forked from extern/shorewall_code
Documentation updates
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@548 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
6e7f5cbd4f
commit
d282399aa7
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,367 +1,421 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall IPSec Tunneling</title>
|
<title>Shorewall IPSec Tunneling</title>
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">IPSEC Tunnels</font></h1>
|
<h1 align="center"><font color="#ffffff">IPSEC Tunnels</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h2><font color="#660066">Configuring FreeS/Wan</font></h2>
|
<h2><font color="#660066">Configuring FreeS/Wan</font></h2>
|
||||||
There is an excellent guide to configuring IPSEC tunnels at<a
|
There is an excellent guide to configuring IPSEC tunnels at<a
|
||||||
href="http://jixen.tripod.com"> http://jixen.tripod.com</a> . I highly recommend
|
href="http://www.geocities.com/jixen66/"> http://www.geocities.com/jixen66/</a>
|
||||||
that you consult that site for information about confuring FreeS/Wan.
|
. I highly recommend that you consult that site for information about confuring
|
||||||
|
FreeS/Wan.
|
||||||
<p><font color="#ff6633"><b>Warning: </b></font>Do not use Proxy ARP and
|
<p><font color="#ff6633"><b>Warning: </b></font>Do not use Proxy ARP and
|
||||||
FreeS/Wan on the same system unless you are prepared to suffer the consequences.
|
FreeS/Wan on the same system unless you are prepared to suffer the consequences.
|
||||||
If you start or restart Shorewall with an IPSEC tunnel active, the proxied
|
If you start or restart Shorewall with an IPSEC tunnel active, the proxied
|
||||||
IP addresses are mistakenly assigned to the IPSEC tunnel device (ipsecX)
|
IP addresses are mistakenly assigned to the IPSEC tunnel device (ipsecX)
|
||||||
rather than to the interface that you specify in the INTERFACE column of
|
rather than to the interface that you specify in the INTERFACE column of
|
||||||
/etc/shorewall/proxyarp. I haven't had the time to debug this problem so I
|
/etc/shorewall/proxyarp. I haven't had the time to debug this problem so
|
||||||
can't say if it is a bug in the Kernel or in FreeS/Wan. </p>
|
I can't say if it is a bug in the Kernel or in FreeS/Wan. </p>
|
||||||
|
|
||||||
<p>You <b>might</b> be able to work around this problem using the following
|
<p>You <b>might</b> be able to work around this problem using the following
|
||||||
(I haven't tried it):</p>
|
(I haven't tried it):</p>
|
||||||
|
|
||||||
<p>In /etc/shorewall/init, include:</p>
|
<p>In /etc/shorewall/init, include:</p>
|
||||||
|
|
||||||
<p> qt service ipsec stop</p>
|
<p> qt service ipsec stop</p>
|
||||||
|
|
||||||
<p>In /etc/shorewall/start, include:</p>
|
<p>In /etc/shorewall/start, include:</p>
|
||||||
|
|
||||||
<p> qt service ipsec start</p>
|
<p> qt service ipsec start</p>
|
||||||
|
|
||||||
<h2> <font color="#660066">IPSec Gateway on the Firewall System </font></h2>
|
<h2> <font color="#660066">IPSec Gateway on the Firewall System </font></h2>
|
||||||
|
|
||||||
<p>Suppose that we have the following sutuation:</p>
|
<p>Suppose that we have the following sutuation:</p>
|
||||||
<font color="#660066">
|
<font color="#660066">
|
||||||
<p align="center"><font face="Century Gothic, Arial, Helvetica"> <img
|
<p align="center"><font face="Century Gothic, Arial, Helvetica"> <img
|
||||||
src="images/TwoNets1.png" width="745" height="427">
|
src="images/TwoNets1.png" width="745" height="427">
|
||||||
</font></p>
|
</font></p>
|
||||||
</font>
|
</font>
|
||||||
<p align="left">We want systems in the 192.168.1.0/24 sub-network to be able
|
<p align="left">We want systems in the 192.168.1.0/24 sub-network to be able
|
||||||
to communicate with systems in the 10.0.0.0/8 network.</p>
|
to communicate with systems in the 10.0.0.0/8 network.</p>
|
||||||
|
|
||||||
<p align="left">To make this work, we need to do two things:</p>
|
<p align="left">To make this work, we need to do two things:</p>
|
||||||
|
|
||||||
<p align="left">a) Open the firewall so that the IPSEC tunnel can be established
|
<p align="left">a) Open the firewall so that the IPSEC tunnel can be established
|
||||||
(allow the ESP and AH protocols and UDP Port 500). </p>
|
(allow the ESP and AH protocols and UDP Port 500). </p>
|
||||||
|
|
||||||
<p align="left">b) Allow traffic through the tunnel.</p>
|
<p align="left">b) Allow traffic through the tunnel.</p>
|
||||||
|
|
||||||
<p align="left">Opening the firewall for the IPSEC tunnel is accomplished
|
<p align="left">Opening the firewall for the IPSEC tunnel is accomplished
|
||||||
by adding an entry to the /etc/shorewall/tunnels file.</p>
|
by adding an entry to the /etc/shorewall/tunnels file.</p>
|
||||||
|
|
||||||
<p align="left">In /etc/shorewall/tunnels on system A, we need the following </p>
|
<p align="left">In /etc/shorewall/tunnels on system A, we need the following </p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
|
||||||
<td><strong> TYPE</strong></td>
|
|
||||||
<td><strong> ZONE</strong></td>
|
|
||||||
<td><strong> GATEWAY</strong></td>
|
|
||||||
<td><strong> GATEWAY ZONE</strong></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>ipsec</td>
|
|
||||||
<td>net</td>
|
|
||||||
<td>134.28.54.2</td>
|
|
||||||
<td> </td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p align="left">In /etc/shorewall/tunnels on system B, we would have:</p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
<tr>
|
||||||
<td><strong> TYPE</strong></td>
|
<td><strong> TYPE</strong></td>
|
||||||
<td><strong> ZONE</strong></td>
|
<td><strong> ZONE</strong></td>
|
||||||
<td><strong> GATEWAY</strong></td>
|
<td><strong> GATEWAY</strong></td>
|
||||||
<td><strong> GATEWAY ZONE</strong></td>
|
<td><strong> GATEWAY ZONE</strong></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ipsec</td>
|
<td>ipsec</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>206.161.148.9</td>
|
<td>134.28.54.2</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p align="left"><b>Note: </b>If either of the endpoints is behind a NAT gateway
|
|
||||||
then the tunnels file entry on the <u><b>other</b></u> endpoint should specify
|
|
||||||
a tunnel type of <i>ipsecnat</i> rather than <i>ipsec</i> and the GATEWAY
|
|
||||||
address should specify the external address of the NAT gateway.<br>
|
|
||||||
</p>
|
|
||||||
<p align="left">You need to define a zone for the remote subnet or include
|
|
||||||
it in your local zone. In this example, we'll assume that you have created
|
|
||||||
a zone called "vpn" to represent the remote subnet.</p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><strong>ZONE</strong></td>
|
|
||||||
<td><strong>DISPLAY</strong></td>
|
|
||||||
<td><strong>COMMENTS</strong></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>vpn</td>
|
|
||||||
<td>VPN</td>
|
|
||||||
<td>Remote Subnet</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p align="left">At both systems, ipsec0 would be included in /etc/shorewall/interfaces
|
<p align="left">In /etc/shorewall/tunnels on system B, we would have:</p>
|
||||||
as a "vpn" interface:</p>
|
|
||||||
|
<blockquote>
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><strong> ZONE</strong></td>
|
<td><strong> TYPE</strong></td>
|
||||||
<td><strong> INTERFACE</strong></td>
|
<td><strong> ZONE</strong></td>
|
||||||
<td><strong> BROADCAST</strong></td>
|
<td><strong> GATEWAY</strong></td>
|
||||||
<td><strong> OPTIONS</strong></td>
|
<td><strong> GATEWAY ZONE</strong></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>vpn</td>
|
<td>ipsec</td>
|
||||||
<td>ipsec0</td>
|
<td>net</td>
|
||||||
<td> </td>
|
<td>206.161.148.9</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p align="left"> You will need to allow traffic between the "vpn" zone and
|
|
||||||
the "loc" zone -- if you simply want to admit all traffic in both
|
|
||||||
directions, you can use the policy file:</p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><strong>SOURCE</strong></td>
|
|
||||||
<td><strong>DEST</strong></td>
|
|
||||||
<td><strong>POLICY</strong></td>
|
|
||||||
<td><strong>LOG LEVEL</strong></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>loc</td>
|
|
||||||
<td>vpn</td>
|
|
||||||
<td>ACCEPT</td>
|
|
||||||
<td> </td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>vpn</td>
|
|
||||||
<td>loc</td>
|
|
||||||
<td>ACCEPT</td>
|
|
||||||
<td> </td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
<p align="left"><b>Note: </b>If either of the endpoints is behind a NAT gateway
|
||||||
|
then the tunnels file entry on the <u><b>other</b></u> endpoint should specify
|
||||||
|
a tunnel type of <i>ipsecnat</i> rather than <i>ipsec</i> and the GATEWAY
|
||||||
|
address should specify the external address of the NAT gateway.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p align="left">You need to define a zone for the remote subnet or include
|
||||||
|
it in your local zone. In this example, we'll assume that you have
|
||||||
|
created a zone called "vpn" to represent the remote subnet.</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><strong>ZONE</strong></td>
|
||||||
|
<td><strong>DISPLAY</strong></td>
|
||||||
|
<td><strong>COMMENTS</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>vpn</td>
|
||||||
|
<td>VPN</td>
|
||||||
|
<td>Remote Subnet</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p align="left">At both systems, ipsec0 would be included in /etc/shorewall/interfaces
|
||||||
|
as a "vpn" interface:</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><strong> ZONE</strong></td>
|
||||||
|
<td><strong> INTERFACE</strong></td>
|
||||||
|
<td><strong> BROADCAST</strong></td>
|
||||||
|
<td><strong> OPTIONS</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>vpn</td>
|
||||||
|
<td>ipsec0</td>
|
||||||
|
<td> </td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p align="left"> You will need to allow traffic between the "vpn" zone and
|
||||||
|
the "loc" zone -- if you simply want to admit all traffic in both
|
||||||
|
directions, you can use the policy file:</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><strong>SOURCE</strong></td>
|
||||||
|
<td><strong>DEST</strong></td>
|
||||||
|
<td><strong>POLICY</strong></td>
|
||||||
|
<td><strong>LOG LEVEL</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>loc</td>
|
||||||
|
<td>vpn</td>
|
||||||
|
<td>ACCEPT</td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>vpn</td>
|
||||||
|
<td>loc</td>
|
||||||
|
<td>ACCEPT</td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
<p align="left"> Once you have these entries in place, restart Shorewall (type
|
<p align="left"> Once you have these entries in place, restart Shorewall (type
|
||||||
shorewall restart); you are now ready to configure the tunnel in <a
|
shorewall restart); you are now ready to configure the tunnel in <a
|
||||||
href="http://www.xs4all.nl/%7Efreeswan/"> FreeS/WAN</a> .</p>
|
href="http://www.xs4all.nl/%7Efreeswan/"> FreeS/WAN</a> .</p>
|
||||||
|
|
||||||
<h2><font color="#660066"><a name="RoadWarrior"></a> Mobile System (Road
|
<h2><font color="#660066"><a name="RoadWarrior"></a> Mobile System (Road
|
||||||
Warrior)</font></h2>
|
Warrior)</font></h2>
|
||||||
|
|
||||||
<p>Suppose that you have a laptop system (B) that you take with you when you
|
<p>Suppose that you have a laptop system (B) that you take with you when you
|
||||||
travel and you want to be able to establish a secure connection back to your
|
travel and you want to be able to establish a secure connection back to your
|
||||||
local network.</p>
|
local network.</p>
|
||||||
|
|
||||||
<p align="center"><strong><font face="Century Gothic, Arial, Helvetica">
|
<p align="center"><strong><font face="Century Gothic, Arial, Helvetica">
|
||||||
<img src="images/Mobile.png" width="677" height="426">
|
<img src="images/Mobile.png" width="677" height="426">
|
||||||
</font></strong></p>
|
</font></strong></p>
|
||||||
|
|
||||||
<p align="left">You need to define a zone for the laptop or include it in
|
<p align="left">You need to define a zone for the laptop or include it in
|
||||||
your local zone. In this example, we'll assume that you have created
|
your local zone. In this example, we'll assume that you have created
|
||||||
a zone called "vpn" to represent the remote host.</p>
|
a zone called "vpn" to represent the remote host.</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><strong>ZONE</strong></td>
|
<td><strong>ZONE</strong></td>
|
||||||
<td><strong>DISPLAY</strong></td>
|
<td><strong>DISPLAY</strong></td>
|
||||||
<td><strong>COMMENTS</strong></td>
|
<td><strong>COMMENTS</strong></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>vpn</td>
|
<td>vpn</td>
|
||||||
<td>VPN</td>
|
<td>VPN</td>
|
||||||
<td>Remote Subnet</td>
|
<td>Remote Subnet</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p align="left"> In this instance, the mobile system (B) has IP address 134.28.54.2
|
||||||
|
but that cannot be determined in advance. In the /etc/shorewall/tunnels
|
||||||
|
file on system A, the following entry should be made:</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><strong> TYPE</strong></td>
|
||||||
|
<td><strong> ZONE</strong></td>
|
||||||
|
<td><strong> GATEWAY</strong></td>
|
||||||
|
<td><strong> GATEWAY ZONE</strong></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>ipsec</td>
|
||||||
|
<td>net</td>
|
||||||
|
<td>0.0.0.0/0</td>
|
||||||
|
<td>vpn</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p align="left"> In this instance, the mobile system (B) has IP address 134.28.54.2
|
|
||||||
but that cannot be determined in advance. In the /etc/shorewall/tunnels file
|
|
||||||
on system A, the following entry should be made:</p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><strong> TYPE</strong></td>
|
|
||||||
<td><strong> ZONE</strong></td>
|
|
||||||
<td><strong> GATEWAY</strong></td>
|
|
||||||
<td><strong> GATEWAY ZONE</strong></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>ipsec</td>
|
|
||||||
<td>net</td>
|
|
||||||
<td>0.0.0.0/0</td>
|
|
||||||
<td>vpn</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p>Note that the GATEWAY ZONE column contains the name of the zone corresponding
|
<p>Note that the GATEWAY ZONE column contains the name of the zone corresponding
|
||||||
to peer subnetworks. This indicates that the gateway system itself comprises
|
to peer subnetworks. This indicates that the gateway system itself comprises
|
||||||
the peer subnetwork; in other words, the remote gateway is a standalone system.</p>
|
the peer subnetwork; in other words, the remote gateway is a standalone
|
||||||
|
system.</p>
|
||||||
<p>You will need to configure /etc/shorewall/interfaces and establish
|
|
||||||
your "through the tunnel" policy as shown under the first example above.<br>
|
<p>You will need to configure /etc/shorewall/interfaces and establish
|
||||||
</p>
|
your "through the tunnel" policy as shown under the first example above.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<h2><a name="Dynamic"></a>Dynamic RoadWarrior Zones</h2>
|
<h2><a name="Dynamic"></a>Dynamic RoadWarrior Zones</h2>
|
||||||
Beginning with Shorewall release 1.3.10, you can define multiple VPN zones
|
Beginning with Shorewall release 1.3.10, you can define multiple VPN zones
|
||||||
and add and delete remote endpoints dynamically using /sbin/shorewall. In
|
and add and delete remote endpoints dynamically using /sbin/shorewall. In
|
||||||
/etc/shorewall/zones:<br>
|
/etc/shorewall/zones:<br>
|
||||||
<br>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table cellpadding="2" border="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td valign="top"><b>ZONE<br>
|
|
||||||
</b></td>
|
|
||||||
<td valign="top"><b>DISPLAY<br>
|
|
||||||
</b></td>
|
|
||||||
<td valign="top"><b>COMMENTS<br>
|
|
||||||
</b></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td valign="top">vpn1<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">VPN-1<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">First VPN Zone<br>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td valign="top">vpn2<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">VPN-2<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">Second VPN Zone<br>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td valign="top">vpn3<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">VPN-3<br>
|
|
||||||
</td>
|
|
||||||
<td valign="top">Third VPN Zone<br>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<br>
|
<br>
|
||||||
</blockquote>
|
|
||||||
In /etc/shorewall/tunnels:<br>
|
<blockquote>
|
||||||
|
<table cellpadding="2" border="2" style="border-collapse: collapse;">
|
||||||
<blockquote>
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ZONE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DISPLAY<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>COMMENTS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">vpn1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">VPN-1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">First VPN Zone<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">vpn2<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">VPN-2<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Second VPN Zone<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">vpn3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">VPN-3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Third VPN Zone<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
In /etc/shorewall/tunnels:<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
<table cellpadding="2" cellspacing="" border="2"
|
<table cellpadding="2" cellspacing="" border="2"
|
||||||
style="border-collapse: collapse;">
|
style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top"><b>TYPE<br>
|
<td valign="top"><b>TYPE<br>
|
||||||
</b></td>
|
</b></td>
|
||||||
<td valign="top"><b>ZONE<br>
|
<td valign="top"><b>ZONE<br>
|
||||||
</b></td>
|
</b></td>
|
||||||
<td valign="top"><b>GATEWAY<br>
|
<td valign="top"><b>GATEWAY<br>
|
||||||
</b></td>
|
</b></td>
|
||||||
<td valign="top"><b>GATEWAY ZONE<br>
|
<td valign="top"><b>GATEWAY ZONE<br>
|
||||||
</b></td>
|
</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">ipsec<br>
|
<td valign="top">ipsec<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">net<br>
|
<td valign="top">net<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">0.0.0.0/0<br>
|
<td valign="top">0.0.0.0/0<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">vpn1,vpn2,vpn3<br>
|
<td valign="top">vpn1,vpn2,vpn3<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
When Shorewall is started, the zones vpn[1-3] will all be empty and Shorewall
|
||||||
|
will issue warnings to that effect. These warnings may be safely ignored.
|
||||||
|
FreeS/Wan may now be configured to have three different Road Warrior connections
|
||||||
|
with the choice of connection being based on X-509 certificates or some
|
||||||
|
other means. Each of these connectioins will utilize a different updown
|
||||||
|
script that adds the remote station to the appropriate zone when the connection
|
||||||
|
comes up and that deletes the remote station when the connection comes down.
|
||||||
|
For example, when 134.28.54.2 connects for the vpn2 zone the 'up' part of
|
||||||
|
the script will issue the command":<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>/sbin/shorewall add ipsec0:134.28.54.2 vpn2<br>
|
||||||
|
</blockquote>
|
||||||
|
and the 'down' part will:<br>
|
||||||
|
|
||||||
|
<blockquote>/sbin/shorewall delete ipsec0:134.28.54.2 vpn<br>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
<h3>Limitations of Dynamic Zones</h3>
|
||||||
|
If you include a dynamic zone in the exclude list of a DNAT rule, the dynamically-added
|
||||||
|
hosts are not excluded from the rule.<br>
|
||||||
|
<br>
|
||||||
|
Example with dyn=dynamic zone:<br>
|
||||||
|
<br>
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="2" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><u><b>ACTION<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>SOURCE<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>DESTINATION<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>PROTOCOL<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>PORT(S)<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>CLIENT<br>
|
||||||
|
PORT(S)<br>
|
||||||
|
</b></u></td>
|
||||||
|
<td valign="top"><u><b>ORIGINAL<br>
|
||||||
|
DESTINATION<br>
|
||||||
|
</b></u></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">DNAT<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">z:dyn<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">loc:192.168.1.3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">tcp<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">80<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
Dynamic changes to the zone <b>dyn</b> will have no effect on the above rule.
|
||||||
|
|
||||||
|
<p><font size="2">Last updated 5/3//2003 - </font><font size="2"> <a
|
||||||
|
href="support.htm">Tom Eastep</a></font> </p>
|
||||||
|
|
||||||
|
<p><a href="copyright.htm"><font size="2"> Copyright</font> © <font
|
||||||
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</blockquote>
|
<br>
|
||||||
When Shorewall is started, the zones vpn[1-3] will all be empty and Shorewall
|
|
||||||
will issue warnings to that effect. These warnings may be safely ignored.
|
|
||||||
FreeS/Wan may now be configured to have three different Road Warrior connections
|
|
||||||
with the choice of connection being based on X-509 certificates or some other
|
|
||||||
means. Each of these connectioins will utilize a different updown script that
|
|
||||||
adds the remote station to the appropriate zone when the connection comes
|
|
||||||
up and that deletes the remote station when the connection comes down. For
|
|
||||||
example, when 134.28.54.2 connects for the vpn2 zone the 'up' part of the
|
|
||||||
script will issue the command":<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
<blockquote>/sbin/shorewall add ipsec0:134.28.54.2 vpn2<br>
|
|
||||||
</blockquote>
|
|
||||||
and the 'down' part will:<br>
|
|
||||||
|
|
||||||
<blockquote>/sbin/shorewall delete ipsec0:134.28.54.2 vpn</blockquote>
|
|
||||||
|
|
||||||
<p><font size="2">Last updated 10/23/2002 - </font><font size="2">
|
|
||||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">
|
|
||||||
Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></p>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,127 +1,122 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Index</title>
|
<title>Shorewall Index</title>
|
||||||
|
|
||||||
<base target="main">
|
<base target="main">
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#4b017c" height="90">
|
bgcolor="#4b017c" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" height="90">
|
<td width="100%"
|
||||||
|
height="90">
|
||||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%"
|
<td width="100%"
|
||||||
bgcolor="#ffffff">
|
bgcolor="#ffffff">
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="seattlefirewall_index.htm">Home</a></li>
|
href="seattlefirewall_index.htm">Home</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="shorewall_features.htm">Features</a></li>
|
href="shorewall_features.htm">Features</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||||
<li> <a href="download.htm">Download</a><br>
|
<li> <a
|
||||||
</li>
|
href="download.htm">Download</a><br>
|
||||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
</li>
|
||||||
<a href="Install.htm">Configuration</a><br>
|
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||||
</li>
|
<a href="Install.htm">Configuration</a><br>
|
||||||
<li> <a
|
</li>
|
||||||
|
<li> <a
|
||||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li> <b><a
|
<li> <b><a
|
||||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||||
|
<li> <a
|
||||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
href="Documentation.htm">Reference Manual</a></li>
|
||||||
<li><a
|
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||||
|
<li><a
|
||||||
href="useful_links.html">Useful Links</a><br>
|
href="useful_links.html">Useful Links</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="troubleshoot.htm">Troubleshooting</a></li>
|
href="troubleshoot.htm">Troubleshooting</a></li>
|
||||||
<li> <a href="errata.htm">Errata</a></li>
|
<li> <a
|
||||||
<li> <a
|
href="errata.htm">Errata</a></li>
|
||||||
|
<li> <a
|
||||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||||
<li> <a href="support.htm">Getting
|
<li> <a
|
||||||
help or Answers to Questions</a><br>
|
href="support.htm">Getting help or Answers to Questions</a></li>
|
||||||
</li>
|
<li><a href="http://lists.shorewall.net">Mailing Lists</a><a
|
||||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
href="http://lists.shorewall.net"> </a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="1.3" target="_top">Shorewall
|
||||||
|
1.3 Site</a></li>
|
||||||
|
<li><a
|
||||||
|
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall
|
||||||
|
1.2 Site</a></li>
|
||||||
|
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://germany.shorewall.net">Germany</a></li>
|
href="http://germany.shorewall.net">Germany</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://france.shorewall.net">France</a></li>
|
href="http://france.shorewall.net">France</a></li>
|
||||||
<li><a href="http://www.shorewall.net"
|
<li><a href="http://shorewall.syachile.cl" target="_top">Chile</a></li>
|
||||||
target="_top">Washington State, USA</a><br>
|
<li><a href="http://shorewall.greshko.com" target="_top">Taiwan</a><br>
|
||||||
</li>
|
</li>
|
||||||
|
<li><a
|
||||||
|
href="http://www.shorewall.net" target="_top">Washington State, USA</a><br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a href="News.htm">News
|
<li> <a
|
||||||
Archive</a></li>
|
href="News.htm">News Archive</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||||
<li> <a href="quotes.htm">Quotes
|
<li> <a
|
||||||
from Users</a></li>
|
href="quotes.htm">Quotes from Users</a></li>
|
||||||
<li> <a href="shoreline.htm">About
|
<li> <a
|
||||||
the Author</a></li>
|
href="shoreline.htm">About the Author</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
|
||||||
<strong><br>
|
|
||||||
<b>Note: </b></strong>Search is unavailable
|
|
||||||
Daily 0200-0330 GMT.<br>
|
|
||||||
<strong></strong>
|
|
||||||
<p><strong>Quick Search</strong><br>
|
|
||||||
<font face="Arial" size="-1">
|
|
||||||
<input type="text" name="words" size="15"></font><font size="-1"> </font>
|
|
||||||
<font face="Arial" size="-1"> <input type="hidden" name="format"
|
|
||||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
|
||||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
|
||||||
value="Search"></font> </p>
|
|
||||||
<font face="Arial"> <input
|
|
||||||
type="hidden" name="exclude"
|
|
||||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
|
||||||
|
|
||||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001-2003 Thomas M. Eastep.</font></a><a
|
size="2">2001-2003 Thomas M. Eastep.</font></a><br>
|
||||||
href="http://www.shorewall.net" target="_top"> </a></p>
|
</p>
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,125 +1,124 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Index</title>
|
<title>Shorewall Index</title>
|
||||||
<base target="main">
|
|
||||||
|
<base target="main">
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#4b017c" height="90">
|
bgcolor="#4b017c" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" height="90">
|
<td width="100%"
|
||||||
|
height="90">
|
||||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%"
|
<td width="100%"
|
||||||
bgcolor="#ffffff">
|
bgcolor="#ffffff">
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="sourceforge_index.htm">Home</a></li>
|
href="seattlefirewall_index.htm">Home</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="shorewall_features.htm">Features</a></li>
|
href="shorewall_features.htm">Features</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||||
<li> <a href="download.htm">Download</a><br>
|
<li> <a
|
||||||
</li>
|
href="download.htm">Download</a><br>
|
||||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
</li>
|
||||||
<a href="Install.htm">Configuration</a><br>
|
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||||
</li>
|
<a href="Install.htm">Configuration</a><br>
|
||||||
<li> <a
|
</li>
|
||||||
|
<li> <a
|
||||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li> <b><a
|
<li> <b><a
|
||||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||||
|
<li> <a
|
||||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
href="Documentation.htm">Reference Manual</a></li>
|
||||||
<li><a
|
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||||
|
<li><a
|
||||||
href="useful_links.html">Useful Links</a><br>
|
href="useful_links.html">Useful Links</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="troubleshoot.htm">Troubleshooting</a></li>
|
href="troubleshoot.htm">Troubleshooting</a></li>
|
||||||
<li> <a href="errata.htm">Errata</a></li>
|
<li> <a href="errata.htm">Errata</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||||
<li> <a href="support.htm">Getting
|
<li> <a
|
||||||
Help or Answers to Questions</a></li>
|
href="support.htm">Getting help or Answers to Questions</a>
|
||||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
</li>
|
||||||
|
<li><a
|
||||||
|
href="http://lists.shorewall.net">Mailing Lists</a> <br>
|
||||||
|
</li>
|
||||||
|
<li><a href="1.3" target="_top">Shorewall 1.3 Site</a></li>
|
||||||
|
<li><a
|
||||||
|
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall 1.2
|
||||||
|
Site</a></li>
|
||||||
|
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://germany.shorewall.net">Germany</a></li>
|
href="http://germany.shorewall.net">Germany</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||||
<li><a target="_top"
|
<li><a target="_top"
|
||||||
href="http://france.shorewall.net">France</a></li>
|
href="http://france.shorewall.net">France</a></li>
|
||||||
<li><a href="http://www.shorewall.net"
|
<li><a href="http://shorewall.syachile.cl" target="_top">Chile</a></li>
|
||||||
target="_top">Washington State, USA</a><br>
|
<li><a href="http://shorewall.greshko.com" target="_top">Taiwan</a><br>
|
||||||
</li>
|
</li>
|
||||||
|
<li><a
|
||||||
|
href="http://www.shorewall.net" target="_top">Washington State, USA</a><br>
|
||||||
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a href="News.htm">News
|
<li> <a href="News.htm">News
|
||||||
Archive</a></li>
|
Archive</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||||
<li> <a href="quotes.htm">Quotes
|
<li> <a href="quotes.htm">Quotes
|
||||||
from Users</a></li>
|
from Users</a></li>
|
||||||
<li> <a href="shoreline.htm">About
|
<li> <a
|
||||||
the Author</a></li>
|
href="shoreline.htm">About the Author</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="sourceforge_index.htm#Donations">Donations</a></li>
|
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
|
||||||
<strong><br>
|
|
||||||
<b>Note: </b></strong>Search is unavailable
|
|
||||||
Daily 0200-0330 GMT.<br>
|
|
||||||
<strong></strong>
|
|
||||||
<p><strong>Quick Search</strong><br>
|
|
||||||
<font face="Arial" size="-1"> <input
|
|
||||||
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
|
||||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
|
||||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
|
||||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
|
||||||
value="Search"></font> </p>
|
|
||||||
<font face="Arial"> <input
|
|
||||||
type="hidden" name="exclude"
|
|
||||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
|
||||||
|
|
||||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001-2003 Thomas M. Eastep.</font></a><br>
|
size="2">2001-2003 Thomas M. Eastep.</font></a><a
|
||||||
</p>
|
href="http://www.shorewall.net" target="_top"> </a></p>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,346 +1,402 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Configuration File Basics</title>
|
<title>Configuration File Basics</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your configuration
|
||||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
files on a system running Microsoft Windows, you <u>must</u>
|
||||||
run them through <a
|
run them through <a
|
||||||
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
||||||
before you use them with Shorewall.</b></p>
|
before you use them with Shorewall.</b></p>
|
||||||
|
|
||||||
<h2><a name="Files"></a>Files</h2>
|
<h2><a name="Files"></a>Files</h2>
|
||||||
|
|
||||||
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>/etc/shorewall/shorewall.conf - used to set
|
<li>/etc/shorewall/shorewall.conf - used to set
|
||||||
several firewall parameters.</li>
|
several firewall parameters.</li>
|
||||||
<li>/etc/shorewall/params - use this file to set
|
<li>/etc/shorewall/params - use this file to set
|
||||||
shell variables that you will expand in other files.</li>
|
shell variables that you will expand in other files.</li>
|
||||||
<li>/etc/shorewall/zones - partition the firewall's
|
<li>/etc/shorewall/zones - partition the firewall's
|
||||||
view of the world into <i>zones.</i></li>
|
view of the world into <i>zones.</i></li>
|
||||||
<li>/etc/shorewall/policy - establishes firewall
|
<li>/etc/shorewall/policy - establishes firewall
|
||||||
high-level policy.</li>
|
high-level policy.</li>
|
||||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
<li>/etc/shorewall/interfaces - describes the
|
||||||
on the firewall system.</li>
|
interfaces on the firewall system.</li>
|
||||||
<li>/etc/shorewall/hosts - allows defining zones
|
<li>/etc/shorewall/hosts - allows defining zones
|
||||||
in terms of individual hosts and subnetworks.</li>
|
in terms of individual hosts and subnetworks.</li>
|
||||||
<li>/etc/shorewall/masq - directs the firewall
|
<li>/etc/shorewall/masq - directs the firewall
|
||||||
where to use many-to-one (dynamic) Network Address Translation
|
where to use many-to-one (dynamic) Network Address Translation
|
||||||
(a.k.a. Masquerading) and Source Network Address Translation
|
(a.k.a. Masquerading) and Source Network Address Translation
|
||||||
(SNAT).</li>
|
(SNAT).</li>
|
||||||
<li>/etc/shorewall/modules - directs the firewall
|
<li>/etc/shorewall/modules - directs the firewall
|
||||||
to load kernel modules.</li>
|
to load kernel modules.</li>
|
||||||
<li>/etc/shorewall/rules - defines rules that are
|
<li>/etc/shorewall/rules - defines rules that
|
||||||
exceptions to the overall policies established in /etc/shorewall/policy.</li>
|
are exceptions to the overall policies established in /etc/shorewall/policy.</li>
|
||||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||||
ARP.</li>
|
ARP.</li>
|
||||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4
|
<li>/etc/shorewall/routestopped (Shorewall 1.3.4
|
||||||
and later) - defines hosts accessible when Shorewall is stopped.</li>
|
and later) - defines hosts accessible when Shorewall is stopped.</li>
|
||||||
<li>/etc/shorewall/tcrules - defines marking of
|
<li>/etc/shorewall/tcrules - defines marking of
|
||||||
packets for later use by traffic control/shaping or policy routing.</li>
|
packets for later use by traffic control/shaping or policy routing.</li>
|
||||||
<li>/etc/shorewall/tos - defines rules for setting
|
<li>/etc/shorewall/tos - defines rules for setting
|
||||||
the TOS field in packet headers.</li>
|
the TOS field in packet headers.</li>
|
||||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE
|
<li>/etc/shorewall/tunnels - defines IPSEC, GRE
|
||||||
and IPIP tunnels with end-points on the firewall system.</li>
|
and IPIP tunnels with end-points on the firewall system.</li>
|
||||||
<li>/etc/shorewall/blacklist - lists blacklisted
|
<li>/etc/shorewall/blacklist - lists blacklisted
|
||||||
IP/subnet/MAC addresses.</li>
|
IP/subnet/MAC addresses.</li>
|
||||||
<li>/etc/shorewall/init - commands that you wish to execute at the
|
<li>/etc/shorewall/init - commands that you wish to execute at the
|
||||||
beginning of a "shorewall start" or "shorewall restart".</li>
|
beginning of a "shorewall start" or "shorewall restart".</li>
|
||||||
<li>/etc/shorewall/start - commands that you wish to execute at the
|
<li>/etc/shorewall/start - commands that you wish to execute at the
|
||||||
completion of a "shorewall start" or "shorewall restart"</li>
|
completion of a "shorewall start" or "shorewall restart"</li>
|
||||||
<li>/etc/shorewall/stop - commands that you wish to execute at the
|
<li>/etc/shorewall/stop - commands that you wish to execute at the
|
||||||
beginning of a "shorewall stop".</li>
|
beginning of a "shorewall stop".</li>
|
||||||
<li>/etc/shorewall/stopped - commands that you wish to execute at
|
<li>/etc/shorewall/stopped - commands that you wish to execute at
|
||||||
the completion of a "shorewall stop".</li>
|
the completion of a "shorewall stop".</li>
|
||||||
<li>/etc/shorewall/ecn - disable Explicit Congestion Notification (ECN
|
<li>/etc/shorewall/ecn - disable Explicit Congestion Notification (ECN
|
||||||
- RFC 3168) to remote hosts or networks.<br>
|
- RFC 3168) to remote hosts or networks.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2><a name="Comments"></a>Comments</h2>
|
<h2><a name="Comments"></a>Comments</h2>
|
||||||
|
|
||||||
<p>You may place comments in configuration files by making the first non-whitespace
|
<p>You may place comments in configuration files by making the first non-whitespace
|
||||||
character a pound sign ("#"). You may also place comments
|
character a pound sign ("#"). You may also place comments at
|
||||||
at the end of any line, again by delimiting the comment from
|
the end of any line, again by delimiting the comment from the
|
||||||
the rest of the line with a pound sign.</p>
|
rest of the line with a pound sign.</p>
|
||||||
|
|
||||||
<p>Examples:</p>
|
<p>Examples:</p>
|
||||||
|
|
||||||
<pre># This is a comment</pre>
|
<pre># This is a comment</pre>
|
||||||
|
|
||||||
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
||||||
|
|
||||||
<h2><a name="Continuation"></a>Line Continuation</h2>
|
<h2><a name="Continuation"></a>Line Continuation</h2>
|
||||||
|
|
||||||
<p>You may continue lines in the configuration files using the usual backslash
|
<p>You may continue lines in the configuration files using the usual backslash
|
||||||
("\") followed immediately by a new line character.</p>
|
("\") followed immediately by a new line character.</p>
|
||||||
|
|
||||||
<p>Example:</p>
|
<p>Example:</p>
|
||||||
|
|
||||||
<pre>ACCEPT net fw tcp \<br>smtp,www,pop3,imap #Services running on the firewall</pre>
|
<pre>ACCEPT net fw tcp \<br>smtp,www,pop3,imap #Services running on the firewall</pre>
|
||||||
|
|
||||||
|
<h2><a name="INCLUDE"></a>IN<small><small></small></small>CLUDE Directive</h2>
|
||||||
|
Beginning with Shorewall version 1.4.2, any file may contain INCLUDE directives.
