Questions tagged [shorewall]

high-level tool for configuring the Linux Netfilter packet filter

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

Shorewall: IPSet from blrules not applying

We're hoping to make use of IPSet to manage temporary IP blocking from sources (CSF+LFD, fail2ban, wherever relevant). The purpose would be that routers using Shorewall at the edges would make use of ...
user avatar
  • 154
0 votes
0 answers
24 views

Debian Server crashes on Shorewall restart. OOM messages in kern.log

I have been adding rules and restarting shorewall for a couple years now on this box (3.16.0-0.bpo.4-amd64 #1 SMP Debian 3.16.39-1+deb8u1~bpo70+1). Shorewall version 4.5.5.3 iptables v1.4.14 Mem: ...
user avatar
  • 1
-1 votes
1 answer
48 views

bind9 not resolving intranetlinks

As a follow up to a question I've asked earlier: Linux server migration to Windows workstation. A supplier got us a new network-card yesterday, but no harddrives so far. I've also bit the bullet on ...
user avatar
0 votes
1 answer
130 views

Configuring shorewall's masq file for a three-interface firewall connected to a router with a single static IP address

I am trying to follow the guide for setting up a "three-Interface Firewall" running Shorewall version 5.0.4. (https://shorewall.org/three-interface.htm). I also have a Procurve switch that ...
user avatar
2 votes
0 answers
181 views

Kubernetes and iptables not mixing: connection content dropped?

I'm playing around with a bare-metal Kubernetes cluster (using the calico CNI plugin) and having troubles redirecting external traffic into the node. I've set up the nginx kubernetes ingress ...
user avatar
  • 163
0 votes
0 answers
93 views

Shorewall - One external IP for two hosts with nginx and keepalived

I'm following this tutorial to setup keepalived: https://www.redhat.com/sysadmin/keepalived-basics It requires two hosts to share one external IP, where the second host is the failover. I'm unsure how ...
user avatar
0 votes
1 answer
281 views

How to uninstall shorewall completely from Ubuntu

I noticed on my some servers shorewall service is installed but it's not running.I want to uninstall it. I executed the command sudo systemctl status shorewall to check status of shorewall and got the ...
user avatar
1 vote
0 answers
156 views

Diagnosing / monitoring HTB or HFSC traffic shaping

I have set up a central Linux router with Shorewall script for a small company that have a HQ and several other offices. They're connected via OpenVPN. All is well, except that I want to fine tune ...
user avatar
0 votes
0 answers
77 views

virtmanager: install via debian netinstall, reboot find not boot device, recovery mode can access

I used the virtmanager to create a virtual machine. The install medium is the debian netinstaller (Version 10, buster). Installation works without problems. Rebooting fails: no boot device found ...
user avatar
0 votes
1 answer
329 views

Shorewall - Allow Remote Client to Ping the Internet

My network address is 192.168.5.0. My host machine is 192.168.5.1 and my client machine is 192.168.5.2. Currently, my client is unable to use the internet browser and even ping the internet. The ...
user avatar
1 vote
0 answers
84 views

Shorewall masquerade on dynamic interface

I have a list of interfaces to which I want to masquerade traffic to. The problem is only one of them is active at once. They all match the regex vlan14[0-9][0-9]. How can I get shorewall to ...
user avatar
0 votes
1 answer
166 views

in shorewall, how can I block requests from external hosts when using nested zones?

I have one Debian server with one network interface, I've configured a bridge for KVM and shorewall with two zones in the same interface so I have the "net" zone and the "kvm" for kvm guests, here is ...
user avatar
  • 425
0 votes
0 answers
450 views

Shorewall blocking outbound traffic to one IP on a vpn tunnel

I'm trying to set up shorewall to block traffic to one particular IP address that is routed over an openvpn tunnel. Naively I have the following shorewall rules in place #Don't allow connection ...
user avatar
0 votes
1 answer
268 views

Shorewall - Wildcard filter by source MAC address

I currently have a Debian PC with two network interfaces acting as a router/gateway. I have several cheap IP cameras that try to access external services, presumably for some kind of 'cloud' ...
user avatar
2 votes
3 answers
1k views

Shorewall with docker

I'm trying to enable docker support in shorewall (version 5.1.3.2). I've followed guide http://shorewall.org/Docker.html . However when I try to start shorewall I get the following error: * Starting ...
user avatar
  • 121
2 votes
4 answers
851 views

How to block specific websites in a small office without hardware firewall? [closed]

