forked from extern/shorewall_code
More 3.0 updates
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2715 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
4309521d0c
commit
e1ed494516
@ -51,14 +51,14 @@
|
|||||||
<note>
|
<note>
|
||||||
<para>Shorewall distribution contains a library of user-defined macros
|
<para>Shorewall distribution contains a library of user-defined macros
|
||||||
that allow for easily allowing or blocking a particular application.
|
that allow for easily allowing or blocking a particular application.
|
||||||
Check your <filename>/usr/share/shorewall/actions.std</filename> file
|
<command>ls <filename>/usr/share/shorewall/</filename>macro.*</command>
|
||||||
for a list of macros in your distribution. If you find what you need,
|
for the list of macros in your distribution. If you find what you need,
|
||||||
you simply use the action in a rule. For example, to allow DNS queries
|
you simply use the macro in a rule. For example, to allow DNS queries
|
||||||
from the <emphasis role="bold">dmz</emphasis> zone to the <emphasis
|
from the <emphasis role="bold">dmz</emphasis> zone to the <emphasis
|
||||||
role="bold">net</emphasis> zone:</para>
|
role="bold">net</emphasis> zone:</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION
|
<programlisting>#ACTION SOURCE DESTINATION
|
||||||
DNS/ACCEPT dmz net</programlisting>
|
DNS/ACCEPT dmz net</programlisting>
|
||||||
</note>
|
</note>
|
||||||
|
|
||||||
<note>
|
<note>
|
||||||
@ -70,12 +70,12 @@ DNS/ACCEPT dmz net</programlisting>
|
|||||||
<para>Example: You want to port forward FTP from the net to your server
|
<para>Example: You want to port forward FTP from the net to your server
|
||||||
at 192.168.1.4 in your DMZ. The FTP section below gives you:</para>
|
at 192.168.1.4 in your DMZ. The FTP section below gives you:</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
FTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
FTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
|
|
||||||
<para>You would code your rule as follows:</para>
|
<para>You would code your rule as follows:</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
FTP/DNAT net dmz:192.168.1.4 </programlisting>
|
FTP/DNAT net dmz:192.168.1.4 </programlisting>
|
||||||
</note>
|
</note>
|
||||||
</section>
|
</section>
|
||||||
@ -84,19 +84,20 @@ FTP/DNAT net dmz:192.168.1.4 </programlisting>
|
|||||||
<title>Auth (identd)</title>
|
<title>Auth (identd)</title>
|
||||||
|
|
||||||
<caution>
|
<caution>
|
||||||
<para><emphasis role="bold"><emphasis>Now,It's 21 Century</emphasis> ,
|
<para><emphasis role="bold"><emphasis>It is now the 21st
|
||||||
don't use identd in production anymore.</emphasis></para>
|
Century</emphasis> ; don't use identd in production
|
||||||
|
anymore.</emphasis></para>
|
||||||
</caution>
|
</caution>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Auth/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
Auth/ACCEPT <emphasis> <source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>DNS</title>
|
<title>DNS</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
DNS/ACCEPT <emphasis> <source></emphasis> <emphasis><destination></emphasis> </programlisting>
|
DNS/ACCEPT <emphasis> <source></emphasis> <emphasis><destination></emphasis> </programlisting>
|
||||||
|
|
||||||
<para>Note that if you are setting up a DNS server that supports recursive
|
<para>Note that if you are setting up a DNS server that supports recursive
|
||||||
resolution, the server is the <<emphasis>destination</emphasis>> for
|
resolution, the server is the <<emphasis>destination</emphasis>> for
|
||||||
@ -106,7 +107,7 @@ DNS/ACCEPT <emphasis> <source></emphasis> <emphasis><destination&g
|
|||||||
a public DNS server in your DMZ that supports recursive resolution for
|
a public DNS server in your DMZ that supports recursive resolution for
|
||||||
local clients then you would need:</para>
|
local clients then you would need:</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
DNS/ACCEPT all dmz
|
DNS/ACCEPT all dmz
|
||||||
DNS/ACCEPT dmz net </programlisting>
|
DNS/ACCEPT dmz net </programlisting>
|
||||||
|
|
||||||
@ -157,7 +158,7 @@ DNAT net loc:192.168.1.4 tcp 4711</programlisting>
|
|||||||
<section>
|
<section>
|
||||||
<title>FTP</title>
|
<title>FTP</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
FTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
FTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
|
|
||||||
<para>Look <ulink url="FTP.html">here</ulink> for much more
|
<para>Look <ulink url="FTP.html">here</ulink> for much more
|
||||||
@ -186,13 +187,14 @@ FTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination>
|
|||||||
<listitem>
|
<listitem>
|
||||||
<para>Your loc->net policy is ACCEPT</para>
|
<para>Your loc->net policy is ACCEPT</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist><programlisting>Gnutella/DNAT net loc:192.168.1.4</programlisting></para>
|
