forked from extern/shorewall_code
267 lines
11 KiB
XML
267 lines
11 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<article>
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Shorewall and Ipsets</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2005</year>
|
|
|
|
<year>2008</year>
|
|
|
|
<year>2010</year>
|
|
|
|
<year>2015</year>
|
|
|
|
<year>2017</year>
|
|
|
|
<year>2019</year>
|
|
|
|
<year>2020</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<caution>
|
|
<para><emphasis role="bold">This article applies to Shorewall 4.4 and
|
|
later. If you are running a version of Shorewall earlier than Shorewall
|
|
4.4.0 then please see the documentation appropriate for your
|
|
version.</emphasis></para>
|
|
</caution>
|
|
|
|
<section id="Ipsets">
|
|
<title>What are Ipsets?</title>
|
|
|
|
<para>Ipsets are an extension to Netfilter/iptables that are available in
|
|
<ulink url="http://xtables-addons.sourceforge.net/">xtables-addons</ulink>
|
|
if they are not available in your current distribution. Instructions for
|
|
installing xtables-addons may be found in the <ulink
|
|
url="Dynamic.html">Dynamic Zones article</ulink>. Note that xtables-addons
|
|
might not be required with the 'ipset' package provided by your
|
|
distribution. See also the section <ulink
|
|
url="configuration_file_basics.htm#capabilities">capabilities</ulink> in
|
|
the <ulink url="configuration_file_basics.htm">configuration file basics
|
|
article</ulink> and the <ulink url="Shorewall-Lite.html#Shorecap">Shorecap
|
|
program</ulink>.</para>
|
|
|
|
<para>Ipset allows you to create one or more named sets of addresses then
|
|
use those sets to define Netfilter/iptables rules. Possible uses of ipsets
|
|
include:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>Blacklists. Ipsets provide an efficient way to represent large
|
|
sets of addresses and you can maintain the lists without the need to
|
|
restart or even refresh your Shorewall configuration.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Zone definition. Using the /etc/shorewall/hosts file, you can
|
|
<ulink url="Dynamic.html">define a zone based on the (dynamic)
|
|
contents of an ipset</ulink>. Again, you can then add or delete
|
|
addresses to the ipset without restarting Shorewall.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para>See the ipsets site (URL above) for additional information about
|
|
ipsets.</para>
|
|
</section>
|
|
|
|
<section id="Support">
|
|
<title>Shorewall Support for Ipsets</title>
|
|
|
|
<para>Support for ipsets was introduced in Shorewall version 2.3.0. In
|
|
most places where a host or network address may be used, you may also use
|
|
the name of an ipset prefaced by "+".</para>
|
|
|
|
<para>Example: "+Mirrors"</para>
|
|
|
|
<para>When using Shorewall, the names of ipsets are restricted as
|
|
follows:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>They must begin with a letter (after the '+').</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>They must be composed of letters, digits, dashes ("-") or
|
|
underscores ("_").</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>To generate a negative match, prefix the "+" with "!" as in
|
|
"!+Mirrors".</para>
|
|
|
|
<para>Example 1: Blacklist all hosts in an ipset named "blacklist"</para>
|
|
|
|
<para><filename>/etc/shorewall/blrules</filename><programlisting>#ACTION SOURCE DEST PROTO DPORT
|
|
DROP net:+blacklist</programlisting></para>
|
|
|
|
<para>Example 2: Allow SSH from all hosts in an ipset named "sshok:</para>
|
|
|
|
<para><filename>/etc/shorewall/rules</filename><programlisting>#ACTION SOURCE DEST PROTO DPORT
|
|
ACCEPT net:+sshok $FW tcp 22</programlisting></para>
|
|
|
|
<para>The name of the ipset can be optionally followed by a
|
|
comma-separated list of flags enclosed in square brackets ([...]). Each
|
|
flag is either <emphasis role="bold">src</emphasis> or <emphasis
|
|
role="bold">dst</emphasis> and specifies whether it is the SOURCE address
|
|
or port number or the DESTINATION address or port number that should be
|
|
matched. The number of flags must be appropriate for the type of ipset. If
|
|
no flags are given, Shorewall assumes that the set takes a single flag and
|
|
will select the flag based on the context. For example, in the blacklist
|
|
file and when the ipset appears in the SOURCE column of the rules file,
|
|
<emphasis role="bold">src</emphasis> is assumed. If the ipset appears in
|
|
the DEST column of the rules file, <emphasis role="bold">dst</emphasis> is
|
|
assumed. Note that by using <emphasis role="bold">[dst]</emphasis> in the
|
|
blacklist file, you can coerce the rule into matching the destination IP
|
|
address rather than the source.</para>
|
|
|
|
<para>Beginning with Shorewall 4.4.14, multiple source or destination
|
|
matches may be specified by placing multiple set names in '+[...]' (e.g.,
|
|
+[myset,myotherset]). When so enclosed, the set names need not be prefixed
|
|
with a plus sign. When such a list of sets is specified, matching packets
|
|
must match all of the listed sets.</para>
