<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>VPN, Netfilter and Shorewall — The Basics</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="id257523"></a>VPN, Netfilter and Shorewall — The Basics</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">Tom</span> <span class="surname">Eastep</span></h3></div></div></div><div><p class="copyright">Copyright © 2004, 2005, 2006 Thomas M. Eastep</p></div><div><div class="legalnotice"><a id="id257913"></a><p>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“<span class="quote"><a class="ulink" href="GnuCopyright.htm" target="_self">GNU Free Documentation
License</a></span>”.</p></div></div><div><p class="pubdate">2008/12/15</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#Taxonomy">Gateway-to-gateway traffic vs. Host-to-host traffic.</a></span></dt><dt><span class="section"><a href="#Netfilter">Relationship to Netfilter</a></span></dt><dt><span class="section"><a href="#Shorewall">What does this mean with Shorewall?</a></span></dt><dt><span class="section"><a href="#Zones">Defining Remote Zones</a></span></dt><dt><span class="section"><a href="#Traffic">Allowing Traffic</a></span></dt><dt><span class="section"><a href="#Policies">Different Firewall Policies for Different Remote Systems</a></span></dt><dt><span class="section"><a href="#tunnels">Eliminating the /etc/shorewall/tunnels file</a></span></dt><dd><dl><dt><span class="section"><a href="#IPSEC">IPSEC</a></span></dt><dt><span class="section"><a href="#PPTP">PPTP</a></span></dt><dt><span class="section"><a href="#OpenVPN">OpenVPN</a></span></dt></dl></dd><dt><span class="section"><a href="#id302303">Links to Other VPN Articles at shorewall.net</a></span></dt></dl></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Taxonomy"></a>Gateway-to-gateway traffic vs. Host-to-host traffic.</h2></div></div></div><p>The purpose of a <em class="firstterm">Virtual Private Network</em>
(VPN) is to provide for secure communication between a set of hosts.
Communication between a pair of hosts connected by a VPN occurs in
stages:</p><div class="orderedlist"><ol type="1"><li><p><span class="bold"><strong>Local-host-to-local-gateway</strong></span>.
This communication is not encrypted; in the case where the traffic
originates on the gateway itself, the communication is local to that
system.</p></li><li><p><span class="bold"><strong>Local-gateway-to-remote-gateway</strong></span>. This
communication is encrypted and can use a tunneling protocol such as
GRE, AH or ESP or a standard protocol such as UDP or TCP. Some VPNs
use multiple protocols; for example PPTP uses TCP port 1723 and GRE
while IPSEC uses UDP port 500 together with ESP or AH.</p></li><li><p><span class="bold"><strong>Remote-gateway-to-remote-host</strong></span>.
This is just the unencrypted traffic described in the first item as it
is delivered to its destination.</p></li></ol></div><p>Of course, one-way communication generally isn't useful so we need
traffic in the other direction as well.</p><div class="orderedlist"><ol type="1"><li><p><span class="bold"><strong>Remote-host-to-remote-gateway</strong></span>.</p></li><li><p><span class="bold"><strong>Remote-gateway-to-local-gateway</strong></span>.</p></li><li><p><span class="bold"><strong>Local-gateway-to-local-host</strong></span>.</p></li></ol></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Netfilter"></a>Relationship to Netfilter</h2></div></div></div><p>When Netfilter is configured on a VPN gateway, each VPN packet goes
through Netfilter twice! Let's first consider outbound traffic:</p><div class="orderedlist"><ol type="1"><li><p><span class="bold"><strong>Local-host-to-local-gateway</strong></span>.