</orderedlist><programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
|
Gnutella/DNAT net loc:192.168.1.4</programlisting></para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>ICQ/AIM</title>
|
<title>ICQ/AIM</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
ICQ/ACCEPT <emphasis><source></emphasis> net</programlisting>
|
ICQ/ACCEPT <emphasis><source></emphasis> net</programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -205,7 +207,7 @@ ICQ/ACCEPT <emphasis><source></emphasis> net</programlisting>
|
|||||||
SSL</emphasis></para>
|
SSL</emphasis></para>
|
||||||
</caution>
|
</caution>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
IMAP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Secure & Unsecure IMAP</programlisting>
|
IMAP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Secure & Unsecure IMAP</programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -235,14 +237,14 @@ ACCEPT <emphasis><z1></emphasis>:<list of client IPs> <emphasis
|
|||||||
<section>
|
<section>
|
||||||
<title>NTP (Network Time Protocol)</title>
|
<title>NTP (Network Time Protocol)</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
NTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
NTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title><trademark>PCAnywhere</trademark></title>
|
<title><trademark>PCAnywhere</trademark></title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
PCA/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
PCA/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -256,7 +258,7 @@ PCA/ACCEPT <emphasis><source></emphasis> <emphasis><destination>
|
|||||||
|
|
||||||
<para>TCP Port 110 (Secure Pop3 is TCP Port 995)</para>
|
<para>TCP Port 110 (Secure Pop3 is TCP Port 995)</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
POP3/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> # Secure & Unsecure Pop3</programlisting>
|
POP3/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> # Secure & Unsecure Pop3</programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -274,14 +276,14 @@ ACCEPT <emphasis><source></emphasis> <emphasis><destination></e
|
|||||||
<section>
|
<section>
|
||||||
<title>rdate</title>
|
<title>rdate</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Rdate/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
Rdate/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>rsync</title>
|
<title>rsync</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Rsync/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
Rsync/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -295,7 +297,7 @@ SSH/ACCEPT <emphasis><source></emphasis> <emphasis><destination></e
|
|||||||
<section>
|
<section>
|
||||||
<title>SMB/NMB (Samba/Windows Browsing/File Sharing)</title>
|
<title>SMB/NMB (Samba/Windows Browsing/File Sharing)</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
SMB/ACCEPT <emphasis><source></emphasis> <emphasis> <destination></emphasis>
|
SMB/ACCEPT <emphasis><source></emphasis> <emphasis> <destination></emphasis>
|
||||||
SMB/ACCEPT <emphasis><destination></emphasis> <emphasis><source></emphasis></programlisting>
|
SMB/ACCEPT <emphasis><destination></emphasis> <emphasis><source></emphasis></programlisting>
|
||||||
|
|
||||||
@ -313,14 +315,14 @@ ACCEPT <emphasis><source></emphasis> <emphasis><destination></e
|
|||||||
<section>
|
<section>
|
||||||
<title>SNMP</title>
|
<title>SNMP</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
SNMP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
SNMP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>Telnet</title>
|
<title>Telnet</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Telnet/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
Telnet/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -344,7 +346,7 @@ ACCEPT <emphasis><source></emphasis> <emphasis><destination></e
|
|||||||
<section>
|
<section>
|
||||||
<title>Traceroute</title>
|
<title>Traceroute</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Trcrt/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Good for 10 hops</programlisting>
|
Trcrt/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Good for 10 hops</programlisting>
|
||||||
|
|
||||||
<para>UDP traceroute uses ports 33434 through 33434+<max number of
|
<para>UDP traceroute uses ports 33434 through 33434+<max number of
|
||||||
@ -363,7 +365,7 @@ ACCEPT fw ...</programlisting>
|
|||||||
<section>
|
<section>
|
||||||
<title>Usenet (NNTP)</title>
|
<title>Usenet (NNTP)</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
NNTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> </programlisting>
|
NNTP/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> </programlisting>
|
||||||
|
|
||||||
<para>TCP Port 119</para>
|
<para>TCP Port 119</para>
|
||||||
@ -385,7 +387,7 @@ ACCEPT <emphasis><source></emphasis> <emphasis><destination></e
|
|||||||
|
|
||||||
<para>Vncserver to Vncviewer in listen mode -- TCP port 5500.</para>
