1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<article>
<!--$Id$-->
<articleinfo>
<title>VPN, Netfilter and Shorewall — The Basics</title>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
</author>
</authorgroup>
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright>
<year>2004</year>
<year>2005</year>
<year>2006</year>
<holder>Thomas M. Eastep</holder>
</copyright>
<legalnotice>
<para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice>
</articleinfo>
<section id="Taxonomy">
<title>Gateway-to-gateway traffic vs. Host-to-host traffic.</title>
<para>The purpose of a <firstterm>Virtual Private Network</firstterm>
(VPN) is to provide for secure communication between a set of hosts.
Communication between a pair of hosts connected by a VPN occurs in
stages:</para>
<orderedlist>
<listitem>
<para><emphasis role="bold">Local-host-to-local-gateway</emphasis>.
This communication is not encrypted; in the case where the traffic
originates on the gateway itself, the communication is local to that
system.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Local-gateway-to-remote-gateway</emphasis>. This
communication is encrypted and can use a tunneling protocol such as
GRE, AH or ESP or a standard protocol such as UDP or TCP. Some VPNs
use multiple protocols; for example PPTP uses TCP port 1723 and GRE
while IPSEC uses UDP port 500 together with ESP or AH.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Remote-gateway-to-remote-host</emphasis>.
This is just the unencrypted traffic described in the first item as it
is delivered to its destination.</para>
</listitem>
</orderedlist>
<para>Of course, one-way communication generally isn't useful so we need
traffic in the other direction as well.</para>
<orderedlist>
<listitem>
<para><emphasis
role="bold">Remote-host-to-remote-gateway</emphasis>.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Remote-gateway-to-local-gateway</emphasis>.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Local-gateway-to-local-host</emphasis>.</para>
</listitem>
</orderedlist>
</section>
<section id="Netfilter">
<title>Relationship to Netfilter</title>
<para>When Netfilter is configured on a VPN gateway, each VPN packet goes
through Netfilter twice! Let's first consider outbound traffic:</para>
<orderedlist>
<listitem>
<para><emphasis role="bold">Local-host-to-local-gateway</emphasis>.
This traffic has a source address in the local network or on the
gateway itself. The destination IP address is that of a remote host;
either the remote gateway itself or a host behind that gateway.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Local-gateway-to-remote-gateway.</emphasis> This
(encrypted) traffic has a source IP address on the gateway and is
addressed to the remote gateway.</para>
</listitem>
</orderedlist>
<para>Incoming traffic is similar.</para>
<graphic align="center" fileref="images/VPNBasics.png" />
</section>
<section id="Shorewall">
<title>What does this mean with Shorewall?</title>
<para>When Shorewall is installed on a VPN gateway system, it categorizes
the VPN-related traffic slightly differently:</para>
<orderedlist>
<listitem>
<para><emphasis role="bold">Local-host-to-remote-host</emphasis> —
same as <emphasis role="bold">Local-host-to-local-gateway</emphasis>
above.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Local-gateway-to-remote-gateway</emphasis>.</para>
</listitem>
<listitem>
<para><emphasis
role="bold">Remote-gateway-to-local-gateway</emphasis>.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Remote-host-to-local-host</emphasis> —
same as <emphasis role="bold">Local-gateway-to-local-host</emphasis>
above.</para>
</listitem>
</orderedlist>
<para>Shorewall implements a set of features for dealing with VPN.</para>