This traffic has a source address in the local network or on the
gateway itself. The destination IP address is that of a remote host;
either the remote gateway itself or a host behind that gateway.</p></li><li><p><span class="bold"><strong>Local-gateway-to-remote-gateway.</strong></span> This
(encrypted) traffic has a source IP address on the gateway and is
addressed to the remote gateway.</p></li></ol></div><p>Incoming traffic is similar.</p><div align="center"><img src="images/VPNBasics.png" align="middle" /></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Shorewall"></a>What does this mean with Shorewall?</h2></div></div></div><p>When Shorewall is installed on a VPN gateway system, it categorizes
the VPN-related traffic slightly differently:</p><div class="orderedlist"><ol type="1"><li><p><span class="bold"><strong>Local-host-to-remote-host</strong></span> —
same as <span class="bold"><strong>Local-host-to-local-gateway</strong></span>
above.</p></li><li><p><span class="bold"><strong>Local-gateway-to-remote-gateway</strong></span>.</p></li><li><p><span class="bold"><strong>Remote-gateway-to-local-gateway</strong></span>.</p></li><li><p><span class="bold"><strong>Remote-host-to-local-host</strong></span> —
same as <span class="bold"><strong>Local-gateway-to-local-host</strong></span>
above.</p></li></ol></div><p>Shorewall implements a set of features for dealing with VPN.</p><div class="orderedlist"><ol type="1"><li><p>The <code class="filename">/etc/shorewall/tunnels</code> file. This file
is used to define remote gateways and the type of encrypted traffic
that will be passed between the Shorewall system and those remote
gateways. In other words, the tunnels file deals with <span class="bold"><strong>Local-gateway-to-remote-gateway</strong></span> and <span class="bold"><strong>Remote-gateway-to-local-gateway</strong></span> traffic.</p></li><li><p>The <code class="filename">/etc/shorewall/zones</code> file. An entry in
this file allows you to associated a name with the set of hosts behind
the remote gateway (or to the remote gateway itself if it is a
standalone system).</p></li><li><p>The <code class="filename">/etc/shorewall/interfaces</code> and
<code class="filename">/etc/shorewall/hosts</code> files. These files are used
to associate a set of remote hosts with the zone name defined in
<code class="filename">/etc/shorewall/zones</code>.</p></li><li><p>The <code class="filename">/etc/shorewall/policy </code>and
<code class="filename">/etc/shorewall/rules files</code>. These files are used
to define the connections that are permitted between the remote and
local hosts -- in other words, the <span class="bold"><strong>Local-host-to-remote-host</strong></span> and <span class="bold"><strong>Remote-host-to-local-host</strong></span> traffic.</p></li></ol></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Zones"></a>Defining Remote Zones</h2></div></div></div><p>Most VPN types are implemented using a virtual network device such
as pppN (e.g., ppp0), tunN (e.g., tun0), etc. This means that in most
cases, remote zone definition is similar to zones that you have already
defined.</p><p><code class="filename">/etc/shorewall/zones</code>:</p><pre class="programlisting">#ZONE TYPE
fw firewall
net ipv4
loc ipv4
<span class="bold"><strong>rem ipv4</strong></span></pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTION
net eth0 detect norft1918,routefilter
loc eth1 detect
<span class="bold"><strong>rem ppp0 192.168.10.0/24</strong></span></pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Traffic"></a>Allowing Traffic</h2></div></div></div><p>Normally, you will just allow all traffic between your remote
client(s) and the local zone. You can do that with a couple of
policies:</p><pre class="programlisting">#SOURCE DESTINATION POLICY LEVEL BURST/LIMIT
rem loc ACCEPT
loc rem ACCEPT</pre><p>Similar policies using $FW rather than 'loc' can permit traffic from
the remote clients to/from the firewall.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Policies"></a>Different Firewall Policies for Different Remote Systems</h2></div></div></div><p>The /etc/shorewall/hosts file comes into play when:</p><div class="orderedlist"><ol type="1"><li><p>You have a number of remote networks.</p></li><li><p>The remote networks have different firewall requirements and you
want to divide them into multiple zones.</p></li><li><p>There is no fixed relationship between the remote networks and
virtual network devices (for example, the VPN uses PPTP and remote
