1

Summary

I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (eth0) interface seems to be working just fine, but I cannot ping PCs on loc or dmz zones. There is likely something wrong with my /etc/network/interfaces setup in the network.

The fw interface runs on dhcp through my ISP, and I configured the loc and dmz interfaces and PCs inside those zones with static IPs. The configuration that I'm trying to use is the three-interface and single IP configuration. The reference document is located on the Shorewall website, "Three-Interface Firewall". I don't know what to do about a gateway on eth1 or eth2 interfaces, b/c the Shorewall docs don't explain that. I assume it would be the same gateway as eth0, but I don't know how to do that since eth0 is on dhcp.

Networking

/etc/network/interfaces for firmware node:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet dhcp

# Secondary network interface for dmz
auto eth1
iface eth1 inet static
    address 10.10.1.1/24
    netmask 255.255.255.0

# Tirtirary network interface for loc
auto eth2
iface eth2 inet static
    address 10.10.2.1/24
    netmask 255.255.255.0

/etc/network/interfaces for dmz

# dmz network interface
auto eth0
iface eth0 inet static
    address 10.10.1.2/24
    netmask 255.255.255.0
    gateway 10.10.1.1

Starting with just the dmz, is there something wrong with my network interfaces setup?

This is what happens when i restart my networking:

Listening on LPF/eth0/HEX:...:...
Sending on   LPF/eth0/HEX:...:...
Sending on   Socket/fallback
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 6
DHCPREQUEST on eth0 to 255.255.255.255 port 67
DHCPOFFER from XY.IP...
DHCPACK from XY.IP...
suspect value in ^1/7078C526/res-5000-2.0 option - discarded
suspect value in ^1/FBEA1017/res-5000-2.0 option - discarded
bound to NEW.IP... -- renewal in 33594 seconds.
done.

I don't understand the "suspect .... - discarded" lines. Does this indicate a problem, or are those potential IPs that are being rejected?

These are the results of ifconfig:

eth0      Link encap:Ethernet  HWaddr MAC
          inet addr:DHCP.IP  Bcast:DHCP.BC  Mask:DHCP.M
          inet6 addr: inet6.IP Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:268607 errors:0 dropped:0 overruns:0 frame:0
          TX packets:89830 errors:0 dropped:0 overruns:0 carrier:7
          collisions:0 txqueuelen:1000
          RX bytes:25066229 (23.9 MiB)  TX bytes:10734393 (10.2 MiB)
          Interrupt:17

eth1      Link encap:Ethernet  HWaddr c0:4a:00:03:00:04
          inet addr:10.10.1.1  Bcast:10.10.1.255  Mask:255.255.255.0
          inet6 addr: fe80::c24a:ff:fe03:4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:82 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:4664 (4.5 KiB)
          Interrupt:19 Base address:0xac00

eth2      Link encap:Ethernet  HWaddr c0:4a:00:07:6a:31
          inet addr:10.10.2.1  Bcast:10.10.2.255  Mask:255.255.255.0
          inet6 addr: fe80::c24a:ff:fe07:6a31/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:48 errors:0 dropped:0 overruns:0 frame:0
          TX packets:33 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2880 (2.8 KiB)  TX bytes:2578 (2.5 KiB)
          Interrupt:16 Base address:0xe800

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:41 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4592 (4.4 KiB)  TX bytes:4592 (4.4 KiB)

Shorewall settings

interfaces

net     eth0            tcpflags,dhcp,nosmurfs,routefilter,logmartians,sourceroute=0
dmz     eth1            tcpflags,nosmurfs,routefilter,logmartians
loc     eth2            tcpflags,nosmurfs,routefilter,logmartians

masq

eth0                    10.10.1.0/24
eth0                    10.10.2.0/24

params

ETH0_IP=$(find_first_interface_address eth0)

policy

loc             net             ACCEPT
net             all             DROP            info
# THE FOLLOWING POLICY MUST BE LAST
all             all             REJECT          info

routestopped

eth1            -
eth2            -

rules

SECTION NEW

# Don't allow connection pickup from the net
Invalid(DROP)   net             all

# Accept DNS connections from the firewall to the Internet
DNS(ACCEPT)     $FW             net

# Accept SSH connections from the local network to the firewall and DMZ
SSH(ACCEPT)     loc             $FW
SSH(ACCEPT)     loc             dmz

# DMZ DNS access to the Internet
DNS(ACCEPT)     dmz             net

# Drop Ping from the "bad" net zone.
Ping(DROP)      net             $FW

# Make ping work bi-directionally between the dmz, net, Firewall and local zone
# (assumes that the loc-> net policy is ACCEPT).
Ping(ACCEPT)    loc             $FW
Ping(ACCEPT)    dmz             $FW
Ping(ACCEPT)    loc             dmz
Ping(ACCEPT)    dmz             loc
Ping(ACCEPT)    dmz             net
Ping(ACCEPT)    loc             net

ACCEPT          $FW             net             icmp
ACCEPT          $FW             loc             icmp
ACCEPT          $FW             dmz             icmp