|
||||||
|
An INCLUDE directive consists of the word INCLUDE followed by a file name
|
||||||
|
and causes the contents of the named file to be logically included into
|
||||||
|
the file containing the INCLUDE. File names given in an INCLUDE directive
|
||||||
|
are assumed to reside in /etc/shorewall or in an alternate configuration
|
||||||
|
directory if one has been specified for the command.<br>
|
||||||
|
<br>
|
||||||
|
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||||
|
are ignored with a warning message.<big><big><br>
|
||||||
|
<br>
|
||||||
|
</big></big> Examples:<big> </big> <br>
|
||||||
|
|
||||||
|
<blockquote> shorewall/params.mgmt:<br>
|
||||||
|
|
||||||
|
<blockquote> MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||||
|
TIME_SERVERS=4.4.4.4<br>
|
||||||
|
BACKUP_SERVERS=5.5.5.5<br>
|
||||||
|
</blockquote>
|
||||||
|
----- end params.mgmt -----<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> shorewall/params:<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<blockquote> # Shorewall 1.3 /etc/shorewall/params<br>
|
||||||
|
[..]<br>
|
||||||
|
#######################################<br>
|
||||||
|
<br>
|
||||||
|
INCLUDE params.mgmt <br>
|
||||||
|
<br>
|
||||||
|
# params unique to this host here<br>
|
||||||
|
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||||
|
</blockquote>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> ----- end params -----<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> shorewall/rules.mgmt:<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<blockquote> ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||||
|
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||||
|
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||||
|
</blockquote>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> ----- end rules.mgmt -----<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> shorewall/rules:<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<blockquote> # Shorewall version 1.3 - Rules File<br>
|
||||||
|
[..]<br>
|
||||||
|
#######################################<br>
|
||||||
|
<br>
|
||||||
|
INCLUDE rules.mgmt <br>
|
||||||
|
<br>
|
||||||
|
# rules unique to this host here<br>
|
||||||
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||||
|
</blockquote>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> ----- end rules -----<br>
|
||||||
|
</blockquote>
|
||||||
<h2><a name="dnsnames"></a>Using DNS Names</h2>
|
<h2><a name="dnsnames"></a>Using DNS Names</h2>
|
||||||
|
|
||||||
<p align="left"> </p>
|
<p align="left"> </p>
|
||||||
|
|
||||||
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
||||||
using DNS names in Shorewall configuration files. If you use DNS
|
using DNS names in Shorewall configuration files. If you use DNS
|
||||||
names and you are called out of bed at 2:00AM because Shorewall won't
|
names and you are called out of bed at 2:00AM because Shorewall won't
|
||||||
start as a result of DNS problems then don't say that you were not forewarned.
|
start as a result of DNS problems then don't say that you were not forewarned.
|
||||||
<br>
|
<br>
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
<p align="left"><b> -Tom<br>
|
<p align="left"><b> -Tom<br>
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
||||||
configuration files may be specified as either IP addresses or DNS
|
configuration files may be specified as either IP addresses or DNS
|
||||||
Names.<br>
|
Names.<br>
|
||||||
<br>
|
<br>
|
||||||
DNS names in iptables rules aren't nearly as useful as
|
DNS names in iptables rules aren't nearly as useful as
|
||||||
they first appear. When a DNS name appears in a rule, the iptables
|
they first appear. When a DNS name appears in a rule, the iptables
|
||||||
utility resolves the name to one or more IP addresses and inserts
|
utility resolves the name to one or more IP addresses and inserts
|
||||||
those addresses into the rule. So changes in the DNS->IP address
|
those addresses into the rule. So changes in the DNS->IP address
|
||||||
relationship that occur after the firewall has started have absolutely
|
relationship that occur after the firewall has started have absolutely
|
||||||
no effect on the firewall's ruleset. </p>
|
no effect on the firewall's ruleset. </p>
|
||||||
|
|
||||||
<p align="left"> If your firewall rules include DNS names then:</p>
|
<p align="left"> If your firewall rules include DNS names then:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>If your /etc/resolv.conf is wrong then your firewall
|
<li>If your /etc/resolv.conf is wrong then your firewall
|
||||||
won't start.</li>
|
won't start.</li>
|
||||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||||
won't start.</li>
|
won't start.</li>
|
||||||
<li>If your Name Server(s) is(are) down then your firewall
|
<li>If your Name Server(s) is(are) down then your firewall
|
||||||
won't start.</li>
|
won't start.</li>
|
||||||
<li>If your startup scripts try to start your firewall
|
<li>If your startup scripts try to start your firewall
|
||||||
before starting your DNS server then your firewall won't start.<br>
|
before starting your DNS server then your firewall won't start.<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Factors totally outside your control (your ISP's router
|
<li>Factors totally outside your control (your ISP's
|
||||||
is down for example), can prevent your firewall from starting.</li>
|
router is down for example), can prevent your firewall from starting.</li>
|
||||||
<li>You must bring up your network interfaces prior to
|
<li>You must bring up your network interfaces prior to
|
||||||
starting your firewall.<br>
|
starting your firewall.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
||||||
of two periods (although one may be trailing). This restriction is
|
of two periods (although one may be trailing). This restriction is
|
||||||
imposed by Shorewall to insure backward compatibility with existing
|
imposed by Shorewall to insure backward compatibility with existing
|
||||||
configuration files.<br>
|
configuration files.<br>
|
||||||
<br>
|
<br>
|
||||||
Examples of valid DNS names:<br>
|
Examples of valid DNS names:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>mail.shorewall.net</li>
|
<li>mail.shorewall.net</li>
|
||||||
<li>shorewall.net. (note the trailing period).</li>
|
<li>shorewall.net. (note the trailing period).</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Examples of invalid DNS names:<br>
|
Examples of invalid DNS names:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>mail (not fully qualified)</li>
|
<li>mail (not fully qualified)</li>
|
||||||
<li>shorewall.net (only one period)</li>
|
<li>shorewall.net (only one period)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
DNS names may not be used as:<br>
|
DNS names may not be used as:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||||
file)</li>
|
file)</li>
|
||||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||||
<li>In the /etc/shorewall/nat file.</li>
|
<li>In the /etc/shorewall/nat file.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
These restrictions are not imposed by Shorewall simply
|
These restrictions are not imposed by Shorewall simply
|
||||||
for your inconvenience but are rather limitations of iptables.<br>
|
for your inconvenience but are rather limitations of iptables.<br>
|
||||||
|
|
||||||
<h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
|
<h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
|
||||||
|
|
||||||
<p>Where specifying an IP address, a subnet or an interface, you can
|
<p>Where specifying an IP address, a subnet or an interface, you can precede
|
||||||
precede the item with "!" to specify the complement of the item. For
|
the item with "!" to specify the complement of the item. For example,
|
||||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must be
|
!192.168.1.4 means "any host but 192.168.1.4". There must be no white space
|
||||||
no white space following the "!".</p>
|
following the "!".</p>
|
||||||
|
|
||||||
<h2><a name="Lists"></a>Comma-separated Lists</h2>
|
<h2><a name="Lists"></a>Comma-separated Lists</h2>
|
||||||
|
|
||||||
<p>Comma-separated lists are allowed in a number of contexts within the
|
<p>Comma-separated lists are allowed in a number of contexts within the
|
||||||
configuration files. A comma separated list:</p>
|
configuration files. A comma separated list:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Must not have any embedded white space.<br>
|
<li>Must not have any embedded white space.<br>
|
||||||
Valid: routefilter,dhcp,norfc1918<br>
|
Valid: routefilter,dhcp,norfc1918<br>
|
||||||
Invalid: routefilter, dhcp, norfc1818</li>
|
Invalid: routefilter, dhcp, norfc1818</li>
|
||||||
<li>If you use line continuation to break a comma-separated
|
<li>If you use line continuation to break a comma-separated
|
||||||
list, the continuation line(s) must begin in column 1 (or
|
list, the continuation line(s) must begin in column 1 (or
|
||||||
there would be embedded white space)</li>
|
there would be embedded white space)</li>
|
||||||
<li>Entries in a comma-separated list may appear
|
<li>Entries in a comma-separated list may appear
|
||||||
in any order.</li>
|
in any order.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2><a name="Ports"></a>Port Numbers/Service Names</h2>
|
<h2><a name="Ports"></a>Port Numbers/Service Names</h2>
|
||||||
|
|
||||||
<p>Unless otherwise specified, when giving a port number you can use
|
<p>Unless otherwise specified, when giving a port number you can use either
|
||||||
either an integer or a service name from /etc/services. </p>
|
an integer or a service name from /etc/services. </p>
|
||||||
|
|
||||||
<h2><a name="Ranges"></a>Port Ranges</h2>
|
<h2><a name="Ranges"></a>Port Ranges</h2>
|
||||||
|
|
||||||
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
||||||
port number</i>>:<<i>high port number</i>>. For example,
|
port number</i>>:<<i>high port number</i>>. For example,
|
||||||
if you want to forward the range of tcp ports 4000 through 4100 to
|
if you want to forward the range of tcp ports 4000 through 4100 to
|
||||||
local host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
local host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
||||||
If you omit the low port number, a value of zero is assumed; if you omit
|
If you omit the low port number, a value of zero is assumed; if you omit
|
||||||
the high port number, a value of 65535 is assumed.<br>
|
the high port number, a value of 65535 is assumed.<br>
|
||||||
|
|
||||||
<h2><a name="Variables"></a>Using Shell Variables</h2>
|
<h2><a name="Variables"></a>Using Shell Variables</h2>
|
||||||
|
|
||||||
<p>You may use the /etc/shorewall/params file to set shell variables
|
<p>You may use the /etc/shorewall/params file to set shell variables
|
||||||
that you can then use in some of the other configuration files.</p>
|
that you can then use in some of the other configuration files.</p>
|
||||||
|
|
||||||
<p>It is suggested that variable names begin with an upper case letter<font
|
<p>It is suggested that variable names begin with an upper case letter<font
|
||||||
size="1"> </font>to distinguish them from variables used internally
|
size="1"> </font>to distinguish them from variables used internally
|
||||||
within the Shorewall programs</p>
|
within the Shorewall programs</p>
|
||||||
|
|
||||||
<p>Example:</p>
|
<p>Example:</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
|
|
||||||
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=routefilter,norfc1918</pre>
|
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=routefilter,norfc1918</pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p><br>
|
<p><br>
|
||||||
Example (/etc/shorewall/interfaces record):</p>
|
Example (/etc/shorewall/interfaces record):</p>
|
||||||
<font
|
<font
|
||||||
face="Century Gothic, Arial, Helvetica">
|
face="Century Gothic, Arial, Helvetica">
|
||||||
|
<blockquote>
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</font>
|
</font>
|
||||||
|
|
||||||
<p>The result will be the same as if the record had been written</p>
|
<p>The result will be the same as if the record had been written</p>
|
||||||
<font
|
<font
|
||||||
face="Century Gothic, Arial, Helvetica">
|
face="Century Gothic, Arial, Helvetica">
|
||||||
|
<blockquote>
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
<pre>net eth0 130.252.100.255 routefilter,norfc1918</pre>
|
<pre>net eth0 130.252.100.255 routefilter,norfc1918</pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</font>
|
</font>
|
||||||
|
<p>Variables may be used anywhere in the other configuration
|
||||||
|
|
||||||
<p>Variables may be used anywhere in the other configuration
|
|
||||||
files.</p>
|
files.</p>
|
||||||
|
|
||||||
<h2><a name="MAC"></a>Using MAC Addresses</h2>
|
<h2><a name="MAC"></a>Using MAC Addresses</h2>
|
||||||
|
|
||||||
<p>Media Access Control (MAC) addresses can be used to specify packet
|
<p>Media Access Control (MAC) addresses can be used to specify packet
|
||||||
source in several of the configuration files. To use this feature,
|
source in several of the configuration files. To use this
|
||||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
feature, your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||||
included.</p>
|
included.</p>
|
||||||
|
|
||||||
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a unique
|
||||||
unique MAC address.<br>
|
MAC address.<br>
|
||||||
<br>
|
<br>
|
||||||
In GNU/Linux, MAC addresses are usually written as
|
In GNU/Linux, MAC addresses are usually written
|
||||||
a series of 6 hex numbers separated by colons. Example:<br>
|
as a series of 6 hex numbers separated by colons. Example:<br>
|
||||||
<br>
|
<br>
|
||||||
[root@gateway root]# ifconfig eth0<br>
|
[root@gateway root]# ifconfig eth0<br>
|
||||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||||
Mask:255.255.255.0<br>
|
Mask:255.255.255.0<br>
|
||||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||||
frame:0<br>
|
frame:0<br>
|
||||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||||
carrier:0<br>
|
carrier:0<br>
|
||||||
collisions:30394 txqueuelen:100<br>
|
collisions:30394 txqueuelen:100<br>
|
||||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||||
(1582.8 Mb)<br>
|
(1582.8 Mb)<br>
|
||||||
Interrupt:11 Base address:0x1800<br>
|
Interrupt:11 Base address:0x1800<br>
|
||||||
<br>
|
<br>
|
||||||
Because Shorewall uses colons as a separator for
|
Because Shorewall uses colons as a separator for
|
||||||
address fields, Shorewall requires MAC addresses to be written
|
address fields, Shorewall requires MAC addresses to be written
|
||||||
in another way. In Shorewall, MAC addresses begin with a tilde
|
in another way. In Shorewall, MAC addresses begin with a tilde
|
||||||
("~") and consist of 6 hex numbers separated by hyphens. In Shorewall,
|
("~") and consist of 6 hex numbers separated by hyphens. In Shorewall,
|
||||||
the MAC address in the example above would be written "~02-00-08-E3-FA-55".<br>
|
the MAC address in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
||||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h2><a name="Levels"></a>Shorewall Configurations</h2>
|
<h2><a name="Levels"></a>Shorewall Configurations</h2>
|
||||||
|
|
||||||
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
||||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start
|
The <a href="starting_and_stopping_shorewall.htm">shorewall start
|
||||||
and restart</a> commands allow you to specify an alternate configuration
|
and restart</a> commands allow you to specify an alternate configuration
|
||||||
directory and Shorewall will use the files in the alternate directory
|
directory and Shorewall will use the files in the alternate directory
|
||||||
rather than the corresponding files in /etc/shorewall. The alternate
|
rather than the corresponding files in /etc/shorewall. The alternate
|
||||||
directory need not contain a complete configuration; those files not in
|
directory need not contain a complete configuration; those files not
|
||||||
the alternate directory will be read from /etc/shorewall.</p>
|
in the alternate directory will be read from /etc/shorewall.</p>
|
||||||
|
|
||||||
<p> This facility permits you to easily create a test or temporary configuration
|
<p> This facility permits you to easily create a test or temporary configuration
|
||||||
by:</p>
|
by:</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li> copying the files that need modification
|
<li> copying the files that need modification
|
||||||
from /etc/shorewall to a separate directory;</li>
|
from /etc/shorewall to a separate directory;</li>
|
||||||
<li> modify those files in the separate directory;
|
<li> modify those files in the separate directory;
|
||||||
and</li>
|
and</li>
|
||||||
<li> specifying the separate directory in a shorewall
|
<li> specifying the separate directory in a shorewall
|
||||||
start or shorewall restart command (e.g., <i><b>shorewall -c
|
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
||||||
/etc/testconfig restart</b></i> ).</li>
|
restart</b></i> )</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
|
<p><font size="2"> Updated 4/18/2003 - <a href="support.htm">Tom Eastep</a>
|
||||||
|
|
||||||
|
|
||||||
<p><font size="2"> Updated 2/24/2003 - <a href="support.htm">Tom Eastep</a>
|
|
||||||
</font></p>
|
</font></p>
|
||||||
|
|
||||||
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,185 +1,198 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Download</title>
|
<title>Download</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p><b>I strongly urge you to read and print a copy of the <a
|
<p><b>I strongly urge you to read and print a copy of the <a
|
||||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||||
for the configuration that most closely matches your own.<br>
|
for the configuration that most closely matches your own.<br>
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
||||||
|
|
||||||
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>The documentation in HTML format is included in the .rpm and in the
|
<p>The documentation in HTML format is included in the .rpm and in the .tgz
|
||||||
.tgz packages below.</p>
|
packages below.</p>
|
||||||
|
|
||||||
<p> Once you've printed the appropriate QuickStart Guide, download <u>
|
<p> Once you've printed the appropriate QuickStart Guide, download <u>
|
||||||
one</u> of the modules:</p>
|
one</u> of the modules:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||||
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
||||||
with a 2.4 kernel, you can use the RPM version (note: the
|
with a 2.4 kernel, you can use the RPM version (note: the
|
||||||
RPM should also work with other distributions that store
|
RPM should also work with other distributions that store
|
||||||
init scripts in /etc/init.d and that include chkconfig or
|
init scripts in /etc/init.d and that include chkconfig or
|
||||||
insserv). If you find that it works in other cases, let <a
|
insserv). If you find that it works in other cases, let <a
|
||||||
href="mailto:teastep@shorewall.net"> me</a> know so that
|
href="mailto:teastep@shorewall.net"> me</a> know so that
|
||||||
I can mention them here. See the <a href="Install.htm">Installation
|
I can mention them here. See the <a href="Install.htm">Installation
|
||||||
Instructions</a> if you have problems installing the RPM.</li>
|
Instructions</a> if you have problems installing the RPM.</li>
|
||||||
<li>If you are running LRP, download the .lrp file
|
<li>If you are running LRP, download the .lrp file
|
||||||
(you might also want to download the .tgz so you will have a copy
|
(you might also want to download the .tgz so you will have a
|
||||||
of the documentation).</li>
|
copy of the documentation).</li>
|
||||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||||
and would like a .deb package, Shorewall is included in both
|
and would like a .deb package, Shorewall is included in both
|
||||||
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||||
Testing Branch</a> and the <a
|
Testing Branch</a> and the <a
|
||||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian Unstable
|
href="http://packages.debian.org/unstable/net/shorewall.html">Debian Unstable
|
||||||
Branch</a>.</li>
|
Branch</a>.</li>
|
||||||
<li>Otherwise, download the <i>shorewall</i>
|
<li>Otherwise, download the <i>shorewall</i>
|
||||||
module (.tgz)</li>
|
module (.tgz)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The documentation in HTML format is included in the .tgz and .rpm files
|
<p>The documentation in HTML format is included in the .tgz and .rpm files
|
||||||
and there is an documentation .deb that also contains the documentation. The
|
and there is an documentation .deb that also contains the documentation. The
|
||||||
.rpm will install the documentation in your default document directory
|
.rpm will install the documentation in your default document directory which
|
||||||
which can be obtained using the following command:<br>
|
can be obtained using the following command:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
|
<p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Please check the <font color="#ff0000"> <a href="errata.htm"> errata</a></font>
|
<p>Please check the <font color="#ff0000"> <a href="errata.htm"> errata</a></font>
|
||||||
to see if there are updates that apply to the version
|
to see if there are updates that apply to the version
|
||||||
that you have downloaded.</p>
|
that you have downloaded.</p>
|
||||||
|
|
||||||
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
||||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION IS
|
||||||
IS REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed configuration
|
REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed configuration
|
||||||
of your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
of your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
||||||
|
|
||||||
<p><b></b></p>
|
<p><b></b></p>
|
||||||
|
|
||||||
<p><b>Download Sites:</b></p>
|
<p><b>Download Sites:</b></p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>SERVER LOCATION</b></td>
|
<td><b>SERVER LOCATION</b></td>
|
||||||
<td><b>DOMAIN</b></td>
|
<td><b>DOMAIN</b></td>
|
||||||
<td><b>HTTP</b></td>
|
<td><b>HTTP</b></td>
|
||||||
<td><b>FTP</b></td>
|
<td><b>FTP</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>SourceForge<br>
|
<td>SourceForge<br>
|
||||||
</td>
|
</td>
|
||||||
<td>sf.net</td>
|
<td>sf.net</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
||||||
<td>N/A</td>
|
<td>N/A</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
|
||||||
<td>Slovak Republic</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Texas, USA</td>
|
|
||||||
<td>Infohiiway.com</td>
|
|
||||||
<td><a
|
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
|
||||||
<td><a target="_blank"
|
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Hamburg, Germany</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
|
||||||
<td><a target="_blank"
|
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
|
||||||
<td>Correofuego.com.ar</td>
|
|
||||||
<td><a
|
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>France</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
<tr>
|
||||||
<td>Washington State, USA</td>
|
<td>Slovak Republic</td>
|
||||||
<td>Shorewall.net</td>
|
<td>Shorewall.net</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
<td><a
|
<td> <a target="_blank"
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
</tbody>
|
<td>Texas, USA</td>
|
||||||
|
<td>Infohiiway.com</td>
|
||||||
|
<td><a
|
||||||
|
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||||
|
<td><a target="_blank"
|
||||||
|
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Hamburg, Germany</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
|
<td><a target="_blank"
|
||||||
|
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||||
|
<td>Correofuego.com.ar</td>
|
||||||
|
<td><a
|
||||||
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
||||||
|
<td> <a target="_blank"
|
||||||
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>France</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
||||||
|
<td> <a target="_blank"
|
||||||
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">Taiwan<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Greshko.com<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><a
|
||||||
|
href="http://shorewall.greshko.com/pub/shorewall/">Browse<br>
|
||||||
|
</a></td>
|
||||||
|
<td valign="top"><a
|
||||||
|
href="ftp://shorewall.greshko.com/pub/shorewall/" target="_top">Browse</a><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Washington State, USA</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
|
<td><a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p align="left"><b>CVS:</b></p>
|
<p align="left"><b>CVS:</b></p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p align="left">The <a target="_top"
|
<p align="left">The <a target="_top"
|
||||||
href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS repository
|
href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS repository
|
||||||
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
||||||
Shorewall component. There's no guarantee that what you find there
|
Shorewall component. There's no guarantee that what you find there
|
||||||
will work at all.<br>
|
will work at all.<br>
|
||||||
</p>
|
</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 3/24/2003 - <a
|
<p align="left"><font size="2">Last Updated 3/24/2003 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -1,256 +1,274 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall 1.4 Errata</title>
|
<title>Shorewall 1.4 Errata</title>
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
|
|
||||||
<meta name="author" content="Tom Eastep">
|
<meta name="author" content="Tom Eastep">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>
|
<li>
|
||||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||||
a corrected script, be sure to run the script through <u>
|
a corrected script, be sure to run the script through <u>
|
||||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||||
it to your Linux system.</b></p>
|
it to your Linux system.</b></p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left"> <b>If you are installing Shorewall for the first
|
<p align="left"> <b>If you are installing Shorewall for the first
|
||||||
time and plan to use the .tgz and install.sh script, you can untar
|
time and plan to use the .tgz and install.sh script, you can untar
|
||||||
the archive, replace the 'firewall' script in the untarred directory
|
the archive, replace the 'firewall' script in the untarred directory
|
||||||
with the one you downloaded below, and then run install.sh.</b></p>
|
with the one you downloaded below, and then run install.sh.</b></p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left"> <b>When the instructions say to install a corrected
|
<p align="left"> <b>When the instructions say to install a corrected
|
||||||
firewall script in /usr/share/shorewall/firewall, you may
|
firewall script in /usr/share/shorewall/firewall, you
|
||||||
rename the existing file before copying in the new file.</b></p>
|
may rename the existing file before copying in the new file.</b></p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||||
For example, do NOT install the 1.3.9a firewall script if you are running
|
For example, do NOT install the 1.3.9a firewall script if you are
|
||||||
1.3.7c.</font></b><br>
|
running 1.3.7c.</font></b><br>
|
||||||
</p>
|
</p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
<li><b><a href="upgrade_issues.htm">Upgrade
|
||||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
Issues</a></b></li>
|
||||||
</li>
|
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||||
<li> <b><a
|
</li>
|
||||||
|
<li> <b><a
|
||||||
href="errata_3.html">Problems in Version 1.3</a></b></li>
|
href="errata_3.html">Problems in Version 1.3</a></b></li>
|
||||||
<li> <b><a
|
<li> <b><a
|
||||||
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
||||||
<li> <b><font
|
<li> <b><font
|
||||||
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||||
<li> <b><font
|
<li> <b><font
|
||||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||||
on RH7.2</a></font></b></li>
|
on RH7.2</a></font></b></li>
|
||||||
<li> <b><a
|
<li> <b><a
|
||||||
href="#Debug">Problems with kernels >= 2.4.18 and RedHat
|
href="#Debug">Problems with kernels >= 2.4.18 and RedHat
|
||||||
iptables</a></b></li>
|
iptables</a></b></li>
|
||||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||||
RPM on SuSE</a></b></li>
|
RPM on SuSE</a></b></li>
|
||||||
<li><b><a href="#Multiport">Problems with iptables
|
<li><b><a href="#Multiport">Problems with iptables
|
||||||
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||||
and NAT</a></b><br>
|
and NAT</a></b><br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<hr>
|
<hr>
|
||||||
<h2 align="left"><a name="V1.4"></a>Problems in Version 1.4</h2>
|
<h2 align="left"><a name="V1.4"></a>Problems in Version 1.4</h2>
|
||||||
|
|
||||||
<h3></h3>
|
<h3></h3>
|
||||||
|
|
||||||
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
<h3>1.4.2</h3>
|
||||||
<ul>
|
|
||||||
<li>Some TCP requests are rejected in the 'common' chain with an ICMP port-unreachable
|
|
||||||
response rather than the more appropriate TCP RST response. This problem
|
|
||||||
is corrected in this updated common.def file which may be installed in /etc/shorewall/common.def.<br>
|
|
||||||
</li>
|
|
||||||
</ul>
|
|
||||||
<h3>1.4.1</h3>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>When a "shorewall check" command is executed, each "rule" produces
|
<li>When an 'add' or 'delete' command is executed, a temporary directory
|
||||||
the harmless additional message:<br>
|
created in /tmp is not being removed. This problem may be corrected by installing
|
||||||
<br>
|
<a
|
||||||
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected<br>
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall"
|
||||||
<br>
|
target="_top">this firewall script</a> in /usr/share/shorewall/firewall as
|
||||||
You may correct the problem by installing <a
|
described ablve. <br>
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
|
||||||
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
|
||||||
as described above.<br>
|
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>1.4.0</h3>
|
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>When running under certain shells Shorewall will attempt to create
|
<li>Some TCP requests are rejected in the 'common' chain with an ICMP
|
||||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
port-unreachable response rather than the more appropriate TCP RST response.