gateways connect on demand).</p></li></ol></div><p>In this case, your configuration takes the following
approach:</p><p><code class="filename">etc/shorewall/zones</code>:</p><pre class="programlisting">#ZONE DISPLAY COMMENT
net Internet The big bad net
loc Local Local LAN
<span class="bold"><strong>rem1 Remote1 Remote LAN 1
rem2 Remote2 Remote LAN 2</strong></span></pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTION
net eth0 detect norft1918,routefilter
loc eth1 detect
<span class="bold"><strong>- tun+ -</strong></span></pre><p>/etc/shorewall/hosts:</p><pre class="programlisting">#ZONE HOST(S) OPTIONS
<span class="bold"><strong>rem1 tun+:10.0.0.0/24
rem2 tun+:10.0.1.0/24</strong></span></pre><p>The <code class="filename">/etc/shorewall/hosts</code> file is also used with
<a class="ulink" href="IPSEC-2.6.html" target="_self">kernel 2.6 native IPSEC</a>.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="tunnels"></a>Eliminating the /etc/shorewall/tunnels file</h2></div></div></div><p>The <code class="filename">/etc/shorewall/tunnels</code> file provides no
functionality that could not be implemented using entries in
<code class="filename">/etc/shorewall/rules</code> and I have elimination of the
<code class="filename">/etc/shorewall/tunnels</code> file as a long-term goal. The
following sections show how entries in
<code class="filename">/etc/shorewall/tunnels</code> can be replaced by rules for
some common tunnel types.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="IPSEC"></a>IPSEC</h3></div></div></div><p>/<code class="filename">etc/shorewall/tunnels</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec Z1 1.2.3.4 Z2</pre></blockquote></div><p><code class="filename">/etc/shorewall/rules</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT $FW Z1:1.2.3.4 udp 500
ACCEPT Z1:1.2.3.4 $FW udp 500
ACCEPT $FW Z1:1.2.3.4 50
ACCEPT Z1:1.2.3.4 $FW 50
ACCEPT $FW Z1:1.2.3.4 51
ACCEPT Z1:1.2.3.4 $FW 51
ACCEPT $FW Z2:1.2.3.4 udp 500
ACCEPT Z2:1.2.3.4 $FW udp 500</pre></blockquote></div><p>The "noah" option causes the rules for protocol 51 to be
eliminated. The "ipsecnat" causes UDP port 4500 to be accepted in both
directions. If no GATEWAY ZONE is given then the last two rules above
are omitted.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="PPTP"></a>PPTP</h3></div></div></div><p><code class="filename">/etc/shorewall/tunnels</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE
pptpserver Z1 1.2.3.4</pre></blockquote></div><p>/<code class="filename">etc/shorewall/rules</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW tcp 1723
ACCEPT $FW Z1:1.2.3.4 47
ACCEPT Z1:1.2.3.4 $FW 47</pre></blockquote></div><p>Tunnel type "pptpclient" simply reverses the direction of the tcp
port 1723 rule.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="OpenVPN"></a>OpenVPN</h3></div></div></div><p><code class="filename">/etc/shorewall/tunnels</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE
openvpn:<span class="emphasis"><em>port</em></span> Z1 1.2.3.4</pre></blockquote></div><p><code class="filename">/etc/shorewall/rules</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp <span class="emphasis"><em>port</em></span>
ACCEPT $FW Z1:1.2.3.4 udp <span class="emphasis"><em>port</em></span></pre></blockquote></div><p><code class="filename">/etc/shorewall/tunnels</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE
openvpnclient:<span class="emphasis"><em>port</em></span> Z1 1.2.3.4</pre></blockquote></div><p><code class="filename">/etc/shorewall/rules</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp - <span class="emphasis"><em>port</em></span>
ACCEPT $FW Z1:1.2.3.4 udp <span class="emphasis"><em>port</em></span></pre></blockquote></div><p><code class="filename">/etc/shorewall/tunnels</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE
openvpnserver:<span class="emphasis"><em>port</em></span> Z1 1.2.3.4</pre></blockquote></div><p><code class="filename">/etc/shorewall/rules</code>:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp <span class="emphasis"><em>port</em></span>
ACCEPT $FW Z1:1.2.3.4 udp - <span class="emphasis"><em>port</em></span></pre></blockquote></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id302303"></a>Links to Other VPN Articles at shorewall.net</h2></div></div></div><div class="itemizedlist"><ul type="disc"><li><p><a class="ulink" href="OPENVPN.html" target="_self">OpenVPN</a></p></li><li><p><a class="ulink" href="IPSEC-2.6.html" target="_self">IPSEC</a></p></li><li><p><a class="ulink" href="PPTP.htm" target="_self">PPTP</a></p></li></ul></div></div></div></body></html>
