Re: Defining "trusted" hosts/nets on a single interface system

Bob Alexander
Tue, 21 Dec 2004 19:37:08 -0000

Tom Eastep wrote:
> On Tue, 2004-12-21 at 18:57 +0100, Bob Alexander wrote:
>
>
>>Now if I try an ftp from 192.168.174.242 to my firewall I get:
>>
>>Dec 21 18:48:06 localhost Shorewall:net2all:DROP:IN=eth0 OUT=
>>SRC=192.168.174.242 DST=192.168.174.244 LEN=48 TOS=0x00 PREC=0x00
>>TTL=128 ID=45825 DF PROTO=TCP SPT=1050 DPT=21 WINDOW=65535 RES=0x00 SYN
>>URGP=0
>>
>>What is it that I am not understanding ??
>>
>
>
> Display your /etc/shorewall/zones file and read:
>
>         # THE ORDER OF THE ENTRIES IN THIS FILE IS IMPORTANT IF YOU HAVE
>         NESTED OR
>         # OVERLAPPING ZONES DEFINED THROUGH /etc/shorewall/hosts.
>         #
>         # See http://www.shorewall.net/Documentation.htm#Nested
>
>
> Go to http://www.shorewall.net/Documentation.htm#Nested and read this:
>
>         Such overlapping/nested zones are allowed and Shorewall
>         processes zones in the order that they appear in
>         the /etc/shorewall/zones file. So if you have nested zones, you
>         want the sub-zone to appear before the super-zone...
>
> Now consider your new zone. It is a sub-zone of the ''net''
zone, right?
> -- does it appear in /etc/shorewall/zones before ''net?
I''m betting that
> it does not.
>
>
>>A second related question: did I interpret correctly the fact that if I
>>want to reinstate the norfc1918 option on my eth0 network and still be
>>able to accept packets from my home LAN I need to list all the lines as
>>computed by the wonderful shorewall iprange in the
>>/etc/shorewall/norfc1918 file ?
>
>
> Well, I would:
>
> a) copy /usr/share/shorewall/rfc1918 to /etc
> b) Add this AT THE FRONT of /etc/shorewall/rfc198:
>
> 	192.168.174.240/29     RETURN
>
> -Tom

Well Tom,
my admiration keep on growing. Really thank you.
So the order of zones is relevant. Got that now.

Good night.
Bob