the IP
|
||||
address of the firewall's DMZ interface.</para>
|
||||
firewall's internal interface and your DMZ computers (DMZ Computers 1
|
||||
& 2) should be configured with their default gateway set to the IP
|
||||
address of the firewall's DMZ interface.</para>
|
||||
|
||||
<para>The foregoing short discussion barely scratches the surface
|
||||
regarding subnetting and routing. If you are interested in learning more
|
||||
about IP addressing and routing, I highly recommend <quote>IP
|
||||
Fundamentals: What Everyone Needs to Know about Addressing & Routing</quote>,
|
||||
Thomas A. Maufer, Prentice-Hall, 1999, ISBN 0-13-975483-0.</para>
|
||||
Fundamentals: What Everyone Needs to Know about Addressing &
|
||||
Routing</quote>, Thomas A. Maufer, Prentice-Hall, 1999, ISBN
|
||||
0-13-975483-0.</para>
|
||||
|
||||
<para>The remainder of this quide will assume that you have configured
|
||||
your network as shown here:</para>
|
||||
@ -492,13 +521,15 @@ fw net ACCEPT</programlisting>
|
||||
<caption>
|
||||
<para>The default gateway for the DMZ computers would be <systemitem
|
||||
class="ipaddress">10.10.11.254</systemitem> and the default gateway
|
||||
for the Local computers would be <systemitem class="ipaddress">10.10.10.254</systemitem>.</para>
|
||||
for the Local computers would be <systemitem
|
||||
class="ipaddress">10.10.10.254</systemitem>.</para>
|
||||
|
||||
<warning>
|
||||
<para>Your ISP might assign your external interface an RFC 1918
|
||||
address. If that address is in the <systemitem class="ipaddress">10.10.10.0/24</systemitem>
|
||||
subnet then you will need to select a DIFFERENT RFC 1918 subnet
|
||||
for your local network and if it is in the <systemitem
|
||||
address. If that address is in the <systemitem
|
||||
class="ipaddress">10.10.10.0/24</systemitem> subnet then you will
|
||||
need to select a DIFFERENT RFC 1918 subnet for your local network
|
||||
and if it is in the <systemitem
|
||||
class="ipaddress">10.10.11.0/24</systemitem> subnet then you will
|
||||
need to select a different RFC 1918 subnet for your DMZ.</para>
|
||||
</warning>
|
||||
@ -511,49 +542,59 @@ fw net ACCEPT</programlisting>
|
||||
<title>IP Masquerading (SNAT)</title>
|
||||
|
||||
<para>The addresses reserved by RFC 1918 are sometimes referred to as
|
||||
non-routable because the Internet backbone routers don't forward
|
||||
packets which have an RFC-1918 destination address. When one of your local
|
||||
systems (let's assume local computer 1) sends a connection request to
|
||||
an internet host, the firewall must perform Network Address Translation
|
||||
(NAT). The firewall rewrites the source address in the packet to be the
|
||||
address of the firewall's external interface; in other words, the
|
||||
firewall makes it look as if the firewall itself is initiating the
|
||||
connection. This is necessary so that the destination host will be able to
|
||||
route return packets back to the firewall (remember that packets whose
|
||||
destination address is reserved by RFC 1918 can't be routed accross
|
||||
the internet). When the firewall receives a return packet, it rewrites the
|
||||
destination address back to 10.10.10.1 and forwards the packet on to local
|
||||
computer 1.</para>
|
||||
non-routable because the Internet backbone routers don't forward packets
|
||||
which have an RFC-1918 destination address. When one of your local systems
|
||||
(let's assume local computer 1) sends a connection request to an internet
|
||||
host, the firewall must perform Network Address Translation (NAT). The
|
||||
firewall rewrites the source address in the packet to be the address of
|
||||
the firewall's external interface; in other words, the firewall makes it
|
||||
look as if the firewall itself is initiating the connection. This is
|
||||
necessary so that the destination host will be able to route return
|
||||
packets back to the firewall (remember that packets whose destination
|
||||
address is reserved by RFC 1918 can't be routed accross the internet).