|
||||||
/etc/shorewall/ecn or you can install <a
|
This problem is corrected in <a
|
||||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def"
|
||||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
target="_top">this updated common.def file</a> which may be installed in
|
||||||
|
/etc/shorewall/common.def.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<hr width="100%" size="2">
|
<h3>1.4.1</h3>
|
||||||
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
|
||||||
|
|
||||||
<p align="left">The upgrade issues have moved to <a
|
|
||||||
href="upgrade_issues.htm">a separate page</a>.</p>
|
|
||||||
|
|
||||||
<hr>
|
|
||||||
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
|
||||||
iptables version 1.2.3</font></h3>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
|
||||||
prevent it from working with Shorewall. Regrettably,
|
|
||||||
RedHat released this buggy iptables in RedHat 7.2. </p>
|
|
||||||
|
|
||||||
<p align="left"> I have built a <a
|
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
|
||||||
corrected 1.2.3 rpm which you can download here</a> and I have
|
|
||||||
also built an <a
|
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
|
||||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
|
||||||
running RedHat 7.1, you can install either of these RPMs
|
|
||||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
|
||||||
|
|
||||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
|
||||||
has released an iptables-1.2.4 RPM of their own which you can
|
|
||||||
download from<font color="#ff6633"> <a
|
|
||||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
|
||||||
</font>I have installed this RPM on my firewall and it works
|
|
||||||
fine.</p>
|
|
||||||
|
|
||||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
|
||||||
the patches are available for download. This <a
|
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
|
||||||
which corrects a problem with parsing of the --log-level
|
|
||||||
specification while this <a
|
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
|
||||||
corrects a problem in handling the TOS target.</p>
|
|
||||||
|
|
||||||
<p align="left">To install one of the above patches:</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>cd iptables-1.2.3/extensions</li>
|
|
||||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18 and
|
|
||||||
RedHat iptables</h3>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
|
||||||
may experience the following:</p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
|
||||||
user-space debugging code was not updated to reflect recent changes in
|
|
||||||
the Netfilter 'mangle' table. You can correct the problem by
|
|
||||||
installing <a
|
|
||||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
|
||||||
this iptables RPM</a>. If you are already running a 1.2.5
|
|
||||||
version of iptables, you will need to specify the --oldpackage
|
|
||||||
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
|
||||||
RPM on SuSE</h3>
|
|
||||||
|
|
||||||
<p>If you find that rpm complains about a conflict with kernel <=
|
|
||||||
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
|
|
||||||
option to rpm.</p>
|
|
||||||
|
|
||||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
|
||||||
|
|
||||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
|
||||||
|
|
||||||
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
|
||||||
MULTIPORT=Yes</b></h3>
|
|
||||||
|
|
||||||
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
|
||||||
change to the syntax used to specify multiport match rules; as
|
|
||||||
a consequence, if you install iptables 1.2.7 you must be
|
|
||||||
running Shorewall 1.3.7a or later or:</p>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>set MULTIPORT=No
|
<li>When a "shorewall check" command is executed, each "rule" produces
|
||||||
in /etc/shorewall/shorewall.conf; or
|
the harmless additional message:<br>
|
||||||
|
<br>
|
||||||
|
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected<br>
|
||||||
|
<br>
|
||||||
|
You may correct the problem by installing <a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
||||||
|
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
||||||
|
as described above.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h3>1.4.0</h3>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>When running under certain shells Shorewall will attempt to create
|
||||||
|
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||||
|
/etc/shorewall/ecn or you can install <a
|
||||||
|
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||||
|
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<hr width="100%" size="2">
|
||||||
|
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
||||||
|
|
||||||
|
<p align="left">The upgrade issues have moved to <a
|
||||||
|
href="upgrade_issues.htm">a separate page</a>.</p>
|
||||||
|
|
||||||
|
<hr>
|
||||||
|
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
||||||
|
iptables version 1.2.3</font></h3>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||||
|
prevent it from working with Shorewall. Regrettably,
|
||||||
|
RedHat released this buggy iptables in RedHat 7.2. </p>
|
||||||
|
|
||||||
|
<p align="left"> I have built a <a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||||
|
corrected 1.2.3 rpm which you can download here</a> and I
|
||||||
|
have also built an <a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||||
|
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||||
|
running RedHat 7.1, you can install either of these RPMs
|
||||||
|
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||||
|
|
||||||
|
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||||
|
has released an iptables-1.2.4 RPM of their own which you can
|
||||||
|
download from<font color="#ff6633"> <a
|
||||||
|
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||||
|
</font>I have installed this RPM on my firewall and it works
|
||||||
|
fine.</p>
|
||||||
|
|
||||||
|
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||||
|
the patches are available for download. This <a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||||
|
which corrects a problem with parsing of the --log-level
|
||||||
|
specification while this <a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||||
|
corrects a problem in handling the TOS target.</p>
|
||||||
|
|
||||||
|
<p align="left">To install one of the above patches:</p>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>cd iptables-1.2.3/extensions</li>
|
||||||
|
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18 and
|
||||||
|
RedHat iptables</h3>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||||
|
may experience the following:</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||||
|
user-space debugging code was not updated to reflect recent changes in
|
||||||
|
the Netfilter 'mangle' table. You can correct the problem by
|
||||||
|
installing <a
|
||||||
|
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||||
|
this iptables RPM</a>. If you are already running a 1.2.5
|
||||||
|
version of iptables, you will need to specify the --oldpackage
|
||||||
|
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||||
|
RPM on SuSE</h3>
|
||||||
|
|
||||||
|
<p>If you find that rpm complains about a conflict with kernel <=
|
||||||
|
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
|
||||||
|
option to rpm.</p>
|
||||||
|
|
||||||
|
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||||
|
|
||||||
|
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||||
|
|
||||||
|
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
||||||
|
MULTIPORT=Yes</b></h3>
|
||||||
|
|
||||||
|
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
||||||
|
change to the syntax used to specify multiport match rules; as
|
||||||
|
a consequence, if you install iptables 1.2.7 you must be
|
||||||
|
running Shorewall 1.3.7a or later or:</p>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>set MULTIPORT=No
|
||||||
|
in /etc/shorewall/shorewall.conf; or
|
||||||
</li>
|
</li>
|
||||||
<li>if you are running
|
<li>if you are
|
||||||
Shorewall 1.3.6 you may install
|
running Shorewall 1.3.6 you may
|
||||||
<a
|
install <a
|
||||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||||
this firewall script</a> in /var/lib/shorewall/firewall
|
this firewall script</a> in /var/lib/shorewall/firewall
|
||||||
as described above.</li>
|
as described above.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
||||||
</h3>
|
</h3>
|
||||||
/etc/shorewall/nat entries of the following form will
|
/etc/shorewall/nat entries of the following form will
|
||||||
result in Shorewall being unable to start:<br>
|
result in Shorewall being unable to start:<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||||
Error message is:<br>
|
Error message is:<br>
|
||||||
|
|
||||||
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
||||||
The solution is to put "no" in the LOCAL column. Kernel
|
The solution is to put "no" in the LOCAL column. Kernel
|
||||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
support for LOCAL=yes has never worked properly and 2.4.18-10 has
|
||||||
disabled it. The 2.4.19 kernel contains corrected support under a
|
disabled it. The 2.4.19 kernel contains corrected support under a
|
||||||
new kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
new kernel configuraiton option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||||
|
|
||||||
<p><font size="2"> Last updated 3/25/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2"> Last updated 5/11/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
@ -1,140 +1,140 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Mailing Lists</title>
|
<title>Shorewall Mailing Lists</title>
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||||
border="0">
|
border="0">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="33%" valign="middle" align="left">
|
<td width="33%" valign="middle"
|
||||||
|
align="left">
|
||||||
<h1 align="center"><a
|
<h1 align="center"><a
|
||||||
href="http://www.centralcommand.com/linux_products.html"><img
|
href="http://www.centralcommand.com/linux_products.html"><img
|
||||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||||
height="79" align="left">
|
height="79" align="left">
|
||||||
</a></h1>
|
</a></h1>
|
||||||
<a
|
<a
|
||||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||||
height="35" alt="">
|
height="35" alt="">
|
||||||
</a>
|
</a>
|
||||||
<p align="right"><font color="#ffffff"><b> </b></font> </p>
|
<p align="right"><font color="#ffffff"><b> </b></font> </p>
|
||||||
</td>
|
</td>
|
||||||
<td valign="middle" width="34%" align="center">
|
<td valign="middle" width="34%" align="center">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
||||||
</td>
|
</td>
|
||||||
<td valign="middle" width="33%"> <a
|
<td valign="middle" width="33%"> <a
|
||||||
href="http://www.postfix.org/"> <img
|
href="http://www.postfix.org/"> <img
|
||||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
src="images/postfix-white.gif" align="right" border="0" width="124"
|
||||||
height="45" alt="(Postfix Logo)">
|
height="66" alt="(Postfix Logo)">
|
||||||
</a><br>
|
</a><br>
|
||||||
|
|
||||||
<div align="left"><a href="http://www.spamassassin.org"><img
|
<div align="left"><a href="http://www.spamassassin.org"><img
|
||||||
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
||||||
border="0">
|
border="0">
|
||||||
</a> </div>
|
</a> </div>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<div align="right"><br>
|
<div align="right"><br>
|
||||||
<b><font color="#ffffff"><br>
|
<b><font color="#ffffff"><br>
|
||||||
Powered by Postfix </font></b><br>
|
</font></b><br>
|
||||||
</div>
|
</div>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||||
Guide</a>.<br>
|
Guide</a>.<br>
|
||||||
</h1>
|
</h1>
|
||||||
|
|
||||||
<p align="left">If you experience problems with any of these lists, please
|
<p align="left">If you experience problems with any of these lists, please
|
||||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
|
||||||
|
|
||||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||||
|
|
||||||
<p align="left">You can report such problems by sending mail to tmeastep
|
<p align="left">You can report such problems by sending mail to tmeastep
|
||||||
at hotmail dot com.</p>
|
at hotmail dot com.</p>
|
||||||
|
|
||||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
<h2>A Word about the SPAM Filters at Shorewall.net <a
|
||||||
href="http://osirusoft.com/"> </a></h2>
|
href="http://osirusoft.com/"> </a></h2>
|
||||||
|
|
||||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
<p>Please note that the mail server at shorewall.net
|
||||||
about list traffic that bounces.</a> Also please note that the mail server
|
checks incoming mail:<br>
|
||||||
at shorewall.net checks incoming mail:<br>
|
</p>
|
||||||
</p>
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||||
</li>
|
</li>
|
||||||
<li>to ensure that the sender address is fully qualified.</li>
|
<li>to ensure that the sender address is fully qualified.</li>
|
||||||
<li>to verify that the sender's domain has an A or MX
|
<li>to verify that the sender's domain has an A
|
||||||
record in DNS.</li>
|
or MX record in DNS.</li>
|
||||||
<li>to ensure that the host name in the HELO/EHLO command
|
<li>to ensure that the host name in the HELO/EHLO
|
||||||
is a valid fully-qualified DNS name that resolves.</li>
|
command is a valid fully-qualified DNS name that resolves.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h2>Please post in plain text</h2>
|
<h2>Please post in plain text</h2>
|
||||||
A growing number of MTAs serving list subscribers are rejecting
|
A growing number of MTAs serving list subscribers are rejecting
|
||||||
all HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||||
"for continuous abuse" because it has been my policy to allow HTML in
|
shorewall.net "for continuous abuse" because it has been my policy to
|
||||||
list posts!!<br>
|
allow HTML in list posts!!<br>
|
||||||
<br>
|
<br>
|
||||||
I think that blocking all HTML is a Draconian way to control
|
I think that blocking all HTML is a Draconian way to control
|
||||||
spam and that the ultimate losers here are not the spammers but the list
|
spam and that the ultimate losers here are not the spammers but the
|
||||||
subscribers whose MTAs are bouncing all shorewall.net mail. As one list
|
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||||
subscriber wrote to me privately "These e-mail admin's need to get a <i>(explitive
|
one list subscriber wrote to me privately "These e-mail admin's need to
|
||||||
deleted)</i> life instead of trying to rid the planet of HTML based e-mail".
|
get a <i>(explitive deleted)</i> life instead of trying to rid the planet
|
||||||
Nevertheless, to allow subscribers to receive list posts as must as possible,
|
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||||
I have now configured the list server at shorewall.net to strip all HTML
|
posts as must as possible, I have now configured the list server at shorewall.net
|
||||||
from outgoing posts. This means that HTML-only posts will be bounced by
|
to strip all HTML from outgoing posts. This means that HTML-only posts
|
||||||
the list server.<br>
|
will be bounced by the list server.<br>
|
||||||
|
|
||||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h2>Other Mail Delivery Problems</h2>
|
<h2>Other Mail Delivery Problems</h2>
|
||||||
If you find that you are missing an occasional list post, your
|
If you find that you are missing an occasional list post,
|
||||||
e-mail admin may be blocking mail whose <i>Received:</i> headers contain
|
your e-mail admin may be blocking mail whose <i>Received:</i> headers
|
||||||
the names of certain ISPs. Again, I believe that such policies hurt more
|
contain the names of certain ISPs. Again, I believe that such policies
|
||||||
than they help but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
hurt more than they help but I'm not prepared to go so far as to start
|
||||||
headers to circumvent those policies.<br>
|
stripping <i>Received:</i> headers to circumvent those policies.<br>
|
||||||
|
|
||||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
|
|
||||||
<p> <font size="-1"> Match:
|
<p> <font size="-1"> Match:
|
||||||
<select name="method">
|
<select name="method">
|
||||||
<option value="and">All </option>
|
<option value="and">All </option>
|
||||||
<option value="or">Any </option>
|
<option value="or">Any </option>
|
||||||
<option value="boolean">Boolean </option>
|
<option value="boolean">Boolean </option>
|
||||||
</select>
|
</select>
|
||||||
Format:
|
Format:
|
||||||
<select name="format">
|
<select name="format">
|
||||||
<option value="builtin-long">Long </option>
|
<option value="builtin-long">Long </option>
|
||||||
<option value="builtin-short">Short </option>
|
<option value="builtin-short">Short </option>
|
||||||
</select>
|
</select>
|
||||||
Sort by:
|
Sort by:
|
||||||
<select name="sort">
|
<select name="sort">
|
||||||
<option value="score">Score </option>
|
<option value="score">Score </option>
|
||||||
<option value="time">Time </option>
|
<option value="time">Time </option>
|
||||||
@ -143,148 +143,146 @@ than they help but I'm not prepared to go so far as to start stripping <i>Recei
|
|||||||
<option value="revtime">Reverse Time </option>
|
<option value="revtime">Reverse Time </option>
|
||||||
<option value="revtitle">Reverse Title </option>
|
<option value="revtitle">Reverse Title </option>
|
||||||
</select>
|
</select>
|
||||||
</font> <input type="hidden" name="config"
|
</font> <input type="hidden" name="config"
|
||||||
value="htdig"> <input type="hidden" name="restrict"
|
value="htdig"> <input type="hidden" name="restrict"
|
||||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||||
name="exclude" value=""> <br>
|
name="exclude" value=""> <br>
|
||||||
Search: <input type="text" size="30" name="words"
|
Search: <input type="text" size="30"
|
||||||
value=""> <input type="submit" value="Search"> </p>
|
name="words" value=""> <input type="submit" value="Search"> </p>
|
||||||
</form>
|
</form>
|
||||||
|
|
||||||
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
||||||
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
||||||
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||||
</font></h2>
|
</font></h2>
|
||||||
|
|
||||||
<h2 align="left">Shorewall CA Certificate</h2>
|
<h2 align="left">Shorewall CA Certificate</h2>
|
||||||
If you want to trust X.509 certificates issued by Shoreline
|
If you want to trust X.509 certificates issued by
|
||||||
Firewall (such as the one used on my web site), you may <a
|
Shoreline Firewall (such as the one used on my web site), you
|
||||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
may <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||||
in your browser. If you don't wish to trust my certificates then
|
in your browser. If you don't wish to trust my certificates then
|
||||||
you can either use unencrypted access when subscribing to Shorewall
|
you can either use unencrypted access when subscribing to Shorewall
|
||||||
mailing lists or you can use secure access (SSL) and accept the server's
|
mailing lists or you can use secure access (SSL) and accept the server's
|
||||||
certificate when prompted by your browser.<br>
|
certificate when prompted by your browser.<br>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||||
to get answers to questions and to report problems. Information
|
to get answers to questions and to report problems. Information
|
||||||
of general interest to the Shorewall user community is also posted
|
of general interest to the Shorewall user community is also posted
|
||||||
to this list.</p>
|
to this list.</p>
|
||||||
|
|
||||||
<p align="left"><b>Before posting a problem report to this list, please see
|
<p align="left"><b>Before posting a problem report to this list, please see
|
||||||
the <a href="http://www.shorewall.net/support.htm">problem reporting
|
the <a href="http://www.shorewall.net/support.htm">problem reporting
|
||||||
guidelines</a>.</b></p>
|
guidelines</a>.</b></p>
|
||||||
|
|
||||||
<p align="left">To subscribe to the mailing list:<br>
|
<p align="left">To subscribe to the mailing list:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><b>Insecure: </b><a
|
<li><b>Insecure: </b><a
|
||||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||||
<li><b>SSL:</b> <a
|
<li><b>SSL:</b> <a
|
||||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left">To post to the list, post to <a
|
<p align="left">To post to the list, post to <a
|
||||||
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
||||||
|
|
||||||
<p align="left">The list archives are at <a
|
<p align="left">The list archives are at <a
|
||||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||||
|
|
||||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
||||||
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
||||||
may be found at <a
|
may be found at <a
|
||||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">This list is for announcements of general interest to the
|
<p align="left">This list is for announcements of general interest to the
|
||||||
Shorewall community. To subscribe:<br>
|
Shorewall community. To subscribe:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left"></p>
|
<p align="left"></p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><b>Insecure:</b> <a
|
<li><b>Insecure:</b> <a
|
||||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||||
<li><b>SSL</b>: <a
|
<li><b>SSL</b>: <a
|
||||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left"><br>
|
<p align="left"><br>
|
||||||
The list archives are at <a
|
The list archives are at <a
|
||||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||||
the exchange of ideas about the future of Shorewall and for coordinating
|
the exchange of ideas about the future of Shorewall and for coordinating
|
||||||
ongoing Shorewall Development.</p>
|
ongoing Shorewall Development.</p>
|
||||||
|
|
||||||
<p align="left">To subscribe to the mailing list:<br>
|
<p align="left">To subscribe to the mailing list:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><b>Insecure: </b><a
|
<li><b>Insecure: </b><a
|
||||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
||||||
<li><b>SSL:</b> <a
|
<li><b>SSL:</b> <a
|
||||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left"> To post to the list, post to <a
|
<p align="left"> To post to the list, post to <a
|
||||||
href="mailto:shorewall-devel@lists.shorewall.net">shorewall-devel@lists.shorewall.net</a>. </p>
|
href="mailto:shorewall-devel@lists.shorewall.net">shorewall-devel@lists.shorewall.net</a>. </p>
|
||||||
|
|
||||||
<p align="left">The list archives are at <a
|
<p align="left">The list archives are at <a
|
||||||
href="http://lists.shorewall.net/pipermail/shorewall-devel">http://lists.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
href="http://lists.shorewall.net/pipermail/shorewall-devel">http://lists.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||||
|
|
||||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||||
the Mailing Lists</h2>
|
the Mailing Lists</h2>
|
||||||
|
|
||||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||||
from Mailman-managed lists although Mailman 2.1 has attempted
|
from Mailman-managed lists although Mailman 2.1 has attempted
|
||||||
to make this less confusing. To unsubscribe:</p>
|
to make this less confusing. To unsubscribe:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">Follow the same link above that you used to subscribe
|
<p align="left">Follow the same link above that you used to subscribe
|
||||||
to the list.</p>
|
to the list.</p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">Down at the bottom of that page is the following text:
|
<p align="left">Down at the bottom of that page is the following text:
|
||||||
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
" To <b>unsubscribe</b> from <i><list name></i>, get a
|
||||||
reminder, or change your subscription options enter your subscription
|
password reminder, or change your subscription options enter
|
||||||
email address:". Enter your email address in the box and
|
your subscription email address:". Enter your email address
|
||||||
click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
in the box and click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">There will now be a box where you can enter your password
|
<p align="left">There will now be a box where you can enter your password
|
||||||
and click on "Unsubscribe"; if you have forgotten your password,
|
and click on "Unsubscribe"; if you have forgotten your password,
|
||||||
there is another button that will cause your password to be emailed
|
there is another button that will cause your password to be emailed
|
||||||
to you.</p>
|
to you.</p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<hr>
|
<hr>
|
||||||
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
||||||
|
|
||||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last updated 3/24/2003 - <a
|
<p align="left"><font size="2">Last updated 3/24/2003 - <a
|
||||||
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
File diff suppressed because one or more lines are too long
@ -2,182 +2,187 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
<title>ICMP Echo-request (Ping)</title>
|
<title>ICMP Echo-request (Ping)</title>
|
||||||
|
|
||||||
<meta http-equiv="content-type"
|
<meta http-equiv="content-type"
|
||||||
content="text/html; charset=ISO-8859-1">
|
content="text/html; charset=ISO-8859-1">
|
||||||
|
|
||||||
<meta name="author" content="Tom Eastep">
|
<meta name="author" content="Tom Eastep">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
|
<h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
<br>
|
<br>
|
||||||
Shorewall 'Ping' management has evolved over time with the latest change
|
Shorewall 'Ping' management has evolved over time with the latest change
|
||||||
coming in Shorewall version 1.4.0. <br>
|
coming in Shorewall version 1.4.0. <br>
|
||||||
|
|
||||||
<h2>Shorewall Versions >= 1.4.0</h2>
|
<h2>Shorewall Versions >= 1.4.0</h2>
|
||||||
In order to accept ping requests from zone z1 to zone z2 where the policy
|
In Shoreall 1.4.0 and later version, ICMP echo-request's are treated just
|
||||||
for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the
|
like any other connection request.<br>
|
||||||
|
<br>
|
||||||
|
In order to accept ping requests from zone z1 to zone z2 where the policy
|
||||||
|
for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the
|
||||||
form:<br>
|
form:<br>
|
||||||
|
|
||||||
<blockquote>ACCEPT <i>z1 z2
|
<blockquote>ACCEPT <i>z1 z2
|
||||||
</i>icmp 8<br>
|
</i>icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
Example: <br>
|
Example: <br>
|
||||||
<br>
|
<br>
|
||||||
To permit ping from the local zone to the firewall:<br>
|
To permit ping from the local zone to the firewall:<br>
|
||||||
|
|
||||||
<blockquote>ACCEPT loc fw
|
<blockquote>ACCEPT loc fw
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
If you would like to accept 'ping' by default even when the relevant
|
If you would like to accept 'ping' by default even when the relevant
|
||||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||||
already exist and in that file place the following command:<br>
|
already exist and in that file place the following command:<br>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||||
you need a rule of the form:<br>
|
you need a rule of the form:<br>
|
||||||
|
|
||||||
<blockquote>DROP <i>z1 z2
|
<blockquote>DROP <i>z1 z2
|
||||||
</i>icmp 8<br>
|
</i>icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
Example:<br>
|
Example:<br>
|
||||||
<br>
|
<br>
|
||||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<blockquote>DROP net fw
|
<blockquote>DROP net fw
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h2>Shorewall Versions >= 1.3.14 with OLD_PING_HANDLING=No in /etc/shorewall/shorewall.conf</h2>
|
<h2>Shorewall Versions >= 1.3.14 and < 1.4.0 with OLD_PING_HANDLING=No
|
||||||
In 1.3.14, Ping handling was put under control of the rules and policies
|
in /etc/shorewall/shorewall.conf</h2>
|
||||||
just like any other connection request. In order to accept ping requests
|
In 1.3.14, Ping handling was put under control of the rules and policies
|
||||||
from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you need
|
just like any other connection request. In order to accept ping requests
|
||||||
a rule in /etc/shoreall/rules of the form:<br>
|
from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you
|
||||||
|
need a rule in /etc/shoreall/rules of the form:<br>
|
||||||
<blockquote>ACCEPT <i>z1 z2
|
|
||||||
|
<blockquote>ACCEPT <i>z1 z2
|
||||||
</i>icmp 8<br>
|
</i>icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
Example: <br>
|
Example: <br>
|
||||||
<br>
|
<br>
|
||||||
To permit ping from the local zone to the firewall:<br>
|
To permit ping from the local zone to the firewall:<br>
|
||||||
|
|
||||||
<blockquote>ACCEPT loc fw
|
<blockquote>ACCEPT loc fw
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
If you would like to accept 'ping' by default even when the relevant
|
If you would like to accept 'ping' by default even when the relevant
|
||||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||||
already exist and in that file place the following command:<br>
|
already exist and in that file place the following command:<br>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||||
you need a rule of the form:<br>
|
you need a rule of the form:<br>
|
||||||
|
|
||||||
<blockquote>DROP <i>z1 z2
|
<blockquote>DROP <i>z1 z2
|
||||||
</i>icmp 8<br>
|
</i>icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
Example:<br>
|
Example:<br>
|
||||||
<br>
|
<br>
|
||||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||||
|
|
||||||
<blockquote>DROP net fw
|
<blockquote>DROP net fw
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<blockquote> </blockquote>
|
<blockquote> </blockquote>
|
||||||
|
|
||||||
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
|
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
|
||||||
</h2>
|
</h2>
|
||||||
There are several aspects to the old Shorewall Ping management:<br>
|
There are several aspects to the old Shorewall Ping management:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
||||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
||||||
<li>The <b>FORWARDPING</b> option in<a
|
<li>The <b>FORWARDPING</b> option in<a
|
||||||
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
||||||
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
There are two cases to consider:<br>
|
There are two cases to consider:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Ping requests addressed to the firewall itself; and</li>
|
<li>Ping requests addressed to the firewall itself; and</li>
|
||||||
<li>Ping requests being forwarded to another system. Included here
|
<li>Ping requests being forwarded to another system. Included here
|
||||||
are all cases of packet forwarding including NAT, DNAT rule, Proxy ARP
|
are all cases of packet forwarding including NAT, DNAT rule, Proxy ARP and
|
||||||
and simple routing.</li>
|
simple routing.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
These cases will be covered separately.<br>
|
These cases will be covered separately.<br>
|
||||||
|
|
||||||
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
||||||
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>If neither <b>noping</b> nor <b>filterping </b>are specified for
|
<li>If neither <b>noping</b> nor <b>filterping </b>are specified for
|
||||||
the interface that receives the ping request then the request will be responded
|
the interface that receives the ping request then the request will be responded
|
||||||
to with an ICMP echo-reply.</li>
|
to with an ICMP echo-reply.</li>
|
||||||
<li>If <b>noping</b> is specified for the interface that receives the
|
<li>If <b>noping</b> is specified for the interface that receives
|
||||||
ping request then the request is ignored.</li>
|
the ping request then the request is ignored.</li>
|
||||||
<li>If <b>filterping </b>is specified for the interface then the request
|
<li>If <b>filterping </b>is specified for the interface then the request
|
||||||
is passed to the rules/policy evaluation.</li>
|
is passed to the rules/policy evaluation.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h3>Ping Requests Forwarded by the Firewall</h3>
|
<h3>Ping Requests Forwarded by the Firewall</h3>
|
||||||
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
||||||
|
|
||||||
<h3>Rules Evaluation</h3>
|
<h3>Rules Evaluation</h3>
|
||||||
Ping requests are ICMP type 8. So the general rule format is:<br>
|
Ping requests are ICMP type 8. So the general rule format is:<br>
|
||||||
<br>
|
<br>
|
||||||
<i>Target Source
|
<i>Target Source
|
||||||
Destination </i>icmp 8<br>
|
Destination </i>icmp 8<br>
|
||||||
<br>
|
<br>
|
||||||
Example 1. Accept pings from the net to the dmz (pings are responded
|
Example 1. Accept pings from the net to the dmz (pings are responded
|
||||||
to with an ICMP echo-reply):<br>
|
to with an ICMP echo-reply):<br>
|
||||||
<br>
|
<br>
|
||||||
ACCEPT net dmz
|
ACCEPT net dmz
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
<br>
|
<br>
|
||||||
Example 2. Drop pings from the net to the firewall<br>
|
Example 2. Drop pings from the net to the firewall<br>
|
||||||
<br>
|
<br>
|
||||||
DROP net fw
|
DROP net fw
|
||||||
icmp 8<br>
|
icmp 8<br>
|
||||||
|
|
||||||
<h3>Policy Evaluation</h3>
|
<h3>Policy Evaluation</h3>
|
||||||
If no applicable rule is found, then the policy for the source to the
|
If no applicable rule is found, then the policy for the source to the
|
||||||
destination is applied.<br>
|
destination is applied.<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>If the relevant policy is ACCEPT then the request is responded
|
<li>If the relevant policy is ACCEPT then the request is responded
|
||||||
to with an ICMP echo-reply.</li>
|
to with an ICMP echo-reply.</li>
|
||||||
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
||||||
then the request is responded to with an ICMP echo-reply.</li>
|
then the request is responded to with an ICMP echo-reply.</li>
|
||||||
<li>Otherwise, the relevant REJECT or DROP policy is used and the request
|
<li>Otherwise, the relevant REJECT or DROP policy is used and the
|
||||||
is either rejected or simply ignored.</li>
|
request is either rejected or simply ignored.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p><font size="2">Updated 2/14/2003 - <a href="support.htm">Tom Eastep</a>
|
<p><font size="2">Updated 5/4/2003 - <a href="support.htm">Tom Eastep</a>
|
||||||
</font></p>
|
</font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,204 +1,237 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall Port Information</title>
|
<title>Shorewall Port Information</title>
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Ports required for Various
|
<h1 align="center"><font color="#ffffff">Ports required for Various
|
||||||
Services/Applications</font></h1>
|
Services/Applications</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p>In addition to those applications described in <a
|
<p>In addition to those applications described in <a
|
||||||
href="Documentation.htm">the /etc/shorewall/rules documentation</a>, here
|
href="Documentation.htm">the /etc/shorewall/rules documentation</a>, here
|
||||||
are some other services/applications that you may need to configure your
|
are some other services/applications that you may need to configure your
|
||||||
firewall to accommodate.</p>
|
firewall to accommodate.</p>
|
||||||
|
|
||||||
<p>NTP (Network Time Protocol)</p>
|
<p>NTP (Network Time Protocol)</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>UDP Port 123</p>
|
<p>UDP Port 123</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>rdate</p>
|
<p>rdate</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 37</p>
|
<p>TCP Port 37</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>UseNet (NNTP)</p>
|
<p>UseNet (NNTP)</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 119</p>
|
<p>TCP Port 119</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>DNS</p>
|
<p>DNS</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>UDP Port 53. If you are configuring a DNS client, you will probably
|
<p>UDP Port 53. If you are configuring a DNS client, you will probably want
|
||||||
want to open TCP Port 53 as well.<br>
|
to open TCP Port 53 as well.<br>
|
||||||
If you are configuring a server, only open TCP Port 53 if you will
|
If you are configuring a server, only open TCP Port 53 if you will
|
||||||
return long replies to queries or if you need to enable ZONE transfers. In
|
return long replies to queries or if you need to enable ZONE transfers. In
|
||||||
the latter case, be sure that your server is properly configured.</p>
|
the latter case, be sure that your server is properly configured.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>ICQ </p>
|
<p>ICQ </p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>UDP Port 4000. You will also need to open a range of TCP ports which
|
<p>UDP Port 4000. You will also need to open a range of TCP ports which
|
||||||
you can specify to your ICQ client. By default, clients use 4000-4100.</p>
|
you can specify to your ICQ client. By default, clients use 4000-4100.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>PPTP</p>
|
<p>PPTP</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p><u>Protocol</u> 47 (NOT <u>port</u> 47) and TCP Port 1723 (<a
|
<p><u>Protocol</u> 47 (NOT <u>port</u> 47) and TCP Port 1723 (<a
|
||||||
href="PPTP.htm">Lots more information here</a>).</p>
|
href="PPTP.htm">Lots more information here</a>).</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>IPSEC</p>
|
<p>IPSEC</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p><u>Protocols</u> 50 and 51 (NOT <u>ports</u> 50 and 51) and UDP Port
|
<p><u>Protocols</u> 50 and 51 (NOT <u>ports</u> 50 and 51) and UDP Port
|
||||||
500. These should be opened in both directions (Lots more information
|
500. These should be opened in both directions (Lots more information
|
||||||
<a href="IPSEC.htm">here</a> and <a href="VPN.htm">here</a>).</p>
|
<a href="IPSEC.htm">here</a> and <a href="VPN.htm">here</a>).</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>SMTP</p>
|
<p>SMTP</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p> TCP Port 25.</p>
|
<p> TCP Port 25.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
<p>RealPlayer<br>
|
||||||
|
</p>
|
||||||
|
<blockquote>
|
||||||
|
<p>UDP Port 6790 inbound<br>
|
||||||
|
</p>
|
||||||
|
</blockquote>
|
||||||
<p>POP3</p>
|
<p>POP3</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 110.</p>
|
<p>TCP Port 110.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>TELNET</p>
|
<p>TELNET</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 23.</p>
|
<p>TCP Port 23.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>SSH</p>
|
<p>SSH</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 22.</p>
|
<p>TCP Port 22.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Auth (identd)</p>
|
<p>Auth (identd)</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Port 113</p>
|
<p>TCP Port 113</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Web Access</p>
|
<p>Web Access</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Ports 80 and 443.</p>
|
<p>TCP Ports 80 and 443.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>FTP</p>
|
<p>FTP</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>Server configuration is covered on in <a
|
<p>Server configuration is covered on in <a
|
||||||
href="Documentation.htm#Rules">the /etc/shorewall/rules documentation</a>,</p>
|
href="Documentation.htm#Rules">the /etc/shorewall/rules documentation</a>,</p>
|
||||||
|
|
||||||
<p>For a client, you must open outbound TCP port 21 and be sure that your
|
<p>For a client, you must open outbound TCP port 21 and be sure that your
|
||||||
kernel is compiled to support FTP connection tracking. If you build this
|
kernel is compiled to support FTP connection tracking. If you build this
|
||||||
support as a module, Shorewall will automatically load the module from
|
support as a module, Shorewall will automatically load the module from
|
||||||
/var/lib/<<i>kernel version</i>>/kernel/net/ipv4/netfilter. <br>
|
/var/lib/<<i>kernel version</i>>/kernel/net/ipv4/netfilter. <br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>If you run an FTP server on a nonstandard port or you need to access
|
<p>If you run an FTP server on a nonstandard port or you need to access
|
||||||
such a server, then you must specify that port in /etc/shorewall/modules.
