#<br /># Shorewall version 2.4 - Rules File<br />#<br /># /etc/shorewall/rules<br />#<br />#    Rules in this file govern connection establishment. Requests and<br /># responses are automatically allowed using connection tracking. For any<br />#       particular (source,dest) pair of zones, the rules are evaluated in the<br />#       order in which they appear in this file and the first match is the one<br />#       that determines the disposition of the request.<br />#<br />#       In most places where an IP address or subnet is allowed, you<br />#     can preceed the address/subnet with &quot;!&quot; (e.g., !192.168.1.0/24) to<br />#     indicate that the rule matches all addresses except the address/subnet<br />#   given. Notice that no white space is permitted between &quot;!&quot; and the<br />#     address/subnet.<br />#------------------------------------------------------------------------------<br /># WARNING: If you masquerade or use SNAT from a local system to the internet, <br />#          you cannot use an ACCEPT rule to allow traffic from the internet to<br />#        that system. You *must* use a DNAT rule instead.<br />#-------------------------------------------------------------------------------#<br /># Columns are:<br />#<br />#    ACTION          ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, CONTINUE,<br />#                   LOG, QUEUE or an &lt;action&gt;.<br />#<br />#                          ACCEPT   -- allow the connection request<br />#                         ACCEPT+  -- like ACCEPT but also excludes the<br />#                                        connection from any subsequent<br />#                                           DNAT[-] or REDIRECT[-] rules<br />#                         NONAT    -- Excludes the connection from any<br />#                                         subsequent DNAT[-] or REDIRECT[-]<br />#                                        rules but doesn&#039;t generate a rule<br />#                                           to accept the traffic.<br />#                               DROP     -- ignore the request<br />#                           REJECT   -- disallow the request and return an<br />#                                       icmp-unreachable or an RST packet.<br />#                           DNAT     -- Forward the request to another<br />#                                           system (and optionally another<br />#                                           port).<br />#                               DNAT-    -- Advanced users only.<br />#                                     Like DNAT but only generates the<br />#                                         DNAT iptables rule and not<br />#                                       the companion ACCEPT rule.<br />#                           SAME     -- Similar to DNAT except that the<br />#                                          port may not be remapped and when<br />#                                        multiple server addresses are <br />#                                           listed, all requests from a given<br />#                                        remote system go to the same<br />#                                     server.<br />#                              SAME-    -- Advanced users only.<br />#                                     Like SAME but only generates the<br />#                                         NAT iptables rule and not<br />#                                        the companion ACCEPT rule.<br />#                           REDIRECT -- Redirect the request to a local<br />#                                          port on the firewall.<br />#                                REDIRECT-<br />#                                         -- Advanced users only.<br />#                                     Like REDIRET but only generates the<br />#                                      REDIRECT iptables rule and not<br />#                                           the companion ACCEPT rule.<br />#<br />#                            CONTINUE -- (For experts only). Do not process<br />#                                       any of the following rules for this<br />#                                      (source zone,destination zone). If<br />#                                       The source and/or destination IP<br />#                                         address falls into a zone defined<br />#                                        later in /etc/shorewall/zones, this<br />#                                      connection request will be passed<br />#                                        to the rules defined for that<br />#                                            (those) zone(s).<br />#                             LOG      -- Simply log the packet and continue.<br />#                          QUEUE    -- Queue the packet to a user-space<br />#                                         application such as ftwall<br />#                                       (http://p2pwall.sf.net).<br />#                             &lt;action&gt; -- The name of an action defined in<br />#                                           /etc/shorewall/actions or in <br />#                                            /usr/share/shorewall/actions.std.<br />#<br />#                     The ACTION may optionally be followed<br />#                    by &quot;:&quot; and a syslog log level (e.g, REJECT:info or<br />#                     DNAT:debug). This causes the packet to be<br />#                        logged at the specified level.<br />#<br />#                    If the ACTION names an action defined in<br />#                 /etc/shorewall/actions or in<br />#                     /usr/share/shorewall/actions.std then:<br />#<br />#                    - If the log level is followed by &quot;!