Shorewall on RPM-based Servers
|
Alteeve Wiki :: How To :: Shorewall on RPM-based Servers |
This covers setup and maintenance of Shorewall 4.5 on Red Hat Enterprise Linux 5.x, 6.x, RHEL derivatives and several recent Fedora releases.
Install
 |
Note: Updated on 2015-05-05 for Shorewall release 4.6.8. |
Install is trivial, we just need to install dependencies and and the latest RPMs.
yum install perl perl-Digest-SHA perl-Digest-SHA1
You can check for the latest version here.
rpm -Uvh http://canada.shorewall.net/pub/shorewall/4.6/shorewall-4.6.8/shorewall-core-4.6.8-0base.noarch.rpm \
http://canada.shorewall.net/pub/shorewall/4.6/shorewall-4.6.8/shorewall-4.6.8-0base.noarch.rpm
Done!
Setup
You need to decide which interface will have your internet connection on it and which will connect to your internal network. For this tutorial;
- eth0; Faces the internal network, has the IP 10.255.255.254/16 and provides DHCP services to the LAN.
- eth1; Faces the Internet.
Configuring Shorewall
All configuration files are in the /etc/shorewall directory, unless explicitly defined. The main Shorewall configuration file, which we will edit last is /etc/shorewall/shorewall.conf.
The files to edit are listed in the order we will edit them in the following subsections.
zones
This controls the main "zones" used by Shorewall. The fw is special in that it defines the firewall itself. The net zone is the Internet-facing network (eth1 in this tutorial). The loc is the local network, the internal network of machines the firewall is protecting, which is eth0 in this tutorial. Both eth0 and eth1 are ipv4 networks.
Append two new lines telling shorewall that we have two new ipv4 networks that it will use:
vim /etc/shorewall/zones
net ipv4
loc ipv4
So that the zones file looks like:
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
loc ipv4
interfaces
Just above, we told shorewall that we had two new ipv4 networks. In the interfaces configuration file, we link these networks to physical interfaces.
|
Note: If you plan to setup a DHCP server on your firewall, you will need to specify the dhcp option, as shown here. You can see a full list of options and their uses on Shorewall's interfaces page. |
To link the new networks to the physical interfaces, append the following entries;
vim /etc/shorewall/interfaces
loc eth0 dhcp
net eth1
So that the interfaces file looks like:
###############################################################################
?FORMAT 2
###############################################################################
#ZONE INTERFACE OPTIONS
loc eth0 dhcp
net eth1
policy
Here you tell shorewall what the default policy is for each network when receiving new connection requests. You don't need to worry about ESTABLISHED and RELATED connections as shorewall handles these rules. The choices are:
- ACCEPT; Accept the connection.
- DROP; Ignore the connection request.
- REJECT; Return an appropriate error to the connection request.
You can also set the log level for connection requests that fall off the chain and hit these policies. It's a good idea to log info level so you can see twits trying to do "bad things(tm)". The one downside to using info is that it pushes a lot of data into the log files, which might make debugging other issues on the firewall. It's really up to you in the end.
Append the following default policies;
vim /etc/shorewall/policy
# Let everything from the firewall machine out onto the net.
fw net ACCEPT
# Likewise, allow everything from the firewall out onto the local network.
fw loc ACCEPT
# Don't allow incoming connections from the web into the fireall *or* into the
# local network. Add 'info' here if you want to log failed connection attempts.
net all DROP info
# Don't allow incoming connections from the local network into the firewall.
loc fw DROP
# Let machines on the local network out onto the web
loc net ACCEPT
So that the policy file looks like:
###############################################################################
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
# Let everything from the firewall machine out onto the net.
fw net ACCEPT
# Likewise, allow everything from the firewall out onto the local network.
fw loc ACCEPT
# Don't allow incoming connections from the web into the fireall *or* into the
# local network. Add 'info' here if you want to log failed connection attempts.
net all DROP info
# Don't allow incoming connections from the local network into the firewall.
loc fw DROP
# Let machines on the local network out onto the web
loc net ACCEPT
rules
This is really the heart of the firewall.
