Shorewall on RPM-based Servers: Difference between revisions
| Line 203: | Line 203: | ||
=== masq === | === masq === | ||
This is the file that handles | This is the file that handles [[MASQ]]erading the virtual machine LAN (the <span class="code">loc</span> zone). Even though there may be several public IP addresses, they are not [[SNAT]]ed to hosts but instead used as a pool of addresses to do Port Forward/[[DNAT]]ing on. | ||
So to enable Internet access from your servers, you need to add a line with the Internet facing interface followed by the subnet that you will be MASQing. | |||
<source lang="bash"> | <source lang="bash"> | ||
| Line 211: | Line 211: | ||
</source> | </source> | ||
<source lang="text"> | <source lang="text"> | ||
eth1 192.168. | eth1 192.168.1.0/24 | ||
</source> | </source> | ||
| Line 220: | Line 220: | ||
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ | #INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ | ||
# GROUP | # GROUP | ||
eth1 192.168. | eth1 192.168.1.0/24 | ||
</source> | </source> | ||
Revision as of 18:43, 19 October 2010
|
Alteeve Wiki :: How To :: Shorewall on RPM-based Servers |
This covers setup and maintenance of Shorewall 4.4 on Fedora 13. It's a very generic How-To though and should work well on most RPM-based distributions.
Install
Note: A mirror of http://www.invoca.ch was made for this how-to. Please check there for updated packages and, if found, please use their newer version
Download and install shorewall-4.4.13.3-1.noarch.rpm
rpm -Uvh https://alteeve.com/files/shorewall/4.4/shorewall-4.4.13/shorewall-4.4.13.3-1.noarch.rpm
Setup
Public IP Address Range
If you have multiple public IP addresses, make sure your Internet facing ethernet device, eth1 in our case, has all of those public IPs assigned to it. Do this by:
- Copying the ifcfg-eth1 to ifcfg-eth1:x where x is a number, starting at 0, with the next public IP in the pool.
- In each 'ifcfg-eth1:x file:
- Add :x to DEVICE=eth1, for example DEVICE=eth1:0 in the ifcfg-eth1:0 file.
- Change the IP address in the IPADDR= line. For example, 208.67.144.34.
- Comment out the GATEWAY= line.
When done, simply restart networking:
/etc/init.d/network restart
Or manually bring up each device with:
ifup eth0:x
Setting x to the number of each alias device you are starting. If you are connected over ssh, using ifup is recommended as you are less likely to lose your ssh session.
Configuring Shorewall
All configuration files are in the following directory, unless explicitly defined:
/etc/shorewall
The main Shorewall configuration file, which we will edit last is /etc/shorewall/shorewall.conf. </source>
The files to edit are listed in the order we will edit them in the following subsections.
zones
This controls the main "zones" used by Shorewall. The fw is special in that it defines the firewall itself. The net zone is the Internet-facing network (eth1 on the firewall). The loc is the local network, the virtual machine network on eth0.
Add:
vim /etc/shorewall/zones
fw firewall
net ipv4
loc ipv4
So that the 'zones' file looks like:
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
loc ipv4
interfaces
Here you tell Shorewall which network zones are on which interfaces.
Add:
vim /etc/shorewall/interfaces
net eth1 detect
loc eth0 detect dhcp
So that the interfaces file looks like:
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth1 detect
loc eth0 detect dhcp
policy
Here you tell Shorewall what the default policy is for each network when receiving new connection requests. You don't need to worry about ESTABLISHED and RELATED connections as Shorewall handles these rules. The choices are:
- ACCEPT
- Accept the connection.
- DROP
- Ignore the connection request.
- REJECT
- Return an appropriate error to the connection request.
