Questions tagged [shorewall]
high-level tool for configuring the Linux Netfilter packet filter
94
questions
1
vote
1
answer
388
views
OpenVPN client fails to re-connect after internet connection re-established
I'm running miniPC with Debian and shorewall on it + and OpenVPN client. All is running smoothly unless my isp modem loses connection. After the connection to the internet is re-established, the ...
- 11
0
votes
1
answer
195
views
Shorewall: IPSet from blrules not applying
We're hoping to make use of IPSet to manage temporary IP blocking from sources (CSF+LFD, fail2ban, wherever relevant). The purpose would be that routers using Shorewall at the edges would make use of ...
- 153
-1
votes
1
answer
243
views
bind9 not resolving intranetlinks
As a follow up to a question I've asked earlier: Linux server migration to Windows workstation. A supplier got us a new network-card yesterday, but no harddrives so far. I've also bit the bullet on ...
- 101
0
votes
1
answer
328
views
Configuring shorewall's masq file for a three-interface firewall connected to a router with a single static IP address
I am trying to follow the guide for setting up a "three-Interface Firewall" running Shorewall version 5.0.4. (https://shorewall.org/three-interface.htm). I also have a Procurve switch that ...
- 13
2
votes
0
answers
588
views
Kubernetes and iptables not mixing: connection content dropped?
I'm playing around with a bare-metal Kubernetes cluster (using the calico CNI plugin) and having troubles redirecting external traffic into the node. I've set up the nginx kubernetes ingress ...
- 163
0
votes
0
answers
152
views
Shorewall - One external IP for two hosts with nginx and keepalived
I'm following this tutorial to setup keepalived: https://www.redhat.com/sysadmin/keepalived-basics
It requires two hosts to share one external IP, where the second host is the failover.
I'm unsure how ...
0
votes
1
answer
488
views
How to uninstall shorewall completely from Ubuntu
I noticed on my some servers shorewall service is installed but it's not running.I want to uninstall it.
I executed the command sudo systemctl status shorewall to check status of shorewall and got the ...
1
vote
0
answers
230
views
Diagnosing / monitoring HTB or HFSC traffic shaping
I have set up a central Linux router with Shorewall script for a small company that have a HQ and several other offices. They're connected via OpenVPN.
All is well, except that I want to fine tune ...
- 11
0
votes
0
answers
132
views
virtmanager: install via debian netinstall, reboot find not boot device, recovery mode can access
I used the virtmanager to create a virtual machine. The install medium is the debian netinstaller (Version 10, buster). Installation works without problems. Rebooting fails: no boot device found ...
- 1
1
vote
1
answer
621
views
Shorewall - Allow Remote Client to Ping the Internet
My network address is 192.168.5.0. My host machine is 192.168.5.1 and my client machine is 192.168.5.2. Currently, my client is unable to use the internet browser and even ping the internet. The ...
- 81
1
vote
0
answers
95
views
Shorewall masquerade on dynamic interface
I have a list of interfaces to which I want to masquerade traffic to. The problem is only one of them is active at once. They all match the regex vlan14[0-9][0-9]. How can I get shorewall to ...
- 538
0
votes
1
answer
222
views
in shorewall, how can I block requests from external hosts when using nested zones?
I have one Debian server with one network interface, I've configured a bridge for KVM and shorewall with two zones in the same interface
so I have the "net" zone and the "kvm" for kvm guests, here is ...
- 425
0
votes
0
answers
561
views
Shorewall blocking outbound traffic to one IP on a vpn tunnel
I'm trying to set up shorewall to block traffic to one particular IP address that is routed over an openvpn tunnel.
Naively I have the following shorewall rules in place
#Don't allow connection ...
- 452
0
votes
1
answer
359
views
Shorewall - Wildcard filter by source MAC address
I currently have a Debian PC with two network interfaces acting as a router/gateway.
I have several cheap IP cameras that try to access external services, presumably for some kind of 'cloud' ...
- 103
2
votes
3
answers
1k
views
Shorewall with docker
I'm trying to enable docker support in shorewall (version 5.1.3.2). I've followed guide http://shorewall.org/Docker.html .
However when I try to start shorewall I get the following error:
* Starting ...
- 121
2
votes
4
answers
922
views
How to block specific websites in a small office without hardware firewall? [closed]
We have a small office setup of less than 100 people.
We have 2 ISP connection which come into Load Balancer and from there to Linux Firewall i.e. Shorewall. Now from Shorewall its goes to Switches ...
- 161
1
vote
0
answers
47
views
Shorewall multiple outgoing IPs allocation
I have perfectly working VPN server with Shorewall installed. I got more IPs for the main eth0 interface so the server accepts the VPN connection from any of x.x.x.x/25 public IPs. But, the issue is ...
0
votes
1
answer
1k
views
OpenVPN tunnel up but no traffic from LAN to VPN
The HeadOffice subnet is 192.168.2.0/24. OpenVPN server & shorewall on same box - acting as a gateway
AWS subnet is 10.9.1.0/24. Openvpn Client configured for VPN access
Tunnel is up and I can ...
- 101
1
vote
1
answer
794
views
Shorewall blocks openvpn traffic?
I have a debian installation with shorewall, openvpn and google authenticator. I can get an vpn connection - but i cannot get any traffic through to local Lan or to internet - what am I missing here:
...
