On Tuesday 26 Nov 2002 6:15 am, magnet wrote:
> Hi all,
> After many installs and messing about regaining some usability of this
> system and network, I used Control Center to install and activate the
> Internet Sharing across the network. As before, it installed Shorewall,
> which has been the #1 culprit in causing all these reinstalls as it just
> shuts the machine down re: internet usage. So I'm turning to the wisdom of
> the list once more for some serious help in getting this horrible piece of
> "protection" to actually work for me and not against me. I've googled the
> problem looking for advice but so far am just coming up with results about
> it being a new feature (M$ jargon for software that doesn't work?) of
> Mandrake 9.0, and very little on deep explaination of configuring it using
> vi to allow all 6 machines to access the internet via main gateway machine.
> I am using the standard IP range 192.168.0.XXX format for all machines
> here:
>
> 192.168.0.1 linux1 mdk 9.0 (gateway modem)
> 192.168.0.2 linux2 mdk 8.2
> 192.168.0.3 linux3 mdk 8.2
> 192.168.0.4 linux4 mdk 8.2
> 192.168.0.5 linux5 mdk 8.2
> 192.168.0.6 linux6 mdk 8.2
> 192.168.0.253 laptop Windblows ME
>
> As soon as I installed it, local machines went off-line and samba was also
> blocked across the network. I have followed the recent posting "Ports to
> keep open for samba?" and have edited the shorewall rules file to match for
> now. I still have internet access/browsing/email from the fw machine but
> local network is still offline.
> I went to the laptop and tried pinging the other machines, all responded
> except the fw machine. I have tried pinging from fw machine to the others
> but it just times out.
>
> Any help will be appreciated on how to get this firewall working correctly.
>
> Regards
> magnet
The problem is not really to do with shorewall, which is in fact a very
effective and highly regarded firewall, but is more to do with the Mandrake
Firewall GUI which sets shorewall up in a very simplistic manner. I would
advise using the GUI to set up Internet sharing, but to then go to editing
the shorewall files directly for everything else. If you *****open the
Mandrake GUI it will alter your files when you exit it***** so once you have
configured shorewall do not enter the GUI again....
To learn about shorewall visit www.shorewall.net You will find some very good
example configurations there.
Basically shorewall is very simple to configure for a simple firewall. The
file /etc/shorewall/interfaces gives your interfaces a name. net for the
Internet connection, masq for your local network with Connection sharing, and
fw for the firewall itself.
Next the file /etc/shorewall/policy gives the general policy. Here we see
these entries (in my network)
masq net ACCEPT # allows internet traffic from my local network to the
Internet
fw net ACCEPT # allows traffic from my firewall to the internet
net all DROP info # Silently Drop all frames from the internet to ANY
interface, and log all frames in syslog
all all REJECT info # Reject all frames not defined in an earlier rule and
log all frames.
This basic policy will allow anything out to the internet, but NOTHING in, and
NOTHING is allowed to connect from my local network and the firewall. So on
its own this configuration would not allow the local network to communicate
with a samba or web server running on my firewall.
So to expand the applications allowed we use the file /etc/shorewall/rules
which allows us to define exceptions to the general policy. Here I have
ACCEPT net fw tcp 80,25 -# This allows http (port 80) and smtp email
(port25)
to connect to my firewall from the Internet using TCP protocol
ACCEPT masq fw tcp
8118,ssh,domain,http,https,137,138,139,631,imap,pop3,smtp,nntp,ntp,10000
#This allows the following services to connect from local network to the
firewall 8118 (privoxy proxy server), ssh (secure shell), domain(53, DNS
name server) -, http and https web traffic, 137/138/139 Samba, 631 CUPS, imap
email, pop3 email, smtp email, nntp news, ntp time protocol, and 10000 webmin
ACCEPT masq fw udp
ssh,domain,bootps,http,https,137,138,139,631,imap,pop3,smtp,nntp,ntp,10000
#similarly for udp protocol
-
ACCEPT fw masq tcp ssh,631,137,138,139 -
ACCEPT fw masq udp ssh,631,137,138,139 # these lines allow the firewall
to
make connections out to the local networkfor 631 CUPS traffic, and Samba
traffic
If you do not what services the port numbers correspond to, there is a list in
/etc/services
Naturally an entry should only be present if the service is actually running.
If you simply wanted to open the firewall machine up to the local network,
while keeping traffic to the internet restricted, the easiest way is to put
two lines in the policies file
masq fw ACCEPT
fw masq ACCEPT
After making any change restart shorewall with
service shorewall restart
Hope that is all understandable - Just remember GUI bad, edits good :-)
derek
Want to buy your Pack or Services from MandrakeSoft?
Go to http://www.mandrakestore.com
