Shorewall and selective access

Greg Shepherd
2004-12-19T18:42:09Z

Tom,

	I punted by the time I got your message on the startup issue. I
re-imaged my system to a base configuration and resolved my problem with the
startup issue.

Thanks for your help.

To All!

I am on my last portion of my configuration and I must confess to being
stumped.

I read the documentation about interfaces, zones, hosts, etc. and read some
googled postings on groups of hosts in the same subnet and managing those
hosts by zones.

I have been attempting to accomplish the following:

Two interface system. (works)
Redirecting transparently users to squid port 3128 except for web server on
local system. (works)
DNAT of a different port to an internal system. (works)
Create adm zone with a short list of specific hosts with unrestricted
access. (HELP!)
Use adm zone to bypass squid port. (Help)
Access to 3128 is for an admin system acting as a content-filtering server
and attempting to force users to use that internal server on a different
port for http access.
Use loc zone for denying access to 3128 on firewall and port 80 to Internet,
but not port 80 on firewall. (I belie I can do this if I can get the
zone/hosts piece working.

Here is what I have at the moment.

Interfaces
#ZONE     INTERFACE     BROADCAST     OPTIONS
net       eth0          detect        routefilter, tcpflags
-       eth1          detect		tcpflags

Zones
#ZONE    DISPLAY     COMMENTS
net      net         The Internet
ADM      ADM 	   Administrative stations
loc      Local       Local Network


This is how it is spaced in the file.
Policy
#SOURCE     		 DEST        POLICY       LOG LEVEL
ADM		 net		 CONTINUE
loc          		 net         ACCEPT
net         		 all         DROP         info
all          		 all         REJECT       info

Hosts
#ZONE     HOST(S)                     OPTIONS
loc       eth1:0.0.0.0/0
ADM       eth1:10.0.0.103

Rules
ACCEPT		fw		net		tcp	53
ACCEPT		fw		net		udp	53
ACCEPT		loc		fw		tcp	22
ACCEPT		loc		fw		icmp	8
ACCEPT		net		fw		icmp	8
ACCEPT		fw		loc		icmp
ACCEPT		fw		net		icmp
ACCEPT	loc	$FW	tcp	5801,5901
ACCEPT	net	$FW	tcp	5801,5901
DNAT	net	loc:10.0.0.100	tcp	3389
REDIRECT	loc	3128	tcp	www	-	10.0.0.102
ACCEPT	$FW	net	tcp	www
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Can anyone guide me?

Thanks!

Greg


-----Original Message-----
From: Tom Eastep [mailto:teastep@shorewall.net]
Sent: Saturday, December 18, 2004 2:35 PM
To: Greg.Shepherd@netmanaged.com
Cc: Shorewall Users
Subject: RE: [Shorewall-users] SuSe 9.1 startup issue


On Sat, 2004-12-18 at 14:16 -0500, Greg Shepherd wrote:

> >
> > I restart shorewall and it works, but not at boot time.
> >
> > Do you have any other suggestions?
>
> No -- I''ve run SuSE on my firewalls off and on for almost a year
and
> I''ve never seen the problem you report. Of course, I''ve
never used the
> YaST RunLevel Editor either; I use insserv or chkconfig.

What does the output of "chkconfig --list" look like?