"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "Introduction.xml" between
shorewall-docs-xml-5.2.3.6.tar.bz2 and shorewall-docs-xml-5.2.6.tar.bz2

About: Shorewall (The Shoreline Firewall) is an iptables based firewall (documentation; XML)

Introduction.xml  (shorewall-docs-xml-5.2.3.6.tar.bz2):Introduction.xml  (shorewall-docs-xml-5.2.6.tar.bz2)
skipping to change at line 19 skipping to change at line 19
<author> <author>
<firstname>Tom</firstname> <firstname>Tom</firstname>
<surname>Eastep</surname> <surname>Eastep</surname>
</author> </author>
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate> <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright> <copyright>
<year>2003-2015</year> <year>2003-2020</year>
<year>2019</year>
<holder>Thomas M. Eastep</holder> <holder>Thomas M. Eastep</holder>
</copyright> </copyright>
<legalnotice> <legalnotice>
<para>Permission is granted to copy, distribute and/or modify this <para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with 1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled Texts. A copy of the license is included in the section entitled
skipping to change at line 129 skipping to change at line 131
networking knowledge, I would encourage you to check out the following networking knowledge, I would encourage you to check out the following
alternatives:</para> alternatives:</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
<para><ulink url="https://help.ubuntu.com/community/UFW">UFW <para><ulink url="https://help.ubuntu.com/community/UFW">UFW
(Uncomplicated Firewall)</ulink></para> (Uncomplicated Firewall)</ulink></para>
</listitem> </listitem>
<listitem> <listitem>
<para><ulink url="http://www.ipcop.org">ipcop</ulink></para> <para><ulink url="https://comparite.ch/free-firewall">Other free
firewalls</ulink></para>
</listitem> </listitem>
</itemizedlist> </itemizedlist>
<para>If you are looking for a Linux firewall solution that can handle <para>If you are looking for a Linux firewall solution that can handle
complex and fast changing network environments then Shorewall is a complex and fast changing network environments then Shorewall is a
logical choice.</para> logical choice.</para>
</section> </section>
</section> </section>
<section id="Concepts"> <section id="Concepts">
skipping to change at line 173 skipping to change at line 176
shown in the above file) is stored in the shell variable shown in the above file) is stored in the shell variable
$<firstterm>FW</firstterm> which may be used throughout the Shorewall $<firstterm>FW</firstterm> which may be used throughout the Shorewall
configuration to refer to the firewall zone.</para> configuration to refer to the firewall zone.</para>
<para>The simplest way to define the hosts in a zone is to associate the <para>The simplest way to define the hosts in a zone is to associate the
zone with a network interface using the <ulink zone with a network interface using the <ulink
url="manpages/shorewall-interfaces.html"><filename>/etc/shorewall/interfaces </filename></ulink> url="manpages/shorewall-interfaces.html"><filename>/etc/shorewall/interfaces </filename></ulink>
file. In the three-interface sample, the three zones are defined using file. In the three-interface sample, the three zones are defined using
that file as follows:</para> that file as follows:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS <programlisting>#ZONE INTERFACE OPTIONS
net eth0 detect dhcp,routefilter net NET_IF tcpflags,dhcp,nosmurfs,routefilter,logmartians,sourcerou
loc eth1 detect te=0,physical=eth0
dmz eth2 detect</programlisting> loc LOC_IF tcpflags,nosmurfs,routefilter,logmartians,physical=eth1
dmz DMZ_IF tcpflags,nosmurfs,routefilter,logmartians,physical=eth2<
/programlisting>
<para>The above file defines the <emphasis>net</emphasis> zone as all IPv4 <para>The above file defines the <emphasis>net</emphasis> zone as all IPv4
hosts interfacing to the firewall through eth0, the hosts interfacing to the firewall through NET_IF, the
<emphasis>loc</emphasis> zone as all IPv4 hosts interfacing through eth1 <emphasis>loc</emphasis> zone as all IPv4 hosts interfacing through LOC_IF
