On 4/14/2014 10:11 AM, Hervé Werner wrote: > Hello. > > > I would like to protect my laptop with Shorewall in the following > network environment : > - user machine not acting as a router having 2 network interfaces : > eth0 and wan0 > - 2 zones : local (internal networks) and internet > - allow some traffic from loc zone (ping, SSH) but however protects > incoming traffic from loc as it came from net (smurfs, tcpflags, > etc...) > > > I tried to setup parallel zones in order to fully separate networks. > However when looking at the rules generated by Shorewall, it excludes > all smurfs and tcpflags checks from loc zone : > > Chain eth0_in (1 references) > pkts bytes target prot opt in out source > destination > 49 6016 dynamic all -- * * 0.0.0.0/0 > 0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED > 105 145K ACCEPT all -- * * 0.0.0.0/0 > 0.0.0.0/0 ctstate RELATED,ESTABLISHED > 49 6016 ~excl0 all -- * * 0.0.0.0/0 > 0.0.0.0/0 ctstate INVALID,NEW,UNTRACKED > 0 0 ACCEPT udp -- * * 0.0.0.0/0 > 0.0.0.0/0 udp dpts:67:68 > 0 0 ~excl1 tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 > 49 6016 ~excl4 all -- * * 0.0.0.0/0 > 0.0.0.0/0 > 49 6016 loc-fw all -- * * 192.168.50.0/24 > 0.0.0.0/0 > 0 0 loc-fw all -- * * 10.30.0.0/19 > 0.0.0.0/0 > 0 0 loc-fw all -- * * 172.16.10.0/29 > 0.0.0.0/0 > > Chain ~excl0 (2 references) > pkts bytes target prot opt in out source > destination > 49 6016 RETURN all -- * * 192.168.50.0/24 > 0.0.0.0/0 > 0 0 RETURN all -- * * 10.30.0.0/19 > 0.0.0.0/0 > 0 0 RETURN all -- * * 172.16.10.0/29 > 0.0.0.0/0 > 0 0 smurfs all -- * * 0.0.0.0/0 > 0.0.0.0/0 [goto] > > Chain ~excl1 (2 references) > pkts bytes target prot opt in out source > destination > 0 0 RETURN all -- * * 192.168.50.0/24 > 0.0.0.0/0 > 0 0 RETURN all -- * * 10.30.0.0/19 > 0.0.0.0/0 > 0 0 RETURN all -- * * 172.16.10.0/29 > 0.0.0.0/0 > 0 0 tcpflags all -- * * 0.0.0.0/0 > 0.0.0.0/0 [goto] > > I'm not sure whether this behaviour is intended because I did not tell > to not check loc zone. > > Also I could not tell Shorewall to consider either eth0 or wlan0 for > the loc & net zones. When adding wlan0 in the interfaces file : > > - eth0 > optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_filter=1,arp_ignore=2 > - wan0 > optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_filter=1,arp_ignore=2 > > > I'm getting this error : ERROR: A provider interface must have at > least one associated zone. >
Corrected config files attached. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
#ZONE HOSTS OPTIONS
loc eth0:\
192.168.50.0/24,\
10.30.0.0/19,\
172.16.10.0/29 -
# # Shorewall version 4.0 - Sample Interfaces File for one-interface configuration. # Copyright (C) 2006 by the Shorewall Team # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # See the file README.txt for further details. #------------------------------------------------------------------------------ # For information about entries in this file, type "man shorewall-interfaces" ############################################################################### ?FORMAT 2 ############################################################################### #ZONE INTERFACE OPTIONS net eth0 optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_filter=1,arp_ignore=2 net wlan0 optional,dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0,arp_filter=1,arp_ignore=2
# # Shorewall version 4.0 - Sample Zones File for one-interface configuration. # Copyright (C) 2006 by the Shorewall Team # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # See the file README.txt for further details. #----------------------------------------------------------------------------- # For information about entries in this file, type "man shorewall-zones" ############################################################################### #ZONE TYPE OPTIONS IN OUT # OPTIONS OPTIONS fw firewall net ipv4 loc:net ipv4
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/NeoTech
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
