设为首页收藏本站

LinuxSir.cn，穿越时空的Linuxsir!

 找回密码
 注册
搜索
热搜: shell linux mysql
LinuxSir.cn，穿越时空的Linuxsir!»论坛 › Linux 发行版讨论区 —— LinuxSir.cn › Gentoo Linux › linuxth以及其它玩防火墙的高手请进，我实在对shorewall ...
12下一页
返回列表 发新帖
查看: 1204|回复: 13

linuxth以及其它玩防火墙的高手请进，我实在对shorewall没办法了，崩溃中OTZ

[复制链接]
发表于 2007-8-9 19:45:00 | 显示全部楼层 |阅读模式
本人化了三个星期时间看各种资料，把gentoo翻来覆去装了不下20遍，好不容易把该整的都整的明白了，就差最后临门一脚配置shorewall实现NAT了，却卡住了……

本来shorewall在网上的资料挺全的，我shorewall的资料看了n遍，确信不会出配置错误，而且我还用webmin来检查我配置的条目，都通过了，本以为绝对不会出问题的东西出了问题，而且还是匪夷所思的古怪问题——我卡住的问题不是客户端不能正常从NAT上网，也不是端口映射有问题，而是——启动防火墙以后它居然把自己给锁家里了……

我的症状非常奇怪，首先我是一台a64的主机，配一块sis900集成网卡，我又找了一块8139插上，从 /etc/udev/rules.d/70-persistent-net.rules里能看到sis的网卡编号是eth0，8139为eth1。首先可以肯定的是，绝无内核配置问题，我把该弄的芯片驱动全部塞进去，该搞iptables相关的东西也全塞进去了，总之这机器在没开防火墙时，以双网卡都启动，其中任何一块在设置好网关后接内网上都可以正常上网（此时内网通过一个604+宽带路由器拨号adsl出去），然后，问题是这样，首先我用的拨号软件是zhllg老大推荐的ppp，是官方手册上推荐的方法：详细的设置方法我就不多叙述了，总之，在没开防火墙前，我用这东西拨号，很轻松的就上去了，能ping到dns，能用route命令看到自己被分配的gatway，然后，启动shorewall，问题大条了……shorewall很干脆的把自己给锁住了——ping外网，完全不通，ping内网，一切正常，内网也能ping到它……此时用ifconfig，可以看到自己的pppoe拨号连接是好的，没有任何问题，route也能正常看到被分配的外网网关，但就是ping外网不通，也不能上网，shorewall停下后运行一个shorewall clear命令清除所有防火墙规则（shorewall默认会启动一种叫routestop的功能，这功能是我在webmin里发现的，还没有找到禁止的方法，他的作用就是你一旦运行了shorewall，当你用shorewall stop停下时，他会默认的把iptables的策略换成堵塞所有外部进来的访问，非要clear，才能正常，不clear的话，你往外ping正常，别人ping不到你），ok了，又能ping到外网dns服务器了……
我现在是怎么也想不明白到底哪里做错了，因为我完全是理解了shorewall的配置策略后才动手的，又有webmin帮我检查是否有错，我把自己配置的相关设置帖在下面
我的sis900 eth0接内网，8139 eth1接外网
zones文件配置

  2. #
  3. # Shorewall version 3.2 - Zones File
  4. #
  5. # /etc/shorewall/zones
  6. #
  7. #        This file declares your network zones. You specify the hosts in
  8. #        each zone through entries in /etc/shorewall/interfaces or
  9. #        /etc/shorewall/hosts.
  10. #
  11. #        WARNING: The format of this file changed in Shorewall 3.0.0. You can
  12. #                 continue to use your old records provided that you set
  13. #                 IPSECFILE=ipsec in /etc/shorewall/shorewall.conf. This will
  14. #                 signal Shorewall that the IPSEC-related zone options are
  15. #                 still specified in /etc/shorewall/ipsec rather than in this
  16. #                 file.
  17. #
  18. #                 To use records in the format described below, you must have
  19. #                 IPSECFILE=zones specified in /etc/shorewall/shorewall.conf
  20. #                 AND YOU MUST NOT SET THE 'FW' VARIABLE IN THAT FILE!!!!!
  21. #
  22. # Columns are:
  23. #
  24. #        ZONE        Short name of the zone (5 Characters or less in length).
  25. #                The names "all" and "none" are reserved and may not be
  26. #                used as zone names.
  27. #
  28. #                Where a zone is nested in one or more other zones,
  29. #                you may follow the (sub)zone name by ":" and a
  30. #                comma-separated list of the parent zones. The parent
  31. #                zones must have been defined in earlier records in this
  32. #                file.
  33. #
  34. #                Example:
  35. #
  36. #                        #ZONE     TYPE     OPTIONS
  37. #                        a          ipv4
  38. #                        b          ipv4
  39. #                        c:a,b     ipv4
  40. #
  41. #                Currently, Shorewall uses this information to reorder the
  42. #                zone list so that parent zones appear after their subzones in
  43. #                the list. The IMPLICIT_CONTINUE option in shorewall.conf can
  44. #                also create implicit CONTINUE policies to/from the subzone.
  45. #
  46. #                In the future, Shorewall may make additional use
  47. #                of nesting information.
  48. #
  49. #        TYPE        ipv4 -        This is the standard Shorewall zone type and is the
  50. #                        default if you leave this column empty or if you enter
  51. #                        "-" in the column. Communication with some zone hosts
  52. #                        may be encrypted. Encrypted hosts are designated using
  53. #                        the 'ipsec'option in /etc/shorewall/hosts.
  54. #                ipsec -        Communication with all zone hosts is encrypted
  55. #                        Your kernel and iptables must include policy
  56. #                        match support.
  57. #                firewall
  58. #                      - Designates the firewall itself. You must have
  59. #                        exactly one 'firewall' zone. No options are
  60. #                        permitted with a 'firewall' zone. The name that you
  61. #                        enter in the ZONE column will be stored in the shell
  62. #                        variable $FW which you may use in other configuration
  63. #                        files to designate the firewall zone.
  64. #
  65. #        OPTIONS,        A comma-separated list of options as follows:
  66. #        IN OPTIONS,
  67. #        OUT OPTIONS        reqid=<number> where <number> is specified
  68. #                        using setkey(8) using the 'unique:<number>
  69. #                        option for the SPD level.
  70. #
  71. #                        spi=<number> where <number> is the SPI of
  72. #                        the SA used to encrypt/decrypt packets.
  73. #
  74. #                        proto=ah|esp|ipcomp
  75. #
  76. #                        mss=<number> (sets the MSS field in TCP packets)
  77. #
  78. #                        mode=transport|tunnel
  79. #
  80. #                        tunnel-src=<address>[/<mask>] (only
  81. #                        available with mode=tunnel)
  82. #
  83. #                        tunnel-dst=<address>[/<mask>] (only
  84. #                        available with mode=tunnel)
  85. #
  86. #                        strict        Means that packets must match all rules.
  87. #
  88. #                        next        Separates rules; can only be used with
  89. #                                strict
  90. #
  91. #                Example:
  92. #                        mode=transport,reqid=44
  93. #
  94. #        The options in the OPTIONS column are applied to both incoming
  95. #        and outgoing traffic. The IN OPTIONS are applied to incoming
  96. #        traffic (in addition to OPTIONS) and the OUT OPTIONS are
  97. #        applied to outgoing traffic.
  98. #
  99. #        If you wish to leave a column empty but need to make an entry
  100. #        in a following column, use "-".
  101. #------------------------------------------------------------------------------
  102. # Example zones:
  103. #
  104. #        You have a three interface firewall with internet, local and DMZ
  105. #        interfaces.
  106. #
  107. #        #ZONE        TYPE                OPTIONS                IN                        OUT
  108. #        #                                        OPTIONS                        OPTIONS
  109. #        fw        firewall
  110. #        net        ipv4
  111. #        loc        ipv4
  112. #        dmz        ipv4
  113. #
  114. #
  115. # For more information, see http://www.shorewall.net/Documentation.htm#Zones
  116. #
  117. ###############################################################################
  118. #ZONE        TYPE                OPTIONS                IN                        OUT
  119. #                                        OPTIONS                        OPTIONS
  120. fw        firewall
  121. net        ipv4
  122. lan        ipv4
  123. #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
复制代码


