-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 03/11/2017 08:56 AM, [email protected] wrote: > I'm working on my 1st shorewall setup. > > It's running on a 2 ethernet interface box, with a VPN connection > too. > > Reading the copious docs I got all that working \o/ > > Now I want to add a USB WiFi interface that will be used for only > one purpose -- as an AccessPoint for guests to access the EXTERNAL > internet only. > > I want to just allow them to login in (using hostapd) and get to > the 'net. Hostapd + dhcp gives them a 10.128.128.##/24 address on > login. Nothing else in my LAN will ever use that segment. > > I want them to completely bypass all my internal LAN infrastructure > -- no broadcast, no FW rules, etc. All firewall-ing, dns, etc. I > want them to worry about on their own -- and using external > resources )e.g., NOT using my LAN dns). > > I'd like to make sure that providing that access is a lightweight > on my shorewall as possible. > > So I _think_ I need to set this up as a DMZ. > > So far, just based on reading & examples, I added this to my > shorewall config > > hosts wifi0 WIFI0_IF:10.128.128.0/24 > > zones wifi0 ipv4 > > params GUEST_WIFI0_IF=wlan0 > > interfaces wifi0 WIFI0_IF > optional,physical=$GUEST_WIFI0_IF,dhcp,tcpflags,nosmurfs,logmartians=1,routefilter=1,sourceroute=0 > > Does that look about right? I'm not sure if that's "overdone or > underdone" :-/ The examples I found all seem to integrate the wifi > INTO the lan -- I'm trying to make sure it AVOIDS the lan, and is > just a "fast/lean pipe" to the net. The "leave my LAN alone" part > is what I'm most concerned about from a security perspective. Not > putting unneccessary load on my firewall would be nice too. > > If the above is right, is there a MACRO that makes it simple for > > rules > > ? Or is there a simple rule(s) that should do it? >
You don't need any rules. You just need policies: net wifiO ACCEPT wifiO net ACCEPT all wifiO REJECT wifiO all REJECT And you don't need the hosts file entry either. - -Tom - -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.net \________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJYxFIuAAoJEJbms/JCOk0QlXAQAItA55a96JOJ8eEGZAmUNmc6 6KzBfvB2EUkwkW39acQkGWSjrX9FSC11z0QhrannJC9G43cXNSmsBqXaIS4iT67E rr3YPfvIlLuWgUv+5KtIh6xNpY9YIAgg11ag+q/0Lfo0RrrIEdkXWzgUhqBQMJ8U tGrWSWVNXhBDFkXpBlTrRUFADJmEtDJPsCSDez7Z4HaN1yXNpqY3mXHR3lZEx7NN Xnx9WLdhpx1xJnD9nHDXfyeRqtYiQ8n/+yi5uXAyuwJqMRRDRSjsZzb65LvvLQzz 3IdQ8v0f7ckOOqLRCOy19STzGwfjpSo0SeCEl+AxxTKPZf5b8NAA6a/imBsJce37 gRyv413b7tIpKwNltIY1SMNMpDiFfYstA77I7eNQ5LMOwtO8yk0GBbzAZJ6jZo6Y X7tM5eaexcbJUeFJ45LacpfJrgNi2fZ4Vs4MBthUjnbLFIijSrVJsra0JdQzL2NK OSLBF8LIFyEate2Y+9s1Ir9tncRT+X/Tc7r8+O/Ug1s9mhb5EbOzGPdlXjVLI09A D2tv+AoNPB/mAD5o4YwXIkSShta9EVt1+ZMJm2zx/pgZCs3Yr0owkgwJTgtxJ7TH B/up9WOT9PEBEfwZ8KpWTflvUkulUvdMuo4JS+bpmlvkiyl16d/S6Dx2Dw1Nu+zk 9hLCyfDQPcaepaUGvcsd =CDRJ -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
