Questions tagged [shorewall]

high-level tool for configuring the Linux Netfilter packet filter

Filter by
Sorted by
Tagged with
1
vote
0answers
87 views

Diagnosing / monitoring HTB or HFSC traffic shaping

I have set up a central Linux router with Shorewall script for a small company that have a HQ and several other offices. They're connected via OpenVPN. All is well, except that I want to fine tune ...
0
votes
0answers
353 views

suricata ips mode configuration

I installed Suricata and Shorewall on device with 3 NIC and a wifi card, I wanted to configure Suricata as IPS. I followed several instructions both from the manual and from several blogs. I have ...
0
votes
0answers
25 views

SSH request is blocked by the firewall but it is logged correct and the request works inside the server

I use shorewall to forward the SSH port 10100 to VM:22. The ssh request on the gateway to VM works (standard port 22). From a client the ssh request doesn't work (timeout) The DNAT rule has the ...
0
votes
0answers
36 views

virtmanager: install via debian netinstall, reboot find not boot device, recovery mode can access

I used the virtmanager to create a virtual machine. The install medium is the debian netinstaller (Version 10, buster). Installation works without problems. Rebooting fails: no boot device found ...
0
votes
1answer
81 views

Shorewall - Allow Remote Client to Ping the Internet

My network address is 192.168.5.0. My host machine is 192.168.5.1 and my client machine is 192.168.5.2. Currently, my client is unable to use the internet browser and even ping the internet. The ...
1
vote
0answers
66 views

Shorewall masquerade on dynamic interface

I have a list of interfaces to which I want to masquerade traffic to. The problem is only one of them is active at once. They all match the regex vlan14[0-9][0-9]. How can I get shorewall to ...
0
votes
1answer
100 views

in shorewall, how can I block requests from external hosts when using nested zones?

I have one Debian server with one network interface, I've configured a bridge for KVM and shorewall with two zones in the same interface so I have the "net" zone and the "kvm" for kvm guests, here is ...
0
votes
0answers
271 views

Shorewall blocking outbound traffic to one IP on a vpn tunnel

I'm trying to set up shorewall to block traffic to one particular IP address that is routed over an openvpn tunnel. Naively I have the following shorewall rules in place #Don't allow connection ...
0
votes
1answer
182 views

Shorewall - Wildcard filter by source MAC address

I currently have a Debian PC with two network interfaces acting as a router/gateway. I have several cheap IP cameras that try to access external services, presumably for some kind of 'cloud' ...
2
votes
2answers
675 views

Shorewall with docker

I'm trying to enable docker support in shorewall (version 5.1.3.2). I've followed guide http://shorewall.org/Docker.html . However when I try to start shorewall I get the following error: * Starting ...
2
votes
4answers
611 views

How to block specific websites in a small office without hardware firewall? [closed]

We have a small office setup of less than 100 people. We have 2 ISP connection which come into Load Balancer and from there to Linux Firewall i.e. Shorewall. Now from Shorewall its goes to Switches ...
1
vote
0answers
31 views

Shorewall multiple outgoing IPs allocation

I have perfectly working VPN server with Shorewall installed. I got more IPs for the main eth0 interface so the server accepts the VPN connection from any of x.x.x.x/25 public IPs. But, the issue is ...
0
votes
1answer
616 views

OpenVPN tunnel up but no traffic from LAN to VPN

The HeadOffice subnet is 192.168.2.0/24. OpenVPN server & shorewall on same box - acting as a gateway AWS subnet is 10.9.1.0/24. Openvpn Client configured for VPN access Tunnel is up and I can ...
1
vote
1answer
512 views

Shorewall blocks openvpn traffic?

I have a debian installation with shorewall, openvpn and google authenticator. I can get an vpn connection - but i cannot get any traffic through to local Lan or to internet - what am I missing here: ...
1
vote
0answers
346 views

Shorewall reporting martians

Running Shorewall v5.0.14.1 on Fedora Server 4.8.15-200.fc24.x86_64 configured with two interfaces (br0 and team0). Interface br0 connects to Internet while the team0 interface connects wireless ...
0
votes
1answer
522 views

How to correctly set up routing on machine with 4 interfaces so that three of interfaces are on the same subnet?

So I have a linux machine with 4 interfaces: enp1s0 enp2s0 enp3s0 enp4s0 What I would to do is have enp1s0 be the WAN interface and acquire its ip address, dns and gateway via DHCP. For the other ...
0
votes
1answer
100 views

Installing Shorewall on Debian stable

I'm going to install Shorewall on a Debian stable Linux box. The shorewall version in the stable repositories is 4.6.4.3-2. Shorewall website suggests to pin apt preferences and force the download of ...
0
votes
1answer
34 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
0
votes
0answers
126 views

How do I get default LXC iptable rules into Shorewall?

I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers. If I reboot the LXC host and leaves ...
1
vote
0answers
83 views

How to ensure via shorewall that the network is closed at boot time?

