Copyright © 2001-2004 Thomas M. Eastep
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.
2004-04-03
Table of Contents
- My Current Network
- Firewall Configuration
- Shorewall.conf
- Params File (Edited)
- Zones File
- Interfaces File
- Hosts File
- Routestopped File
- RFC1918 File
- Blacklist File (Partial)
- Policy File
- Masq File
- NAT File
- Proxy ARP File
- Tunnels File (Shell variable TEXAS set in /etc/shorewall/params)
- Actions File
- action.Mirrors File
- /etc/shorewall/action.Drop
- /etc/shorewall/action.Reject
- Rules File (The shell variables are set in /etc/shorewall/params)
- /etc/network/interfaces
- /etc/dhcpd.conf (MAC Addresses Omitted)
- Bridge (Wookie) Configuration
Caution
I use a combination of One-to-one NAT and Proxy ARP, neither of which are relevant to a simple configuration with a single public IP address. If you have just a single public IP address, most of what you see here won't apply to your setup so beware of copying parts of this configuration and expecting them to work for you. What you copy may or may not work in your configuration.
Caution
The configuration shown here corresponds to Shorewall version 2.0.1 (that's right -- I am running a version of Shorewall that is not yet released). My configuration uses features not available in earlier Shorewall releases.
I have DSL service and have 5 static IP addresses (206.124.146.176-180). My DSL “modem” (Fujitsu Speedport) is connected to eth0. I have a local network connected to eth2 (subnet 192.168.1.0/24) and a DMZ connected to eth1 (206.124.146.176/32). Note that the IP address of eth1 is a duplicate of one on eth0.
In this configuration:
I use one-to-one NAT for Ursa (my personal system that dual-boots Mandrake 9.2 and Windows XP) - Internal address 192.168.1.5 and external address 206.124.146.178.
I use one-to-one NAT for EastepLaptop (My work system -- Windows XP SP2). Internal address 192.168.1.7 and external address 206.124.146.180.
I use SNAT through 206.124.146.179 for my SuSE 9.0 Linux system (Wookie), my Wife's Windows XP system (Tarry), and our Windows XP laptop (Tipper) which connects through the Wireless Access Point (wap) via a Wireless Bridge (wet).
Note
While the distance between the WAP and where I usually use the laptop isn't very far (25 feet or so), using a WAC11 (CardBus wireless card) has proved very unsatisfactory (lots of lost connections). By replacing the WAC11 with the WET11 wireless bridge, I have virtually eliminated these problems (Being an old radio tinkerer (K7JPV), I was also able to eliminate the disconnects by hanging a piece of aluminum foil on the family room wall. Needless to say, my wife Tarry rejected that as a permanent solution :-).
I have Wookie (193.168.1.3) configured as a 3-port bridge. Squid runs on this system and is configured as a transparent proxy.
The firewall runs on a 256MB PII/233 with Debian Sarge (Testing).
Wookie and Ursa run Samba and the Wookie acts as a WINS server.
The wireless network connects to Wookie's eth2 via a LinkSys WAP11. In additional to using the rather weak WEP 40-bit encryption (64-bit with the 24-bit preamble), I use MAC verification. This is still a weak combination and if I lived near a wireless “hot spot”, I would probably add IPSEC or something similar to my WiFi->local connections.
The single system in the DMZ (address 206.124.146.177) runs postfix, Courier IMAP (imaps and pop3), DNS, a Web server (Apache) and an FTP server (Pure-ftpd) under RedHat 9.0. The system also runs fetchmail to fetch our email from our old and current ISPs. That server is managed through Proxy ARP.
The firewall system itself runs a DHCP server that serves the local network.
All administration and publishing is done using ssh/scp. I have a desktop environment installed on the firewall but I am not usually logged in to it. X applications tunnel through SSH to Ursa. The server also has a desktop environment installed and that desktop environment is available via XDMCP from the local zone. For the most part though, X tunneled through SSH is used for server administration and the server runs at run level 3 (multi-user console mode on RedHat).
I run an SNMP server on my firewall to serve MRTG running in the DMZ.
The ethernet interface in the Server is configured with IP address 206.124.146.177, netmask 255.255.255.0. The server's default gateway is 206.124.146.254 (Router at my ISP. This is the same default gateway used by the firewall itself). On the firewall, an entry in my /etc/network/interfaces file (see below) adds a host route to 206.124.146.177 through eth1 when that interface is brought up.
Tarry (192.168.1.4) runs a PPTP server for Road Warrior access.
This is set up so that I can start the firewall before bringing up my Ethernet interfaces.
I use a stripped-down file which doesn't have to be updated when the IANA allocates a block of IP addresses.
#SUBNET TARGET 169.254.0.0/16 DROP # DHCP autoconfig 172.16.0.0/12 logdrop # RFC 1918 192.0.2.0/24 logdrop # Example addresses 192.168.0.0/16 logdrop # RFC 1918 10.24.60.56 DROP # Some idiot in my broadcast domain # has a box configured with this # address. 10.0.0.0/8 logdrop # Reserved (RFC 1918)
#SOURCE DESTINATION POLICY LOG LEVEL BURST:LIMIT fw fw ACCEPT # For testing fw->fw rules loc net ACCEPT # Allow all net traffic from local net $FW loc ACCEPT # Allow local access from the firewall $FW tx ACCEPT # Allow firewall access to texas loc tx ACCEPT # Allow local net access to texas loc fw REJECT $LOG # Reject loc->fw and log net all DROP $LOG 10/sec:40 # Rate limit and # DROP net->all all all REJECT $LOG # Reject and log the rest #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
Although most of our internal systems use one-to-one NAT, my wife's system (192.168.1.4) uses IP Masquerading (actually SNAT) as do my SuSE system (192.168.1.3), our laptop (192.168.3.8) and visitors with laptops.
