Standalone Firewall
Tom
Eastep
2002-2006
Thomas M. Eastep
Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
GNU Free Documentation
License
.
This article applies to Shorewall 3.0 and
later. If you are running a version of Shorewall earlier than Shorewall
3.0.0 then please see the documentation for that
release.
Do not attempt to install Shorewall on a
remote system. You are virtually assured to lock yourself out of that
system.
Introduction
Setting up Shorewall on a standalone Linux system is very easy if
you understand the basics and follow the documentation.
This guide doesn't attempt to acquaint you with all of the features
of Shorewall. It rather focuses on what is required to configure Shorewall
in one of its most common configurations:
Linux system
Single external IP address
Connection through Cable Modem, DSL,
ISDN, Frame Relay, dial-up... or connected to a
LAN and you simply wish to protect your Linux
system from other systems on that LAN.
System Requirements
Shorewall requires that you have the
iproute/iproute2 package installed
(on RedHat, the package is called
iproute). You can tell if this package is installed
by the presence of an ip program on your firewall
system. As root, you can use the which command to
check for this program:
[root@gateway root]# which ip
/sbin/ip
[root@gateway root]#
Before you start
I recommend that you read through the guide first to familiarize
yourself with what's involved then go back through it again making your
configuration changes.
If you edit your configuration files on a
Windows system, you must save them as
Unix files if your editor supports that option
or you must run them through dos2unix before trying
to use them. Similarly, if you copy a configuration file from your
Windows hard drive to a floppy disk, you must
run dos2unix against the copy before using it with
Shorewall.
Windows
Version of dos2unix
Linux
Version of dos2unix
Conventions
Points at which configuration changes are recommended are flagged
with .
PPTP/ADSL
If you have an ADSL Modem and you use
PPTP to communicate with a server in that modem, you
must make the changes recommended here in addition to those detailed below.
ADSL with PPTP is most commonly
found in Europe, notably in Austria.
Shorewall Concepts
The configuration files for Shorewall are contained in the directory
/etc/shorewall -- for simple
setups, you only need to deal with a few of these as described in this
guide. After you have installed
Shorewall, you can find the Samples as follows:
If you installed using an RPM, the samples
will be in the Samples/one-interface subdirectory of the
Shorewall documentation directory. If you don't know where the
Shorewall documentation directory is, you can find the samples using
this command:
~# rpm -ql shorewall | fgrep one-interface
/usr/share/doc/packages/shorewall/Samples/one-interface
/usr/share/doc/packages/shorewall/Samples/one-interface/interfaces
/usr/share/doc/packages/shorewall/Samples/one-interface/policy
/usr/share/doc/packages/shorewall/Samples/one-interface/rules
/usr/share/doc/packages/shorewall/Samples/one-interface/zones
~#
If you installed using the tarball, the samples are in the
Samples/one-interface directory
in the tarball.
If you installed using the .deb, the samples are in /usr/share/doc/shorewall/examples/one-interface.
Note to Debian Users
If you install using the .deb, you will find that your /etc/shorewall directory is empty. This is
intentional. The released configuration file skeletons may be found on
your system in the directory /usr/share/doc/shorewall/default-config.
Simply copy the files you need from that directory to /etc/shorewall and modify the
copies.
Note that you must copy /usr/share/doc/shorewall/default-config/shorewall.conf
and /usr/share/doc/shorewall/default-config/modules
to /etc/shorewall even if you do
not modify those files.
If you are installing Shorewall version 3.4.0 or later then as each
file is introduced, I suggest that you look at the actual file on your
system and that you look at the man page for that
file. For example, to look at the man page for the
/etc/shorewall/zones file, type man
shorewall-zones at a shell prompt.
If you are installing a Shorewall version earlier than 3.4.0, then
as each file is introduced, I suggest that you look through the actual
file on your system -- each file contains detailed configuration
instructions and default entries.
Shorewall views the network where it is running as being composed of
a set of zones. In the one-interface sample
configuration, only two zones are defined:
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
Shorewall zones are defined in /etc/shorewall/zones.
