Re: Defining "trusted" hosts/nets on a single interface system

Tom Eastep
Tue, 21 Dec 2004 18:29:07 -0000

On Tue, 2004-12-21 at 18:57 +0100, Bob Alexander wrote:

>
> Now if I try an ftp from 192.168.174.242 to my firewall I get:
>
> Dec 21 18:48:06 localhost Shorewall:net2all:DROP:IN=eth0 OUT=
> SRC=192.168.174.242 DST=192.168.174.244 LEN=48 TOS=0x00 PREC=0x00
> TTL=128 ID=45825 DF PROTO=TCP SPT=1050 DPT=21 WINDOW=65535 RES=0x00 SYN
> URGP=0
>
> What is it that I am not understanding ??
>

Display your /etc/shorewall/zones file and read:

        # THE ORDER OF THE ENTRIES IN THIS FILE IS IMPORTANT IF YOU HAVE
        NESTED OR
        # OVERLAPPING ZONES DEFINED THROUGH /etc/shorewall/hosts.
        #
        # See http://www.shorewall.net/Documentation.htm#Nested


Go to http://www.shorewall.net/Documentation.htm#Nested and read this:

        Such overlapping/nested zones are allowed and Shorewall
        processes zones in the order that they appear in
        the /etc/shorewall/zones file. So if you have nested zones, you
        want the sub-zone to appear before the super-zone...

Now consider your new zone. It is a sub-zone of the ''net''
zone, right?
-- does it appear in /etc/shorewall/zones before ''net? I''m
betting that
it does not.

> A second related question: did I interpret correctly the fact that if I
> want to reinstate the norfc1918 option on my eth0 network and still be
> able to accept packets from my home LAN I need to list all the lines as
> computed by the wonderful shorewall iprange in the
> /etc/shorewall/norfc1918 file ?

Well, I would:

a) copy /usr/share/shorewall/rfc1918 to /etc
b) Add this AT THE FRONT of /etc/shorewall/rfc198:

	192.168.174.240/29     RETURN

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key