Andrew Suffield wrote:

> 
> So it seems like there's two ways to tackle this problem. The first is
> to dramatically reduce the number of iptables rules used by the
> firewall by restructuring it differently - I'm not sure if this is
> possible, so I'm attaching the relevant parts of one of them in case
> anybody has any ideas (the other is much the same, only bigger)

I've attached an updated configuration which is similar. It requires
that you manually configure the broadcast addresses in the interfaces
file (I've just put "-") but it compiles on my not-so-new laptop in 10
seconds.

> The other way is to modify shorewall to use a different approach to
> installing rules. It seems to me that iptables-restore could be
> (ab)used to perform batch installations of many rules at once. I think
> that's either a really good idea or a really bad one, but I'm not sure
> which.

That change is almost as big as the change from 3.0 -> 3.2. I've looked
at it but I'm out of energy for this type of massive change at the moment.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ [EMAIL PROTECTED]
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key
###############################################################################
#ZONE   HOST(S)                                 OPTIONS
site    eth2.100:10.1.0.0/24
mon     eth2.201:10.1.201.11

# For practical purposes, we'll classify these as part of the management zone
mng     eth2.102:10.1.102.11
mng     eth2.102:10.1.102.12

woff    eth2.102:10.1.200.0/24
nec     eth2.102:10.1.106.0/25
tag     eth2.102:10.1.106.128/25
vpn     eth2.102:10.1.105.0/24
mng     eth2.102:10.1.101.0/24

wfl    eth2.102:0.0.0.0/0

wfd     eth2.102:10.1.50.0/24
wbd     eth2.102:10.1.51.0/24
wdayc   eth2.102:10.1.52.0/24

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE
###############################################################################
#ZONE   INTERFACE       BROADCAST       OPTIONS
link    eth2.102        detect
aoff    eth2.201        detect          dhcp
serv    eth2.100        detect          dhcp
dev     eth2.202        detect
afl     eth2.3+         -               dhcp
afl     eth2.4+         -               dhcp
rogue   eth2.1          detect
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
###############################################################################
#SOURCE         DEST            POLICY          LOG             LIMIT:BURST
#                                               LEVEL
fw              all             ACCEPT
dev             all             ACCEPT
all             all             REJECT
#LAST LINE -- DO NOT REMOVE
#############################################################################################################
#ACTION SOURCE          DEST            PROTO   DEST    SOURCE          
ORIGINAL        RATE            USER/
#                                               PORT(S) PORT(S)         DEST    
        LIMIT           GROUP
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW

# Reject all new tcp packets that aren't SYNs - these are junk, or worms
rejNotSyn:info link all tcp

ACCEPT fw link 89
ACCEPT link fw 89

Ping/ACCEPT fw all
Ping/ACCEPT serv all
Ping/ACCEPT woff fw
Ping/ACCEPT all serv
Ping/ACCEPT all fw
Ping/ACCEPT all link
Ping/ACCEPT link serv:195.80.27.218

# Site DNS service
DNS/ACCEPT all site:10.1.0.1
DNS/ACCEPT serv:10.1.100.2 link

# SSH - pretty permissive here
SSH/ACCEPT all link
SSH/ACCEPT fw all
SSH/ACCEPT all fw
SSH/ACCEPT woff serv
SSH/ACCEPT aoff serv

# Outbound mail access
IMAPS/ACCEPT woff link

# OpenVPN tunnels
ACCEPT all fw tcp openvpn
ACCEPT all fw udp openvpn

# Internet-accessible services
IMAPS/ACCEPT all serv:10.1.100.2
Web/ACCEPT   all serv:10.1.100.2
SMTP/ACCEPT  all serv:10.1.100.2
DNS/ACCEPT   all serv:10.1.100.2
NTP/ACCEPT   all serv:10.1.100.2

Web/ACCEPT woff serv:10.1.100.5
Web/ACCEPT aoff serv:10.1.100.5
ACCEPT woff serv:10.1.100.6 tcp 3050,5900
ACCEPT aoff serv:10.1.100.6 tcp 3050,5900
SMB/ACCEPT woff serv
SMB/ACCEPT aoff serv
SMB/ACCEPT serv woff
SMB/ACCEPT serv aoff

