NethServer 6

With this configuration rules for blocking access to local network service don't work.

Example:

• Service: SSH
• Port: 22
• Access: public
• DenyHosts: 8.8.8.8 (on net zone)

The rule should be generated in net2fw chain, but net2fw is not defined since no red interface is configured.

The proposed solution is to configure Shorewall as follow:

• the green zone is all traffic coming to the network interface from all local networks
• the red zone is all other traffic

Below there is an implementation with templates custom.
If any modification is done on "Trusted network" page, the firewall must be restart with following command:

signal-event firewall-adjust

Please test this configuration on a running system and on a VPS.
If the implementation is good, remember to add firewall-adjust action to following events:

• network-create
• network-delete
• network-modify

/etc/e-smith/templates-custom/etc/shorewall/interfaces/20nics:

#
# 20nics
#
{
    use esmith::NetworksDB;
    my $ndb = esmith::NetworksDB->open_ro();

    if (!defined($ndb->red)) {
        foreach my $i ($ndb->green) {
            my $role = $i->prop('role') || next;
            my $type = $i->prop('type') || '';
            next if ($i->prop('role') eq 'slave' || $i->prop('role') eq 'bridged');
            next if ($type eq 'alias');
            if ($role eq 'green') {
                $OUT .= "# Force GREEN + RED mode with only one interface\n";
                $OUT .= "net\t".$i->key."\ttcpflags,dhcp,nosmurfs,logmartians,optional";
            }
            $OUT .= ",bridge" if ($type eq 'bridge');
            $OUT .= "\n";
        }
    } else {
        foreach my $i ($ndb->interfaces) {
            my $role = $i->prop('role') || next;
            my $type = $i->prop('type') || '';
            next if ($i->prop('role') eq 'slave' || $i->prop('role') eq 'bridged');
            next if ($type eq 'alias');
            if ($role eq 'green') {
                $OUT .= "loc\t".$i->key."\ttcpflags,nosmurfs";
            } elsif ($role eq 'red') {
                $OUT.="net\t".$i->key."\ttcpflags,dhcp,nosmurfs,logmartians,optional";
            } else {
                $role = substr($role,0,5); #truncate zone name to 5 chars
                $OUT.="$role\t".$i->key."\ttcpflags,nosmurfs,logmartians";
            }
            $OUT .= ",bridge" if ($type eq 'bridge');
            $OUT .= "\n";
        } 
    }
}

/etc/e-smith/templates-custom/etc/shorewall/hosts/20green:

{
    use esmith::NetworksDB;
    my $ndb = esmith::NetworksDB->open_ro();

    if (!defined($ndb->red)) {
        foreach my $i ($ndb->green) {
            $OUT .= "# Force GREEN + RED mode with only one interface\n";
            foreach my $n ($ndb->local_access_spec()) {
                my ($addr, $mask) = split('/', $n);
                my $net = esmith::util::computeLocalNetworkShortSpec($addr, $mask || '255.255.255.255');
                $OUT .= "loc\t".$i->key.":".$net."\n";
            }
        }
    }
}

/etc/e-smith/templates-custom/etc/shorewall/rules/40services (cosmetic fix):

{
    use NethServer::Service;
    use NethServer::Firewall;
    use esmith::ConfigDB;
    my $fw = NethServer::Firewall->new();
    my $confDb = esmith::ConfigDB->open();
    my $accept = 'ACCEPT';
    my $nfqueue = $firewall{'nfqueue'} || 'disabled';
    if ($nfqueue eq 'enabled') {
        $accept = 'NFQUEUE';
        # SSH and HTTPD-ADMIN exeception: do not filter ssh from local network
        $OUT.="#\n#\tAllow administration from local network\n#\n";
        $OUT .= "?COMMENT always accept sshd from loc\n";
        $OUT.="ACCEPT\tloc\t\$FW\ttcp\t".$sshd{'TCPPort'}."\n";
        $OUT .= "?COMMENT always accept httpd-admin from loc\n";
        $OUT.="ACCEPT\tloc\t\$FW\ttcp\t".${'httpd-admin'}{'TCPPort'}."\n";
    }

    foreach my $serviceRecord ($confDb->get_all_by_prop('type' => 'service')) {
        my $access = $serviceRecord->prop('access') || 'private';
    my $tcpPorts = $serviceRecord->prop('TCPPorts') || $serviceRecord->prop('TCPPort') || '';
    my $udpPorts = $serviceRecord->prop('UDPPorts') || $serviceRecord->prop('UDPPort') || '';
        if ($access eq 'none') {
            $OUT.="#\n#\tService: ".$serviceRecord->key." Access: NONE\n#\n";
            next;
        }
        if($tcpPorts || $udpPorts) {
            if( ! NethServer::Service::is_enabled($serviceRecord->key) ) {
            next;
            }
            $OUT.="#\n#\tService: ".$serviceRecord->key." Access: $access\n#\n"; 
            foreach my $port (split(',', $tcpPorts)) {
                my $allow = $serviceRecord->prop('AllowHosts') || '';
                my $deny = $serviceRecord->prop('DenyHosts') || '';
                $port =~ s/\-/:/g;
                # Always deny from hosts listed in DenyHosts
                foreach my $host (split(/,/,$deny)) {
                    my $addr = $fw->getAddress($host);
                    $OUT.="?COMMENT deny ".$serviceRecord->key." access from $host\n"; 
                    $OUT.="REJECT\t".$fw->getZone($host)."\t\$FW\ttcp\t$port\n";
                }
                # Always accept from hosts listed in AllowHosts
                foreach my $host (split(/,/,$allow)) {
                    my $addr = $fw->getAddress($host);
                    $OUT.="?COMMENT allow ".$serviceRecord->key." access from $host\n"; 
                    $OUT.="$accept\t".$fw->getZone($host)."\t\$FW\ttcp\t$port\n";
                }
                $OUT.="?COMMENT ".$serviceRecord->key."\n"; 
                $OUT.="ACCEPT\tloc\t\$FW\ttcp\t$port\n";
                if ($access eq 'public') {
                    $OUT.="$accept\tnet\t\$FW\ttcp\t$port\n";
                }
            }
            foreach my $port (split(',', $udpPorts)) {
                my $allow = $serviceRecord->prop('AllowHosts') || '';
                my $deny = $serviceRecord->prop('DenyHosts') || '';
                $port =~ s/\-/:/g;
                # Always deny from hosts listed in DenyHosts
                foreach my $host (split(/,/,$deny)) {
                    my $addr = $fw->getAddress($host);
                    $OUT.="?COMMENT deny ".$serviceRecord->key." access from $host\n"; 
                    $OUT.="REJECT\t".$fw->getZone($host)."\t\$FW\tudp\t$port\n";
                }
                # Always accept from hosts listed in AllowHosts
                foreach my $host (split(/,/,$allow)) {
                    my $addr = $fw->getAddress($host);
                    $OUT.="?COMMENT allow ".$serviceRecord->key." access from $host\n"; 
                    $OUT.="$accept\t".$fw->getZone($host)."\t\$FW\tudp\t$port\n";
                }
                $OUT.="ACCEPT\tloc\t\$FW\tudp\t$port\n";
                if ($access eq 'public') {
                    $OUT.="$accept\tnet\t\$FW\tudp\t$port\n";
                }
            }
        }
    }
}