Note that Shorewall recognizes the firewall system as its own zone.
When the /etc/shorewall/zones file is processed, the
name of the firewall zone (fw
in the above example) is
stored in the shell variable $FW which may be used
to refer to the firewall zone throughout the Shorewall
configuration.
Rules about what traffic to allow and what traffic to deny are
expressed in terms of zones.
You express your default policy for connections from one zone to
another zone in the /etc/shorewall/policy
file.
You define exceptions to those default policies in the /etc/shorewall/rules
file.
For each connection request entering the firewall, the request is
first checked against the
/etc/shorewall/rules file. If no
rule in that file matches the connection request then the first policy in
/etc/shorewall/policy that matches the request is
applied. If there is a comon
action defined for the policy in
/etc/shorewall/actions or
/usr/share/shorewall/actions.std then that action is
peformed before the policy is applied. The purpose of the common action is
two-fold:
It silently drops or rejects harmless common traffic that would
otherwise clutter up your log — Broadcasts for example.
If ensures that traffic critical to correct operation is allowed
through the firewall — ICMP fragmentation-needed
for example.
The /etc/shorewall/policy file included with
the one-interface sample has the following policies:
#SOURCE ZONE DESTINATION ZONE POLICY LOG LEVEL LIMIT:BURST
$FW net ACCEPT
net all DROP info
all all REJECT info
The above policy will:
allow all connection requests from the firewall to the
internet
drop (ignore) all connection requests from the internet to your
firewall
reject all other connection requests (Shorewall requires this
catchall policy).
At this point, edit your /etc/shorewall/policy
and make any changes that you wish.
External Interface
The firewall has a single network interface. Where Internet
connectivity is through a cable or DSL
Modem
, the External Interface will be
the ethernet adapter (eth0) that
is connected to that Modem
unless you connect via
Point-to-Point Protocol over Ethernet
(PPPoE) or Point-to-Point Tunneling
Protocol (PPTP) in which case the External
Interface will be a PPP interface (e.g., ppp0). If you connect via a regular modem,
your External Interface will also be ppp0. If you connect using
ISDN, your external interface will be ippp0.
Be sure you know which interface is your external interface. Many
hours have been spent floundering by users who have configured the wrong
interface. If you are unsure, then as root type ip route
ls at the command line. The device listed in the last
(default) route should be your external interface.
Example:
root@lists:~# ip route ls
192.168.2.2 dev tun0 proto kernel scope link src 192.168.2.1
10.13.10.0/24 dev tun1 scope link
192.168.2.0/24 via 192.168.2.2 dev tun0
206.124.146.0/24 dev eth0 proto kernel scope link src 206.124.146.176
10.10.10.0/24 dev tun1 scope link
default via 206.124.146.254 dev eth0
root@lists:~#
In that example, eth0 is
the external interface.
The Shorewall one-interface sample configuration assumes that the
external interface is eth0. If
your configuration is different, you will have to modify the sample
/etc/shorewall/interfaces file accordingly. While you
are there, you may wish to review the list of options that are specified
for the interface. Some hints:
If your external interface is ppp0 or ippp0, you can replace the
detect
in the second column with -
(minus
the quotes).
If your external interface is ppp0 or ippp0 or if you have a static IP address,
you can remove dhcp
from the option list.
IP Addresses
Before going further, we should say a few words about
Internet Protocol (IP) addresses.
Normally, your Internet Service Provider
(ISP) will assign you a single IP
address. That address can be assigned statically, by the Dynamic
Host Configuration Protocol (DHCP), through
the establishment of your dial-up connection, or during establishment of
your other type of PPP (PPPoA,
PPPoE, etc.) connection.
RFC-1918 reserves several
Private IP address ranges for use
in private networks:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
These addresses are sometimes referred to as
non-routable because the Internet backbone routers
will not forward a packet whose destination address is reserved by
RFC-1918. In some cases though,
ISPs are assigning these addresses then using
Network Address Translation -
NAT) to rewrite packet headers when
forwarding to/from the internet.
Before starting Shorewall, you should look at
the IP address of your external interface and if it is in one of the above
ranges, you should remove the norfc1918
option from the
entry in /etc/shorewall/interfaces.
