|
Size: 139
Comment:
|
Size: 1290
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 7: | Line 7: |
| == Shorewall settings === | The firewall setting plan and status are shown in the figure above. In an ideal setting, the NAT router on the firewall should filter the packets while allowing the necessary ports open (Figure left). At the 40m, currently, the half of nodus is exposed to the net and handling the web/elog/rsync requests, while other access to the intranet ("local") is blocked (Figure right). So nodus needs to have the function of the firewall. The command (and settings) iptables are supposed to handle this filtering of the packets by the ports. However, iptables configuration is complicated. A mistake in iptables may cause security issue or malfunction of the network which the cause could be tricky to track down. Therefore '''shorewall''' is introduced as the configration tool for iptables, which is simpler and user friendly. == Requirement == Block all the connection from net to local. The exceptions are: ssh, 8080 (http), 8081 (https), 30889 (apache), ping, and rsync. Block all the connection from local to net (via nodus). This is because the connection from local to outside should go through NAT router rather than nodus. Allow == Shorewall settings == |
Shorewall Setting on Nodus
Network Topology
The firewall setting plan and status are shown in the figure above. In an ideal setting, the NAT router on the firewall should filter the packets while allowing the necessary ports open (Figure left). At the 40m, currently, the half of nodus is exposed to the net and handling the web/elog/rsync requests, while other access to the intranet ("local") is blocked (Figure right). So nodus needs to have the function of the firewall.
The command (and settings) iptables are supposed to handle this filtering of the packets by the ports. However, iptables configuration is complicated. A mistake in iptables may cause security issue or malfunction of the network which the cause could be tricky to track down. Therefore shorewall is introduced as the configration tool for iptables, which is simpler and user friendly.
Requirement
Block all the connection from net to local. The exceptions are: ssh, 8080 (http), 8081 (https), 30889 (apache), ping, and rsync.
Block all the connection from local to net (via nodus). This is because the connection from local to outside should go through NAT router rather than nodus.
Allow