[Shorewall-users] Shorewall overlapping zone problem

Alain Degreffe
Wed, 29 May 2002 14:27:04 -0000

Le Mercredi 29 Mai 2002 15:04, vous avez =E9crit :
> On Wed, 29 May 2002, Alain Degreffe wrote:
> > Hi,
> >
> >
> > I have a serious problem with shorewall 1.2.6:
> >
> >
> > I have a loc type zone and a free zone ( some computers in the loc
zone )
> > with full access to all zones. (defined with host file )
> >
> >
> > I have added :
> >
> >
> > free all  ACCEPT
> >
> >
> > BUT Shorewall isolate my "free" subzone in the FORWARD and
OUTPUT CHAIN.
> > "free" is able to connect anything BUT the reverse path is
blocked due to
> > the fact that this stub zone do not follow the parent zone''s
rules. (I
> > mean ZoneX -> loc ACCEPT is not applied to my sub zone
"free" )
> >
> >
> >
> > Each other zone is blocked by rules !!! but loc is able to do more
>
> What is the order of ''free'' and ''loc''
in your /etc/shorewall/zones file?

This is not the problem !

A usefull information: my design

Internet1---------\       /---------- "loc" ( "free" sub
zone)
                   Shorewell
internet2---------/       \---------- "jail" (eth)
                /
                --------------ipsectunnel on internet =3D"extranet"
zone


In our case, i woud like

1.restric loc to firewall(proxy server/shorewall ) and extranet
2.to permit all access to free


The script make "for zone in $zone"  and this work well but in any
case ,
 look the FORWARD chain and you''ll see that any subzone is treated like
 another one

1. take the zone
2. walk trought policies
3. for any combination no described in the policy file, the script add a
matching for all2all chain ( and of course , the forward is blocked )

The "continue" policy is not very usefull if you only use policy to
define
special acces to a sub zone....

I really think that the sub zone is not usable... The script never look for a
parent zone.

I explain the process in the both case ( free before loc and loc before look
 ) 1. free before loc

Well free is able to do what is defined in the policy/rule file but in the
forward CHAIN , all access to free zone is locked and all2all is matched
before extranet2loc

2.loc before free

all2all is matched before free2jail

Any suggestion ?

> -Tom