# Systems management
Telnet/ACCEPT woff mng
Web/ACCEPT    woff mng
Telnet/ACCEPT aoff mng
Web/ACCEPT    aoff mng
Telnet/ACCEPT fw mng
Web/ACCEPT    fw mng
ACCEPT        mng serv udp tftp

# For the servers
Web/ACCEPT   serv:10.1.100.2 link
FTP/ACCEPT   serv:10.1.100.2 link
NTP/ACCEPT   serv:10.1.100.2 link
SMTP/ACCEPT  serv:10.1.100.2 link
Web/ACCEPT   serv:10.1.100.2 mon
Web/ACCEPT   fw all
SMB/ACCEPT   fw all
SMB/ACCEPT   all fw

# Site services
NTP/ACCEPT all site:10.1.0.2

# Web proxy access
ACCEPT all serv:10.1.100.2 tcp http,webcache

ACCEPT site:10.1.0.3 nec tcp 5060,5070,1720,1730
ACCEPT site:10.1.0.3 nec udp 5060,5070
ACCEPT site:10.1.0.3 nec udp 
8000:8020,10020:10040,10100,4000,1720,3000,3001,1000
ACCEPT nec site:10.1.0.3 tcp 5060,5070,1720,1730
ACCEPT nec site:10.1.0.3 udp 5060,5070
ACCEPT nec site:10.1.0.3 udp 
8000:8020,10020:10040,10100,4000,1720,3000,3001,1000
ACCEPT woff nec tcp 8,8000
ACCEPT woff nec tcp 5060,5070
ACCEPT woff nec udp 5060,5070
ACCEPT woff nec udp 
8000:8020,10020:10040,10100,4000,1720,3000,3001,1000,3456,3458
ACCEPT nec woff udp 5060,5070
ACCEPT nec woff udp 
8000:8020,10020:10040,10100,4000,1720,3000,3001,1000,3456,3458
ACCEPT nec site:10.1.0.3 all
ACCEPT site:10.1.0.3 nec all
ACCEPT woff site:10.1.0.3 udp 5060,5070,8000:8020,10020:10040
ACCEPT woff mon:10.1.200.11 udp 5060,5070,8000:8020,10020:10040

# Tag control stuff
SSH/ACCEPT woff mon
Web/ACCEPT woff mon
ACCEPT woff mon udp 12001
ACCEPT mon wfl1:10.1.1.2 udp tftp,12000
ACCEPT mon wfl2:10.1.2.2 udp tftp,12000
ACCEPT mon wfl3:10.1.3.2 udp tftp,12000
ACCEPT mon wfl4:10.1.4.2 udp tftp,12000
ACCEPT mon wfl5:10.1.5.2 udp tftp,12000
ACCEPT mon wfl6:10.1.6.2 udp tftp,12000
ACCEPT mon wfl7:10.1.7.2 udp tftp,12000
ACCEPT mon wfl8:10.1.8.2 udp tftp,12000
ACCEPT mon wfl9:10.1.9.2 udp tftp,12000
ACCEPT mon wfl10:10.1.10.2 udp tftp,12000
ACCEPT mon wfl11:10.1.11.2 udp tftp,12000
ACCEPT mon wfl12:10.1.12.2 udp tftp,12000
ACCEPT mon wfl13:10.1.13.2 udp tftp,12000
ACCEPT mon wfl14:10.1.14.2 udp tftp,12000
ACCEPT mon wfl15:10.1.15.2 udp tftp,12000
ACCEPT mon wfl16:10.1.16.2 udp tftp,12000
ACCEPT mon wfl17:10.1.17.2 udp tftp,12000
ACCEPT mon wfl18:10.1.18.2 udp tftp,12000
ACCEPT mon wfl19:10.1.19.2 udp tftp,12000
ACCEPT mon wfl20:10.1.20.2 udp tftp,12000
ACCEPT mon wfl21:10.1.21.2 udp tftp,12000
ACCEPT mon wfl22:10.1.22.2 udp tftp,12000
ACCEPT mon wfl23:10.1.23.2 udp tftp,12000
ACCEPT mon wfl24:10.1.24.2 udp tftp,12000
ACCEPT mon wfl25:10.1.25.2 udp tftp,12000
ACCEPT mon wfl26:10.1.26.2 udp tftp,12000
ACCEPT mon wfl27:10.1.27.2 udp tftp,12000
ACCEPT mon wfd:10.1.50.2 udp tftp,12000
ACCEPT mon wbd:10.1.51.2 udp tftp,12000
ACCEPT mon wdayc:10.1.52.2 udp tftp,12000
ACCEPT mon afl:10.1.1.2 udp tftp,12000
ACCEPT mon afl:10.1.2.2 udp tftp,12000
ACCEPT mon afl:10.1.3.2 udp tftp,12000
ACCEPT mon afl:10.1.4.2 udp tftp,12000
ACCEPT mon afl:10.1.5.2 udp tftp,12000
ACCEPT mon afl:10.1.6.2 udp tftp,12000
ACCEPT mon afl:10.1.7.2 udp tftp,12000
ACCEPT mon afl:10.1.8.2 udp tftp,12000
ACCEPT mon afl:10.1.9.2 udp tftp,12000
ACCEPT mon afl:10.1.10.2 udp tftp,12000
ACCEPT mon afl:10.1.11.2 udp tftp,12000
ACCEPT mon afl:10.1.12.2 udp tftp,12000
ACCEPT mon afl:10.1.13.2 udp tftp,12000
ACCEPT mon afl1:10.1.14.2 udp tftp,12000
ACCEPT mon afl:10.1.15.2 udp tftp,12000
ACCEPT mon afl:10.1.16.2 udp tftp,12000

