Shorewall Setting on Nodus

Network Topology

The firewall setting plan and status are shown in the figure above. In an ideal setting, the NAT router on the firewall should filter the packets while allowing the necessary ports open (Figure left). At the 40m, currently, the half of nodus is exposed to the net and handling the web/elog/rsync requests, while other access to the intranet ("local") is blocked (Figure right). So nodus needs to have the function of the firewall.

The command (and settings) iptables are supposed to handle this filtering of the packets by the ports. However, iptables configuration is complicated. A mistake in iptables may cause security issue or malfunction of the network which the cause could be tricky to track down. Therefore shorewall is introduced as the configration tool for iptables, which is simpler and user friendly.

Requirement

• Block all the connection from net to local. The exceptions are: ssh, 8080 (http), 8081 (https), 30889 (apache), ping, and rsync.
• Block all the connection from local to net (via nodus). This is because the connection from local to outside should go through NAT router rather than nodus.
• Allow fw (firewall) to net, fw to local, and local to fw.
• To expose NDS service on megatron to net, we want to allow net to access 31200 of nodus. This connection should be port forwarded to 31200 of megatron.

Shorewall settings

• Installation info of shorewall is in ~root/.shorewallrc. We don't need to touch it.

• defines the names of the net zones (fw, net, loc)

#ZONE           TYPE
fw              firewall
net             ipv4
loc             ipv4

• defines which network interface belongs to which zone.

#ZONE           INTERFACE               OPTIONS
net             enp1s0f1                -
loc             enp1s0f0                -

• defines the grobal policy of the network. Individual exceptions are not defined here but in .

loc->net is dropped (make no response). net->fw is rejected immediately. fw->net, fw->loc, and loc->fw are accepted. Everything else is dropped.

#SOURCE         DEST            POLICY  LOGLEVEL        RATE    CONNLIMIT
loc             net             DROP    info

$FW             net             ACCEPT
net             $FW             REJECT  info

$FW             loc             ACCEPT
loc             $FW             ACCEPT

all             all             DROP    info

• {{/