Shorewall Version 1.0

Documentation


1. Philosophy

2. Components

3. Firewall Structure

4. /etc/shorewall/zones

5. /etc/shorewall/interfaces

6. /etc/shorewall/policy

7. /etc/shorewall/rules

8. /etc/shorewall/masq

9. /etc/shorewall/proxyarp

10. /etc/shorewall/nat

11. /etc/shorewall/tunnels

12. /etc/shorewall/shorewall.conf

13. Starting the Firewall

14. My Configuration Files


1. Philosophy

Shorewall is designed to allow flexible firewall configuration. Whereas its predecessor (Seattle Firewall a.k.a. Seawall) had a large number of very specific parameters and had firewall policy built in, Shorewall takes a different approach. 

Shorewall:

2. Components

Shorewall consists of the following components:

3. Firewall Structure

Shorewall divides hosts zones. Shorewall itself defines exactly one zone called "fw" which refers to the firewall system itself. The /etc/shorewall/zones file is used to define additional zones; the file provided with Shorewall defines the following additional zones:

  1. net -- Interfaces to the (untrusted) internet.
  2. dmz - Interfaces for connecting systems that must be accessible from the internet and from the local network.  Hosts connected to these interfaces cannot be trusted completely since their servers may have been compromised through a security exploit.
  3. local - Interfaces for connecting systems in your local network(s). These systems must be protected from the internet and from the DMZ and in some cases, from each other.
  4. gw - Systems accessed through a tunnel gateway. Depending on your environment these may or may not be trusted. This zone was added in version 1.0.1.

Traffic directed from a zone to the firewall itself is sent through a chain named <zone name>2fw. For example, traffic inbound from the internet and addressed to the firewall is sent through a chain named net2fw. Similarly, traffic originating in the firewall and being sent to a host in a given zone is sent through a chain named fw2<zone name>. For example, traffic originating in the firewall and destined for a host in the local network is sent through a chain named fw2local. 

Traffic being forwarded between two zones (or from one interface to a zone to another interface to that zone) is sent through a chain named <source zone>2<destination zone>. So for example, traffic originating in a local system and destined for a remote web server is sent through chain local2net. Any destination NAT will have occurred before the packet traverses one of these chains so rules in /etc/shorewall/rules should be expressed in terms of the destination system's real IP address as opposed to its apparent external address. Similarly, source NAT will occur after the packet has traversed the appropriate forwarding chain so the rules again will be expressed using the source system's real IP address.

4. /etc/shorewall/zones

This file was introduced in version 1.0.4 and is used to define the network zones. Prior to version 1.0.4, the firewall script itself defined the network zones. There is one entry in /etc/shorewall/zones for each zone; Columns in an entry are:

The /etc/shorewall/zones file released with Shorewall is as follows:

ZONE DISPLAY COMMENTS
net Net Internet
local Local Local networks
dmz DMZ Demilitarized zone
gw Gateway Tunnels to Peers

You may add, delete and modify entries in the /etc/shorewall/zones file as desired so long as you have at least one zone defined.

Warning: If you rename or delete a zone, you should perform "shorewall stop; shorewall start" to install the change rather than "shorewall restart".

5. /etc/shorewall/interfaces

This file is used to tell the firewall which of your firewall's network interfaces are connected to which zone. There will be one entry in /etc/shorewall/interfaces for each of your interfaces. Columns in an entry are:

Example 1: You have a conventional firewall setup in which eth0 connects to a Cable or DSL modem and eth1 connects to your local network and eth0 gets its IP address via DHCP. You want to ignore ping requests from the internet. Your /etc/shorewall/interfaces file would be as follows:

ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect dhcp,noping,norfc1918
local eth1 detect routestopped

Example 2: You have a standalone dialup Linux System. Your /etc/shorewall/interfaces file would be:

ZONE INTERFACE BROADCAST OPTIONS
net ppp0    

6. /etc/shorewall/policy Configuration.

This file is used to describe the firewall policy regarding establishment of connections. Connection establishment is described in terms of clients who initiate connections and servers who receive those connection requests. Policies defined in /etc/shorewall/policy describe which zones are allowed to establish connections with other zones.

Policies established in /etc/shorewall/policy can be viewed as default policies. If no rule in /etc/shorewall/rules applies to a particular connection request then the policy from /etc/shorewall/policy is applied.

Three policies are defined:

For each policy specified in /etc/shorewall/policy, you can indicate that you want a message sent to your system log each time that the policy is applied.

Entries in /etc/shorewall/policy have four columns as follows:

  1. CLIENT - The name of a client zone (a zone defined in the /etc/shorewall/zones file, "fw" or "all").
  2. SERVER - The name of a destination zone (a zone defined in the /etc/shorewall/zones file, "fw" or "all").
  3. POLICY - The default policy for connection requests from the CLIENT zone to the DESTINATION zone.
  4. LOG LEVEL - Optional. If left empty, no log message is generated when the policy is applied. Otherwise, this column should contain an integer or name indicating a syslog level. See the syslog.conf man page for a description of each log level.

In the CLIENT and SERVER columns, you can enter "all" to indicate all zones. 

The policy file installed by default is as follows:

CLIENT SERVER POLICY LOG LEVEL
local net ACCEPT  
net all DROP info
all all REJECT info

This table may be interpreted as follows:

WARNING: When establishing the default policy for a (CLIENT,SERVER) pair, the firewall script processes the /etc/shorewall/policy file from top to bottom and uses the first applicable policy that it finds. For example, in the following policy file, the policy for (local, local) connections would be ACCEPT as specified in the first entry even though the third entry in the file specifies REJECT.

