Defining "trusted" hosts/nets on a single interface system

Bob Alexander
Tue, 21 Dec 2004 17:57:19 -0000

Ok, I give up. I tried, really hard, before asking but I must be the
most stupid shorewall user on the planet :(

My laptop runs a single eth0 interface and knows Net and Firewall as
zones and the default "inbound" policies are Net->Any DROP and
>ny->Any
REJECT.

Now at home I have my trusted 192.168.174.240/29 subnet which hosts my
very trusted 192.168.174.242 host and I would like to accept quite a few
protocols coming from that node/subnet (ftp clients and windows printer
sharing amongst others).

I therefore tried defining a new ZONE called HomeLan and then a new
"Zone Hosts" for zone HomeLan on eth0 with 192.168.174.240/29.

I then defined a new default policy with source HomeLan, dest Firewall
Policy ACCEPT and placed it right under the first entry (FW->Net Accept)

Now if I try an ftp from 192.168.174.242 to my firewall I get:

Dec 21 18:48:06 localhost Shorewall:net2all:DROP:IN=eth0 OUT=
SRC=192.168.174.242 DST=192.168.174.244 LEN=48 TOS=0x00 PREC=0x00
TTL=128 ID=45825 DF PROTO=TCP SPT=1050 DPT=21 WINDOW=65535 RES=0x00 SYN
URGP=0

What is it that I am not understanding ??

A second related question: did I interpret correctly the fact that if I
want to reinstate the norfc1918 option on my eth0 network and still be
able to accept packets from my home LAN I need to list all the lines as
computed by the wonderful shorewall iprange in the
/etc/shorewall/norfc1918 file ?

Thank you very much
Bob

t40:/etc/shorewall# shorewall iprange 192.168.0.0-192.168.174.239
192.168.0.0/17
192.168.128.0/19
192.168.160.0/21
192.168.168.0/22
192.168.172.0/23
192.168.174.0/25
192.168.174.128/26
192.168.174.192/27
192.168.174.224/28
t40:/etc/shorewall# shorewall iprange 192.168.174.248-192.168.255.255
192.168.174.248/29
192.168.175.0/24
192.168.176.0/20
192.168.192.0/18