setup shorewall(6) and let squid cache files up to 50MB

17 files changed, 770 insertions, 6 deletions

diff --git a/TODO b/TODO
index f1cf9b94..c219e5bb 100644
--- a/TODO
+++ b/TODO
@@ -18,7 +18,6 @@ About jenkins.debian.net
 
 == General todo
 
-* firewall host (with shorewall-lite and shorewall6-lite)
 * mail notifications (to where?)
 * proper backup (=daily), bottom of this document
 * more tests (see below)
@@ -27,12 +26,10 @@ About jenkins.debian.net
 === Minor stuff
 
 * split TODO and about.txt?
-** use nice stylesheet for about.html
+** use debian stylesheet for about.html
 ** use job description to create .txt file to be included in about.txt/TODO?
 * proper git repo url, outside users/holger
-* squid, cache files bigger than 20MB? (maximum_object_size in squid.conf)
 * only trigger (=really run) jobs if available+used packages have changed (save packages in db and compare)
-* use mirror.1und1.d?
 
 == More tests to be run
 
diff --git a/etc/default/shorewall b/etc/default/shorewall
new file mode 100644
index 00000000..9dfed2f8
--- /dev/null
+++ b/etc/default/shorewall
@@ -0,0 +1,44 @@
+# prevent startup with default configuration
+# set the following varible to 1 in order to allow Shorewall to start
+
+startup=1
+
+# If your Shorewall configuration requires detection of the ip address of a ppp
+# interface, you must list such interfaces in "wait_interface" to get Shorewall
+# to wait until the interface is configured. Otherwise the script will fail
+# because it won't be able to detect the IP address.
+#
+# Example:
+#    wait_interface="ppp0"
+# or
+#    wait_interface="ppp0 ppp1"
+# or, if you have defined  in /etc/shorewall/params
+#    wait_interface=
+
+#
+# Global start/restart/stop options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
+#
+INITLOG=/dev/null
+
+#
+# Set this to 1 to cause '/etc/init.d/shorewall stop' to place the firewall in
+# a safe state rather than to open it
+#
+SAFESTOP=0
+
+# EOF
diff --git a/etc/default/shorewall6 b/etc/default/shorewall6
new file mode 100644
index 00000000..babe9782
--- /dev/null
+++ b/etc/default/shorewall6
@@ -0,0 +1,44 @@
+# prevent startup with default configuration
+# set the following varible to 1 in order to allow Shorewall6 to start
+
+startup=1
+
+# if your Shorewall6 configuration requires detection of the ip address of a
+# ppp interface, you must list such interfaces in "wait_interface" to get
+# Shorewall6 to wait until the interface is configured. Otherwise the script
+# will fail because it won't be able to detect the IP address.
+#
+# Example:
+#    wait_interface="ppp0"
+# or
+#    wait_interface="ppp0 ppp1"
+# or, if you have defined  in /etc/shorewall6/params
+#    wait_interface=
+
+#
+# Startup options
+#
+OPTIONS=""
+
+#
+# Start options
+#
+STARTOPTIONS=""
+
+#
+# Restart options
+#
+RESTARTOPTIONS=""
+
+#
+# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
+#
+INITLOG=/dev/null
+
+#
+# Set this to 1 to cause '/etc/init.d/shorewall6 stop' to place the firewall in
+# a safe state rather than to open it
+#
+SAFESTOP=0
+
+# EOF
diff --git a/etc/shorewall/interfaces b/etc/shorewall/interfaces
new file mode 100644
index 00000000..21cad8cc
--- /dev/null
+++ b/etc/shorewall/interfaces
@@ -0,0 +1,19 @@
+#
+# Shorewall version 4.0 - Sample Interfaces File for one-interface configuration.
+# Copyright (C) 2006 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall-interfaces"
+###############################################################################
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0
+# to be safe in case of interface renamings..
+net     eth1            dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0
diff --git a/etc/shorewall/params b/etc/shorewall/params
new file mode 100644
index 00000000..a60512b4
--- /dev/null
+++ b/etc/shorewall/params
@@ -0,0 +1,28 @@
+#
+# Shorewall version 4 - Params File
+#
+# /etc/shorewall/params
+#
+#	Assign any variables that you need here.
+#
+#	It is suggested that variable names begin with an upper case letter
+#	to distinguish them from variables used internally within the
+#	Shorewall programs
+#
+#	Example:
+#
+#		NET_IF=eth0
+#		NET_BCAST=130.252.100.255
+#		NET_OPTIONS=routefilter,norfc1918
+#
+#	Example (/etc/shorewall/interfaces record):
+#
+#		net	$NET_IF		$NET_BCAST	$NET_OPTIONS
+#
+#	The result will be the same as if the record had been written
+#
+#		net	eth0		130.252.100.255	routefilter,norfc1918
