<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Routing on One Interface</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="Multiple_Zones"></a>Routing on One Interface</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">Tom</span> <span class="surname">Eastep</span></h3></div></div></div><div><p class="copyright">Copyright © 2003-2005 Thomas M. Eastep</p></div><div><div class="legalnotice"><a id="id286316"></a><p>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“<span class="quote"><a class="ulink" href="GnuCopyright.htm" target="_self">GNU Free Documentation
License</a></span>”.</p></div></div><div><p class="pubdate">2008/12/15</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#Intro">Introduction</a></span></dt><dt><span class="section"><a href="#Router">Router in the Local Zone</a></span></dt><dd><dl><dt><span class="section"><a href="#Standard">Can You Use the Standard Configuration?</a></span></dt><dt><span class="section"><a href="#Enough">Will One Zone be Enough?</a></span></dt><dt><span class="section"><a href="#Separate">I Need Separate Zones</a></span></dt><dd><dl><dt><span class="section"><a href="#Nested">Nested Zones</a></span></dt><dt><span class="section"><a href="#Parallel">Parallel Zones</a></span></dt></dl></dd></dl></dd><dt><span class="section"><a href="#Special">Some Hosts have Special Firewalling Requirements</a></span></dt><dt><span class="section"><a href="#OneArmed">One-armed Router</a></span></dt></dl></div><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p><span class="bold"><strong>This article applies to Shorewall 3.0 and
later. If you are running a version of Shorewall earlier than Shorewall
3.0.0 then please see the documentation for that
release.</strong></span></p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Intro"></a>Introduction</h2></div></div></div><p>While most configurations can be handled with each of the firewall's
network interfaces assigned to a single zone, there are cases where you
will want to divide the hosts accessed through an interface between two or
more zones.</p><div class="itemizedlist"><ul type="disc"><li><p>The interface has multiple addresses on multiple subnetworks.
This case is covered in the <a class="ulink" href="Shorewall_and_Aliased_Interfaces.html" target="_self">Aliased Interface
documentation</a>.</p></li><li><p>You are using some form of NAT and want to access a server by
its external IP address from the same LAN segment. This is covered in
<a class="ulink" href="FAQ.htm#faq2" target="_self">FAQs 2 and 2a</a>.</p></li><li><p>There are routers accessible through the interface and you want
to treat the networks accessed through that router as a separate
zone.</p></li><li><p>Some of the hosts accessed through an interface have
significantly different firewalling requirements from the others so
you want to assign them to a different zone.</p></li></ul></div><p>The key points to keep in mind when setting up multiple zones per
interface are:</p><div class="itemizedlist"><ul type="disc"><li><p>Shorewall generates rules for zones in the order that the zone
declarations appear in /etc/shorewall/zones unless you modify the
processing order using the explicit
<span class="emphasis"><em>child-zone</em></span>:<span class="emphasis"><em>parent-zone</em></span>
syntax, in which case the child zone rules are generated first.</p></li><li><p>The order of entries in /etc/shorewall/hosts is immaterial as
far as the generated rule set is concerned.</p></li></ul></div><p><span class="bold"><strong>These examples use the local zone but the same
technique works for any zone.</strong></span> Remember that Shorewall doesn't
have any conceptual knowledge of “<span class="quote">Internet</span>”,
“<span class="quote">Local</span>”, or “<span class="quote">DMZ</span>” so all zones except the
firewall itself ($FW) are the same as far as Shorewall is concerned. Also,
the examples use private (RFC 1918) addresses but public IP addresses can
be used in exactly the same way.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Router"></a>Router in the Local Zone</h2></div></div></div><p>Here is an example of a router in the local zone.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>the <span class="bold"><strong>box called “<span class="quote">Router</span>” could