You can also set the log level for connection requests that fall off the chain and hit these policies. It's a good idea to log info level so you can see twits trying to do "bad things(tm)".
vim /etc/shorewall/policy
# This allows the firewall out onto the Internet
fw net ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw loc ACCEPT
# - Protect the firewall from compromised servers.
loc fw DROP
# - Let anything from the VMs out onto the Internet.
loc net ACCEPT
# - Drop and log anything else.
net all DROP info
So that the policy file looks like:
###############################################################################
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
# This allows the firewall out onto the Internet
fw net ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw loc ACCEPT
# - Protect the firewall from compromised servers.
loc fw DROP
# - Let anything from the VMs out onto the Internet.
loc net ACCEPT
# - Drop and log anything else.
net all DROP info
rules
Here you tell Shorewall what the exceptions are to the default policies. The first rule to match is used. This is really the heart of the firewall.
The example below shows a setup where remote access in to the firewall itself is allowed only on port 22869 (modified SSH port). Then two Microsoft Windows servers are setup. Both servers are internally set to listen for RDP connections on the same default port (3389). To allow for this with just one external IP address, the firewall is told to route incoming connections on port 3394 to the internal machine at IP 192.168.1.11 on port 3393. Likewise, incoming connections on port 3393 will be forwarded to 192.168.1.10:3393. A few other ports are opened for various services as further examples.
Edit rules so that the it file looks like.
vim /etc/shorewall/rules
############################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
### Rules for data going into the firewall
# Allow SSH connections to the firewall itself
ACCEPT net fw tcp 22869
# Allow SSH and DHCP requests from the VMs into the firewall.
ACCEPT loc fw tcp 22869
ACCEPT loc fw udp 67,68
### Forwards using DNAT
## Internet into 'win2008_iis_01'
#DNAT <src> loc:<ip>:<srv_port> tcp <ext_port>
# RDP
DNAT net loc:192.168.1.11:3389 tcp 3394
# FTP
DNAT net loc:192.168.1.11:20 tcp 20
DNAT net loc:192.168.1.11:21 tcp 21
# SMTP
DNAT net loc:192.168.1.11:25 tcp 25
# DNS
DNAT net loc:192.168.1.11:53 tcp 53
# HTTP
DNAT net loc:192.168.1.11:80 tcp 80
## Internet into 'win2008_sql_01'
# RDP
DNAT net loc:192.168.1.10:3389 tcp 3393
# VPN
DNAT net loc:192.168.1.10:1732 tcp 1732
masq
This is the file that handles MASQerading the virtual machine LAN (the loc zone). Even though there may be several public IP addresses, they are not SNATed to hosts but instead used as a pool of addresses to do Port Forward/DNATing on.
So to enable Internet access from your servers, you need to add a line with the Internet facing interface followed by the subnet that you will be MASQing.
vim /etc/shorewall/masq
eth1 192.168.1.0/24
So that the 'rules' file looks like:
###############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/
# GROUP
eth1 192.168.1.0/24
shorewall.conf
Once you have the above files in place, you need to enable the firewall.
Edit /etc/shorewall/shorewall.conf and change the following lines:
vim /etc/shorewall/shorewall.conf
STARTUP_ENABLED=No
LOGFILE=/var/log/messages
To:
STARTUP_ENABLED=Yes
LOGFILE=/var/log/shorewall
Starting the Firewall
To start the firewall, simply run:
/etc/init.d/shorewall restart
The firewall should now be running. To see the new rules, simply run:
iptables-save
This will print out the actual firewall rules. You will need some experience with iptables to understand all their meaning, but the general flow should be understandable.
Lastly, make sure the firewall starts on boot by running:
chkconfig shorewall on
| Any questions, feedback, advice, complaints or meanderings are welcome. | |||
| Alteeve's Niche! | Alteeve Enterprise Support | Community Support | |
| © 2025 Alteeve. Intelligent Availability® is a registered trademark of Alteeve's Niche! Inc. 1997-2025 | |||
| legal stuff: All info is provided "As-Is". Do not use anything here unless you are willing and able to take responsibility for your own actions. | |||