+#
+###############################################################################
+
+#LAST LINE -- DO NOT REMOVE
diff --git a/etc/shorewall/policy b/etc/shorewall/policy
new file mode 100644
index 00000000..b6edc636
--- /dev/null
+++ b/etc/shorewall/policy
@@ -0,0 +1,18 @@
+#
+# Shorewall version 4.0 - Sample Policy File for one-interface configuration.
+# Copyright (C) 2006 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall-policy"
+###############################################################################
+#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
+$FW		net		ACCEPT
+net		all		DROP		info
+# The FOLLOWING POLICY MUST BE LAST
+all		all		REJECT		info
diff --git a/etc/shorewall/rules b/etc/shorewall/rules
new file mode 100644
index 00000000..db08726c
--- /dev/null
+++ b/etc/shorewall/rules
@@ -0,0 +1,32 @@
+#
+# Shorewall version 4.0 - Sample Rules File for one-interface configuration.
+# Copyright (C) 2006 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------------------------------------
+# For information on entries in this file, type "man shorewall-rules"
+######################################################################################################################################################################################
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME         HEADERS         SWITCH
+#							PORT	PORT(S)		DEST		LIMIT		GROUP
+#SECTION ALL
+#SECTION ESTABLISHED
+#SECTION RELATED
+SECTION NEW
+
+# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
+
+Ping(DROP)	net		$FW
+
+# Permit all ICMP traffic FROM the firewall TO the net zone
+
+ACCEPT		$FW		net		icmp
+
+# http and ssh are allowed
+ACCEPT    net       $FW             tcp          80
+ACCEPT    net       $FW             tcp          22
+
diff --git a/etc/shorewall/shorewall.conf b/etc/shorewall/shorewall.conf
new file mode 100644
index 00000000..f491c51b
--- /dev/null
+++ b/etc/shorewall/shorewall.conf
@@ -0,0 +1,249 @@
+###############################################################################
+#
+# Shorewall version 4.0 - Sample shorewall.conf for one-interface
+#                         configuration.
+# Copyright (C) 2006 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#
+# For information about the settings in this file, type "man shorewall.conf"
+#
+# The manpage is also online at
+# http://shorewall.net/manpages/shorewall.conf.html
+#
+###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+#		              V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+#		                L O G G I N G
+###############################################################################
+
+BLACKLIST_LOGLEVEL=
+
+LOG_MARTIANS=Yes
+
+LOG_VERBOSITY=2
+
+LOGALLNEW=
+
+LOGFILE=/var/log/messages
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGTAGONLY=No
+
+LOGLIMIT=
+
+MACLIST_LOG_LEVEL=info
+
+RELATED_LOG_LEVEL=
+
+SFILTER_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+
+CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
+
+GEOIPDIR=/usr/share/xt_geoip/LE
+
+IPTABLES=
+
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
+PERL=/usr/bin/perl
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
+
+RESTOREFILE=restore
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=
+
+TC=
+
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+
+ACCEPT_DEFAULT="none"
+DROP_DEFAULT="Drop"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
+
+###############################################################################
+#                        R S H / R C P  C O M M A N D S
+###############################################################################
+
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADD_IP_ALIASES=No
+
+ADD_SNAT_ALIASES=No
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DISABLE_IPV6=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+IPSET_WARNINGS=Yes
+
+IP_FORWARDING=Off
+
+KEEP_RT_TABLES=No
+
+LOAD_HELPERS_ONLY=Yes
+
+LEGACY_FASTSTART=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
+RETAIN_ALIASES=No
+
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
+TC_ENABLED=Internal
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+TRACK_PROVIDERS=Yes
+
+USE_DEFAULT_RT=No
+
+USE_PHYSICAL_NAMES=No
+
+ZONE2ZONE=2
+
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=REJECT
+
+RELATED_DISPOSITION=ACCEPT
+
+SMURF_DISPOSITION=DROP
+