|
such a server, then you must specify that port in /etc/shorewall/modules.
|
||||||
For example, if you run an FTP server that listens on port 49 then you would
|
For example, if you run an FTP server that listens on port 49 then you would
|
||||||
have:<br>
|
have:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>loadmodule ip_conntrack_ftp ports=21,49<br>
|
<p>loadmodule ip_conntrack_ftp ports=21,49<br>
|
||||||
loadmodule ip_nat_ftp ports=21,49<br>
|
loadmodule ip_nat_ftp ports=21,49<br>
|
||||||
</p>
|
</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Note that you MUST include port 21 in the <i>ports</i> list or you may
|
<p>Note that you MUST include port 21 in the <i>ports</i> list or you may
|
||||||
have problems accessing regular FTP servers.</p>
|
have problems accessing regular FTP servers.</p>
|
||||||
|
|
||||||
<p>If there is a possibility that these modules might be loaded before
|
<p>If there is a possibility that these modules might be loaded before Shorewall
|
||||||
Shorewall starts, then you should include the port list in /etc/modules.conf:<br>
|
starts, then you should include the port list in /etc/modules.conf:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>options ip_conntrack_ftp ports=21,49<br>
|
<p>options ip_conntrack_ftp ports=21,49<br>
|
||||||
options ip_nat_ftp ports=21,49<br>
|
options ip_nat_ftp ports=21,49<br>
|
||||||
</p>
|
</p>
|
||||||
</blockquote>
|
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
<p><b>IMPORTANT: </b>Once you have made these changes to /etc/shorewall/modules
|
||||||
|
and/or /etc/modules.conf, you must either:<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>Unload the modules and restart shorewall: (<b><font
|
||||||
|
color="#009900">rmmod ip_nat_ftp; rmmod ip_conntrack_ftp; shorewall restart</font></b>);
|
||||||
|
or</li>
|
||||||
|
<li>Reboot<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ol>
|
||||||
|
|
||||||
|
<p> </p>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<blockquote> </blockquote>
|
||||||
|
|
||||||
<p>SMB/NMB (Samba/Windows Browsing/File Sharing)</p>
|
<p>SMB/NMB (Samba/Windows Browsing/File Sharing)</p>
|
||||||
|
|
||||||
<blockquote> </blockquote>
|
<blockquote> </blockquote>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>TCP Ports 137, 139 and 445.<br>
|
<p>TCP Ports 137, 139 and 445.<br>
|
||||||
UDP Ports 137-139.<br>
|
UDP Ports 137-139.<br>
|
||||||
<br>
|
<br>
|
||||||
Also, <a href="samba.htm">see this page</a>.</p>
|
Also, <a href="samba.htm">see this page</a>.</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Traceroute</p>
|
<p>Traceroute</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>UDP ports 33434 through 33434+<i><max number of hops></i>-1</p>
|
<p>UDP ports 33434 through 33434+<i><max number of hops></i>-1</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>NFS<br>
|
<p>NFS<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>I personally use the following rules for opening access from zone z1
|
<p>I personally use the following rules for opening access from zone z1
|
||||||
to a server with IP address a.b.c.d in zone z2:<br>
|
to a server with IP address a.b.c.d in zone z2:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<pre>ACCEPT z1 z2:a.b.c.d udp 111<br>ACCEPT z1 z2:a.b.c.d tcp 111<br>ACCEPT z1 z2:a.b.c.d udp 2049<br>ACCEPT z1 z2:a.b.c.d udp 32700:<br></pre>
|
<pre>ACCEPT z1 z2:a.b.c.d udp 111<br>ACCEPT z1 z2:a.b.c.d tcp 111<br>ACCEPT z1 z2:a.b.c.d udp 2049<br>ACCEPT z1 z2:a.b.c.d udp 32700:<br></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<p>Note that my rules only cover NFS using UDP (the normal case). There
|
<p>Note that my rules only cover NFS using UDP (the normal case). There
|
||||||
is lots of additional information at <a
|
is lots of additional information at <a
|
||||||
href="http://nfs.sourceforge.net/nfs-howto/security.html"> http://nfs.sourceforge.net/nfs-howto/security.html</a></p>
|
href="http://nfs.sourceforge.net/nfs-howto/security.html"> http://nfs.sourceforge.net/nfs-howto/security.html</a></p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>Didn't find what you are looking for -- have you looked in your own
|
<p>VNC<br>
|
||||||
/etc/services file? </p>
|
</p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<p>TCP port 5900 + <display number></p>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p>Didn't find what you are looking for -- have you looked in your own /etc/services
|
||||||
|
file? </p>
|
||||||
|
|
||||||
<p>Still looking? Try <a
|
<p>Still looking? Try <a
|
||||||
href="http://www.networkice.com/advice/Exploits/Ports"> http://www.networkice.com/advice/Exploits/Ports</a></p>
|
href="http://www.networkice.com/advice/Exploits/Ports"> http://www.networkice.com/advice/Exploits/Ports</a></p>
|
||||||
|
|
||||||
<p><font size="2">Last updated 2/25/2003 - </font><font size="2"> <a
|
<p><font size="2">Last updated 5/5/2003 - </font><font size="2"> <a
|
||||||
href="support.htm">Tom Eastep</a></font> </p>
|
href="support.htm">Tom Eastep</a></font> </p>
|
||||||
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,268 +1,373 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||||
<base
|
|
||||||
target="_self">
|
<base target="_self">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="4"
|
<table border="0" cellpadding="0" cellspacing="4"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
|
||||||
width="100%" height="90">
|
<td width="100%" height="90">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"> <font size="4"><i> <a
|
<h1 align="center"> <font size="4"><i> <a
|
||||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||||
src="images/washington.jpg" border="0">
|
src="images/washington.jpg" border="0">
|
||||||
</a></i></font><a
|
</a></i></font><a
|
||||||
href="http://www.shorewall.net" target="_top"><img border="1"
|
href="http://www.shorewall.net" target="_top"><img border="1"
|
||||||
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
||||||
alt="(Shorewall Logo)" align="right" vspace="4">
|
alt="(Shorewall Logo)" align="right" vspace="4">
|
||||||
</a></h1>
|
</a></h1>
|
||||||
<small><small><small><small><a
|
<small><small><small><small><a
|
||||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||||
|
|
||||||
<div align="center">
|
|
||||||
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
<div align="center">
|
||||||
|
|
||||||
|
|
||||||
|
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
||||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
||||||
href="1.3" target="_top"><font color="#ffffff"><br>
|
href="1.3" target="_top"><font color="#ffffff"><br>
|
||||||
<small><small><small><small>Shorewall 1.3 Site is here</small></small></small></small></font></a><a
|
</font></a><br>
|
||||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><br>
|
|
||||||
<small><small><small><small>Shorewall 1.2 Site is here</small></small></small></small></font></a><br>
|
|
||||||
|
</h1>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
</h1>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<div align="center">
|
<div align="center">
|
||||||
<center>
|
<center>
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
|
||||||
width="90%">
|
<td width="90%">
|
||||||
|
|
||||||
|
|
||||||
<h2 align="left">What is it?</h2>
|
<h2 align="left">What is it?</h2>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||||
firewall that can be used on a dedicated firewall system, a multi-function
|
firewall that can be used on a dedicated firewall system, a multi-function
|
||||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>This program is free software; you can redistribute it and/or modify
|
<p>This program is free software; you can redistribute it and/or modify
|
||||||
it under
|
it
|
||||||
the terms of <a
|
under the terms of <a
|
||||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||||
GNU General Public License</a> as published by the Free Software
|
GNU General Public License</a> as published by the Free Software
|
||||||
Foundation.<br>
|
Foundation.<br>
|
||||||
<br>
|
<br>
|
||||||
This program
|
This
|
||||||
is distributed in the hope that it will
|
program is distributed in the hope that
|
||||||
be useful, but WITHOUT ANY WARRANTY; without
|
it will be useful, but WITHOUT ANY WARRANTY;
|
||||||
even the implied warranty of MERCHANTABILITY
|
without even the implied warranty of MERCHANTABILITY
|
||||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
or FITNESS FOR A PARTICULAR PURPOSE. See
|
||||||
GNU General Public License for more details.<br>
|
the GNU General Public License for more details.<br>
|
||||||
<br>
|
<br>
|
||||||
You should have
|
You
|
||||||
received a copy of the GNU General Public
|
should have received a copy of the GNU General
|
||||||
License along with this program; if
|
Public License along with this program;
|
||||||
not, write to the Free Software Foundation,
|
if not, write to the Free Software Foundation,
|
||||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
||||||
|
USA</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||||
|
|
||||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
||||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
|
||||||
</a>Jacques Nilo
|
|
||||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
|
||||||
on a floppy, CD or compact flash) distribution
|
|
||||||
called <i>Bering</i> that features
|
|
||||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
<h2><br>
|
||||||
find their work at: <a
|
Getting Started with Shorewall</h2>
|
||||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
New to Shorewall? Start by selecting the <a
|
||||||
</a></p>
|
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||||
|
match your environment and follow the step by step instructions.<br>
|
||||||
<p><b>Congratulations to Jacques and Eric on the recent release of
|
<br>
|
||||||
Bering 1.1!!! </b><br>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<h2>This is a mirror of the main Shorewall web site at SourceForge
|
|
||||||
(<a href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
|
||||||
|
|
||||||
<h2>News</h2>
|
<h2>News</h2>
|
||||||
|
|
||||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
|
||||||
|
<p><b>5/10/2003 - Shorewall Mirror in Asia </b><b><img border="0"
|
||||||
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b><br>
|
||||||
|
</p>
|
||||||
|
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||||
|
|
||||||
|
<p><b>5/8/2003 - Shorewall Mirror in Chile </b><b><img border="0"
|
||||||
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><b>4/26/2003 - lists.shorewall.net Downtime </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
|
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||||
|
</b><b><img border="0" src="images/new10.gif" width="28"
|
||||||
|
height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
|
||||||
|
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||||
|
to Shorewall version 1.4.2.</p>
|
||||||
|
|
||||||
|
|
||||||
|
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||||
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
|
||||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||||
Shorewall presentation to GSLUG</a>. The presentation is in HTML format
|
Shorewall presentation to GSLUG</a>. The presentation is in
|
||||||
but was generated from Microsoft PowerPoint and is best viewed using Internet
|
HTML format but was generated from Microsoft PowerPoint and is best viewed
|
||||||
Explorer although Konqueror also seems to work reasonably well. Neither Opera
|
using Internet Explorer (although Konqueror also seems to work reasonably
|
||||||
or Netscape work well to view the presentation.<br>
|
well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to view
|
||||||
</blockquote>
|
the presentation.<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b><br>
|
</b><br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p><b> Problems Corrected:</b></p>
|
|
||||||
|
<p><b> Problems Corrected:</b></p>
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>TCP connection requests rejected out of the <b>common</b>
|
<li>TCP connection requests rejected out of the
|
||||||
chain are now properly rejected with TCP RST; previously, some of these
|
<b>common</b> chain are now properly rejected with TCP
|
||||||
requests were rejected with an ICMP port-unreachable response.</li>
|
RST; previously, some of these requests were rejected with an ICMP
|
||||||
<li>'traceroute -I' from behind the firewall previously timed
|
port-unreachable response.</li>
|
||||||
out on the first hop (e.g., to the firewall). This has been worked around.</li>
|
<li>'traceroute -I' from behind the firewall previously
|
||||||
|
timed out on the first hop (e.g., to the firewall). This has been
|
||||||
|
worked around.</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p><b> New Features:</b></p>
|
|
||||||
|
<p><b> New Features:</b></p>
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Where an entry in the/etc/shorewall/hosts file specifies
|
<li>Where an entry in the/etc/shorewall/hosts file
|
||||||
a particular host or network, Shorewall now creates an intermediate chain
|
specifies a particular host or network, Shorewall now creates an intermediate
|
||||||
for handling input from the related zone. This can substantially reduce the
|
chain for handling input from the related zone. This can substantially
|
||||||
number of rules traversed by connections requests from such zones.<br>
|
reduce the number of rules traversed by connections requests from such
|
||||||
<br>
|
zones.<br>
|
||||||
</li>
|
<br>
|
||||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
</li>
|
||||||
consists of the word INCLUDE followed by a file name and causes the contents
|
<li>Any file may include an INCLUDE directive. An
|
||||||
of the named file to be logically included into the file containing the INCLUDE.
|
INCLUDE directive consists of the word INCLUDE followed by a file
|
||||||
File names given in an INCLUDE directive are assumed to reside in /etc/shorewall
|
name and causes the contents of the named file to be logically included
|
||||||
or in an alternate configuration directory if one has been specified for
|
into the file containing the INCLUDE. File names given in an INCLUDE
|
||||||
the command. <br>
|
directive are assumed to reside in /etc/shorewall or in an alternate
|
||||||
<br>
|
configuration directory if one has been specified for the command. <br>
|
||||||
Examples:<br>
|
<br>
|
||||||
shorewall/params.mgmt:<br>
|
Examples:<br>
|
||||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
shorewall/params.mgmt:<br>
|
||||||
TIME_SERVERS=4.4.4.4<br>
|
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||||
BACKUP_SERVERS=5.5.5.5<br>
|
TIME_SERVERS=4.4.4.4<br>
|
||||||
----- end params.mgmt -----<br>
|
BACKUP_SERVERS=5.5.5.5<br>
|
||||||
<br>
|
----- end params.mgmt -----<br>
|
||||||
<br>
|
<br>
|
||||||
shorewall/params:<br>
|
<br>
|
||||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
shorewall/params:<br>
|
||||||
[..]<br>
|
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||||
#######################################<br>
|
[..]<br>
|
||||||
<br>
|
#######################################<br>
|
||||||
INCLUDE params.mgmt <br>
|
<br>
|
||||||
<br>
|
INCLUDE params.mgmt <br>
|
||||||
# params unique to this host here<br>
|
<br>
|
||||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
# params unique to this host here<br>
|
||||||
----- end params -----<br>
|
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT
|
||||||
<br>
|
REMOVE<br>
|
||||||
<br>
|
----- end params -----<br>
|
||||||
shorewall/rules.mgmt:<br>
|
<br>
|
||||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
<br>
|
||||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
shorewall/rules.mgmt:<br>
|
||||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||||
----- end rules.mgmt -----<br>
|
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||||
<br>
|
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||||
shorewall/rules:<br>
|
----- end rules.mgmt -----<br>
|
||||||
# Shorewall version 1.3 - Rules File<br>
|
<br>
|
||||||
[..]<br>
|
shorewall/rules:<br>
|
||||||
#######################################<br>
|
# Shorewall version 1.3 - Rules File<br>
|
||||||
<br>
|
[..]<br>
|
||||||
INCLUDE rules.mgmt <br>
|
#######################################<br>
|
||||||
<br>
|
<br>
|
||||||
# rules unique to this host here<br>
|
INCLUDE rules.mgmt <br>
|
||||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
<br>
|
||||||
----- end rules -----<br>
|
# rules unique to this host here<br>
|
||||||
<br>
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
|
||||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
REMOVE<br>
|
||||||
are ignored with a warning message.<br>
|
----- end rules -----<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
INCLUDE's may be nested to a level of 3 -- further nested
|
||||||
<li>Routing traffic from an interface back out that interface
|
INCLUDE directives are ignored with a warning message.<br>
|
||||||
continues to be a problem. While I firmly believe that this should never
|
<br>
|
||||||
happen, people continue to want to do it. To limit the damage that such
|
</li>
|
||||||
nonsense produces, I have added a new 'routeback' option in /etc/shorewall/interfaces
|
<li>Routing traffic from an interface back out that
|
||||||
and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the 'ZONE'
|
interface continues to be a problem. While I firmly believe that
|
||||||
column may not contain '-'; in other words, 'routeback' can't be used as
|
this should never happen, people continue to want to do it. To limit
|
||||||
an option for a multi-zone interface. The 'routeback' option CAN be specified
|
the damage that such nonsense produces, I have added a new 'routeback'
|
||||||
however on individual group entries in /etc/shorewall/hosts.<br>
|
option in /etc/shorewall/interfaces and /etc/shorewall/hosts. When
|
||||||
<br>
|
used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
||||||
The 'routeback' option is similar to the old 'multi' option with two
|
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
||||||
exceptions:<br>
|
interface. The 'routeback' option CAN be specified however on individual
|
||||||
<br>
|
group entries in /etc/shorewall/hosts.<br>
|
||||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
<br>
|
||||||
<br>
|
The 'routeback' option is similar to the old 'multi' option
|
||||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
with two exceptions:<br>
|
||||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
<br>
|
||||||
tuples associated with the given 'interface').<br>
|
a) The option pertains to a particular zone,interface,address
|
||||||
<br>
|
tuple.<br>
|
||||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>' for information
|
<br>
|
||||||
about how this new option may affect your configuration.<br>
|
b) The option only created infrastructure to pass traffic
|
||||||
</li>
|
from (zone,interface,address) tuples back to themselves (the 'multi'
|
||||||
|
option affected all (zone,interface,address) tuples associated with
|
||||||
|
the given 'interface').<br>
|
||||||
|
<br>
|
||||||
|
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>'
|
||||||
|
for information about how this new option may affect your configuration.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p><b></b></p>
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="News.htm">More News</a></p>
|
<p><a href="News.htm">More News</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||||
|
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||||
|
alt="(Leaf Logo)">
|
||||||
|
</a>Jacques
|
||||||
|
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||||
|
on a floppy, CD or compact flash) distribution
|
||||||
|
called <i>Bering</i> that
|
||||||
|
features Shorewall-1.3.14 and Kernel-2.4.20.
|
||||||
|
You can find their work at: <a
|
||||||
|
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||||
|
|
||||||
|
</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
<b>Congratulations to Jacques and Eric on the recent release of Bering
|
||||||
|
1.2!!! </b><br>
|
||||||
<h2><a name="Donations"></a>Donations</h2>
|
<h2><a name="Donations"></a>Donations</h2>
|
||||||
</td>
|
</td>
|
||||||
<td
|
|
||||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
||||||
</td>
|
|
||||||
</tr>
|
<form method="post"
|
||||||
|
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
</tbody>
|
<strong><br>
|
||||||
|
<font color="#ffffff"><b>Note: </b></font></strong><font
|
||||||
|
color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
||||||
|
<strong></strong>
|
||||||
|
|
||||||
|
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||||
|
<font face="Arial"
|
||||||
|
size="-1"> <input type="text" name="words" size="15"></font><font
|
||||||
|
size="-1"> </font> <font face="Arial" size="-1"> <input
|
||||||
|
type="hidden" name="format" value="long"> <input type="hidden"
|
||||||
|
name="method" value="and"> <input type="hidden" name="config"
|
||||||
|
value="htdig"> <input type="submit" value="Search"></font> </p>
|
||||||
|
<font face="Arial"> <input
|
||||||
|
type="hidden" name="exclude"
|
||||||
|
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||||
|
|
||||||
|
<p><font color="#ffffff"><b><a
|
||||||
|
href="http://lists.shorewall.net/htdig/search.html"><font
|
||||||
|
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||||
|
<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</center>
|
</center>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<table border="0" cellpadding="5" cellspacing="0"
|
<table border="0" cellpadding="5" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%"
|
<td
|
||||||
style="margin-top: 1px;">
|
width="100%" style="margin-top: 1px;">
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><a href="http://www.starlight.org"> <img
|
<p align="center"><a href="http://www.starlight.org"> <img
|
||||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||||
hspace="10">
|
hspace="10">
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||||
but if you try it and find it useful, please consider making a donation
|
but if you try it and find it useful, please consider making a donation
|
||||||
to <a
|
to
|
||||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||||
Foundation.</font></a> Thanks!</font></p>
|
Children's Foundation.</font></a> Thanks!</font></p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p><font size="2">Updated 4/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2">Updated 5/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||||
<br>
|
<br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,128 +1,141 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>About the Shorewall Author</title>
|
<title>About the Shorewall Author</title>
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Tom Eastep</font></h1>
|
<h1 align="center"><font color="#ffffff">Tom Eastep</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="center"> <img border="3" src="images/TomNTarry.png"
|
<p align="center"> <img border="3" src="images/TomNTarry.png"
|
||||||
alt="Tom on the PCT - 1991" width="316" height="392">
|
alt="Tom on the PCT - 1991" width="316" height="392">
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="center">Tarry & Tom -- August 2002<br>
|
<p align="center">Tarry & Tom -- August 2002<br>
|
||||||
<br>
|
<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Born 1945 in <a
|
<li>Born 1945 in <a
|
||||||
href="http://www.experiencewashington.com">Washington State</a> .</li>
|
href="http://www.experiencewashington.com">Washington State</a> .</li>
|
||||||
<li>BA Mathematics from <a href="http://www.wsu.edu">Washington
|
<li>BA Mathematics from <a
|
||||||
State University</a> 1967</li>
|
href="http://www.wsu.edu">Washington State University</a> 1967</li>
|
||||||
<li>MA Mathematics from <a
|
<li>MA Mathematics from <a
|
||||||
href="http://www.washington.edu">University of Washington</a> 1969</li>
|
href="http://www.washington.edu">University of Washington</a> 1969</li>
|
||||||
<li>Burroughs Corporation (now <a
|
<li>Burroughs Corporation (now <a
|
||||||
href="http://www.unisys.com">Unisys</a> ) 1969 - 1980</li>
|
href="http://www.unisys.com">Unisys</a> ) 1969 - 1980</li>
|
||||||
<li><a href="http://www.tandem.com">Tandem Computers, Incorporated</a>
|
<li><a href="http://www.tandem.com">Tandem Computers,
|
||||||
(now part of the <a href="http://www.hp.com">The New HP</a>) 1980
|
Incorporated</a> (now part of the <a href="http://www.hp.com">The
|
||||||
- present</li>
|
New HP</a>) 1980 - present</li>
|
||||||
<li>Married 1969 - no children.</li>
|
<li>Married 1969 - no children.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>I am currently a member of the design team for the next-generation
|
<p>I am currently a member of the design team for the next-generation operating
|
||||||
operating system from the NonStop Enterprise Division of HP. </p>
|
system from the NonStop Enterprise Division of HP. </p>
|
||||||
|
|
||||||
<p>I became interested in Internet Security when I established a home office
|
<p>I became interested in Internet Security when I established a home office
|
||||||
in 1999 and had DSL service installed in our home. I investigated
|
in 1999 and had DSL service installed in our home. I investigated
|
||||||
ipchains and developed the scripts which are now collectively known as
|
ipchains and developed the scripts which are now collectively known
|
||||||
<a href="http://seawall.sourceforge.net"> Seattle Firewall</a>. Expanding
|
as <a href="http://seawall.sourceforge.net"> Seattle Firewall</a>.
|
||||||
on what I learned from Seattle Firewall, I then designed and
|
Expanding on what I learned from Seattle Firewall, I then designed
|
||||||
wrote Shorewall. </p>
|
and wrote Shorewall. </p>
|
||||||
|
|
||||||
<p>I telework from our <a
|
<p>I telework from our <a
|
||||||
href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a> in <a
|
href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a> in <a
|
||||||
href="http://www.cityofshoreline.com">Shoreline, Washington</a> where
|
href="http://www.cityofshoreline.com">Shoreline, Washington</a> where
|
||||||
I live with my wife Tarry. </p>
|
I live with my wife Tarry. </p>
|
||||||
|
|
||||||
<p>Our current home network consists of: </p>
|
<p>Our current home network consists of: </p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB &
|
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB
|
||||||
20GB IDE HDs and LNE100TX (Tulip) NIC - My personal Windows system.