Here you tell shorewall what the exceptions there are to the default policies. The first rule to match is used.
The example below shows a setup where remote access in to the firewall itself is allowed only on port 22000 (modified SSH port). Then two Microsoft Windows servers are setup. Both servers are internally set to listen for RDP connections on the same default port (3389). To allow for this with just one external IP address, the firewall is told to route incoming connections on port 3390 to the internal machine at IP 10.255.0.11 on port 3393. Likewise, incoming connections on port 3389 will be forwarded to directly to 10.255.0.10:3389.
We'll also add a couple special rules that tells shorewall to respond to ICMP ping requests. Some people don't like this as ping sweeps are a quick way for malicious people to find servers on the net. Personally, I find the usefulness of being able to ping my firewall more beneficial.
Append rules so that the it file looks like.
vim /etc/shorewall/rules
### Rules for data going into the firewall. Consult /etc/services or your local
### search engine for ports and protocols used by your favourite programs.
# Answer ICMP queries
Ping(ACCEPT) net fw
Ping(ACCEPT) loc fw
# Allow incoming SSH connections to the firewall itself from the web on port
# 22000. Allow incoming SSH connections to the firewall on port 22 and 22000
# from the local network.
ACCEPT net fw tcp 22000
ACCEPT loc fw tcp 22
ACCEPT loc fw tcp 22000
# Allow incoming connections from the internet to two windows servers listening
# for RDP connections on the same port. This will be handled using different
# external ports using destination network address translation.
ACCEPT net loc:10.255.0.10:3389 tcp 3389
ACCEPT net loc:10.255.0.11:3389 tcp 3390
This is a spartan example of what you can do. It's meant to show how you can do matching and non-matching TCP port forwards. With this simple format, you should be able to create all the rules you need to setup your network.
masq
This is the file that handles MASQerading the machines on the local LAN (the loc zone). This is how shorewall provides internet access to an entire subnet of machines on a given network.
So to enable Internet access from your machines, you need to add a line with the Internet facing interface followed by the subnet of the local network that you will be masquerading.
vim /etc/shorewall/masq
eth1 10.255.0.0/16
So that the masq file looks like:
################################################################################################################
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL
# GROUP DEST
eth1 10.255.0.0/16
shorewall.conf
Once you have the above files in place, you need to enable the firewall.
Edit /etc/shorewall/shorewall.conf and change the following lines:
vim /etc/shorewall/shorewall.conf
STARTUP_ENABLED=No
To:
STARTUP_ENABLED=Yes
Starting the Firewall
To start the firewall, simply run:
/etc/init.d/shorewall restart
The firewall should now be running. To see the new rules, simply run:
iptables-save
This will print out the actual firewall rules. You will need some experience with iptables to understand all their meaning, but the general flow should be understandable.
Lastly, make sure the firewall starts on boot by running:
chkconfig shorewall on
Fixing SELinux Problems
If you get an error like:
/etc/init.d/shorewall start
Compiling...
Can't exec "/usr/lib/shorewall/getparams": Permission denied at /usr/share/perl5/Shorewall/Config.pm line 5041.
ERROR: Processing of /etc/shorewall/params failed
If we check /var/log/audit/audit.log, we see:
type=AVC msg=audit(1403851868.309:165): avc: denied { execute_no_trans } for pid=11114 comm="perl" path="/usr/lib/shorewall/getparams" dev=sda3 ino=1705335 scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
To fix this, run:
semanage fcontext -a -t bin_t /usr/lib/shorewall/getparams
restorecon -vF /usr/lib/shorewall/getparams
Now shorewall should start properly.
/etc/init.d/shorewall start
Compiling...
Shorewall configuration compiled to /var/lib/shorewall/.start
Starting Shorewall....
done.
| Any questions, feedback, advice, complaints or meanderings are welcome. | |||
| Alteeve's Niche! | Alteeve Enterprise Support | Community Support | |
| © 2025 Alteeve. Intelligent Availability® is a registered trademark of Alteeve's Niche! Inc. 1997-2025 | |||
| legal stuff: All info is provided "As-Is". Do not use anything here unless you are willing and able to take responsibility for your own actions. | |||