> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > On 03/11/2017 08:56 AM, [email protected] wrote: >> I'm working on my 1st shorewall setup. >> >> It's running on a 2 ethernet interface box, with a VPN connection >> too. >> >> Reading the copious docs I got all that working \o/ >> >> Now I want to add a USB WiFi interface that will be used for only >> one purpose -- as an AccessPoint for guests to access the EXTERNAL >> internet only. >> >> I want to just allow them to login in (using hostapd) and get to >> the 'net. Hostapd + dhcp gives them a 10.128.128.##/24 address on >> login. Nothing else in my LAN will ever use that segment. >> >> I want them to completely bypass all my internal LAN infrastructure >> -- no broadcast, no FW rules, etc. All firewall-ing, dns, etc. I >> want them to worry about on their own -- and using external >> resources )e.g., NOT using my LAN dns). >> >> I'd like to make sure that providing that access is a lightweight >> on my shorewall as possible. >> >> So I _think_ I need to set this up as a DMZ. >> >> So far, just based on reading & examples, I added this to my >> shorewall config >> >> hosts wifi0 WIFI0_IF:10.128.128.0/24 >> >> zones wifi0 ipv4 >> >> params GUEST_WIFI0_IF=wlan0 >> >> interfaces wifi0 WIFI0_IF >> optional,physical=$GUEST_WIFI0_IF,dhcp,tcpflags,nosmurfs,logmartians=1,routefilter=1,sourceroute=0 >> >> Does that look about right? I'm not sure if that's "overdone or >> underdone" :-/ The examples I found all seem to integrate the wifi >> INTO the lan -- I'm trying to make sure it AVOIDS the lan, and is >> just a "fast/lean pipe" to the net. The "leave my LAN alone" part >> is what I'm most concerned about from a security perspective. Not >> putting unneccessary load on my firewall would be nice too. >> >> If the above is right, is there a MACRO that makes it simple for >> >> rules >> >> ? Or is there a simple rule(s) that should do it? >> > You don't need any rules. You just need policies: > > net wifiO ACCEPT > wifiO net ACCEPT > all wifiO REJECT > wifiO all REJECT > > And you don't need the hosts file entry either. > > - -Tom > - -- > Tom Eastep \ Q: What do you get when you cross a mobster with > Shoreline, \ an international standard? > Washington, USA \ A: Someone who makes you an offer you can't > http://shorewall.net \________________________________________________ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > Comment: GPGTools - http://gpgtools.org > > iQIcBAEBCAAGBQJYxFIuAAoJEJbms/JCOk0QlXAQAItA55a96JOJ8eEGZAmUNmc6 > 6KzBfvB2EUkwkW39acQkGWSjrX9FSC11z0QhrannJC9G43cXNSmsBqXaIS4iT67E > rr3YPfvIlLuWgUv+5KtIh6xNpY9YIAgg11ag+q/0Lfo0RrrIEdkXWzgUhqBQMJ8U > tGrWSWVNXhBDFkXpBlTrRUFADJmEtDJPsCSDez7Z4HaN1yXNpqY3mXHR3lZEx7NN > Xnx9WLdhpx1xJnD9nHDXfyeRqtYiQ8n/+yi5uXAyuwJqMRRDRSjsZzb65LvvLQzz > 3IdQ8v0f7ckOOqLRCOy19STzGwfjpSo0SeCEl+AxxTKPZf5b8NAA6a/imBsJce37 > gRyv413b7tIpKwNltIY1SMNMpDiFfYstA77I7eNQ5LMOwtO8yk0GBbzAZJ6jZo6Y > X7tM5eaexcbJUeFJ45LacpfJrgNi2fZ4Vs4MBthUjnbLFIijSrVJsra0JdQzL2NK > OSLBF8LIFyEate2Y+9s1Ir9tncRT+X/Tc7r8+O/Ug1s9mhb5EbOzGPdlXjVLI09A > D2tv+AoNPB/mAD5o4YwXIkSShta9EVt1+ZMJm2zx/pgZCs3Yr0owkgwJTgtxJ7TH > B/up9WOT9PEBEfwZ8KpWTflvUkulUvdMuo4JS+bpmlvkiyl16d/S6Dx2Dw1Nu+zk > 9hLCyfDQPcaepaUGvcsd > =CDRJ > -----END PGP SIGNATURE----- > > ------------------------------------------------------------------------------ > Announcing the Oxford Dictionaries API! The API offers world-renowned > dictionary content that is easy and intuitive to access. Sign up for an > account today to start using our lexical data to power your apps and > projects. Get started today and enter our developer competition. > http://sdm.link/oxford > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users
On 3/11/17 12:38 PM, Tom Eastep wrote: Tom, Hey just curious, how come you say to do: net wifi ACCEPT at the top of that policy file? Does that open up more that desired? Also doesn't there need to be a MASQUERADE line in snat file? MASQUERADE 10.128.128.0/24 eth0 (or whatever interface for net is) ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
