summaryrefslogtreecommitdiffstats
path: root/etc/shorewall6
diff options
context:
space:
mode:
authorHolger Levsen <holger@layer-acht.org>2012-10-21 14:55:35 +0200
committerHolger Levsen <holger@layer-acht.org>2012-10-21 14:55:35 +0200
commit63b2dbce87c82b917cd5e0574f04d51f0cf52d4f (patch)
treec1774c227e5aa56010b7b7fa46c2dbdf4d5f1551 /etc/shorewall6
parentec412beda5d3fba47597cce64aa235ffff203c36 (diff)
downloadjenkins.debian.net-63b2dbce87c82b917cd5e0574f04d51f0cf52d4f.tar.xz
setup shorewall(6) and let squid cache files up to 50MB
Diffstat (limited to 'etc/shorewall6')
-rw-r--r--etc/shorewall6/interfaces17
-rw-r--r--etc/shorewall6/params27
-rw-r--r--etc/shorewall6/policy20
-rw-r--r--etc/shorewall6/rules28
-rw-r--r--etc/shorewall6/shorewall6.conf206
-rw-r--r--etc/shorewall6/zones17
6 files changed, 315 insertions, 0 deletions
diff --git a/etc/shorewall6/interfaces b/etc/shorewall6/interfaces
new file mode 100644
index 00000000..ba3f5827
--- /dev/null
+++ b/etc/shorewall6/interfaces
@@ -0,0 +1,17 @@
+#
+# Shorewall6 version 4 - Sample Interfaces File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-interfaces"
+###############################################################################
+FORMAT 2
+###############################################################################
+#ZONE INTERFACE OPTIONS
+net eth0 tcpflags
diff --git a/etc/shorewall6/params b/etc/shorewall6/params
new file mode 100644
index 00000000..b9772415
--- /dev/null
+++ b/etc/shorewall6/params
@@ -0,0 +1,27 @@
+#
+# Shorewall6 version 4 - Params File
+#
+# /etc/shorewall6/params
+#
+# Assign any variables that you need here.
+#
+# It is suggested that variable names begin with an upper case letter
+# to distinguish them from variables used internally within the
+# Shorewall6 programs
+#
+# Example:
+#
+# NET_IF=eth0
+# NET_OPTIONS=dhcp,nosmurfs
+#
+# Example (/etc/shorewall6/interfaces record):
+#
+# net $NET_IF - $NET_OPTIONS
+#
+# The result will be the same as if the record had been written
+#
+# net eth0 - dhcp,nosmurfs
+#
+###############################################################################
+
+#LAST LINE -- DO NOT REMOVE
diff --git a/etc/shorewall6/policy b/etc/shorewall6/policy
new file mode 100644
index 00000000..da7019e1
--- /dev/null
+++ b/etc/shorewall6/policy
@@ -0,0 +1,20 @@
+#
+# Shorewall6 version 4 - Sample Policy File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-policy"
+#
+###############################################################################
+#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
+$FW net ACCEPT
+net $FW DROP info
+net all DROP info
+# The FOLLOWING POLICY MUST BE LAST
+all all REJECT info
diff --git a/etc/shorewall6/rules b/etc/shorewall6/rules
new file mode 100644
index 00000000..e051f8e0
--- /dev/null
+++ b/etc/shorewall6/rules
@@ -0,0 +1,28 @@
+#
+# Shorewall6 version 4 - Sample Rules File for one-interface configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------------------------------------
+# For information on entries in this file, type "man shorewall6-rules"
+###########################################################################################################################################################################
+#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH
+# PORT PORT(S) DEST LIMIT GROUP
+#SECTION ALL
+#SECTION ESTABLISHED
+#SECTION RELATED
+SECTION NEW
+
+# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
+
+Ping(DROP) net $FW
+
+# Permit all ICMP traffic FROM the firewall TO the net zone
+
+ACCEPT $FW net ipv6-icmp
+
diff --git a/etc/shorewall6/shorewall6.conf b/etc/shorewall6/shorewall6.conf
new file mode 100644
index 00000000..a2f75cfd
--- /dev/null
+++ b/etc/shorewall6/shorewall6.conf
@@ -0,0 +1,206 @@
+###############################################################################
+#
+# Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
+#
+# For information about the settings in this file, type "man shorewall6.conf"
+#
+# Manpage also online at
+# http://www.shorewall.net/manpages6/shorewall6.conf.html
+###############################################################################
+# S T A R T U P E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+# V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+# L O G G I N G
+###############################################################################
+
+BLACKLIST_LOGLEVEL=
+
+LOG_VERBOSITY=2
+
+LOGALLNEW=
+
+LOGFILE=
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGLIMIT=
+
+LOGTAGONLY=No
+
+MACLIST_LOG_LEVEL=info
+
+RELATED_LOG_LEVEL=
+
+SFILTER_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
+###############################################################################
+# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
+###############################################################################
+
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
+
+GEOIPDIR=/usr/share/xt_geoip/LE
+
+IP6TABLES=
+
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
+PERL=/usr/bin/perl
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
+
+RESTOREFILE=
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=
+
+TC=
+
+###############################################################################
+# D E F A U L T A C T I O N S / M A C R O S
+###############################################################################
+
+ACCEPT_DEFAULT="none"
+DROP_DEFAULT="Drop"
+NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
+
+###############################################################################
+# R S H / R C P C O M M A N D S
+###############################################################################
+
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+
+###############################################################################
+# F I R E W A L L O P T I O N S
+###############################################################################
+
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=No
+
+EXPORTMODULES=Yes
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+IPSET_WARNINGS=Yes
+
+IP_FORWARDING=Off
+
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+TC_ENABLED=No
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+TRACK_PROVIDERS=Yes
+
+USE_DEFAULT_RT=No
+
+USE_PHYSICAL_NAMES=No
+
+ZONE2ZONE=2
+
+###############################################################################
+# P A C K E T D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=REJECT
+
+RELATED_DISPOSITION=ACCEPT
+
+SFILTER_DISPOSITION=DROP
+
+SMURF_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
+################################################################################
+# P A C K E T M A R K L A Y O U T
+################################################################################
+
+TC_BITS=
+
+PROVIDER_BITS=
+
+PROVIDER_OFFSET=
+
+MASK_BITS=
+
+ZONE_BITS=0
diff --git a/etc/shorewall6/zones b/etc/shorewall6/zones
new file mode 100644
index 00000000..6a983a30
--- /dev/null
+++ b/etc/shorewall6/zones
@@ -0,0 +1,17 @@
+#
+# Shorewall6 version 4 - Sample Zones File for one-interface IPv6 configuration.
+# Copyright (C) 2006,2008 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#-----------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall6-zones"
+###############################################################################
+#ZONE TYPE OPTIONS IN OUT
+# OPTIONS OPTIONS
+fw firewall
+net ipv6