&#039; then all rules<br />#                     in the action are logged at the log level.<br />#<br />#                      - If the log level is not followed by &quot;!&quot; then only<br />#                      those rules in the action that do not specify <br />#                   logging are logged at the specified level.<br />#<br />#                      - The special log level &#039;none!&#039; suppresses logging<br />#                       by the action.<br />#<br />#                  You may also specify ULOG (must be in upper case) as a<br />#                   log level.This will log to the ULOG target for routing<br />#                   to a separate log through use of ulogd<br />#                   (http://www.gnumonks.org/projects/ulogd).<br />#<br />#                 Actions specifying logging may be followed by a<br />#                  log tag (a string of alphanumeric characters)<br />#                    are appended to the string generated by the<br />#                      LOGPREFIX (in /etc/shorewall/shorewall.conf). <br />#<br />#                    Example: ACCEPT:info:ftp would include &#039;ftp &#039;<br />#                  at the end of the log prefix generated by the<br />#                    LOGPREFIX setting.<br />#<br />#        SOURCE          Source hosts to which the rule applies. May be a zone<br />#                       defined in /etc/shorewall/zones, $FW to indicate the<br />#                  firewall itself, &quot;all&quot; or &quot;none&quot; If the ACTION is DNAT or<br />#                    REDIRECT, sub-zones of the specified zone may be<br />#                 excluded from the rule by following the zone name with<br />#                   &quot;!&#039; and a comma-separated list of sub-zone names.<br />#<br />#                       When &quot;none&quot; is used either in the SOURCE or DEST column,<br />#                       the rule is ignored.<br />#<br />#                      When &quot;all&quot; is used either in the SOURCE or DEST column<br />#                 intra-zone traffic is not affected. You must add <br />#                        separate rules to handle that traffic.<br />#<br />#                    Except when &quot;all&quot; is specified, clients may be further<br />#                 restricted to a list of subnets and/or hosts by<br />#                  appending &quot;:&quot; and a comma-separated list of subnets<br />#                    and/or hosts. Hosts may be specified by IP or MAC<br />#                        address; mac addresses must begin with &quot;~&quot; and must use<br />#                        &quot;-&quot; as a separator.<br />#<br />#                     Hosts may be specified as an IP address range using the<br />#                  syntax &lt;low address&gt;-&lt;high address&gt;. This requires that<br />#                      your kernel and iptables contain iprange match support.<br />#                       If you kernel and iptables have ipset match support then<br />#                       you may give the name of an ipset prefaced by &quot;+&quot;. The<br />#                       ipset name may be optionally followed by a number from<br />#                       1 to 6 enclosed in square brackets ([]) to indicate the<br />#                       number of levels of source bindings to be matched.<br />#<br />#                      dmz:192.168.2.2         Host 192.168.2.2 in the DMZ<br />#<br />#                       net:155.186.235.0/24    Subnet 155.186.235.0/24 on the<br />#                                           Internet<br />#<br />#                  loc:192.168.1.1,192.168.1.2<br />#                                              Hosts 192.168.1.1 and<br />#                                            192.168.1.2 in the local zone.<br />#                   loc:~00-A0-C9-15-39-78  Host in the local zone with<br />#                                               MAC address 00:A0:C9:15:39:78.<br />#<br />#                   net:192.0.2.11-192.0.2.17<br />#                                                Hosts 192.0.2.11-192.0.2.17 in<br />#                                           the net zone.<br />#<br />#                     Alternatively, clients may be specified by interface<br />#                     by appending &quot;:&quot; to the zone name followed by the<br />#                      interface name. For example, loc:eth1 specifies a<br />#                        client that communicates with the firewall system<br />#                        through eth1. This may be optionally followed by<br />#                 another colon (&quot;:&quot;) and an IP/MAC/subnet address<br />#                       as described above (e.g., loc:eth1:192.168.1.5).<br />#<br />#  DEST            Location of Server. May be a zone defined in<br />#                     /etc/shorewall/zones, $FW to indicate the firewall<br />#                       itself, &quot;all&quot; or &quot;none&quot;.<br />#<br />#                      When &quot;none&quot; is used either in the SOURCE or DEST column,<br />#                       the rule is ignored.<br />#<br />#                      When &quot;all&quot; is used either in the SOURCE or DEST column<br />#                 intra-zone traffic is not affected. You must add <br />#                        separate rules to handle that traffic.<br />#<br />#                    Except when &quot;all&quot; is specified, the server may be<br />#                      further restricted to a particular subnet, host or<br />#                       interface by appending &quot;:&quot; and the subnet, host or<br />#                     interface. See above.