ACCEPT wfl:10.1.1.2 mon udp tftp,12000
ACCEPT wfl:10.1.2.2 mon udp tftp,12000
ACCEPT wfl:10.1.3.2 mon udp tftp,12000
ACCEPT wfl:10.1.4.2 mon udp tftp,12000
ACCEPT wfl:10.1.5.2 mon udp tftp,12000
ACCEPT wfl:10.1.6.2 mon udp tftp,12000
ACCEPT wfl:10.1.7.2 mon udp tftp,12000
ACCEPT wfl:10.1.8.2 mon udp tftp,12000
ACCEPT wfl:10.1.9.2 mon udp tftp,12000
ACCEPT wfl:10.1.10.2 mon udp tftp,12000
ACCEPT wfl:10.1.11.2 mon udp tftp,12000
ACCEPT wfl:10.1.12.2 mon udp tftp,12000
ACCEPT wfl:10.1.13.2 mon udp tftp,12000
ACCEPT wfl:10.1.14.2 mon udp tftp,12000
ACCEPT wfl:10.1.15.2 mon udp tftp,12000
ACCEPT wfl:10.1.16.2 mon udp tftp,12000
ACCEPT wfl:10.1.17.2 mon udp tftp,12000
ACCEPT wfl:10.1.18.2 mon udp tftp,12000
ACCEPT wfl:10.1.19.2 mon udp tftp,12000
ACCEPT wfl:10.1.20.2 mon udp tftp,12000
ACCEPT wfl:10.1.21.2 mon udp tftp,12000
ACCEPT wfl:10.1.22.2 mon udp tftp,12000
ACCEPT wfl:10.1.23.2 mon udp tftp,12000
ACCEPT wfl:10.1.24.2 mon udp tftp,12000
ACCEPT wfl:10.1.25.2 mon udp tftp,12000
ACCEPT wfl:10.1.26.2 mon udp tftp,12000
ACCEPT wfl:10.1.27.2 mon udp tftp,12000
ACCEPT wfd:10.1.50.2 mon udp tftp,12000
ACCEPT wbd:10.1.51.2 mon udp tftp,12000
ACCEPT wdayc:10.1.52.2 mon udp tftp,12000
ACCEPT afl:10.1.1.2 mon udp tftp,12000
ACCEPT afl:10.1.2.2 mon udp tftp,12000
ACCEPT afl:10.1.3.2 mon udp tftp,12000
ACCEPT afl:10.1.4.2 mon udp tftp,12000
ACCEPT afl:10.1.5.2 mon udp tftp,12000
ACCEPT afl:10.1.6.2 mon udp tftp,12000
ACCEPT afl:10.1.7.2 mon udp tftp,12000
ACCEPT afl:10.1.8.2 mon udp tftp,12000
ACCEPT afl:10.1.9.2 mon udp tftp,12000
ACCEPT afl:10.1.10.2 mon udp tftp,12000
ACCEPT afl:10.1.11.2 mon udp tftp,12000
ACCEPT afl:10.1.12.2 mon udp tftp,12000
ACCEPT afl:10.1.13.2 mon udp tftp,12000
ACCEPT afl:10.1.14.2 mon udp tftp,12000
ACCEPT afl:10.1.15.2 mon udp tftp,12000
ACCEPT afl:10.1.16.2 mon udp tftp,12000

