[Shorewall-users] Shorewall overlapping zone problem

Tom Eastep
Wed, 29 May 2002 14:30:30 -0000

On Wed, 29 May 2002, Alain Degreffe wrote:

> >
> > What is the order of ''free'' and
''loc'' in your /etc/shorewall/zones file?
>
> This is not the problem !
>
> A usefull information: my design
>
> Internet1---------\       /---------- "loc" ( "free"
sub zone)
>                    Shorewell
> internet2---------/       \---------- "jail" (eth)
>                 /
>                 --------------ipsectunnel on internet ="extranet"
zone
>
>
> In our case, i woud like
>
> 1.restric loc to firewall(proxy server/shorewall ) and extranet
> 2.to permit all access to free
>
>
> The script make "for zone in $zone"  and this work well but in
any case ,
>  look the FORWARD chain and you''ll see that any subzone is treated
like
>  another one
>
> 1. take the zone
> 2. walk trought policies
> 3. for any combination no described in the policy file, the script add a
> matching for all2all chain ( and of course , the forward is blocked )
>
> The "continue" policy is not very usefull if you only use policy
to define
> special acces to a sub zone....
>
> I really think that the sub zone is not usable... The script never look for
a
> parent zone.
>
> I explain the process in the both case ( free before loc and loc before
look
>  ) 1. free before loc
>
> Well free is able to do what is defined in the policy/rule file but in the
> forward CHAIN , all access to free zone is locked and all2all is matched
> before extranet2loc
>
> 2.loc before free
>
> all2all is matched before free2jail
>
> Any suggestion ?
>

Yes -- please tar up your /etc/shorewall directory and send it to me along
with the output of "shorewall status" -- I can''t make any
sense of your
report without it.

-Tom