<br />#<br />#                             Restrictions:<br />#<br />#                             1. MAC addresses are not allowed.<br />#                                2. In DNAT rules, only IP addresses are<br />#                             allowed; no FQDNs or subnet addresses<br />#                            are permitted.<br />#                                3. You may not specify both an interface and<br />#                                an address.<br />#<br />#                    Like in the SOURCE column, you may specify a range of<br />#                    up to 256 IP addresses using the syntax<br />#                  &lt;first ip&gt;-&lt;last ip&gt;. When the ACTION is DNAT or DNAT-,<br />#                      the connections will be assigned to addresses in the<br />#                     range in a round-robin fashion.<br />#<br />#                       If you kernel and iptables have ipset match support then<br />#                       you may give the name of an ipset prefaced by &quot;+&quot;. The<br />#                       ipset name may be optionally followed by a number from<br />#                       1 to 6 enclosed in square brackets ([]) to indicate the<br />#                       number of levels of destination bindings to be matched.<br />#                       Only one of the SOURCE and DEST columns may specify an<br />#                       ipset name.<br />#<br />#                     The port that the server is listening on may be<br />#                  included and separated from the server&#039;s IP address by<br />#                      &quot;:&quot;. If omitted, the firewall will not modifiy the<br />#                     destination port. A destination port may only be<br />#                 included if the ACTION is DNAT or REDIRECT.<br />#<br />#                       Example: loc:192.168.1.3:3128 specifies a local<br />#                  server at IP address 192.168.1.3 and listening on port<br />#                   3128. The port number MUST be specified as an integer<br />#                    and not as a name from /etc/services.<br />#<br />#                     if the ACTION is REDIRECT, this column needs only to<br />#                     contain the port number on the firewall that the<br />#                 request should be redirected to.<br />#<br />#  PROTO           Protocol - Must be &quot;tcp&quot;, &quot;udp&quot;, &quot;icmp&quot;, a number, or<br />#                      &quot;all&quot;.<br />#<br />#  DEST PORT(S)    Destination Ports. A comma-separated list of Port<br />#                        names (from /etc/services), port numbers or port<br />#                 ranges; if the protocol is &quot;icmp&quot;, this column is<br />#                      interpreted as the destination icmp-type(s).<br />#<br />#                      A port range is expressed as &lt;low port&gt;:&lt;high port&gt;.<br />#<br />#                  This column is ignored if PROTOCOL = all but must be<br />#                     entered if any of the following ields are supplied.<br />#                      In that case, it is suggested that this field contain<br />#                     &quot;-&quot;<br />#<br />#                    If your kernel contains multi-port match support, then<br />#                   only a single Netfilter rule will be generated if in<br />#                     this list and the CLIENT PORT(S) list below:<br />#                     1. There are 15 or less ports listed.<br />#                    2. No port ranges are included.<br />#                  Otherwise, a separate rule will be generated for each<br />#                    port.<br />#<br />#     CLIENT PORT(S)  (Optional) Port(s) used by the client. If omitted,<br />#                       any source port is acceptable. Specified as a comma-<br />#                     separated list of port names, port numbers or port<br />#                       ranges.<br />#<br />#                   If you don&#039;t want to restrict client ports but need to<br />#                      specify an ORIGINAL DEST in the next column, then place<br />#                  &quot;-&quot; in this column.<br />#<br />#                     If your kernel contains multi-port match support, then<br />#                   only a single Netfilter rule will be generated if in<br />#                     this list and the DEST PORT(S) list above:<br />#                       1. There are 15 or less ports listed.<br />#                    2. No port ranges are included.<br />#                  Otherwise, a separate rule will be generated for each<br />#                    port.<br />#<br />#     ORIGINAL DEST   (0ptional) -- If ACTION is DNAT[-] or REDIRECT[-] then <br />#                  if included and different from the IP<br />#                    address given in the SERVER column, this is an address<br />#                   on some interface on the firewall and connections to<br />#                     that address will be forwarded to the IP and port<br />#                        specified in the DEST column.<br />#<br />#                     A comma-separated list of addresses may also be used. <br />#                   This is usually most useful with the REDIRECT target <br />#                    where you want to redirect traffic destined for<br />#                  particular set of hosts.<br />#<br />#                  Finally, if the list of addresses begins with &quot;!&quot; then<br />#                 the rule will be followed only if the original <br />#                  destination address in the connection request does not<br />#                   match any of the addresses listed.