Shorewall on RPM-based Servers: Difference between revisions
m (→interfaces) |
m (→policy) |
||
| Line 115: | Line 115: | ||
<source lang="bash"> | <source lang="bash"> | ||
vim /etc/shorewall/policy | vim /etc/shorewall/policy | ||
</ | </source> | ||
<source lang="text"> | <source lang="text"> | ||
# This allows the firewall out onto the Internet | # This allows the firewall out onto the Internet | ||
Revision as of 16:21, 18 October 2010
This covers setup and maintenance of Shorewall 4.4 on Fedora 13. It's a very generic How-To though and should work well on most RPM-based distributions.
Install
Note: A mirror of http://www.invoca.ch was made for this how-to. Please check there for updated packages and, if found, please use their newer version
Download and install shorewall-4.4.13.3-1.noarch.rpm
rpm -Uvh https://alteeve.com/files/shorewall/4.4/shorewall-4.4.13/shorewall-4.4.13.3-1.noarch.rpm
Setup
Public IP Address Range
If you have multiple public IP addresses, make sure your Internet facing ethernet device, eth1 in our case, has all of those public IPs assigned to it. Do this by:
- Copying the ifcfg-eth1 to ifcfg-eth1:x where x is a number, starting at 0, with the next public IP in the pool.
- In each 'ifcfg-eth1:x file:
- Add :x to DEVICE=eth1, for example DEVICE=eth1:0 in the ifcfg-eth1:0 file.
- Change the IP address in the IPADDR= line. For example, 208.67.144.34.
- Comment out the GATEWAY= line.
When done, simply restart networking:
/etc/init.d/network restart
Or manually bring up each device with:
ifup eth0:x
Setting x to the number of each alias device you are starting. If you are connected over ssh, using ifup is recommended as you are less likely to lose your ssh session.
Configuring Shorewall
All configuration files are in the following directory, unless explicitly defined:
/etc/shorewall
The main Shorewall configuration file, which we will edit last is /etc/shorewall/shorewall.conf. </source>
The files to edit are listed in the order we will edit them in the following subsections.
zones
This controls the main "zones" used by Shorewall. The fw is special in that it defines the firewall itself. The net zone is the Internet-facing network (eth1 on the firewall). The loc is the local network, the virtual machine network on eth0.
Add:
vim /etc/shorewall/zones
fw firewall
net ipv4
loc ipv4
So that the 'zones' file looks like:
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
loc ipv4
interfaces
Here you tell Shorewall which network zones are on which interfaces.
Add:
vim /etc/shorewall/interfaces
net eth1 detect
loc eth0 detect dhcp
So that the interfaces file looks like:
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth1 detect
loc eth0 detect dhcp
policy
Here you tell Shorewall what the default policy is for each network when receiving new connection requests. You don't need to worry about ESTABLISHED and RELATED connections as Shorewall handles these rules. The choices are:
- ACCEPT
- Accept the connection.
- DROP
- Ignore the connection request.
- REJECT
- Return an appropriate error to the connection request.
You can also set the log level for connection requests that fall off the chain and hit these policies. It's a good idea to log info level so you can see twits trying to do "bad things(tm)".
vim /etc/shorewall/policy
# This allows the firewall out onto the Internet
fw net ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw loc ACCEPT
# - Protect the firewall from compromised servers.
loc fw DROP
# - Let anything from the VMs out onto the Internet.
loc net ACCEPT
# - Drop and log anything else.
net all DROP info
So that the policy file looks like:
###############################################################################
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
# This allows the firewall out onto the Internet
fw net ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw loc ACCEPT
# - Protect the firewall from compromised servers.
loc fw DROP
# - Let anything from the VMs out onto the Internet.
loc net ACCEPT
# - Drop and log anything else.
net all DROP info
rules
Here you tell Shorewall what the exceptions are to the default policies. The first match is used. This is really the heart of the firewall.
Edit rules so that the it file looks like:
vim /etc/shorewall/rules
</span>
<source lang="text">
############################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
### Rules for data going into the firewall
# Allow SSH connections to the firewall itself
ACCEPT net fw tcp 22
# Allow SSH and DHCP requests from the VMs into the firewall.
ACCEPT loc fw tcp 22
ACCEPT loc fw udp 67,68
### Forwards using DNAT
## Internet into 'VSH02' -> 'dom0'
# SSH
DNAT net loc:192.168.10.2:22 tcp 22002
## Internet into 'VSH03' -> 'dom0'
# SSH
DNAT net loc:192.168.10.3:22 tcp 22003
## Internet into 'auth01'
# SSH
DNAT net loc:192.168.10.100:22 tcp 22100
# OpenVPN
DNAT net loc:192.168.10.100:1194 udp 1194
## Internet into 'web01'
# SSH
DNAT net loc:192.168.10.101:22 tcp 22101
## Internet into 'web02'
# SSH
DNAT net loc:192.168.10.102:22 tcp 22102
## Internet into 'res01'
# SSH
DNAT net loc:192.168.10.103:22 tcp 22103
## Internet into 'dev01'
# SSH
DNAT net loc:192.168.10.104:22 tcp 22104
## Internet into 'sql01' (ssh and mysql)
# SSH
DNAT net loc:192.168.10.105:22 tcp 22105
DNAT net loc:192.168.10.105:3306 tcp 3306
masq
This is the file that handles MASQerading the virtual machine LAN (the 'loc' zone). Even though there are several IP addresses, they are not SNATed to hosts but instead used as a pool of addresses to do Port Forward/DNAT'ing on.
Add:
vim /etc/shorewall/masq
</span>
<source lang="text">
eth1 192.168.10.0/24
So that the 'rules' file looks like:
###############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/
# GROUP
eth1 192.168.10.0/24
shorewall.conf
Once you have the above files in place, you need to enable the firewall.
Edit /etc/shorewall/shorewall.conf and change the following lines:
vim /etc/shorewall/shorewall.conf
</span>
<source lang="text">
STARTUP_ENABLED=No
LOGFILE=/var/log/messages
To:
STARTUP_ENABLED=Yes
LOGFILE=/var/log/shorewall
Starting the Firewall
To start the firewall, simply run:
/etc/init.d/shorewall restart
The firewall should now be running. To see the new rules, simply run:
iptables-save
</span>
This will print out the actual firewall rules. You will need some experience with <span class="code">iptables</span> to understand all their meaning, but the general flow should be understandable.
Lastly, make sure the firewall starts on boot by running:
<source lang="bash">
chkconfig shorewall on
| Any questions, feedback, advice, complaints or meanderings are welcome. | |||
| Alteeve's Niche! | Enterprise Support: Alteeve Support |
Community Support | |
| © Alteeve's Niche! Inc. 1997-2024 | Anvil! "Intelligent Availability®" Platform | ||
| legal stuff: All info is provided "As-Is". Do not use anything here unless you are willing and able to take responsibility for your own actions. | |||