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
+################################################################################
+#			P A C K E T  M A R K  L A Y O U T
+################################################################################
+
+TC_BITS=
+
+PROVIDER_BITS=
+
+PROVIDER_OFFSET=
+
+MASK_BITS=
+
+ZONE_BITS=0
+
+################################################################################
+#                            L E G A C Y  O P T I O N
+#                      D O  N O T  D E L E T E  O R  A L T E R
+################################################################################
+
+IPSECFILE=zones
+
+#LAST LINE -- DO NOT REMOVE
diff --git a/etc/shorewall/zones b/etc/shorewall/zones
new file mode 100644
index 00000000..5084ff11
--- /dev/null
+++ b/etc/shorewall/zones
@@ -0,0 +1,17 @@
+#
+# Shorewall version 4.0 - Sample Zones File for one-interface configuration.
+# Copyright (C) 2006 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall-zones"
+###############################################################################
+#ZONE	TYPE	OPTIONS			IN			OUT
+#					OPTIONS			OPTIONS
+fw	firewall
+net	ipv4
diff --git a/etc/shorewall6/interfaces b/etc/shorewall6/interfaces
new file mode 100644
index 00000000..ba3f5827
--- /dev/null
+++ b/etc/shorewall6/interfaces
@@ -0,0 +1,17 @@
+#
+# Shorewall6 version 4 - Sample Interfaces File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-interfaces"
+###############################################################################
+FORMAT 2
+###############################################################################
+#ZONE	INTERFACE	OPTIONS
+net     eth0            tcpflags
diff --git a/etc/shorewall6/params b/etc/shorewall6/params
new file mode 100644
index 00000000..b9772415
--- /dev/null
+++ b/etc/shorewall6/params
@@ -0,0 +1,27 @@
+#
+# Shorewall6 version 4 - Params File
+#
+# /etc/shorewall6/params
+#
+#	Assign any variables that you need here.
+#
+#	It is suggested that variable names begin with an upper case letter
+#	to distinguish them from variables used internally within the
+#	Shorewall6 programs
+#
+#	Example:
+#
+#		NET_IF=eth0
+#		NET_OPTIONS=dhcp,nosmurfs
+#
+#	Example (/etc/shorewall6/interfaces record):
+#
+#		net	$NET_IF		-	$NET_OPTIONS
+#
+#	The result will be the same as if the record had been written
+#
+#		net	eth0		-	dhcp,nosmurfs
+#
+###############################################################################
+
+#LAST LINE -- DO NOT REMOVE
diff --git a/etc/shorewall6/policy b/etc/shorewall6/policy
new file mode 100644
index 00000000..da7019e1
--- /dev/null
+++ b/etc/shorewall6/policy
@@ -0,0 +1,20 @@
+#
+# Shorewall6 version 4 - Sample Policy File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-policy"
+#
+###############################################################################
+#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
+$FW		net		ACCEPT
+net		$FW		DROP		info
+net		all		DROP		info
+# The FOLLOWING POLICY MUST BE LAST
+all		all		REJECT		info
diff --git a/etc/shorewall6/rules b/etc/shorewall6/rules
new file mode 100644
index 00000000..e051f8e0
--- /dev/null
+++ b/etc/shorewall6/rules
@@ -0,0 +1,28 @@
+#
+# Shorewall6 version 4 - Sample Rules File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------------------------------------
+# For information on entries in this file, type "man shorewall6-rules"
+###########################################################################################################################################################################
+#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/	MARK	CONNLIMIT	TIME       HEADERS   SWITCH
+#							PORT	PORT(S)		DEST		LIMIT		GROUP
+#SECTION ALL
+#SECTION ESTABLISHED
+#SECTION RELATED
+SECTION NEW
+
+# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
+
+Ping(DROP)	net		$FW
+
+# Permit all ICMP traffic FROM the firewall TO the net zone
+
+ACCEPT		$FW		net		ipv6-icmp
+
diff --git a/etc/shorewall6/shorewall6.conf b/etc/shorewall6/shorewall6.conf
new file mode 100644
index 00000000..a2f75cfd
--- /dev/null
+++ b/etc/shorewall6/shorewall6.conf
@@ -0,0 +1,206 @@
+###############################################################################
+#
+#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
+#
+#  For information about the settings in this file, type "man shorewall6.conf"
+#
+#  Manpage also online at
+#  http://www.shorewall.net/manpages6/shorewall6.conf.html