<br />#<br />#                        For other actions, this column may be included and may<br />#                   contain one or more addresses (host or network)<br />#                  separated by commas. Address ranges are not allowed.<br />#                       When this column is supplied, rules are generated<br />#                       that require that the original destination address matches<br />#                       one of the listed addresses. This feature is most useful when<br />#                       you want to generate a filter rule that corresponds to a <br />#                    DNAT- or REDIRECT- rule. In this usage, the list of<br />#                      addresses should not begin with &quot;!&quot;.<br />#<br />#                    See http://shorewall.net/PortKnocking.html for an <br />#                       example of using an entry in this column with a<br />#                  user-defined action rule.               <br />#<br />#  RATE LIMIT      You may rate-limit the rule by placing a value in <br />#                       this colume:<br /># <br />#                             &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br />#<br />#                     where &lt;rate&gt; is the number of connections per <br />#                     &lt;interval&gt; (&quot;sec&quot; or &quot;min&quot;) and &lt;burst&gt; is the<br />#                   largest burst permitted. If no &lt;burst&gt; is given,<br />#                   a value of 5 is assumed. There may be no<br />#                 no whitespace embedded in the specification.<br />#<br />#                              Example: 10/sec:20<br />#<br />#        USER/GROUP      This column may only be non-empty if the SOURCE is<br />#                       the firewall itself.<br />#                     <br />#                 The column may contain:<br />#<br />#                      [!][&lt;user name or number&gt;][:&lt;group name or number&gt;][+&lt;program name&gt;]<br />#<br />#                 When this column is non-empty, the rule applies only<br />#                     if the program generating the output is running under<br />#                    the effective &lt;user&gt; and/or &lt;group&gt; specified (or is<br />#                 NOT running under that id if &quot;!&quot; is given).<br />#<br />#                     Examples:<br />#<br />#                         joe     #program must be run by joe<br />#                              :kids   #program must be run by a member of<br />#                                      #the &#039;kids&#039; group<br />#                              !:kids  #program must not be run by a member<br />#                                     #of the &#039;kids&#039; group<br />#                           +upnpd  #program named &#039;upnpd&#039;<br />#<br />#  Example: Accept SMTP requests from the DMZ to the internet<br />#<br />#        #ACTION SOURCE  DEST PROTO      DEST    SOURCE  ORIGINAL<br /># #                               PORT    PORT(S) DEST<br />#     ACCEPT  dmz     net       tcp   smtp<br />#<br />#      Example: Forward all ssh and http connection requests from the internet<br />#           to local system 192.168.1.3<br />#<br />#      #ACTION SOURCE  DEST            PROTO   DEST    SOURCE  ORIGINAL<br /># #                                       PORT    PORT(S) DEST<br />#     DNAT    net     loc:192.168.1.3 tcp     ssh,http<br />#<br />#  Example: Forward all http connection requests from the internet<br />#           to local system 192.168.1.3 with a limit of 3 per second and<br />#             a maximum burst of 10<br />#<br />#    #ACTION         SOURCE  DEST            PROTO   DEST    SOURCE  ORIGINAL        RATE<br />#     #                                               PORT    PORT(S) DEST            LIMIT<br />#    DNAT            net     loc:192.168.1.3 tcp     http    -       -               3/sec:10<br />#<br />#  Example: Redirect all locally-originating www connection requests to<br />#              port 3128 on the firewall (Squid running on the firewall<br />#                 system) except when the destination address is 192.168.2.2<br />#<br />#       #ACTION  SOURCE DEST      PROTO DEST    SOURCE  ORIGINAL<br /># #                               PORT    PORT(S) DEST<br />#     REDIRECT loc    3128      tcp   www      -      !192.168.2.2<br />#<br />#      Example: All http requests from the internet to address<br />#                130.252.100.69 are to be forwarded to 192.168.1.3<br />#<br />#   #ACTION  SOURCE DEST            PROTO   DEST    SOURCE  ORIGINAL<br /># #                                       PORT    PORT(S) DEST<br />#     DNAT      net   loc:192.168.1.3 tcp     80      -       130.252.100.69<br />#<br />#       Example: You want to accept SSH connections to your firewall only <br />#             from internet IP addresses 130.252.100.69 and 130.252.100.70<br />#<br />#     #ACTION  SOURCE DEST            PROTO   DEST    SOURCE  ORIGINAL<br /># #                                       PORT    PORT(S) DEST<br />#     ACCEPT   net:130.252.100.69,130.252.100.70 fw \<br />#                                  tcp     22<br />####################################################################################################<br />#ACTION  SOURCE               DEST            PROTO   DEST    SOURCE     ORIGINAL     RATE            USER/<br />#                                            PORT    PORT(S)    DEST         LIMIT           GROUP<br />ACCEPT:info  $FW     net     tcp     53<br />ACCEPT:info     $FW     net     udp     53<br />ACCEPT:info     $FW     net     tcp     80,8080,8008,8888<br />ACCEPT:info      $FW     net     tcp     443<br />ACCEPT:info    $FW     net     tcp     20,21<br />ACCEPT:info  $FW     net     tcp     110<br />ACCEPT:info    $FW     net     tcp     995<br />ACCEPT:info    $FW     net     tcp     25<br />ACCEPT:info     $FW     net     tcp     113<br />ACCEPT:info    $FW     net     tcp     4662<br />ACCEPT        $FW     net     udp     12582<br />#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

