I am trying to follow the guide for setting up a "three-Interface Firewall" running Shorewall version 5.0.4. (https://shorewall.org/three-interface.htm). I also have a Procurve switch that ethernet.
I have a single static IP from my ISP which my router uses along with its gateway address and two DNS servers addresses it uses.
Where I get confused is trying to decipher if the VLANs on my switch need to make use of any of this info ? Do my VLANs or either of my two other network interfaces for my LAN and DMZ need to know about my ISP router?
This leads me to shorewall's masq file.
The guide states the following:
If your external IP is static then, if you are running Shorewall 5.0.13 or earlier, you can enter our static IP in the third column in the /etc/shorewall/masq entry if you like although your firewall will work fine if you leave that column empty (Masquerade). Entering your static IP in column 3 (SNAT) makes the processing of outgoing packets a little more efficient.
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL # GROUP DEST etho1 10.0.0.0/8,\ 169.254.0.0/16,\ 172.16.0.0/12,\ 192.168.0.0/16
I think these entries only include the subnets I intend to use potentially on my VLAN. If so is the static address referred to in the guide the static IP address of my internal firewall IP or its external IP ?