Difference between revisions of "Bering-uClibc 4.x - User Guide - IPv4 Networking - Configure Shorewall"

From bering-uClibc
Jump to: navigation, search
(Created from http://leaf.sourceforge.net/doc/buci-shorwall3.html)
 
m (adjust documentation link and shorewall configuration screen)
Line 16: Line 16:
 
* [http://www.shorewall.net/ Shorewall] is an [http://www.netfilter.org/ iptables] based firewall which offers many features (Masquerading/SNAT, Port forwarding, Static NAT, Proxy ARP, VPN support, Traffic Control/Shaping) which are described in greater detail [http://www.shorewall.net/shorewall_features.htm here.]
 
* [http://www.shorewall.net/ Shorewall] is an [http://www.netfilter.org/ iptables] based firewall which offers many features (Masquerading/SNAT, Port forwarding, Static NAT, Proxy ARP, VPN support, Traffic Control/Shaping) which are described in greater detail [http://www.shorewall.net/shorewall_features.htm here.]
 
* It is a very powerful tool with which it is "simple to do simple things" but which also offers a great flexibility.
 
* It is a very powerful tool with which it is "simple to do simple things" but which also offers a great flexibility.
* It is very well documented. I strongly recommend that you print out the full documentation available in pdf format in the Shorewall [http://www.shorewall.net/pub/shorewall download area] and that you spend the time to understand the concept behind it. A worthwhile effort !
+
* It is very well documented. We strongly recommend that you have a look at the full documentation available at [http://shorewall.net/Documentation.html shorewall.net] and that you spend the time to understand the concept behind it. A worthwhile effort !
 
* It has a nice [http://www.shorewall.net/shorewall_quickstart_guide.htm QuickStart Guide] which will allow the reader to quickly grasp the basics. A prerequisite reading!
 
* It has a nice [http://www.shorewall.net/shorewall_quickstart_guide.htm QuickStart Guide] which will allow the reader to quickly grasp the basics. A prerequisite reading!
 
* It has a tremendous support from it's developer, Tom Eastep, who replies very quickly to requests addressed to the [http://www.shorewall.net/mailing_list.htm shorewall user's mailing list]. Mail archives are also available and searchable.
 
* It has a tremendous support from it's developer, Tom Eastep, who replies very quickly to requests addressed to the [http://www.shorewall.net/mailing_list.htm shorewall user's mailing list]. Mail archives are also available and searchable.
Line 28: Line 28:
 
  3) Zones    Partition the network into Zones
 
  3) Zones    Partition the network into Zones
 
  4) Ifaces    Shorewall Networking Interfaces
 
  4) Ifaces    Shorewall Networking Interfaces
  5) Ipsec    Define Zone IPSEC Properties
+
  5) Hosts    Define specific zones
6) Hosts    Define specific zones
+
  6) Policy    Firewall high-level policy
  7) Policy    Firewall high-level policy
+
  7) Rules    Exceptions to policy
  8) Rules    Exceptions to policy
+
  8) Masq      Internal MASQ Server Configuration
  9) Maclist  MAC Verification
+
  9) RStopped  Hosts admitted after 'shorewall stop'
10) Masq      Internal MASQ Server Configuration
+
  10) Nat      Static NAT Configuration
  11) ProxyArp  Proxy ARP Configuration
+
  11) Config    Shorewall Global Parameters
12) RStopped  Hosts admitted after 'shorewall stop'
+
  12) Modules  Netfilter modules to load
  13) Nat      Static NAT Configuration
+
  13) TOS      Type of Service policy
  14) Tunnels  Tunnel Definition (ipsec)
+
  14) Blacklist Blacklisted hosts
15) TCDevices
+
  15) ECN      Disable ECN to hosts and networks
16) TCClasses
+
  16) Init      Commands executed before [re]start
17) TCRules  FWMark Rules
+
  17) Initdone    Commands executed during [re]start
18) Config    Shorewall Global Parameters
+
18) Start    Commands executed after [re]start
  19) Modules  Netfilter modules to load
+
  19) Started    Commands executed after complete [re]start
  20) TOS      Type of Service policy
+
20) Stop      Commands executed before stop
  21) Blacklist Blacklisted hosts
+
  21) Stopped  Commands executed after stop
  22) ECN      Disable ECN to hosts and networks
+
  22) Actions  Define user actions
  23) Init      Commands executed before [re]start
+
23) Netmap    Network Mapping Table
  24) Start    Commands executed after [re]start
+
24) Route_rules Routing to providers
  25) Stop      Commands executed before stop
+
25) Tunnels  Tunnel Definition (ipsec
  26) Stopped  Commands executed after stop
+
26) Account  Traffic Accounting Rules
  27) Account  Traffic Accounting Rules
+
  27) TCClasses  Define htb classes
  28) Actions  Define user actions
+
  28) TCDevices Specify speed of devices for traffic shaping
  29) Continue Commands executed early in [re]start
+
  29) TCFilters   Classify traffic for shaping
  30) Netmap   Network Mapping Table
+
30) TCInterfaces  Devices for simplified traffic shaping
  31) Providers Additional routing tables
+
  31) TCPri Classify traffic for simplified traffic shaping
 +
32) TCRules  FWMark Rules
 +
33) Maclist  MAC Verification
 +
34) Providers Additional routing table
 +
35) ProxyArp  Proxy ARP Configuration
 +
36) Notrack  Exclude traffic from connection tracking
 +
 