Interfaces文件配置
  1. #
  2. # Shorewall version 3.2 - Interfaces File
  3. #
  4. # /etc/shorewall/interfaces
  5. #
  6. #        You must add an entry in this file for each network interface on your
  7. #        firewall system.
  8. #
  9. # Columns are:
  10. #
  11. #        ZONE                Zone for this interface. Must match the name of a
  12. #                        zone defined in /etc/shorewall/zones. You may not
  13. #                        list the firewall zone in this column.
  14. #
  15. #                        If the interface serves multiple zones that will be
  16. #                        defined in the /etc/shorewall/hosts file, you should
  17. #                        place "-" in this column.
  18. #
  19. #                        If there are multiple interfaces to the same zone,
  20. #                        you must list them in separate entries:
  21. #
  22. #                        Example:
  23. #
  24. #                                loc        eth1        -
  25. #                                loc        eth2        -
  26. #
  27. #        INTERFACE        Name of interface. Each interface may be listed only
  28. #                        once in this file. You may NOT specify the name of
  29. #                        an alias (e.g., eth0:0) here; see
  30. #                        http://www.shorewall.net/FAQ.htm#faq18
  31. #
  32. #                        You may specify wildcards here. For example, if you
  33. #                        want to make an entry that applies to all PPP
  34. #                        interfaces, use 'ppp+'.
  35. #
  36. #                        There is no need to define the loopback        interface (lo)
  37. #                        in this file.
  38. #
  39. #        BROADCAST        The broadcast address for the subnetwork to which the
  40. #                        interface belongs. For P-T-P interfaces, this
  41. #                        column is left blank.If the interface has multiple
  42. #                        addresses on multiple subnets then list the broadcast
  43. #                        addresses as a comma-separated list.
  44. #
  45. #                        If you use the special value "detect", Shorewall
  46. #                        will detect the broadcast address(es) for you. If you
  47. #                        select this option, the interface must be up before
  48. #                        the firewall is started.
  49. #
  50. #                        If you don't want to give a value for this column but
  51. #                        you want to enter a value in the OPTIONS column, enter
  52. #                        "-" in this column.
  53. #
  54. #        OPTIONS                A comma-separated list of options including the
  55. #                        following:
  56. #
  57. #                        dhcp             - Specify this option when any of
  58. #                                       the following are true:
  59. #                                       1. the interface gets its IP address
  60. #                                          via DHCP
  61. #                                       2. the interface is used by
  62. #                                          a DHCP server running on the firewall
  63. #                                       3. you have a static IP but are on a LAN
  64. #                                          segment with lots of Laptop DHCP
  65. #                                          clients.
  66. #                                       4. the interface is a bridge with
  67. #                                          a DHCP server on one port and DHCP
  68. #                                          clients on another port.
  69. #
  70. #                        norfc1918    - This interface should not receive
  71. #                                       any packets whose source is in one
  72. #                                       of the ranges reserved by RFC 1918
  73. #                                       (i.e., private or "non-routable"
  74. #                                       addresses). If packet mangling or
  75. #                                       connection-tracking match is enabled in
  76. #                                       your kernel, packets whose destination
  77. #                                       addresses are reserved by RFC 1918 are
  78. #                                       also rejected.
  79. #
  80. #                        routefilter  - turn on kernel route filtering for this
  81. #                                       interface (anti-spoofing measure). This
  82. #                                       option can also be enabled globally in
  83. #                                       the /etc/shorewall/shorewall.conf file.
  84. #
  85. #                        logmartians  - turn on kernel martian logging (logging
  86. #                                       of packets with impossible source
  87. #                                       addresses. It is suggested that if you
  88. #                                       set routefilter on an interface that
  89. #                                       you also set logmartians. This option
  90. #                                       may also be enabled globally in the
  91. #                                       /etc/shorewall/shorewall.conf file.
  92. #
  93. #                        blacklist    - Check packets arriving on this interface
  94. #                                       against the /etc/shorewall/blacklist
  95. #                                       file.
  96. #
  97. #                        maclist             - Connection requests from this interface
  98. #                                       are compared against the contents of
  99. #                                       /etc/shorewall/maclist. If this option
  100. #                                       is specified, the interface must be
  101. #                                       an ethernet NIC and must be up before
  102. #                                       Shorewall is started.
  103. #
  104. #                        tcpflags     - Packets arriving on this interface are
  105. #                                       checked for certain illegal combinations
  106. #                                       of TCP flags. Packets found to have
  107. #                                       such a combination of flags are handled
  108. #                                       according to the setting of
  109. #                                       TCP_FLAGS_DISPOSITION after having been
  110. #                                       logged according to the setting of
  111. #                                       TCP_FLAGS_LOG_LEVEL.
  112. #
  113. #                        proxyarp     -
  114. #                                Sets
  115. #                                /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
  116. #                                Do NOT use this option if you are
  117. #                                employing Proxy ARP through entries in
  118. #                                /etc/shorewall/proxyarp. This option is
  119. #                                intended soley for use with Proxy ARP
  120. #                                sub-networking as described at:
  121. #                                http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet
  122. #
  123. #                        routeback    - If specified, indicates that Shorewall
  124. #                                       should include rules that allow
  125. #                                       filtering traffic arriving on this
  126. #                                       interface back out that same interface.
  127. #
  128. #                        arp_filter   - If specified, this interface will only
  129. #                                       respond to ARP who-has requests for IP
  130. #                                       addresses configured on the interface.
  131. #                                       If not specified, the interface can
  132. #                                       respond to ARP who-has requests for
  133. #                                       IP addresses on any of the firewall's
  134. #                                       interface. The interface must be up
  135. #                                       when Shorewall is started.
  136. #
  137. #                        arp_ignore[=<number>]
  138. #                                     - If specified, this interface will
  139. #                                       respond to arp requests based on the
  140. #                                       value of <number>.
  141. #
  142. #                                       1 - reply only if the target IP address
  143. #                                       is local address configured on the
  144. #                                       incoming interface
  145. #
  146. #                                       2 - reply only if the target IP address
  147. #                                       is local address configured on the
  148. #                                       incoming interface and both with the
  149. #                                       sender's IP address are part from same
  150. #                                       subnet on this interface
  151. #
  152. #                                       3 - do not reply for local addresses
  153. #                                       configured with scope host, only
  154. #                                       resolutions for global and link
  155. #                                       addresses are replied
  156. #
  157. #                                       4-7 - reserved
  158. #
  159. #                                       8 - do not reply for all local
  160. #                                       addresses
  161. #
  162. #                                       If no <number> is given then the value
  163. #                                       1 is assumed
  164. #
  165. #                                       WARNING -- DO NOT SPECIFY arp_ignore
  166. #                                       FOR ANY INTERFACE INVOLVED IN PROXY ARP.
  167. #
  168. #                        nosmurfs     - Filter packets for smurfs
  169. #                                       (packets with a broadcast
  170. #                                       address as the source).
  171. #
  172. #                                       Smurfs will be optionally logged based
  173. #                                       on the setting of SMURF_LOG_LEVEL in
  174. #                                       shorewall.conf. After logging, the
  175. #                                       packets are dropped.
  176. #
  177. #                        detectnets   - Automatically taylors the zone named
  178. #                                       in the ZONE column to include only those
  179. #                                       hosts routed through the interface.
  180. #
  181. #                        sourceroute  - If this option is not specified for an
  182. #                                       interface, then source-routed packets
  183. #                                       will not be accepted from that
  184. #                                       interface (sets /proc/sys/net/ipv4/
  185. #                                       conf/<interface>/
  186. #                                       accept_source_route to 1).
  187. #                                       Only set this option if you know what
  188. #                                       you are you doing. This might represent
  189. #                                       a security risk and is not usually
  190. #                                       needed.
  191. #
  192. #                        upnp             - Incoming requests from this interface
  193. #                                       may be remapped via UPNP (upnpd).
  194. #
  195. #                        WARNING: DO NOT SET THE detectnets OPTION ON YOUR
  196. #                                 INTERNET INTERFACE.
  197. #
  198. #                        The order in which you list the options is not
  199. #                        significant but the list should have no embedded white
  200. #                        space.
  201. #
  202. #        Example 1:        Suppose you have eth0 connected to a DSL modem and
  203. #                        eth1 connected to your local network and that your
  204. #                        local subnet is 192.168.1.0/24. The interface gets
  205. #                        it's IP address via DHCP from subnet
  206. #                        206.191.149.192/27. You have a DMZ with subnet
  207. #                        192.168.2.0/24 using eth2.
  208. #
  209. #                        Your entries for this setup would look like:
  210. #
  211. #                        net        eth0        206.191.149.223        dhcp
  212. #                        local        eth1        192.168.1.255
  213. #                        dmz        eth2        192.168.2.255
  214. #
  215. #        Example 2:        The same configuration without specifying broadcast
  216. #                        addresses is:
  217. #
  218. #                        net        eth0        detect                dhcp
  219. #                        loc        eth1        detect
  220. #                        dmz        eth2        detect
  221. #
  222. #        Example 3:        You have a simple dial-in system with no ethernet
  223. #                        connections.
  224. #
  225. #                        net        ppp0        -
  226. #
  227. # For additional information, see
  228. # http://shorewall.net/Documentation.htm#Interfaces
  229. #
  230. ###############################################################################
  231. #ZONE        INTERFACE        BROADCAST        OPTIONS
  232. net        eth1
  233. lan        eth0
  234. #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
复制代码