CLIENT SERVER POLICY LOG LEVEL
local all ACCEPT  
net all DROP info
local local REJECT info

7. /etc/shorewall/rules

The /etc/shorewall/rules file defines exceptions to the policies established in the /etc/shorewall/policy file. There is one entry in /etc/shorewall/rules for each of these rules. 

Entries in the file have the following columns:

These forms are used in conjunction with the ADDRESS column described below in order to perform port forwarding and port redirection respectively.

Example 1. You wish to forward all ssh connection requests from the internet to local system 192.168.1.3. 

RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S) ADDRESS
ACCEPT net local:192.168.1.3 tcp ssh - all

Example 2. You want to redirect all www requests from the local network to a Squid server running on the firewall and listening on port 8080. Squid will require access to remote web servers.

RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S) ADDRESS
ACCEPT local fw::8080 tcp www - all
ACCEPT fw net tcp www    

Example 3. You want to run a web server at 155.186.235.222 in your DMZ and have it accessible remotely and locally. the DMZ is managed by Proxy ARP or by classical sub-netting.

RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S) ADDRESS
ACCEPT net dmz:155.186.235.222 tcp www -  
ACCEPT local dmz:155.186.235.222 tcp www    

Example 4. You want to run wu-ftpd on 192.168.2.2 in your masqueraded DMZ. Your internet interface address is 155.186.235.151 and you want the FTP server to be accessible from the local 192.168.1.0/24 and dmz 192.168.2.0/24 subnetworks. Note that size the server is in the 192.168.2.0/24 subnetwork, we can assume that access to the server from that subnet will not involve the firewall.

RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S) ADDRESS
ACCEPT net dmz:192.168.2.2 tcp ftp - all
ACCEPT dmz:192.168.2.2 net tcp - ftp-data  
ACCEPT  local:192.168.1.0/24 dmz:192.168.2.2 tcp ftp   155.186.235.151
ACCEPT dmz:192.168.2.2 local:192.168.1.0/24 tcp - ftp-data  

If you are running wu-ftpd, you you should restrict the range of passive in your /etc/ftpaccess file. I only need a few simultaneous FTP sessions so I use port range 65500-65535. In /etc/ftpaccess, this entry is appropriate:

passive ports  0.0.0.0/0 65500 65534

If you are running pure-ftpd, you would include "-p 65500:65534" on the pure-ftpd runline.

The important point here is to ensure that the port range used for FTP passive connections is unique and will not overlap with any usage on the firewall system.

8. /etc/shorewall/masq

The /etc/shorewall/masq file is used to define classical IP Masquerading. There is one entry in the file for each subnet that you want to masquerade. Columns are:

Example: You have eth0 connected to a cable modem and eth1 connected to your local subnetwork 192.168.9.0/24. Your /etc/shorewall/masq file would look like:

INTERFACE SUBNET
eth0 192.168.9.0/24

9. /etc/shorewall/proxyarp

The /etc/shorewall/proxyarp file is used to define Proxy ARP. You need one entry in this file for each system to be proxy arp'd. Columns are:

Example: You have public IP addresses 155.182.235.0/28. You configure your firewall as follows:

In your DMZ, you want to install a Web/FTP server with public address 155.186.235.4. On the Web server, you establish a host route to  192.168.10.1 and use that as the Web Server's default route. In your /etc/shorewall/proxyarp file, you will have:

ADDRESS INTERFACE EXTERNAL
155.186.235.4 eth2 eth0

10. /etc/shorewall/nat

The /etc/shorewall/nat file is used to define static NAT. There is one entry in the file for each static NAT relationship that you wish to define. Columns in an entry are:

Look here for additional information and an example.

11. /etc/shorewall/tunnels

The /etc/shorewall/tunnels file allows you to define IPSec tunnels with end-points on your firewall. To use this feature, you must install version 1.9 or the current FreeS/WAN development snapshot. 

Instructions for setting up tunnels may be found here.

12. /etc/shorewall/shorewall.conf

This file is used to set the following firewall parameters:

13. Starting/Stopping and Monitoring the firewall.

If you have a permanent internet connection such as DSL or Cable, I recommend that you start the firewall automatically at boot. Once you have installed "firewall" in your init.d directory, simply type "chkconfig --add firewall". This will start the firewall in run levels 2-5 and stop it in run levels 1 and 6. If you want to configure your firewall differently from this default, you can use the "--level" option in chkconfig (see "man chkconfig") or using your favorite graphical run-level editor.

Important Note: If you have specified "detect" for any interfaces in /etc/shorewall/interfaces, then those interfaces must be started before you start the firewall. If you are worried about the window between when your internet interface is started and when Shorewall is started, you can always arrange for the firewall to be stopped prior to starting your internet interface or you can remove the "detect" keyword and replace it with the actual broadcast address for the interface. This will allow you to start your firewall prior to starting your network interfaces. 

If you use dialup, you may want to start the firewall in your /etc/ppp/ip-up.local script. I recommend just placing "shorewall restart" in that script.

You can manually start and stop Shoreline Firewall using the "shorewall" shell program:

The "shorewall" program may also be used to monitor the firewall.


Updated 3/18/2001 - Tom Eastep