high-level tool for configuring the Linux Netfilter packet filter

learn more… | top users | synonyms

1
vote
1answer
55 views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw ...
0
votes
0answers
119 views

tc-tbf rate limiting works on 100Mbit Ethernet, but not Gigabit ethernet, with Windows

I have a linux box I use as a firewall with Shorewall. I have traffic shaping enabled in order to prioritize traffic from one computer used for videoconferencing. My business has an upload speed of ...
1
vote
1answer
25 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
0
votes
0answers
248 views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
0
votes
0answers
134 views

IMAP is configured and I can connect by telnet but not from outside

When I issue telnet localhost imap command I get the following message: Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN ...
0
votes
2answers
55 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
0
votes
1answer
76 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
0
votes
0answers
66 views

Multi-ISP setup only has single working connection

I have a gateway running Shorewall 4.0. The gateway has 3 NIC's: eth0 (172.16.x.x): local network eth1 (10.0.0.138): connected to ADSL modem, which in turn is used by ppp0 (80.127.x.x) for internet ...
1
vote
0answers
119 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
182 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
0
votes
0answers
138 views

Simple Shorewall/netfilter traffic control/prioritization questions and possible strange side effects

I am setting up traffic prioritization for a small business to prioritize videoconferencing traffic over general web traffic. I use Shorewall (which controls iptables/netfiler) on a linux machine for ...
1
vote
0answers
144 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
1answer
712 views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
1
vote
0answers
285 views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
3
votes
2answers
606 views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
5
votes
3answers
535 views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
-1
votes
1answer
429 views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
0
votes
1answer
186 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
1
vote
1answer
112 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
2
votes
0answers
321 views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
1
vote
1answer
3k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
-1
votes
2answers
752 views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
1
vote
0answers
168 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
0
votes
2answers
329 views

Shorewall blacklist not working

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as #ADDRESS/SUBNET ...
0
votes
1answer
47 views

Shorewall deny all assh access except one user

Hi all I have an ubuntu server with shorewall firewall. I want to deny all ssh access exxcept my user: "alessandro". How can I write this rule in shorewall? Thanks
0
votes
1answer
74 views

Expressing iptables rule as shorewall rule

I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
1
vote
2answers
122 views

multiple blacklist files shorewall

I have been blocking by ip with shorewall and the blacklist file. I have decided to block a few country entirely and the blacklist file is huge! So my question is this: Is it possible to have ...
0
votes
2answers
621 views

Routing to secondary LAN with Shorewall

I'm setting up Shorewall (4.4.26.1), and have been trying to figure out routing between two LAN segments for the good part of the afternoon. It's time to ask for help. ((INTERNET)) | | ...
0
votes
1answer
339 views

Martian source in log of machine1 after ssh-DNAT to virtual machine located on machine2 (machine1 and machine2 xover connected)

My scenario 2 physical machines, each with 2 network interfaces (eth0, eth1). they act as virtual machine host for one machine alone, the networking works with no problems first i had two ...
1
vote
0answers
90 views

Shorewall SHOW DYNAMIC command doesn't work

Setting up shorewall dynamic zones, http://shorewall.net/Dynamic.html shows the command shorewall show dynamic zone where zone is one of your zones. I can get the add and delete commands to work, but ...
0
votes
2answers
68 views

Service redirection on same network

I have a network on which I run multiple servers each dedicated to a given service. Because most services run on distinct ports I'm currently looking for a way of unifying "all" services into a ...
5
votes
1answer
1k views

multiple IP addresses bound - which one is used for outgoing packets?