|
& 20GB IDE HDs and LNE100TX (Tulip) NIC - My personal Windows
|
||||||
Serves as a PPTP server for Road Warrior access. Dual boots <a
|
system. Serves as a PPTP server for Road Warrior access. Dual boots <a
|
||||||
href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
|
href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
|
||||||
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, LNE100TX(Tulip)
|
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, LNE100TX(Tulip)
|
||||||
NIC - My personal Linux System which runs Samba configured as a
|
NIC - My personal Linux System which runs Samba configured
|
||||||
WINS server. This system also has <a
|
as a WINS server. This system also has <a
|
||||||
href="http://www.vmware.com/">VMware</a> installed and can run both
|
href="http://www.vmware.com/">VMware</a> installed and can run both
|
||||||
<a href="http://www.debian.org">Debian Woody</a> and <a
|
<a href="http://www.debian.org">Debian Woody</a> and <a
|
||||||
href="http://www.suse.com">SuSE 8.1</a> in virtual machines.</li>
|
href="http://www.suse.com">SuSE 8.1</a> in virtual machines.</li>
|
||||||
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100 NIC
|
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100
|
||||||
- Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache), FTP (Pure_ftpd),
|
NIC - Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache), FTP
|
||||||
DNS server (Bind 9).</li>
|
(Pure_ftpd), DNS server (Bind 9).</li>
|
||||||
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD - 3
|
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD -
|
||||||
LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall 1.4.0
|
3 LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall
|
||||||
and a DHCP server.</li>
|
1.4.2 and a DHCP server.</li>
|
||||||
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139 NIC
|
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
|
||||||
- My wife's personal system.</li>
|
NIC - My wife's personal system.</li>
|
||||||
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB HD, onboard
|
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB HD,
|
||||||
EEPRO100 and EEPRO100 in expansion base and LinkSys WAC11 - My
|
built-in EEPRO100, EEPRO100 in expansion base and LinkSys WAC11 - My
|
||||||
main work system.</li>
|
work system.</li>
|
||||||
|
<li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and LinkSys
|
||||||
|
WAC11 - Our Laptop.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>For more about our network see <a href="myfiles.htm">my Shorewall Configuration</a>.</p>
|
<p>For more about our network see <a href="myfiles.htm">my Shorewall Configuration</a>.</p>
|
||||||
|
|
||||||
<p>All of our other systems are made by <a
|
<p>All of our other systems are made by <a
|
||||||
href="http://www.compaq.com">Compaq</a> (part of the new <a
|
href="http://www.compaq.com">Compaq</a> (part of the new <a
|
||||||
href="http://www.hp.com/">HP</a>).. All of our Tulip NICs are <a
|
href="http://www.hp.com/">HP</a>).. All of our Tulip NICs are <a
|
||||||
href="http://www.netgear.com">Netgear</a> FA310TXs.</p>
|
href="http://www.netgear.com">Netgear</a> FA310TXs.</p>
|
||||||
|
|
||||||
<p><a href="http://www.redhat.com"><img border="0"
|
<p><a href="http://www.redhat.com"><img border="0"
|
||||||
src="images/poweredby.png" width="88" height="31">
|
src="images/poweredby.png" width="88" height="31">
|
||||||
</a><a href="http://www.compaq.com"><img border="0"
|
</a><a href="http://www.compaq.com"><img border="0"
|
||||||
src="images/poweredbycompaqlog0.gif" hspace="3" width="83" height="25">
|
src="images/poweredbycompaqlog0.gif" hspace="3" width="83" height="25">
|
||||||
</a><a href="http://www.pureftpd.org"><img border="0"
|
</a><a href="http://www.pureftpd.org"><img border="0"
|
||||||
src="images/pure.jpg" width="88" height="31">
|
src="images/pure.jpg" width="88" height="31">
|
||||||
</a><font size="4"><a href="http://www.apache.org"><img
|
</a><font size="4"><a href="http://www.apache.org"><img
|
||||||
border="0" src="images/apache_pb1.gif" hspace="2" width="170"
|
border="0" src="images/apache_pb1.gif" hspace="2" width="170"
|
||||||
height="20">
|
height="20">
|
||||||
</a><a href="http://www.mandrakelinux.com"><img
|
</a><a href="http://www.mandrakelinux.com"><img
|
||||||
src="images/medbutton.png" alt="Powered by Mandrake" width="90"
|
src="images/medbutton.png" alt="Powered by Mandrake" width="90"
|
||||||
height="32">
|
height="32">
|
||||||
</a><img src="images/shorewall.jpg" alt="Protected by Shorewall"
|
</a><img src="images/shorewall.jpg"
|
||||||
width="125" height="40" hspace="4">
|
alt="Protected by Shorewall" width="125" height="40" hspace="4">
|
||||||
</font></p>
|
<a href="http://www.opera.com"><img src="images/opera.png"
|
||||||
|
alt="(Opera Logo)" width="102" height="39" border="0">
|
||||||
<p><font size="2">Last updated 3/17/2003 - </font><font size="2"> <a
|
</a> <a href="http://www.hp.com"><img
|
||||||
|
src="images/penquin_in_blue_racer_sm2.gif" alt="" width="120"
|
||||||
|
height="75" border="0">
|
||||||
|
</a><a href="http://www.opera.com"> </a> </font></p>
|
||||||
|
|
||||||
|
<p><font size="2">Last updated 5/8/2003 - </font><font size="2"> <a
|
||||||
href="support.htm">Tom Eastep</a></font> </p>
|
href="support.htm">Tom Eastep</a></font> </p>
|
||||||
<font face="Trebuchet MS"><a href="copyright.htm"><font
|
<font face="Trebuchet MS"><a href="copyright.htm"><font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas
|
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas
|
||||||
M. Eastep.</font></a></font><br>
|
M. Eastep.</font></a></font><br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,86 +1,91 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Mirrors</title>
|
<title>Shorewall Mirrors</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Mirrors</font></h1>
|
<h1 align="center"><font color="#ffffff">Shorewall Mirrors</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="left"><b>Remember that updates to the mirrors are often delayed
|
<p align="left"><b>Remember that updates to the mirrors are often delayed
|
||||||
for 6-12 hours after an update to the primary rsync site. For HTML content,
|
for 6-12 hours after an update to the primary rsync site. For HTML content,
|
||||||
the main web site (<a href="http://shorewall.sf.net">http://shorewall.sf.net</a>)
|
the main web site (<a href="http://shorewall.sf.net">http://shorewall.sf.net</a>)
|
||||||
is updated at the same time as the rsync site.</b></p>
|
is updated at the same time as the rsync site.</b></p>
|
||||||
|
|
||||||
<p align="left">The main Shorewall Web Site is <a
|
<p align="left">The main Shorewall Web Site is <a
|
||||||
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>
|
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>
|
||||||
and is located in California, USA. It is mirrored at:</p>
|
and is located in California, USA. It is mirrored at:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a target="_top" href="http://slovakia.shorewall.net"> http://slovakia.shorewall.net</a>
|
<li><a target="_top" href="http://slovakia.shorewall.net"> http://slovakia.shorewall.net</a>
|
||||||
(Slovak Republic).</li>
|
(Slovak Republic).</li>
|
||||||
<li> <a href="http://www.infohiiway.com/shorewall"
|
<li> <a href="http://www.infohiiway.com/shorewall"
|
||||||
target="_top"> http://shorewall.infohiiway.com</a> (Texas, USA).</li>
|
target="_top"> http://shorewall.infohiiway.com</a> (Texas, USA).</li>
|
||||||
<li><a target="_top" href="http://germany.shorewall.net"> http://germany.shorewall.net</a>
|
<li><a target="_top" href="http://germany.shorewall.net"> http://germany.shorewall.net</a>
|
||||||
(Hamburg, Germany)</li>
|
(Hamburg, Germany)</li>
|
||||||
<li><a target="_top" href="http://shorewall.correofuego.com.ar">http://shorewall.correofuego.com.ar</a>
|
<li><a target="_top" href="http://shorewall.correofuego.com.ar">http://shorewall.correofuego.com.ar</a>
|
||||||
(Martinez (Zona Norte - GBA), Argentina)</li>
|
(Martinez (Zona Norte - GBA), Argentina)</li>
|
||||||
<li><a target="_top" href="http://france.shorewall.net">http://france.shorewall.net</a>
|
<li><a target="_top" href="http://france.shorewall.net">http://france.shorewall.net</a>
|
||||||
(Paris, France)</li>
|
(Paris, France)</li>
|
||||||
<li><a href="http://www.shorewall.net" target="_top">http://www.shorewall.net</a>
|
<li><a href="http://shorewall.syachile.cl" target="_top">http://shorewall.syachile.cl
|
||||||
|
</a>(Santiago Chile)<br>
|
||||||
|
</li>
|
||||||
|
<li><a href="http://www.shorewall.net" target="_top">http://www.shorewall.net</a>
|
||||||
(Washington State, USA)<br>
|
(Washington State, USA)<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left">The rsync site is mirrored via FTP at:</p>
|
<p align="left">The rsync site is mirrored via FTP at:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a target="_blank"
|
<li><a target="_blank"
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">ftp://slovakia.shorewall.net/mirror/shorewall</a>
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/">ftp://slovakia.shorewall.net/mirror/shorewall</a>
|
||||||
(Slovak Republic).</li>
|
(Slovak Republic).</li>
|
||||||
<li> <a href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall/"
|
<li> <a
|
||||||
target="_blank">ftp://ftp.infohiiway.com/pub/shorewall</a> (Texas, USA).</li>
|
href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall/" target="_blank">ftp://ftp.infohiiway.com/pub/shorewall</a>
|
||||||
<li><a target="_blank"
|
(Texas, USA).</li>
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall</a>
|
<li><a target="_blank"
|
||||||
|
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall</a>
|
||||||
(Hamburg, Germany)</li>
|
(Hamburg, Germany)</li>
|
||||||
<li> <a target="_blank"
|
<li> <a target="_blank"
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall">ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall</a>
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall">ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall</a>
|
||||||
(Martinez (Zona Norte - GBA), Argentina)</li>
|
(Martinez (Zona Norte - GBA), Argentina)</li>
|
||||||
<li> <a target="_blank"
|
<li> <a target="_blank"
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
|
||||||
(Paris, France)</li>
|
(Paris, France)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Search results and the mailing list archives are always fetched from the
|
Search results and the mailing list archives are always fetched from the
|
||||||
site in Washington State.<br>
|
site in Washington State.<br>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 3/7/2003 - <a
|
<p align="left"><font size="2">Last Updated 5/8/2003 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
||||||
<br>
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,288 +1,297 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall QuickStart Guide</title>
|
<title>Shorewall QuickStart Guide</title>
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
|
||||||
(HOWTO's)<br>
|
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
||||||
Version 4.0</font></h1>
|
(HOWTO's)<br>
|
||||||
</td>
|
Version 4.0</font></h1>
|
||||||
</tr>
|
</td>
|
||||||
|
</tr>
|
||||||
</tbody>
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="center">With thanks to Richard who reminded me once again that we
|
<p align="center">With thanks to Richard who reminded me once again that
|
||||||
must all first walk before we can run.<br>
|
we must all first walk before we can run.<br>
|
||||||
The French Translations are courtesy of Patrice Vetsel<br>
|
The French Translations are courtesy of Patrice Vetsel<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h2>The Guides</h2>
|
<h2>The Guides</h2>
|
||||||
|
|
||||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||||
in common firewall setups.</p>
|
in common firewall setups.</p>
|
||||||
|
|
||||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="standalone.htm">Standalone</a> Linux
|
<li><a href="standalone.htm">Standalone</a>
|
||||||
System (<a href="standalone_fr.html">Version Française</a>)</li>
|
Linux System (<a href="standalone_fr.html">Version Française</a>)</li>
|
||||||
<li><a href="two-interface.htm">Two-interface</a>
|
<li><a href="two-interface.htm">Two-interface</a>
|
||||||
Linux System acting as a firewall/router for a small local network
|
Linux System acting as a firewall/router for a small local
|
||||||
(<a href="two-interface_fr.html">Version Française</a>)</li>
|
network (<a href="two-interface_fr.html">Version Française</a>)</li>
|
||||||
<li><a href="three-interface.htm">Three-interface</a>
|
<li><a href="three-interface.htm">Three-interface</a>
|
||||||
Linux System acting as a firewall/router for a small local network
|
Linux System acting as a firewall/router for a small local
|
||||||
and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
network and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The above guides are designed to get your first firewall up and running
|
<p>The above guides are designed to get your first firewall up and running
|
||||||
quickly in the three most common Shorewall configurations.</p>
|
quickly in the three most common Shorewall configurations.</p>
|
||||||
|
|
||||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> (See
|
||||||
the steps necessary to set up a firewall where <b>there are multiple
|
Index Below) outlines the steps necessary to set up a firewall
|
||||||
public IP addresses involved or if you want to learn more about
|
where <b>there are multiple public IP addresses involved or
|
||||||
Shorewall than is explained in the single-address guides above.</b></p>
|
if you want to learn more about Shorewall than is explained in
|
||||||
|
the single-address guides above.</b></p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall Concepts</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Interfaces">3.0 Network Interfaces</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Addressing">4.0 Addressing, Subnets
|
|
||||||
and Routing</a>
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4
|
|
||||||
Address Resolution Protocol</a></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#RFC1918">4.5 RFC 1918</a></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Options">5.0 Setting up your Network</a>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#ProxyARP">5.2.3 Proxy ARP</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#NAT">5.2.4 Static NAT</a></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds and Ends</a></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0
|
|
||||||
DNS</a></li>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
|
||||||
Stopping the Firewall</a></li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2><a name="Documentation"></a>Documentation Index</h2>
|
<h2><a name="Documentation"></a>Documentation Index</h2>
|
||||||
|
|
||||||
<p>The following documentation covers a variety of topics and <b>supplements
|
<p>The following documentation covers a variety of topics and <b>supplements
|
||||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||||
described above</b>. Please review the appropriate guide before
|
described above</b>. Please review the appropriate guide before
|
||||||
trying to use this documentation directly.</p>
|
trying to use this documentation directly.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
<li><a
|
||||||
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
||||||
(e.g., eth0:0)</a><br>
|
(e.g., eth0:0)</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="configuration_file_basics.htm">Common
|
<li><a
|
||||||
configuration file features</a>
|
href="configuration_file_basics.htm">Common configuration file
|
||||||
|
features</a>
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Comments">Comments in configuration
|
href="configuration_file_basics.htm#Comments">Comments in configuration
|
||||||
files</a></li>
|
files</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||||
<li><a
|
<li><a href="configuration_file_basics.htm#INCLUDE">INCLUDE Directive</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a
|
||||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||||
or Subnet</a></li>
|
or Subnet</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
href="configuration_file_basics.htm#Configs">Shorewall Configurations (making
|
||||||
(making a test configuration)</a></li>
|
a test configuration)</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="Documentation.htm">Configuration File
|
<li><a href="Documentation.htm">Configuration
|
||||||
Reference Manual</a>
|
File Reference Manual</a>
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
<li> <a
|
||||||
<li><font color="#000099"><a
|
href="Documentation.htm#Variables">params</a></li>
|
||||||
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Zones">zones</a></font></li>
|
href="Documentation.htm#Zones">zones</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Policy">policy</a></font></li>
|
href="Documentation.htm#Policy">policy</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Rules">rules</a></font></li>
|
href="Documentation.htm#Rules">rules</a></font></li>
|
||||||
<li><a href="Documentation.htm#Common">common</a></li>
|
<li><a href="Documentation.htm#Common">common</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Masq">masq</a></font></li>
|
href="Documentation.htm#Masq">masq</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#NAT">nat</a></font></li>
|
href="Documentation.htm#NAT">nat</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
<li><a
|
||||||
<li><font color="#000099"><a
|
href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||||
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
<li><a href="Documentation.htm#TOS">tos</a>
|
||||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
</li>
|
||||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
<li><a
|
||||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||||
|
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||||
|
<li><a
|
||||||
|
href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="dhcp.htm">DHCP</a></li>
|
<li><a href="dhcp.htm">DHCP</a></li>
|
||||||
<li><a href="ECN.html">ECN Disabling by host or
|
<li><a href="ECN.html">ECN Disabling by host
|
||||||
subnet</a><br>
|
or subnet</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><font color="#000099"><a href="shorewall_extension_scripts.htm">Extension
|
<li><font color="#000099"><a
|
||||||
Scripts</a></font> (How to extend Shorewall without modifying Shorewall
|
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||||
code through the use of files in /etc/shorewall -- /etc/shorewall/start,
|
(How to extend Shorewall without modifying Shorewall code through the
|
||||||
/etc/shorewall/stopped, etc.)</li>
|
use of files in /etc/shorewall -- /etc/shorewall/start, /etc/shorewall/stopped,
|
||||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
etc.)</li>
|
||||||
<li><a href="shorewall_firewall_structure.htm">Firewall
|
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||||
Structure</a></li>
|
<li><a
|
||||||
<li><font color="#000099"><a href="kernel.htm">Kernel
|
href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||||
Configuration</a></font></li>
|
<li><font color="#000099"><a
|
||||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
href="kernel.htm">Kernel Configuration</a></font></li>
|
||||||
</li>
|
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
</li>
|
||||||
</li>
|
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||||
<li><a href="myfiles.htm">My Shorewall Configuration
|
</li>
|
||||||
(How I personally use Shorewall)</a><br>
|
<li><a href="myfiles.htm">My Shorewall
|
||||||
|
Configuration (How I personally use Shorewall)</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="ping.html">'Ping' Management</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="ports.htm">Port Information</a>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>Which applications use which ports</li>
|
||||||
|
<li>Ports used by Trojans</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||||
|
<li><a href="samba.htm">Samba</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="ping.html">'Ping' Management</a><br>
|
|
||||||
</li>
|
|
||||||
<li><a href="ports.htm">Port Information</a>
|
|
||||||
<ul>
|
|
||||||
<li>Which applications use which ports</li>
|
|
||||||
<li>Ports used by Trojans</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
|
||||||
<li><a href="samba.htm">Samba</a></li>
|
|
||||||
<li><font color="#000099"><a
|
|
||||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Description of all /sbin/shorewall commands</li>
|
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||||
<li>How to safely test a Shorewall configuration change<br>
|
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||||
</li>
|
Concepts</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||||
|
Interfaces</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||||
|
Subnets and Routing</a>
|
||||||
|
<ul>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||||
|
Resolution Protocol (ARP)</a></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC 1918</a></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||||
|
up your Network</a>
|
||||||
|
<ul>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||||
|
Proxy ARP</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||||
|
NAT</a></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds
|
||||||
|
and Ends</a></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#StartingAndStopping">7.0
|
||||||
|
Starting and Stopping the Firewall</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
<li><font color="#000099"><a href="NAT.htm">Static
|
<li><font color="#000099"><a
|
||||||
NAT</a></font></li>
|
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
|
||||||
Proxy with Shorewall</a><br>
|
<ul>
|
||||||
</li>
|
<li>Description of all /sbin/shorewall commands</li>
|
||||||
<li><a href="traffic_shaping.htm">Traffic Shaping/QOS</a></li>
|
<li>How to safely test a Shorewall configuration
|
||||||
<li>VPN
|
change<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
<li><font color="#000099"><a
|
||||||
|
href="NAT.htm">Static NAT</a></font></li>
|
||||||
|
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
||||||
|
Proxy with Shorewall</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="traffic_shaping.htm">Traffic
|
||||||
|
Shaping/QOS</a></li>
|
||||||
|
<li>VPN
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="PPTP.htm">PPTP</a></li>
|
<li><a href="PPTP.htm">PPTP</a></li>
|
||||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system
|
<li><a href="VPN.htm">IPSEC/PPTP</a> from
|
||||||
behind your firewall to a remote network.</li>
|
a system behind your firewall to a remote network.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="whitelisting_under_shorewall.htm">White
|
<li><a
|
||||||
List Creation</a></li>
|
href="whitelisting_under_shorewall.htm">White List Creation</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||||
|
|
||||||
<p><font size="2">Last modified 4/112003 - <a href="support.htm">Tom Eastep</a></font></p>
|
<p><font size="2">Last modified 5/03/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||||
Eastep</font></a><br>
|
Eastep</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@ -1,281 +1,376 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||||
<base
|
|
||||||
target="_self">
|
<base target="_self">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="4"
|
<table border="0" cellpadding="0" cellspacing="4"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
|
||||||
width="100%" height="90">
|
<td width="100%" height="90">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"> <font size="4"><i> <a
|
<h1 align="center"> <font size="4"><i> <a
|
||||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||||
src="images/washington.jpg" border="0">
|
src="images/washington.jpg" border="0">
|
||||||
</a></i></font><font
|
</a></i></font><font
|
||||||
color="#ffffff">Shorewall 1.4 - <font
|
color="#ffffff">Shorewall 1.4 - <font
|
||||||
size="4">"<i>iptables made easy"</i></font></font><br>
|
size="4">"<i>iptables made easy"</i></font></font><br>
|
||||||
<a target="_top" href="1.3/index.html"><font color="#ffffff">
|
<a target="_top" href="1.3/index.html"><font
|
||||||
<small><small><small>Shorewall 1.3 Site here</small></small></small></font></a><br>
|
color="#ffffff"> </font></a><a target="_top"
|
||||||
<a target="_top"
|
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small><br>
|
||||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small>Shorewall
|
</small></small></small></font></a>
|
||||||
1.2 Site here<br>
|
|
||||||
</small></small></small></font></a>
|
|
||||||
|
|
||||||
</h1>
|
</h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<div align="center">
|
<div align="center">
|
||||||
<center>
|
<center>
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
|
||||||
width="90%">
|
<td width="90%">
|
||||||
|
|
||||||
|
|
||||||
<h2 align="left">What is it?</h2>
|
<h2 align="left">What is it?</h2>
|
||||||
|
|
||||||
|
|
||||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
|
||||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
|
||||||
(iptables) based firewall that can be used on a dedicated
|
|
||||||
firewall system, a multi-function gateway/router/server
|
|
||||||
or on a standalone GNU/Linux system.</p>
|
|
||||||
|
|
||||||
|
|
||||||
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||||
|
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||||
|
(iptables) based firewall that can be used on
|
||||||
|
a dedicated firewall system, a multi-function gateway/router/server
|
||||||
|
or on a standalone GNU/Linux system.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>This program is free software; you can redistribute it and/or modify
|
<p>This program is free software; you can redistribute it and/or modify
|
||||||
it under
|
it
|
||||||
the terms of <a
|
under the terms of <a
|
||||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||||
GNU General Public License</a> as published by the Free Software
|
GNU General Public License</a> as published by the Free Software
|
||||||
Foundation.<br>
|
Foundation.<br>
|
||||||
<br>
|
|
||||||
This program
|
<br>
|
||||||
is distributed in the hope that it will
|
This
|
||||||
be useful, but WITHOUT ANY WARRANTY; without
|
program is distributed in the hope that
|
||||||
even the implied warranty of MERCHANTABILITY
|
it will be useful, but WITHOUT ANY WARRANTY;
|
||||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
without even the implied warranty of MERCHANTABILITY
|
||||||
GNU General Public License for more details.<br>
|
or FITNESS FOR A PARTICULAR PURPOSE.
|
||||||
<br>
|
See the GNU General Public License for more details.<br>
|
||||||
You should
|
|
||||||
have received a copy of the GNU General
|
<br>
|
||||||
Public License along with this program;
|
You
|
||||||
if not, write to the Free Software Foundation,
|
should have received a copy of the GNU
|
||||||
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
General Public License along with
|
||||||
USA</p>
|
this program; if not, write to the Free Software
|
||||||
|
Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||||
|
MA 02139, USA</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||||
|
|
||||||
|
|
||||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
||||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
<h2>Getting Started with Shorewall</h2>
|
||||||
</a>Jacques
|
New to Shorewall? Start by selecting the <a
|
||||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||||
on a floppy, CD or compact flash) distribution
|
match your environment and follow the step by step instructions.<br>
|
||||||
called <i>Bering</i> that features
|
|
||||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
|
||||||
find their work at: <a
|
|
||||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
|
||||||
<b>Congratulations
|
|
||||||
to Jacques and Eric on the recent release of Bering
|
|
||||||
1.1!!! <br>
|
|
||||||
</b>
|
|
||||||
|
|
||||||
<h2><b>News</b></h2>
|
<h2><b>News</b></h2>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
|
<p><b>5/10/2003 - Shorewall Mirror in Asia </b><b><img border="0"
|
||||||
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b><br>
|
||||||
|
</p>
|
||||||
|
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||||
|
|
||||||
|
<p><b>5/8/2003 - Shorewall Mirror in Chile </b><b><img border="0"
|
||||||
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><b>4/26/2003 - lists.shorewall.net Downtime </b><b><img
|
||||||
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b> </b><b><img
|
||||||
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||||
|
to Shorewall version 1.4.2.</p>
|
||||||
|
|
||||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
|
|
||||||
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
||||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||||
is in HTML format but was generated from Microsoft PowerPoint and is best
|
is in HTML format but was generated from Microsoft PowerPoint and is
|
||||||
viewed using Internet Explorer although Konqueror also seems to work reasonably
|
best viewed using Internet Explorer (although Konqueror also seems to
|
||||||
well. Neither Opera or Netscape work well to view the presentation.</blockquote>
|
work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape
|
||||||
|
work well to view the presentation.</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b><br>
|
</b><br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
|
|
||||||
<p><b> Problems Corrected:</b></p>
|
<p><b> Problems Corrected:</b></p>
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>TCP connection requests rejected out of the <b>common</b>
|
<li>TCP connection requests rejected out of the <b>common</b>
|
||||||
chain are now properly rejected with TCP RST; previously, some of these requests
|
chain are now properly rejected with TCP RST; previously, some of these
|
||||||
were rejected with an ICMP port-unreachable response.</li>
|
requests were rejected with an ICMP port-unreachable response.</li>
|
||||||
<li>'traceroute -I' from behind the firewall previously timed
|
<li>'traceroute -I' from behind the firewall previously
|
||||||
out on the first hop (e.g., to the firewall). This has been worked around.</li>
|
timed out on the first hop (e.g., to the firewall). This has been worked
|
||||||
|
around.</li>
|
||||||
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p><b> New Features:</b></p>
|
<p><b> New Features:</b></p>
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Where an entry in the/etc/shorewall/hosts file specifies
|
<li>Where an entry in the/etc/shorewall/hosts file
|
||||||
a particular host or network, Shorewall now creates an intermediate chain
|
specifies a particular host or network, Shorewall now creates an intermediate
|
||||||
for handling input from the related zone. This can substantially reduce
|
chain for handling input from the related zone. This can substantially
|
||||||
the number of rules traversed by connections requests from such zones.<br>
|
reduce the number of rules traversed by connections requests from such
|
||||||
<br>
|
zones.<br>
|
||||||
</li>
|
<br>
|
||||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
</li>
|
||||||
consists of the word INCLUDE followed by a file name and causes the contents
|
<li>Any file may include an INCLUDE directive. An
|
||||||
of the named file to be logically included into the file containing the
|
INCLUDE directive consists of the word INCLUDE followed by a file name
|
||||||
INCLUDE. File names given in an INCLUDE directive are assumed to reside
|
and causes the contents of the named file to be logically included into
|
||||||
in /etc/shorewall or in an alternate configuration directory if one has
|
the file containing the INCLUDE. File names given in an INCLUDE directive
|
||||||
been specified for the command. <br>
|
are assumed to reside in /etc/shorewall or in an alternate configuration
|
||||||
<br>
|
directory if one has been specified for the command. <br>
|
||||||
Examples:<br>
|
<br>
|
||||||
shorewall/params.mgmt:<br>
|
Examples:<br>
|
||||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
shorewall/params.mgmt:<br>
|
||||||
TIME_SERVERS=4.4.4.4<br>
|
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||||
BACKUP_SERVERS=5.5.5.5<br>
|
TIME_SERVERS=4.4.4.4<br>
|
||||||
----- end params.mgmt -----<br>
|
BACKUP_SERVERS=5.5.5.5<br>
|
||||||
<br>
|
----- end params.mgmt -----<br>
|
||||||
<br>
|
<br>
|
||||||
shorewall/params:<br>
|
<br>
|
||||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
shorewall/params:<br>
|
||||||
[..]<br>
|
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||||
#######################################<br>
|
[..]<br>
|
||||||
<br>
|
#######################################<br>
|
||||||
INCLUDE params.mgmt <br>
|
<br>
|
||||||
<br>
|
INCLUDE params.mgmt <br>
|
||||||
# params unique to this host here<br>
|
<br>
|
||||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
# params unique to this host here<br>
|
||||||
----- end params -----<br>
|
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||||
<br>
|
----- end params -----<br>
|
||||||
<br>
|
<br>
|
||||||
shorewall/rules.mgmt:<br>
|
<br>
|
||||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
shorewall/rules.mgmt:<br>
|
||||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||||
----- end rules.mgmt -----<br>
|
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||||
<br>
|
----- end rules.mgmt -----<br>
|
||||||
shorewall/rules:<br>
|
<br>
|
||||||
# Shorewall version 1.3 - Rules File<br>
|
shorewall/rules:<br>
|
||||||
[..]<br>
|
# Shorewall version 1.3 - Rules File<br>
|
||||||
#######################################<br>
|
[..]<br>
|
||||||
<br>
|
#######################################<br>
|
||||||
INCLUDE rules.mgmt <br>
|
<br>
|
||||||
<br>
|
INCLUDE rules.mgmt <br>
|
||||||
# rules unique to this host here<br>
|
<br>
|
||||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
# rules unique to this host here<br>
|
||||||
----- end rules -----<br>
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
|
||||||
<br>
|
REMOVE<br>
|
||||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
----- end rules -----<br>
|
||||||
are ignored with a warning message.<br>
|
<br>
|
||||||
<br>
|
INCLUDE's may be nested to a level of 3 -- further nested
|
||||||
</li>
|
INCLUDE directives are ignored with a warning message.<br>
|
||||||
<li>Routing traffic from an interface back out that interface
|
<br>
|
||||||
continues to be a problem. While I firmly believe that this should never
|
</li>
|
||||||
happen, people continue to want to do it. To limit the damage that such
|
<li>Routing traffic from an interface back out that
|
||||||
nonsense produces, I have added a new 'routeback' option in /etc/shorewall/interfaces
|
interface continues to be a problem. While I firmly believe that this
|
||||||
and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the 'ZONE'
|
should never happen, people continue to want to do it. To limit the
|
||||||
column may not contain '-'; in other words, 'routeback' can't be used as
|
damage that such nonsense produces, I have added a new 'routeback' option
|
||||||
an option for a multi-zone interface. The 'routeback' option CAN be specified
|
in /etc/shorewall/interfaces and /etc/shorewall/hosts. When used in
|
||||||
however on individual group entries in /etc/shorewall/hosts.<br>
|
/etc/shorewall/interfaces, the 'ZONE' column may not contain '-'; in
|
||||||
<br>
|
other words, 'routeback' can't be used as an option for a multi-zone
|
||||||
The 'routeback' option is similar to the old 'multi' option with two
|
interface. The 'routeback' option CAN be specified however on individual
|
||||||
exceptions:<br>
|
group entries in /etc/shorewall/hosts.<br>
|
||||||
<br>
|
<br>
|
||||||
a) The option pertains to a particular zone,interface,address tuple.<br>
|
The 'routeback' option is similar to the old 'multi' option
|
||||||
<br>
|
with two exceptions:<br>
|
||||||
b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
<br>
|
||||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
a) The option pertains to a particular zone,interface,address
|
||||||
tuples associated with the given 'interface').<br>
|
tuple.<br>
|
||||||
<br>
|
<br>
|
||||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>' for information
|
b) The option only created infrastructure to pass traffic
|
||||||
about how this new option may affect your configuration.<br>
|
from (zone,interface,address) tuples back to themselves (the 'multi'
|
||||||
</li>
|
option affected all (zone,interface,address) tuples associated with
|
||||||
|
the given 'interface').<br>
|
||||||
|
<br>
|
||||||
|
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>'
|
||||||
|
for information about how this new option may affect your configuration.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
<p><b><a href="News.htm">More News</a></b></p>
|
|
||||||
<b> </b>
|
|
||||||
|
|
||||||
<h2><b> </b></h2>
|
|
||||||
<b> </b>
|
|
||||||
|
|
||||||
|
<p><b><a href="News.htm">More News</a></b></p>
|
||||||
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
|
<h2><b> </b></h2>
|
||||||
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||||
|
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||||
|
alt="(Leaf Logo)">
|
||||||
|
</a>Jacques
|
||||||
|
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||||
|
on a floppy, CD or compact flash) distribution
|
||||||
|
called <i>Bering</i> that
|
||||||
|
features Shorewall-1.3.14 and Kernel-2.4.20.
|
||||||
|
You can find their work at: <a
|
||||||
|
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||||
|
|
||||||
|
<b>Congratulations to Jacques and Eric on the
|
||||||
|
recent release of Bering 1.2!!! </b><br>
|
||||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||||
align="left" alt="SourceForge Logo"
|
align="left" alt="SourceForge Logo"
|
||||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||||
|
|
||||||
</a></b></h1>
|
</a></b></h1>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
<h4><b> </b></h4>
|
<h4><b> </b></h4>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
<h2><b>This site is hosted by the generous folks at <a
|
<h2><b>This site is hosted by the generous folks at <a
|
||||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||||
<b> </b></td>
|
<b> </b></td>
|
||||||
<td
|
|
||||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
||||||
</td>
|
|
||||||
</tr>
|
<form method="post"
|
||||||
|
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
</tbody>
|
|
||||||
|
<p><strong><br>
|
||||||
|
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||||
|
<font color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||||
|
<font face="Arial" size="-1"> <input type="text"
|
||||||
|
name="words" size="15"></font><font size="-1"> </font><font
|
||||||
|
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||||
|
value="long"> <input type="hidden" name="method" value="and">
|
||||||
|
<input type="hidden" name="config" value="htdig"> <input
|
||||||
|
type="submit" value="Search"></font> </p>
|
||||||
|
<font face="Arial"> <input type="hidden"
|
||||||
|
name="exclude" value="[http://lists.shorewall.net/pipermail/*]">
|
||||||
|
</font> </form>
|
||||||
|
|
||||||
|
<p><font color="#ffffff"><b> <a
|
||||||
|
href="http://lists.shorewall.net/htdig/search.html"> <font
|
||||||
|
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||||
|
<a target="_top"
|
||||||
|
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||||
|
</font></a><a target="_top"
|
||||||
|
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
|
||||||
|
</td>
|
||||||
|
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</center>
|
</center>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<table border="0" cellpadding="5" cellspacing="0"
|
<table border="0" cellpadding="5" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
<td
|
||||||
width="100%" style="margin-top: 1px;">
|
width="100%" style="margin-top: 1px;">
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><a href="http://www.starlight.org"> <img
|
<p align="center"><a href="http://www.starlight.org"> <img
|
||||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||||
hspace="10">
|
hspace="10">
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||||
but if you try it and find it useful, please consider making a donation
|
but if you try it and find it useful, please consider making a donation
|
||||||
to <a
|
to
|
||||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||||
Foundation.</font></a> Thanks!</font></p>
|
Children's Foundation.</font></a> Thanks!</font></p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p><font size="2">Updated 4/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2">Updated 5/10/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||||
<br>
|
<br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -1,425 +1,427 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Standalone Firewall</title>
|
<title>Standalone Firewall</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h2 align="center">Version 2.0.1</h2>
|
<h2 align="center">Version 2.0.1</h2>
|
||||||
|
|
||||||
<p align="left">Setting up Shorewall on a standalone Linux system is very
|
<p align="left">Setting up Shorewall on a standalone Linux system is very
|
||||||
easy if you understand the basics and follow the documentation.</p>
|
easy if you understand the basics and follow the documentation.</p>
|
||||||
|
|
||||||
<p>This guide doesn't attempt to acquaint you with all of the features of
|
<p>This guide doesn't attempt to acquaint you with all of the features of
|
||||||
Shorewall. It rather focuses on what is required to configure Shorewall
|
Shorewall. It rather focuses on what is required to configure Shorewall
|
||||||
in one of its most common configurations:</p>
|
in one of its most common configurations:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Linux system</li>
|
<li>Linux system</li>
|
||||||
<li>Single external IP address</li>
|
<li>Single external IP address</li>
|
||||||
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
<li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>Shorewall requires that you have the iproute/iproute2 package installed
|
<p>Shorewall requires that you have the iproute/iproute2 package installed
|
||||||
(on RedHat, the package is called <i>iproute</i>)<i>. </i>You can tell
|
(on RedHat, the package is called <i>iproute</i>)<i>. </i>You can tell
|
||||||
if this package is installed by the presence of an <b>ip</b> program on
|
if this package is installed by the presence of an <b>ip</b> program
|
||||||
your firewall system. As root, you can use the 'which' command to check
|
on your firewall system. As root, you can use the 'which' command to
|
||||||
for this program:</p>
|
check for this program:</p>
|
||||||
|
|
||||||
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
||||||
|
|
||||||
<p>I recommend that you read through the guide first to familiarize yourself
|
<p>I recommend that you read through the guide first to familiarize yourself
|
||||||
with what's involved then go back through it again making your configuration
|
with what's involved then go back through it again making your configuration
|
||||||
changes. Points at which configuration changes are recommended are flagged
|
changes. Points at which configuration changes are recommended are
|
||||||
with <img border="0" src="images/BD21298_.gif" width="13" height="13">
|
flagged with <img border="0" src="images/BD21298_.gif" width="13"
|
||||||
.</p>
|
height="13">
|
||||||
|
.</p>
|
||||||
|
|
||||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||||
If you edit your configuration files on a Windows system, you
|
If you edit your configuration files on a Windows system, you
|
||||||
must save them as Unix files if your editor supports that option or you
|
must save them as Unix files if your editor supports that option or you
|
||||||
must run them through dos2unix before trying to use them. Similarly, if
|
must run them through dos2unix before trying to use them. Similarly, if
|
||||||
you copy a configuration file from your Windows hard drive to a floppy disk,
|
you copy a configuration file from your Windows hard drive to a floppy
|
||||||
you must run dos2unix against the copy before using it with Shorewall.</p>
|
disk, you must run dos2unix against the copy before using it with Shorewall.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows
|
||||||
of dos2unix</a></li>
|
Version of dos2unix</a></li>
|
||||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
|
||||||
Version of dos2unix</a></li>
|
Version of dos2unix</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Concepts</h2>
|
<h2 align="left">Shorewall Concepts</h2>
|
||||||
|
|
||||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||||
alt="">
|
alt="">
|
||||||
The configuration files for Shorewall are contained in the directory
|
The configuration files for Shorewall are contained in the directory
|
||||||
/etc/shorewall -- for simple setups, you only need to deal with a few of
|
/etc/shorewall -- for simple setups, you only need to deal with a few
|
||||||
these as described in this guide. After you have <a
|
of these as described in this guide. After you have <a
|
||||||
href="Install.htm">installed Shorewall</a>, <b>download the <a
|
href="Install.htm">installed Shorewall</a>, <b>download the <a
|
||||||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
href="http://www1.shorewall.net/pub/shorewall/Samples/">one-interface sample</a>,
|
||||||
sample</a>, un-tar it (tar -zxvf one-interface.tgz) and and copy the files
|
un-tar it (tar -zxvf one-interface.tgz) and and copy the files to /etc/shorewall
|
||||||
to /etc/shorewall (they will replace files with the same names that were
|
(they will replace files with the same names that were placed in /etc/shorewall
|
||||||
placed in /etc/shorewall during Shorewall installation)</b>.</p>
|
during Shorewall installation)</b>.</p>
|
||||||
|
|
||||||
<p>As each file is introduced, I suggest that you look through the actual
|
<p>As each file is introduced, I suggest that you look through the actual
|
||||||
file on your system -- each file contains detailed configuration instructions
|
file on your system -- each file contains detailed configuration instructions
|
||||||
and default entries.</p>
|
and default entries.</p>
|
||||||
|
|
||||||
<p>Shorewall views the network where it is running as being composed of a
|
<p>Shorewall views the network where it is running as being composed of a
|
||||||
set of <i>zones.</i> In the one-interface sample configuration, only one
|
set of <i>zones.</i> In the one-interface sample configuration, only
|
||||||
zone is defined:</p>
|
one zone is defined:</p>
|
||||||
|
|
||||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||||
cellspacing="0" id="AutoNumber2">
|
cellspacing="0" id="AutoNumber2">
|
||||||
<tbody>
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><u><b>Name</b></u></td>
|
||||||
|
<td><u><b>Description</b></u></td>
|
||||||
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>Name</b></u></td>
|
<td><b>net</b></td>
|
||||||
<td><u><b>Description</b></u></td>
|
<td><b>The Internet</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
|
||||||
<td><b>net</b></td>
|
</tbody>
|
||||||
<td><b>The Internet</b></td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p>Shorewall zones are defined in <a href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
<p>Shorewall zones are defined in <a href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
||||||
|
|
||||||
<p>Shorewall also recognizes the firewall system as its own zone - by default,
|
<p>Shorewall also recognizes the firewall system as its own zone - by default,
|
||||||
the firewall itself is known as <b>fw</b>.</p>
|
the firewall itself is known as <b>fw</b>.</p>
|
||||||
|
|
||||||
<p>Rules about what traffic to allow and what traffic to deny are expressed
|
<p>Rules about what traffic to allow and what traffic to deny are expressed
|
||||||
in terms of zones.</p>
|
in terms of zones.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>You express your default policy for connections from one zone
|
<li>You express your default policy for connections from one zone
|
||||||
to another zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
to another zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||||
</a>file.</li>
|
</a>file.</li>
|
||||||
<li>You define exceptions to those default policies in the <a
|
<li>You define exceptions to those default policies in the <a
|
||||||
href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
|
href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>For each connection request entering the firewall, the request is first
|
<p>For each connection request entering the firewall, the request is first
|
||||||
checked against the /etc/shorewall/rules file. If no rule in that file
|
checked against the /etc/shorewall/rules file. If no rule in that file
|
||||||
matches the connection request then the first policy in /etc/shorewall/policy
|
matches the connection request then the first policy in /etc/shorewall/policy
|
||||||
that matches the request is applied. If that policy is REJECT or DROP
|
that matches the request is applied. If that policy is REJECT or DROP
|
||||||
the request is first checked against the rules in /etc/shorewall/common
|
the request is first checked against the rules in /etc/shorewall/common
|
||||||
(the samples provide that file for you).</p>
|
(the samples provide that file for you).</p>
|
||||||
|
|
||||||
<p>The /etc/shorewall/policy file included with the one-interface sample has
|
<p>The /etc/shorewall/policy file included with the one-interface sample
|
||||||
the following policies:</p>
|
has the following policies:</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber3">
|
id="AutoNumber3">
|
||||||
<tbody>
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><u><b>SOURCE ZONE</b></u></td>
|
||||||
|
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||||
|
<td><u><b>POLICY</b></u></td>
|
||||||
|
<td><u><b>LOG LEVEL</b></u></td>
|
||||||
|
<td><u><b>LIMIT:BURST</b></u></td>
|
||||||
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>SOURCE ZONE</b></u></td>
|
<td>fw</td>
|
||||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
<td>net</td>
|
||||||
<td><u><b>POLICY</b></u></td>
|
<td>ACCEPT</td>
|
||||||
<td><u><b>LOG LEVEL</b></u></td>
|
<td> </td>
|
||||||
<td><u><b>LIMIT:BURST</b></u></td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>fw</td>
|
<td>net</td>
|
||||||
<td>net</td>
|
<td>all<br>
|
||||||
<td>ACCEPT</td>
|
</td>
|
||||||
<td> </td>
|
<td>DROP</td>
|
||||||
<td> </td>
|
<td>info</td>
|
||||||
</tr>
|
<td> </td>
|
||||||
<tr>
|
</tr>
|
||||||
<td>net</td>
|
<tr>
|
||||||
<td>all<br>
|
<td>all</td>
|
||||||
</td>
|
<td>all</td>
|
||||||
<td>DROP</td>
|
<td>REJECT</td>
|
||||||
<td>info</td>
|
<td>info</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
|
||||||
<td>all</td>
|
</tbody>
|
||||||
<td>all</td>
|
|
||||||
<td>REJECT</td>
|
|
||||||
<td>info</td>
|
|
||||||
<td> </td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>The above policy will:</p>
|
<p>The above policy will:</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>allow all connection requests from the firewall to the internet</li>
|
<li>allow all connection requests from the firewall to the internet</li>
|
||||||
<li>drop (ignore) all connection requests from the internet to
|
<li>drop (ignore) all connection requests from the internet to
|
||||||
your firewall</li>
|
your firewall</li>
|
||||||
<li>reject all other connection requests (Shorewall requires this
|
<li>reject all other connection requests (Shorewall requires this
|
||||||
catchall policy).</li>
|
catchall policy).</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p>At this point, edit your /etc/shorewall/policy and make any changes that
|
<p>At this point, edit your /etc/shorewall/policy and make any changes that
|
||||||
you wish.</p>
|
you wish.</p>
|
||||||
|
|
||||||
<h2 align="left">External Interface</h2>
|
<h2 align="left">External Interface</h2>
|
||||||
|
|
||||||
<p align="left">The firewall has a single network interface. Where Internet
|
<p align="left">The firewall has a single network interface. Where Internet
|
||||||
connectivity is through a cable or DSL "Modem", the <i>External Interface</i>
|
connectivity is through a cable or DSL "Modem", the <i>External Interface</i>
|
||||||
will be the ethernet adapter (<b>eth0</b>) that is connected to that "Modem"
|
will be the ethernet adapter (<b>eth0</b>) that is connected to that
|
||||||
<u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol
|
"Modem" <u>unless</u> you connect via <i><u>P</u>oint-to-<u>P</u>oint
|
||||||
over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling
|
<u>P</u>rotocol over <u>E</u>thernet</i> (PPPoE) or <i><u>P</u>oint-to-<u>P</u>oint
|
||||||
<u>P</u>rotocol </i>(PPTP) in which case the External Interface will be
|
<u>T</u>unneling <u>P</u>rotocol </i>(PPTP) in which case the External
|
||||||
a <b>ppp0</b>. If you connect via a regular modem, your External Interface
|
Interface will be a <b>ppp0</b>. If you connect via a regular modem, your
|
||||||
will also be <b>ppp0</b>. If you connect using ISDN, your external interface
|
External Interface will also be <b>ppp0</b>. If you connect using ISDN,
|
||||||
will be<b> ippp0.</b></p>
|
your external interface will be<b> ippp0.</b></p>
|
||||||
|
|
||||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||||
height="13">
|
height="13">
|
||||||
The Shorewall one-interface sample configuration assumes that the
|
The Shorewall one-interface sample configuration assumes that
|
||||||
external interface is <b>eth0</b>. If your configuration is different,
|
the external interface is <b>eth0</b>. If your configuration is different,
|
||||||
you will have to modify the sample /etc/shorewall/interfaces file accordingly.
