Code: Select all
Requirements for this tutorial:
Linux 2.4 or 2.6 kernel:
this should be most everybody, Shorewall requires Netfilter,
which is only in 2.4 and later kernels. (see section 2 for configuration instructions)
Shorewall:
Duh! In portage as "shorewall". This tutorial is written
using the latest unmasked version, 2.0.7. I'll update this tutorial as neccessary
to fit with later versions as they become unmasked.
iptables:
In portage under "iptables". This tutorial is written using the latest unmasked version, 1.2.11-r3. See Section 3.
iproute2:
In portage as "iproute2". This tutorial is written using the latest unmasked version, 2.6.10.20050112-r1. See Section 3.
Breakdown of the Tutorial:
Section 1: Introduction: Linux security and the Shoreline Firewall Utility (Shorewall)
Section 2: Kernel Configuration
Section 3: Emerging Shorewall
Section 4: Configuring Shorewall
4.a: /etc/shorewall/interfaces
4.b: /etc/shorewall/policy
4.c: /etc/shorewall/rules
Section 5: Finalization and Testing
Section 6: Logging Shorewall MessagesSection 1: Introduction: Linux security and the Shoreline Firewall Utility (Shorewall)
One of the main reasons people switch to linux is "because it is more secure", however the truth is linux is only as secure as you make it. What I find amazing is the amount of people who neglect setting up a proper firewall, and without one your super secure linux box is just a big bullseye. So no more excuses, it's time to take the security of your system into your own hands, and set up an effective and useable personal firewall for your desktop. I call this a "tutorial" instead of a "how-to" because I try to give some explanation while guiding you through firewall set up. If you give a man a fish, he will eat for a day.....
As you may have guessed this tutorial is aimed at desktop users of linux who wan't to set up a personal firewall that works without much fuss. If that's what your looking for, read on, this is for you. If not, read on, you might learn something. Either that or you'll see a mistake or some way to improve on what I'm about to say, in that case I'd appreciate your input. Now, down to business. When it comes to a firewall utility that's simple to set up, easy to understand, and all powerful, I default to Shorewall. What is Shorewall you ask? Let's turn to the developers themselves:
What does that mean? It means that Shorewall provides you with a simplified way to configure the built-in packet filtering firewall capabilities of the linux kernel, making your linux box as secure as it's OS is cracked up to be. It is important to realize however that although firewall is a great first line of defense, it isn't a garuntee of security. Setting up a well configured firewall however will make you much more secure, and as you'll see it's very simple to do.Tom Eastep wrote:The Shoreline Firewall, more commonly known as Shorewall, is high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and with the help of the iptables utility, Shorewall configures Netfilter to match your requirements.
Section 2: Kernel Configuration
Before we begin, let's make sure that you've compiled your kernel with the built in packet filtering capabilities Shorewall is supposed to take advantage of. So, run:
Code: Select all
cd /usr/src/linux
make menuconfigCode: Select all
# For 2.6 kernels look under:
Device Drivers --->
Networking support --->
Networking options --->
[*] Network packet filtering (replaces ipchains) --->
IP: Netfilter Configuration --->
<*> Connection tracking (required for masq/NAT)
<*> IP Tables Support (required for filtering/masq/NAT)
# Include (<*> not <M>) all options and sub options under IP tables support
# For 2.4 kernels look under:
Networking options --->
[*] Network packet filtering (replaces ipchains)
IP: Netfilter Configuration --->
<*> Connection tracking (required for masq/NAT)
<*> IP Tables Support (required for filtering/masq/NAT)
# Include (<*> not <M>) all options and sub options under IP tables supportSection 3: Emerge Shorewall (Does this really need it's own section
)Once you've verified that your kernel is configured to use netfilter, then we can start with Shorewall itself. A wise man (Lao Tzu) once said "A journey of a thousand miles begins with one step" So, first step, emerge Shorewall (this will also emerge iptables and iproute2). Are you done yet? It's not that large of a compile...allright I'll give you a minute. Done? Good.
Section 4: Configuring Shorewall
Setting up a personal firewall in Shorewall comes down to three configuration files, that's it. There are more, however for this tutorial there are only three you need to be concerned with and all are contained within /etc/shorewall: /etc/shorewall/interfaces, /etc/shorewall/policy, and /etc/shorewall/rules.
A central concept to the configuration of Shorewall is the zone. A zone is an abstract group of computers that you can easially assign traffic rules to. For this tutorial, the only zone we will concern ourselves with is the net zone, which consists of every computer but you
. The net zone contains both possible legitimate and illegitimate connections, so we must find a way to strike a balance between protection and useablity when it comes to the policies and rules we create for it. However, before we create any rules for this zone, we must first define it. 4.a: /etc/shorewall/interfaces
This is where /etc/shorewall/interfaces comes in. This part is very simple, so I won't give to much explanation outside of the relevant portion of the file itself. The first portion of all the configuration files is a commented section explaining the use of the file in detail, so please, read it. The last portion is the "business end" of the config file. In this case, we assume that the computer is connected to the internet on the interface eth0. The various options listed are explained further in the file itself, so add any options to your file that apply to your particular configuration. For most people, simply adding the zone and interface will suffice.