be a VPN server</strong></span> or other such device; from the point of view
of this discussion, it makes no difference.</p></div><div><img src="images/MultiZone1.png" /></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Standard"></a>Can You Use the Standard Configuration?</h3></div></div></div><p>In many cases, the <a class="ulink" href="two-interface.htm" target="_self">standard
two-interface Shorewall setup</a> will work fine in this
configuration. It will work if:</p><div class="itemizedlist"><ul type="disc"><li><p>The firewall requirements to/from the Internet are the same
for 192.168.1.0/24 and 192.168.2.0/24.</p></li><li><p>The hosts in 192.168.1.0/24 know that the route to
192.168.2.0/24 is through the <span class="bold"><strong>router</strong></span>.</p></li></ul></div><p>All you have to do on the firewall is add a route to
192.168.2.0/24 through the <span class="bold"><strong>router</strong></span> and
restart Shorewall.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Enough"></a>Will One Zone be Enough?</h3></div></div></div><p>If the firewalling requirements for the two local networks is the
same but the hosts in 192.168.1.0/24 don't know how to route to
192.168.2.0/24 then you need to configure the firewall slightly
differently. This type of configuration is rather stupid from an IP
networking point of view but it is sometimes necessary because you
simply don't want to have to reconfigure all of the hosts in
192.168.1.0/24 to add a persistent route to 192.168.2.0/24. On the
firewall:</p><div class="orderedlist"><ol type="1"><li><p>Add a route to 192.168.2.0/24 through the <span class="bold"><strong>Router</strong></span>.</p></li><li><p>Set the “<span class="quote">routeback</span>” option for eth1 (the local
firewall interface) in /etc/shorewall/interfaces.</p></li><li><p>Restart Shorewall.</p></li></ol></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Separate"></a>I Need Separate Zones</h3></div></div></div><p>If you need to make 192.168.2.0/24 into its own zone, you can do
it one of two ways; Nested Zones or Parallel Zones.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="Nested"></a>Nested Zones</h4></div></div></div><p>You can define one zone (called it “<span class="quote">loc</span>”) as being
all hosts connected to eth1 and a second zone “<span class="quote">loc1</span>”
(192.168.2.0/24) as a sub-zone.</p><div><img src="images/MultiZone1A.png" /></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The Router in the above diagram is assumed to NOT be doing
SNAT for the hosts in the 192.168.2.0/24 network.</p></div><p>The advantage of this approach is that the zone
“<span class="quote">loc1</span>” can use CONTINUE policies such that if a
connection request doesn't match a “<span class="quote">loc1</span>” rule, it will
be matched against the “<span class="quote">loc</span>” rules. For example, if your
loc1->net policy is CONTINUE then if a connection request from loc1
to the Internet doesn't match any rules for loc1->net then it will
be checked against the loc->net rules.</p><p><code class="filename">/etc/shorewall/zones</code></p><pre class="programlisting">#ZONE TYPE OPTIONS
loc ipv4
loc1:loc ipv4</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>the Parent zone (loc) is defined first then the sub-zone
(loc1) is defined using the special syntax shown.</p></div><p><code class="filename">/etc/shorewall/interfaces</code></p><pre class="programlisting">#ZONE INTERFACE BROADCAST
loc eth1 192.168.1.255</pre><p><code class="filename">/etc/shorewall/hosts</code></p><pre class="programlisting">#ZONE HOSTS
loc1 eth1:192.168.2.0/24</pre><p>If you don't need Shorewall to set up infrastructure to route
traffic between “<span class="quote">loc</span>” and “<span class="quote">loc1</span>”, add these
two policies.</p><p>/etc/shorewall/policy</p><pre class="programlisting">#SOURCE DEST POLICY
loc loc1 NONE
