diff options
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/default/shorewall | 44 | ||||
| -rw-r--r-- | etc/default/shorewall6 | 44 | ||||
| -rw-r--r-- | etc/shorewall/interfaces | 19 | ||||
| -rw-r--r-- | etc/shorewall/params | 28 | ||||
| -rw-r--r-- | etc/shorewall/policy | 18 | ||||
| -rw-r--r-- | etc/shorewall/rules | 32 | ||||
| -rw-r--r-- | etc/shorewall/shorewall.conf | 249 | ||||
| -rw-r--r-- | etc/shorewall/zones | 17 | ||||
| -rw-r--r-- | etc/shorewall6/interfaces | 17 | ||||
| -rw-r--r-- | etc/shorewall6/params | 27 | ||||
| -rw-r--r-- | etc/shorewall6/policy | 20 | ||||
| -rw-r--r-- | etc/shorewall6/rules | 28 | ||||
| -rw-r--r-- | etc/shorewall6/shorewall6.conf | 206 | ||||
| -rw-r--r-- | etc/shorewall6/zones | 17 | ||||
| -rw-r--r-- | etc/squid/squid.conf | 3 |
15 files changed, 768 insertions, 1 deletions
diff --git a/etc/default/shorewall b/etc/default/shorewall new file mode 100644 index 00000000..9dfed2f8 --- /dev/null +++ b/etc/default/shorewall @@ -0,0 +1,44 @@ +# prevent startup with default configuration +# set the following varible to 1 in order to allow Shorewall to start + +startup=1 + +# If your Shorewall configuration requires detection of the ip address of a ppp +# interface, you must list such interfaces in "wait_interface" to get Shorewall +# to wait until the interface is configured. Otherwise the script will fail +# because it won't be able to detect the IP address. +# +# Example: +# wait_interface="ppp0" +# or +# wait_interface="ppp0 ppp1" +# or, if you have defined in /etc/shorewall/params +# wait_interface= + +# +# Global start/restart/stop options +# +OPTIONS="" + +# +# Start options +# +STARTOPTIONS="" + +# +# Restart options +# +RESTARTOPTIONS="" + +# +# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf +# +INITLOG=/dev/null + +# +# Set this to 1 to cause '/etc/init.d/shorewall stop' to place the firewall in +# a safe state rather than to open it +# +SAFESTOP=0 + +# EOF diff --git a/etc/default/shorewall6 b/etc/default/shorewall6 new file mode 100644 index 00000000..babe9782 --- /dev/null +++ b/etc/default/shorewall6 @@ -0,0 +1,44 @@ +# prevent startup with default configuration +# set the following varible to 1 in order to allow Shorewall6 to start + +startup=1 + +# if your Shorewall6 configuration requires detection of the ip address of a +# ppp interface, you must list such interfaces in "wait_interface" to get +# Shorewall6 to wait until the interface is configured. Otherwise the script +# will fail because it won't be able to detect the IP address. +# +# Example: +# wait_interface="ppp0" +# or +# wait_interface="ppp0 ppp1" +# or, if you have defined in /etc/shorewall6/params +# wait_interface= + +# +# Startup options +# +OPTIONS="" + +# +# Start options +# +STARTOPTIONS="" + +# +# Restart options +# +RESTARTOPTIONS="" + +# +# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf +# +INITLOG=/dev/null + +# +# Set this to 1 to cause '/etc/init.d/shorewall6 stop' to place the firewall in +# a safe state rather than to open it +# +SAFESTOP=0 + +# EOF diff --git a/etc/shorewall/interfaces b/etc/shorewall/interfaces new file mode 100644 index 00000000..21cad8cc --- /dev/null +++ b/etc/shorewall/interfaces @@ -0,0 +1,19 @@ +# +# Shorewall version 4.0 - Sample Interfaces File for one-interface configuration. +# Copyright (C) 2006 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#------------------------------------------------------------------------------ +# For information about entries in this file, type "man shorewall-interfaces" +############################################################################### +FORMAT 2 +############################################################################### +#ZONE INTERFACE OPTIONS +net eth0 dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0 +# to be safe in case of interface renamings.. +net eth1 dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0 diff --git a/etc/shorewall/params b/etc/shorewall/params new file mode 100644 index 00000000..a60512b4 --- /dev/null +++ b/etc/shorewall/params @@ -0,0 +1,28 @@ +# +# Shorewall version 4 - Params File +# +# /etc/shorewall/params +# +# Assign any variables that you need here. +# +# It is suggested that variable names begin with an upper case letter +# to distinguish them from variables used internally within the +# Shorewall programs +# +# Example: +# +# NET_IF=eth0 +# NET_BCAST=130.252.100.255 +# NET_OPTIONS=routefilter,norfc1918 +# +# Example (/etc/shorewall/interfaces record): +# +# net $NET_IF $NET_BCAST $NET_OPTIONS +# +# The result will be the same as if the record had been written +# +# net eth0 130.252.100.255 routefilter,norfc1918 +# +############################################################################### + +#LAST LINE -- DO NOT REMOVE diff --git a/etc/shorewall/policy b/etc/shorewall/policy new file mode 100644 index 00000000..b6edc636 --- /dev/null +++ b/etc/shorewall/policy @@ -0,0 +1,18 @@ +# +# Shorewall version 4.0 - Sample Policy File for one-interface configuration. +# Copyright (C) 2006 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#----------------------------------------------------------------------------- +# For information about entries in this file, type "man shorewall-policy" +############################################################################### +#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST +$FW net ACCEPT +net all DROP info +# The FOLLOWING POLICY MUST BE LAST +all all REJECT info diff --git a/etc/shorewall/rules b/etc/shorewall/rules new file mode 100644 index 00000000..db08726c --- /dev/null +++ b/etc/shorewall/rules @@ -0,0 +1,32 @@ +# +# Shorewall version 4.0 - Sample Rules File for one-interface configuration. +# Copyright (C) 2006 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#------------------------------------------------------------------------------------------------------------ +# For information on entries in this file, type "man shorewall-rules" +###################################################################################################################################################################################### +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH +# PORT PORT(S) DEST LIMIT GROUP +#SECTION ALL +#SECTION ESTABLISHED +#SECTION RELATED +SECTION NEW + +# Drop Ping from the "bad" net zone.. and prevent your log from being flooded.. + +Ping(DROP) net $FW + +# Permit all ICMP traffic FROM the firewall TO the net zone + +ACCEPT $FW net icmp + +# http and ssh are allowed +ACCEPT net $FW tcp 80 +ACCEPT net $FW tcp 22 + diff --git a/etc/shorewall/shorewall.conf b/etc/shorewall/shorewall.conf new file mode 100644 index 00000000..f491c51b --- /dev/null +++ b/etc/shorewall/shorewall.conf @@ -0,0 +1,249 @@ +############################################################################### +# +# Shorewall version 4.0 - Sample shorewall.conf for one-interface +# configuration. +# Copyright (C) 2006 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +# +# For information about the settings in this file, type "man shorewall.conf" +# +# The manpage is also online at +# http://shorewall.net/manpages/shorewall.conf.html +# +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# L O G G I N G +############################################################################### + +BLACKLIST_LOGLEVEL= + +LOG_MARTIANS=Yes + +LOG_VERBOSITY=2 + +LOGALLNEW= + +LOGFILE=/var/log/messages + +LOGFORMAT="Shorewall:%s:%s:" + +LOGTAGONLY=No + +LOGLIMIT= + +MACLIST_LOG_LEVEL=info + +RELATED_LOG_LEVEL= + +SFILTER_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +STARTUP_LOG=/var/log/shorewall-init.log + +TCP_FLAGS_LOG_LEVEL=info + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall + +GEOIPDIR=/usr/share/xt_geoip/LE + +IPTABLES= + +IP= + +IPSET= + +LOCKFILE= + +MODULESDIR= + +PERL=/usr/bin/perl + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +RESTOREFILE=restore + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK= + +TC= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +ACCEPT_DEFAULT="none" +DROP_DEFAULT="Drop" +NFQUEUE_DEFAULT="none" +QUEUE_DEFAULT="none" +REJECT_DEFAULT="Reject" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' +RSH_COMMAND='ssh ${root}@${system} ${command}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +ACCOUNTING=Yes + +ACCOUNTING_TABLE=filter + +ADD_IP_ALIASES=No + +ADD_SNAT_ALIASES=No + +ADMINISABSENTMINDED=Yes + +AUTO_COMMENT=Yes + +AUTOMAKE=No + +BLACKLISTNEWONLY=Yes + +CLAMPMSS=No + +CLEAR_TC=Yes + +COMPLETE=No + +DISABLE_IPV6=No + +DELETE_THEN_ADD=Yes + +DETECT_DNAT_IPADDRS=No + +DONT_LOAD= + +DYNAMIC_BLACKLIST=Yes + +EXPAND_POLICIES=Yes + +EXPORTMODULES=Yes + +FASTACCEPT=No + +FORWARD_CLEAR_MARK= + +IMPLICIT_CONTINUE=No + +IPSET_WARNINGS=Yes + +IP_FORWARDING=Off + +KEEP_RT_TABLES=No + +LOAD_HELPERS_ONLY=Yes + +LEGACY_FASTSTART=No + +MACLIST_TABLE=filter + +MACLIST_TTL= + +MANGLE_ENABLED=Yes + +MAPOLDACTIONS=No + +MARK_IN_FORWARD_CHAIN=No + +MODULE_SUFFIX=ko + +MULTICAST=No + +MUTEX_TIMEOUT=60 + +NULL_ROUTE_RFC1918=No + +OPTIMIZE=1 + +OPTIMIZE_ACCOUNTING=No + +REQUIRE_INTERFACE=No + +RESTORE_DEFAULT_ROUTE=Yes + +RETAIN_ALIASES=No + +ROUTE_FILTER=No + +SAVE_IPSETS=No + +TC_ENABLED=Internal + +TC_EXPERT=No + +TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2" + +TRACK_PROVIDERS=Yes + +USE_DEFAULT_RT=No + +USE_PHYSICAL_NAMES=No + +ZONE2ZONE=2 + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=REJECT + +RELATED_DISPOSITION=ACCEPT + +SMURF_DISPOSITION=DROP + +SFILTER_DISPOSITION=DROP + +TCP_FLAGS_DISPOSITION=DROP + +################################################################################ +# P A C K E T M A R K L A Y O U T +################################################################################ + +TC_BITS= + +PROVIDER_BITS= + +PROVIDER_OFFSET= + +MASK_BITS= + +ZONE_BITS=0 + +################################################################################ +# L E G A C Y O P T I O N +# D O N O T D E L E T E O R A L T E R +################################################################################ + +IPSECFILE=zones + +#LAST LINE -- DO NOT REMOVE diff --git a/etc/shorewall/zones b/etc/shorewall/zones new file mode 100644 index 00000000..5084ff11 --- /dev/null +++ b/etc/shorewall/zones @@ -0,0 +1,17 @@ +# +# Shorewall version 4.0 - Sample Zones File for one-interface configuration. +# Copyright (C) 2006 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#----------------------------------------------------------------------------- +# For information about entries in this file, type "man shorewall-zones" +############################################################################### +#ZONE TYPE OPTIONS IN OUT +# OPTIONS OPTIONS +fw firewall +net ipv4 diff --git a/etc/shorewall6/interfaces b/etc/shorewall6/interfaces new file mode 100644 index 00000000..ba3f5827 --- /dev/null +++ b/etc/shorewall6/interfaces @@ -0,0 +1,17 @@ +# +# Shorewall6 version 4 - Sample Interfaces File for one-interface configuration. +# Copyright (C) 2006,2008 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#------------------------------------------------------------------------------ +# For information about entries in this file, type "man shorewall6-interfaces" +############################################################################### +FORMAT 2 +############################################################################### +#ZONE INTERFACE OPTIONS +net eth0 tcpflags diff --git a/etc/shorewall6/params b/etc/shorewall6/params new file mode 100644 index 00000000..b9772415 --- /dev/null +++ b/etc/shorewall6/params @@ -0,0 +1,27 @@ +# +# Shorewall6 version 4 - Params File +# +# /etc/shorewall6/params +# +# Assign any variables that you need here. +# +# It is suggested that variable names begin with an upper case letter +# to distinguish them from variables used internally within the +# Shorewall6 programs +# +# Example: +# +# NET_IF=eth0 +# NET_OPTIONS=dhcp,nosmurfs +# +# Example (/etc/shorewall6/interfaces record): +# +# net $NET_IF - $NET_OPTIONS +# +# The result will be the same as if the record had been written +# +# net eth0 - dhcp,nosmurfs +# +############################################################################### + +#LAST LINE -- DO NOT REMOVE diff --git a/etc/shorewall6/policy b/etc/shorewall6/policy new file mode 100644 index 00000000..da7019e1 --- /dev/null +++ b/etc/shorewall6/policy @@ -0,0 +1,20 @@ +# +# Shorewall6 version 4 - Sample Policy File for one-interface configuration. +# Copyright (C) 2006,2008 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#----------------------------------------------------------------------------- +# For information about entries in this file, type "man shorewall6-policy" +# +############################################################################### +#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST +$FW net ACCEPT +net $FW DROP info +net all DROP info +# The FOLLOWING POLICY MUST BE LAST +all all REJECT info diff --git a/etc/shorewall6/rules b/etc/shorewall6/rules new file mode 100644 index 00000000..e051f8e0 --- /dev/null +++ b/etc/shorewall6/rules @@ -0,0 +1,28 @@ +# +# Shorewall6 version 4 - Sample Rules File for one-interface configuration. +# Copyright (C) 2006,2008 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#------------------------------------------------------------------------------------------------------------ +# For information on entries in this file, type "man shorewall6-rules" +########################################################################################################################################################################### +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH +# PORT PORT(S) DEST LIMIT GROUP +#SECTION ALL +#SECTION ESTABLISHED +#SECTION RELATED +SECTION NEW + +# Drop Ping from the "bad" net zone.. and prevent your log from being flooded.. + +Ping(DROP) net $FW + +# Permit all ICMP traffic FROM the firewall TO the net zone + +ACCEPT $FW net ipv6-icmp + diff --git a/etc/shorewall6/shorewall6.conf b/etc/shorewall6/shorewall6.conf new file mode 100644 index 00000000..a2f75cfd --- /dev/null +++ b/etc/shorewall6/shorewall6.conf @@ -0,0 +1,206 @@ +############################################################################### +# +# Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf +# +# For information about the settings in this file, type "man shorewall6.conf" +# +# Manpage also online at +# http://www.shorewall.net/manpages6/shorewall6.conf.html +############################################################################### +# S T A R T U P E N A B L E D +############################################################################### + +STARTUP_ENABLED=Yes + +############################################################################### +# V E R B O S I T Y +############################################################################### + +VERBOSITY=1 + +############################################################################### +# L O G G I N G +############################################################################### + +BLACKLIST_LOGLEVEL= + +LOG_VERBOSITY=2 + +LOGALLNEW= + +LOGFILE= + +LOGFORMAT="Shorewall:%s:%s:" + +LOGLIMIT= + +LOGTAGONLY=No + +MACLIST_LOG_LEVEL=info + +RELATED_LOG_LEVEL= + +SFILTER_LOG_LEVEL=info + +SMURF_LOG_LEVEL=info + +STARTUP_LOG=/var/log/shorewall6-init.log + +TCP_FLAGS_LOG_LEVEL=info + +############################################################################### +# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S +############################################################################### + +CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall + +GEOIPDIR=/usr/share/xt_geoip/LE + +IP6TABLES= + +IP= + +IPSET= + +LOCKFILE= + +MODULESDIR= + +PERL=/usr/bin/perl + +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin + +RESTOREFILE= + +SHOREWALL_SHELL=/bin/sh + +SUBSYSLOCK= + +TC= + +############################################################################### +# D E F A U L T A C T I O N S / M A C R O S +############################################################################### + +ACCEPT_DEFAULT="none" +DROP_DEFAULT="Drop" +NFQUEUE_DEFAULT="none" +QUEUE_DEFAULT="none" +REJECT_DEFAULT="Reject" + +############################################################################### +# R S H / R C P C O M M A N D S +############################################################################### + +RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' +RSH_COMMAND='ssh ${root}@${system} ${command}' + +############################################################################### +# F I R E W A L L O P T I O N S +############################################################################### + +ACCOUNTING=Yes + +ACCOUNTING_TABLE=filter + +ADMINISABSENTMINDED=Yes + +AUTO_COMMENT=Yes + +AUTOMAKE=No + +BLACKLISTNEWONLY=Yes + +CLAMPMSS=No + +CLEAR_TC=Yes + +COMPLETE=No + +DELETE_THEN_ADD=Yes + +DONT_LOAD= + +DYNAMIC_BLACKLIST=Yes + +EXPAND_POLICIES=No + +EXPORTMODULES=Yes + +FASTACCEPT=No + +FORWARD_CLEAR_MARK= + +IMPLICIT_CONTINUE=No + +IPSET_WARNINGS=Yes + +IP_FORWARDING=Off + +KEEP_RT_TABLES=Yes + +LEGACY_FASTSTART=No + +LOAD_HELPERS_ONLY=Yes + +MACLIST_TABLE=filter + +MACLIST_TTL= + +MANGLE_ENABLED=Yes + +MARK_IN_FORWARD_CHAIN=No + +MODULE_SUFFIX=ko + +MUTEX_TIMEOUT=60 + +OPTIMIZE=1 + +OPTIMIZE_ACCOUNTING=No + +REQUIRE_INTERFACE=No + +TC_ENABLED=No + +TC_EXPERT=No + +TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2" + +TRACK_PROVIDERS=Yes + +USE_DEFAULT_RT=No + +USE_PHYSICAL_NAMES=No + +ZONE2ZONE=2 + +############################################################################### +# P A C K E T D I S P O S I T I O N +############################################################################### + +BLACKLIST_DISPOSITION=DROP + +MACLIST_DISPOSITION=REJECT + +RELATED_DISPOSITION=ACCEPT + +SFILTER_DISPOSITION=DROP + +SMURF_DISPOSITION=DROP + +TCP_FLAGS_DISPOSITION=DROP + +################################################################################ +# P A C K E T M A R K L A Y O U T +################################################################################ + +TC_BITS= + +PROVIDER_BITS= + +PROVIDER_OFFSET= + +MASK_BITS= + +ZONE_BITS=0 diff --git a/etc/shorewall6/zones b/etc/shorewall6/zones new file mode 100644 index 00000000..6a983a30 --- /dev/null +++ b/etc/shorewall6/zones @@ -0,0 +1,17 @@ +# +# Shorewall6 version 4 - Sample Zones File for one-interface IPv6 configuration. +# Copyright (C) 2006,2008 by the Shorewall Team +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# See the file README.txt for further details. +#----------------------------------------------------------------------------- +# For information about entries in this file, type "man shorewall6-zones" +############################################################################### +#ZONE TYPE OPTIONS IN OUT +# OPTIONS OPTIONS +fw firewall +net ipv6 diff --git a/etc/squid/squid.conf b/etc/squid/squid.conf index 230bc50d..69cbe777 100644 --- a/etc/squid/squid.conf +++ b/etc/squid/squid.conf @@ -1985,7 +1985,8 @@ cache_dir ufs /var/spool/squid 100 16 10240 # proper proxy for APT. # #Default: -# maximum_object_size 20480 KB +#NOTE 3: raised to 50 MB +maximum_object_size 51200 KB # TAG: cache_swap_low (percent, 0-100) # TAG: cache_swap_high (percent, 0-100) |