high-level tool for configuring the Linux Netfilter packet filter

learn more… | top users | synonyms

0
votes
0answers
11 views

Redirect destination or rewrite destination in shorewall

My shorewall firewall running on debian nicely. I have 2 server outside from my network. All my client access server A some reason i want client access to server B without changeing ip address or dns ...
0
votes
0answers
9 views

How to log any connection request from statically banned IPs with shorewall?

So I'm banning IPs with shorewall drop IP. How do I get shorewall to log connexion requests from those IPs ?
2
votes
1answer
43 views

Shorewall: VPN clients can access LAN resources, but not the Internet

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources. Router port-forwards 1194 port to RPi, so it's accessible from the ...
0
votes
0answers
30 views

How to correctly setup Shorewall on VPN server connecting VPN clients to server's local network and vice versa?

I'm having some problems with my network setup. It looks something like this: The goal was to create a VPN server inside the local network that will a) Allow VPN clients to access local network ...
1
vote
0answers
50 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
55 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
0
votes
1answer
44 views

DNAT in Shorewall not working for VPN

I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this: $ cat interfaces #ZONE ...
0
votes
0answers
158 views

Docker & Shorewall: Access container via localhost

This is kinda a follow-up to the excellent anwer of user fazy in this previous question: Docker & Shorewall I applied the configuration as described there but it doesn't seem to work with a ...
1
vote
1answer
241 views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw ...
0
votes
0answers
261 views

tc-tbf rate limiting works on 100Mbit Ethernet, but not Gigabit ethernet, with Windows

I have a linux box I use as a firewall with Shorewall. I have traffic shaping enabled in order to prioritize traffic from one computer used for videoconferencing. My business has an upload speed of ...
1
vote
1answer
31 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
0
votes
0answers
434 views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
0
votes
0answers
222 views

IMAP is configured and I can connect by telnet but not from outside

When I issue telnet localhost imap command I get the following message: Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN ...
0
votes
2answers
87 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
0
votes
1answer
138 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
0
votes
0answers
165 views

Multi-ISP setup only has single working connection

I have a gateway running Shorewall 4.0. The gateway has 3 NIC's: eth0 (172.16.x.x): local network eth1 (10.0.0.138): connected to ADSL modem, which in turn is used by ppp0 (80.127.x.x) for internet ...
1
vote
0answers
231 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
336 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
252 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
1answer
2k views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
1
vote
0answers
446 views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
3
votes
2answers
1k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
9
votes
4answers
1k views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
-1
votes
1answer
703 views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
0
votes
1answer
216 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
1
vote
1answer
131 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
2
votes
1answer
489 views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
1
vote
1answer
4k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
0
votes
2answers
1k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
1
vote
0answers
238 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
0
votes
2answers
495 views

Shorewall blacklist not working

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as #ADDRESS/SUBNET ...
0
votes
1answer
49 views

Shorewall deny all assh access except one user

Hi all I have an ubuntu server with shorewall firewall. I want to deny all ssh access exxcept my user: "alessandro". How can I write this rule in shorewall? Thanks
0
votes
1answer
90 views

Expressing iptables rule as shorewall rule

I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
1
vote
2answers
129 views

multiple blacklist files shorewall

I have been blocking by ip with shorewall and the blacklist file. I have decided to block a few country entirely and the blacklist file is huge! So my question is this: Is it possible to have ...
0
votes
2answers
863 views

Routing to secondary LAN with Shorewall

I'm setting up Shorewall (4.4.26.1), and have been trying to figure out routing between two LAN segments for the good part of the afternoon. It's time to ask for help. ((INTERNET)) | | ...
0
votes
1answer
445 views

Martian source in log of machine1 after ssh-DNAT to virtual machine located on machine2 (machine1 and machine2 xover connected)

My scenario 2 physical machines, each with 2 network interfaces (eth0, eth1). they act as virtual machine host for one machine alone, the networking works with no problems first i had two ...
1
vote
0answers
109 views

Shorewall SHOW DYNAMIC command doesn't work

Setting up shorewall dynamic zones, http://shorewall.net/Dynamic.html shows the command shorewall show dynamic zone where zone is one of your zones. I can get the add and delete commands to work, but ...
0
votes
2answers
70 views

Service redirection on same network

I have a network on which I run multiple servers each dedicated to a given service. Because most services run on distinct ports I'm currently looking for a way of unifying "all" services into a ...
5
votes
1answer
1k views

multiple IP addresses bound - which one is used for outgoing packets?

Using IP aliasing a linux box has bound multiple ip addresses from the same subnet on the same NIC. So ifconfig shows up device eth0 with , eth0:1 with and eth0:2 with . How does Linux determine the ...
1
vote
1answer
281 views

virtualbox port forwarding - firewall config

i have a ubuntu host system with virtualbox running a windows server. In Virtualbox i have configured the network with a NAT interface and port forwarding for the RDP deamon running inside the vm. ...
1
vote
1answer
172 views

Linux Router - Share bandwidth per IPs with current active connections

We have a Linux machine running as a custom router, currently utilising Shorewall. This sits between our incoming internet connection and the internal LAN. What we would like to achieve is 'fair ...
1
vote
2answers
2k views

How to DNAT to different local IP based on what public IP was accessed with Shorewall?

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses. As an example, I want to map ports 80, 443 and 8080 on 232.21.23.23 (public) to 192.168.122.12 ...
3
votes
1answer
1k views

Bridge and OpenVPN with shorewall

I have this scenario and everything it's working OK, but I want to configure my Shorewall and I can't do it. My interfaces are: br0 (bridge of eth0) tun0 (OpenVPN) vnet* (each one of bridged ...
0
votes
1answer
292 views

Sub-process /usr/bin/dpkg returned an error code (1)

Hey friends i am getting the following error when i am trying to purge shorewall root@aptosid:/etc# apt-get purge shorewall Reading package lists... Done Building dependency tree Reading ...
4
votes
1answer
531 views

Using knockd with shorewall

I'd like to migrate my old pure iptables firewall configuration to a shorewall setup. I get the basics, but I haven't been able to replicate my existing knockd setup: I have a 'tmpknock' chain that ...
1
vote
1answer
1k views

How to use address ranges in shorewall rules?

I want to add rule for a range of IP addresses from 64.240.160.0 to 64.240.191.255.
1
vote
0answers
84 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected ...
1
vote
2answers
1k views

Shorewall enabling MySQL port

I've recently set up an ubuntu server to host my site - I need to open up port 3306 for MySQL access on my server. I'm currently using shorewall on my server - how can open incoming connections to ...
0
votes
1answer
648 views

Track torrent traffic in shorewall

I use shorewall to configure my firewall. Is there anyway to track torrent traffic using shorewall accounting?
2
votes
1answer
420 views

Route by port in multi-isp configuration

I'm using shorewall firewall and have successfuly configure multiple isp source. Currently it balances all traffic to both ISP. What I want to achieve is to route ssh trafic to ISP1 and route www ...