# Allow connection to web server from loc to dmz
DNAT            loc             dmz:10.10.1.2   tcp     -       80,443        $ETH0_IP

# Allow DNS connection to internal server from net
DNS(ACCEPT)     loc             dmz:10.10.1.3
DNS(ACCEPT)     $FW             dmz:10.10.1.3
DNS(ACCEPT)     loc             dmz:10.10.1.4
DNS(ACCEPT)     $FW             dmz:10.10.1.4

# Allow SMTPS traffic to internal server from net
SMTPS(ACCEPT)   dmz:10.10.1.2   $FW
POP3S(ACCEPT)   $FW             dmz:10.10.1.2

# Allow SSH and SFTP on web server
SSH(ACCEPT)     $FW             dmz:10.10.1.2
SSH(ACCEPT)     net             $FW

shorewall.conf

# Only change in this file:
IP_FORWARDING=On

zones

fw      firewall
net     ipv4
loc     ipv4
dmz     ipv4

shorewall check

Checking...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Checking /etc/shorewall/zones...
Checking /etc/shorewall/interfaces...
Determining Hosts in Zones...
Locating Action Files...
Checking /usr/share/shorewall/action.Drop for chain Drop...
Checking /usr/share/shorewall/action.Broadcast for chain Broadcast...
Checking /usr/share/shorewall/action.Invalid for chain Invalid...
Checking /usr/share/shorewall/action.NotSyn for chain NotSyn...
Checking /usr/share/shorewall/action.Reject for chain Reject...
Checking /etc/shorewall/policy...
Adding Anti-smurf Rules
Adding rules for DHCP
Checking TCP Flags filtering...
Checking Kernel Route Filtering...
Checking Martian Logging...
Checking Accept Source Routing...
Checking /etc/shorewall/masq...
Checking MAC Filtration -- Phase 1...
Checking /etc/shorewall/rules...
Checking /usr/share/shorewall/action.Invalid for chain %Invalid...
Checking MAC Filtration -- Phase 2...
Applying Policies...
Checking /etc/shorewall/routestopped...
Shorewall configuration verified

shorewall start

Compiling...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
Determining Hosts in Zones...
Locating Action Files...
Compiling /usr/share/shorewall/action.Drop for chain Drop...
Compiling /usr/share/shorewall/action.Broadcast for chain Broadcast...
Compiling /usr/share/shorewall/action.Invalid for chain Invalid...
Compiling /usr/share/shorewall/action.NotSyn for chain NotSyn...
Compiling /usr/share/shorewall/action.Reject for chain Reject...
Compiling /etc/shorewall/policy...
Adding Anti-smurf Rules
Adding rules for DHCP
Compiling TCP Flags filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling Accept Source Routing...
Compiling /etc/shorewall/masq...
Compiling MAC Filtration -- Phase 1...
Compiling /etc/shorewall/rules...
Compiling /usr/share/shorewall/action.Invalid for chain %Invalid...
Compiling MAC Filtration -- Phase 2...
Applying Policies...
Generating Rule Matrix...
Creating iptables-restore input...
Compiling /etc/shorewall/routestopped...
Shorewall configuration compiled to /var/lib/shorewall/.start
Starting Shorewall....
Initializing...
Setting up Route Filtering...
Setting up Martian Logging...
Setting up Accept Source Routing...
Setting up Traffic Control...
Preparing iptables-restore input...
Running /sbin/iptables-restore...
IPv4 Forwarding Enabled
done.

Ping

in fw terminal: ping 10.10.1.2

PING 10.10.1.2 (10.10.1.2) 56(84) bytes of data.
From 10.10.1.1 icmp_seq=1 Destination Host Unreachable
From 10.10.1.1 icmp_seq=2 Destination Host Unreachable
From 10.10.1.1 icmp_seq=3 Destination Host Unreachable

in dmz terminal: ping 10.10.1.1

connect: network not reachable

I don't know what is missing/wrong. Any help would be appreciated.

0

Solution

I found an answer to my problem, and it was the network configuration on the dmz. The dmz is on a Dell Power Edge 1950, where I'm running the hardware node on 10.10.1.2/24, and a venet0, virtual node for OpenVZ. I was not concerned about connecting to the OpenVZ nodes just yet, but could not even connect to the hardware node. After modifying the networking information and removing the CIDR addition of /24, everything fell into place. I run CentOS 6.5 on the hardware node, and I guess it doesn't like CIDR addressing.

I am now pinging the dmz from fw, so the gateway is open, happy days:

> ping 10.10.2.1
PING 10.10.2.1 (10.10.2.1) 56(84) bytes of data.
64 bytes from 10.10.2.1: icmp_req=1 ttl=64 time=0.056 ms
64 bytes from 10.10.2.1: icmp_req=2 ttl=64 time=0.027 ms
64 bytes from 10.10.2.1: icmp_req=3 ttl=64 time=0.026 ms
64 bytes from 10.10.2.1: icmp_req=4 ttl=64 time=0.025 ms

Summary

The configuration is solid, so I hope it helps someone else setting up a Shorewall interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.