loc1 loc NONE</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="Parallel"></a>Parallel Zones</h4></div></div></div><p>You define both zones in the /etc/shorewall/hosts file to create
two disjoint zones.</p><div><img src="images/MultiZone1B.png" /></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The Router in the above diagram is assumed to NOT be doing
SNAT for the hosts in the 192.168.2.0/24 network.</p></div><p><code class="filename">/etc/shorewall/zones</code></p><pre class="programlisting">#ZONE TYPE OPTIONS
loc1 ipv4
loc2 ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code></p><pre class="programlisting">#ZONE INTERFACE BROADCAST
- eth1 192.168.1.255</pre><p><code class="filename">/etc/shorewall/hosts</code></p><pre class="programlisting">#ZONE HOSTS
loc1 eth1:192.168.1.0/24
loc2 eth1:192.168.2.0/24</pre><p>You don't need Shorewall to set up infrastructure to route
traffic between “<span class="quote">loc</span>” and “<span class="quote">loc1</span>”, so add
these two policies:</p><pre class="programlisting">#SOURCE DEST POLICY
loc1 loc2 NONE
loc2 loc1 NONE</pre></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Special"></a>Some Hosts have Special Firewalling Requirements</h2></div></div></div><p>There are cases where a subset of the addresses associated with an
interface need special handling. Here's an example.</p><div><img src="images/MultiZone2.png" /></div><p>In this example, addresses 192.168.1.8 - 192.168.1.15
(192.168.1.8/29) are to be treated as their own zone (loc1).</p><p><code class="filename">/etc/shorewall/zones</code></p><pre class="programlisting">#ZONE TYPE OPTIONS
loc ipv4
loc1:loc ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code></p><pre class="programlisting">#ZONE INTERFACE BROADCAST
loc eth1 192.168.1.255</pre><p><code class="filename">/etc/shorewall/hosts</code></p><pre class="programlisting">#ZONE HOSTS
loc1 eth1:192.168.1.8/29</pre><p>You probably don't want Shorewall to set up infrastructure to route
traffic between “<span class="quote">loc</span>” and “<span class="quote">loc1</span>” so you should
add these two policies.</p><p><code class="filename">/etc/shorewall/policy</code></p><pre class="programlisting">#SOURCE DEST POLICY
loc loc1 NONE
loc1 loc NONE</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="OneArmed"></a>One-armed Router</h2></div></div></div><p>Nested zones may also be used to configure a
“<span class="quote">one-armed</span>” router (I don't call it a “<span class="quote">firewall</span>”
because it is very insecure. For example, if you connect to the Internet
via cable modem, your next door neighbor has full access to your local
systems as does everyone else connected to the same cable modem head-end
controller). Here eth0 is configured with both a public IP address and an
RFC 1918 address (More on that topic may be found <a class="ulink" href="Shorewall_and_Aliased_Interfaces.html" target="_self">here</a>). Hosts in the
“<span class="quote">loc</span>” zone are configured with their default gateway set to
the Shorewall router's RFC1918 address.</p><div><img src="images/MultiZone3.png" /></div><p><code class="filename">/etc/shorewall/zones</code></p><pre class="programlisting">#ZONE TYPE OPTIONS
net ipv4
loc:net ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code></p><pre class="programlisting">#ZONE INTERFACE BROADCAST
net eth0 detect</pre><p><code class="filename">/etc/shorewall/hosts</code></p><pre class="programlisting">#ZONE HOSTS OPTIONS
loc eth0:192.168.1.0/24 maclist</pre><p><code class="filename"><code class="filename">/etc/shorewall/masq</code></code></p><pre class="programlisting">#INTERFACE SOURCE ADDRESS
eth0:!192.168.1.0/24 192.168.1.0/24</pre><p>Note that the <span class="bold"><strong>maclist</strong></span> option is
specified in <code class="filename">/etc/shorewall/interfaces</code>. This is to
help protect your router from unauthorized access by your friends and
neighbors. Start without <span class="bold"><strong>maclist</strong></span> then add
it and configure your <a class="ulink" href="MAC_Validation.html" target="_self"><code class="filename">/etc/shorewall/maclist</code></a>
file when everything else is working.</p></div></div></body></html>