|
you will have to modify the sample /etc/shorewall/interfaces file accordingly.
|
||||||
While you are there, you may wish to review the list of options that are
|
While you are there, you may wish to review the list of options that
|
||||||
specified for the interface. Some hints:</p>
|
are specified for the interface. Some hints:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>,
|
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>,
|
||||||
you can replace the "detect" in the second column with "-". </p>
|
you can replace the "detect" in the second column with "-". </p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>
|
<p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>
|
||||||
or if you have a static IP address, you can remove "dhcp" from the option
|
or if you have a static IP address, you can remove "dhcp" from the
|
||||||
list. </p>
|
option list. </p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<h2 align="left">IP Addresses</h2>
|
<h2 align="left">IP Addresses</h2>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">RFC 1918 reserves several <i>Private </i>IP address ranges
|
<p align="left">RFC 1918 reserves several <i>Private </i>IP address ranges
|
||||||
for use in private networks:</p>
|
for use in private networks:</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left">These addresses are sometimes referred to as <i>non-routable</i>
|
<p align="left">These addresses are sometimes referred to as <i>non-routable</i>
|
||||||
because the Internet backbone routers will not forward a packet whose
|
because the Internet backbone routers will not forward a packet whose
|
||||||
destination address is reserved by RFC 1918. In some cases though, ISPs
|
destination address is reserved by RFC 1918. In some cases though,
|
||||||
are assigning these addresses then using <i>Network Address Translation
|
ISPs are assigning these addresses then using <i>Network Address Translation
|
||||||
</i>to rewrite packet headers when forwarding to/from the internet.</p>
|
</i>to rewrite packet headers when forwarding to/from the internet.</p>
|
||||||
|
|
||||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||||
width="13" height="13">
|
width="13" height="13">
|
||||||
Before starting Shorewall, you should look at the IP address
|
Before starting Shorewall, you should look at the IP address
|
||||||
of your external interface and if it is one of the above ranges, you
|
of your external interface and if it is one of the above ranges, you
|
||||||
should remove the 'norfc1918' option from the entry in /etc/shorewall/interfaces.</p>
|
should remove the 'norfc1918' option from the entry in /etc/shorewall/interfaces.</p>
|
||||||
</div>
|
|
||||||
|
|
||||||
<div align="left">
|
|
||||||
<h2 align="left">Enabling other Connections</h2>
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">If you wish to enable connections from the internet to your
|
<h2 align="left">Enabling other Connections</h2>
|
||||||
firewall, the general format is:</p>
|
</div>
|
||||||
</div>
|
|
||||||
|
<div align="left">
|
||||||
<div align="left">
|
<p align="left">If you wish to enable connections from the internet to your
|
||||||
<blockquote>
|
firewall, the general format is:</p>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div align="left">
|
||||||
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber4">
|
id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
|
||||||
<td><u><b>ACTION</b></u></td>
|
|
||||||
<td><u><b>SOURCE</b></u></td>
|
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
|
||||||
<td><u><b>PORT</b></u></td>
|
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td>net</td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td>fw</td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td><i><protocol></i></td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td><i><port></i></td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
</tbody>
|
<td>ACCEPT</td>
|
||||||
|
<td>net</td>
|
||||||
|
<td>fw</td>
|
||||||
|
<td><i><protocol></i></td>
|
||||||
|
<td><i><port></i></td>
|
||||||
|
<td> </td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div align="left">
|
||||||
|
<p align="left">Example - You want to run a Web Server and a POP3 Server
|
||||||
|
on your firewall system:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Example - You want to run a Web Server and a POP3 Server on
|
<blockquote>
|
||||||
your firewall system:</p>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div align="left">
|
|
||||||
<blockquote>
|
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber5">
|
id="AutoNumber5">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
|
||||||
<td><u><b>ACTION</b></u></td>
|
|
||||||
<td><u><b>SOURCE</b></u></td>
|
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
|
||||||
<td><u><b>PORT</b></u></td>
|
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td>net</td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td>fw</td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td>tcp</td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td>80</td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>tcp</td>
|
<td>tcp</td>
|
||||||
<td>110</td>
|
<td>80</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
</tbody>
|
<td>ACCEPT</td>
|
||||||
|
<td>net</td>
|
||||||
|
<td>fw</td>
|
||||||
|
<td>tcp</td>
|
||||||
|
<td>110</td>
|
||||||
|
<td> </td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">If you don't know what port and protocol a particular application
|
<p align="left">If you don't know what port and protocol a particular application
|
||||||
uses, see <a href="ports.htm">here</a>.</p>
|
uses, see <a href="ports.htm">here</a>.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><b>Important: </b>I don't recommend enabling telnet to/from
|
<p align="left"><b>Important: </b>I don't recommend enabling telnet to/from
|
||||||
the internet because it uses clear text (even for login!). If you want
|
the internet because it uses clear text (even for login!). If you
|
||||||
shell access to your firewall from the internet, use SSH:</p>
|
want shell access to your firewall from the internet, use SSH:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber4">
|
id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
|
||||||
<td><u><b>ACTION</b></u></td>
|
|
||||||
<td><u><b>SOURCE</b></u></td>
|
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
|
||||||
<td><u><b>PORT</b></u></td>
|
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td>net</td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td>fw</td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td>tcp</td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td>22</td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td> </td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
</tbody>
|
<td>ACCEPT</td>
|
||||||
|
<td>net</td>
|
||||||
|
<td>fw</td>
|
||||||
|
<td>tcp</td>
|
||||||
|
<td>22</td>
|
||||||
|
<td> </td>
|
||||||
|
<td> </td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||||
height="13">
|
height="13">
|
||||||
At this point, edit /etc/shorewall/rules to add other connections
|
At this point, edit /etc/shorewall/rules to add other connections
|
||||||
as desired.</p>
|
as desired.</p>
|
||||||
</div>
|
|
||||||
|
|
||||||
<div align="left">
|
|
||||||
<h2 align="left">Starting and Stopping Your Firewall</h2>
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
|
<h2 align="left">Starting and Stopping Your Firewall</h2>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div align="left">
|
||||||
<p align="left"> <img border="0" src="images/BD21298_2.gif"
|
<p align="left"> <img border="0" src="images/BD21298_2.gif"
|
||||||
width="13" height="13" alt="Arrow">
|
width="13" height="13" alt="Arrow">
|
||||||
The <a href="Install.htm">installation procedure </a> configures
|
The <a href="Install.htm">installation procedure </a> configures
|
||||||
your system to start Shorewall at system boot but beginning with Shorewall
|
your system to start Shorewall at system boot but beginning with Shorewall
|
||||||
version 1.3.9 startup is disabled so that your system won't try to start
|
version 1.3.9 startup is disabled so that your system won't try to start
|
||||||
Shorewall before configuration is complete. Once you have completed configuration
|
Shorewall before configuration is complete. Once you have completed configuration
|
||||||
of your firewall, you can enable Shorewall startup by removing the file
|
of your firewall, you can enable Shorewall startup by removing the file
|
||||||
/etc/shorewall/startup_disabled.<br>
|
/etc/shorewall/startup_disabled.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Users of the .deb
|
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Users of the .deb
|
||||||
package must edit /etc/default/shorewall and set 'startup=1'.</font><br>
|
package must edit /etc/default/shorewall and set 'startup=1'.</font><br>
|
||||||
</p>
|
</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">The firewall is started using the "shorewall start" command
|
<p align="left">The firewall is started using the "shorewall start" command
|
||||||
and stopped using "shorewall stop". When the firewall is stopped, routing
|
and stopped using "shorewall stop". When the firewall is stopped,
|
||||||
is enabled on those hosts that have an entry in <a
|
routing is enabled on those hosts that have an entry in <a
|
||||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. A
|
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. A
|
||||||
running firewall may be restarted using the "shorewall restart" command.
|
running firewall may be restarted using the "shorewall restart" command.
|
||||||
If you want to totally remove any trace of Shorewall from your Netfilter
|
If you want to totally remove any trace of Shorewall from your Netfilter
|
||||||
configuration, use "shorewall clear".</p>
|
configuration, use "shorewall clear".</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><b>WARNING: </b>If you are connected to your firewall from
|
<p align="left"><b>WARNING: </b>If you are connected to your firewall from
|
||||||
the internet, do not issue a "shorewall stop" command unless you have
|
the internet, do not issue a "shorewall stop" command unless you have
|
||||||
added an entry for the IP address that you are connected from to <a
|
added an entry for the IP address that you are connected from to
|
||||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
<a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||||
Also, I don't recommend using "shorewall restart"; it is better to create
|
Also, I don't recommend using "shorewall restart"; it is better to create
|
||||||
an <i><a href="configuration_file_basics.htm#Configs">alternate configuration</a></i>
|
an <i><a href="configuration_file_basics.htm#Configs">alternate configuration</a></i>
|
||||||
and test it using the <a
|
and test it using the <a
|
||||||
href="starting_and_stopping_shorewall.htm">"shorewall try" command</a>.</p>
|
href="starting_and_stopping_shorewall.htm">"shorewall try" command</a>.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last updated 2/21/2003 - <a
|
<p align="left"><font size="2">Last updated 2/21/2003 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002, 2003
|
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002, 2003
|
||||||
Thomas M. Eastep</font></a></p>
|
Thomas M. Eastep</font></a></p>
|
||||||
<br>
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
@ -1,469 +1,469 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Standalone Firewall</title>
|
<title>Standalone Firewall</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber6" bgcolor="#400169" height="90">
|
id="AutoNumber6" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
<h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h2 align="center">Version 2.0.1 Française</h2>
|
<h2 align="center">Version 2.0.1 Française</h2>
|
||||||
|
|
||||||
<p align="left"><small><i><u>Notes du traducteur</u> :<br>
|
<p align="left"><small><i><u>Notes du traducteur</u> :<br>
|
||||||
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail n'est
|
Je ne prétends pas être un vrai traducteur dans le sens ou mon travail
|
||||||
pas des plus précis (loin de là...). Je ne me suis pas attaché à une traduction
|
n'est pas des plus précis (loin de là...). Je ne me suis pas attaché à une
|
||||||
exacte du texte, mais plutôt à en faire une version française intelligible
|
traduction exacte du texte, mais plutôt à en faire une version française
|
||||||
par tous (et par moi). Les termes techniques sont la plupart du temps conservés
|
intelligible par tous (et par moi). Les termes techniques sont la plupart
|
||||||
sous leur forme originale et mis entre parenthèses car vous pouvez les retrouver
|
du temps conservés sous leur forme originale et mis entre parenthèses car
|
||||||
dans le reste des documentations ainsi que dans les fichiers de configuration.
|
vous pouvez les retrouver dans le reste des documentations ainsi que dans
|
||||||
N?hésitez pas à me contacter afin d?améliorer ce document <a
|
les fichiers de configuration. N?hésitez pas à me contacter afin d?améliorer
|
||||||
href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM pour
|
ce document <a href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a>
|
||||||
sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP pour son
|
(merci à JMM pour sa relecture et ses commentaires pertinents, ainsi qu'à
|
||||||
formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
Tom EASTEP pour son formidable outil et sa disponibilité)</i><i>.</i></small></p>
|
||||||
|
|
||||||
<p align="left">Mettre en place un système Linux en tant que firewall (écluse)
|
<p align="left">Mettre en place un système Linux en tant que firewall (écluse)
|
||||||
pour un petit réseau est une chose assez simple, si vous comprenez les bases
|
pour un petit réseau est une chose assez simple, si vous comprenez les bases
|
||||||
et suivez la documentation.</p>
|
et suivez la documentation.</p>
|
||||||
|
|
||||||
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il
|
<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il se
|
||||||
se focalise sur ce qui est nécessaire pour configurer Shorewall, dans son
|
focalise sur ce qui est nécessaire pour configurer Shorewall, dans son utilisation
|
||||||
utilisation la plus courante :</p>
|
la plus courante :</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Un système Linux</li>
|
<li>Un système Linux</li>
|
||||||
<li>Une seule adresse IP externe</li>
|
<li>Une seule adresse IP externe</li>
|
||||||
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay,
|
<li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay,
|
||||||
rtc...</li>
|
rtc...</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé.
|
<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé. Vous
|
||||||
Vous pouvez voir si le paquet est installé en vérifiant la présence du programme
|
pouvez voir si le paquet est installé en vérifiant la présence du programme
|
||||||
ip sur votre système de firewall. Sous root, utilisez la commande 'which'
|
ip sur votre système de firewall. Sous root, utilisez la commande 'which'
|
||||||
pour rechercher le programme :</p>
|
pour rechercher le programme :</p>
|
||||||
|
|
||||||
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
<pre> [root@gateway root]# which ip<br> /sbin/ip<br> [root@gateway root]#</pre>
|
||||||
|
|
||||||
<p>Je vous recommande dans un premier temps de parcourir tout le guide pour
|
<p>Je vous recommande dans un premier temps de parcourir tout le guide pour
|
||||||
vous familiariser avec ce qu'il va se passer, et de revenir au début en effectuant
|
vous familiariser avec ce qu'il va se passer, et de revenir au début en effectuant
|
||||||
le changements dans votre configuration. Les points, où les changements dans
|
le changements dans votre configuration. Les points, où les changements dans
|
||||||
la configuration sont recommandées, sont signalés par une <img
|
la configuration sont recommandées, sont signalés par une <img
|
||||||
border="0" src="images/BD21298_.gif" width="13" height="13">
|
border="0" src="images/BD21298_.gif" width="13" height="13">
|
||||||
.</p>
|
.</p>
|
||||||
|
|
||||||
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
<p><img border="0" src="images/j0213519.gif" width="60" height="60">
|
||||||
Si vous éditez vos fichiers de configuration sur un système Windows, vous
|
Si vous éditez vos fichiers de configuration sur un système Windows, vous
|
||||||
devez les sauver comme des fichiers Unix si votre éditeur supporte cette option
|
devez les sauver comme des fichiers Unix si votre éditeur supporte cette
|
||||||
sinon vous devez les faire passer par dos2unix avant d'essayer de les utiliser.
|
option sinon vous devez les faire passer par dos2unix avant d'essayer de
|
||||||
De la même manière, si vous copiez un fichier de configuration depuis votre
|
les utiliser. De la même manière, si vous copiez un fichier de configuration
|
||||||
disque dur Windows vers une disquette, vous devez lancer dos2unix sur la
|
depuis votre disque dur Windows vers une disquette, vous devez lancer dos2unix
|
||||||
copie avant de l'utiliser avec Shorewall.</p>
|
sur la copie avant de l'utiliser avec Shorewall.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
<li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
|
||||||
|
of dos2unix</a></li>
|
||||||
|
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version
|
||||||
of dos2unix</a></li>
|
of dos2unix</a></li>
|
||||||
<li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version
|
|
||||||
of dos2unix</a></li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2 align="left">Les Concepts de Shorewall</h2>
|
<h2 align="left">Les Concepts de Shorewall</h2>
|
||||||
|
|
||||||
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
<p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
|
||||||
alt="">
|
alt="">
|
||||||
Les fichiers de configuration pour Shorewall sont situés dans le répertoire
|
Les fichiers de configuration pour Shorewall sont situés dans le répertoire
|
||||||
/etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec
|
/etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec
|
||||||
quelques un d'entre eux comme décris dans ce guide. Après avoir <a
|
quelques un d'entre eux comme décris dans ce guide. Après avoir <a
|
||||||
href="Install.htm">installé Shorewall</a>, <b>téléchargez le <a
|
href="Install.htm">installé Shorewall</a>, <b>téléchargez le <a
|
||||||
href="http://france.shorewall.net/pub/shorewall/LATEST.samples/one-interface.tgz">one-interface
|
href="http://www1.shorewall.net/pub/shorewall/Samples/">one-interface sample</a>,
|
||||||
sample</a>, un-tarez le (tar -zxvf one-interface.tgz) et copiez les fichiers
|
un-tarez le (tar -zxvf one-interface.tgz) et copiez les fichiers vers /etc/shorewall
|
||||||
vers /etc/shorewall (Ils remplaceront les fichiers de même nom déjà existant
|
(Ils remplaceront les fichiers de même nom déjà existant dans /etc/shorewall
|
||||||
dans /etc/shorewall installés lors de l'installation de Shorewall)</b>.</p>
|
installés lors de l'installation de Shorewall)</b>.</p>
|
||||||
|
|
||||||
<p>Parallèlement à la description, je vous suggère de jeter un oeil à ceux
|
<p>Parallèlement à la description, je vous suggère de jeter un oeil à ceux
|
||||||
physiquement présents sur votre système -- chacun des fichiers contient des
|
physiquement présents sur votre système -- chacun des fichiers contient des
|
||||||
instructions de configuration détaillées et des entrées par défaut.</p>
|
instructions de configuration détaillées et des entrées par défaut.</p>
|
||||||
|
|
||||||
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble de
|
<p>Shorewall voit le réseau où il tourne comme composé par un ensemble de
|
||||||
<i>zones.</i> Dans les fichiers de configuration fournis pour une unique
|
<i>zones.</i> Dans les fichiers de configuration fournis pour une unique interface,
|
||||||
interface, une seule zone est définie :</p>
|
une seule zone est définie :</p>
|
||||||
|
|
||||||
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
<table border="0" style="border-collapse: collapse;" cellpadding="3"
|
||||||
cellspacing="0" id="AutoNumber2">
|
cellspacing="0" id="AutoNumber2">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>Name</b></u></td>
|
<td><u><b>Name</b></u></td>
|
||||||
<td><u><b>Description</b></u></td>
|
<td><u><b>Description</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>net</b></td>
|
<td><b>net</b></td>
|
||||||
<td><b>The Internet</b></td>
|
<td><b>The Internet</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p>Les zones de Shorewall sont définies dans <a
|
<p>Les zones de Shorewall sont définies dans <a
|
||||||
href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
|
||||||
|
|
||||||
<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone
|
<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone -
|
||||||
- par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
par défaut, le firewall lui-même est connu en tant que <b>fw</b>.</p>
|
||||||
|
|
||||||
<p>Les règles concernant le trafic à autoriser ou à interdire sont exprimées
|
<p>Les règles concernant le trafic à autoriser ou à interdire sont exprimées
|
||||||
en utilisant les termes de zones.</p>
|
en utilisant les termes de zones.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Vous exprimez les politiques par défaut pour les connexions d'une zone
|
<li>Vous exprimez les politiques par défaut pour les connexions d'une
|
||||||
à une autre dans le fichier<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
zone à une autre dans le fichier<a href="Documentation.htm#Policy"> /etc/shorewall/policy
|
||||||
</a>.</li>
|
</a>.</li>
|
||||||
<li>Vous définissez les exceptions à ces règles de politiques par défaut
|
<li>Vous définissez les exceptions à ces règles de politiques par défaut
|
||||||
dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>Pour chacune des demandes de connexion entrantes dans le firewall, les
|
<p>Pour chacune des demandes de connexion entrantes dans le firewall, les
|
||||||
demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules.
|
demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules.
|
||||||
Si aucune des règles dans ce fichier ne correspondent, alors la première
|
Si aucune des règles dans ce fichier ne correspondent, alors la première politique
|
||||||
politique dans /etc/shorewall/policy qui y correspond est appliquée. Si cette
|
dans /etc/shorewall/policy qui y correspond est appliquée. Si cette politique
|
||||||
politique est REJECT ou DROP la requête est alors comparée par rapport aux
|
est REJECT ou DROP la requête est alors comparée par rapport aux règles contenues
|
||||||
règles contenues dans /etc/shorewall/common (l'archive d'exemple vous fournit
|
dans /etc/shorewall/common (l'archive d'exemple vous fournit ce fichier).</p>
|
||||||
ce fichier).</p>
|
|
||||||
|
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive one-interface
|
||||||
<p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive one-interface
|
|
||||||
a les politiques suivantes :</p>
|
a les politiques suivantes :</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber3">
|
id="AutoNumber3">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>SOURCE ZONE</b></u></td>
|
<td><u><b>SOURCE ZONE</b></u></td>
|
||||||
<td><u><b>DESTINATION ZONE</b></u></td>
|
<td><u><b>DESTINATION ZONE</b></u></td>
|
||||||
<td><u><b>POLICY</b></u></td>
|
<td><u><b>POLICY</b></u></td>
|
||||||
<td><u><b>LOG LEVEL</b></u></td>
|
<td><u><b>LOG LEVEL</b></u></td>
|
||||||
<td><u><b>LIMIT:BURST</b></u></td>
|
<td><u><b>LIMIT:BURST</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>all<br>
|
<td>all<br>
|
||||||
</td>
|
</td>
|
||||||
<td>DROP</td>
|
<td>DROP</td>
|
||||||
<td>info</td>
|
<td>info</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>all</td>
|
<td>all</td>
|
||||||
<td>all</td>
|
<td>all</td>
|
||||||
<td>REJECT</td>
|
<td>REJECT</td>
|
||||||
<td>info</td>
|
<td>info</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<pre> </pre>
|
<pre> </pre>
|
||||||
Ces politiques vont :
|
Ces politiques vont :
|
||||||
<ol>
|
<ol>
|
||||||
<li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
|
<li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
|
||||||
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet vers
|
<li>drop (ignorer) toutes les demandes de connexion depuis l'Internet
|
||||||
votre firewall</li>
|
vers votre firewall</li>
|
||||||
<li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin
|
<li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin
|
||||||
de cette politique).</li>
|
de cette politique).</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les changements
|
<p>A ce point, éditez votre /etc/shorewall/policy et faites y les changements
|
||||||
que vous désirez.</p>
|
que vous désirez.</p>
|
||||||
|
|
||||||
<h2 align="left">Interface Externe</h2>
|
<h2 align="left">Interface Externe</h2>
|
||||||
|
|
||||||
<p align="left">Le firewall possède une seule interface réseau. Lorsque la
|
<p align="left">Le firewall possède une seule interface réseau. Lorsque la
|
||||||
connexion Internet passe par un modem câble ou par un routeur ADSL (pas un
|
connexion Internet passe par un modem câble ou par un routeur ADSL (pas un
|
||||||
simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur
|
simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur
|
||||||
ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez
|
ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez
|
||||||
par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i>
|
par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i>
|
||||||
(PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
(PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
|
||||||
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous connectez
|
dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous connectez
|
||||||
par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
|
||||||
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface externe
|
Si vous vous connectez en utilisant l'ISDN (numéris), votre interface externe
|
||||||
sera<b> ippp0.</b></p>
|
sera<b> ippp0.</b></p>
|
||||||
|
|
||||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||||
height="13">
|
height="13">
|
||||||
L'exemple de configuration de Shorewall pour une interface suppose que votre
|
L'exemple de configuration de Shorewall pour une interface suppose que
|
||||||
interface externe est <b>eth0</b>. Si votre configuration est différente,
|
votre interface externe est <b>eth0</b>. Si votre configuration est différente,
|
||||||
vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence.
|
vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence.
|
||||||
Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont
|
Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont
|
||||||
spécifiées pour l'interface. Quelques astuces :</p>
|
spécifiées pour l'interface. Quelques astuces :</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>,
|
<p align="left">Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>,
|
||||||
vous pouvez remplacer le "detect" dans la seconde colonne par un "-".
|
vous pouvez remplacer le "detect" dans la seconde colonne par un "-".
