Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shorewall]

high-level tool for configuring the Linux Netfilter packet filter

0
votes
0answers
9 views

Traffic Shaping with Shorewall

I'd like to shape my network traffic according to the following rules: All traffic from one specific IP has lowest priority All HTTPS traffic shall have medium priority All SSH traffic shall have ...
0
votes
0answers
10 views

one bond cant send packet out

We have a Centos 7 server with two bonds and one of bonds can not send out any packet (cant ping google for instance) but its public IP is accessible from outside and can be pinged; this happened so ...
0
votes
0answers
105 views

Docker and shorewall : rejected packets

I've a Debian box with shorewall configured and working. I just added a simple docker container (nginxdemos/hello) : % sudo docker ps CONTAINER ID IMAGE COMMAND ...
0
votes
0answers
57 views

Do not clear NAT table when using Shorewall

I am using shorewall in my system, although I do not want to implement NAT rules through this. NAT rules are programmed separately using iptables command. So now, suppose I created some filtering ...
1
vote
0answers
20 views

Shorewall masquerade on dynamic interface

I have a list of interfaces to which I want to masquerade traffic to. The problem is only one of them is active at once. They all match the regex vlan14[0-9][0-9]. How can I get shorewall to ...
0
votes
0answers
38 views

Shorewall host on CentOS can't connect to outside

My shorewall firewall host (CentOS 7.4 / Shorewall 5.0.14.1) can't connect to the outside, but hosts behind it in the network can. It seems to be some connection tracking issue, but I can't work it ...
0
votes
1answer
70 views

in shorewall, how can I block requests from external hosts when using nested zones?

I have one Debian server with one network interface, I've configured a bridge for KVM and shorewall with two zones in the same interface so I have the "net" zone and the "kvm" for kvm guests, here is ...
0
votes
0answers
245 views

Shorewall - port forwarding on the same subnet

I'm a little bit stuck and I would like to ask for your help. I'm trying to forward a port on the firewall to a PC on my internal network. Here is my Shorewall config: /etc/shorewall/interfaces net ...
0
votes
0answers
126 views

Shorewall blocking outbound traffic to one IP on a vpn tunnel

I'm trying to set up shorewall to block traffic to one particular IP address that is routed over an openvpn tunnel. Naively I have the following shorewall rules in place #Don't allow connection ...
0
votes
1answer
74 views

Shorewall - Wildcard filter by source MAC address

I currently have a Debian PC with two network interfaces acting as a router/gateway. I have several cheap IP cameras that try to access external services, presumably for some kind of 'cloud' ...
2
votes
1answer
345 views

Shorewall with docker

I'm trying to enable docker support in shorewall (version 5.1.3.2). I've followed guide http://shorewall.org/Docker.html . However when I try to start shorewall I get the following error: * Starting ...
1
vote
4answers
282 views

How to block specific websites in a small office without hardware firewall? [closed]

We have a small office setup of less than 100 people. We have 2 ISP connection which come into Load Balancer and from there to Linux Firewall i.e. Shorewall. Now from Shorewall its goes to Switches ...
1
vote
0answers
27 views

Shorewall multiple outgoing IPs allocation

I have perfectly working VPN server with Shorewall installed. I got more IPs for the main eth0 interface so the server accepts the VPN connection from any of x.x.x.x/25 public IPs. But, the issue is ...
0
votes
1answer
333 views

OpenVPN tunnel up but no traffic from LAN to VPN

The HeadOffice subnet is 192.168.2.0/24. OpenVPN server & shorewall on same box - acting as a gateway AWS subnet is 10.9.1.0/24. Openvpn Client configured for VPN access Tunnel is up and I can ...
1
vote
1answer
282 views

Shorewall blocks openvpn traffic?

I have a debian installation with shorewall, openvpn and google authenticator. I can get an vpn connection - but i cannot get any traffic through to local Lan or to internet - what am I missing here: ...
1
vote
0answers
190 views

Shorewall reporting martians

Running Shorewall v5.0.14.1 on Fedora Server 4.8.15-200.fc24.x86_64 configured with two interfaces (br0 and team0). Interface br0 connects to Internet while the team0 interface connects wireless ...
0
votes
1answer
320 views

How to correctly set up routing on machine with 4 interfaces so that three of interfaces are on the same subnet?

So I have a linux machine with 4 interfaces: enp1s0 enp2s0 enp3s0 enp4s0 What I would to do is have enp1s0 be the WAN interface and acquire its ip address, dns and gateway via DHCP. For the other ...
0
votes
1answer
87 views

Installing Shorewall on Debian stable

I'm going to install Shorewall on a Debian stable Linux box. The shorewall version in the stable repositories is 4.6.4.3-2. Shorewall website suggests to pin apt preferences and force the download of ...
0
votes
1answer
33 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
0
votes
0answers
84 views

How do I get default LXC iptable rules into Shorewall?

I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers. If I reboot the LXC host and leaves ...
1
vote
0answers
76 views

How to ensure via shorewall that the network is closed at boot time?

I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables rules are applied the network is in a closed state. There provision for ...
1
vote
1answer
45 views

Is there provision for incremental configuration in shorewall?

I did not find any provision for incremental configuration in Shorewall. Is there such a mechanism? What I am looking for is the ability to add configuration files (for rules for instance) in a (...
4
votes
1answer
529 views

Shorewall blocks openvpn traffic

I have one root server and two clients. The root server has a static ip address and runs Debian Linux. My clients are Mac OS X and Debian Linux with dynamic ip addresses. From my clients I can open a ...
2
votes
1answer
415 views

Shorewall: VPN clients can access LAN resources, but not the Internet

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources. Router port-forwards 1194 port to RPi, so it's accessible from the ...
1
vote
0answers
147 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
0
votes
1answer
204 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
0
votes
1answer
498 views

DNAT in Shorewall not working for VPN

I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this: $ cat interfaces #ZONE ...
1
vote
1answer
838 views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (...
1
vote
1answer
60 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
0
votes
0answers
950 views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
0
votes
2answers
220 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
0
votes
1answer
303 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
1
vote
0answers
531 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
679 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
698 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
2
votes
1answer
5k views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
1
vote
0answers
1k views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
5
votes
2answers
4k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so far)....
16
votes
7answers
5k views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
-1
votes
1answer
2k views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
0
votes
2answers
495 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
1
vote
1answer
185 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
3
votes
1answer
2k views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
2
votes
1answer
8k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
2
votes
3answers
4k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
1
vote
0answers
464 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
0
votes
2answers
1k views

Shorewall blacklist not working

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as #ADDRESS/SUBNET ...
0
votes
1answer
76 views

Shorewall deny all assh access except one user

Hi all I have an ubuntu server with shorewall firewall. I want to deny all ssh access exxcept my user: "alessandro". How can I write this rule in shorewall? Thanks
0
votes
1answer
264 views

Expressing iptables rule as shorewall rule

I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
1
vote
2answers
177 views

multiple blacklist files shorewall

I have been blocking by ip with shorewall and the blacklist file. I have decided to block a few country entirely and the blacklist file is huge! So my question is this: Is it possible to have ...