Shorewall QuickStart Guides (HOWTO's)
Version 3.1

With thanks to Richard who reminded me once again that we must all first walk before we can run.
The French Translations are courtesy of Patrice Vetsel

The Guides

These guides provide step-by-step instructions for configuring Shorewall in common firewall setups.

The following guides are for users who have a single public IP address:

• Standalone Linux System (Version Française)
• Two-interface Linux System acting as a firewall/router for a small local network (Version Française)
• Three-interface Linux System acting as a firewall/router for a small local network and a DMZ. (Version Française)

The above guides are designed to get your first firewall up and running quickly in the three most common Shorewall configurations.

The Shorewall Setup Guide outlines the steps necessary to set up a firewall where there are multiple public IP addresses involved or if you want to learn more about Shorewall than is explained in the single-address guides above.

• 1.0 Introduction
• 2.0 Shorewall Concepts
• 3.0 Network Interfaces
• 4.0 Addressing, Subnets and Routing
  • 4.1 IP Addresses
  • 4.2 Subnets
  • 4.3 Routing
  • 4.4 Address Resolution Protocol
  • 4.5 RFC 1918
• 5.0 Setting up your Network
  • 5.1 Routed
  • 5.2 Non-routed
    • 5.2.1 SNAT
    • 5.2.2 DNAT
    • 5.2.3 Proxy ARP
    • 5.2.4 Static NAT
  • 5.3 Rules
  • 5.4 Odds and Ends
• 6.0 DNS
• 7.0 Starting and Stopping the Firewall

Documentation Index

The following documentation covers a variety of topics and supplements the QuickStart Guides described above. Please review the appropriate guide before trying to use this documentation directly.

• Aliased (virtual) Interfaces (e.g., eth0:0)
  
• Blacklisting
  • Static Blacklisting using /etc/shorewall/blacklist
  • Dynamic Blacklisting using /sbin/shorewall
• Common configuration file features
  • Comments in configuration files
  • Line Continuation
  • Port Numbers/Service Names
  • Port Ranges
  • Using Shell Variables
  • Using DNS Names
    
  • Complementing an IP address or Subnet
  • Shorewall Configurations (making a test configuration)
  • Using MAC Addresses in Shorewall
• Configuration File Reference Manual
  • params
  • zones
  • interfaces
  • hosts
  • policy
  • rules
  • common
  • masq
  • proxyarp
  • nat
  • tunnels
  • tcrules
  • shorewall.conf
  • modules
  • tos
  • blacklist
  • rfc1918
  • routestopped
• DHCP
• Extension Scripts (How to extend Shorewall without modifying Shorewall code)
• Fallback/Uninstall
• Firewall Structure
• Kernel Configuration
• Logging
  
• MAC Verification
  
• My Configuration Files (How I personally use Shorewall)
• 'Ping' Management
  
• Port Information
  • Which applications use which ports
  • Ports used by Trojans
• Proxy ARP
• Samba
• Starting/stopping the Firewall
• Description of all /sbin/shorewall commands
• How to safely test a Shorewall configuration change
  
• Static NAT
• Squid as a Transparent Proxy with Shorewall
  
• Traffic Shaping/QOS
• VPN
  • IPSEC
  • GRE and IPIP
  • OpenVPN
    
  • PPTP
  • IPSEC/PPTP from a system behind your firewall to a remote network.
• White List Creation

If you use one of these guides and have a suggestion for improvement please let me know.

Last modified 3/5/2003 - Tom Eastep

Copyright 2002, 2003 Thomas M. Eastep