Shorewall and Aliased Interfaces

Background

The traditional net-tools contain a program called ifconfig which is used to configure network devices. ifconfig introduced the concept of aliased or virtial interfaces. These virtual interfaces have names of the form interface:integer (e.g., eth0:0) and ifconfig treats them more or less like real interfaces.

Example:

[root@gateway root]# ifconfig eth0:0
eth0:0    Link encap:Ethernet  HWaddr 02:00:08:3:FA:55
          inet addr:206.124.146.178  Bcast:206.124.146.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:11 Base address:0x2000
[root@gateway root]#

The ifconfig utility is being gradually phased out in favor of the ip utility which is part of the iproute package. The ip utility does not use the concept of aliases or virtual interfaces but rather treats additional addresses on an interface as objects. The ip utility does provide for interaction with ifconfig in that it allows addresses to be labeled and labels may take the form of ipconfig virtual interfaces.

Example:

[root@gateway root]# ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb qlen 100
    link/ether 02:00:08:e3:fa:55 brd ff:ff:ff:ff:ff:ff
    inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0
    inet 206.124.146.178/24 brd 206.124.146.255 scope global secondary eth0:0
[root@gateway root]#

Note that one cannot type "ip addr show dev eth0:0" because "eth0:0" is a label for a particular address rather than a device name.

[root@gateway root]# ip addr show dev eth0:0
Device "eth0:0" does not exist.
[root@gateway root]#

The iptables program doesn't support virtual interfaces in either it's "-i" or "-o" command options; as a consequence, Shorewall does not allow them to be used in the /etc/shorewall/interfaces file.

So how do I handle more than one address on an interface?

The answer depends on what you are trying to do with the interfaces. In the sub-sections that follow, we'll take a look at common scenarios.

Separate Rules

If you need to make a rule for traffic to/from the firewall itself that only applies to a particular IP address, simply qualify the $FW zone with the IP address.

Example (allow SSH from net to eth0:0 above):

ACTION
SOURCE
DESTINATION
PROTOCOL
PORT(S)
SOURCE PORT(S)
ORIGINAL DESTINATION

ACCEPT
net
fw:206.124.146.178
tcp
22

DNAT

Suppose that I had set up eth0:0 as above and I wanted to port forward from that virtual interface to a web server running in my local zone at 192.168.1.3. That is accomplised by a single rule in the /etc/shorewall/rules file:

ACTION
SOURCE
DESTINATION
PROTOCOL
PORT(S)
SOURCE PORT(S)
ORIGINAL DESTINATION

DNAT
net
loc:192.168.1.3
tcp
80
-
206.124.146.178

SNAT

If you wanted to use eth0:0 as the IP address for outbound connections from your local zone (eth1), then in /etc/shorewall/masq:

INTERFACE
SUBNET
ADDRESS

eth0
eth1
206.124.146.178

Shorewall can create the alias (additional address) for you if you set ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall 1.3.14, Shorewall can actually create the "label" (virtual interface) so that you can see the created address using ifconfig. In addition to setting ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE column as follows:

INTERFACE
SUBNET
ADDRESS

eth0:0
eth1
206.124.146.178

Shorewall can also set up SNAT to round-robin over a range of IP addresses. Do do that, you specify a range of IP addresses in the ADDRESS column. If you specify a label in the INTERFACE column, Shorewall will use that label for the first address of the range and will increment the label by one for each subsequent label.

INTERFACE
SUBNET
ADDRESS

eth0:0
eth1
206.124.146.178-206.124.146.180

The above would create three IP addresses:

    eth0:0 = 206.124.146.178
    eth0:1 = 206.124.146.179
    eth0:2 = 206.124.146.180

STATIC NAT

If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3, you would have the following in /etc/shorewall/nat:

EXTERNAL
INTERFACE
INTERNAL
ALL INTERFACES
LOCAL

206.124.146.178
eth0
192.168.1.3
no
no

Shorewall can create the alias (additional address) for you if you set ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall 1.3.14, Shorewall can actually create the "label" (virtual interface) so that you can see the created address using ifconfig. In addition to setting ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE column as follows:

EXTERNAL
INTERFACE
INTERNAL
ALL INTERFACES
LOCAL

206.124.146.178
eth0:0
192.168.1.3
no
no

In either case, to create rules that pertain only to this NAT pair, you simply qualify the local zone with the internal IP address.

