forked from extern/shorewall_code
147 lines
4.9 KiB
XML
147 lines
4.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<article>
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Shorewall and Linux-vserver</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2010</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<section>
|
|
<title>Introduction</title>
|
|
|
|
<para>Formal support for Linux-vserver was added in Shorewall 4.4.11
|
|
Beta2. The centerpiece of that support is the
|
|
<firstterm>vserver</firstterm> zone type. Vserver zones have the following
|
|
characteristics:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>They are defined on the Linux-vserver host.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The $FW zone is their implicit parent.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Their contents must be defined using the <ulink
|
|
url="manpages/shorewall-hosts.html">shorewall-hosts </ulink>(5)
|
|
file.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>They may not appear in the ZONE column of the <ulink
|
|
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
|
|
(5) file.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>If you use these zones, keep in mind that Linux-vserver implements a
|
|
very weak form of network virtualization:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>From a networking point of view, vservers live on the host
|
|
system. So if you don't use care, Vserver traffic to/from zone z will
|
|
be controlled by the fw->z and z->fw rules and policies rather
|
|
than by vserver->z and z->vserver rules and policies.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Outgoing connections from a vserver will not use the Vserver's
|
|
address as the SOURCE IP address unless you configure applications
|
|
running in the Vserver properly. This is especially true for IPv6
|
|
applications. Such connections will appear to come from the $FW zone
|
|
rather than the intended Vserver zone.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Vserver Zones</title>
|
|
|
|
<para>Here is a diagram of the network configuration here at Shorewall.net
|
|
during the summer of 2010:</para>
|
|
|
|
<graphic align="center" fileref="images/Network2010a.png" />
|
|
|
|
<para>I created a zone for the vservers as follows:</para>
|
|
|
|
<para><filename>/etc/shorewall/zones</filename>:</para>
|
|
|
|
<programlisting>#ZONE TYPE OPTIONS ...
|
|
fw firewall
|
|
loc ip #Local Zone
|
|
drct:loc ipv4 #Direct internet access
|
|
net ipv4 #Internet
|
|
vpn ipv4 #OpenVPN clients
|
|
<emphasis role="bold">dmz vserver #Vservers</emphasis></programlisting>
|
|
|
|
<para><filename>/etc/shorewall/hosts</filename>:</para>
|
|
|
|
<programlisting>#ZONE HOST(S) OPTIONS
|
|
drct eth3:dynamic
|
|
<emphasis role="bold">dmz eth1:70.90.191.124/31</emphasis></programlisting>
|
|
|
|
<para>While the IP addresses 70.90.191.124 and 70.90.191.125 are
|
|
configured on eth1, the actual interface name is irrelevate so long as the
|
|
interface is defined in <ulink
|
|
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink> (5).
|
|
Shorewall will consider all vserver zones to be associated with the
|
|
loopback interface (<emphasis role="bold">lo</emphasis>).</para>
|
|
|
|
<para>Once a vserver zone is defined, it can be used like any other zone
|
|
type.</para>
|
|
|
|
<para>Here is the corresponding IPv6 configuration.</para>
|
|
|
|
<para><filename>/etc/shorewall6/zones</filename></para>
|
|
|
|
<programlisting>#ZONE TYPE OPTIONS IN OUT
|
|
# OPTIONS OPTIONS
|
|
fw firewall
|
|
net ipv6
|
|
loc ipv6
|
|
vpn ipv6
|
|
<emphasis role="bold">dmz vserver</emphasis>
|
|
</programlisting>
|
|
|
|
<para><filename>/etc/shorewall6/hosts</filename>:</para>
|
|
|
|
<programlisting>#ZONE HOST(S) OPTIONS
|
|
dmz sit1:[2001:470:e857:1::/64]</programlisting>
|
|
|
|
<para>Note that I choose to place the Vservers on sit1 (the IPv6 net
|
|
interface) rather than on eth1. Again, it really doesn't matter
|
|
much.</para>
|
|
</section>
|
|
</article>
|