Shorewall on RPM-based Servers

AN!Wiki :: How To :: Shorewall on RPM-based Servers

This covers setup and maintenance of Shorewall 4.4 on Red Hat Enterprise Linux 5.x, 6.x, RHEL derivatives and several recent Fedora releases.

Install

Note: A mirror of http://www.invoca.ch was made for this how-to. Please check there for updated packages and, if found, please use their newer version

Download and install shorewall-4.4.15.2-1.noarch.rpm

rpm -Uvh https://alteeve.com/files/shorewall/4.4/shorewall-4.4.15/shorewall-4.4.15.2-1.noarch.rpm

Setup

Public IP Address Range

If you have multiple public IP addresses, make sure your Internet facing ethernet device, eth1 in our case, has all of those public IPs assigned to it. Do this by:

1. Copying the ifcfg-eth1 to ifcfg-eth1:x where x is a number, starting at 0, with the next public IP in the pool.
2. In each 'ifcfg-eth1:x file:
   1. Add :x to DEVICE=eth1, for example DEVICE=eth1:0 in the ifcfg-eth1:0 file.
   2. Change the IP address in the IPADDR= line. For example, 208.67.144.34.
   3. Comment out the GATEWAY= line.

When done, simply restart networking:

/etc/init.d/network restart

Or manually bring up each device with:

ifup eth0:x

Setting x to the number of each alias device you are starting. If you are connected over ssh, using ifup is recommended as you are less likely to lose your ssh session.

Configuring Shorewall

All configuration files are in the following directory, unless explicitly defined:

/etc/shorewall

The main Shorewall configuration file, which we will edit last is /etc/shorewall/shorewall.conf. </source>

The files to edit are listed in the order we will edit them in the following subsections.

zones

This controls the main "zones" used by Shorewall. The fw is special in that it defines the firewall itself. The net zone is the Internet-facing network (eth1 on the firewall). The loc is the local network, the virtual machine network on eth0.

Add:

vim /etc/shorewall/zones

fw      firewall
net     ipv4
loc     ipv4

So that the 'zones' file looks like:

###############################################################################
#ZONE   TYPE            OPTIONS         IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
net     ipv4
loc     ipv4

interfaces

Here you tell Shorewall which network zones are on which interfaces.

Add:

vim /etc/shorewall/interfaces

net     eth1            detect          
loc     eth0            detect          dhcp

So that the interfaces file looks like:

###############################################################################
#ZONE   INTERFACE       BROADCAST       OPTIONS
net     eth1            detect          
loc     eth0            detect          dhcp

policy

Here you tell Shorewall what the default policy is for each network when receiving new connection requests. You don't need to worry about ESTABLISHED and RELATED connections as Shorewall handles these rules. The choices are:

• ACCEPT
  • Accept the connection.
• DROP
  • Ignore the connection request.
• REJECT
  • Return an appropriate error to the connection request.

You can also set the log level for connection requests that fall off the chain and hit these policies. It's a good idea to log info level so you can see twits trying to do "bad things(tm)".

vim /etc/shorewall/policy

# This allows the firewall out onto the Internet
fw      net     ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw      loc     ACCEPT
# - Protect the firewall from compromised servers. 
loc     fw      DROP
# - Let anything from the VMs out onto the Internet.
loc     net     ACCEPT
# - Drop and log anything else.
net     all     DROP            info

So that the policy file looks like:

###############################################################################
#SOURCE DEST    POLICY          LOG     LIMIT:          CONNLIMIT:
#                               LEVEL   BURST           MASK
# This allows the firewall out onto the Internet
fw      net     ACCEPT
# These are the default policies; All VMs are allowed out to the net, Anything
# from the Internet is DROPed and anything else to anything else is REJECTed
# and logged.
# - Anything from the firewall to the VMs is allowed.
fw      loc     ACCEPT
# - Protect the firewall from compromised servers. 
loc     fw      DROP
# - Let anything from the VMs out onto the Internet.
loc     net     ACCEPT
# - Drop and log anything else.
net     all     DROP            info

rules

Here you tell Shorewall what the exceptions are to the default policies. The first rule to match is used. This is really the heart of the firewall.