+###############################################################################
+#		       S T A R T U P   E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+#		              V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+#			       L O G G I N G
+###############################################################################
+
+BLACKLIST_LOGLEVEL=
+
+LOG_VERBOSITY=2
+
+LOGALLNEW=
+
+LOGFILE=
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGLIMIT=
+
+LOGTAGONLY=No
+
+MACLIST_LOG_LEVEL=info
+
+RELATED_LOG_LEVEL=
+
+SFILTER_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
+###############################################################################
+#	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
+###############################################################################
+
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
+
+GEOIPDIR=/usr/share/xt_geoip/LE
+
+IP6TABLES=
+
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
+PERL=/usr/bin/perl
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
+
+RESTOREFILE=
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=
+
+TC=
+
+###############################################################################
+#		D E F A U L T   A C T I O N S / M A C R O S
+###############################################################################
+
+ACCEPT_DEFAULT="none"
+DROP_DEFAULT="Drop"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
+
+###############################################################################
+#                        R S H / R C P  C O M M A N D S
+###############################################################################
+
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+
+###############################################################################
+#			F I R E W A L L	  O P T I O N S
+###############################################################################
+
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=No
+
+EXPORTMODULES=Yes
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+IPSET_WARNINGS=Yes
+
+IP_FORWARDING=Off
+
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+TC_ENABLED=No
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+TRACK_PROVIDERS=Yes
+
+USE_DEFAULT_RT=No
+
+USE_PHYSICAL_NAMES=No
+
+ZONE2ZONE=2
+
+###############################################################################
+#			P A C K E T   D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=REJECT
+
+RELATED_DISPOSITION=ACCEPT
+
+SFILTER_DISPOSITION=DROP
+
+SMURF_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
+################################################################################
+#			P A C K E T  M A R K  L A Y O U T
+################################################################################
+
+TC_BITS=
+
+PROVIDER_BITS=
+
+PROVIDER_OFFSET=
+
+MASK_BITS=
+
+ZONE_BITS=0
diff --git a/etc/shorewall6/zones b/etc/shorewall6/zones
new file mode 100644
index 00000000..6a983a30
--- /dev/null
+++ b/etc/shorewall6/zones
@@ -0,0 +1,17 @@
+#
+# Shorewall6 version 4 - Sample Zones File for one-interface IPv6 configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-zones"
+###############################################################################
+#ZONE	TYPE	OPTIONS			IN			OUT
+#					OPTIONS			OPTIONS
+fw	firewall
+net	ipv6
diff --git a/etc/squid/squid.conf b/etc/squid/squid.conf
index 230bc50d..69cbe777 100644
--- a/etc/squid/squid.conf
+++ b/etc/squid/squid.conf
@@ -1985,7 +1985,8 @@ cache_dir ufs /var/spool/squid 100 16 10240
 #	proper proxy for APT.
 #
 #Default:
-# maximum_object_size 20480 KB
+#NOTE 3: raised to 50 MB
+maximum_object_size 51200 KB
 
 #  TAG: cache_swap_low	(percent, 0-100)
 #  TAG: cache_swap_high	(percent, 0-100)
diff --git a/update_jdn.sh b/update_jdn.sh
index 68cffb1c..b1b1b744 100755
--- a/update_jdn.sh
+++ b/update_jdn.sh
@@ -22,7 +22,7 @@ asciidoc -a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scrip
 # install packages we need
 # (more or less grouped into more-then-nice-to-have, needed-while-things-are-new, needed)
 #
-sudo apt-get install vim screen less etckeeper mtr-tiny dstat devscripts bash-completion \
+sudo apt-get install vim screen less etckeeper mtr-tiny dstat devscripts bash-completion shorewall shorewall6 cron-apt apt-listchanges \
 	build-essential python-setuptools \
 	debootstrap sudo figlet graphviz apache2 python-yaml