Using IP aliasing a linux box has bound multiple ip addresses from the same subnet on the same NIC. So ifconfig shows up device eth0 with , eth0:1 with and eth0:2 with . How does Linux determine the ...
1
vote
1answer
249 views

virtualbox port forwarding - firewall config

i have a ubuntu host system with virtualbox running a windows server. In Virtualbox i have configured the network with a NAT interface and port forwarding for the RDP deamon running inside the vm. ...
1
vote
1answer
166 views

Linux Router - Share bandwidth per IPs with current active connections

We have a Linux machine running as a custom router, currently utilising Shorewall. This sits between our incoming internet connection and the internal LAN. What we would like to achieve is 'fair ...
1
vote
1answer
824 views

How to DNAT to different local IP based on what public IP was accessed with Shorewall?

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses. As an example, I want to map ports 80, 443 and 8080 on 232.21.23.23 (public) to 192.168.122.12 ...
3
votes
1answer
1k views

Bridge and OpenVPN with shorewall

I have this scenario and everything it's working OK, but I want to configure my Shorewall and I can't do it. My interfaces are: br0 (bridge of eth0) tun0 (OpenVPN) vnet* (each one of bridged ...
0
votes
1answer
258 views

Sub-process /usr/bin/dpkg returned an error code (1)

Hey friends i am getting the following error when i am trying to purge shorewall root@aptosid:/etc# apt-get purge shorewall Reading package lists... Done Building dependency tree Reading ...
4
votes
1answer
489 views

Using knockd with shorewall

I'd like to migrate my old pure iptables firewall configuration to a shorewall setup. I get the basics, but I haven't been able to replicate my existing knockd setup: I have a 'tmpknock' chain that ...
1
vote
1answer
833 views

How to use address ranges in shorewall rules?

I want to add rule for a range of IP addresses from 64.240.160.0 to 64.240.191.255.
1
vote
0answers
80 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected ...
1
vote
2answers
1k views

Shorewall enabling MySQL port

I've recently set up an ubuntu server to host my site - I need to open up port 3306 for MySQL access on my server. I'm currently using shorewall on my server - how can open incoming connections to ...
0
votes
1answer
548 views

Track torrent traffic in shorewall

I use shorewall to configure my firewall. Is there anyway to track torrent traffic using shorewall accounting?
2
votes
1answer
365 views

Route by port in multi-isp configuration

I'm using shorewall firewall and have successfuly configure multiple isp source. Currently it balances all traffic to both ISP. What I want to achieve is to route ssh trafic to ISP1 and route www ...
0
votes
2answers
368 views

Possible hack attack in Ubuntu Server?

I am having a Ubuntu 10.04 Server with Shorewall 4.4.6. For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log. It occupied all ...
0
votes
1answer
794 views

I would like to redirect port 8140 on my public IP address (ip1) to port 8140 on Internet host (ip2)

edit3: i would like to get exactly what is descripted in http://shorewall.net/FAQ.htm#faq1g but it doesn't work for me. edit3 end; os: debian squeeze shorwall: 4.4.11.6-3 3 computers a, b & c; ...
1
vote
1answer
687 views

Clarify the intent of ping rules in a Shorewall configuration

I'm configuring shorewall on a server, and things are going well so far. However, there is one thing I am wondering about. The 'rules' file has, among others, the following lines: # # Drop Ping from ...
1
vote
2answers
512 views

Forwarding a call from different subdomains to different internal machines

How do I route traffic from different sub domains to different internal IP addresses? I have set up a Debian router that has one public IP and a domain name pointed to that IP, I would like to have ...
0
votes
1answer
312 views

Prevent Shorewall log entries for specific IP address and/or port

I have Shorewall firewall setup on a Debian server which is working fine. I get various log entries in /var/log/messages when packets are dropped, as expected, for example: Aug 17 19:09:07 cheetah ...
1
vote
1answer
232 views

What service uses UDP port 60059?

I received an email from logcheck that contained a number of attempted connections to UDP port 60059. This email is sent by logcheck. If you no longer wish to receive such mail, you can either ...
1
vote
0answers
240 views

Multi-ISP firewall setup

We have been trying to move away from a SonicWall firewall for quite some time now. Through much Googling and many hours of trial and error, we have met varying degrees of success through different ...