The $MIRRORS variable expands to a list of approximately 10 IP addresses. So moving these checks into a separate chain reduces the number of rules that most net->dmz traffic needs to traverse.
This is my common action for the DROP policy. It is like the standard Drop action except that it allows “Ping”.
This is my common action for the REJECT policy. It is like the standard Reject action except that it allows “Ping” and contains one rule that guards against log flooding by broken software running in my local zone.
#TARGET SOURCE DEST PROTO DEST SOURCE RATE USER/ # PORT(S) PORT(S) LIMIT GROUP RejectAuth AllowPing dropBcast RejectSMB DropUPnP dropNonSyn DropDNSrep DROP loc:eth2:!192.168.1.0/24 #So that my braindead Windows[tm] XP system doesn't flood my log #with NTP requests with a source address in 16.0.0.0/8 (address of #its PPTP tunnel to HP).
This file is Debian specific. My additional entry (which is displayed in bold type) adds a route to my DMZ server when eth1 is brought up. It allows me to enter “Yes” in the HAVEROUTE column of my Proxy ARP file.
... auto eth1 iface eth1 inet static address 206.124.146.176 netmask 255.255.255.255 broadcast 0.0.0.0 up ip route add 206.124.146.177 dev eth1 ...
While this is a little off-topic, I've included it to show how to set up DHCP on two interfaces.
default-lease-time 67200; max-lease-time 67200; get-lease-hostnames on; group { option subnet-mask 255.255.255.0; option broadcast-address 192.168.1.255; option routers 192.168.1.254; option ntp-servers 192.168.1.254; option domain-name-servers 192.168.1.193; option netbios-name-servers 192.168.1.254; option domain-name "shorewall.net"; option netbios-dd-server 192.168.1.254; option netbios-node-type 8; option netbios-scope ""; subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.11 192.168.1.20; } host ursa.shorewall.net { hardware ethernet …; fixed-address 192.168.1.5; } host eastept1 { hardware ethernet …; fixed-address 192.168.1.7; } host tarry { hardware ethernet …; fixed-address 192.168.1.4; } host wookie.shorewall.net { hardware ethernet …; fixed-address 192.168.1.3; } host testws.shorewall.net { hardware ethernet …; fixed-address 192.168.1.6; } host printer.shorewall.net { hardware ethernet …; fixed-address 192.168.1.10; } } group { option subnet-mask 255.255.255.0; option broadcast-address 192.168.3.255; option routers 192.168.3.254; option ntp-servers 192.168.3.254; option domain-name-servers 206.124.146.177; option netbios-name-servers 192.168.3.254; option domain-name "shorewall.net"; option netbios-dd-server 192.168.3.254; option netbios-node-type 8; option netbios-scope ""; subnet 192.168.3.0 netmask 255.255.255.0 { range 192.168.3.11 192.168.3.20; } host easteplaptop { hardware ethernet …; fixed-address 192.168.3.7; } host tipper.shorewall.net { hardware ethernet …; fixed-address 192.168.3.8; }
As mentioned above, Wookie acts as a bridge. It's view of the network is diagrammed in the following figure.
I've included the files that I used to configure that system -- some of them are SuSE-specific.
The configuration on Wookie can be modified to test various bridging features -- otherwise, it serves to isolate the Wireless network from the rest of our systems.
The first rule allows a transparent WWW proxy (Squid) to run on my bridge/firewall. Squid listens on port 3128.
The remaining rules protect the local systems and bridge from the WiFi network. Note that we don't restrict WiFi→net traffic since the only directly-accessible system in the net zone is the firewall (Wookie and the Firewall are connected by a cross-over cable).
This file is SuSE-specific and creates the bridge device br0. A script for other disbributions would be similar.
#!/bin/sh ################################################################################ # Script to create a bridge between eth0, eth1 and eth2 # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # # (c) 2004 - Tom Eastep (teastep@shorewall.net) # # Modify the following variables to match your configuration # # chkconfig: 2345 05 89 # description: Layer 2 Bridge # ################################################################################ PATH=$PATH:/sbin:/usr/sbin:/usr/local/sbin do_stop() { echo "Stopping Bridge" brctl delbr br0 ip link set eth0 down ip link set eth1 down ip link set eth2 down } do_start() { echo "Starting Bridge" ip link set eth0 up ip link set eth1 up ip link set eth2 up brctl addbr br0 brctl addif br0 eth0 brctl addif br0 eth1 brctl addif br0 eth2 } case "$1" in start) do_start ;; stop) do_stop ;; restart) do_stop sleep 1 do_start ;; *) echo "Usage: $0 {start|stop|restart}" exit 1 esac exit 0
This file is SuSE-specific