shorewall-ipsec.patch

Giacomo Sanchietti, 08/09/2013 02:48 PM

Download (2.21 KB)

View differences:

/etc/shorewall.ori/interfaces 2013-08-09 09:57:12.506730576 +0000
25 25 
loc	eth0	tcpflags,nosmurfs
26 26 

  		




  27
  27
  
    
vpn        tun0

  		




  
  28
  
    
l2tp    ppp+

  		












  

    
      /etc/shorewall.ori/policy	2013-08-09 09:57:12.455730427 +0000
    
  





  22
  22
  
    
#				LEVEL	BURST		MASK

  		




  23
  23
  
    
loc            vpn           ACCEPT

  		




  24
  24
  
    
vpn            loc           ACCEPT

  		




  
  25
  
    
ipsec          loc           ACCEPT

  		




  
  26
  
    
loc            ipsec          ACCEPT

  		




  
  27
  
    
loc             l2tp            ACCEPT # Allows local machines to connect to road warriors

  		




  
  28
  
    
l2tp            loc             ACCEPT # Allows road warriors to connect to local machines

  		




  
  29
  
    
l2tp            net             ACCEPT # Allows road warriors to connect to the Internet

  		




  
  30
  
    
ipsec		net		ACCEPT

  		




  25
  31
  
    
# Policies for traffic originating from the local LAN (loc)

  		




  26
  32
  
    
#

  		




  27
  33
  
    
# If you want to force clients to access the Internet via a proxy server

  		




  ......




  36
  42
  
    
# $FW to net policy to ACCEPT and remove the 'info' LOG LEVEL.

  		




  37
  43
  
    
$FW		net		ACCEPT		info

  		




  38
  44
  
    
$FW		loc		ACCEPT

  		




  
  45
  
    
$FW		ipsec		ACCEPT

  		




  39
  46
  
    
#

  		




  40
  47
  
    
# Policies for traffic originating from the Internet zone (net)

  		




  41
  48
  
    
#

  		




  42
  49
  
    
net		$FW		DROP		info

  		




  43
  50
  
    
net		loc		DROP		info

  		




  44
  51
  
    
net		all		DROP		info

  		




  
  52
  
    

  		




  45
  53
  
    
# THE FOLLOWING POLICY MUST BE LAST

  		




  46
  54
  
    
all		all		REJECT		info

  		




  47
  55
  
    
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

  		












  

    
      /etc/shorewall.ori/rules	2013-08-09 09:57:12.511730591 +0000
    
  





  34
  34
  
    
#  (assumes that the loc-> net policy is ACCEPT).

  		




  35
  35
  
    
#

  		




  36
  36
  
    
Ping/ACCEPT     loc             $FW

  		




  
  37
  
    
Ping/ACCEPT     ipsec           $FW

  		




  
  38
  
    
Ping/ACCEPT     l2tp            $FW

  		




  
  39
  
    
Ping/ACCEPT     $FW		ipsec

  		




  
  40
  
    
Ping/ACCEPT     $FW		l2tp

  		




  37
  41
  
    

  		




  38
  42
  
    
#

  		




  39
  43
  
    
#       Accept DNS connections from the firewall to the Internet

  		












  

    
      /etc/shorewall.ori/zones	2013-08-09 09:57:12.513730597 +0000
    
  





  24
  24
  
    
loc	ipv4

  		




  25
  25
  
    
net	ipv4

  		




  26
  26
  
    
vpn     ipv4

  		




  
  27
  
    
ipsec   ipsec

  		




  
  28
  
    
l2tp    ipv4