Shorewall COVER STORY Configuring Netfilter/iptables with Shorewall Setting the Table When users think about their workstations at home, they often forget about security. But danger is out there, waiting to pounce on the unsuspecting. Shorewall helps everyday Linux users keep the intruders away. BY JAMES MOHR he only way to make your system including simply dropping it or even completely safe from attack is manipulating it. Tnever to connect to the Internet. Netfilter also supports the older Whenever you open the door to go out, ipchains, the packet filter facility in 2.2 you open the door for a potential hacker kernels. Netfilter needs to be explicitly to get it. set to “ipchains compatibility mode” for Some users have the mistaken belief it to work with ipchains. that intruders only attack high-profile You can download the latest version of sites and would not be interested in a Shorewall from the Shorewall Web site personal home workstation. The truth is [2] as either source or as an RPM pack- that every single computer on the Inter- age. Note that the RPM version has not net is in danger of attack – even been tested with every distribution, mines if a particular connection is computers with dial-up connections. In although it has been tested with major allowed, if and how the packet should be many cases, these attacks are blind, distributions like SuSE, Redhat, and manipulated or redirected, and so on. brute force attacks, where the attacker Mandrake. If you are uncertain, check This concept is basically the same in tries a long list of known security holes. the Shorewall site. all firewall software and can be To foil the attackers, you could simply In order for Shorewall to work, you employed on networks with dozens or disable all inbound ports, which essen- also need the iptables and iproute/ even hundreds of computers, although it tially makes your computer invisible to iproute2 packages. These packages are is likely that with that many computers the world. However, when you need to provided by default in most distribu- talking to each other, you would proba- (or even just want to) provided services tions, so it shouldn’t be a problem. The bly want to break down your network from your computer, you need a different reason you need iptables is that Shore- into multiple segments. Each segment form of protection. wall is not really the firewall itself. That also could be managed by its own Shore- Even the smallest businesses need the is, Shorewall is not responsible for wall firewall. protection a firewall provides. Most users checking, filtering, and managing pack- One thing to note is that you do not cannot afford the thousands of dollars ets. Shorewall simply takes its necessarily need to have a dedicated for a commercial firewall product. Fortu- configuration files and uses the iptables computer just for your firewall. Although nately, there are open source solutions command to load them into the kernel. this is common practice (and generally a that offer the necessary protection. One Because iptables assumes the task of good idea), home users probably don’t such solution is Shorewall. manipulating tables within the kernel, have the space to set up extra computers Shorewall is no longer needed once you for each specific function. If your work- Behind the Scenes run it. You can actually see what is being station is connecting directly to the Shorewall is the common name of the done by taking a look at the Shorewall Internet, you could add a firewall Shoreline Firewall. From a user’s per- program itself. No, you don’t need to dig directly to your workstation. spective, Shorewall is a set of through a lot of source. The shorewall My network consists of one computer easy-to-configure files that are used to program (typically, /sbin/shorewall) is a with a DSL card that connects to the configure Netfilter [1]. Netfilter is a fea- shell script. Internet, one Windows XP machine, and ture of the Linux 2.4.x and 2.6.x kernels So that iptables will know what to do, another Linux computer. Each has a dif- that allows kernel modules to access the you need to tell the kernel what the rules ferent purpose, and I allow different network protocol stack at various places. are. So-called rulesets are defined within connections to and from these machines. The kernel module then can do almost iptables and consist of one connection As simple as my network configura- anything with the network packet, and a number of “classifiers.” This deter- tion is, I only have to change a couple of www.linux-magazine.com January 2005 33 COVER STORY Shorewall face. Since I have three zones, you may Listing 1: Sample zones file be asking yourself why there is no entry 01 #ZONE DISPLAY COMMENT for the firewall zone. Well, quite simply, 02 net Net the Internet zone the firewall zone connects to the other 03 loc Local the local network zones through one of the interfaces 04 fw FW the firewall already specified. So, it might be better 05 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE to think of the interface file as defining which interface the firewall uses to talk to the other zones. the configuration files in order to use The zones are defined in the In the case of the ppp0 interface, the Shorewall. Because this is a common (as /etc/shorewall/zones file. Each entry has broadcast has a hyphen (-). Since a PPP well as simple) configuration, it is a good three values: zone name (used to refer- connection doesn’t have a broadcast, I place to start. ence this zone in the other files), display could have left this blank. However, name (which appears when shorewall is since I wanted to specify some additional Basic Configuration loading the rules), and a comment. List- options, I needed some kind of place The primary configuration file is ing 1 shows you a basic zones file. holder. Hence, the hyphen. If I had no /etc/shorewall/shorewall.conf. shore- options, I could have left this blank. wall.conf lets you configure everything Defining the Paths of However, I like to always include from startup behavior to shutdown Communication hyphens as a reminder that something is behavior. Although you can set a lot of Although we have defined the zones, the “missing.” different values in this file, I have not yet firewall still does not know how it com- The routefilter option I specified tells found a reason to change any of the set- municates with each zone. That is, there the kernel to reject any package on the tings on my system. is no association between the zone name given interface that has a source address You may already be familiar with the and the actual network. This is done that would have been routed outbound term “segment” to refer to specific por- through the /etc/shorewall/interfaces file, on a different interface. In this case, if tions of a network. Shorewall uses the which consists of four columns: zone, the ppp0 interface had a packet with an term “zone.” In my configuration, I have interface, broadcast, and options. inbound source address that was nor- four zones: fw (the firewall itself, my On my system, the interfaces file looks mally routed outbound from the eth0 workstation), net (the Internet) and loc like Listing 2. interface, it would be dropped. This is (the local network). The zone is simply the name of the referred to as anti-spoofing. Zone names must be short (5 charac- zone from your zones file. The interface The second option, norfc1918, tells the ters or fewer) and can contain letters or is the name of the network interface. For kernel not to route addresses specified as numbers. Note that you cannot use the example, for my DSL connection, which “private” in RFC 1918. RFC 1918 lists a special zone all. Also, you cannot refer uses the Point-to-Point Protocol (PPP), number of address ranges that can be to a zone other than your firewall by the the interface name is ppp0. The interface used by anyone and shouldn’t be routed. name defined by the FW variable in name for my ethernet card is eth0. To This option ensures that they aren’t. shorewall.conf. This name defaults to fw. find out which interfaces you have, use Details of RFC 1918 can be found at [3]. Even if you are not providing any ser- the command /sbin/ifconfig. The broad- Here I have a dilemma. I want my vices to computers outside of your local cast column is the broadcast address for other computers to be able to access the network, you still need the Internet the network attached to that interface. Internet, but they have RFC 1918 zone. Remember that iptable rules are As you might guess, the options column addresses. So how can they reach the defined by a specific connection, that is, specifies any options you want to use. Internet? Well, this is something we will by two end points. One end point is per- On my system, I have two entries that get to shortly. haps your workstation, and the other is look like this: You can configure Shorewall to behave the Internet. Thus, you need to define in specific ways based on the zones by the Internet as a specific zone. net ppp0 routefilter,norfc1918 setting the “policy” for that zone. Setting Note that these names are just a con- loc eth0 detect - the default policy for a zone is done (as vention.