|
||||
When the firewall receives a return packet, it rewrites the destination
|
||||
address back to 10.10.10.1 and forwards the packet on to local computer
|
||||
1.</para>
|
||||
|
||||
<para>On Linux systems, the above process is often referred to as IP
|
||||
Masquerading and you will also see the term Source Network Address
|
||||
Translation (SNAT) used. Shorewall follows the convention used with
|
||||
Netfilter: <itemizedlist><listitem><para><emphasis>Masquerade</emphasis>
|
||||
describes the case where you let your firewall system automatically detect
|
||||
the external interface address.</para></listitem><listitem><para><emphasis>SNAT</emphasis>
|
||||
refers to the case when you explicitly specify the source address that you
|
||||
want outbound packets from your local network to use.</para></listitem></itemizedlist>
|
||||
In Shorewall, both Masquerading and SNAT are configured with entries in
|
||||
the <filename class="directory">/etc/shorewall/</filename><filename>masq</filename>
|
||||
Netfilter: <itemizedlist>
|
||||
<listitem>
|
||||
<para><emphasis>Masquerade</emphasis> describes the case where you
|
||||
let your firewall system automatically detect the external interface
|
||||
address.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis>SNAT</emphasis> refers to the case when you
|
||||
explicitly specify the source address that you want outbound packets
|
||||
from your local network to use.</para>
|
||||
</listitem>
|
||||
</itemizedlist> In Shorewall, both Masquerading and SNAT are configured
|
||||
with entries in the <filename
|
||||
class="directory">/etc/shorewall/</filename><filename>masq</filename>
|
||||
file.</para>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>If your external firewall interface is <filename class="devicefile">eth0</filename>,
|
||||
your local interface <filename class="devicefile">eth1</filename> and your
|
||||
DMZ interface is <filename class="devicefile">eth2</filename> then you do
|
||||
not need to modify the file provided with the sample. Otherwise, edit
|
||||
<filename class="directory">/etc/shorewall/</filename><filename>masq</filename>
|
||||
and change it to match your configuration.</para>
|
||||
<para>If your external firewall interface is <filename
|
||||
class="devicefile">eth0</filename>, your local interface <filename
|
||||
class="devicefile">eth1</filename> and your DMZ interface is <filename
|
||||
class="devicefile">eth2</filename> then you do not need to modify the file
|
||||
provided with the sample. Otherwise, edit <filename
|
||||
class="directory">/etc/shorewall/</filename><filename>masq</filename> and
|
||||
change it to match your configuration.</para>
|
||||
|
||||
<para>If, despite all advice to the contrary, you are using this guide and
|
||||
want to use one-to-one NAT or Proxy ARP for your DMZ, remove the entry for
|
||||
eth2 from <filename>/etc/shorewall/masq</filename>.</para>
|
||||
<para>If, in spite of all advice to the contrary, you are using this guide
|
||||
and want to use one-to-one NAT or Proxy ARP for your DMZ, remove the entry
|
||||
for eth2 from <filename>/etc/shorewall/masq</filename>.</para>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>If your external IP is static, you can enter it in the third column
|
||||
in the <filename class="directory">/etc/shorewall/</filename><filename>masq</filename>
|
||||
in the <filename
|
||||
class="directory">/etc/shorewall/</filename><filename>masq</filename>
|
||||
entry if you like although your firewall will work fine if you leave that
|
||||
column empty. Entering your static IP in column 3 makes processing
|
||||
outgoing packets a little more efficient.</para>
|
||||
@ -562,9 +603,16 @@ fw net ACCEPT</programlisting>
|
||||
|
||||
<para>If you are using the Debian package, please check your
|
||||
<filename>shorewall.conf</filename> file to ensure that the following are
|
||||
set correctly; if they are not, change them appropriately:
|
||||
<itemizedlist><listitem><para><varname>NAT_ENABLED=Yes</varname>
|
||||
(Shorewall versions earlier than 1.4.6)</para></listitem><listitem><para><varname>IP_FORWARDING=On</varname></para></listitem></itemizedlist></para>
|
||||
set correctly; if they are not, change them appropriately: <itemizedlist>
|
||||
<listitem>
|
||||
<para><varname>NAT_ENABLED=Yes</varname> (Shorewall versions earlier
|
||||