#<br /># Shorewall 2.4 -- Policy File<br />#<br /># /etc/shorewall/policy<br />#<br />#              THE ORDER OF ENTRIES IN THIS FILE IS IMPORTANT<br />#<br />#       This file determines what to do with a new connection request if we<br />#      don&#039;t get a match from the /etc/shorewall/rules file . For each<br />#     source/destination pair, the file is processed in order until a<br />#  match is found (&quot;all&quot; will match any client or server).<br />#<br /># Columns are:<br />#<br />#      SOURCE          Source zone. Must be the name of a zone defined<br />#                  in /etc/shorewall/zones, $FW or &quot;all&quot;.<br />#<br />#  DEST            Destination zone. Must be the name of a zone defined<br />#                     in /etc/shorewall/zones, $FW or &quot;all&quot;<br />#<br />#   POLICY          Policy if no match from the rules file is found. Must<br />#                    be &quot;ACCEPT&quot;, &quot;DROP&quot;, &quot;REJECT&quot;, &quot;CONTINUE&quot; or &quot;NONE&quot;.<br />#<br />#                    ACCEPT          - Accept the connection<br />#                  DROP            - Ignore the connection request<br />#                  REJECT          - For TCP, send RST. For all other, send<br />#                                   &quot;port unreachable&quot; ICMP.<br />#                     QUEUE           - Send the request to a user-space<br />#                                         application using the QUEUE target.<br />#                    CONTINUE        - Pass the connection request past<br />#                                         any other rules that it might also<br />#                                       match (where the source or destination<br />#                                   zone in those rules is a superset of<br />#                                     the SOURCE or DEST in this policy).<br />#                    NONE            - Assume that there will never be any<br />#                                      packets from this SOURCE<br />#                                         to this DEST. Shorewall will not set up<br />#                                          any infrastructure to handle such<br />#                                        packets and you may not have any rules<br />#                                   with this SOURCE and DEST in the<br />#                                         /etc/shorewall/rules file. If such a<br />#                                     packet _is_ received, the result is<br />#                                      undefined. NONE may not be used if the <br />#                                          SOURCE or DEST columns contain the<br />#                                       firewall zone ($FW) or &quot;all&quot;.<br />#<br />#                 If this column contains ACCEPT, DROP or REJECT and a <br />#                    corresponding common action is defined in<br />#                        /etc/shorewall/actions (or /usr/share/shorewall/actions.std)<br />#                     then that action will be invoked before the policy named in<br />#                      this column is inforced.<br />#<br />#  LOG LEVEL       If supplied, each connection handled under the default<br />#                   POLICY is logged at that level. If not supplied, no<br />#                      log message is generated. See syslog.conf(5) for a<br />#                       description of log levels.<br />#<br />#                        Beginning with Shorewall version 1.3.12, you may<br />#                 also specify ULOG (must be in upper case). This will<br />#                     log to the ULOG target and sent to a separate log<br />#                        through use of ulogd<br />#                     (http://www.gnumonks.org/projects/ulogd).<br />#<br />#                 If you don&#039;t want to log but need to specify the<br />#                    following column, place &quot;-&quot; here.<br />#<br />#       LIMIT:BURST     If passed, specifies the maximum TCP connection rate<br />#                     and the size of an acceptable burst. If not specified,<br />#                   TCP connections are not limited.<br />#<br />#  Example:<br />#<br />#  a) All connections from the local network to the internet are allowed<br />#    b) All connections from the internet are ignored but logged at syslog<br />#       level KERNEL.INFO.<br />#    d) All other connection requests are rejected and logged at level<br />#           KERNEL.INFO.<br />#<br />#   #SOURCE         DEST            POLICY          LOG<br />#      #                                               LEVEL<br />#    loc             net             ACCEPT<br />#   net             all             DROP            info<br />#     #<br />#        # THE FOLLOWING POLICY MUST BE LAST<br />#      #       <br /># all             all             REJECT          info <br />#<br /># See http://shorewall.net/Documentation.htm#Policy for additional information.<br />###############################################################################<br />#SOURCE             DEST            POLICY          LOG             LIMIT:BURST<br />#                                              LEVEL<br />loc  net     DROP    info<br />net   loc     DROP    info<br />all   all     DROP    info<br />$FW   net     ACCEPT  info<br />#LAST LINE -- DO NOT REMOVE