Setup shorewall with two interfaces

One of the most basic things whenever you setup a network is allow access from an externel network and then secure it. Both these tasks are easily achieved by using a firewall. A popular choice of firewall is shorewall, in this article I will show you how to configure a simple network two interface network. You allow all traffic from the internal network to the external network but block all traffic except ICMP and http from the external network. So without further delay lets get started.

First you have to install shorewall to this:
yum install shorewall (Fedora/Redhat)
apt-get install shorewall (Ubuntu/Debian)

Now you should have a /etc/shorewall directory and in it there is shorewall.conf file. This is the first file you edit. Im only going to list the lines you'll have to change in the shorewall.conf file:

#Change this from No to Yes
STARTUP_ENABLED=Yes

#Name of firewall zone, if you don't set it you'll have to configure it in zones file
#Set this to fw
FW=fw

#Enable IP Forwarding
#Set this to On
IP_FORWARDING=On

That is all you have to change in the shorewall.conf, You don't need to change other default values.

Now edit/create /etc/shorewall/zones file
You specify one zone net which is the external zone and one zone loc which is for your local network

net ipv4
loc ipv4

Now that you have specified the zones its time to bind them to their interfaces. Lets suppose eth1 is connected to the external network and eth0 is connected to the local network.Time to edit/create /etc/shorewall/interfaces

loc eth0 detect tcpflags
net eth1 detect routefilter,tcpflags,nosmurfs

What you have done in this is bind eth0 to zone loc and told the firewall to detect the broadcast address and check for bad tcp flags. The other thing you have done is bind eth1 to zone net, autodetect broadcast address and check for bad tcp flags+ disable source routing+ check for broadcast source packets.

Upto now you have done these things :
Setup three zones fw(the firewall zone i.e the machine firewall is running on),loc(the local network) and net(the external zone). You have also bound these zones to specific interfaces and enabled IP forwarding.

For sharing an internet connection between multiple computers using a single external IP linux does something called IP masquerading. What it basically means is when you send your packets to the external network the firewall changes the source IP to your external IP and keeps track of who sent the packet to whom. When the host you have sent the packet to replies the firewall recieves the packet and changes the destination address to your IP and sends the packet to you. Sounds tough? To setup IP masquerading for your loc zone(eth0) to access the net zone(eth1) create/edit /etc/shorewall/masq like this:

eth1 eth0

Maybe it isn't so complicated afterall. Now you almost have a fully functional but for one thing You don't have any policy/rule for packet filtering! What are you waiting for create a default policy now. Just create/edit /etc/shorewall/policy .This file is the basic firewall policy. What it means that when a packet does not meet any firewall rule(which we setup later) then it is routed according to the policy.

#SOURCE DEST ACTION LOGGING
$FW net ACCEPT
$FW loc ACCEPT
net all DROP info
# The FOLLOWING POLICY MUST BE LAST
all all REJECT info

The file is read from top to bottom as soon as a packet matches a given rule it is routed accordingly. In this file what we have done is :

• Allow all traffic from the firewall to external network.
• Allow all traffic from the firewall to local network.
• Drop all traffic from external network to anywhere and log it as info message in syslog.
• Reject all traffic that doesn't meet any rule.

Don't worry if you don't see this working completely, we have to configure the rules which is followed before the default policy. Create/edit /etc/rules like this :

#ACTION SOURCE DEST PROTO PORT
ACCEPT net $FW tcp 80
ACCEPT loc all all
ACCEPT net $FW icmp

Our basic rules are very simple:

• Allow only tcp traffic from the external network at port 80(http) to the firewall.
• Allow all traffic from the local network to anywhere
• Allow ICMP traffic from the external network to the firewall

Now our configuration is complete but for a small step. Edit the file /etc/default/shorewall and change this line

#Change this from 0 to 1
startup=1

Now our configuration of shorewall is complete. Its time to start it:

/etc/init.d/shorewall start

If all goes well then our firewall should be up and running. What we have configured is a very basic setup. For more features and logging facilities I suggest you look into /usr/share/doc/shorewall. The documentation is excellent and the examples are very descriptive. Now go and have fun with your secure network.