   
 
   
 
   q) quit
 
   q) quit

Revision as of 18:26, 4 January 2011

IPv4 Networking - Configure Shorewall
Prev Bering-uClibc 4.x - User Guide Next


This material copied directly from http://leaf.sourceforge.net/doc/buci-shorwall3.html - needs to be checked/updated for Bering-uClibc 4.x!
Davidmbrooke 19:39, 8 November 2010 (UTC)

One of the distinctive feature of LEAF Bering-uClibc (introduced with Bering) is that it relies on Shorewall to provide its firewall facility.

The reasons behind this choice are numerous:

  • Shorewall is an iptables based firewall which offers many features (Masquerading/SNAT, Port forwarding, Static NAT, Proxy ARP, VPN support, Traffic Control/Shaping) which are described in greater detail here.
  • It is a very powerful tool with which it is "simple to do simple things" but which also offers a great flexibility.
  • It is very well documented. We strongly recommend that you have a look at the full documentation available at shorewall.net and that you spend the time to understand the concept behind it. A worthwhile effort !
  • It has a nice QuickStart Guide which will allow the reader to quickly grasp the basics. A prerequisite reading!
  • It has a tremendous support from it's developer, Tom Eastep, who replies very quickly to requests addressed to the shorewall user's mailing list. Mail archives are also available and searchable.

To configure Shorewall, start the LEAF packages configuration menu and choose shorwall. The following menu will appear:

                        shorwall configuration files

1) Shorewall Runtime Startup options
2) Params    Assign parameter values
3) Zones     Partition the network into Zones
4) Ifaces    Shorewall Networking Interfaces
5) Hosts     Define specific zones
6) Policy    Firewall high-level policy
7) Rules     Exceptions to policy
8) Masq      Internal MASQ Server Configuration
9) RStopped  Hosts admitted after 'shorewall stop'
10) Nat       Static NAT Configuration
11) Config    Shorewall Global Parameters
12) Modules   Netfilter modules to load
13) TOS       Type of Service policy
14) Blacklist Blacklisted hosts
15) ECN       Disable ECN to hosts and networks
16) Init      Commands executed before [re]start
17) Initdone     Commands executed during [re]start
18) Start     Commands executed after [re]start
19) Started     Commands executed after complete [re]start
20) Stop      Commands executed before stop
21) Stopped   Commands executed after stop
22) Actions   Define user actions
23) Netmap    Network Mapping Table
24) Route_rules Routing to providers
25) Tunnels   Tunnel Definition (ipsec
26) Account   Traffic Accounting Rules
27) TCClasses  Define htb classes
28) TCDevices  Specify speed of devices for traffic shaping
29) TCFilters    Classify traffic for shaping
30) TCInterfaces  Devices for simplified traffic shaping
31) TCPri Classify traffic for simplified traffic shaping
32) TCRules   FWMark Rules
33) Maclist   MAC Verification
34) Providers Additional routing table
35) ProxyArp  Proxy ARP Configuration
36) Notrack  Exclude traffic from connection tracking


  q) quit
  ----------------------------------------------------------------------------
        Selection:

Check the hyperlinks above, the Quickstart Guide or the Shorewall documentation to have a full explanation on those configuration files.

Four files must be checked absolutely to make sure they fit your needs:

A) The zone file (entry 2). For a two interfaces setting - Bering-uClibc's default - it looks like:

 #ZONE   DISPLAY         COMMENTS
 net     Net             Internet
 loc     Local           Local networks
 #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

B) The interfaces file (entry 3) defines your interfaces. Default in Bering-uClibc is:

 (...)
 #ZONE   INTERFACE       BROADCAST       OPTIONS
 net     eth0            detect          dhcp,routefilter,norfc1918
 loc     eth1            detect
 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
 

C) The rules file (entry 6) is one of the most important files in Shorewall. Here is the one from Bering-uClibc:

 (...)
 ######################################################################################################
 #ACTION  SOURCE         DEST            PROTO   DEST    SOURCE     ORIGINAL     RATE            USER/
 #                                               PORT    PORT(S)    DEST         LIMIT           GROUP
 #                                               PORT    PORT(S)    DEST         LIMIT
 #      Accept DNS connections from the firewall to the network
 #      and from the local network to the firewall (in case dnsmasq is           DNS/ACCEPT   fw          net
 DNS/ACCEPT   loc         fw

 #      Accept SSH connections from the local network for administrati
 #
 SSH/ACCEPT   loc         fw

 #      Allow Ping to Firewall                                                   #
 Ping/ACCEPT  net         fw
 Ping/ACCEPT  loc         fw

 #      Allow all ICMP types (including ping) from firewall
 ACCEPT    fw           loc                     icmp
 ACCEPT    fw           net                     icmp
 #      Allow local network to access weblet/webconf
 #
 Web/ACCEPT   loc        fw
 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Important: If you change any of the shorewall parameters, remember to save your configuration!



Prev Up Next