Filter
Top Products
RuggedRouter® User Guide
Hosts
Shorewall hosts are used to assign zones to individual hosts or subnets, on an interface
which handles multiple subnets. This allows the firewall to manage traffic being
forwarded back out the interface it arrived on, but destined for another subnet. This is
often useful for VPN setups to handle the VPN traffic separately from the other traffic
on the interface which carries the VPN traffic. An example follows:
Zone Interface IP Address or Network
local eth3 10.0.0.0/8
guests eth3 192.168.0.0/24
Interfaces are defined in the file /etc/shorewall/hosts and are modified from the
Network Hosts menu.
Policy
Shorewall policies are the default actions for connection establishment between
different firewall zones. Each policy is of the form:
Source-zone Destination-zone Default-action
You can define a policy from each zone to each other. You may also use a wildcard
zone of “all” to represent all zones.
The default action describes how to handle the connection request. There are six
types of actions: ACCEPT, DROP, REJECT, QUEUE, CONTINUE and NONE. The
first three are the most widely used and are described here.
When the ACCEPT policy is used, a connection is allowed. When the DROP policy
is used, a request is simply ignored. No notification is made to the requesting client.
When the REJECT policy is used, a request is rejected with an TCP RST or an ICMP
destination-unreachable packet being returned to the client.
An example should illustrate the use of policies.
Source Zone Destination Zone Policy
loc net ACCEPT
net all DROP
all all REJECT
The above policies will:
• Allow connection requests only from your local network to the Internet. If
you wanted to allow requests from a console on the RuggedRouter to
Internet you would need to add a policy of ACCEPT fw zone to net zone.
• Drop (ignore) all connection requests from the Internet to your firewall or
local network, and
• Reject all other connection requests.
Note that a client on the Internet that is probing the RuggedRouter's TCP/UDP ports
will receive no responses and will not be able to detect the presence of the router. A
host in the local network, on the other hand, will fail to connect to the router but will
receive a notification.
Note that order of policies is important. If the last rule of this example were entered
first then no connections at all would be allowed.
Policies are defined in the file /etc/shorewall/policy and are modified from the
Default Policy menu.
114 RuggedCom