We have a small office setup of less than 100 people. We have 2 ISP connection which come into Load Balancer and from there to Linux Firewall i.e. Shorewall. Now from Shorewall its goes to Switches ...
user avatar
  • 161
1 vote
0 answers
40 views

Shorewall multiple outgoing IPs allocation

I have perfectly working VPN server with Shorewall installed. I got more IPs for the main eth0 interface so the server accepts the VPN connection from any of x.x.x.x/25 public IPs. But, the issue is ...
user avatar
0 votes
1 answer
1k views

OpenVPN tunnel up but no traffic from LAN to VPN

The HeadOffice subnet is 192.168.2.0/24. OpenVPN server & shorewall on same box - acting as a gateway AWS subnet is 10.9.1.0/24. Openvpn Client configured for VPN access Tunnel is up and I can ...
user avatar
1 vote
1 answer
695 views

Shorewall blocks openvpn traffic?

I have a debian installation with shorewall, openvpn and google authenticator. I can get an vpn connection - but i cannot get any traffic through to local Lan or to internet - what am I missing here: ...
user avatar
1 vote
0 answers
591 views

Shorewall reporting martians

Running Shorewall v5.0.14.1 on Fedora Server 4.8.15-200.fc24.x86_64 configured with two interfaces (br0 and team0). Interface br0 connects to Internet while the team0 interface connects wireless ...
user avatar
  • 11
0 votes
1 answer
842 views

How to correctly set up routing on machine with 4 interfaces so that three of interfaces are on the same subnet?

So I have a linux machine with 4 interfaces: enp1s0 enp2s0 enp3s0 enp4s0 What I would to do is have enp1s0 be the WAN interface and acquire its ip address, dns and gateway via DHCP. For the other ...
user avatar
0 votes
1 answer
115 views

Installing Shorewall on Debian stable

I'm going to install Shorewall on a Debian stable Linux box. The shorewall version in the stable repositories is 4.6.4.3-2. Shorewall website suggests to pin apt preferences and force the download of ...
user avatar
  • 83
0 votes
1 answer
38 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
user avatar
  • 3,327
0 votes
0 answers
159 views

How do I get default LXC iptable rules into Shorewall?

I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers. If I reboot the LXC host and leaves ...
user avatar
  • 1,436
1 vote
0 answers
89 views

How to ensure via shorewall that the network is closed at boot time?

I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables rules are applied the network is in a closed state. There provision for ...
user avatar
  • 3,327
1 vote
1 answer
90 views

Is there provision for incremental configuration in shorewall?

I did not find any provision for incremental configuration in Shorewall. Is there such a mechanism? What I am looking for is the ability to add configuration files (for rules for instance) in a (...
user avatar
  • 3,327
3 votes
1 answer
710 views

Shorewall blocks openvpn traffic

I have one root server and two clients. The root server has a static ip address and runs Debian Linux. My clients are Mac OS X and Debian Linux with dynamic ip addresses. From my clients I can open a ...
user avatar
2 votes
1 answer
597 views

Shorewall: VPN clients can access LAN resources, but not the Internet

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources. Router port-forwards 1194 port to RPi, so it's accessible from the ...
user avatar
  • 31
1 vote
0 answers
185 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
user avatar
  • 111
0 votes
1 answer
322 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
user avatar
  • 111
0 votes
1 answer
824 views

DNAT in Shorewall not working for VPN

I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this: $ cat interfaces #ZONE ...
user avatar
  • 282
1 vote
1 answer
1k views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (...
user avatar
1 vote
1 answer
71 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
user avatar
0 votes
0 answers
1k views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
user avatar
  • 251
0 votes
2 answers
311 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
user avatar
  • 3,087
0 votes
1 answer
425 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
user avatar
  • 1
1 vote
0 answers
665 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
user avatar
1 vote
0 answers
852 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
user avatar
  • 425
1 vote
0 answers
938 views

Firewall rejecting UDP "connections"?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
user avatar
  • 3,591
3 votes
1 answer
7k views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
user avatar
  • 251
1 vote
0 answers
2k views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
user avatar
  • 3,591
5 votes
2 answers
5k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so far)....
user avatar
  • 251
17 votes
7 answers
7k views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
user avatar
  • 283
-1 votes
1 answer
2k views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
user avatar
  • 1,096
0 votes
2 answers
634 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
user avatar
1 vote
1 answer
197 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
user avatar
  • 161
3 votes
1 answer
2k views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
user avatar
2 votes
1 answer
8k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
user avatar
  • 397
2 votes
3 answers
4k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
user avatar
1 vote
0 answers
525 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
user avatar
  • 56