|
|
|
|
<para>Shorewall can save/restore your ipset contents with certain
|
|
restrictions:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>You must set SAVE_IPSETS=Yes in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall.conf</ulink> (5).</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>You must have at least one entry in the other configuration
|
|
files that uses an ipset.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>You can use an ipset in <ulink
|
|
url="manpages/shorewall-stoppedulres.html">shorewall-stoppedrules</ulink>
|
|
(5), but SAVE_IPSET={Yes|ipv4} will not save such a set during 'stop'
|
|
processing. Use Shorewall-init to save/restore your ipsets in this
|
|
case (see below).</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The <command>restore</command> command cannot restore ipset
|
|
contents saved by the <command>save</command> command unless the
|
|
firewall is first stopped.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para>Beginning with Shorewall 4.6.4, you can save selective ipsets by
|
|
setting SAVE_IPSETS to a comma-separated list of ipset names. You can also
|
|
restrict the group of sets saved to ipv4 sets by setting
|
|
SAVE_IPSETS=ipv4.</para>
|
|
|
|
<para>With Shorewall 4.6.4, the SAVE_IPSETS option may specify a list of
|
|
ipsets to be saved. When such a list is specified, only those ipsets
|
|
together with the ipsets supporting dynamic zones are saved. Shorewall6
|
|
support for the SAVE_IPSETS option was also added in 4.6.4. When
|
|
SAVE_IPSETS=Yes in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall6.conf(5)</ulink>, only ipv6
|
|
ipsets are saved. For Shorewall, if SAVE_IPSETS=ipv4 in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>, then only
|
|
ipv4 ipsets are saved. Both features require ipset version 5 or
|
|
later.</para>
|
|
|
|
<caution>
|
|
<para>After setting SAVE_IPSETS, it is important to recompile the
|
|
firewall script (e.g., 'shorewall compile', 'shorewall reload' or
|
|
'shorewall restart') before rebooting</para>
|
|
</caution>
|
|
|
|
<para>Although Shorewall can save the definition of your ipsets and
|
|
restore them when Shorewall starts, in most cases you must use the ipset
|
|
utility to initially create and load your ipsets. The exception is that
|
|
Shorewall will automatically create an empty iphash ipset to back each
|
|
dynamic zone. It will also create the ipset required by the
|
|
DYNAMIC_BLACKLIST=ipset:.. setting in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall[6].conf(5)</ulink>,</para>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Shorewall6 and Shorewall-init Support for Ipsets</title>
|
|
|
|
<para>Ipset support in Shorewall6 was added in Shorewall 4.4.21.</para>
|
|
|
|
<para>Beginning with Shorewall 4.6.4, SAVE_IPSETS is available in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall6-conf(5)</ulink>. When set to
|
|
Yes, the ipv6 ipsets will be saved. You can also save selective ipsets by
|
|
setting SAVE_IPSETS to a comma-separated list of ipset names.</para>
|
|
|
|
<para>Prior to Shorewall 4.6.4, SAVE_IPSETS=Yes in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink> won't work
|
|
correctly because it saves both IPv4 and IPv6 ipsets. To work around this
|
|
issue, Shorewall-init is capable restoring ipset contents during 'start'
|
|
and saving them during 'stop'. To direct Shorewall-init to save/restore
|
|
ipset contents, set the SAVE_IPSETS option in
|
|
/etc/sysconfig/shorewall-init (/etc/default/shorewall-init on Debian and
|
|
derivatives). The value of the option is a file name where the contents of
|
|
the ipsets will be save to and restored from. Shorewall-init will create
|
|
any necessary directories during the first 'save' operation.</para>
|
|
|
|
<caution>
|
|
<para>If you set SAVE_IPSETS in /etc/sysconfig/shorewall-init
|
|
(/etc/default/shorewall-init on Debian and derivatives) when
|
|
shorewall-init has not been started by systemd, then when the system is
|
|
going down during reboot, the ipset contents will not be saved. You can
|
|
work around that as follows:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Suppose that you have set
|
|
SAVE_IPSETS=/var/lib/shorewall/init-save-ipsets.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Before rebooting, execute this command:</para>
|
|
|
|
<programlisting>ipset save > /var/lib/shorewall/init-save-ipsets</programlisting>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Be sure to enable shoewall-init (e.g., <emphasis
|
|
role="bold">systemctl enable shorewall-init</emphasis>).</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</caution>
|
|
|
|
<para>If you configure Shorewall-init to save/restore ipsets, be sure to
|
|
set SAVE_IPSETS=No in shorewall.conf and shorewall6.conf.</para>
|
|
|
|
<para>If you configure SAVE_IPSETS in <ulink
|
|
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink> and/or <ulink
|
|
url="manpages/shorewall.conf.html">shorewall6.conf(5)</ulink> then do not
|
|
set SAVE_IPSETS in shorewall-init.</para>
|
|
</section>
|
|
</article>
|