|
||||||
</p>
|
</p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left"> Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>
|
<p align="left"> Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>
|
||||||
ou bien si vous avez une adresse IP statique, vous pouvez enlever le "dhcp"
|
ou bien si vous avez une adresse IP statique, vous pouvez enlever le "dhcp"
|
||||||
de la liste d'option. </p>
|
de la liste d'option. </p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<h2 align="left">Adresse IP</h2>
|
<h2 align="left">Adresse IP</h2>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée
|
<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée (<i>Private</i>IP)
|
||||||
(<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
|
pour l'utilisation dans des réseaux privés :</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
<pre> 10.0.0.0 - 10.255.255.255<br> 172.16.0.0 - 172.31.255.255<br> 192.168.0.0 - 192.168.255.255</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left">Ces adresses sont parfois désignées comme étant <i>non-routables</i>
|
<p align="left">Ces adresses sont parfois désignées comme étant <i>non-routables</i>
|
||||||
car les routeurs sur les backbones Internet ne font pas passer les paquets
|
car les routeurs sur les backbones Internet ne font pas passer les paquets
|
||||||
dont les adresses de destinations sont définies dans la RFC 1918. Dans certains
|
dont les adresses de destinations sont définies dans la RFC 1918. Dans certains
|
||||||
cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent
|
cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent
|
||||||
le <i>Network Address Translation </i>afin de récrire les entêtes des paquets
|
le <i>Network Address Translation </i>afin de récrire les entêtes des paquets
|
||||||
lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
|
lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
|
||||||
|
|
||||||
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
<p align="left"><img border="0" src="images/BD21298_.gif" align="left"
|
||||||
width="13" height="13">
|
width="13" height="13">
|
||||||
Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface
|
Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface
|
||||||
externe et si elle est comprise dans une des plages précédentes, vous devriez
|
externe et si elle est comprise dans une des plages précédentes, vous devriez
|
||||||
enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<h2 align="left">Permettre d'autres connexions</h2>
|
<h2 align="left">Permettre d'autres connexions</h2>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Si vous désirez autoriser d'autres connexions depuis l'Internet
|
<p align="left">Si vous désirez autoriser d'autres connexions depuis l'Internet
|
||||||
vers votre firewall, le format général est :</p>
|
vers votre firewall, le format général est :</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber4">
|
id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>ACTION</b></u></td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td><u><b>SOURCE</b></u></td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td><u><b>PORT</b></u></td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td><i><protocol></i></td>
|
<td><i><protocol></i></td>
|
||||||
<td><i><port></i></td>
|
<td><i><port></i></td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un
|
<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un serveur
|
||||||
serveur POP3 sur votre système de firewall :</p>
|
POP3 sur votre système de firewall :</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber5">
|
id="AutoNumber5">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>ACTION</b></u></td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td><u><b>SOURCE</b></u></td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td><u><b>PORT</b></u></td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>tcp</td>
|
<td>tcp</td>
|
||||||
<td>80</td>
|
<td>80</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>tcp</td>
|
<td>tcp</td>
|
||||||
<td>110</td>
|
<td>110</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Si vous ne savez pas quel port ou protocole une application
|
<p align="left">Si vous ne savez pas quel port ou protocole une application
|
||||||
particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><b>Important: </b>Je ne vous recommande pas d'autoriser le
|
<p align="left"><b>Important: </b>Je ne vous recommande pas d'autoriser le
|
||||||
telnet depuis ou vers l'Internet car il utilise du texte en clair (même pour
|
telnet depuis ou vers l'Internet car il utilise du texte en clair (même pour
|
||||||
le login et le mot de passe !). Si vous voulez avoir un accès au shell de
|
le login et le mot de passe !). Si vous voulez avoir un accès au shell de
|
||||||
votre firewall depuis Internet, utilisez SSH :</p>
|
votre firewall depuis Internet, utilisez SSH :</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
<table border="1" cellpadding="2" style="border-collapse: collapse;"
|
||||||
id="AutoNumber4">
|
id="AutoNumber4">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><u><b>ACTION</b></u></td>
|
<td><u><b>ACTION</b></u></td>
|
||||||
<td><u><b>SOURCE</b></u></td>
|
<td><u><b>SOURCE</b></u></td>
|
||||||
<td><u><b>DESTINATION</b></u></td>
|
<td><u><b>DESTINATION</b></u></td>
|
||||||
<td><u><b>PROTOCOL</b></u></td>
|
<td><u><b>PROTOCOL</b></u></td>
|
||||||
<td><u><b>PORT</b></u></td>
|
<td><u><b>PORT</b></u></td>
|
||||||
<td><u><b>SOURCE PORT</b></u></td>
|
<td><u><b>SOURCE PORT</b></u></td>
|
||||||
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
<td><u><b>ORIGINAL ADDRESS</b></u></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>ACCEPT</td>
|
<td>ACCEPT</td>
|
||||||
<td>net</td>
|
<td>net</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>tcp</td>
|
<td>tcp</td>
|
||||||
<td>22</td>
|
<td>22</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
<td> <br>
|
<td> <br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> ACCEPT net fw tcp 22</pre>
|
<pre> ACCEPT net fw tcp 22</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
<p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
|
||||||
height="13">
|
height="13">
|
||||||
A ce point, éditez /etc/shorewall/rules pour rajouter les autres connexions
|
A ce point, éditez /etc/shorewall/rules pour rajouter les autres connexions
|
||||||
désirées.</p>
|
désirées.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<h2 align="left">Lancer et Arrêter son Firewall</h2>
|
<h2 align="left">Lancer et Arrêter son Firewall</h2>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"> <img border="0" src="images/BD21298_2.gif" width="13"
|
<p align="left"> <img border="0" src="images/BD21298_2.gif" width="13"
|
||||||
height="13" alt="Arrow">
|
height="13" alt="Arrow">
|
||||||
La <a href="Install.htm">procédure d'installation </a> configure votre système
|
La <a href="Install.htm">procédure d'installation </a> configure votre
|
||||||
pour lancer Shorewall au boot du système, mais au début avec la version 1.3.9
|
système pour lancer Shorewall au boot du système, mais au début avec la version
|
||||||
de Shorewall le lancement est désactivé, n'essayer pas de lancer Shorewall
|
1.3.9 de Shorewall le lancement est désactivé, n'essayer pas de lancer Shorewall
|
||||||
avec que la configuration soit finie. Une fois que vous en aurez fini avec
|
avec que la configuration soit finie. Une fois que vous en aurez fini avec
|
||||||
la configuration du firewall, vous pouvez permettre le lancement de Shorewall
|
la configuration du firewall, vous pouvez permettre le lancement de Shorewall
|
||||||
en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
en supprimant le fichier /etc/shorewall/startup_disabled.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs
|
<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs des
|
||||||
des paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
|
paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
|
||||||
</p>
|
</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Le firewall est activé en utilisant la commande "shorewall
|
<p align="left">Le firewall est activé en utilisant la commande "shorewall
|
||||||
start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé, le
|
start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé, le
|
||||||
routage est autorisé sur les hôtes qui possèdent une entrée dans <a
|
routage est autorisé sur les hôtes qui possèdent une entrée dans <a
|
||||||
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. Un
|
href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. Un
|
||||||
firewall qui tourne peut être relancé en utilisant la commande "shorewall
|
firewall qui tourne peut être relancé en utilisant la commande "shorewall
|
||||||
restart". Si vous voulez enlever toutes traces de Shorewall sur votre configuration
|
restart". Si vous voulez enlever toutes traces de Shorewall sur votre configuration
|
||||||
de Netfilter, utilisez "shorewall clear".</p>
|
de Netfilter, utilisez "shorewall clear".</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall
|
<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall depuis
|
||||||
depuis Internet, n'essayez pas une commande "shorewall stop" tant que vous
|
Internet, n'essayez pas une commande "shorewall stop" tant que vous n'avez
|
||||||
n'avez pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle
|
pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle vous
|
||||||
vous êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
|
||||||
De la même manière, je ne vous recommande pas d'utiliser "shorewall restart";
|
De la même manière, je ne vous recommande pas d'utiliser "shorewall restart";
|
||||||
il est plus intéressant de créer une <i><a
|
il est plus intéressant de créer une <i><a
|
||||||
href="configuration_file_basics.htm#Configs">configuration alternative</a></i>
|
href="configuration_file_basics.htm#Configs">configuration alternative</a></i>
|
||||||
et de la tester en utilisant la commande <a
|
et de la tester en utilisant la commande <a
|
||||||
href="starting_and_stopping_shorewall.htm">"shorewall try"</a>.</p>
|
href="starting_and_stopping_shorewall.htm">"shorewall try"</a>.</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last updated 12/9/2002 - <a
|
<p align="left"><font size="2">Last updated 12/9/2002 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002 Thomas
|
<p align="left"><a href="copyright.htm"><font size="2">Copyright 2002 Thomas
|
||||||
M. Eastep</font></a></p>
|
M. Eastep</font></a></p>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,75 +1,79 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall Support Guide</title>
|
<title>Shorewall Support Guide</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td
|
<td
|
||||||
width="100%">
|
width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||||
</font></h1>
|
</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h2>Before Reporting a Problem or Asking a Question<br>
|
<h2>Before Reporting a Problem or Asking a Question<br>
|
||||||
</h2>
|
</h2>
|
||||||
There are a number
|
There are
|
||||||
of sources of Shorewall information. Please try these before you
|
a number of sources of Shorewall information. Please try these before
|
||||||
post.
|
you post.
|
||||||
<ul>
|
<ul>
|
||||||
<li>More than half of the questions
|
<li>Shorewall versions earlier
|
||||||
posted on the support list have answers directly accessible from
|
that 1.3.0 are no longer supported.<br>
|
||||||
the <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
|
||||||
Index</a><br>
|
|
||||||
</li>
|
|
||||||
<li> The
|
|
||||||
<a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
|
||||||
problems. </li>
|
|
||||||
<li> The <a
|
|
||||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
|
||||||
a number of tips to help you solve common problems.
|
|
||||||
</li>
|
</li>
|
||||||
<li> The <a
|
<li>More than half of the questions posted on the support
|
||||||
href="errata.htm"> Errata</a> has links to download updated
|
list have answers directly accessible from the <a
|
||||||
components. </li>
|
href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||||
<li> The Site and
|
Index</a><br>
|
||||||
Mailing List Archives search facility can locate documents and
|
</li>
|
||||||
posts about similar problems: </li>
|
<li>
|
||||||
|
The <a href="http://www.shorewall.net/FAQ.htm">FAQ</a> has solutions
|
||||||
|
to more than 20 common problems. </li>
|
||||||
|
<li> The
|
||||||
|
<a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||||
|
Information contains a number of tips to help
|
||||||
|
you solve common problems. </li>
|
||||||
|
<li> The
|
||||||
|
<a href="http://www.shorewall.net/errata.htm"> Errata</a> has links
|
||||||
|
to download updated components. </li>
|
||||||
|
<li> The Site
|
||||||
|
and Mailing List Archives search facility can locate documents
|
||||||
|
and posts about similar problems: </li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2>Site and Mailing List Archive Search</h2>
|
<h2>Site and Mailing List Archive Search</h2>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<form method="post"
|
<form method="post"
|
||||||
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
||||||
|
|
||||||
<select name="method">
|
<select name="method">
|
||||||
<option value="and">All </option>
|
<option value="and">All </option>
|
||||||
<option value="or">Any </option>
|
<option value="or">Any </option>
|
||||||
<option value="boolean">Boolean </option>
|
<option value="boolean">Boolean </option>
|
||||||
</select>
|
</select>
|
||||||
Format:
|
Format:
|
||||||
<select name="format">
|
<select name="format">
|
||||||
<option value="builtin-long">Long </option>
|
<option value="builtin-long">Long </option>
|
||||||
<option value="builtin-short">Short </option>
|
<option value="builtin-short">Short </option>
|
||||||
</select>
|
</select>
|
||||||
Sort by:
|
Sort by:
|
||||||
<select name="sort">
|
<select name="sort">
|
||||||
<option value="score">Score </option>
|
<option value="score">Score </option>
|
||||||
<option value="time">Time </option>
|
<option value="time">Time </option>
|
||||||
@ -78,231 +82,238 @@ posts about similar problems: </li>
|
|||||||
<option value="revtime">Reverse Time </option>
|
<option value="revtime">Reverse Time </option>
|
||||||
<option value="revtitle">Reverse Title </option>
|
<option value="revtitle">Reverse Title </option>
|
||||||
</select>
|
</select>
|
||||||
</font><input type="hidden" name="config" value="htdig"><input
|
</font><input type="hidden" name="config"
|
||||||
type="hidden" name="restrict" value=""><font size="-1"> Include Mailing
|
value="htdig"><input type="hidden" name="restrict" value=""><font
|
||||||
List Archives:
|
size="-1"> Include Mailing List Archives:
|
||||||
|
|
||||||
<select size="1" name="exclude">
|
<select size="1" name="exclude">
|
||||||
<option value="">Yes</option>
|
<option value="">Yes</option>
|
||||||
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
||||||
</select>
|
</select>
|
||||||
</font><br>
|
</font><br>
|
||||||
Search: <input type="text" size="30" name="words" value=""> <input
|
Search: <input type="text" size="30" name="words"
|
||||||
type="submit" value="Search"><br>
|
value=""> <input type="submit" value="Search"><br>
|
||||||
</form>
|
</form>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h2>Problem Reporting Guidelines<br>
|
<h2>Problem Reporting Guidelines<br>
|
||||||
</h2>
|
</h2>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Please remember we only know what is posted
|
<li>Please remember we only know what
|
||||||
in your message. Do not leave out any information that appears
|
is posted in your message. Do not leave out any information
|
||||||
to be correct, or was mentioned in a previous post. There have
|
that appears to be correct, or was mentioned in a previous
|
||||||
been countless posts by people who were sure that some part of
|
post. There have been countless posts by people who were sure
|
||||||
their configuration was correct when it actually contained a small
|
that some part of their configuration was correct when it actually
|
||||||
error. We tend to be skeptics where detail is lacking.<br>
|
contained a small error. We tend to be skeptics where detail
|
||||||
<br>
|
is lacking.<br>
|
||||||
</li>
|
<br>
|
||||||
<li>Please keep in mind that you're asking
|
</li>
|
||||||
for <strong>free</strong> technical support. Any help we
|
<li>Please keep in mind that you're
|
||||||
offer is an act of generosity, not an obligation. Try to make it
|
asking for <strong>free</strong> technical support.
|
||||||
easy for us to help you. Follow good, courteous practices in writing
|
Any help we offer is an act of generosity, not an obligation.
|
||||||
and formatting your e-mail. Provide details that we need if you expect
|
Try to make it easy for us to help you. Follow good, courteous
|
||||||
good answers. <em>Exact quoting </em> of error messages, log entries,
|
practices in writing and formatting your e-mail. Provide details that
|
||||||
command output, and other output is better than a paraphrase or summary.<br>
|
we need if you expect good answers. <em>Exact quoting </em> of
|
||||||
<br>
|
error messages, log entries, command output, and other output is better
|
||||||
</li>
|
than a paraphrase or summary.<br>
|
||||||
<li> Please
|
<br>
|
||||||
don't describe your environment and then ask us to send
|
</li>
|
||||||
you custom configuration files. We're here to answer
|
<li>
|
||||||
your questions but we can't do your job for you.<br>
|
Please don't describe your environment and then ask us
|
||||||
<br>
|
to send you custom configuration files. We're here
|
||||||
</li>
|
to answer your questions but we can't do your
|
||||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
job for you.<br>
|
||||||
include this information:</li>
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||||
|
include this information:</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>the exact version of Shorewall you are
|
<li>the exact version of Shorewall
|
||||||
running.<br>
|
you are running.<br>
|
||||||
<br>
|
<br>
|
||||||
<b><font color="#009900">shorewall version</font><br>
|
<b><font color="#009900">shorewall
|
||||||
</b> <br>
|
version</font><br>
|
||||||
</li>
|
</b> <br>
|
||||||
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>the exact kernel version you are running<br>
|
<li>the exact kernel version you are
|
||||||
<br>
|
running<br>
|
||||||
<font color="#009900"><b>uname -a<br>
|
<br>
|
||||||
<br>
|
<font color="#009900"><b>uname -a<br>
|
||||||
</b></font></li>
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>the complete, exact output of<br>
|
<li>the complete, exact output of<br>
|
||||||
<br>
|
<br>
|
||||||
<font color="#009900"><b>ip addr show<br>
|
<font color="#009900"><b>ip addr
|
||||||
<br>
|
show<br>
|
||||||
</b></font></li>
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>the complete, exact output of<br>
|
<li>the complete, exact output of<br>
|
||||||
<br>
|
<br>
|
||||||
<font color="#009900"><b>ip route show<br>
|
<font color="#009900"><b>ip route
|
||||||
<br>
|
show<br>
|
||||||
</b></font></li>
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>If your kernel is modularized, the exact
|
<li>If your kernel is modularized,
|
||||||
output from<br>
|
the exact output from<br>
|
||||||
<br>
|
<br>
|
||||||
<font color="#009900"><b>lsmod</b></font><br>
|
<font color="#009900"><b>lsmod</b></font><br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||||
problems of any kind then:</b></big></i></u></font><br>
|
problems of any kind then:</b></big></i></u></font><br>
|
||||||
<br>
|
<br>
|
||||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||||
<br>
|
<br>
|
||||||
2. Try the connection that is failing.<br>
|
2. Try the connection that is failing.<br>
|
||||||
<br>
|
<br>
|
||||||
3.<b><font color="#009900"> /sbin/shorewall status >
|
3.<b><font color="#009900"> /sbin/shorewall status
|
||||||
/tmp/status.txt</font></b><br>
|
> /tmp/status.txt</font></b><br>
|
||||||
<br>
|
<br>
|
||||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>the exact wording of any <code
|
<li>the exact wording of any <code
|
||||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>If you installed Shorewall using one of the QuickStart Guides,
|
<li>If you installed Shorewall using one of the QuickStart
|
||||||
please indicate which one. <br>
|
Guides, please indicate which one. <br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
<li><b>If you are running Shorewall under Mandrake using the
|
||||||
installation of Shorewall, please say so.<br>
|
Mandrake installation of Shorewall, please say so.<br>
|
||||||
<br>
|
<br>
|
||||||
</b></li>
|
</b></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
<li>As a
|
<li>As
|
||||||
general matter, please <strong>do not edit the diagnostic information</strong>
|
a general matter, please <strong>do not edit the diagnostic
|
||||||
in an attempt to conceal your IP address, netmask, nameserver
|
information</strong> in an attempt to conceal your IP address,
|
||||||
addresses, domain name, etc. These aren't secrets, and concealing
|
netmask, nameserver addresses, domain name, etc. These aren't
|
||||||
them often misleads us (and 80% of the time, a hacker could derive them
|
secrets, and concealing them often misleads us (and 80% of the time,
|
||||||
anyway from information contained in the SMTP headers of your post).<br>
|
a hacker could derive them anyway from information contained in
|
||||||
<br>
|
the SMTP headers of your post).<br>
|
||||||
<strong></strong></li>
|
<br>
|
||||||
<li>Do you see any "Shorewall" messages ("<b><font
|
<strong></strong></li>
|
||||||
|
<li>Do you see any "Shorewall" messages ("<b><font
|
||||||
color="#009900">/sbin/shorewall show log</font></b>") when
|
color="#009900">/sbin/shorewall show log</font></b>") when
|
||||||
you exercise the function that is giving you problems? If so, include
|
you exercise the function that is giving you problems? If so,
|
||||||
the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||||
file.<br>
|
file.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Please include any of the Shorewall configuration files
|
<li>Please include any of the Shorewall configuration
|
||||||
(especially the /etc/shorewall/hosts file if you have
|
files (especially the /etc/shorewall/hosts file if
|
||||||
modified that file) that you think are relevant. If
|
you have modified that file) that you think are relevant.
|
||||||
you include /etc/shorewall/rules, please include /etc/shorewall/policy
|
If you include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||||
as well (rules are meaningless unless one also knows the policies).<br>
|
as well (rules are meaningless unless one also knows the policies).<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>If an error occurs when you try to "<font
|
<li>If an error occurs when you try to "<font
|
||||||
color="#009900"><b>shorewall start</b></font>", include a trace
|
color="#009900"><b>shorewall start</b></font>", include a trace
|
||||||
(See the <a href="troubleshoot.htm">Troubleshooting</a> section for
|
(See the <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||||
instructions).<br>
|
section for instructions).<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li><b>The list server limits posts to 120kb so don't post
|
<li><b>The list server limits posts to 120kb so don't
|
||||||
GIFs of your network layout, etc. to the Mailing
|
post GIFs of your network layout, etc. to
|
||||||
List -- your post will be rejected.</b></li>
|
the Mailing List -- your post will be rejected.</b></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<blockquote> The author gratefully acknowleges that the above list was
|
<blockquote> The author gratefully acknowleges that the above list was
|
||||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||||
<em>Olszewski</em> found at <a
|
<em>Olszewski</em> found at <a
|
||||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h2>When using the mailing list, please post in plain text</h2>
|
<h2>When using the mailing list, please post in plain text</h2>
|
||||||
|
|
||||||
<blockquote> A growing number of MTAs serving list subscribers are
|
<blockquote> A growing number of MTAs serving list subscribers are
|
||||||
rejecting all HTML traffic. At least one MTA has gone so far as to
|
rejecting all HTML traffic. At least one MTA has gone so far as to
|
||||||
blacklist shorewall.net "for continuous abuse" because it has been
|
blacklist shorewall.net "for continuous abuse" because it has been
|
||||||
my policy to allow HTML in list posts!!<br>
|
my policy to allow HTML in list posts!!<br>
|
||||||
<br>
|
<br>
|
||||||
I think that blocking all HTML is a Draconian
|
I think that blocking all HTML is
|
||||||
way to control spam and that the ultimate losers here are not
|
a Draconian way to control spam and that the ultimate losers
|
||||||
the spammers but the list subscribers whose MTAs are bouncing
|
here are not the spammers but the list subscribers whose MTAs
|
||||||
all shorewall.net mail. As one list subscriber wrote to me privately
|
are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||||
"These e-mail admin's need to get a <i>(expletive deleted)</i> life
|
to me privately "These e-mail admin's need to get a <i>(expletive
|
||||||
instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
deleted)</i> life instead of trying to rid the planet of HTML based
|
||||||
to allow subscribers to receive list posts as must as possible, I
|
e-mail". Nevertheless, to allow subscribers to receive list posts
|
||||||
have now configured the list server at shorewall.net to strip all HTML
|
as must as possible, I have now configured the list server at shorewall.net
|
||||||
from outgoing posts.<br>
|
to strip all HTML from outgoing posts.<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote> <b>If you have a <u>quick</u> question about
|
||||||
|
capabilities or where to find something, you may use the</b> <a
|
||||||
|
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||||
|
Forum</a>. <u><b>DO NOT POST THE OUTPUT OF "shorewall status" TO THE FORUM;
|
||||||
|
I WON'T LOOK AT IT.</b></u> <b>If you need to supply "shorewall status"
|
||||||
|
output, use the appropriate mailing list below.</b><br>
|
||||||
|
|
||||||
<h4>If you run Shorewall under Bering -- <span
|
<h4>If you run Shorewall under Bering -- <span
|
||||||
style="font-weight: 400;">please post your question or problem
|
style="font-weight: 400;">please post your question or problem
|
||||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF
|
to the <a
|
||||||
Users mailing list</a>.</span></h4>
|
href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||||
<b>If you run Shorewall under MandrakeSoft
|
list</a>.</span></h4>
|
||||||
Multi Network Firewall (MNF) and you have not purchased an MNF
|
<b>If you run Shorewall under MandrakeSoft
|
||||||
license from MandrakeSoft then you can post non MNF-specific Shorewall
|
Multi Network Firewall (MNF) and you have not purchased an
|
||||||
questions to the </b><a
|
MNF license from MandrakeSoft then you can post non MNF-specific
|
||||||
|
Shorewall questions to the </b><a
|
||||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||||
list</a> or the <a
|
list</a>. <b>Do not expect to get free MNF support on the list.</b><br>
|
||||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
|
||||||
Forum</a>. <b>Do not expect to get free MNF support on the list or forum.</b><br>
|
|
||||||
|
|
||||||
<p>Otherwise, please post your question or problem to the <a
|
<p>Otherwise, please post your question or problem to the <a
|
||||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||||
list</a> or to the <a
|
list</a> .</p>
|
||||||
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
|
||||||
Forum</a>.<br>
|
<p> To Subscribe to the mailing list go to <a
|
||||||
To Subscribe to the mailing list go to <a
|
|
||||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||||
.<br>
|
.<br>
|
||||||
</p>
|
</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>For information on other Shorewall mailing lists, go to <a
|
<p>For information on other Shorewall mailing lists, go to <a
|
||||||
href="http://lists.shorewall.net/mailing_list.htm">http://lists.shorewall.net/mailing_list.htm</a><br>
|
href="http://lists.shorewall.net">http://lists.shorewall.net</a><br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 4/10/2003 - Tom Eastep</font></p>
|
<p align="left"><font size="2">Last Updated 5/12/2003 - Tom Eastep</font></p>
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
<br>
|
||||||
<br>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,233 +1,224 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall Troubleshooting</title>
|
<title>Shorewall Troubleshooting</title>
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Troubleshooting<img
|
<h1 align="center"><font color="#ffffff">Shorewall Troubleshooting<img
|
||||||
src="images/obrasinf.gif" alt="Beating head on table" width="90"
|
src="images/obrasinf.gif" alt="Beating head on table" width="90"
|
||||||
height="90" align="middle">
|
height="90" align="middle">
|
||||||
</font></h1>
|
</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h3 align="left">Check the Errata</h3>
|
<h3 align="left">Check the Errata</h3>
|
||||||
|
|
||||||
<p align="left">Check the <a href="errata.htm">Shorewall Errata</a> to be
|
<p align="left">Check the <a href="errata.htm">Shorewall Errata</a> to be
|
||||||
sure that there isn't an update that you are missing for your version
|
sure that there isn't an update that you are missing for your version
|
||||||
of the firewall.</p>
|
of the firewall.</p>
|
||||||
|
|
||||||
<h3 align="left">Check the FAQs</h3>
|
<h3 align="left">Check the FAQs</h3>
|
||||||
|
|
||||||
<p align="left">Check the <a href="FAQ.htm">FAQs</a> for solutions to common
|
<p align="left">Check the <a href="FAQ.htm">FAQs</a> for solutions to common
|
||||||
problems.</p>
|
problems.</p>
|
||||||
|
|
||||||
<h3 align="left">If the firewall fails to start</h3>
|
<h3 align="left">If the firewall fails to start</h3>
|
||||||
If you receive an error message when starting or restarting
|
If you receive an error message when starting or restarting
|
||||||
the firewall and you can't determine the cause, then do the following:
|
the firewall and you can't determine the cause, then do the following:
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Make a note of the error message that you see.<br>
|
<li>Make a note of the error message that you see.<br>
|
||||||
</li>
|
</li>
|
||||||
<li>shorewall debug start 2> /tmp/trace</li>
|
<li>shorewall debug start 2> /tmp/trace</li>
|
||||||
<li>Look at the /tmp/trace file and see if that helps you
|
<li>Look at the /tmp/trace file and see if that helps you
|
||||||
determine what the problem is. Be sure you find the place in the log
|
determine what the problem is. Be sure you find the place in the log
|
||||||
where the error message you saw is generated -- in 99.9% of the cases, it
|
where the error message you saw is generated -- If you are using Shorewall
|
||||||
will not be near the end of the log because after startup errors, Shorewall
|
1.4.0 or later, you should find the message near the end of the log.</li>
|
||||||
goes through a "shorewall stop" phase which will also be traced.</li>
|
<li>If you still can't determine what's wrong then see the
|
||||||
<li>If you still can't determine what's wrong then see the
|
|
||||||
<a href="support.htm">support page</a>.</li>
|
<a href="support.htm">support page</a>.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Here's an example. During startup, a user sees the following:<br>
|
Here's an example. During startup, a user sees the following:<br>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre>Adding Common Rules<br>iptables: No chain/target/match by that name<br>Terminated<br></pre>
|
<pre>Adding Common Rules<br>iptables: No chain/target/match by that name<br>Terminated<br></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
A search through the trace for "No chain/target/match by that name" turned
|
A search through the trace for "No chain/target/match by that name" turned
|
||||||
up the following:
|
up the following:
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre>+ echo 'Adding Common Rules'<br>+ add_common_rules<br>+ run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ echo -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ sed 's/!/! /g'<br>+ iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>iptables: No chain/target/match by that name<br></pre>
|
<pre>+ echo 'Adding Common Rules'<br>+ add_common_rules<br>+ run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ echo -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ sed 's/!/! /g'<br>+ iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>iptables: No chain/target/match by that name<br></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
The command that failed was: "iptables -A reject -p tcp -j REJECT --reject-with
|
The command that failed was: "iptables -A reject -p tcp -j REJECT --reject-with
|
||||||
tcp-reset". In this case, the user had compiled his own kernel and had forgotten
|
tcp-reset". In this case, the user had compiled his own kernel and had forgotten
|
||||||
to include REJECT target support (see <a href="kernel.htm">kernel.htm</a>)
|
to include REJECT target support (see <a href="kernel.htm">kernel.htm</a>)
|
||||||
|
|
||||||
<h3>Your network environment</h3>
|
<h3>Your network environment</h3>
|
||||||
|
|
||||||
<p>Many times when people have problems with Shorewall, the problem is
|
<p>Many times when people have problems with Shorewall, the problem is actually
|
||||||
actually an ill-conceived network setup. Here are several popular snafus:
|
an ill-conceived network setup. Here are several popular snafus: </p>
|
||||||
</p>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Port Forwarding where client and server are in
|
<li>Port Forwarding where client and server are
|
||||||
the same subnet. See <a href="FAQ.htm">FAQ 2.</a></li>
|
in the same subnet. See <a href="FAQ.htm">FAQ 2.</a></li>
|
||||||
<li>Changing the IP address of a local system to be in the
|
<li>Changing the IP address of a local system to be in the
|
||||||
external subnet, thinking that Shorewall will suddenly believe that
|
external subnet, thinking that Shorewall will suddenly believe that
|
||||||
the system is in the 'net' zone.</li>
|
the system is in the 'net' zone.</li>
|
||||||
<li>Multiple interfaces connected to the same HUB or Switch.
|
<li>Multiple interfaces connected to the same HUB or Switch.
