On Tuesday 26 Nov 2002 9:51 am, Derek Jennings wrote: > > The problem is not really to do with shorewall, which is in fact a very > effective and highly regarded firewall, but is more to do with the Mandrake > Firewall GUI which sets shorewall up in a very simplistic manner. I would > advise using the GUI to set up Internet sharing, but to then go to editing > the shorewall files directly for everything else. If you *****open the > Mandrake GUI it will alter your files when you exit it***** so once you > have configured shorewall do not enter the GUI again.... >
I'm not sure what GUI you are refering to here? I used vi to look at the files in /etc/shorewall/ and had the shorewall site up in the browser for reference. > > To learn about shorewall visit www.shorewall.net You will find some very > good example configurations there. > > Basically shorewall is very simple to configure for a simple firewall. The > file /etc/shorewall/interfaces gives your interfaces a name. net for the > Internet connection, masq for your local network with Connection sharing, > and fw for the firewall itself. > > Next the file /etc/shorewall/policy gives the general policy. Here we see > these entries (in my network) > masq net ACCEPT # allows internet traffic from my local network to the > Internet > > fw net ACCEPT # allows traffic from my firewall to the internet > > net all DROP info # Silently Drop all frames from the internet to ANY > interface, and log all frames in syslog > > all all REJECT info # Reject all frames not defined in an earlier rule > and log all frames. > > > This basic policy will allow anything out to the internet, but NOTHING in, > and NOTHING is allowed to connect from my local network and the firewall. > So on its own this configuration would not allow the local network to > communicate with a samba or web server running on my firewall. > > So to expand the applications allowed we use the file /etc/shorewall/rules > which allows us to define exceptions to the general policy. Here I have > ACCEPT net fw tcp 80,25 -# This allows http (port 80) and smtp >email > (port25) to connect to my firewall from the Internet using TCP protocol > > ACCEPT masq fw tcp > 8118,ssh,domain,http,https,137,138,139,631,imap,pop3,smtp,nntp,ntp,10000 > #This allows the following services to connect from local network to the > firewall 8118 (privoxy proxy server), ssh (secure shell), domain(53, DNS > name server) -, http and https web traffic, 137/138/139 Samba, 631 CUPS, > imap email, pop3 email, smtp email, nntp news, ntp time protocol, and 10000 > webmin > > ACCEPT masq fw udp > ssh,domain,bootps,http,https,137,138,139,631,imap,pop3,smtp,nntp,ntp,10000 > #similarly for udp protocol > > - > ACCEPT fw masq tcp ssh,631,137,138,139 - > ACCEPT fw masq udp ssh,631,137,138,139 # these lines allow the >firewall to > make connections out to the local networkfor 631 CUPS traffic, and Samba > traffic > > If you do not what services the port numbers correspond to, there is a list > in /etc/services > > Naturally an entry should only be present if the service is actually > running. If you simply wanted to open the firewall machine up to the local > network, while keeping traffic to the internet restricted, the easiest way > is to put two lines in the policies file > masq fw ACCEPT > fw masq ACCEPT > > After making any change restart shorewall with > service shorewall restart > > Hope that is all understandable - Just remember GUI bad, edits good :-) > > derek I did an "iptables -L" in su console to check everything is ALLOWed, after uninstalling the firewall for now to regain some control, restarted the samba server, rebooted the laptop (stupid thing!) and still samba isn't working. I also now have no ftp access to this box from any other machine on the LAN. This is the point I start to lose my temper with linux. You think you have uninstalled everything, get a reply that all traffic restrictions have been lifted to flow again, even rebooted and still you can't stop something that manages to cause failure of previously working functions, and not know what is causing it. I need some light shed on this problem coz I'm close to giving up after double-figured re-installs. Regards magnet
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