than 1.4.6)</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><varname>IP_FORWARDING=On</varname></para>
|
||||
</listitem>
|
||||
</itemizedlist></para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@ -588,9 +636,10 @@ fw net ACCEPT</programlisting>
|
||||
<para>The general form of a simple port forwarding rule in <filename
|
||||
class="directory">/etc/shorewall/</filename><filename>rules</filename> is:
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
DNAT net dmz:<emphasis><server local IP address></emphasis>[:<emphasis><server port></emphasis>] <emphasis><protocol></emphasis> <emphasis><port></emphasis></programlisting>
|
||||
If you don't specify the <emphasis><varname><server port></varname></emphasis>,
|
||||
it is assumed to be the same as <emphasis><varname><port></varname></emphasis>.</para>
|
||||
DNAT net dmz:<emphasis><server local IP address></emphasis>[:<emphasis><server port></emphasis>] <emphasis><protocol></emphasis> <emphasis><port></emphasis></programlisting>
|
||||
If you don't specify the <emphasis><varname><server
|
||||
port></varname></emphasis>, it is assumed to be the same as
|
||||
<emphasis><varname><port></varname></emphasis>.</para>
|
||||
|
||||
<example>
|
||||
<title>You run a Web Server on DMZ Computer 2 and you want to forward
|
||||
@ -598,71 +647,113 @@ DNAT net dmz:<emphasis><server local IP address></emphasis>[:
|
||||
|
||||
<para><programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
DNAT net dmz:10.10.11.2 tcp 80
|
||||
ACCEPT loc dmz:10.10.11.2 tcp 80</programlisting><itemizedlist><listitem><para>Entry
|
||||
1 forwards port 80 from the Internet.</para></listitem><listitem><para>Entry
|
||||
2 allows connections from the local network.</para></listitem></itemizedlist>
|
||||
Several important points to keep in mind:<itemizedlist><listitem><para>When
|
||||
you are connecting to your server from your local systems, you must use
|
||||
the server's internal IP address (<systemitem class="ipaddress">10.10.11.2</systemitem>).</para></listitem><listitem><para>Many
|
||||
ISPs block incoming connection requests to port 80. If you have problems
|
||||
connecting to your web server, try the following rule and try connecting
|
||||
to port 5000 (e.g., connect to <literal>http://w.x.y.z:5000 where
|
||||
w.x.y.z</literal> is your external IP).<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE
|
||||
ACCEPT loc dmz:10.10.11.2 tcp 80</programlisting><itemizedlist>
|
||||
<listitem>
|
||||
<para>Entry 1 forwards port 80 from the Internet.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Entry 2 allows connections from the local network.</para>
|
||||
</listitem>
|
||||
</itemizedlist> Several important points to keep in mind:<itemizedlist>
|
||||
<listitem>
|
||||
<para>When you are connecting to your server from your local
|
||||
systems, you must use the server's internal IP address
|
||||
(<systemitem class="ipaddress">10.10.11.2</systemitem>).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Many ISPs block incoming connection requests to port 80. If
|
||||
you have problems connecting to your web server, try the following
|
||||
rule and try connecting to port 5000 (e.g., connect to
|
||||
<literal>http://w.x.y.z:5000 where w.x.y.z</literal> is your
|
||||
external IP).<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE
|
||||
# PORT(S)
|
||||
DNAT net dmz:10.10.11.2:80 tcp 80 5000</programlisting></para></listitem><listitem><para>If
|
||||
you want to be able to access your server from the local network using
|
||||
your external address, then if you have a static external IP you can
|
||||
replace the loc->dmz rule above with:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
|
||||
DNAT net dmz:10.10.11.2:80 tcp 80 5000</programlisting></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>If you want to be able to access your server from the local
|
||||
network using your external address, then if you have a static
|
||||
external IP you can replace the loc->dmz rule above
|
||||
with:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
|
||||
# PORT(S) DEST
|
||||
DNAT loc dmz:10.10.11.2 tcp 80 - <emphasis><external IP></emphasis></programlisting>If
|
||||
you have a dynamic IP then you must ensure that your external interface
|
||||
is up before starting Shorewall and you must take steps as follows
|
||||
(assume that your external interface is <filename class="devicefile">eth0</filename>):<orderedlist><listitem><para>Include
