forked from extern/shorewall_code
219 lines
7.8 KiB
XML
219 lines
7.8 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<article>
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Shorewall and Linux-vserver</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2010</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<section>
|
|
<title>Introduction</title>
|
|
|
|
<para>Formal support for Linux-vserver was added in Shorewall 4.4.11
|
|
Beta2. The centerpiece of that support is the
|
|
<firstterm>vserver</firstterm> zone type. Vserver zones have the following
|
|
characteristics:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>They are defined on the Linux-vserver host.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The $FW zone is their implicit parent.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Their contents must be defined using the <ulink
|
|
url="manpages/shorewall-hosts.html">shorewall-hosts </ulink>(5) file.
|
|
The <emphasis role="bold">ipsec</emphasis> option may not be
|
|
specified.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>They may not appear in the ZONE column of the <ulink
|
|
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
|
|
(5) file.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Note that you don't need to run Vservers to use vserver zones; they
|
|
may also be used to create a firewall sub-zone for each <ulink
|
|
url="Shorewall_and_Aliased_Interfaces.html">aliased
|
|
interface</ulink>.</para>
|
|
|
|
<para>If you use these zones, keep in mind that Linux-vserver implements a
|
|
very weak form of network virtualization:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>From a networking point of view, vservers live on the host
|
|
system. So if you don't use care, Vserver traffic to/from zone z will
|
|
be controlled by the fw->z and z->fw rules and policies rather
|
|
than by vserver->z and z->vserver rules and policies.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Outgoing connections from a vserver will not use the Vserver's
|
|
address as the SOURCE IP address unless you configure applications
|
|
running in the Vserver properly. This is especially true for IPv6
|
|
applications. Such connections will appear to come from the $FW zone
|
|
rather than the intended Vserver zone.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>While you can define the vservers to be associated with the
|
|
network interface where their IP addresses are added at vserver
|
|
startup time, Shorewall internally associates all vservers with the
|
|
loopback interface (<emphasis role="bold">lo</emphasis>). Here's an
|
|
example of how that association can show up:</para>
|
|
|
|
<programlisting>gateway:~# shorewall show zones
|
|
Shorewall 4.4.11-Beta2 Zones at gateway - Fri Jul 2 12:26:30 PDT 2010
|
|
|
|
fw (firewall)
|
|
drct (ipv4)
|
|
eth4:+drct_eth4
|
|
loc (ipv4)
|
|
eth4:0.0.0.0/0
|
|
net (ipv4)
|
|
eth1:0.0.0.0/0
|
|
vpn (ipv4)
|
|
tun+:0.0.0.0/0
|
|
dmz (<emphasis role="bold">vserver</emphasis>)
|
|
<emphasis role="bold">lo</emphasis>:70.90.191.124/31
|
|
|
|
gateway:~#</programlisting>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Vserver Zones</title>
|
|
|
|
<para>This is a diagram of the network configuration here at Shorewall.net
|
|
during the summer of 2010:</para>
|
|
|
|
<graphic align="center" fileref="images/Network2010a.png" />
|
|
|
|
<para>I created a zone for the vservers as follows:</para>
|
|
|
|
<para><filename>/etc/shorewall/zones</filename>:</para>
|
|
|
|
<programlisting>#ZONE TYPE OPTIONS ...
|
|
fw firewall
|
|
loc ip #Local Zone
|
|
drct:loc ipv4 #Direct internet access
|
|
net ipv4 #Internet
|
|
vpn ipv4 #OpenVPN clients
|
|
<emphasis role="bold">dmz vserver #Vservers</emphasis></programlisting>
|
|
|
|
<para><filename>/etc/shorewall/interfaces</filename>:</para>
|
|
|
|
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
|
<emphasis role="bold">net eth1 detect dhcp,optional,routefilter=0,logmartians,proxyarp=0,nosmurfs,upnp</emphasis>
|
|
...</programlisting>
|
|
|
|
<para><filename>/etc/shorewall/hosts</filename>:</para>
|
|
|
|
<programlisting>#ZONE HOST(S) OPTIONS
|
|
drct eth4:dynamic
|
|
<emphasis role="bold">dmz eth1:70.90.191.124/31</emphasis></programlisting>
|
|
|
|
<para>While the IP addresses 70.90.191.124 and 70.90.191.125 are
|
|
configured on eth1, the actual interface name is irrelevate so long as the
|
|
interface is defined in <ulink
|
|
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink> (5).
|
|
Shorewall will consider all vserver zones to be associated with the
|
|
loopback interface (<emphasis role="bold">lo</emphasis>).</para>
|
|
|
|
<para>Once a vserver zone is defined, it can be used like any other zone
|
|
type.</para>
|
|
|
|
<para>Here is the corresponding IPv6 configuration.</para>
|
|
|
|
<para><filename>/etc/shorewall6/zones</filename></para>
|
|
|
|
<programlisting>#ZONE TYPE OPTIONS IN OUT
|
|
# OPTIONS OPTIONS
|
|
fw firewall
|
|
net ipv6
|
|
loc ipv6
|
|
vpn ipv6
|
|
<emphasis role="bold">dmz vserver</emphasis>
|
|
</programlisting>
|
|
|
|
<para><filename>/etc/shorewall6/interfaces</filename>:</para>
|
|
|
|
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
|
<emphasis role="bold">net sit1 detect tcpflags,forward=1,nosmurfs,routeback</emphasis>
|
|
...</programlisting>
|
|
|
|
<para><filename>/etc/shorewall6/hosts</filename>:</para>
|
|
|
|
<programlisting>#ZONE HOST(S) OPTIONS
|
|
<emphasis role="bold">dmz sit1:[2001:470:e857:1::/64]</emphasis></programlisting>
|
|
|
|
<para>Note that I choose to place the Vservers on sit1 (the IPv6 net
|
|
interface) rather than on eth1. Again, it really doesn't matter
|
|
much.</para>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Sharing an IPv6 /64 between Vservers and a LAN</title>
|
|
|
|
<para>I have both a /64 (2001:470:b:227::/64) and a /48
|
|
(2001:470:e857::/48) from <ulink
|
|
url="http://www.tunnelbroker.net">Hurricane Electric</ulink>. When I first
|
|
set up my Vserver configuration, I assigned addresses from the /48 to the
|
|
Vservers as shown above.</para>
|
|
|
|
<para>Given that it is likely that when native IPv6 is available from my
|
|
ISP, I will only be able to afford a single /64, in February 2011 I
|
|
decided to migrate my vservers to the /68. This was possible because of
|
|
Proxy NDP support in Shorewall 4.4.16 and later. The new network diagram
|
|
is as shown below:</para>
|
|
|
|
<graphic align="center" fileref="images/Network2011.png" />
|
|
|
|
<para>This change was accompanied by the following additions to
|
|
<filename>/etc/shorewall6/proxyndp</filename>:</para>
|
|
|
|
<programlisting>#ADDRESS INTERFACE EXTERNAL HAVEROUTE PERSISTENT
|
|
2001:470:b:227::2 - eth4 Yes Yes
|
|
2001:470:b:227::3 - eth4 Yes Yes
|
|
</programlisting>
|
|
|
|
<para>These two entries allow the firewall to respond to NDP requests for
|
|
the two Vserver IPv6 addresses received on interface eth4.</para>
|
|
</section>
|
|
</article>
|