forked from extern/shorewall_code
5d701bb601
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4805 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
59 lines
1.7 KiB
Plaintext
59 lines
1.7 KiB
Plaintext
#
|
|
# Shorewall version 3.4 - Sample Rules File for three-interface configuration.
|
|
# Copyright (C) 2006 by the Shorewall Team
|
|
#
|
|
# This library is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
# License as published by the Free Software Foundation; either
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
#
|
|
# See the file README.txt for further details.
|
|
#
|
|
# For additional information, see http://shorewall.net/Documentation.htm#Rules
|
|
#
|
|
#############################################################################################################
|
|
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/
|
|
# PORT PORT(S) DEST LIMIT GROUP
|
|
#
|
|
# Accept DNS connections from the firewall to the Internet
|
|
#
|
|
DNS/ACCEPT $FW net
|
|
#
|
|
#
|
|
# Accept SSH connections from the local network to the firewall and DMZ
|
|
#
|
|
SSH/ACCEPT loc $FW
|
|
SSH/ACCEPT loc dmz
|
|
#
|
|
# DMZ DNS access to the Internet
|
|
#
|
|
DNS/ACCEPT dmz net
|
|
|
|
|
|
# Reject Ping from the "bad" net zone.
|
|
|
|
Ping/REJECT net $FW
|
|
|
|
#
|
|
# Make ping work bi-directionally between the dmz, net, Firewall and local zone
|
|
# (assumes that the loc-> net policy is ACCEPT).
|
|
#
|
|
|
|
Ping/ACCEPT loc $FW
|
|
Ping/ACCEPT dmz $FW
|
|
Ping/ACCEPT loc dmz
|
|
Ping/ACCEPT dmz loc
|
|
Ping/ACCEPT dmz net
|
|
|
|
ACCEPT $FW net icmp
|
|
ACCEPT $FW loc icmp
|
|
ACCEPT $FW dmz icmp
|
|
|
|
# Uncomment this if using Proxy ARP and static NAT and you want to allow ping from
|
|
# the net zone to the dmz and loc
|
|
|
|
#Ping/ACCEPT net dmz
|
|
#Ping/ACCEPT net loc
|
|
|
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|