To determine the IP address of your external interface, as root
type ip addr ls dev <interface> at the
command line where <interface> is your
external interface. The line beginning with inet
identifies your IP address.
Example:
root@lists:~# ip addr ls dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc htb qlen 1000
link/ether 00:02:e3:08:48:4c brd ff:ff:ff:ff:ff:ff
inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0
inet6 fe80::202:e3ff:fe08:484c/64 scope link
valid_lft forever preferred_lft forever
root@lists:~#
In this example, the IP address of the external interface is
206.124.146.176
Enabling other Connections
Shorewall includes a collection of macros that can be used to
quickly allow or deny services. You can find a list of the macros included
in your version of Shorewall using the command ls
/usr/share/shorewall/macro.*.
If you wish to enable connections from the internet to your firewall
and you find an appropriate macro in
/etc/shorewall/macro.*, the general format of a rule
in /etc/shorewall/rules is:
#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
<macro>/ACCEPT net $FW
Be sure to add your rules after the line that reads SECTION NEW.
You want to run a Web Server and a IMAP Server on your firewall
system:
#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
Web/ACCEPT net $FW
IMAP/ACCEPT net $FW
You may also choose to code your rules directly without using the
pre-defined macros. This will be necessary in the event that there is not
a pre-defined macro that meets your requirements. In that case the general
format of a rule in /etc/shorewall/rules is:
#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT net $FW <protocol> <port>
You want to run a Web Server and a IMAP Server on your firewall
system:
#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT net $FW tcp 80
ACCEPT net $FW tcp 143
If you don't know what port and protocol a particular application
uses, see here.
I don't recommend enabling telnet to/from the internet because it
uses clear text (even for login!). If you want shell access to your
firewall from the internet, use SSH:
#ACTION SOURCE DESTINATION PROTO DEST PORT(S)
SSH/ACCEPT net $FW
At this point, edit /etc/shorewall/rules to add
other connections as desired.
Starting and Stopping Your Firewall
The installation procedure
configures your system to start Shorewall at system boot but startup is
disabled so that your system won't try to start Shorewall before
configuration is complete. Once you have completed configuration of your
firewall, you must edit /etc/shorewall/shorewall.conf and set
STARTUP_ENABLED=Yes.
Users of the .deb package must edit
/etc/default/shorewall and set
STARTUP=1.
You must enable startup by editing
/etc/shorewall/shorewall.conf and setting
STARTUP_ENABLED=Yes.
The firewall is started using the shorewall
start
command and stopped using
shorewall stop
. When the firewall is
stopped, routing is enabled on those hosts that have an entry in
/etc/shorewall/routestopped.
A running firewall may be restarted using the shorewall
restart
command. If you want to totally remove any trace
of Shorewall from your Netfilter configuration, use
shorewall clear
.
If you are connected to your firewall from the internet, do not
issue a shorewall stop
command unless
you have added an entry for the IP address that you are connected from
to /etc/shorewall/routestopped.
Also, I don't recommend using shorewall
restart
; it is better to create an alternate
configuration and test it using the shorewall
try
command.
If it Doesn't Work
Re-check each of the items flagged with a red arrow
above.
Check your log.
Check the Troubleshooting
Guide.
Check the FAQ.
Additional Recommended Reading
I highly recommend that you review the Common Configuration File Features
page -- it contains helpful tips about Shorewall features than
make administering your firewall easier.
Revision History
2.0
2005-09-12
TE
More 3.0 Updates
1.9
2005-09-02
CR
Update for Shorewall 3.0
1.8
2005-07-12
TE
Change reference to rfc1918 to bogons.
1.7
2004-02-16
TE
Move /etc/shorewall/rfc1918 to
/usr/share/shorewall.
1.6
2004-02-05
TE
Update for Shorewall 2.0
1.5
2004-01-05
TE
Standards Changes
1.4
2003-12-30
TE
Add tip about /etc/shorewall/rfc1918 updates.
1.3
2003-11-15
TE
Initial Docbook Conversion