<orderedlist>
<listitem>
<para>The <filename>/etc/shorewall/tunnels</filename> file. This file
is used to define remote gateways and the type of encrypted traffic
that will be passed between the Shorewall system and those remote
gateways. In other words, the tunnels file deals with <emphasis
role="bold">Local-gateway-to-remote-gateway</emphasis> and <emphasis
role="bold">Remote-gateway-to-local-gateway</emphasis> traffic.</para>
</listitem>
<listitem>
<para>The <filename>/etc/shorewall/zones</filename> file. An entry in
this file allows you to associated a name with the set of hosts behind
the remote gateway (or to the remote gateway itself if it is a
standalone system).</para>
</listitem>
<listitem>
<para>The <filename>/etc/shorewall/interfaces</filename> and
<filename>/etc/shorewall/hosts</filename> files. These files are used
to associate a set of remote hosts with the zone name defined in
<filename>/etc/shorewall/zones</filename>.</para>
</listitem>
<listitem>
<para>The <filename>/etc/shorewall/policy </filename>and
<filename>/etc/shorewall/rules files</filename>. These files are used
to define the connections that are permitted between the remote and
local hosts -- in other words, the <emphasis
role="bold">Local-host-to-remote-host</emphasis> and <emphasis
role="bold">Remote-host-to-local-host</emphasis> traffic.</para>
</listitem>
</orderedlist>
</section>
<section id="Zones">
<title>Defining Remote Zones</title>
<para>Most VPN types are implemented using a virtual network device such
as pppN (e.g., ppp0), tunN (e.g., tun0), etc. This means that in most
cases, remote zone definition is similar to zones that you have already
defined.</para>
<para><filename>/etc/shorewall/zones</filename>:</para>
<programlisting>#ZONE TYPE
fw firewall
net ipv4
loc ipv4
<emphasis role="bold">rem ipv4</emphasis></programlisting>
<para><filename>/etc/shorewall/interfaces</filename>:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTION
net eth0 - tcpflags,routefilter
loc eth1 -
<emphasis role="bold">rem ppp0 -</emphasis></programlisting>
</section>
<section id="Traffic">
<title>Allowing Traffic</title>
<para>Normally, you will just allow all traffic between your remote
client(s) and the local zone. You can do that with a couple of
policies:</para>
<programlisting>#SOURCE DESTINATION POLICY LEVEL BURST/LIMIT
rem loc ACCEPT
loc rem ACCEPT</programlisting>
<para>Similar policies using $FW rather than 'loc' can permit traffic from
the remote clients to/from the firewall.</para>
</section>
<section id="Policies">
<title>Different Firewall Policies for Different Remote Systems</title>
<para>The /etc/shorewall/hosts file comes into play when:</para>
<orderedlist>
<listitem>
<para>You have a number of remote networks.</para>
</listitem>
<listitem>
<para>The remote networks have different firewall requirements and you
want to divide them into multiple zones.</para>
</listitem>
<listitem>
<para>There is no fixed relationship between the remote networks and
virtual network devices (for example, the VPN uses PPTP and remote
gateways connect on demand).</para>
</listitem>
</orderedlist>
<para>In this case, your configuration takes the following
approach:</para>
<para><filename>etc/shorewall/zones</filename>:</para>
<programlisting>#ZONE TYPE OPTIONS
net ipv4
loc ipv4
<emphasis role="bold">rem1 ipv4 #Remote LAN 1
rem2 ipv4 #Remote LAN 2</emphasis></programlisting>
<para><filename>/etc/shorewall/interfaces</filename>:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTION
net eth0 - tcpflags,routefilter
loc eth1 -
<emphasis role="bold">- tun+ -</emphasis></programlisting>
<para>/etc/shorewall/hosts:</para>
<programlisting>#ZONE HOST(S) OPTIONS
<emphasis role="bold">rem1 tun+:10.0.0.0/24