Example: You want to allow SSH from the net to 206.124.146.178 a.k.a. 192.168.1.3.

ACTION
SOURCE
DESTINATION
PROTOCOL
PORT(S)
SOURCE PORT(S)
ORIGINAL DESTINATION

ACCEPT
net
loc:192.168.1.3
tcp
22

MULTIPLE SUBNETS

Sometimes multiple IP addresses are used because there are multiple subnetworks configured on a LAN segment. This technique does not provide for any security between the subnetworks if the users of the systems have administrative privileges because in that case, the users can simply manipulate their system's routing table to bypass your firewall/router. Nevertheless, there are cases where you simply want to consider the LAN segment itself as a zone and allow your firewall/router to route between the two subnetworks.

Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254. You want to simply route all requests between the two subnetworks.

If you are running Shorewall 1.4.1 or Later

In /etc/shorewall/interfaces:

ZONE
INTERFACE
BROADCAST
OPTIONS

-
eth1
192.168.1.255,192.168.20.255

In /etc/shorewall/hosts:

ZONE
HOSTS
OPTIONS

loc
eth1:192.168.1.0/24

loc
eth1:192.168.20.0/24

Note that you do NOT need any entry in /etc/shorewall/policy as Shorewall 1.4.1 and later releases default to allowing intra-zone traffic.

If you are running Shorewall 1.4.0 or earlier

In /etc/shorewall/interfaces:

ZONE
INTERFACE
BROADCAST
OPTIONS

loc
eth1
192.168.1.255,192.168.20.255
Note 1:

Note 1: If you are running Shorewall 1.3.10 or earlier then you must specify the multi option.

In /etc/shorewall/policy:

SOURCE
DESTINATION
POLICY
LOG LEVEL
BURST:LIMIT

loc
loc
ACCEPT

Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254. You want to make these subnetworks into separate zones and control the access between them (the users of the systems do not have administrative privileges).

In /etc/shorewall/zones:

ZONE
DISPLAY
DESCRIPTION

loc
Local
Local Zone 1

loc2
Local2
Local Zone 2

In /etc/shorewall/interfaces:

ZONE
INTERFACE
BROADCAST
OPTIONS

-
eth1
192.168.1.255,192.168.20.255
Note 1:

Note 1: If you are running Shorewall 1.3.10 or earlier then you must specify the multi option.

In /etc/shorewall/hosts:

ZONE
HOSTS
OPTIONS

loc
eth1:192.168.1.0/24

loc2
eth1:192.168.20.0/24

In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic that you want to permit.

Last Updated 6/22/2003 A - Tom Eastep

ACTION	SOURCE	DESTINATION	PROTOCOL	PORT(S)	SOURCE PORT(S)	ORIGINAL DESTINATION
ACCEPT	net	fw:206.124.146.178	tcp	22

INTERFACE	SUBNET	ADDRESS
eth0:0	eth1	206.124.146.178-206.124.146.180

EXTERNAL	INTERFACE	INTERNAL	ALL INTERFACES	LOCAL
206.124.146.178	eth0	192.168.1.3	no	no

ZONE	INTERFACE	BROADCAST	OPTIONS
-	eth1	192.168.1.255,192.168.20.255

ZONE	HOSTS	OPTIONS
loc	eth1:192.168.1.0/24
loc	eth1:192.168.20.0/24

SOURCE	DESTINATION	POLICY	LOG LEVEL	BURST:LIMIT
loc	loc	ACCEPT

ZONE	DISPLAY	DESCRIPTION
loc	Local	Local Zone 1
loc2	Local2	Local Zone 2