Policy配置
  1. #
  2. # Shorewall version 3.2 - Policy File
  3. #
  4. # /etc/shorewall/policy
  5. #
  6. #                     THE ORDER OF ENTRIES IN THIS FILE IS IMPORTANT
  7. #
  8. #        This file determines what to do with a new connection request if we
  9. #        don't get a match from the /etc/shorewall/rules file . For each
  10. #        source/destination pair, the file is processed in order until a
  11. #        match is found ("all" will match any client or server).
  12. #
  13. #                        INTRA-ZONE POLICIES ARE PRE-DEFINED
  14. #
  15. #        For $FW and for all of the zoned defined in /etc/shorewall/zones,
  16. #        the POLICY for connections from the zone to itself is ACCEPT (with no
  17. #        logging or TCP connection rate limiting but may be overridden by an
  18. #        entry in this file. The overriding entry must be explicit (cannot use
  19. #        "all" in the SOURCE or DEST).
  20. #
  21. #       Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall.conf, then
  22. #       the implicit policy to/from any sub-zone is CONTINUE. These implicit
  23. #       CONTINUE policies may also be overridden by an explicit entry in this
  24. #       file.
  25. #
  26. # Columns are:
  27. #
  28. #        SOURCE                Source zone. Must be the name of a zone defined
  29. #                        in /etc/shorewall/zones, $FW or "all".
  30. #
  31. #        DEST                Destination zone. Must be the name of a zone defined
  32. #                        in /etc/shorewall/zones, $FW or "all"
  33. #
  34. #        POLICY                Policy if no match from the rules file is found. Must
  35. #                        be "ACCEPT", "DROP", "REJECT", "CONTINUE" or "NONE".
  36. #
  37. #                        ACCEPT                - Accept the connection
  38. #                        DROP                - Ignore the connection request
  39. #                        REJECT                - For TCP, send RST. For all other,
  40. #                                          send "port unreachable" ICMP.
  41. #                        QUEUE                - Send the request to a user-space
  42. #                                          application using the QUEUE target.
  43. #                        CONTINUE        - Pass the connection request past
  44. #                                          any other rules that it might also
  45. #                                          match (where the source or
  46. #                                          destination zone in those rules is
  47. #                                          a superset of the SOURCE or DEST
  48. #                                          in this policy).
  49. #                        NONE                - Assume that there will never be any
  50. #                                          packets from this SOURCE
  51. #                                          to this DEST. Shorewall will not set
  52. #                                          up any infrastructure to handle such
  53. #                                          packets and you may not have any
  54. #                                          rules with this SOURCE and DEST in
  55. #                                          the /etc/shorewall/rules file. If
  56. #                                          such a packet _is_ received, the
  57. #                                          result is undefined. NONE may not be
  58. #                                          used if the SOURCE or DEST columns
  59. #                                          contain the firewall zone ($FW) or
  60. #                                          "all".
  61. #
  62. #                        If this column contains ACCEPT, DROP or REJECT and a
  63. #                        corresponding common action is defined in
  64. #                        /etc/shorewall/actions (or
  65. #                        /usr/share/shorewall/actions.std) then that action
  66. #                        will be invoked before the policy named in this column
  67. #                        is enforced.
  68. #
  69. #        LOG LEVEL        If supplied, each connection handled under the default
  70. #                        POLICY is logged at that level. If not supplied, no
  71. #                        log message is generated. See syslog.conf(5) for a
  72. #                        description of log levels.
  73. #
  74. #                        Beginning with Shorewall version 1.3.12, you may
  75. #                        also specify ULOG (must be in upper case). This will
  76. #                        log to the ULOG target and sent to a separate log
  77. #                        through use of ulogd
  78. #                        (http://www.gnumonks.org/projects/ulogd).
  79. #
  80. #                        If you don't want to log but need to specify the
  81. #                        following column, place "-" here.
  82. #
  83. #        LIMIT:BURST        If passed, specifies the maximum TCP connection rate
  84. #                        and the size of an acceptable burst. If not specified,
  85. #                        TCP connections are not limited.
  86. #
  87. #        Example:
  88. #
  89. #        a) All connections from the local network to the internet are allowed
  90. #        b) All connections from the internet are ignored but logged at syslog
  91. #           level KERNEL.INFO.
  92. #        d) All other connection requests are rejected and logged at level
  93. #           KERNEL.INFO.
  94. #
  95. #        #SOURCE                DEST                POLICY                LOG
  96. #        #                                                LEVEL
  97. #        loc                net                ACCEPT
  98. #        net                all                DROP                info
  99. #        #
  100. #        # THE FOLLOWING POLICY MUST BE LAST
  101. #        #
  102. #        all                all                REJECT                info
  103. #
  104. # See http://shorewall.net/Documentation.htm#Policy for additional information.
  105. #
  106. ###############################################################################
  107. #SOURCE                DEST                POLICY                LOG                LIMIT:BURST
  108. #                                                LEVEL
  109. fw        all        ACCEPT
  110. lan        all        ACCEPT
  111. net        all        DROP
  112. all        all        REJECT
  113. #LAST LINE -- DO NOT REMOVE
复制代码