|
<para>Vncserver to Vncviewer in listen mode -- TCP port 5500.</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
VNCL/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
VNCL/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis></programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -404,7 +406,7 @@ VNCL/ACCEPT <emphasis><source></emphasis> <emphasis><destination&g
|
|||||||
<section>
|
<section>
|
||||||
<title>Web Access</title>
|
<title>Web Access</title>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
Web/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Insecure HTTP& Secure HTTP</programlisting>
|
Web/ACCEPT <emphasis><source></emphasis> <emphasis><destination></emphasis> #Insecure HTTP& Secure HTTP</programlisting>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -434,6 +436,16 @@ ACCEPT <<emphasis>apps</emphasis>> <<emphasis>chooser</emphasis>
|
|||||||
<title>Revision History</title>
|
<title>Revision History</title>
|
||||||
|
|
||||||
<para><revhistory>
|
<para><revhistory>
|
||||||
|
<revision>
|
||||||
|
<revnumber>1.17</revnumber>
|
||||||
|
|
||||||
|
<date>2005-09-20</date>
|
||||||
|
|
||||||
|
<authorinitials>TE</authorinitials>
|
||||||
|
|
||||||
|
<revremark>More 3.0 Updates</revremark>
|
||||||
|
</revision>
|
||||||
|
|
||||||
<revision>
|
<revision>
|
||||||
<revnumber>1.16</revnumber>
|
<revnumber>1.16</revnumber>
|
||||||
|
|
||||||
|
|||||||
@ -308,21 +308,18 @@ all all REJECT info</programlisting>
|
|||||||
<section>
|
<section>
|
||||||
<title>Enabling other Connections</title>
|
<title>Enabling other Connections</title>
|
||||||
|
|
||||||
<para>Shorewall includes a collection of actions that can be used to
|
<para>Shorewall includes a collection of macros that can be used to
|
||||||
quickly allow or deny services. You can find a list of the actions
|
quickly allow or deny services. You can find a list of the macros included
|
||||||
included in your version of Shorewall in the file
|
in your version of Shorewall using the command <command>ls
|
||||||
<filename>/usr/share/shorewall/actions.std</filename>.</para>
|
<filename>/usr/share/shorewall/macro.*</filename></command>.</para>
|
||||||
|
|
||||||
<para>Those actions that allow a connection begin with
|
|
||||||
<quote>Allow</quote>.</para>
|
|
||||||
|
|
||||||
<para>If you wish to enable connections from the internet to your firewall
|
<para>If you wish to enable connections from the internet to your firewall
|
||||||
and you find an appropriate <quote>Allow</quote> action in
|
and you find an appropriate macro in
|
||||||
<filename>/etc/shorewall/actions.std</filename>, the general format of a
|
<filename>/etc/shorewall/macro.*</filename>, the general format of a rule
|
||||||
rule in <filename>/etc/shorewall/rules</filename> is:</para>
|
in <filename>/etc/shorewall/rules</filename> is:</para>
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
<<emphasis>action</emphasis>> net $FW</programlisting>
|
<<emphasis>macro</emphasis>>/ACCEPT net $FW</programlisting>
|
||||||
|
|
||||||
<example>
|
<example>
|
||||||
<title>You want to run a Web Server and a IMAP Server on your firewall
|
<title>You want to run a Web Server and a IMAP Server on your firewall
|
||||||
@ -334,10 +331,9 @@ IMAP/ACCEPT net $FW</programlisting>
|
|||||||
</example>
|
</example>
|
||||||
|
|
||||||
<para>You may also choose to code your rules directly without using the
|
<para>You may also choose to code your rules directly without using the
|
||||||
pre-defined actions. This will be necessary in the event that there is not
|
pre-defined macros. This will be necessary in the event that there is not
|
||||||
a pre-defined action that meets your requirements. In that case the
|
a pre-defined macro that meets your requirements. In that case the general
|
||||||
general format of a rule in <filename>/etc/shorewall/rules</filename>
|
format of a rule in <filename>/etc/shorewall/rules</filename> is:</para>
|
||||||
is:</para>
|
|
||||||
|
|
||||||
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
<programlisting>#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
|
||||||
ACCEPT net $FW <emphasis><protocol></emphasis> <emphasis><port></emphasis></programlisting>
|
ACCEPT net $FW <emphasis><protocol></emphasis> <emphasis><port></emphasis></programlisting>
|
||||||
@ -433,6 +429,16 @@ SSH/ACCEPT net $FW </programlisting>
|
|||||||
<title>Revision History</title>
|
<title>Revision History</title>
|
||||||
|
|
||||||
<para><revhistory>
|
<para><revhistory>
|
||||||
|
<revision>
|
||||||
|
<revnumber>2.0</revnumber>
|
||||||
|
|
||||||
|
<date>2005-09-12</date>
|
||||||
|
|
||||||
|
<authorinitials>TE</authorinitials>
|
||||||
|
|
||||||
|
<revremark>More 3.0 Updates</revremark>
|
||||||
|
</revision>
|
||||||
|
|
||||||
<revision>
|
<revision>
|
||||||
<revnumber>1.9</revnumber>
|
<revnumber>1.9</revnumber>
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user