|
||||||
Given the way that the Linux kernel respond to ARP "who-has" requests,
|
Given the way that the Linux kernel respond to ARP "who-has" requests,
|
||||||
this type of setup does NOT work the way that you expect it to.</li>
|
this type of setup does NOT work the way that you expect it to.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3 align="left">If you are having connection problems:</h3>
|
<h3 align="left">If you are having connection problems:</h3>
|
||||||
|
|
||||||
<p align="left">If the appropriate policy for the connection that you are
|
<p align="left">If the appropriate policy for the connection that you are
|
||||||
trying to make is ACCEPT, please DO NOT ADD ADDITIONAL ACCEPT RULES TRYING
|
trying to make is ACCEPT, please DO NOT ADD ADDITIONAL ACCEPT RULES TRYING
|
||||||
TO MAKE IT WORK. Such additional rules will NEVER make it work, they
|
TO MAKE IT WORK. Such additional rules will NEVER make it work, they
|
||||||
add clutter to your rule set and they represent a big security hole in
|
add clutter to your rule set and they represent a big security hole in
|
||||||
the event that you forget to remove them later.</p>
|
the event that you forget to remove them later.</p>
|
||||||
|
|
||||||
<p align="left">I also recommend against setting all of your policies to
|
<p align="left">I also recommend against setting all of your policies to
|
||||||
ACCEPT in an effort to make something work. That robs you of one of
|
ACCEPT in an effort to make something work. That robs you of one of
|
||||||
your best diagnostic tools - the "Shorewall" messages that Netfilter
|
your best diagnostic tools - the "Shorewall" messages that Netfilter
|
||||||
will generate when you try to connect in a way that isn't permitted
|
will generate when you try to connect in a way that isn't permitted
|
||||||
by your rule set.</p>
|
by your rule set.</p>
|
||||||
|
|
||||||
<p align="left">Check your log ("/sbin/shorewall show log"). If you don't
|
<p align="left">Check your log ("/sbin/shorewall show log"). If you don't
|
||||||
see Shorewall messages, then your problem is probably NOT a Shorewall
|
see Shorewall messages, then your problem is probably NOT a Shorewall
|
||||||
problem. If you DO see packet messages, it may be an indication that you
|
problem. If you DO see packet messages, it may be an indication that you
|
||||||
are missing one or more rules -- see <a href="FAQ.htm#faq17">FAQ 17</a>.</p>
|
are missing one or more rules -- see <a href="FAQ.htm#faq17">FAQ 17</a>.</p>
|
||||||
|
|
||||||
<p align="left">While you are troubleshooting, it is a good idea to clear
|
<p align="left">While you are troubleshooting, it is a good idea to clear
|
||||||
two variables in /etc/shorewall/shorewall.conf:</p>
|
two variables in /etc/shorewall/shorewall.conf:</p>
|
||||||
|
|
||||||
<p align="left">LOGRATE=""<br>
|
<p align="left">LOGRATE=""<br>
|
||||||
LOGBURST=""</p>
|
LOGBURST=""</p>
|
||||||
|
|
||||||
<p align="left">This way, you will see all of the log messages being
|
<p align="left">This way, you will see all of the log messages being generated
|
||||||
generated (be sure to restart shorewall after clearing these variables).</p>
|
(be sure to restart shorewall after clearing these variables).</p>
|
||||||
|
|
||||||
<p align="left">Example:</p>
|
<p align="left">Example:</p>
|
||||||
<font face="Century Gothic, Arial, Helvetica">
|
<font face="Century Gothic, Arial, Helvetica">
|
||||||
|
<p align="left"><font face="Courier">Jun 27 15:37:56 gateway kernel: Shorewall:all2all:REJECT:IN=eth2
|
||||||
<p align="left"><font face="Courier">Jun 27 15:37:56 gateway kernel:
|
OUT=eth1 SRC=192.168.2.2 DST=192.168.1.3 LEN=67 TOS=0x00 PREC=0x00 TTL=63
|
||||||
Shorewall:all2all:REJECT:IN=eth2 OUT=eth1 SRC=192.168.2.2 DST=192.168.1.3
|
ID=5805 DF PROTO=UDP SPT=1803 DPT=53 LEN=47</font></p>
|
||||||
LEN=67 TOS=0x00 PREC=0x00 TTL=63 ID=5805 DF PROTO=UDP SPT=1803 DPT=53
|
</font>
|
||||||
LEN=47</font></p>
|
|
||||||
</font>
|
|
||||||
<p align="left">Let's look at the important parts of this message:</p>
|
<p align="left">Let's look at the important parts of this message:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>all2all:REJECT - This packet was REJECTed out of the all2all
|
<li>all2all:REJECT - This packet was REJECTed out of the all2all
|
||||||
chain -- the packet was rejected under the "all"->"all" REJECT
|
chain -- the packet was rejected under the "all"->"all" REJECT
|
||||||
policy (see <a href="FAQ.htm#faq17">FAQ 17).</a></li>
|
policy (see <a href="FAQ.htm#faq17">FAQ 17).</a></li>
|
||||||
<li>IN=eth2 - the packet entered the firewall via eth2</li>
|
<li>IN=eth2 - the packet entered the firewall via eth2</li>
|
||||||
<li>OUT=eth1 - if accepted, the packet would be sent on eth1</li>
|
<li>OUT=eth1 - if accepted, the packet would be sent on eth1</li>
|
||||||
<li>SRC=192.168.2.2 - the packet was sent by 192.168.2.2</li>
|
<li>SRC=192.168.2.2 - the packet was sent by 192.168.2.2</li>
|
||||||
<li>DST=192.168.1.3 - the packet is destined for 192.168.1.3</li>
|
<li>DST=192.168.1.3 - the packet is destined for 192.168.1.3</li>
|
||||||
<li>PROTO=UDP - UDP Protocol</li>
|
<li>PROTO=UDP - UDP Protocol</li>
|
||||||
<li>DPT=53 - DNS</li>
|
<li>DPT=53 - DNS</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left">In this case, 192.168.2.2 was in the "dmz" zone and 192.168.1.3
|
<p align="left">In this case, 192.168.2.2 was in the "dmz" zone and 192.168.1.3
|
||||||
is in the "loc" zone. I was missing the rule:</p>
|
is in the "loc" zone. I was missing the rule:</p>
|
||||||
|
|
||||||
<p align="left">ACCEPT dmz loc udp 53<br>
|
<p align="left">ACCEPT dmz loc udp 53<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left">See <a href="FAQ.htm#faq17">FAQ 17</a> for additional information
|
<p align="left">See <a href="FAQ.htm#faq17">FAQ 17</a> for additional information
|
||||||
about how to interpret the chain name appearing in a Shorewall log message.<br>
|
about how to interpret the chain name appearing in a Shorewall log message.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h3 align="left">'Ping' Problems?</h3>
|
<h3 align="left">'Ping' Problems?</h3>
|
||||||
Either can't ping when you think you should be able to or are able to ping
|
Either can't ping when you think you should be able to or are able to
|
||||||
when you think that you shouldn't be allowed? Shorewall's 'Ping' Management<a
|
ping when you think that you shouldn't be allowed? Shorewall's 'Ping' Management<a
|
||||||
href="ping.html"> is described here</a>.<br>
|
href="ping.html"> is described here</a>.<br>
|
||||||
|
|
||||||
<h3 align="left">Other Gotchas</h3>
|
<h3 align="left">Other Gotchas</h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Seeing rejected/dropped packets logged out of the INPUT
|
<li>Seeing rejected/dropped packets logged out of the INPUT
|
||||||
or FORWARD chains? This means that:
|
or FORWARD chains? This means that:
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>your zone definitions are screwed up and the host that
|
<li>your zone definitions are screwed up and the host that
|
||||||
is sending the packets or the destination host isn't in any zone
|
is sending the packets or the destination host isn't in any zone
|
||||||
(using an <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>
|
(using an <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>
|
||||||
file are you?); or</li>
|
file are you?); or</li>
|
||||||
<li>the source and destination hosts are both connected to
|
<li>the source and destination hosts are both connected
|
||||||
the same interface and you don't have a policy or rule for the
|
to the same interface and you don't have a policy or rule for
|
||||||
source zone to or from the destination zone.</li>
|
the source zone to or from the destination zone.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</li>
|
</li>
|
||||||
<li>Remember that Shorewall doesn't automatically allow ICMP
|
<li>Remember that Shorewall doesn't automatically allow ICMP
|
||||||
type 8 ("ping") requests to be sent between zones. If you want
|
type 8 ("ping") requests to be sent between zones. If you want pings
|
||||||
pings to be allowed between zones, you need a rule of the form:<br>
|
to be allowed between zones, you need a rule of the form:<br>
|
||||||
<br>
|
<br>
|
||||||
ACCEPT <source zone> <destination zone>
|
ACCEPT <source zone> <destination
|
||||||
icmp echo-request<br>
|
zone> icmp echo-request<br>
|
||||||
<br>
|
<br>
|
||||||
The ramifications of this can be subtle. For example, if you
|
The ramifications of this can be subtle. For example, if
|
||||||
have the following in /etc/shorewall/nat:<br>
|
you have the following in /etc/shorewall/nat:<br>
|
||||||
<br>
|
<br>
|
||||||
10.1.1.2 eth0 130.252.100.18<br>
|
10.1.1.2 eth0 130.252.100.18<br>
|
||||||
<br>
|
<br>
|
||||||
and you ping 130.252.100.18, unless you have allowed icmp
|
and you ping 130.252.100.18, unless you have allowed icmp
|
||||||
type 8 between the zone containing the system you are pinging from
|
type 8 between the zone containing the system you are pinging from
|
||||||
and the zone containing 10.1.1.2, the ping requests will be dropped. </li>
|
and the zone containing 10.1.1.2, the ping requests will be dropped. </li>
|
||||||
<li>If you specify "routefilter" for an interface, that
|
<li>If you specify "routefilter" for an interface, that
|
||||||
interface must be up prior to starting the firewall.</li>
|
interface must be up prior to starting the firewall.</li>
|
||||||
<li>Is your routing correct? For example, internal systems
|
<li>Is your routing correct? For example, internal systems
|
||||||
usually need to be configured with their default gateway set to
|
usually need to be configured with their default gateway set to the
|
||||||
the IP address of their nearest firewall interface. One often overlooked
|
IP address of their nearest firewall interface. One often overlooked
|
||||||
aspect of routing is that in order for two hosts to communicate, the
|
aspect of routing is that in order for two hosts to communicate, the
|
||||||
routing between them must be set up <u>in both directions.</u> So
|
routing between them must be set up <u>in both directions.</u> So when
|
||||||
when setting up routing between <b>A</b> and<b> B</b>, be sure to
|
setting up routing between <b>A</b> and<b> B</b>, be sure to verify
|
||||||
verify that the route from <b>B</b> back to <b>A</b> is defined.</li>
|
that the route from <b>B</b> back to <b>A</b> is defined.</li>
|
||||||
<li>Some versions of LRP (EigerStein2Beta for example) have
|
<li>Some versions of LRP (EigerStein2Beta for example) have
|
||||||
a shell with broken variable expansion. <a
|
a shell with broken variable expansion. <a
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/ash.gz"> You can get a corrected
|
href="ftp://ftp.shorewall.net/pub/shorewall/ash.gz"> You can get a corrected
|
||||||
shell from the Shorewall Errata download site.</a> </li>
|
shell from the Shorewall Errata download site.</a> </li>
|
||||||
<li>Do you have your kernel properly configured? <a
|
<li>Do you have your kernel properly configured? <a
|
||||||
href="kernel.htm">Click here to see my kernel configuration.</a> </li>
|
href="kernel.htm">Click here to see my kernel configuration.</a> </li>
|
||||||
<li>Shorewall requires the "ip" program. That program is
|
<li>Shorewall requires the "ip" program. That program
|
||||||
generally included in the "iproute" package which should be included
|
is generally included in the "iproute" package which should be included
|
||||||
with your distribution (though many distributions don't install iproute
|
with your distribution (though many distributions don't install iproute
|
||||||
by default). You may also download the latest source tarball from <a
|
by default). You may also download the latest source tarball from <a
|
||||||
href="ftp://ftp.inr.ac.ru/ip-routing" target="_blank"> ftp://ftp.inr.ac.ru/ip-routing</a>
|
href="ftp://ftp.inr.ac.ru/ip-routing" target="_blank"> ftp://ftp.inr.ac.ru/ip-routing</a>
|
||||||
.</li>
|
.</li>
|
||||||
<li>Problems with NAT? Be sure that you let Shorewall
|
<li>Problems with NAT? Be sure that you let Shorewall
|
||||||
add all external addresses to be use with NAT unless you have set <a
|
add all external addresses to be use with NAT unless you have set <a
|
||||||
href="Documentation.htm#Aliases"> ADD_IP_ALIASES</a> =No in /etc/shorewall/shorewall.conf.</li>
|
href="Documentation.htm#Aliases"> ADD_IP_ALIASES</a> =No in /etc/shorewall/shorewall.conf.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>Still Having Problems?</h3>
|
<h3>Still Having Problems?</h3>
|
||||||
|
|
||||||
<p>See the<a href="support.htm"> support page.<br>
|
<p>See the<a href="support.htm"> support page.<br>
|
||||||
</a></p>
|
</a></p>
|
||||||
<font face="Century Gothic, Arial, Helvetica">
|
<font face="Century Gothic, Arial, Helvetica">
|
||||||
|
|
||||||
<blockquote> </blockquote>
|
<blockquote> </blockquote>
|
||||||
</font>
|
</font>
|
||||||
<p><font size="2">Last updated 2/21/2003 - Tom Eastep</font> </p>
|
<p><font size="2">Last updated 4/29/2003 - Tom Eastep</font> </p>
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,437 +1,421 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Upgrade Issues</title>
|
<title>Upgrade Issues</title>
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p>For upgrade instructions see the <a
|
<p>For upgrade instructions see the <a
|
||||||
href="Install.htm">Install/Upgrade page</a>.<br>
|
href="Install.htm">Install/Upgrade page</a>.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>It is important that you read all of the sections on this page where the
|
<p>It is important that you read all of the sections on this page where the
|
||||||
version number mentioned in the section title is later than what you are
|
version number mentioned in the section title is later than what you are
|
||||||
currently running.<br>
|
currently running.<br>
|
||||||
</p>
|
</p>
|
||||||
<p> In the descriptions that follows, the term <b><i>group </i></b>refers
|
|
||||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may
|
<p> In the descriptions that follows, the term <b><i>group </i></b>refers
|
||||||
be a host address) accessed through a particular interface.<br>
|
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
|
||||||
</p>
|
a host address) accessed through a particular interface.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<p>Examples:<br>
|
<p>Examples:<br>
|
||||||
<br>
|
<br>
|
||||||
eth0:0.0.0.0/0<br>
|
eth0:0.0.0.0/0<br>
|
||||||
eth2:192.168.1.0/24<br>
|
eth2:192.168.1.0/24<br>
|
||||||
eth3:192.0.2.123<br>
|
eth3:192.0.2.123<br>
|
||||||
</p>
|
</p>
|
||||||
|
<p> You can use the "shorewall check" command to see the groups associated
|
||||||
|
with each of your zones.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<h3>Version >= 1.4.2</h3>
|
<h3>Version >= 1.4.2</h3>
|
||||||
There are some cases where you may want to handle traffic from a particular
|
There are some cases where you may want to handle traffic from a particular
|
||||||
group to itself. While I personally think that such a setups are ridiculous,
|
group to itself. While I personally think that such a setups are ridiculous,
|
||||||
there are two cases covered in this documentation where it can occur:<br>
|
there are two cases covered in this documentation where it can occur:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
|
<li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
|
||||||
<li><a href="Shorewall_Squid_Usage.html">When running Squid as a transparent
|
<li><a href="Shorewall_Squid_Usage.html">When running Squid as a transparent
|
||||||
proxy in your local zone.</a></li>
|
proxy in your local zone.</a></li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
If you have either of these cases, you will want to review the current documentation
|
If you have either of these cases, you will want to review the current documentation
|
||||||
and change your configuration accordingly.<br>
|
and change your configuration accordingly.<br>
|
||||||
|
|
||||||
<h3>Version >= 1.4.1</h3>
|
<h3>Version >= 1.4.1</h3>
|
||||||
You can use the "shorewall check" command to see the groups associated with
|
|
||||||
each of your zones.<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
<li>Beginning with Version 1.4.1, traffic between groups in the same
|
||||||
zone is accepted by default. Previously, traffic from a zone to itself
|
zone is accepted by default. Previously, traffic from a zone to itself was
|
||||||
was treated just like any other traffic; any matching rules were applied
|
treated just like any other traffic; any matching rules were applied followed
|
||||||
followed by enforcement of the appropriate policy. With 1.4.1 and later
|
by enforcement of the appropriate policy. With 1.4.1 and later versions,
|
||||||
versions, unless you have explicit rules for traffic from Z to Z or you
|
unless you have explicit rules for traffic from Z to Z or you have an explicit
|
||||||
have an explicit Z to Z policy (where "Z" is some zone) then traffic between
|
Z to Z policy (where "Z" is some zone) then traffic between the groups
|
||||||
the groups in zone Z will be accepted. If you do have one or more explicit
|
in zone Z will be accepted. If you do have one or more explicit rules for
|
||||||
rules for Z to Z or if you have an explicit Z to Z policy then the behavior
|
Z to Z or if you have an explicit Z to Z policy then the behavior is as it
|
||||||
is as it was in prior versions.</li>
|
was in prior versions.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<ol>
|
<ol>
|
||||||
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic between
|
<li>If you have a Z Z ACCEPT policy for a zone to allow traffic
|
||||||
two interfaces to the same zone, that policy can be removed and traffic
|
between two interfaces to the same zone, that policy can be removed and
|
||||||
between the interfaces will traverse fewer rules than previously.</li>
|
traffic between the interfaces will traverse fewer rules than previously.</li>
|
||||||
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
<li>If you have a Z Z DROP or Z Z REJECT policy or you have Z->Z
|
||||||
rules then your configuration should not require any change.</li>
|
rules then your configuration should not require any change.</li>
|
||||||
<li>If you are currently relying on a implicit policy (one that has
|
<li>If you are currently relying on a implicit policy (one that has
|
||||||
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
|
||||||
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
two interfaces to a zone Z and you have no rules for Z->Z then you should
|
||||||
add an explicit DROP or REJECT policy for Z to Z.<br>
|
add an explicit DROP or REJECT policy for Z to Z.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Beginning with Version 1.4.1, Shorewall will never create rules
|
<li> Sometimes, you want two separate zones on one interface but you
|
||||||
to deal with traffic from a given group back to itself. The <i>multi</i>
|
don't want Shorewall to set up any infrastructure to handle traffic between
|
||||||
interface option is no longer available so if you want to route traffic between
|
them. </li>
|
||||||
two subnetworks on the same interface then either:</li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
<blockquote>Example:<br>
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<ol>
|
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/interfaces<br><br>z2 eth1 192.168.1.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.3<br></pre>
|
||||||
<li>The subnetworks must be in different zones; or</li>
|
</blockquote>
|
||||||
<li>You must use the /etc/shorewall/hosts file to define the subnetworks
|
Here, zone z1 is nested in zone z2 and the firewall is not going to be
|
||||||
as two groups in a single zone.</li>
|
involved in any traffic between these two zones. Beginning with Shorewall
|
||||||
|
1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
|
||||||
</ol>
|
traffic between z1 and z2 by using the new NONE policy:<br>
|
||||||
|
<blockquote>
|
||||||
|
<pre>/etc/shorewall/policy<br><pre>z1 z2 NONE<br>z2 z1 NONE</pre></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
If you use the technique described in FAQ 2 to send local requests addressed
|
Note that NONE policies are generally used in pairs unless there is asymetric
|
||||||
to your firewall's external address back to a local server then you need to
|
routing where only the traffic on one direction flows through the firewall
|
||||||
change your configuration to match <a href="FAQ.htm#faq2">the new version
|
and you are using a NONE polciy in the other direction. </blockquote>
|
||||||
of FAQ #2.<br>
|
|
||||||
</a><br>
|
<h3>Version 1.4.1<br>
|
||||||
Example 1 -- Two zones:<br>
|
</h3>
|
||||||
|
<ul>
|
||||||
<blockquote>
|
<li>In Version 1.4.1, Shorewall will never create rules to deal
|
||||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/policy<br><br>z1 z2 ACCEPT<br>z2 z1 ACCEPT<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.0/24<br>z2 eth1:192.168.2.0/24<br></pre>
|
with traffic from a given group back to itself. The <i>multi</i> interface
|
||||||
</blockquote>
|
option is no longer available so if you want to route traffic between two
|
||||||
Example 2 -- One zone:
|
subnetworks on the same interface then I recommend that you upgrade to Version
|
||||||
<blockquote>
|
1.4.2 and use the 'routeback' interface or host option. </li>
|
||||||
<pre><br>/etc/shorewall/zones<br><br>z Zone The Zone<br><br>/etc/shorewall/interfaces<br><br>- eth1 192.168.1.255,192.168.2.255<br><br>/etc/shorewall/hosts<br><br>z eth1:192.168.1.0/24<br>z eth1:192.168.2.0/24<br></pre>
|
|
||||||
</blockquote>
|
</ul>
|
||||||
Note that in the second example, we don't need any policy since z->z
|
|
||||||
traffic is accepted by default. The second technique is preferable if you
|
|
||||||
want unlimited access between the two subnetworks.<br>
|
|
||||||
<br>
|
|
||||||
Sometimes, you want two separate zones on one interface but you don't
|
|
||||||
want Shorewall to set up any infrastructure to handle traffic between them.
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
Example:<br>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<pre>/etc/shorewall/zones<br><br>z1 Zone1 The first Zone<br>z2 Zone2 The secont Zone<br><br>/etc/shorewall/interfaces<br><br>z2 eth1 192.168.1.255<br><br>/etc/shorewall/hosts<br><br>z1 eth1:192.168.1.3<br></pre>
|
|
||||||
</blockquote>
|
|
||||||
Here, zone z1 is nested in zone z2 and the firewall is not going to be
|
|
||||||
involved in any traffic between these two zones. Beginning with Shorewall
|
|
||||||
1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
|
|
||||||
traffic between z1 and z2 by using the new NONE policy:<br>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<pre>/etc/shorewall/policy<br><pre>z1 z2 NONE<br>z2 z1 NONE</pre></pre>
|
|
||||||
</blockquote>
|
|
||||||
Note that NONE policies are generally used in pairs unless there is asymetric
|
|
||||||
routing where only the traffic on one direction flows through the firewall
|
|
||||||
and you are using a NONE polciy in the other direction.
|
|
||||||
<h3>Version >= 1.4.0</h3>
|
<h3>Version >= 1.4.0</h3>
|
||||||
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
<b>IMPORTANT: Shorewall >=1.4.0 </b><b>requires</b> <b>the iproute
|
||||||
package ('ip' utility).</b><br>
|
package ('ip' utility).</b><br>
|
||||||
<br>
|
|
||||||
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
|
||||||
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
|
||||||
<br>
|
|
||||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<b>Note: </b>Unfortunately, some distributions call this package iproute2
|
||||||
This may be worked around by using the --nodeps option of rpm (rpm
|
which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||||
|
<br>
|
||||||
|
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
This may be worked around by using the --nodeps option of rpm (rpm
|
||||||
-Uvh --nodeps <shorewall rpm>).<br>
|
-Uvh --nodeps <shorewall rpm>).<br>
|
||||||
<br>
|
<br>
|
||||||
If you are upgrading from a version < 1.4.0, then:<br>
|
If you are upgrading from a version < 1.4.0, then:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
<li>The <b>noping </b>and <b>forwardping</b> interface options
|
||||||
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
are no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||||
ICMP echo-request (ping) packets are treated just like any other connection
|
ICMP echo-request (ping) packets are treated just like any other connection
|
||||||
request and are subject to rules and policies.</li>
|
request and are subject to rules and policies.</li>
|
||||||
<li>Interface names of the form <device>:<integer>
|
<li>Interface names of the form <device>:<integer>
|
||||||
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
in /etc/shorewall/interfaces now generate a Shorewall error at startup
|
||||||
(they always have produced warnings in iptables).</li>
|
(they always have produced warnings in iptables).</li>
|
||||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||||
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
|
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
|
||||||
contents are determined by BOTH the interfaces and hosts files when there
|
contents are determined by BOTH the interfaces and hosts files when there
|
||||||
are entries for the zone in both files.</li>
|
are entries for the zone in both files.</li>
|
||||||
<li>The <b>routestopped</b> option in the interfaces and hosts
|
<li>The <b>routestopped</b> option in the interfaces and hosts
|
||||||
file has been eliminated; use entries in the routestopped file instead.</li>
|
file has been eliminated; use entries in the routestopped file instead.</li>
|
||||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
||||||
no longer accepted; you must convert to using the new syntax.</li>
|
no longer accepted; you must convert to using the new syntax.</li>
|
||||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is
|
<li value="6">The ALLOWRELATED variable in shorewall.conf is
|
||||||
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with
|
||||||
<li value="6">Late-arriving DNS replies are now dropped by default;
|
ALLOWRELATED=Yes.</li>
|
||||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
<li value="6">Late-arriving DNS replies are now dropped by
|
||||||
logging these packets.</li>
|
default; there is no need for your own /etc/shorewall/common file simply
|
||||||
<li value="6">The 'firewall', 'functions' and 'version' file
|
to avoid logging these packets.</li>
|
||||||
have been moved to /usr/share/shorewall.</li>
|
<li value="6">The 'firewall', 'functions' and 'version' file
|
||||||
<li value="6">The icmp.def file has been removed. If you include
|
have been moved to /usr/share/shorewall.</li>
|
||||||
|
<li value="6">The icmp.def file has been removed. If you include
|
||||||
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
it from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||||
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>Version 1.4.0</h3>
|
<h3>Version 1.4.0</h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li value="8">The 'multi' interface option is no longer supported.
|
<li value="8">The 'multi' interface option is no longer supported.
|
||||||
Shorewall will generate rules for sending packets back out the same
|
Shorewall will generate rules for sending packets back out the same interface
|
||||||
interface that they arrived on in two cases:</li>
|
that they arrived on in two cases:</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<ul>
|
<ul>
|
||||||
<li>There is an <u>explicit</u> policy for the source zone to or
|
<li>There is an <u>explicit</u> policy for the source zone to or
|
||||||
from the destination zone. An explicit policy names both zones and does
|
from the destination zone. An explicit policy names both zones and does
|
||||||
not use the 'all' reserved word.</li>
|
not use the 'all' reserved word.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>There are one or more rules for traffic for the source zone to
|
<li>There are one or more rules for traffic for the source zone
|
||||||
or from the destination zone including rules that use the 'all' reserved
|
to or from the destination zone including rules that use the 'all' reserved
|
||||||
word. Exception: if the source zone and destination zone are the same
|
word. Exception: if the source zone and destination zone are the same then
|
||||||
then the rule must be explicit - it must name the zone in both the SOURCE
|
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||||
and DESTINATION columns.</li>
|
DESTINATION columns.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h3>Version >= 1.3.14</h3>
|
<h3>Version >= 1.3.14</h3>
|
||||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
|
||||||
height="13">
|
|
||||||
Beginning in version 1.3.14, Shorewall treats entries in
|
|
||||||
<a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The
|
|
||||||
change involves entries with an <b>interface name</b> in the <b>SUBNET</b>
|
|
||||||
(second) <b>column</b>:<br>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
|
||||||
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
|
||||||
masquerade traffic from that subnet. Any other subnets that routed through
|
|
||||||
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
|
||||||
or to have SNAT applied.</li>
|
|
||||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
|
||||||
routing table to determine ALL subnets routed through the named interface.
|
|
||||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
|
||||||
applied.</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
You will need to make a change to your configuration if:<br>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>You have one or more entries in /etc/shorewall/masq with
|
|
||||||
an interface name in the SUBNET (second) column; and</li>
|
|
||||||
<li>That interface connects to more than one subnetwork.</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
Two examples:<br>
|
|
||||||
<br>
|
|
||||||
<b>Example 1</b> -- Suppose that your current config is as
|
|
||||||
follows:<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
|
||||||
|
|
||||||
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
|
||||||
required.<br>
|
|
||||||
</blockquote>
|
|
||||||
<b>Example 2</b>-- What if your current configuration is like
|
|
||||||
this?<br>
|
|
||||||
|
|
||||||
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
|
||||||
|
|
||||||
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
|
||||||
to:<br>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
|
||||||
<img src="images/BD21298_3.gif" alt="" width="13"
|
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||||
height="13">
|
height="13">
|
||||||
Version 1.3.14 also introduced simplified ICMP echo-request
|
Beginning in version 1.3.14, Shorewall treats entries in
|
||||||
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
<a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The
|
||||||
is used to specify that the old (pre-1.3.14) ping handling is to be
|
change involves entries with an <b>interface name</b> in the <b>SUBNET</b>
|
||||||
used (If the option is not set in your /etc/shorewall/shorewall.conf
|
(second) <b>column</b>:<br>
|
||||||
then OLD_PING_HANDLING=Yes is assumed). I don't plan on supporting the
|
|
||||||
old handling indefinitely so I urge current users to migrate to using
|
<ul>
|
||||||
the new handling as soon as possible. See the <a href="ping.html">'Ping'
|
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet
|
||||||
handling documentation</a> for details.<br>
|
on the interface (as shown by "ip addr show <i>interface</i>") and would
|
||||||
|
masquerade traffic from that subnet. Any other subnets that routed through
|
||||||
<h3>Version 1.3.10</h3>
|
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
|
||||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
or to have SNAT applied.</li>
|
||||||
to version 1.3.10, you will need to use the '--force' option:<br>
|
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||||
|
routing table to determine ALL subnets routed through the named interface.
|
||||||
|
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||||
|
applied.</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
You will need to make a change to your configuration if:<br>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>You have one or more entries in /etc/shorewall/masq with
|
||||||
|
an interface name in the SUBNET (second) column; and</li>
|
||||||
|
<li>That interface connects to more than one subnetwork.</li>
|
||||||
|
|
||||||
|
</ol>
|
||||||
|
Two examples:<br>
|
||||||
<br>
|
<br>
|
||||||
|
<b>Example 1</b> -- Suppose that your current config is as
|
||||||
<blockquote>
|
follows:<br>
|
||||||
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
<br>
|
||||||
|
|
||||||
|
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||||
|
|
||||||
|
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
||||||
|
required.<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
<b>Example 2</b>-- What if your current configuration is like
|
||||||
|
this?<br>
|
||||||
|
|
||||||
|
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
||||||
|
|
||||||
|
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
||||||
|
to:<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||||
|
<img src="images/BD21298_3.gif" alt="" width="13"
|
||||||
|
height="13">
|
||||||
|
Version 1.3.14 also introduced simplified ICMP echo-request
|
||||||
|
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||||
|
is used to specify that the old (pre-1.3.14) ping handling is to be
|
||||||
|
used (If the option is not set in your /etc/shorewall/shorewall.conf then
|
||||||
|
OLD_PING_HANDLING=Yes is assumed). I don't plan on supporting the old
|
||||||
|
handling indefinitely so I urge current users to migrate to using the
|
||||||
|
new handling as soon as possible. See the <a href="ping.html">'Ping' handling
|
||||||
|
documentation</a> for details.<br>
|
||||||
|
|
||||||
|
<h3>Version 1.3.10</h3>
|
||||||
|
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||||
|
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
<h3>Version >= 1.3.9</h3>
|
<h3>Version >= 1.3.9</h3>
|
||||||
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||||
If you have an application that uses functions from that file, your
|
If you have an application that uses functions from that file, your
|
||||||
application will need to be changed to reflect this change of location.<br>
|
application will need to be changed to reflect this change of location.<br>
|
||||||
|
|
||||||
<h3>Version >= 1.3.8</h3>
|
<h3>Version >= 1.3.8</h3>
|
||||||
|
|
||||||
<p>If you have a pair of firewall systems configured for failover
|
<p>If you have a pair of firewall systems configured for failover
|
||||||
or if you have asymmetric routing, you will need to modify
|
or if you have asymmetric routing, you will need to modify
|
||||||
your firewall setup slightly under Shorewall
|
your firewall setup slightly under Shorewall
|
||||||
versions >= 1.3.8. Beginning with version 1.3.8,
|
versions >= 1.3.8. Beginning with version 1.3.8,
|
||||||
you must set NEWNOTSYN=Yes in your
|
you must set NEWNOTSYN=Yes in your
|
||||||
/etc/shorewall/shorewall.conf file.</p>
|
/etc/shorewall/shorewall.conf file.</p>
|
||||||
|
|
||||||
<h3>Version >= 1.3.7</h3>
|
<h3>Version >= 1.3.7</h3>
|
||||||
|
|
||||||
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
||||||
will need to include the following
|
will need to include the following
|
||||||
rules in their /etc/shorewall/icmpdef file (creating this
|
rules in their /etc/shorewall/icmpdef file (creating this file
|
||||||
file if necessary):</p>
|
if necessary):</p>
|
||||||
|
|
||||||
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
||||||
|
|
||||||
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
||||||
command from that file since the icmp.def file is now empty.</p>
|
command from that file since the icmp.def file is now empty.</p>
|
||||||
|
|
||||||
<h3><b><a name="Bering">Upgrading </a>Bering to Shorewall >= 1.3.3</b></h3>
|
<h3><b><a name="Bering">Upgrading </a>Bering to Shorewall >= 1.3.3</b></h3>
|
||||||
|
|
||||||
<p>To properly upgrade with Shorewall version 1.3.3 and later:</p>
|
<p>To properly upgrade with Shorewall version 1.3.3 and later:</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Be sure you have a
|
<li>Be sure you have
|
||||||
backup -- you will need to transcribe
|
a backup -- you will need to transcribe
|
||||||
any Shorewall configuration changes
|
any Shorewall configuration changes
|
||||||
that you have made to the new configuration.</li>
|
that you have made to the new configuration.</li>
|
||||||
<li>Replace the shorwall.lrp
|
<li>Replace the shorwall.lrp
|
||||||
package provided on the Bering floppy
|
package provided on the Bering floppy
|
||||||
with the later one. If you did not
|
with the later one. If you did not
|
||||||
obtain the later version from Jacques's site, see additional instructions
|
obtain the later version from Jacques's site, see additional instructions
|
||||||
below.</li>
|
below.</li>
|
||||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||||
file and remove the /var/lib/shorewall
|
file and remove the /var/lib/shorewall
|
||||||
entry if present. Then do not forget
|
entry if present. Then do not forget
|
||||||
to backup root.lrp !</li>
|
to backup root.lrp !</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
||||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||||
for setting up a two-interface firewall</a> plus you also need
|
for setting up a two-interface firewall</a> plus you also need
|
||||||
to add the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
to add the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
||||||
|
|
||||||
<p align="left">If you have a pair of firewall systems configured for
|
<p align="left">If you have a pair of firewall systems configured for
|
||||||
failover or if you have asymmetric routing, you will need to modify
|
failover or if you have asymmetric routing, you will need to modify
|
||||||
your firewall setup slightly under Shorewall versions 1.3.6
|
your firewall setup slightly under Shorewall versions
|
||||||
and 1.3.7</p>
|
1.3.6 and 1.3.7</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
||||||
the following rule<br>
|
the following rule<br>
|
||||||
<br>
|
<br>
|
||||||
<font face="Courier">run_iptables -A newnotsyn
|
<font face="Courier">run_iptables -A newnotsyn
|
||||||
-j RETURN # So that the connection tracking table can be
|
-j RETURN # So that the connection tracking table can be
|
||||||
rebuilt<br>
|
rebuilt<br>
|
||||||
# from
|
# from
|
||||||
non-SYN packets after takeover.<br>
|
non-SYN packets after takeover.<br>
|
||||||
</font> </p>
|
</font> </p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
<p align="left">Create /etc/shorewall/common (if you don't already
|
<p align="left">Create /etc/shorewall/common (if you don't already
|
||||||
have that file) and include the following:<br>
|
have that file) and include the following:<br>
|
||||||
<br>
|
<br>
|
||||||
<font face="Courier">run_iptables -A common
|
<font face="Courier">run_iptables -A common
|
||||||
-p tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks
|
-p tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks
|
||||||
to rebuild connection<br>
|
to rebuild connection<br>
|
||||||
|
|
||||||
#tracking table. <br>
|
#tracking table. <br>
|
||||||
. /etc/shorewall/common.def</font> </p>
|
. /etc/shorewall/common.def</font> </p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h3 align="left">Versions >= 1.3.5</h3>
|
<h3 align="left">Versions >= 1.3.5</h3>
|
||||||
|
|
||||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no longer
|
<p align="left">Some forms of pre-1.3.0 rules file syntax are no longer
|
||||||
supported. </p>
|
supported. </p>
|
||||||
|
|
||||||
<p align="left">Example 1:</p>
|
<p align="left">Example 1:</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left">Must be replaced with:</p>
|
<p align="left">Must be replaced with:</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Example 2:</p>
|
<p align="left">Example 2:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Must be replaced with:</p>
|
<p align="left">Must be replaced with:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> REDIRECT loc 3128 tcp 80</pre>
|
<pre> REDIRECT loc 3128 tcp 80</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<h3 align="left">Version >= 1.3.2</h3>
|
<h3 align="left">Version >= 1.3.2</h3>
|
||||||
|
|
||||||
<p align="left">The functions and versions files together with the 'firewall'
|
<p align="left">The functions and versions files together with the 'firewall'
|
||||||
symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||||
If you have applications that access these files, those applications
|
If you have applications that access these files, those applications
|
||||||
should be modified accordingly.</p>
|
should be modified accordingly.</p>
|
||||||
|
|
||||||
<p><font size="2"> Last updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2"> Last updated 4/13/2003 - <a href="support.htm">Tom
|
||||||
</p>
|
Eastep</a></font> </p>
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user