Rules文件我干脆没配置，留空为了测试方便

  2. #
  3. # Shorewall version 3.2 - Rules File
  4. #
  5. # /etc/shorewall/rules
  6. #
  7. #        Rules in this file govern connection establishment. Requests and
  8. #        responses are automatically allowed using connection tracking. For any
  9. #        particular (source,dest) pair of zones, the rules are evaluated in the
  10. #        order in which they appear in this file and the first match is the one
  11. #        that determines the disposition of the request.
  12. #
  13. #        In most places where an IP address or subnet is allowed, you
  14. #        can preceed the address/subnet with "!" (e.g., !192.168.1.0/24) to
  15. #        indicate that the rule matches all addresses except the address/subnet
  16. #        given. Notice that no white space is permitted between "!" and the
  17. #        address/subnet.
  18. #------------------------------------------------------------------------------
  19. # WARNING: If you masquerade or use SNAT from a local system to the internet,
  20. #           you cannot use an ACCEPT rule to allow traffic from the internet to
  21. #           that system. You *must* use a DNAT rule instead.
  22. #------------------------------------------------------------------------------
  23. #
  24. # The rules file is divided into sections. Each section is introduced by
  25. # a "Section Header" which is a line beginning with SECTION followed by the
  26. # section name.
  27. #
  28. # Sections are as follows and must appear in the order listed:
  29. #
  30. #        ESTABLISHED                Packets in the ESTABLISHED state are processed
  31. #                                by rules in this section.
  32. #
  33. #                                The only ACTIONs allowed in this section are
  34. #                                ACCEPT, DROP, REJECT, LOG and QUEUE
  35. #
  36. #                                There is an implicit ACCEPT rule inserted
  37. #                                at the end of this section.
  38. #
  39. #        RELATED                        Packets in the RELATED state are processed by
  40. #                                rules in this section.
  41. #
  42. #                                The only ACTIONs allowed in this section are
  43. #                                ACCEPT, DROP, REJECT, LOG and QUEUE
  44. #
  45. #                                There is an implicit ACCEPT rule inserted
  46. #                                at the end of this section.
  47. #
  48. #        NEW                        Packets in the NEW and INVALID states are
  49. #                                processed by rules in this section.
  50. #
  51. # Note: If you are not familiar with Netfilter to the point where you are
  52. #        comfortable with the differences between the various connection
  53. #        tracking states, then I suggest that you omit the ESTABLISHED and
  54. #        RELATED sections and place all of your rules in the NEW section
  55. #        (That's after the line that reads SECTION NEW').
  56. #
  57. # WARNING: If you specify FASTACCEPT=Yes in shorewall.conf then the
  58. #           ESTABLISHED and RELATED sections must be empty.
  59. #
  60. # You may omit any section that you don't need. If no Section Headers appear
  61. # in the file then all rules are assumed to be in the NEW section.
  62. #
  63. # Columns are:
  64. #
  65. #        ACTION                ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, CONTINUE,
  66. #                        LOG, QUEUE or an <action>.
  67. #
  68. #                                ACCEPT         -- allow the connection request
  69. #                                ACCEPT+         -- like ACCEPT but also excludes the
  70. #                                            connection from any subsequent
  71. #                                            DNAT[-] or REDIRECT[-] rules
  72. #                                NONAT         -- Excludes the connection from any
  73. #                                            subsequent DNAT[-] or REDIRECT[-]
  74. #                                            rules but doesn't generate a rule
  75. #                                            to accept the traffic.
  76. #                                DROP         -- ignore the request
  77. #                                REJECT         -- disallow the request and return an
  78. #                                            icmp-unreachable or an RST packet.
  79. #                                DNAT         -- Forward the request to another
  80. #                                            system (and optionally another
  81. #                                            port).
  82. #                                DNAT-         -- Advanced users only.
  83. #                                            Like DNAT but only generates the
  84. #                                            DNAT iptables rule and not
  85. #                                            the companion ACCEPT rule.
  86. #                                SAME         -- Similar to DNAT except that the
  87. #                                            port may not be remapped and when
  88. #                                            multiple server addresses are
  89. #                                            listed, all requests from a given
  90. #                                            remote system go to the same
  91. #                                            server.
  92. #                                SAME-         -- Advanced users only.
  93. #                                            Like SAME but only generates the
  94. #                                            NAT iptables rule and not
  95. #                                            the companion ACCEPT rule.
  96. #                                REDIRECT -- Redirect the request to a local
  97. #                                            port on the firewall.
  98. #                                REDIRECT-
  99. #                                         -- Advanced users only.
  100. #                                            Like REDIRET but only generates the
  101. #                                            REDIRECT iptables rule and not
  102. #                                            the companion ACCEPT rule.
  103. #
  104. #                                CONTINUE -- (For experts only). Do not process
  105. #                                            any of the following rules for this
  106. #                                            (source zone,destination zone). If
  107. #                                            The source and/or destination IP
  108. #                                            address falls into a zone defined
  109. #                                            later in /etc/shorewall/zones, this
  110. #                                            connection request will be passed
  111. #                                            to the rules defined for that
  112. #                                            (those) zone(s).
  113. #                                LOG         -- Simply log the packet and continue.
  114. #                                QUEUE         -- Queue the packet to a user-space
  115. #                                            application such as ftwall
  116. #                                            (http://p2pwall.sf.net).
  117. #                                <action> -- The name of an action defined in
  118. #                                            /etc/shorewall/actions or in
  119. #                                            /usr/share/shorewall/actions.std.
  120. #                                <macro>         -- The name of a macro defined in a
  121. #                                            file named macro.<macro-name>. If
  122. #                                            the macro accepts an action
  123. #                                            parameter (Look at the macro
  124. #                                            source to see if it has PARAM in
  125. #                                            the TARGET column) then the macro
  126. #                                            name is followed by "/" and the
  127. #                                            action (ACCEPT, DROP, REJECT, ...)
  128. #                                            to be substituted for the
  129. #                                            parameter. Example: FTP/ACCEPT.
  130. #
  131. #                        The ACTION may optionally be followed
  132. #                        by ":" and a syslog log level (e.g, REJECT:info or
  133. #                        DNAT:debug). This causes the packet to be
  134. #                        logged at the specified level.
  135. #
  136. #                        If the ACTION names an action defined in
  137. #                        /etc/shorewall/actions or in
  138. #                        /usr/share/shorewall/actions.std then:
  139. #
  140. #                        - If the log level is followed by "!' then all rules
  141. #                          in the action are logged at the log level.
  142. #
  143. #                        - If the log level is not followed by "!" then only
  144. #                          those rules in the action that do not specify
  145. #                          logging are logged at the specified level.
  146. #
  147. #                        - The special log level 'none!' suppresses logging
  148. #                          by the action.
  149. #
  150. #                        You may also specify ULOG (must be in upper case) as a
  151. #                        log level.This will log to the ULOG target for routing
  152. #                        to a separate log through use of ulogd
  153. #                        (http://www.gnumonks.org/projects/ulogd).
  154. #
  155. #                        Actions specifying logging may be followed by a
  156. #                        log tag (a string of alphanumeric characters)
  157. #                        are appended to the string generated by the
  158. #                        LOGPREFIX (in /etc/shorewall/shorewall.conf).
  159. #
  160. #                        Example: ACCEPT:info:ftp would include 'ftp '
  161. #                        at the end of the log prefix generated by the
  162. #                        LOGPREFIX setting.
  163. #
  164. #        SOURCE                Source hosts to which the rule applies. May be a zone
  165. #                        defined in /etc/shorewall/zones, $FW to indicate the
  166. #                        firewall itself, "all", "all+", "all-", "all+-" or
  167. #                        "none".
  168. #
  169. #                        When "none" is used either in the SOURCE or DEST
  170. #                        column, the rule is ignored.
  171. #
  172. #                        "all" means "All Zones", including the firewall itself.
  173. #                        "all-" means "All Zones, except the firewall itself".
  174. #                        When "all[-]" is used either in the SOURCE or DEST
  175. #                        column intra-zone traffic is not affected. When
  176. #                        "all+[-]" is "used, intra-zone traffic is affected.
  177. #
  178. #                        Except when "all[+][-]" is specified, clients may be
  179. #                        further restricted to a list of subnets and/or hosts by
  180. #                        appending ":" and a comma-separated list of subnets
  181. #                        and/or hosts. Hosts may be specified by IP or MAC
  182. #                        address; mac addresses must begin with "~" and must use
  183. #                        "-" as a separator.
  184. #
  185. #                        Hosts may be specified as an IP address range using the
  186. #                        syntax <low address>-<high address>. This requires that
  187. #                        your kernel and iptables contain iprange match support.
  188. #                        If you kernel and iptables have ipset match support
  189. #                        then you may give the name of an ipset prefaced by "+".
  190. #                        The ipset name may be optionally followed by a number
  191. #                        from 1 to 6 enclosed in square brackets ([]) to
  192. #                        indicate the number of levels of source bindings to be
  193. #                        matched.
  194. #
  195. #                        dmz:192.168.2.2                Host 192.168.2.2 in the DMZ
  196. #
  197. #                        net:155.186.235.0/24        Subnet 155.186.235.0/24 on the
  198. #                                                Internet
  199. #
  200. #                        loc:192.168.1.1,192.168.1.2
  201. #                                                Hosts 192.168.1.1 and
  202. #                                                192.168.1.2 in the local zone.
  203. #                        loc:~00-A0-C9-15-39-78        Host in the local zone with
  204. #                                                MAC address 00:A0:C9:15:39:78.
  205. #
  206. #                        net:192.0.2.11-192.0.2.17
  207. #                                                Hosts 192.0.2.11-192.0.2.17 in
  208. #                                                the net zone.
  209. #
  210. #                        Alternatively, clients may be specified by interface
  211. #                        by appending ":" to the zone name followed by the
  212. #                        interface name. For example, loc:eth1 specifies a
  213. #                        client that communicates with the firewall system
  214. #                        through eth1. This may be optionally followed by
  215. #                        another colon (":") and an IP/MAC/subnet address
  216. #                        as described above (e.g., loc:eth1:192.168.1.5).
  217. #
  218. #        DEST                Location of Server. May be a zone defined in
  219. #                        /etc/shorewall/zones, $FW to indicate the firewall
  220. #                        itself, "all". "all+" or "none".
  221. #
  222. #                        When "none" is used either in the SOURCE or DEST
  223. #                        column, the rule is ignored.
  224. #
  225. #                        When "all" is used either in the SOURCE or DEST column
  226. #                        intra-zone traffic is not affected. When "all+" is
  227. #                        used, intra-zone traffic is affected.
  228. #
  229. #                        Except when "all[+]" is specified, the server may be
  230. #                        further restricted to a particular subnet, host or
  231. #                        interface by appending ":" and the subnet, host or
  232. #                        interface. See above.
  233. #
  234. #                                Restrictions:
  235. #
  236. #                                1. MAC addresses are not allowed.
  237. #                                2. In DNAT rules, only IP addresses are
  238. #                                   allowed; no FQDNs or subnet addresses
  239. #                                   are permitted.
  240. #                                3. You may not specify both an interface and
  241. #                                   an address.
  242. #
  243. #                        Like in the SOURCE column, you may specify a range of
  244. #                        up to 256 IP addresses using the syntax
  245. #                        <first ip>-<last ip>. When the ACTION is DNAT or DNAT-,
  246. #                        the connections will be assigned to addresses in the
  247. #                        range in a round-robin fashion.
  248. #
  249. #                        If you kernel and iptables have ipset match support
  250. #                        then you may give the name of an ipset prefaced by "+".
  251. #                        The ipset name may be optionally followed by a number
  252. #                        from 1 to 6 enclosed in square brackets ([]) to
  253. #                        indicate the number of levels of destination bindings
  254. #                        to be matched. Only one of the SOURCE and DEST columns
  255. #                        may specify an ipset name.
  256. #
  257. #                        The port that the server is listening on may be
  258. #                        included and separated from the server's IP address by
  259. #                        ":". If omitted, the firewall will not modifiy the
  260. #                        destination port. A destination port may only be
  261. #                        included if the ACTION is DNAT or REDIRECT.
  262. #
  263. #                        Example: loc:192.168.1.3:3128 specifies a local
  264. #                        server at IP address 192.168.1.3 and listening on port
  265. #                        3128. The port number MUST be specified as an integer
  266. #                        and not as a name from /etc/services.
  267. #
  268. #                        if the ACTION is REDIRECT, this column needs only to
  269. #                        contain the port number on the firewall that the
  270. #                        request should be redirected to.
  271. #
  272. #        PROTO                Protocol - Must be "tcp", "tcp:syn", "udp", "icmp",
  273. #                        "ipp2p", "ipp2p:udp", "ipp2p:all" a number, or "all".
  274. #                       "ipp2p*" requires ipp2p match support in your kernel
  275. #                       and iptables.
  276. #
  277. #                        "tcp:syn" implies "tcp" plus the SYN flag must be
  278. #                        set and the RST,ACK and FIN flags must be reset.
  279. #
  280. #        DEST PORT(S)        Destination Ports. A comma-separated list of Port
  281. #                        names (from /etc/services), port numbers or port
  282. #                        ranges; if the protocol is "icmp", this column is
  283. #                        interpreted as the destination icmp-type(s).
  284. #
  285. #                        If the protocol is ipp2p, this column is interpreted
  286. #                        as an ipp2p option without the leading "--" (example
  287. #                        "bit" for bit-torrent). If no port is given, "ipp2p" is
  288. #                        assumed.
  289. #
  290. #                        A port range is expressed as <low port>:<high port>.
  291. #
  292. #                        This column is ignored if PROTOCOL = all but must be
  293. #                        entered if any of the following ields are supplied.
  294. #                        In that case, it is suggested that this field contain
  295. #                         "-"
  296. #
  297. #                        If your kernel contains multi-port match support, then
  298. #                        only a single Netfilter rule will be generated if in
  299. #                        this list and the CLIENT PORT(S) list below:
  300. #                        1. There are 15 or less ports listed.
  301. #                        2. No port ranges are included.
  302. #                        Otherwise, a separate rule will be generated for each
  303. #                        port.
  304. #
  305. #        SOURCE PORT(S)        (Optional) Port(s) used by the client. If omitted,
  306. #                        any source port is acceptable. Specified as a comma-
  307. #                        separated list of port names, port numbers or port
  308. #                        ranges.
  309. #
  310. #                        If you don't want to restrict client ports but need to
  311. #                        specify an ORIGINAL DEST in the next column, then
  312. #                        place "-" in this column.
  313. #
  314. #                        If your kernel contains multi-port match support, then
  315. #                        only a single Netfilter rule will be generated if in
  316. #                        this list and the DEST PORT(S) list above:
  317. #                        1. There are 15 or less ports listed.
  318. #                        2. No port ranges are included.
  319. #                        Otherwise, a separate rule will be generated for each
  320. #                        port.
  321. #
  322. #        ORIGINAL DEST        (0ptional) -- If ACTION is DNAT[-] or REDIRECT[-]
  323. #                        then if included and different from the IP
  324. #                        address given in the SERVER column, this is an address
  325. #                        on some interface on the firewall and connections to
  326. #                        that address will be forwarded to the IP and port
  327. #                        specified in the DEST column.
  328. #
  329. #                        A comma-separated list of addresses may also be used.
  330. #                        This is usually most useful with the REDIRECT target
  331. #                        where you want to redirect traffic destined for
  332. #                        particular set of hosts.
  333. #
  334. #                        Finally, if the list of addresses begins with "!" then
  335. #                        the rule will be followed only if the original
  336. #                        destination address in the connection request does not
  337. #                        match any of the addresses listed.
  338. #
  339. #                        For other actions, this column may be included and may
  340. #                        contain one or more addresses (host or network)
  341. #                        separated by commas. Address ranges are not allowed.
  342. #                        When this column is supplied, rules are generated
  343. #                        that require that the original destination address
  344. #                        matches one of the listed addresses. This feature is
  345. #                        most useful when you want to generate a filter rule
  346. #                        that corresponds to a DNAT- or REDIRECT- rule. In this
  347. #                        usage, the list of addresses should not begin with "!".
  348. #
  349. #                        See http://shorewall.net/PortKnocking.html for an
  350. #                        example of using an entry in this column with a
  351. #                        user-defined action rule.
  352. #
  353. #        RATE LIMIT        You may rate-limit the rule by placing a value in
  354. #                        this colume:
  355. #
  356. #                                <rate>/<interval>[:<burst>]
  357. #
  358. #                        where <rate> is the number of connections per
  359. #                        <interval> ("sec" or "min") and <burst> is the
  360. #                        largest burst permitted. If no <burst> is given,
  361. #                        a value of 5 is assumed. There may be no
  362. #                        no whitespace embedded in the specification.
  363. #
  364. #                                Example: 10/sec:20
  365. #
  366. #        USER/GROUP        This column may only be non-empty if the SOURCE is
  367. #                        the firewall itself.
  368. #
  369. #                        The column may contain:
  370. #
  371. #        [!][<user name or number>][:<group name or number>][+<program name>]
  372. #
  373. #                        When this column is non-empty, the rule applies only
  374. #                        if the program generating the output is running under
  375. #                        the effective <user> and/or <group> specified (or is
  376. #                        NOT running under that id if "!" is given).
  377. #
  378. #                        Examples:
  379. #
  380. #                                joe        #program must be run by joe
  381. #                                :kids        #program must be run by a member of
  382. #                                        #the 'kids' group
  383. #                                !:kids        #program must not be run by a member
  384. #                                        #of the 'kids' group
  385. #                                +upnpd        #program named upnpd (This feature was
  386. #                                        #removed from Netfilter in kernel
  387. #                                        #version 2.6.14).
  388. #
  389. #        Example: Accept SMTP requests from the DMZ to the internet
  390. #
  391. #        #ACTION SOURCE        DEST PROTO        DEST        SOURCE        ORIGINAL
  392. #        #                                PORT        PORT(S) DEST
  393. #        ACCEPT        dmz        net          tcp        smtp
  394. #
  395. #        Example: Forward all ssh and http connection requests from the
  396. #                 internet to local system 192.168.1.3
  397. #
  398. #        #ACTION SOURCE        DEST                PROTO        DEST        SOURCE        ORIGINAL
  399. #        #                                        PORT        PORT(S) DEST
  400. #        DNAT        net        loc:192.168.1.3 tcp        ssh,http
  401. #
  402. #        Example: Forward all http connection requests from the internet
  403. #                 to local system 192.168.1.3 with a limit of 3 per second and
  404. #                 a maximum burst of 10
  405. #
  406. #        #ACTION SOURCE DEST               PROTO  DEST  SOURCE  ORIGINAL RATE
  407. #        #                                      PORT  PORT(S) DEST     LIMIT
  408. #        DNAT        net    loc:192.168.1.3 tcp    http  -            -             3/sec:10
  409. #
  410. #        Example: Redirect all locally-originating www connection requests to
  411. #                 port 3128 on the firewall (Squid running on the firewall
  412. #                 system) except when the destination address is 192.168.2.2
  413. #
  414. #        #ACTION         SOURCE        DEST          PROTO        DEST        SOURCE        ORIGINAL
  415. #        #                                PORT        PORT(S) DEST
  416. #        REDIRECT loc        3128          tcp        www         -        !192.168.2.2
  417. #
  418. #        Example: All http requests from the internet to address
  419. #                 130.252.100.69 are to be forwarded to 192.168.1.3
  420. #
  421. #        #ACTION         SOURCE        DEST                PROTO        DEST        SOURCE        ORIGINAL
  422. #        #                                        PORT        PORT(S) DEST
  423. #        DNAT          net        loc:192.168.1.3 tcp        80        -        130.252.100.69
  424. #
  425. #        Example: You want to accept SSH connections to your firewall only
  426. #                 from internet IP addresses 130.252.100.69 and 130.252.100.70
  427. #
  428. #        #ACTION         SOURCE        DEST                PROTO        DEST        SOURCE        ORIGINAL
  429. #        #                                        PORT        PORT(S) DEST
  430. #        ACCEPT         net:130.252.100.69,130.252.100.70 \
  431. #                        $FW                 tcp        22
  432. #
  433. #        Example: From the Internet, you want to connect to TCP port 2222 on
  434. #                 your firewall and have the connection forwarded to port 22
  435. #                 on local system 192.168.3.4
  436. #        #ACTION         SOURCE        DEST                        PROTO        DEST
  437. #        #                                                PORT
  438. #        DNAT         net        loc:192.168.3.4:22        tcp        2222
  439. #
  440. #############################################################################################################
  441. #ACTION        SOURCE                DEST                PROTO        DEST        SOURCE                ORIGINAL        RATE                USER/
  442. #                                                PORT(S)        PORT(S)                DEST                LIMIT                GROUP
  443. #SECTION ESTABLISHED
  444. #SECTION RELATED
  445. SECTION NEW
  446. #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
复制代码