- 21
1
vote
0
answers
656
views
Shorewall reporting martians
Running Shorewall v5.0.14.1 on Fedora Server 4.8.15-200.fc24.x86_64 configured with two interfaces (br0 and team0). Interface br0 connects to Internet while the team0 interface connects wireless ...
- 11
0
votes
1
answer
1k
views
How to correctly set up routing on machine with 4 interfaces so that three of interfaces are on the same subnet?
So I have a linux machine with 4 interfaces:
enp1s0
enp2s0
enp3s0
enp4s0
What I would to do is have enp1s0 be the WAN interface and acquire its ip address, dns and gateway via DHCP.
For the other ...
- 103
0
votes
1
answer
129
views
Installing Shorewall on Debian stable
I'm going to install Shorewall on a Debian stable Linux box. The shorewall version in the stable repositories is 4.6.4.3-2.
Shorewall website suggests to pin apt preferences and force the download of ...
- 83
0
votes
1
answer
39
views
Why is my ISP box talking to my DMZ host?
I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following
Internet - PublicIP - ...
- 3,617
0
votes
0
answers
179
views
How do I get default LXC iptable rules into Shorewall?
I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers.
If I reboot the LXC host and leaves ...
- 1,576
1
vote
0
answers
96
views
How to ensure via shorewall that the network is closed at boot time?
I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables rules are applied the network is in a closed state.
There provision for ...
- 3,617
1
vote
1
answer
102
views
Is there provision for incremental configuration in shorewall?
I did not find any provision for incremental configuration in Shorewall. Is there such a mechanism?
What I am looking for is the ability to add configuration files (for rules for instance) in a (...
- 3,617
3
votes
1
answer
745
views
Shorewall blocks openvpn traffic
I have one root server and two clients. The root server has a static ip address and runs Debian Linux. My clients are Mac OS X and Debian Linux with dynamic ip addresses.
From my clients I can open a ...
- 133
2
votes
1
answer
654
views
Shorewall: VPN clients can access LAN resources, but not the Internet
I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources.
Router port-forwards 1194 port to RPi, so it's accessible from the ...
- 31
1
vote
0
answers
203
views
Selinux: Shorewall will not respond to fail2ban
I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message:
SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
- 111
0
votes
1
answer
349
views
Shorewall: Block repeatedly failling ips on port 22
I am on Fedora 21, and port 22 is open for ssh connections.
I am using key-based authentication with password and root logins disabled.
My logs are flooded with messages like the ones appended at ...
- 111
0
votes
1
answer
913
views
DNAT in Shorewall not working for VPN
I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this:
$ cat interfaces
#ZONE ...
- 302
1
vote
1
answer
1k
views
Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy
Summary
I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (...
- 157
1
vote
1
answer
91
views
ec2 instance timed out
So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
- 133
0
votes
0
answers
1k
views
Routing Traffic to Subnet through OpenVPN Client Tunnel
I have a Shorewall powered masquerading router:
eth0: DHCP client, external interface (net zone)
eth1: static, internal interface (loc zone)
Now I want to add an OpenVPN client that creates a TUN ...
- 261
0
votes
2
answers
330
views
If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?
Let's say I have a policy file, such as
fw net ACCEPT
net fw DROP
trusted fw ACCEPT
trusted net ACCEPT
untrusted fw DROP*
untrusted net ACCEPT
all ...
- 3,197
0
votes
1
answer
504
views
HAProxy fails to connect when Shorewall firewall is enabled on web servers
I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers.
As soon as I do, error messages ...
- 1
1
vote
0
answers
689
views
shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables
I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work.
When I start shorewall, I get this messages ...
- 23
1
vote
0
answers
900
views
Shorewall: DNAT to IPSEC tunnel zone not routing correctly
I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem:
# from fw and lan hosts:
# ping 192.168.4.44
PING ...
- 425
1
vote
0
answers
1k
views
Firewall rejecting UDP "connections"?
I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
- 3,661
3
votes
1
answer
7k
views
Configuring Shorewall for routed OpenVPN
I have an Ubuntu server 14.04 machine that serves as a NAT router.
The routing is achieved using Shorewall, mostly in line with this tutorial.
The LAN has the subnet 10.0.0.0/24
On this machine I ...
- 261
1
vote
0
answers
2k
views
Shorewall redirect rule only working for some hosts in the same network
I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
- 3,661
5
votes
2
answers
5k
views
Shorewall: logging to custom file
I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so far)....
- 261
17
votes
7
answers
8k
views
Docker & Shorewall
I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well.
By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
- 283
-1
votes
1
answer
2k
views
Shorewall forward 443 port to two servers [closed]
I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
- 968
0
votes
2
answers
712
views
Can I use iptables, Shorewall and ipset on the same time?
I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall.
Is it ...
- 464
1
vote
1
answer
276
views
How to send packets coming from a second router on a particular port back to the router, using iptables not a route
I have a Linux server which runs a particular service listening on a single TCP port.
The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
- 161
3
votes
1
answer
2k
views
How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?
I'm researching privacy-compliant high-security deployment options for AWS VPC.
I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
- 31
2
votes
1
answer
8k
views
How do I configure routing for an IPSEC tunnel between Openswan and RouterOS
I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
- 427
2
votes
3
answers
5k
views
Can't resolve issue: iptables: No chain/target/match by that name
So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error.
iptables: No chain/target/match by that name.
ERROR: ...
- 31
1
vote
0
answers
541
views
Send traffic over a specific port through a specific interface, using Shorewall
I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface.
...
- 56