|
||||
the following in /etc/shorewall/params:</para><para><command>ETH0_IP=$(find_interface_address
|
||||
eth0)</command></para></listitem><listitem><para>Make your
|
||||
<literal>loc->dmz</literal> rule: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
|
||||
DNAT loc dmz:10.10.11.2 tcp 80 - <emphasis><external IP></emphasis></programlisting>If
|
||||
you have a dynamic IP then you must ensure that your external
|
||||
interface is up before starting Shorewall and you must take steps
|
||||
as follows (assume that your external interface is <filename
|
||||
class="devicefile">eth0</filename>):<orderedlist>
|
||||
<listitem>
|
||||
<para>Include the following in /etc/shorewall/params:</para>
|
||||
|
||||
<para><command>ETH0_IP=$(find_interface_address
|
||||
eth0)</command></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Make your <literal>loc->dmz</literal> rule:
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
|
||||
# PORT(S) DEST
|
||||
DNAT loc dmz:10.10.11.2 tcp 80 - $ETH0_IP</programlisting></para></listitem></orderedlist></para></listitem><listitem><para>If
|
||||
you want to access your server from the DMZ using your external IP
|
||||
address, see <ulink url="FAQ.htm#faq2a">FAQ 2a</ulink>.</para></listitem></itemizedlist></para>
|
||||
DNAT loc dmz:10.10.11.2 tcp 80 - $ETH0_IP</programlisting></para>
|
||||
</listitem>
|
||||
</orderedlist></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>If you want to access your server from the DMZ using your
|
||||
external IP address, see <ulink url="FAQ.htm#faq2a">FAQ
|
||||
2a</ulink>.</para>
|
||||
</listitem>
|
||||
</itemizedlist></para>
|
||||
</example>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>At this point, add the DNAT and ACCEPT rules for your servers.</para>
|
||||
<para>At this point, add the DNAT and ACCEPT rules for your
|
||||
servers.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Domain Name Server (DNS)</title>
|
||||
|
||||
<para>Normally, when you connect to your ISP, as part of getting an IP
|
||||
address your firewall's <emphasis>Domain Name Service</emphasis> (DNS)
|
||||
resolver will be automatically configured (e.g., the <filename>/etc/resolv.conf</filename>
|
||||
file will be written). Alternatively, your ISP may have given you the IP
|
||||
address of a pair of DNS name servers for you to manually configure as
|
||||
your primary and secondary name servers. It is your responsibility to
|
||||
configure the resolver in your internal systems. You can take one of two
|
||||
approaches: <itemizedlist><listitem><para>You can configure your internal
|
||||
systems to use your ISP's name servers. If your ISP gave you the
|
||||
addresses of their servers or if those addresses are available on their
|
||||
web site, you can configure your internal systems to use those addresses.
|
||||
If that information isn't available, look in <filename>/etc/resolv.conf</filename>
|
||||
on your firewall system -- the name servers are given in <quote>nameserver</quote>
|
||||
records in that file.</para></listitem><listitem><para><inlinegraphic
|
||||
fileref="images/BD21298_.gif" format="GIF" /></para><para>You can
|
||||
configure a <emphasis>Caching Name Server</emphasis> on your firewall or
|
||||
in your DMZ. <trademark>Red Hat</trademark> has an RPM for a caching name
|
||||
server (which also requires the '<command>bind</command>' RPM) and
|
||||
for Bering users, there is <filename>dnscache.lrp</filename>. If you take
|
||||
this approach, you configure your internal systems to use the caching name
|
||||
server as their primary (and only) name server. You use the internal IP
|
||||
address of the firewall (<systemitem class="ipaddress">10.10.10.254</systemitem>
|
||||
in the example above) for the name server address if you choose to run the
|
||||
name server on your firewall. To allow your local systems to talk to your
|
||||
caching name server, you must open port 53 (both UDP and TCP) from the
|
||||
local network to the server; you do that by adding the rules in
|
||||
<filename>/etc/shorewall/rules</filename>.</para></listitem></itemizedlist>
|
||||
If you run the name server on the firewall:
|
||||
address your firewall's <emphasis>Domain Name Service</emphasis> (DNS)
|
||||
resolver will be automatically configured (e.g., the
|
||||
<filename>/etc/resolv.conf</filename> file will be written).