Masq设置


  2. #
  3. # Shorewall version 3.2 - Masq file
  4. #
  5. # /etc/shorewall/masq
  6. #
  7. #        Use this file to define dynamic NAT (Masquerading) and to define
  8. #        Source NAT (SNAT).
  9. #
  10. #        WARNING: The entries in this file are order-sensitive. The first
  11. #        entry that matches a particular connection will be the one that
  12. #        is used.
  13. #
  14. #        WARNING: If you have more than one ISP, adding entries to this
  15. #        file will *not* force connections to go out through a particular
  16. #        ISP. You must use PREROUTING entries in /etc/shorewall/tcrules
  17. #        to do that.
  18. #
  19. # Columns are:
  20. #
  21. #        INTERFACE -- Outgoing interface. This is usually your internet
  22. #                     interface. If ADD_SNAT_ALIASES=Yes in
  23. #                     /etc/shorewall/shorewall.conf, you may add ":" and
  24. #                     a digit to indicate that you want the alias added with
  25. #                     that name (e.g., eth0:0). This will allow the alias to
  26. #                     be displayed with ifconfig. THAT IS THE ONLY USE FOR
  27. #                     THE ALIAS NAME AND IT MAY NOT APPEAR IN ANY OTHER
  28. #                     PLACE IN YOUR SHOREWALL CONFIGURATION.
  29. #
  30. #                     This may be qualified by adding the character
  31. #                     ":" followed by a destination host or subnet.
  32. #
  33. #                     If you wish to inhibit the action of ADD_SNAT_ALIASES
  34. #                     for this entry then include the ":" but omit the digit:
  35. #
  36. #                                eth0:
  37. #                                eth2::192.0.2.32/27
  38. #
  39. #                     Normally Masq/SNAT rules are evaluated after those for
  40. #                     one-to-one NAT (/etc/shorewall/nat file). If you want
  41. #                     the rule to be applied before one-to-one NAT rules,
  42. #                     prefix the interface name with "+":
  43. #
  44. #                        +eth0
  45. #                        +eth0:192.0.2.32/27
  46. #                        +eth0:2
  47. #
  48. #                     This feature should only be required if you need to
  49. #                     insert rules in this file that preempt entries in
  50. #                     /etc/shorewall/nat.
  51. #
  52. #        SUBNET -- Subnet that you wish to masquerade. You can specify this as
  53. #                  a subnet or as an interface. If you give the name of an
  54. #                  interface, the interface must be up before you start the
  55. #                  firewall (Shorewall will use your main routing table to
  56. #                  determine the appropriate subnet(s) to masquerade).
  57. #
  58. #                  In order to exclude a subset of the specified SUBNET, you
  59. #                  may append "!" and a comma-separated list of IP addresses
  60. #                  and/or subnets that you wish to exclude.
  61. #
  62. #                  Example: eth1!192.168.1.4,192.168.32.0/27
  63. #
  64. #                  In that example traffic from eth1 would be masqueraded unless
  65. #                  it came from 192.168.1.4 or 196.168.32.0/27
  66. #
  67. #        ADDRESS -- (Optional).        If you specify an address here, SNAT will be
  68. #                                used and this will be the source address. If
  69. #                                ADD_SNAT_ALIASES is set to Yes or yes in
  70. #                                /etc/shorewall/shorewall.conf then Shorewall
  71. #                                will automatically add this address to the
  72. #                                INTERFACE named in the first column.
  73. #
  74. #                                You may also specify a range of up to 256
  75. #                                IP addresses if you want the SNAT address to
  76. #                                be assigned from that range in a round-robin
  77. #                                range by connection. The range is specified by
  78. #                                <first ip in range>-<last ip in range>.
  79. #
  80. #                                Example: 206.124.146.177-206.124.146.180
  81. #
  82. #                                You may also use the special value "detect"
  83. #                                which causes Shorewall to determine the
  84. #                                IP addresses configured on the interface named
  85. #                                in the INTERFACES column and substitute them
  86. #                                in this column.
  87. #
  88. #                                Finally, you may also specify a comma-separated
  89. #                                list of ranges and/or addresses in this column.
  90. #
  91. #                                This column may not contain DNS Names.
  92. #
  93. #                                Normally, Netfilter will attempt to retain
  94. #                                the source port number. You may cause
  95. #                                netfilter to remap the source port by following
  96. #                                an address or range (if any) by ":" and
  97. #                                a port range with the format <low port>-
  98. #                                <high port>. If this is done, you must
  99. #                                specify "tcp" or "udp" in the PROTO column.
  100. #
  101. #                                Examples:
  102. #
  103. #                                        192.0.2.4:5000-6000
  104. #                                        :4000-5000
  105. #
  106. #                                You can invoke the SAME target using the
  107. #                                following in this column:
  108. #
  109. #                        SAME:[nodst:]<address-range>[,<address-range>...]
  110. #
  111. #                                The <address-ranges> may be single addresses
  112. #                                or "detect" as described above.
  113. #
  114. #                                SAME works like SNAT with the exception that
  115. #                                the same local IP address is assigned to each
  116. #                                connection from a local address to a given
  117. #                                remote address.
  118. #
  119. #                                If the 'nodst:' option is included, then the
  120. #                                same source address is used for a given
  121. #                                internal system regardless of which remote
  122. #                                system is involved.
  123. #
  124. #                                If you want to leave this column empty
  125. #                                but you need to specify the next column then
  126. #                                place a hyphen ("-") here.
  127. #
  128. #        PROTO -- (Optional)        If you wish to restrict this entry to a
  129. #                                particular protocol then enter the protocol
  130. #                                name (from /etc/protocols) or number here.
  131. #
  132. #        PORT(S) -- (Optional)        If the PROTO column specifies TCP (protocol 6)
  133. #                                or UDP (protocol 17) then you may list one
  134. #                                or more port numbers (or names from
  135. #                                /etc/services) separated by commas or you
  136. #                                may list a single port range
  137. #                                (<low port>:<high port>).
  138. #
  139. #                                Where a comma-separated list is given, your
  140. #                                kernel and iptables must have multiport match
  141. #                                support and a maximum of 15 ports may be
  142. #                                listed.
  143. #
  144. #        IPSEC -- (Optional)        If you specify a value other than "-" in this
  145. #                                column, you must be running kernel 2.6 and
  146. #                                your kernel and iptables must include policy
  147. #                                match support.
  148. #
  149. #                                Comma-separated list of options from the
  150. #                                following. Only packets that will be encrypted
  151. #                                via an SA that matches these options will have
  152. #                                their source address changed.
  153. #
  154. #                                        Yes or yes -- must be the only option
  155. #                                        listed and matches all outbound
  156. #                                        traffic that will be encrypted.
  157. #
  158. #                                        reqid=<number> where <number> is
  159. #                                        specified using setkey(8) using the
  160. #                                        'unique:<number> option for the SPD
  161. #                                        level.
  162. #
  163. #                                        spi=<number> where <number> is the
  164. #                                        SPI of the SA.
  165. #
  166. #                                        proto=ah|esp|ipcomp
  167. #
  168. #                                        mode=transport|tunnel
  169. #
  170. #                                        tunnel-src=<address>[/<mask>] (only
  171. #                                        available with mode=tunnel)
  172. #
  173. #                                        tunnel-dst=<address>[/<mask>] (only
  174. #                                        available with mode=tunnel)
  175. #
  176. #                                        strict        Means that packets must match
  177. #                                                all rules.
  178. #
  179. #                                        next        Separates rules; can only be
  180. #                                                used with strict..
  181. #
  182. #        Example 1:
  183. #
  184. #                  You have a simple masquerading setup where eth0 connects to
  185. #                  a DSL or cable modem and eth1 connects to your local network
  186. #                  with subnet 192.168.0.0/24.
  187. #
  188. #                  Your entry in the file can be either:
  189. #
  190. #                        eth0        eth1
  191. #
  192. #                  or
  193. #
  194. #                        eth0        192.168.0.0/24
  195. #
  196. #        Example 2:
  197. #
  198. #                  You add a router to your local network to connect subnet
  199. #                  192.168.1.0/24 which you also want to masquerade. You then
  200. #                  add a second entry for eth0 to this file:
  201. #
  202. #                        eth0        192.168.1.0/24
  203. #
  204. #        Example 3:
  205. #
  206. #                  You have an IPSEC tunnel through ipsec0 and you want to
  207. #                  masquerade packets coming from 192.168.1.0/24 but only if
  208. #                  these packets are destined for hosts in 10.1.1.0/24:
  209. #
  210. #                        ipsec0:10.1.1.0/24        196.168.1.0/24
  211. #
  212. #        Example 4:
  213. #
  214. #                  You want all outgoing traffic from 192.168.1.0/24 through
  215. #                  eth0 to use source address 206.124.146.176 which is NOT the
  216. #                  primary address of eth0. You want 206.124.146.176 added to
  217. #                  be added to eth0 with name eth0:0.
  218. #
  219. #                        eth0:0        192.168.1.0/24        206.124.146.176
  220. #
  221. #        Example 5:
  222. #
  223. #                 You want all outgoing SMTP traffic entering the firewall
  224. #                 on eth1 to be sent from eth0 with source IP address
  225. #                 206.124.146.177. You want all other outgoing traffic
  226. #                 from eth1 to be sent from eth0 with source IP address
  227. #                 206.124.146.176.
  228. #
  229. #                        eth0        eth1        206.124.146.177        tcp        smtp
  230. #                        eth0        eth1        206.124.146.176
  231. #
  232. #                THE ORDER OF THE ABOVE TWO RULES IS SIGNIFICANT!!!!!
  233. #
  234. # For additional information, see http://shorewall.net/Documentation.htm#Masq
  235. #
  236. ###############################################################################
  237. #INTERFACE                SUBNET                ADDRESS                PROTO        PORT(S)        IPSEC
  238. eth1     eth0
  239. #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
复制代码


