On 9/17/10 9:10 AM, Tom Eastep wrote:
> Beta 6 is now available for testing. Pay close attention to the
> Blacklisting change in this release; static blacklisting is incompatible
> with blacklisting in Beta 5.
> 
> Problems corrected:
> 
> 1)  'shorewall clear' (and 'shorewall6 clear') now work again (broken
>     in Beta 5).
> 
> 2)  To work around an issue in Netfilter/iptables, Shorewall now uses
>     state match rather than conntrack match for UNTRACKED state
>     matching.
> 
> New Features:
> 
> 1)  Blacklisting has undergone considerable change in Shorewall 4.4.13.
> 
>     a) Blacklisting is now based on zones rather than on interfaces and
>        host groups.
> 
>     b) Near compatibility with earlier releases is maintained.
> 

I've found a case where interface-related filtering like 'nosmurfs' and
'dhcp' is done before incoming blacklist filtering.

gateway:/etc/shorewall# cat zones
fw              firewall
loc             ip                        #Local Zone
net             ipv4            blacklist #Internet
drct            ipv4:loc
gateway:/etc/shorewall# c

gateway:/etc/shorewall# cat interfaces
#ZONE  INTERFACE  BROADCAST OPTIONS
drct   INT_IF     detect    nets=dynamic,physical=...
net    COM_IF     detect    dhcp,optional,nosmurfs,physical=...
...

gateway:/etc/shorewall# cat hosts
#ZONE   HOST(S)                                 OPTIONS
loc     INT_IF:0.0.0.0/0
loc     COM_IF:10.1.10.0/24

The 'net' zone and 'loc' zones share COM_IF.

The generated ruleset:

Shorewall 4.4.13-Beta6 Chain COM_IF_in at gateway - Fri Sep 17 16:24:08
PDT 2010

Counters reset Fri Sep 17 15:16:00 PDT 2010

Chain COM_IF_in (1 references)
 pkts bytes target     prot opt in     out     source
destination
 1580  110K smurfs     all  --  *      *       0.0.0.0/0
0.0.0.0/0           state INVALID,NEW,UNTRACKED
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0           udp dpts:67:68
    0     0 loc-dmz    all  --  *      *       10.1.10.0/24
70.90.191.124/31
    1    69 loc-fw     all  --  *      *       10.1.10.0/24
0.0.0.0/0
   98  6109 net-fw     all  --  *      *       0.0.0.0/0
0.0.0.0/0

gateway:/etc/shorewall#

Chain net-fw (1 references)
 pkts bytes target     prot opt in     out     source
destination
  102  6353 blacklst   all  --  *      *       0.0.0.0/0
0.0.0.0/0           state INVALID,NEW,UNTRACKED

COM_IF_fwd is similar.

I'm not sure whether or not I'll be able to do anything about this in
the short term.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

Attachment: signature.asc
Description: OpenPGP digital signature

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Reply via email to