|
||||
Alternatively, your ISP may have given you the IP address of a pair of DNS
|
||||
name servers for you to manually configure as your primary and secondary
|
||||
name servers. It is your responsibility to configure the resolver in your
|
||||
internal systems. You can take one of two approaches: <itemizedlist>
|
||||
<listitem>
|
||||
<para>You can configure your internal systems to use your ISP's name
|
||||
servers. If your ISP gave you the addresses of their servers or if
|
||||
those addresses are available on their web site, you can configure
|
||||
your internal systems to use those addresses. If that information
|
||||
isn't available, look in <filename>/etc/resolv.conf</filename> on
|
||||
your firewall system -- the name servers are given in
|
||||
<quote>nameserver</quote> records in that file.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif"
|
||||
format="GIF" /></para>
|
||||
|
||||
<para>You can configure a <emphasis>Caching Name Server</emphasis>
|
||||
on your firewall or in your DMZ. <trademark>Red Hat</trademark> has
|
||||
an RPM for a caching name server (which also requires the
|
||||
'<command>bind</command>' RPM) and for Bering users, there is
|
||||
<filename>dnscache.lrp</filename>. If you take this approach, you
|
||||
configure your internal systems to use the caching name server as
|
||||
their primary (and only) name server. You use the internal IP
|
||||
address of the firewall (<systemitem
|
||||
class="ipaddress">10.10.10.254</systemitem> in the example above)
|
||||
for the name server address if you choose to run the name server on
|
||||
your firewall. To allow your local systems to talk to your caching
|
||||
name server, you must open port 53 (both UDP and TCP) from the local
|
||||
network to the server; you do that by adding the rules in
|
||||
<filename>/etc/shorewall/rules</filename>.</para>
|
||||
</listitem>
|
||||
</itemizedlist> If you run the name server on the firewall:
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
AllowDNS loc fw
|
||||
AllowDNS dmz fw </programlisting> Run name server on DMZ
|
||||
@ -674,11 +765,12 @@ AllowDNS fw dmz:10.10.11.1 </programlisting></para>
|
||||
<emphasis>defined action</emphasis>. Shorewall includes a number of
|
||||
defined actions and <ulink url="User_defined_Actions.html">you can add
|
||||
your own</ulink>. To see the list of actions included with your version of
|
||||
Shorewall, look in the file <filename>/usr/share/shorewall/actions.std</filename>.
|
||||
Those actions that accept connection requests have names that begin with
|
||||
Shorewall, look in the file
|
||||
<filename>/usr/share/shorewall/actions.std</filename>. Those actions that
|
||||
accept connection requests have names that begin with
|
||||
<quote>Allow</quote>.</para>
|
||||
|
||||
<para>You don't have to use defined actions when coding a rule in
|
||||
<para>You don't have to use defined actions when coding a rule in
|
||||
<filename>/etc/shorewall/rules</filename>; the generated Netfilter ruleset
|
||||
is slightly more efficient if you code your rules directly rather than
|
||||
using defined actions. The first example above (name server on the
|
||||
@ -690,9 +782,9 @@ ACCEPT loc fw udp 53
|
||||
ACCEPT dmz fw tcp 53
|
||||
ACCEPT dmz fw udp 53 </programlisting>
|
||||
|
||||
<para>In cases where Shorewall doesn't include a defined action to
|
||||
meet your needs, you can either define the action yourself or you can
|
||||
simply code the appropriate rules directly.</para>
|
||||
<para>In cases where Shorewall doesn't include a defined action to meet
|
||||
your needs, you can either define the action yourself or you can simply
|
||||
code the appropriate rules directly.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@ -712,12 +804,12 @@ AllowSSH loc dmz </programlisting>Those rules allow you to run
|
||||
connect to those servers from your local systems.</para>
|
||||
|
||||
<para>If you wish to enable other connections between your systems, the
|
||||
general format for using a defined action is:
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
<<emphasis>action</emphasis>> <emphasis><source zone> <destination zone></emphasis></programlisting></para>
|
||||
general format for using a defined action is: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
<<emphasis>action</emphasis>> <emphasis><source zone> <destination zone></emphasis></programlisting></para>
|
||||
|
||||
<para>The general format when not using a defined action is:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
ACCEPT <emphasis><source zone> <destination zone> <protocol> <port> </emphasis></programlisting></para>
|
||||
<para>The general format when not using a defined action
|
||||
is:<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
ACCEPT <emphasis><source zone> <destination zone> <protocol> <port> </emphasis></programlisting></para>
|
||||
|
||||
<example>
|
||||
<title>You want to run a publicly-available DNS server on your firewall
|