rem2 tun+:10.0.1.0/24</emphasis></programlisting>
<para>The <filename>/etc/shorewall/hosts</filename> file is also used with
<ulink url="IPSEC-2.6.html">kernel 2.6 native IPSEC</ulink>.</para>
</section>
<section id="tunnels">
<title>Eliminating the /etc/shorewall/tunnels file</title>
<para>The <filename>/etc/shorewall/tunnels</filename> file provides no
functionality that could not be implemented using entries in
<filename>/etc/shorewall/rules</filename> and I have elimination of the
<filename>/etc/shorewall/tunnels</filename> file as a long-term goal. The
following sections show how entries in
<filename>/etc/shorewall/tunnels</filename> can be replaced by rules for
some common tunnel types.</para>
<section id="IPSEC">
<title>IPSEC</title>
<para>/<filename>etc/shorewall/tunnels</filename>:</para>
<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
ipsec Z1 1.2.3.4 Z2</programlisting>
</blockquote>
<para><filename>/etc/shorewall/rules</filename>:</para>
<blockquote>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT $FW Z1:1.2.3.4 udp 500
ACCEPT Z1:1.2.3.4 $FW udp 500
ACCEPT $FW Z1:1.2.3.4 50
ACCEPT Z1:1.2.3.4 $FW 50
ACCEPT $FW Z1:1.2.3.4 51
ACCEPT Z1:1.2.3.4 $FW 51
ACCEPT $FW Z2:1.2.3.4 udp 500
ACCEPT Z2:1.2.3.4 $FW udp 500</programlisting>
</blockquote>
<para>The "noah" option causes the rules for protocol 51 to be
eliminated. The "ipsecnat" causes UDP port 4500 to be accepted in both
directions. If no GATEWAY ZONE is given then the last two rules above
are omitted.</para>
</section>
<section id="PPTP">
<title>PPTP</title>
<para><filename>/etc/shorewall/tunnels</filename>:</para>
<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
pptpserver Z1 1.2.3.4</programlisting>
</blockquote>
<para>/<filename>etc/shorewall/rules</filename>:</para>
<blockquote>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW tcp 1723
ACCEPT $FW Z1:1.2.3.4 47
ACCEPT Z1:1.2.3.4 $FW 47</programlisting>
</blockquote>
<para>Tunnel type "pptpclient" simply reverses the direction of the tcp
port 1723 rule.</para>
</section>
<section id="OpenVPN">
<title>OpenVPN</title>
<para><filename>/etc/shorewall/tunnels</filename>:</para>
<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
openvpn:<emphasis>port</emphasis> Z1 1.2.3.4</programlisting>
</blockquote>
<para><filename>/etc/shorewall/rules</filename>:</para>
<blockquote>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp <emphasis>port</emphasis>
ACCEPT $FW Z1:1.2.3.4 udp <emphasis>port</emphasis></programlisting>
</blockquote>
<para><filename>/etc/shorewall/tunnels</filename>:</para>
<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
openvpnclient:<emphasis>port</emphasis> Z1 1.2.3.4</programlisting>
</blockquote>
<para><filename>/etc/shorewall/rules</filename>:</para>
<blockquote>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp - <emphasis>port</emphasis>
ACCEPT $FW Z1:1.2.3.4 udp <emphasis>port</emphasis></programlisting>
</blockquote>
<para><filename>/etc/shorewall/tunnels</filename>:</para>
<blockquote>
<programlisting>#TYPE ZONE GATEWAY GATEWAY ZONE
openvpnserver:<emphasis>port</emphasis> Z1 1.2.3.4</programlisting>
</blockquote>
<para><filename>/etc/shorewall/rules</filename>:</para>
<blockquote>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT PORT(S)
ACCEPT Z1:1.2.3.4 $FW udp <emphasis>port</emphasis>
ACCEPT $FW Z1:1.2.3.4 udp - <emphasis>port</emphasis></programlisting>
</blockquote>
</section>
</section>
<section>
<title>Links to Other VPN Articles at shorewall.net</title>
<itemizedlist>
<listitem>
<para><ulink url="OPENVPN.html">OpenVPN</ulink></para>
</listitem>
<listitem>
<para><ulink url="IPSEC-2.6.html">IPSEC</ulink></para>
</listitem>
<listitem>
<para><ulink url="PPTP.htm">PPTP</ulink></para>
</listitem>
</itemizedlist>
</section>
</article>
|