就是以上了，我不知道哪里出问题，于是后来为了测试，我干脆这么干，把内网的网卡eth0禁掉了，直接用一块网卡给自己构建了一个防护墙，结果问题和刚才一样，一开防火墙，立刻就ping不通外网，配置如下
zones文件
  1. #
  2. # Shorewall version 3.2 - Zones File
  3. #
  4. # /etc/shorewall/zones
  5. #
  6. #        This file declares your network zones. You specify the hosts in
  7. #        each zone through entries in /etc/shorewall/interfaces or
  8. #        /etc/shorewall/hosts.
  9. #
  10. #        WARNING: The format of this file changed in Shorewall 3.0.0. You can
  11. #                 continue to use your old records provided that you set
  12. #                 IPSECFILE=ipsec in /etc/shorewall/shorewall.conf. This will
  13. #                 signal Shorewall that the IPSEC-related zone options are
  14. #                 still specified in /etc/shorewall/ipsec rather than in this
  15. #                 file.
  16. #
  17. #                 To use records in the format described below, you must have
  18. #                 IPSECFILE=zones specified in /etc/shorewall/shorewall.conf
  19. #                 AND YOU MUST NOT SET THE 'FW' VARIABLE IN THAT FILE!!!!!
  20. #
  21. # Columns are:
  22. #
  23. #        ZONE        Short name of the zone (5 Characters or less in length).
  24. #                The names "all" and "none" are reserved and may not be
  25. #                used as zone names.
  26. #
  27. #                Where a zone is nested in one or more other zones,
  28. #                you may follow the (sub)zone name by ":" and a
  29. #                comma-separated list of the parent zones. The parent
  30. #                zones must have been defined in earlier records in this
  31. #                file.
  32. #
  33. #                Example:
  34. #
  35. #                        #ZONE     TYPE     OPTIONS
  36. #                        a          ipv4
  37. #                        b          ipv4
  38. #                        c:a,b     ipv4
  39. #
  40. #                Currently, Shorewall uses this information to reorder the
  41. #                zone list so that parent zones appear after their subzones in
  42. #                the list. The IMPLICIT_CONTINUE option in shorewall.conf can
  43. #                also create implicit CONTINUE policies to/from the subzone.
  44. #
  45. #                In the future, Shorewall may make additional use
  46. #                of nesting information.
  47. #
  48. #        TYPE        ipv4 -        This is the standard Shorewall zone type and is the
  49. #                        default if you leave this column empty or if you enter
  50. #                        "-" in the column. Communication with some zone hosts
  51. #                        may be encrypted. Encrypted hosts are designated using
  52. #                        the 'ipsec'option in /etc/shorewall/hosts.
  53. #                ipsec -        Communication with all zone hosts is encrypted
  54. #                        Your kernel and iptables must include policy
  55. #                        match support.
  56. #                firewall
  57. #                      - Designates the firewall itself. You must have
  58. #                        exactly one 'firewall' zone. No options are
  59. #                        permitted with a 'firewall' zone. The name that you
  60. #                        enter in the ZONE column will be stored in the shell
  61. #                        variable $FW which you may use in other configuration
  62. #                        files to designate the firewall zone.
  63. #
  64. #        OPTIONS,        A comma-separated list of options as follows:
  65. #        IN OPTIONS,
  66. #        OUT OPTIONS        reqid=<number> where <number> is specified
  67. #                        using setkey(8) using the 'unique:<number>
  68. #                        option for the SPD level.
  69. #
  70. #                        spi=<number> where <number> is the SPI of
  71. #                        the SA used to encrypt/decrypt packets.
  72. #
  73. #                        proto=ah|esp|ipcomp
  74. #
  75. #                        mss=<number> (sets the MSS field in TCP packets)
  76. #
  77. #                        mode=transport|tunnel
  78. #
  79. #                        tunnel-src=<address>[/<mask>] (only
  80. #                        available with mode=tunnel)
  81. #
  82. #                        tunnel-dst=<address>[/<mask>] (only
  83. #                        available with mode=tunnel)
  84. #
  85. #                        strict        Means that packets must match all rules.
  86. #
  87. #                        next        Separates rules; can only be used with
  88. #                                strict
  89. #
  90. #                Example:
  91. #                        mode=transport,reqid=44
  92. #
  93. #        The options in the OPTIONS column are applied to both incoming
  94. #        and outgoing traffic. The IN OPTIONS are applied to incoming
  95. #        traffic (in addition to OPTIONS) and the OUT OPTIONS are
  96. #        applied to outgoing traffic.
  97. #
  98. #        If you wish to leave a column empty but need to make an entry
  99. #        in a following column, use "-".
  100. #------------------------------------------------------------------------------
  101. # Example zones:
  102. #
  103. #        You have a three interface firewall with internet, local and DMZ
  104. #        interfaces.
  105. #
  106. #        #ZONE        TYPE                OPTIONS                IN                        OUT
  107. #        #                                        OPTIONS                        OPTIONS
  108. #        fw        firewall
  109. #        net        ipv4
  110. #        loc        ipv4
  111. #        dmz        ipv4
  112. #
  113. #
  114. # For more information, see http://www.shorewall.net/Documentation.htm#Zones
  115. #
  116. ###############################################################################
  117. #ZONE        TYPE                OPTIONS                IN                        OUT
  118. #                                        OPTIONS                        OPTIONS
  119. fw        firewall
  120. net        ipv4
  121. #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
复制代码