||||
@ -735,27 +827,33 @@ ACCEPT net fw tcp 53
|
||||
ACCEPT net fw udp 53 </programlisting>
|
||||
|
||||
<para>Those rules would of course be in addition to the rules listed
|
||||
above under "If you run the name server on your firewall".</para>
|
||||
above under "If you run the name server on your firewall".</para>
|
||||
</example>
|
||||
|
||||
<para>If you don't know what port and protocol a particular
|
||||
application uses, <ulink url="ports.htm">look here</ulink>.</para>
|
||||
<para>If you don't know what port and protocol a particular application
|
||||
uses, <ulink url="ports.htm">look here</ulink>.</para>
|
||||
|
||||
<important>
|
||||
<para>I don't recommend enabling telnet to/from the Internet because
|
||||
it uses clear text (even for login!). If you want shell access to your
|
||||
<para>I don't recommend enabling telnet to/from the Internet because it
|
||||
uses clear text (even for login!). If you want shell access to your
|
||||
firewall from the Internet, use SSH: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
AllowSSH net fw</programlisting></para>
|
||||
</important>
|
||||
|
||||
<para><inlinegraphic fileref="images/leaflogo.gif" format="GIF" /> Bering
|
||||
users will want to add the following two rules to be compatible with
|
||||
Jacques's Shorewall configuration: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
Jacques's Shorewall configuration: <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S)
|
||||
ACCEPT loc fw udp 53
|
||||
ACCEPT net fw tcp 80 </programlisting><itemizedlist><listitem><para>Entry
|
||||
1 allows the DNS Cache to be used.</para></listitem><listitem><para>Entry
|
||||
2 allows the <quote>weblet</quote> to work.</para></listitem></itemizedlist><inlinegraphic
|
||||
fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
ACCEPT net fw tcp 80 </programlisting><itemizedlist>
|
||||
<listitem>
|
||||
<para>Entry 1 allows the DNS Cache to be used.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Entry 2 allows the <quote>weblet</quote> to work.</para>
|
||||
</listitem>
|
||||
</itemizedlist><inlinegraphic fileref="images/BD21298_.gif"
|
||||
format="GIF" /></para>
|
||||
|
||||
<para>Now modify <filename>/etc/shorewall/rules</filename> to add or
|
||||
remove other connections as required.</para>
|
||||
@ -771,18 +869,18 @@ ACCEPT net fw tcp 80 </programlisting><it
|
||||
external IP address does not mean that the request will be associated
|
||||
with the external interface or the <quote>net</quote> zone. Any
|
||||
traffic that you generate from the local network will be associated
|
||||
with your local interface and will be treated as loc->fw traffic.</para>
|
||||
with your local interface and will be treated as loc->fw
|
||||
traffic.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><emphasis role="bold">IP addresses are properties of systems,
|
||||
not of interfaces</emphasis>. It is a mistake to believe that your
|
||||
firewall is able to forward packets just because you can ping the IP
|
||||
address of all of the firewall's interfaces from the local
|
||||
network. The only conclusion you can draw from such pinging success is
|
||||
that the link between the local system and the firewall works and that
|
||||
you probably have the local system's default gateway set
|
||||
correctly.</para>
|
||||
address of all of the firewall's interfaces from the local network.
|
||||
The only conclusion you can draw from such pinging success is that the
|
||||
link between the local system and the firewall works and that you
|
||||
probably have the local system's default gateway set correctly.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -790,8 +888,9 @@ ACCEPT net fw tcp 80 </programlisting><it
|
||||
interfaces are in the $FW (fw) zone</emphasis>. If 192.168.1.254 is
|
||||
the IP address of your internal interface then you can write
|
||||
<quote><emphasis role="bold">$FW:192.168.1.254</emphasis></quote> in a
|
||||
rule but you may not write <quote><emphasis role="bold">loc:192.168.1.254</emphasis></quote>.
|
||||
Similarly, it is nonsensical to add 192.168.1.254 to the <emphasis
|
||||
rule but you may not write <quote><emphasis
|
||||
role="bold">loc:192.168.1.254</emphasis></quote>. Similarly, it is
|
||||
nonsensical to add 192.168.1.254 to the <emphasis
|
||||
role="bold">loc</emphasis> zone using an entry in
|
||||
<filename>/etc/shorewall/hosts</filename>.</para>
|
||||
</listitem>
|
||||
@ -823,45 +922,52 @@ ACCEPT net fw tcp 80 </programlisting><it
|
||||
|
||||
<para>The <ulink url="Install.htm">installation procedure</ulink>
|
||||
configures your system to start Shorewall at system boot but beginning
|
||||
with Shorewall version 1.3.9 startup is disabled so that your system
|
||||
won't try to start Shorewall before configuration is complete. Once
|
||||
you have completed configuration of your firewall, you can enable
|
||||
Shorewall startup by removing the file <filename>/etc/shorewall/startup_disabled</filename>.
