0

I am trying to follow the guide for setting up a "three-Interface Firewall" running Shorewall version 5.0.4. (https://shorewall.org/three-interface.htm). I also have a Procurve switch that ethernet.

I have a single static IP from my ISP which my router uses along with its gateway address and two DNS servers addresses it uses.

Where I get confused is trying to decipher if the VLANs on my switch need to make use of any of this info ? Do my VLANs or either of my two other network interfaces for my LAN and DMZ need to know about my ISP router?

This leads me to shorewall's masq file.

The guide states the following:

If your external IP is static then, if you are running Shorewall 5.0.13 or earlier, you can enter our static IP in the third column in the /etc/shorewall/masq entry if you like although your firewall will work fine if you leave that column empty (Masquerade). Entering your static IP in column 3 (SNAT) makes the processing of outgoing packets a little more efficient.

#INTERFACE:DEST    SOURCE    ADDRESS    PROTO  PORT(S)  IPSEC  MARK  USER/  SWITCH  ORIGINAL
#                      GROUP    DEST
etho1      10.0.0.0/8,\
      169.254.0.0/16,\
      172.16.0.0/12,\
      192.168.0.0/16

I think these entries only include the subnets I intend to use potentially on my VLAN. If so is the static address referred to in the guide the static IP address of my internal firewall IP or its external IP ?

Improve this question

1 Answer 1

Reset to default
0

Got this working. The masq settings essentially allows for the network interface from the firewall feeding into the switch to act as a gateway for its VLAN subnets.

Note the SOURCE entries are my VLAN subnets

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.