Interfaces文件配置

  2. #
  3. # Shorewall version 3.2 - Interfaces File
  4. #
  5. # /etc/shorewall/interfaces
  6. #
  7. #        You must add an entry in this file for each network interface on your
  8. #        firewall system.
  9. #
  10. # Columns are:
  11. #
  12. #        ZONE                Zone for this interface. Must match the name of a
  13. #                        zone defined in /etc/shorewall/zones. You may not
  14. #                        list the firewall zone in this column.
  15. #
  16. #                        If the interface serves multiple zones that will be
  17. #                        defined in the /etc/shorewall/hosts file, you should
  18. #                        place "-" in this column.
  19. #
  20. #                        If there are multiple interfaces to the same zone,
  21. #                        you must list them in separate entries:
  22. #
  23. #                        Example:
  24. #
  25. #                                loc        eth1        -
  26. #                                loc        eth2        -
  27. #
  28. #        INTERFACE        Name of interface. Each interface may be listed only
  29. #                        once in this file. You may NOT specify the name of
  30. #                        an alias (e.g., eth0:0) here; see
  31. #                        http://www.shorewall.net/FAQ.htm#faq18
  32. #
  33. #                        You may specify wildcards here. For example, if you
  34. #                        want to make an entry that applies to all PPP
  35. #                        interfaces, use 'ppp+'.
  36. #
  37. #                        There is no need to define the loopback        interface (lo)
  38. #                        in this file.
  39. #
  40. #        BROADCAST        The broadcast address for the subnetwork to which the
  41. #                        interface belongs. For P-T-P interfaces, this
  42. #                        column is left blank.If the interface has multiple
  43. #                        addresses on multiple subnets then list the broadcast
  44. #                        addresses as a comma-separated list.
  45. #
  46. #                        If you use the special value "detect", Shorewall
  47. #                        will detect the broadcast address(es) for you. If you
  48. #                        select this option, the interface must be up before
  49. #                        the firewall is started.
  50. #
  51. #                        If you don't want to give a value for this column but
  52. #                        you want to enter a value in the OPTIONS column, enter
  53. #                        "-" in this column.
  54. #
  55. #        OPTIONS                A comma-separated list of options including the
  56. #                        following:
  57. #
  58. #                        dhcp             - Specify this option when any of
  59. #                                       the following are true:
  60. #                                       1. the interface gets its IP address
  61. #                                          via DHCP
  62. #                                       2. the interface is used by
  63. #                                          a DHCP server running on the firewall
  64. #                                       3. you have a static IP but are on a LAN
  65. #                                          segment with lots of Laptop DHCP
  66. #                                          clients.
  67. #                                       4. the interface is a bridge with
  68. #                                          a DHCP server on one port and DHCP
  69. #                                          clients on another port.
  70. #
  71. #                        norfc1918    - This interface should not receive
  72. #                                       any packets whose source is in one
  73. #                                       of the ranges reserved by RFC 1918
  74. #                                       (i.e., private or "non-routable"
  75. #                                       addresses). If packet mangling or
  76. #                                       connection-tracking match is enabled in
  77. #                                       your kernel, packets whose destination
  78. #                                       addresses are reserved by RFC 1918 are
  79. #                                       also rejected.
  80. #
  81. #                        routefilter  - turn on kernel route filtering for this
  82. #                                       interface (anti-spoofing measure). This
  83. #                                       option can also be enabled globally in
  84. #                                       the /etc/shorewall/shorewall.conf file.
  85. #
  86. #                        logmartians  - turn on kernel martian logging (logging
  87. #                                       of packets with impossible source
  88. #                                       addresses. It is suggested that if you
  89. #                                       set routefilter on an interface that
  90. #                                       you also set logmartians. This option
  91. #                                       may also be enabled globally in the
  92. #                                       /etc/shorewall/shorewall.conf file.
  93. #
  94. #                        blacklist    - Check packets arriving on this interface
  95. #                                       against the /etc/shorewall/blacklist
  96. #                                       file.
  97. #
  98. #                        maclist             - Connection requests from this interface
  99. #                                       are compared against the contents of
  100. #                                       /etc/shorewall/maclist. If this option
  101. #                                       is specified, the interface must be
  102. #                                       an ethernet NIC and must be up before
  103. #                                       Shorewall is started.
  104. #
  105. #                        tcpflags     - Packets arriving on this interface are
  106. #                                       checked for certain illegal combinations
  107. #                                       of TCP flags. Packets found to have
  108. #                                       such a combination of flags are handled
  109. #                                       according to the setting of
  110. #                                       TCP_FLAGS_DISPOSITION after having been
  111. #                                       logged according to the setting of
  112. #                                       TCP_FLAGS_LOG_LEVEL.
  113. #
  114. #                        proxyarp     -
  115. #                                Sets
  116. #                                /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
  117. #                                Do NOT use this option if you are
  118. #                                employing Proxy ARP through entries in
  119. #                                /etc/shorewall/proxyarp. This option is
  120. #                                intended soley for use with Proxy ARP
  121. #                                sub-networking as described at:
  122. #                                http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet
  123. #
  124. #                        routeback    - If specified, indicates that Shorewall
  125. #                                       should include rules that allow
  126. #                                       filtering traffic arriving on this
  127. #                                       interface back out that same interface.
  128. #
  129. #                        arp_filter   - If specified, this interface will only
  130. #                                       respond to ARP who-has requests for IP
  131. #                                       addresses configured on the interface.
  132. #                                       If not specified, the interface can
  133. #                                       respond to ARP who-has requests for
  134. #                                       IP addresses on any of the firewall's
  135. #                                       interface. The interface must be up
  136. #                                       when Shorewall is started.
  137. #
  138. #                        arp_ignore[=<number>]
  139. #                                     - If specified, this interface will
  140. #                                       respond to arp requests based on the
  141. #                                       value of <number>.
  142. #
  143. #                                       1 - reply only if the target IP address
  144. #                                       is local address configured on the
  145. #                                       incoming interface
  146. #
  147. #                                       2 - reply only if the target IP address
  148. #                                       is local address configured on the
  149. #                                       incoming interface and both with the
  150. #                                       sender's IP address are part from same
  151. #                                       subnet on this interface
  152. #
  153. #                                       3 - do not reply for local addresses
  154. #                                       configured with scope host, only
  155. #                                       resolutions for global and link
  156. #                                       addresses are replied
  157. #
  158. #                                       4-7 - reserved
  159. #
  160. #                                       8 - do not reply for all local
  161. #                                       addresses
  162. #
  163. #                                       If no <number> is given then the value
  164. #                                       1 is assumed
  165. #
  166. #                                       WARNING -- DO NOT SPECIFY arp_ignore
  167. #                                       FOR ANY INTERFACE INVOLVED IN PROXY ARP.
  168. #
  169. #                        nosmurfs     - Filter packets for smurfs
  170. #                                       (packets with a broadcast
  171. #                                       address as the source).
  172. #
  173. #                                       Smurfs will be optionally logged based
  174. #                                       on the setting of SMURF_LOG_LEVEL in
  175. #                                       shorewall.conf. After logging, the
  176. #                                       packets are dropped.
  177. #
  178. #                        detectnets   - Automatically taylors the zone named
  179. #                                       in the ZONE column to include only those
  180. #                                       hosts routed through the interface.
  181. #
  182. #                        sourceroute  - If this option is not specified for an
  183. #                                       interface, then source-routed packets
  184. #                                       will not be accepted from that
  185. #                                       interface (sets /proc/sys/net/ipv4/
  186. #                                       conf/<interface>/
  187. #                                       accept_source_route to 1).
  188. #                                       Only set this option if you know what
  189. #                                       you are you doing. This might represent
  190. #                                       a security risk and is not usually
  191. #                                       needed.
  192. #
  193. #                        upnp             - Incoming requests from this interface
  194. #                                       may be remapped via UPNP (upnpd).
  195. #
  196. #                        WARNING: DO NOT SET THE detectnets OPTION ON YOUR
  197. #                                 INTERNET INTERFACE.
  198. #
  199. #                        The order in which you list the options is not
  200. #                        significant but the list should have no embedded white
  201. #                        space.
  202. #
  203. #        Example 1:        Suppose you have eth0 connected to a DSL modem and
  204. #                        eth1 connected to your local network and that your
  205. #                        local subnet is 192.168.1.0/24. The interface gets
  206. #                        it's IP address via DHCP from subnet
  207. #                        206.191.149.192/27. You have a DMZ with subnet
  208. #                        192.168.2.0/24 using eth2.
  209. #
  210. #                        Your entries for this setup would look like:
  211. #
  212. #                        net        eth0        206.191.149.223        dhcp
  213. #                        local        eth1        192.168.1.255
  214. #                        dmz        eth2        192.168.2.255
  215. #
  216. #        Example 2:        The same configuration without specifying broadcast
  217. #                        addresses is:
  218. #
  219. #                        net        eth0        detect                dhcp
  220. #                        loc        eth1        detect
  221. #                        dmz        eth2        detect
  222. #
  223. #        Example 3:        You have a simple dial-in system with no ethernet
  224. #                        connections.
  225. #
  226. #                        net        ppp0        -
  227. #
  228. # For additional information, see
  229. # http://shorewall.net/Documentation.htm#Interfaces
  230. #
  231. ###############################################################################
  232. #ZONE        INTERFACE        BROADCAST        OPTIONS
  233. net        eth1
  234. #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
复制代码