I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables rules are applied the network is in a closed state. There provision for ...
1
vote
1answer
66 views

Is there provision for incremental configuration in shorewall?

I did not find any provision for incremental configuration in Shorewall. Is there such a mechanism? What I am looking for is the ability to add configuration files (for rules for instance) in a (...
3
votes
1answer
616 views

Shorewall blocks openvpn traffic

I have one root server and two clients. The root server has a static ip address and runs Debian Linux. My clients are Mac OS X and Debian Linux with dynamic ip addresses. From my clients I can open a ...
2
votes
1answer
509 views

Shorewall: VPN clients can access LAN resources, but not the Internet

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources. Router port-forwards 1194 port to RPi, so it's accessible from the ...
1
vote
0answers
169 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file /tmp/fai2ban*.[...
0
votes
1answer
232 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
0
votes
1answer
659 views

DNAT in Shorewall not working for VPN

I have a firewall (10.8.0.1) connected to an internal server (10.8.0.2) via VPN. On the firewall the VPN interface is called tun0. So in my shorewall configuration I have this: $ cat interfaces #ZONE ...
1
vote
1answer
938 views

Cannot Ping Devices Across Interfaces for Shorewall Single IP Three-interface Firewall on Debian Wheezy

Summary I am currently working on a three interface software firewall using Shorewall 4.5.5.3 on Debian Wheezy, and I'm having some difficulty with the loc (eth2) and dmz (eth1) interfaces. The fw (...
1
vote
1answer
65 views

ec2 instance timed out

So I was ssh'd into my running instance while trying to set up Postfix for mailing.. I was fallowing this tutorial: http://flurdy.com/docs/postfix/#ec2. I got to the Shorewall part and fallowed all ...
0
votes
0answers
1k views

Routing Traffic to Subnet through OpenVPN Client Tunnel

I have a Shorewall powered masquerading router: eth0: DHCP client, external interface (net zone) eth1: static, internal interface (loc zone) Now I want to add an OpenVPN client that creates a TUN ...
0
votes
2answers
257 views

If a packet matches a shorewall policy, can I log the packets (e.g. using tcpdump)?

Let's say I have a policy file, such as fw net ACCEPT net fw DROP trusted fw ACCEPT trusted net ACCEPT untrusted fw DROP* untrusted net ACCEPT all ...
0
votes
1answer
359 views

HAProxy fails to connect when Shorewall firewall is enabled on web servers

I have a fairly standard HAProxy / Web Cluster setup, which is running perfectly fine - as long as I don't enable the Shorewall firewall on the web cluster servers. As soon as I do, error messages ...
1
vote
0answers
610 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
776 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
842 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
2
votes
1answer
6k views

Configuring Shorewall for routed OpenVPN

I have an Ubuntu server 14.04 machine that serves as a NAT router. The routing is achieved using Shorewall, mostly in line with this tutorial. The LAN has the subnet 10.0.0.0/24 On this machine I ...
1
vote
0answers
2k views

Shorewall redirect rule only working for some hosts in the same network

I'm trying to use Shorewall's REDIRECT action to intercept traffic destined for the firewall's port 514 (TCP and UDP) to port 5000 (also TCP and UDP), while also allowing direct traffic to the latter ...
5
votes
2answers
5k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so far)....
17
votes
7answers
6k views

Docker & Shorewall

I'm using Shorewall on my server as simple standalone firewall and would like to use Docker as well. By using a Docker container and its port redirection docker sets up its own iptables rules/chains ...
-1
votes
1answer
2k views

Shorewall forward 443 port to two servers [closed]

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and ...
0
votes
2answers
558 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
1
vote
1answer
189 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
3
votes
1answer
2k views

How can I whitelist oubound-from-private-subnet traffic to S3 on the NAT instance of an EC2 VPC?

I'm researching privacy-compliant high-security deployment options for AWS VPC. I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how ...
2
votes
1answer
8k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
2
votes
3answers
4k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
1
vote
0answers
490 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
0
votes
3answers
1k views

Shorewall blacklist not working

We are getting dictionary attacks to our SQL server, So I wanted to block some of the IP's using shorewall blacklist. I mentioned the IP in /etc/shorewall/blacklist as #ADDRESS/SUBNET ...
0
votes
1answer
91 views

Shorewall deny all assh access except one user

Hi all I have an ubuntu server with shorewall firewall. I want to deny all ssh access exxcept my user: "alessandro". How can I write this rule in shorewall? Thanks
0
votes
1answer
367 views

Expressing iptables rule as shorewall rule

I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
1
vote
2answers
186 views

multiple blacklist files shorewall

I have been blocking by ip with shorewall and the blacklist file. I have decided to block a few country entirely and the blacklist file is huge! So my question is this: Is it possible to have ...
2
votes
2answers
3k views

Routing to secondary LAN with Shorewall

I'm setting up Shorewall (4.4.26.1), and have been trying to figure out routing between two LAN segments for the good part of the afternoon. It's time to ask for help. ((INTERNET)) | | [...