From 38c04d1758dd98d407d0e3a166f7ded49d37a26f Mon Sep 17 00:00:00 2001 From: Jessica Frazelle Date: Tue, 28 Jul 2015 02:47:30 -0700 Subject: [PATCH] updates to shorewall conf Signed-off-by: Jessica Frazelle --- shorewall/Dockerfile | 8 +- shorewall/etc/interfaces | 15 ++ shorewall/etc/masq | 13 ++ shorewall/etc/policy | 17 +++ shorewall/etc/rules | 22 +++ shorewall/etc/shorewall.conf | 282 +++++++++++++++++++++++++++++++++++ shorewall/etc/zones | 14 ++ 7 files changed, 369 insertions(+), 2 deletions(-) create mode 100644 shorewall/etc/interfaces create mode 100644 shorewall/etc/masq create mode 100644 shorewall/etc/policy create mode 100644 shorewall/etc/rules create mode 100644 shorewall/etc/shorewall.conf create mode 100644 shorewall/etc/zones diff --git a/shorewall/Dockerfile b/shorewall/Dockerfile index 689a328..eb7d3ca 100644 --- a/shorewall/Dockerfile +++ b/shorewall/Dockerfile @@ -3,6 +3,7 @@ # docker run --rm -it \ # --net host \ # --cap-add NET_ADMIN \ +# --privileged \ # jess/shorewall # FROM alpine:latest @@ -10,6 +11,9 @@ MAINTAINER Jessica Frazelle RUN apk update && apk add \ shorewall \ - && rm -rf /var/cache/apk/* + && rm -rf /var/cache/apk/* \ + && touch /var/log/messages -CMD [ "shorewall" ] +COPY ./etc /etc/shorewall + +ENTRYPOINT [ "/usr/sbin/shorewall" ] diff --git a/shorewall/etc/interfaces b/shorewall/etc/interfaces new file mode 100644 index 0000000..b9994bf --- /dev/null +++ b/shorewall/etc/interfaces @@ -0,0 +1,15 @@ +# +# Shorewall version 4 - Interfaces File +# +# For information about entries in this file, type "man shorewall-interfaces" +# +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-interfaces.html +# +############################################################################### +?FORMAT 2 +############################################################################### +#ZONE INTERFACE OPTIONS +- lo ignore +dock docker0 +net all dhcp,physical=+,routeback diff --git a/shorewall/etc/masq b/shorewall/etc/masq new file mode 100644 index 0000000..dc73582 --- /dev/null +++ b/shorewall/etc/masq @@ -0,0 +1,13 @@ +# +# Shorewall version 4 - Masq file +# +# For information about entries in this file, type "man shorewall-masq" +# +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-masq.html +# +################################################################################################################ +#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL +# GROUP DEST +#eth0 172.17.0.0/16 +#wlan0 172.17.42.1/24 diff --git a/shorewall/etc/policy b/shorewall/etc/policy new file mode 100644 index 0000000..861cb97 --- /dev/null +++ b/shorewall/etc/policy @@ -0,0 +1,17 @@ +# +# Shorewall version 4 - Policy File +# +# For information about entries in this file, type "man shorewall-policy" +# +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-policy.html +# +############################################################################### +#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT: +# LEVEL BURST MASK +dock all ACCEPT +# on a server you would obviously want to accept +net dock DROP +net all DROP +fw net ACCEPT +fw dock ACCEPT diff --git a/shorewall/etc/rules b/shorewall/etc/rules new file mode 100644 index 0000000..e304808 --- /dev/null +++ b/shorewall/etc/rules @@ -0,0 +1,22 @@ +# +# Shorewall version 4 - Rules File +# +# For information on the settings in this file, type "man shorewall-rules" +# +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-rules.html +# +###################################################################################################################################################################################################### +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER +# PORT PORT(S)DEST LIMIT GROUP +?SECTION ALL +?SECTION ESTABLISHED +?SECTION RELATED +?SECTION INVALID +?SECTION UNTRACKED +?SECTION NEW +Invalid(DROP) net $FW tcp +# on a server you would obiously want to accept here +SSH(DROP) net $FW +# on a server you would obviously want to accept here +Ping(DROP) net $FW diff --git a/shorewall/etc/shorewall.conf b/shorewall/etc/shorewall.conf new file mode 100644 index 0000000..c01049e --- /dev/null +++ b/shorewall/etc/shorewall.conf @@ -0,0 +1,282 @@ +############################################################################### +# +# Shorewall Version 4.4 -- /etc/shorewall/shorewall.conf +# +# For information about the settings in this file, type "man shorewall.conf" +# +# Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# L O G G I N G +############################################################################### + +BLACKLIST_LOG_LEVEL= + +INVALID_LOG_LEVEL= + +LOG_BACKEND= + +LOG_MARTIANS=Yes + +LOG_VERBOSITY=2 + +LOGALLNEW= + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGLIMIT= + +MACLIST_LOG_LEVEL=info + +RELATED_LOG_LEVEL= + +RPFILTER_LOG_LEVEL=info + +SFILTER_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +STARTUP_LOG=/var/log/shorewall-init.log + +TCP_FLAGS_LOG_LEVEL=info + +UNTRACKED_LOG_LEVEL= + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +ARPTABLES= + +CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall + +GEOIPDIR=/usr/share/xt_geoip/LE + +IPTABLES= + +IP= + +IPSET= + +LOCKFILE= + +MODULESDIR= + +NFACCT= + +PERL=/usr/bin/perl + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +RESTOREFILE=restore + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK= + +TC= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +ACCEPT_DEFAULT="none" +DROP_DEFAULT="Drop" +NFQUEUE_DEFAULT="none" +QUEUE_DEFAULT="none" +REJECT_DEFAULT="Reject" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' +RSH_COMMAND='ssh ${root}@${system} ${command}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +ACCOUNTING=Yes + +ACCOUNTING_TABLE=filter + +ADD_IP_ALIASES=No + +ADD_SNAT_ALIASES=No + +ADMINISABSENTMINDED=Yes + +BASIC_FILTERS=No + +IGNOREUNKNOWNVARIABLES=No + +AUTOCOMMENT=Yes + +AUTOHELPERS=Yes + +AUTOMAKE=No + +BLACKLIST="NEW,INVALID,UNTRACKED" + +CHAIN_SCRIPTS=No + +CLAMPMSS=No + +CLEAR_TC=Yes + +COMPLETE=Yes + +DEFER_DNS_RESOLUTION=Yes + +DISABLE_IPV6=No + +DELETE_THEN_ADD=Yes + +DETECT_DNAT_IPADDRS=No + +DONT_LOAD= + +DYNAMIC_BLACKLIST=Yes + +EXPAND_POLICIES=Yes + +EXPORTMODULES=Yes + +FASTACCEPT=Yes + +FORWARD_CLEAR_MARK= + +HELPERS= + +IMPLICIT_CONTINUE=No + +INLINE_MATCHES=Yes + +IPSET_WARNINGS=Yes + +IP_FORWARDING=On + +KEEP_RT_TABLES=No + +LOAD_HELPERS_ONLY=Yes + +LEGACY_FASTSTART=No + +MACLIST_TABLE=filter + +MACLIST_TTL= + +MANGLE_ENABLED=Yes + +MAPOLDACTIONS=No + +MARK_IN_FORWARD_CHAIN=No + +MODULE_SUFFIX=ko + +MULTICAST=No + +MUTEX_TIMEOUT=60 + +NULL_ROUTE_RFC1918=No + +OPTIMIZE=All + +OPTIMIZE_ACCOUNTING=No + +REJECT_ACTION= + +REQUIRE_INTERFACE=Yes + +RESTORE_DEFAULT_ROUTE=Yes + +RESTORE_ROUTEMARKS=Yes + +RETAIN_ALIASES=No + +ROUTE_FILTER=No + +SAVE_ARPTABLES=No + +SAVE_IPSETS=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2" + +TRACK_PROVIDERS=Yes + +TRACK_RULES=No + +USE_DEFAULT_RT=Yes + +USE_PHYSICAL_NAMES=No + +USE_RT_NAMES=No + +WARNOLDCAPVERSION=Yes + +ZONE2ZONE=- + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +INVALID_DISPOSITION=CONTINUE + +MACLIST_DISPOSITION=REJECT + +RELATED_DISPOSITION=ACCEPT + +RPFILTER_DISPOSITION=DROP + +SMURF_DISPOSITION=DROP + +SFILTER_DISPOSITION=DROP + +TCP_FLAGS_DISPOSITION=DROP + +UNTRACKED_DISPOSITION=CONTINUE + +################################################################################ +# P A C K E T M A R K L A Y O U T +################################################################################ + +TC_BITS= + +PROVIDER_BITS= + +PROVIDER_OFFSET= + +MASK_BITS= + +ZONE_BITS=0 + +################################################################################ +# L E G A C Y O P T I O N +# D O N O T D E L E T E O R A L T E R +################################################################################ + +IPSECFILE=zones + +#LAST LINE -- DO NOT REMOVE diff --git a/shorewall/etc/zones b/shorewall/etc/zones new file mode 100644 index 0000000..473a8c3 --- /dev/null +++ b/shorewall/etc/zones @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Zones File +# +# For information about this file, type "man shorewall-zones" +# +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-zones.html +# +############################################################################### +#ZONE TYPE OPTIONS IN OUT +# OPTIONS OPTIONS +fw firewall +dock ipv4 +net ip