Policy配置

  2. #
  3. # Shorewall version 3.2 - Policy File
  4. #
  5. # /etc/shorewall/policy
  6. #
  7. #                     THE ORDER OF ENTRIES IN THIS FILE IS IMPORTANT
  8. #
  9. #        This file determines what to do with a new connection request if we
  10. #        don't get a match from the /etc/shorewall/rules file . For each
  11. #        source/destination pair, the file is processed in order until a
  12. #        match is found ("all" will match any client or server).
  13. #
  14. #                        INTRA-ZONE POLICIES ARE PRE-DEFINED
  15. #
  16. #        For $FW and for all of the zoned defined in /etc/shorewall/zones,
  17. #        the POLICY for connections from the zone to itself is ACCEPT (with no
  18. #        logging or TCP connection rate limiting but may be overridden by an
  19. #        entry in this file. The overriding entry must be explicit (cannot use
  20. #        "all" in the SOURCE or DEST).
  21. #
  22. #       Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall.conf, then
  23. #       the implicit policy to/from any sub-zone is CONTINUE. These implicit
  24. #       CONTINUE policies may also be overridden by an explicit entry in this
  25. #       file.
  26. #
  27. # Columns are:
  28. #
  29. #        SOURCE                Source zone. Must be the name of a zone defined
  30. #                        in /etc/shorewall/zones, $FW or "all".
  31. #
  32. #        DEST                Destination zone. Must be the name of a zone defined
  33. #                        in /etc/shorewall/zones, $FW or "all"
  34. #
  35. #        POLICY                Policy if no match from the rules file is found. Must
  36. #                        be "ACCEPT", "DROP", "REJECT", "CONTINUE" or "NONE".
  37. #
  38. #                        ACCEPT                - Accept the connection
  39. #                        DROP                - Ignore the connection request
  40. #                        REJECT                - For TCP, send RST. For all other,
  41. #                                          send "port unreachable" ICMP.
  42. #                        QUEUE                - Send the request to a user-space
  43. #                                          application using the QUEUE target.
  44. #                        CONTINUE        - Pass the connection request past
  45. #                                          any other rules that it might also
  46. #                                          match (where the source or
  47. #                                          destination zone in those rules is
  48. #                                          a superset of the SOURCE or DEST
  49. #                                          in this policy).
  50. #                        NONE                - Assume that there will never be any
  51. #                                          packets from this SOURCE
  52. #                                          to this DEST. Shorewall will not set
  53. #                                          up any infrastructure to handle such
  54. #                                          packets and you may not have any
  55. #                                          rules with this SOURCE and DEST in
  56. #                                          the /etc/shorewall/rules file. If
  57. #                                          such a packet _is_ received, the
  58. #                                          result is undefined. NONE may not be
  59. #                                          used if the SOURCE or DEST columns
  60. #                                          contain the firewall zone ($FW) or
  61. #                                          "all".
  62. #
  63. #                        If this column contains ACCEPT, DROP or REJECT and a
  64. #                        corresponding common action is defined in
  65. #                        /etc/shorewall/actions (or
  66. #                        /usr/share/shorewall/actions.std) then that action
  67. #                        will be invoked before the policy named in this column
  68. #                        is enforced.
  69. #
  70. #        LOG LEVEL        If supplied, each connection handled under the default
  71. #                        POLICY is logged at that level. If not supplied, no
  72. #                        log message is generated. See syslog.conf(5) for a
  73. #                        description of log levels.
  74. #
  75. #                        Beginning with Shorewall version 1.3.12, you may
  76. #                        also specify ULOG (must be in upper case). This will
  77. #                        log to the ULOG target and sent to a separate log
  78. #                        through use of ulogd
  79. #                        (http://www.gnumonks.org/projects/ulogd).
  80. #
  81. #                        If you don't want to log but need to specify the
  82. #                        following column, place "-" here.
  83. #
  84. #        LIMIT:BURST        If passed, specifies the maximum TCP connection rate
  85. #                        and the size of an acceptable burst. If not specified,
  86. #                        TCP connections are not limited.
  87. #
  88. #        Example:
  89. #
  90. #        a) All connections from the local network to the internet are allowed
  91. #        b) All connections from the internet are ignored but logged at syslog
  92. #           level KERNEL.INFO.
  93. #        d) All other connection requests are rejected and logged at level
  94. #           KERNEL.INFO.
  95. #
  96. #        #SOURCE                DEST                POLICY                LOG
  97. #        #                                                LEVEL
  98. #        loc                net                ACCEPT
  99. #        net                all                DROP                info
  100. #        #
  101. #        # THE FOLLOWING POLICY MUST BE LAST
  102. #        #
  103. #        all                all                REJECT                info
  104. #
  105. # See http://shorewall.net/Documentation.htm#Policy for additional information.
  106. #
  107. ###############################################################################
  108. #SOURCE                DEST                POLICY                LOG                LIMIT:BURST
  109. #                                                LEVEL
  110. fw        all        ACCEPT
  111. net        all        DROP
  112. all        all        REJECT
  113. #LAST LINE -- DO NOT REMOVE
复制代码

人后rules和masq都是空的

就这样，还是把我给挡住出不去，真乃神奇，我现在只想到两种可能，1，ppp拨号方式和shorewall有兼容问题，2.pppoe拨号方式的nat设置有特别的地方，只有这两种可能了，请高手指教，谢谢，小弟实在是想不出还有什么不对的地方了
回复

使用道具 举报

发表于 2007-8-9 21:38:33 | 显示全部楼层
还不如，直接自己写iptables 呢。

简单实在，太复杂的东西，不喜欢玩。
回复 支持 反对

使用道具 举报

 楼主| 发表于 2007-8-9 21:48:51 | 显示全部楼层
Post by GaryWuGang
还不如，直接自己写iptables 呢。

简单实在，太复杂的东西，不喜欢玩。


iptables简单?天啊，光看手册我都要疯了，就是因为怕了iptables才跑来用shorewall的
回复 支持 反对

使用道具 举报

linuxth
发表于 2007-8-9 22:26:36 | 显示全部楼层
记得之前有这样说过。
原来你是pppoe呀，防火墙设定时“要举一反三”了。

在Masq的配置文件中，不难发现问题
#INTERFACE                SUBNET                ADDRESS                PROTO        PORT(S)        IPSEC
eth1     eth0
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE


用ppp0 来替换你的外网 eth1，或者增加ppp0相关设定。
回复 支持 反对

使用道具 举报

 楼主| 发表于 2007-8-9 22:55:35 | 显示全部楼层
Post by linuxth
记得之前有这样说过。

在Masq的配置文件中，不难发现问题


用ppp0 来替换你的外网 eth1，或者增加ppp0相关设定。

你的意思是说，ppp0才是我的上网界面，eth1不是，那么我在Interfaces就必须写成

net      ppp0

这样写吗？然后把masq里给写成
ppp0   eth0
这么干？
经你这么一说我想起来了，我今天回来看某shorewall帖子的时候看到这么一句：


  2. interfaces文件：

  4. [Copy to clipboard] [ - ]CODE:
  5. #ZONE   INTERFACE       BROADCAST       OPTIONS
  6. loc     eth1            -
  7. net     eth0            -
  8. dmz     eth2            -
  9. 这里是定义网络界面的文件，也就是将zone文件里面建立的区域和实际网络界面联系起来。
  10. 每行都是指实际的网络界面。除了普通的eth外，你还可以使用ppp界面例如：
  11. [color=red]loc   ppp+    -这里的意思是本地网络是用户拨号到防火墙的。[/color]
复制代码


看来我还是windows的习惯思维，只看到了网卡界面，没有想到pppoe的连接界面是不同的……

PS：请问你有什么建议解决我说的那个shorewall stop的时候会自动堵塞所有外部对fw的访问的问题，我查了shorewall.conf文件里的文档，就没找到哪一个项能关掉这功能
回复 支持 反对

使用道具 举报

linuxth
发表于 2007-8-9 23:09:31 | 显示全部楼层
是的，你的理解正确，增加ppp界面再来测试防火墙。

注：启动防火墙时，ppp要处于连接状态。
回复 支持 反对

使用道具 举报

 楼主| 发表于 2007-8-9 23:20:52 | 显示全部楼层
Post by linuxth
是的，你的理解正确，增加ppp界面再来测试防火墙。

注：启动防火墙时，ppp要处于连接状态。


等以下，ppp要处于连接状态？不能先启动防火墙后拨号吗？这可就是麻烦问题了，那这样NAT就无法无人值守了，比如停电后来电，我怎么让shorewall在拨号上去了再启动呢……晕
回复 支持 反对

使用道具 举报

linuxth
发表于 2007-8-9 23:23:49 | 显示全部楼层
设为开机自动拔号。
回复 支持 反对

使用道具 举报

 楼主| 发表于 2007-8-9 23:31:48 | 显示全部楼层
Post by linuxth
设为开机自动拔号。

那不是问题，如何保证开机拨号拨上去了以后shorewall才启动才是难题……

对了，还有更麻烦的，万一掉线了，shorewall会怎么样，这才更头疼……
PS：那个shorewall stop后会堵塞所有外部对fw区域的访问的问题，你有没有发现，有解决方法吗？
回复 支持 反对

使用道具 举报

linuxth
发表于 2007-8-9 23:49:18 | 显示全部楼层
如何保证开机拨号拨上去了以后shorewall才启动才是难题……

嗯，可以如愿的。
万一掉线了，shorewall会怎么样，这才更头疼

嗯，试图让ppp断线重拔，ShareWall应该可以继续工作的（这个需要测试一下）

ps的问题不清楚，没碰到，等你防火墙能正常工作后，再回头看这个问题，是否存在。
回复 支持 反对

使用道具 举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

快速回复 返回顶部 返回列表