Web/ACCEPT mon wfl:10.1.1.2
Web/ACCEPT mon wfl:10.1.2.2
Web/ACCEPT mon wfl:10.1.3.2
Web/ACCEPT mon wfl:10.1.4.2
Web/ACCEPT mon wfl:10.1.5.2
Web/ACCEPT mon wfl:10.1.6.2
Web/ACCEPT mon wfl:10.1.7.2
Web/ACCEPT mon wfl:10.1.8.2
Web/ACCEPT mon wfl:10.1.9.2
Web/ACCEPT mon wfl:10.1.10.2
Web/ACCEPT mon wfl:10.1.11.2
Web/ACCEPT mon wfl:10.1.12.2
Web/ACCEPT mon wfl:10.1.13.2
Web/ACCEPT mon wfl:10.1.14.2
Web/ACCEPT mon wfl:10.1.15.2
Web/ACCEPT mon wfl:10.1.16.2
Web/ACCEPT mon wfl:10.1.17.2
Web/ACCEPT mon wfl:10.1.18.2
Web/ACCEPT mon wfl:10.1.19.2
Web/ACCEPT mon wfl:10.1.20.2
Web/ACCEPT mon wfl:10.1.21.2
Web/ACCEPT mon wfl:10.1.22.2
Web/ACCEPT mon wfl:10.1.23.2
Web/ACCEPT mon wfl:10.1.24.2
Web/ACCEPT mon wfl:10.1.25.2
Web/ACCEPT mon wfl:10.1.26.2
Web/ACCEPT mon wfl:10.1.27.2
Web/ACCEPT mon wfd:10.1.50.2
Web/ACCEPT mon wbd:10.1.51.2
Web/ACCEPT mon wdayc:10.1.52.2
Web/ACCEPT mon afl:10.1.1.2
Web/ACCEPT mon afl:10.1.2.2
Web/ACCEPT mon afl:10.1.3.2
Web/ACCEPT mon afl:10.1.4.2
Web/ACCEPT mon afl:10.1.5.2
Web/ACCEPT mon afl:10.1.6.2
Web/ACCEPT mon afl:10.1.7.2
Web/ACCEPT mon afl:10.1.8.2
Web/ACCEPT mon afl:10.1.9.2
Web/ACCEPT mon afl:10.1.10.2
Web/ACCEPT mon afl:10.1.11.2
Web/ACCEPT mon afl:10.1.12.2
Web/ACCEPT mon afl:10.1.13.2
Web/ACCEPT mon afl:10.1.14.2
Web/ACCEPT mon afl:10.1.15.2
Web/ACCEPT mon afl:10.1.16.2

Syslog/ACCEPT all mon

ACCEPT all serv:10.1.100.5 udp 12000
ACCEPT serv:10.1.100.5 all udp 12000
ACCEPT woff serv:10.1.100.5 tcp 12001
Syslog/ACCEPT all serv:10.1.100.5

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
###############################################################################
#ZONE   TYPE            OPTIONS         IN                      OUT
#                                       OPTIONS                 OPTIONS
fw      firewall
rogue
site

mon
mng
serv
dev

nec
tag
woff
aoff

wfd
wbd
wdayc
wfl
afl

vpn
link
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

Attachment: signature.asc
Description: OpenPGP digital signature

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Reply via email to