The example below shows a setup where remote access in to the firewall itself is allowed only on port 22869 (modified SSH port). Then two Microsoft Windows servers are setup. Both servers are internally set to listen for RDP connections on the same default port (3389). To allow for this with just one external IP address, the firewall is told to route incoming connections on port 3394 to the internal machine at IP 192.168.1.11 on port 3393. Likewise, incoming connections on port 3393 will be forwarded to 192.168.1.10:3393. A few other ports are opened for various services as further examples.

Edit rules so that the it file looks like.

vim /etc/shorewall/rules

############################################################################################################################################################
#ACTION         SOURCE          DEST                    PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK    CONNLIMIT       TIME
#                                                               PORT    PORT(S)         DEST            LIMIT           GROUP
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW

### Rules for data going into the firewall
# Allow SSH connections to the firewall itself
ACCEPT          net             fw                      tcp     22869
# Allow SSH and DHCP requests from the VMs into the firewall.
ACCEPT          loc             fw                      tcp     22869
ACCEPT          loc             fw                      udp     67,68

### Forwards using DNAT
## Internet into 'win2008_iis_01'
#DNAT           <src>           loc:<ip>:<srv_port>     tcp    <ext_port>
# RDP
DNAT            net             loc:192.168.1.11:3389   tcp    3394
# FTP
DNAT            net             loc:192.168.1.11:20     tcp    20
DNAT            net             loc:192.168.1.11:21     tcp    21
# SMTP
DNAT            net             loc:192.168.1.11:25     tcp    25
# DNS
DNAT            net             loc:192.168.1.11:53     tcp    53
# HTTP
DNAT            net             loc:192.168.1.11:80     tcp    80

## Internet into 'win2008_sql_01'
# RDP
DNAT            net             loc:192.168.1.10:3389   tcp    3393
# VPN
DNAT            net             loc:192.168.1.10:1732   tcp    1732

masq

This is the file that handles MASQerading the virtual machine LAN (the loc zone). Even though there may be several public IP addresses, they are not SNATed to hosts but instead used as a pool of addresses to do Port Forward/DNATing on.

So to enable Internet access from your servers, you need to add a line with the Internet facing interface followed by the subnet that you will be MASQing.

vim /etc/shorewall/masq

eth1                    192.168.1.0/24

So that the 'rules' file looks like:

###############################################################################
#INTERFACE              SOURCE          ADDRESS         PROTO   PORT(S) IPSEC   MARK    USER/
#                                                                                       GROUP
eth1                    192.168.1.0/24

shorewall.conf

Once you have the above files in place, you need to enable the firewall.

Edit /etc/shorewall/shorewall.conf and change the following lines:

vim /etc/shorewall/shorewall.conf

STARTUP_ENABLED=No
LOGFILE=/var/log/messages

To:

STARTUP_ENABLED=Yes
LOGFILE=/var/log/shorewall

Starting the Firewall

To start the firewall, simply run:

/etc/init.d/shorewall restart

The firewall should now be running. To see the new rules, simply run:

iptables-save

This will print out the actual firewall rules. You will need some experience with iptables to understand all their meaning, but the general flow should be understandable.

Lastly, make sure the firewall starts on boot by running:

chkconfig shorewall on

 

Any questions, feedback, advice, complaints or meanderings are welcome.
Alteeve's Niche!	Enterprise Support: Alteeve Support	Community Support
© Alteeve's Niche! Inc. 1997-2024		Anvil! "Intelligent Availability®" Platform
legal stuff: All info is provided "As-Is". Do not use anything here unless you are willing and able to take responsibility for your own actions.