Code: Select all
##############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
#
net eth0 detect dhcp,nosmurfs
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
4.b: /etc/shorewall/policy
Now that we've defined the net zone, we have to create some sort of overall policy telling shorwall how to handle traffic to and from your computer (designated by fw in the remaining config files) and the net zone. This is done in /etc/shorewall/policy. Basically, if you are using your computer as a desktop, you probably won't need to concern yourself with new connections to your computer from the internet. So our first overall policy rule is to drop all new incoming connections from the internet. The reason why we want to drop connections rather than simply reject them is simple. If a connection is rejected, the connection is blocked, however a packet is sent back to the requesting computer. This packet contains information which a hacker can use against you, and most importantly it let's them know you exist. So why give them that edge? Dropping packets as opposed to rejecting them makes you practically invisible to anyone who is scanning the internet looking for targets, which makes you a good measure safer. Finally, we make a catchall policy, and tell Shorewall to reject all traffic from all sources, that is to block all traffic from the internet to your computer and visa versa
(this sounds stupid but just bear with me). Here is how your /etc/shorewall/policy file should end up looking.
Code: Select all
###############################################################################
#SOURCE DEST POLICY LOG LIMIT:BURST
# LEVEL
net all DROP info
#
# THE FOLLOWING POLICY MUST BE LAST
#
all all REJECT info
#LAST LINE -- DO NOT REMOVE
" If this is running through your mind, you are correct. If we stopped right now, your computer would be absolutely useless, however creating this general policy is a good idea. What we are in effect saying by creating this policy is we are only going to allow traffic to and from this computer that we specify. The reason for resticting traffic from your computer as well is to prevent trojans from connecting out and compromising your security. 4.c: /etc/shorewall/rules
As I said in the beginning of this tutorial, we have to find some middle ground between security and useablity. We've taken care of the security part, in fact your computer is so secure it is impractical. Now we need to add some useablity. We do this in /etc/shorewall/rules. As I said before, the only traffic you will probably need to allow are connections from your computer (fw) to specific ports of computers on the internet (net). This example file contains some common entries that you may want to add to your /etc/shorwall/rules file. For more rules examples, check out this page on the Shorewall site. Here is an example /etc/shorewall/rules.
Code: Select all
####################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/
# PORT PORT(S) DEST LIMIT GROUP
ACCEPT fw net tcp 80 #http
ACCEPT fw net udp 80 #http
ACCEPT fw net tcp 443 #https
ACCEPT fw net udp 443 #https
ACCEPT fw net tcp 21 #ftp
ACCEPT fw net tcp 53 #DNS
ACCEPT fw net udp 53 #DNS
ACCEPT fw net tcp 110 #unsecure Pop3
ACCEPT fw net tcp 995 #Secure Pop3
ACCEPT fw net tcp 873 #rsync
ACCEPT fw net tcp 25 #unsecure SMTP
ACCEPT fw net tcp 465 #SMTP over SSL
ACCEPT fw net tcp 5190 #AIM/ICQ
DROP net fw tcp 113 #AUTH/IDENT, I added this to show how to block a port
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
Section 5: Finalization/Testing
Now run rc-update add shorewall default && /etc/init.d/shorewall start, and your done!
Wasn't that simple. In fact, it's so simple you probably can't belive you have a firewall running. Don't trust me eh? So test out your new firewall. Here is a great computer security webpage. It's aimed more at windows slaves, I mean users , but it never the less contains some great information. It also has a feature called "Shields Up" (the link is about halfway down the main page), that allows you to portscan your computer and test your firewall. If it shows a port is closed and not stealthed (i.e. packets are being rejected not dropped), just add a line like the last one in the example /etc/shorewall/rules file to nip it in the bum. I hope this tutorial helps somebody, and I'd be happy to hear any feedback or constuctive comments ("Your tutorial sucks!!! " is not a constructive comment )Section 6: Stopping and Starting Shorewall
One thing that people are often confused about when it comes to shorewall, is that issuing the command shorewall stop or /etc/shorewall/stop doesn't really "stop" shorewall. When you stop shorewall with the stop command, the box locks down, blocking all incoming connections. If you want to enable two way connections to another machine on the network when shorewall is stopped, you need to add the interface it connects to the firewall on as well as its IP to /etc/shorewall/routestopped. If you really want to "stop" shorewall, that is to get netfilter to ACCEPT all incoming packets, you need to issue the clear command, with either /etc/init.d/shorewall clear or shorewall clear.
Section 7: Logging Shorewall Messages
This last part is for users of syslog-ng who want to log Shorewall messages to a seperate log file (you can also run shorewall logwatch to look at the latest shorewall messages). Just add these lines to /etc/syslog-ng/syslog-ng.conf:
Code: Select all
## You shouldn't need to add this line,
## it's probably already there, however
## I include it because the last line references it.
source src { unix-stream("/dev/log"); internal(); pipe ("/proc/kmsg"); };
## You do need to add these lines though
destination d_shorewall{ file ("/var/log/shorewall/shorewall.log"); };
filter f_shorewall { match ("Shorewall"); };
## If you don't want shorewall messages logged to
## /var/log/messages anymore add this filter as well
filter f_not_shorewall { not match ("Shorewall"); };
## Then add this to log messages to your shorewall log
log { source(src); filter (f_shorewall); destination (d_shorewall); };
## If you don't want shorewall messages logged to
## any other destination, such as /var/log/messages
## just use the f_not_shorewall filter like so
log { source(src); filter (f_not_shorewall);destination(messages); };03-26-05: Added kernel configuration section, minor grammatical edits.
03-28-05: Added section headings. It's a short how-to but what the hay.
03-31-05: Fixed the kernel configuration section for 2.4 kernels
04-10-05: Removed norfc1918 from sample /etc/shorewall/interfaces file.
04-10-05: Moved Section 6 to Section 7, added Section 6: Stopping and Starting Shorewall.
04-26-05: Modified kernel configuration section for completeness. Modified the syslog-ng logging section.
).