and the <emphasis>dmz</emphasis> as all IPv4 hosts interfacing through and the <emphasis>dmz</emphasis> as all IPv4 hosts interfacing through
eth2. It is important to note that the composition of a zone is defined in eth2. The interface names shown in the INTERFACE column are <emphasis>
terms of a combination of addresses <emphasis role="bold">and</emphasis> logical</emphasis> names which are used throughout the configuration to
refer to the individual interfaces. The actual interface names are
specified using the <emphasis role="bold">physical</emphasis> option. It
is important to note that the composition of a zone is defined in terms of
a combination of addresses <emphasis role="bold">and</emphasis>
interfaces. When using the <ulink interfaces. When using the <ulink
url="manpages/shorewall-interfaces.html"><filename>/etc/shorewall/interfaces </filename></ulink> url="manpages/shorewall-interfaces.html"><filename>/etc/shorewall/interfaces </filename></ulink>
file to define a zone, all addresses are included; when you want to define file to define a zone, all addresses are included; when you want to define
a zone that contains a limited subset of the IPv4 address space, you use a zone that contains a limited subset of the IPv4 address space, you use
the <ulink the <ulink
url="manpages/shorewall-hosts.html"><filename>/etc/shorewall/hosts</filename ></ulink> url="manpages/shorewall-hosts.html"><filename>/etc/shorewall/hosts</filename ></ulink>
file or you may use the nets= option in file or you may use the nets= option in
<filename>/etc/shorewall/interfaces</filename>:</para> <filename>/etc/shorewall/interfaces</filename>:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS <programlisting>#ZONE INTERFACE OPTIONS
net eth0 detect dhcp,routefilter,nets=(!192.168.0.0/23) net NET_IF tcpflags,dhcp,nosmurfs,routefilter,logmartians,sourcerou
loc eth1 detect nets=(192.168.0.0/24) te=0,physical=eth0
dmz eth2 detect nets=(192.168.1.0/24)</programlisting> loc LOC_IF tcpflags,nosmurfs,routefilter,logmartians,physical=eth1,
<emphasis
role="bold">nets=172.20.1.0/24</emphasis>
dmz DMZ_IF tcpflags,nosmurfs,routefilter,logmartians,physical=eth2
</programlisting>
<para>The above file defines the <emphasis>net</emphasis> zone as all IPv4 <para>The above file defines the <emphasis>net</emphasis> zone as all IPv4
hosts interfacing to the firewall through eth0 <emphasis>except</emphasis> hosts interfacing to the firewall through eth0 <emphasis>except</emphasis>
for 192.168.0.0/23, the <emphasis>loc</emphasis> zone as IPv4 hosts for 192.168.0.0/23, the <emphasis>loc</emphasis> zone as IPv4 hosts
192.168.0.0/24 interfacing through eth1 and the <emphasis>dmz</emphasis> 192.168.0.0/24 interfacing through eth1 and the <emphasis>dmz</emphasis>
as IPv4 hosts 192.168.1.0/24 interfacing through eth2 (Note that as IPv4 hosts 192.168.1.0/24 interfacing through eth2 (Note that
192.168.0.0/24 together with 192.168.1.0/24 comprises 192.168.0.0/24 together with 192.168.1.0/24 comprises
192.168.0.0/23).</para> 192.168.0.0/23).</para>
<para>Note that the names NET_IF, LOC_IF and DMZ_IF are <emphasis>logical
interface names</emphasis> which are mapped to actual physical network
interfaces using the <emphasis role="bold">physical=</emphasis> option in
each interface file entry.</para>
<para>Rules about what traffic to allow and what traffic to deny are <para>Rules about what traffic to allow and what traffic to deny are
expressed in terms of zones. <itemizedlist spacing="compact"> expressed in terms of zones. <itemizedlist spacing="compact">
<listitem> <listitem>
<para>You express your default policy for connections from one zone <para>You express your default policy for connections from one zone
to another zone in the <ulink to another zone in the <ulink
url="manpages/shorewall-policy.html"><filename url="manpages/shorewall-policy.html"><filename
class="directory">/etc/shorewall/</filename><filename>policy</filename ></ulink> class="directory">/etc/shorewall/</filename><filename>policy</filename ></ulink>
file. The basic choices for policy are:</para> file. The basic choices for policy are:</para>
<itemizedlist> <itemizedlist>
 End of changes. 7 change blocks. 
14 lines changed or deleted 32 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)