high-level tool for configuring the Linux Netfilter packet filter

learn more… | top users | synonyms

0
votes
0answers
9 views

Shorewall : how do I DNAT requests from LXC container back to same LXC container?

I've got a few LXC containers running on a host. I'm using Shorewall to handle configuration of FW on the host, as well as DNAT rules. Let's say I've got a MySQL server running on with IP address 10....
0
votes
1answer
23 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
0
votes
0answers
45 views

pound server listening to 0.0.0.0 causes a 301 redirect loop?

I have a pound 2.6 server in front of an apache 2.4.7 server. Both are in openvz containers in the same host and both have private ip addresses, as follows: [www.]my.domain:80 --> Internet --> ...
0
votes
0answers
12 views

How do I get default LXC iptable rules into Shorewall?

I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers. If I reboot the LXC host and leaves ...
1
vote
0answers
30 views

How to ensure via shorewall that the network is closed at boot time?

I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables rules are applied the network is in a closed state. There provision for ...
1
vote
1answer
13 views

Is there provision for incremental configuration in shorewall?

I did not find any provision for incremental configuration in Shorewall. Is there such a mechanism? What I am looking for is the ability to add configuration files (for rules for instance) in a (...
0
votes
0answers
18 views

How to allow DHCP between 2 networks using Shorewall?

I have a server with hyper-v and 3 networks: eth0 is virtual, eth1 is physical, eth2 is extranet from ISP. Virtual network has a DHCP running and all virtual machines can reach it fine. But not the ...
4
votes
1answer
177 views

Shorewall blocks openvpn traffic

I have one root server and two clients. The root server has a static ip address and runs Debian Linux. My clients are Mac OS X and Debian Linux with dynamic ip addresses. From my clients I can open a ...
0
votes
0answers
38 views

Shorewall forwarding subnet on bridged interfaces

I have a setup that is trying to forward a subnet from an external interface to a bridged network on the other side of the firewall. I can ping the required subnet from the firewall OK, but when I ...
0
votes
0answers
23 views

Redirect destination or rewrite destination in shorewall

My shorewall firewall running on debian nicely. I have 2 server outside from my network. All my client access server A some reason i want client access to server B without changeing ip address or dns ...
2
votes
1answer
112 views

Shorewall: VPN clients can access LAN resources, but not the Internet

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources. Router port-forwards 1194 port to RPi, so it's accessible from the ...
1
vote
0answers
87 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
0
votes
1answer
141 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
0
votes
1answer
100 views

DNAT in Shorewall not working for VPN

I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this: $ cat interfaces #ZONE ...
1
vote
1answer
485 views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (...
1
vote
1answer
47 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
0
votes
0answers
532 views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
0
votes
2answers
119 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
0
votes
1answer
203 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
1
vote
0answers
329 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
449 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
369 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
0
votes
1answer
3k views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
1
vote
0answers
792 views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
3
votes
2answers
2k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so far)....
12
votes
6answers
2k views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
-1
votes
1answer
1k views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
0
votes
2answers
287 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
1
vote
1answer
163 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
2
votes
1answer
750 views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
2
votes
1answer
6k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
1
vote
2answers
2k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
1
vote
0answers
328 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
0
votes
2answers
730 views

Shorewall blacklist not working

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as #ADDRESS/SUBNET ...
0
votes
1answer
50 views

Shorewall deny all assh access except one user

Hi all I have an ubuntu server with shorewall firewall. I want to deny all ssh access exxcept my user: "alessandro". How can I write this rule in shorewall? Thanks
0
votes
1answer
101 views

Expressing iptables rule as shorewall rule

I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
1
vote
2answers
142 views

multiple blacklist files shorewall

I have been blocking by ip with shorewall and the blacklist file. I have decided to block a few country entirely and the blacklist file is huge! So my question is this: Is it possible to have ...
0
votes
2answers
1k views

Routing to secondary LAN with Shorewall

I'm setting up Shorewall (4.4.26.1), and have been trying to figure out routing between two LAN segments for the good part of the afternoon. It's time to ask for help. ((INTERNET)) | | [...
0
votes
1answer
550 views

Martian source in log of machine1 after ssh-DNAT to virtual machine located on machine2 (machine1 and machine2 xover connected)

My scenario 2 physical machines, each with 2 network interfaces (eth0, eth1). they act as virtual machine host for one machine alone, the networking works with no problems first i had two ...
1
vote
0answers
127 views

Shorewall SHOW DYNAMIC command doesn't work

Setting up shorewall dynamic zones, http://shorewall.net/Dynamic.html shows the command shorewall show dynamic zone where zone is one of your zones. I can get the add and delete commands to work, but ...
0
votes
2answers
71 views

Service redirection on same network

I have a network on which I run multiple servers each dedicated to a given service. Because most services run on distinct ports I'm currently looking for a way of unifying "all" services into a ...
5
votes
1answer
2k views

multiple IP addresses bound - which one is used for outgoing packets?

Using IP aliasing a linux box has bound multiple ip addresses from the same subnet on the same NIC. So ifconfig shows up device eth0 with , eth0:1 with and eth0:2 with . How does Linux determine the ...
1
vote
1answer
322 views

virtualbox port forwarding - firewall config

i have a ubuntu host system with virtualbox running a windows server. In Virtualbox i have configured the network with a NAT interface and port forwarding for the RDP deamon running inside the vm. ...
1
vote
1answer
179 views

Linux Router - Share bandwidth per IPs with current active connections

We have a Linux machine running as a custom router, currently utilising Shorewall. This sits between our incoming internet connection and the internal LAN. What we would like to achieve is 'fair use'...
1
vote
2answers
3k views

How to DNAT to different local IP based on what public IP was accessed with Shorewall?

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses. As an example, I want to map ports 80, 443 and 8080 on 232.21.23.23 (public) to 192.168.122.12 (...
3
votes
1answer
1k views

Bridge and OpenVPN with shorewall

I have this scenario and everything it's working OK, but I want to configure my Shorewall and I can't do it. My interfaces are: br0 (bridge of eth0) tun0 (OpenVPN) vnet* (each one of bridged ...
0
votes
1answer
322 views

Sub-process /usr/bin/dpkg returned an error code (1)

Hey friends i am getting the following error when i am trying to purge shorewall root@aptosid:/etc# apt-get purge shorewall Reading package lists... Done Building dependency tree Reading ...
4
votes
1answer
594 views

Using knockd with shorewall

I'd like to migrate my old pure iptables firewall configuration to a shorewall setup. I get the basics, but I haven't been able to replicate my existing knockd setup: I have a 'tmpknock' chain that ...
2
votes
1answer
1k views

How to use address ranges in shorewall rules?

I want to add rule for a range of IP addresses from 64.240.160.0 to 64.240.191.255.
1
vote
0answers
86 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected zone)....