|
||||
<important><para>Users of the <filename>.deb</filename> package must edit
|
||||
<filename>/etc/default/shorewall</filename> and set <varname>startup=1</varname>.</para></important>The
|
||||
firewall is started using the <command>shorewall start</command> command
|
||||
and stopped using <command>shorewall stop</command>. When the firewall is
|
||||
stopped, routing is enabled on those hosts that have an entry in <ulink
|
||||
with Shorewall version 1.3.9 startup is disabled so that your system won't
|
||||
try to start Shorewall before configuration is complete. Once you have
|
||||
completed configuration of your firewall, you can enable Shorewall startup
|
||||
by removing the file <filename>/etc/shorewall/startup_disabled</filename>.
|
||||
<important>
|
||||
<para>Users of the <filename>.deb</filename> package must edit
|
||||
<filename>/etc/default/shorewall</filename> and set
|
||||
<varname>startup=1</varname>.</para>
|
||||
</important>The firewall is started using the <command>shorewall
|
||||
start</command> command and stopped using <command>shorewall
|
||||
stop</command>. When the firewall is stopped, routing is enabled on those
|
||||
hosts that have an entry in <ulink
|
||||
url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>.
|
||||
A running firewall may be restarted using the <command>shorewall restart</command>
|
||||
command. If you want to totally remove any trace of Shorewall from your
|
||||
Netfilter configuration, use <command>shorewall clear</command>.</para>
|
||||
A running firewall may be restarted using the <command>shorewall
|
||||
restart</command> command. If you want to totally remove any trace of
|
||||
Shorewall from your Netfilter configuration, use <command>shorewall
|
||||
clear</command>.</para>
|
||||
|
||||
<para><inlinegraphic fileref="images/BD21298_.gif" format="GIF" /></para>
|
||||
|
||||
<para>The three-interface sample assumes that you want to enable routing
|
||||
to/from <filename class="devicefile">eth1</filename> (your local network)
|
||||
and <filename class="devicefile">eth2</filename> (DMZ) when Shorewall is
|
||||
stopped. If these two interfaces don't connect to your local network
|
||||
and DMZ or if you want to enable a different set of hosts, modify
|
||||
<filename>/etc/shorewall/routestopped</filename> accordingly.
|
||||
<warning><para>If you are connected to your firewall from the Internet, do
|
||||
not issue a <command>shorewall stop</command> command unless you have
|
||||
added an entry for the IP address that you are connected from to <ulink
|
||||
url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>.
|
||||
Also, I don't recommend using <command>shorewall restart</command>; it
|
||||
is better to create an <ulink url="configuration_file_basics.htm#Levels">alternate
|
||||
configuration</ulink> and test it using the <ulink
|
||||
url="starting_and_stopping_shorewall.htm"><command>shorewall try</command>
|
||||
command</ulink>.</para></warning></para>
|
||||
stopped. If these two interfaces don't connect to your local network and
|
||||
DMZ or if you want to enable a different set of hosts, modify
|
||||
<filename>/etc/shorewall/routestopped</filename> accordingly. <warning>
|
||||
<para>If you are connected to your firewall from the Internet, do not
|
||||
issue a <command>shorewall stop</command> command unless you have
|
||||
added an entry for the IP address that you are connected from to
|
||||
<ulink
|
||||
url="Documentation.htm#Routestopped"><filename>/etc/shorewall/routestopped</filename></ulink>.
|
||||
Also, I don't recommend using <command>shorewall restart</command>; it
|
||||
is better to create an <ulink
|
||||
url="configuration_file_basics.htm#Levels">alternate
|
||||
configuration</ulink> and test it using the <ulink
|
||||
url="starting_and_stopping_shorewall.htm"><command>shorewall
|
||||
try</command> command</ulink>.</para>
|
||||
</warning></para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Additional Recommended Reading</title>
|
||||
|
||||
<para>I highly recommend that you review the <ulink
|
||||
url="configuration_file_basics.htm">Common Configuration File Features</ulink>
|
||||
page -- it contains helpful tips about Shorewall features than make
|
||||
administering your firewall easier.</para>
|
||||
url="configuration_file_basics.htm">Common Configuration File
|
||||
Features</ulink> page -- it contains helpful tips about Shorewall features
|
||||
than make administering your firewall easier.</para>
|
||||
</section>
|
||||
</article>
|
||||
Loading…
Reference in New Issue
Block a user