1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<article>
<!--$Id$-->
<articleinfo>
<title>Shorewall Init</title>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
</author>
</authorgroup>
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright>
<year>2010</year>
<holder>Thomas M. Eastep</holder>
</copyright>
<legalnotice>
<para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice>
</articleinfo>
<section>
<title>Introduction</title>
<para>The Shorewall init scripts released from shorewall.net and by most
distributions start Shorewall after networking. This allows Shorewall to
detect the network configuration and taylor itself accordingly. It is
possible to start Shorewall prior to networking but doing so limits the
set of Shorewall features that can be used.</para>
<para>When Shorewall starts after networking, there is the possibility of
unwanted connections being accepted between the time that an interface
comes up and the time that Shorewall has finished starting up. Also,
Shorewall has had no means of reacting when interfaces are brought up and
down.</para>
<para>Beginning with Shorewall 4.4.10, a new package, <firstterm>Shorewall
Init</firstterm>, is available. Shorewall Init serves two purposes:</para>
<orderedlist>
<listitem>
<para>It can 'close' the firewall before the network interfaces are
brought up during boot.</para>
</listitem>
<listitem>
<para>It can change the firewall state as the result of interfaces
being brought up or taken down.</para>
</listitem>
</orderedlist>
<para>These two features can be controlled independently. Shorewall Init
can be used together with any combination of the other Shorewall packages.
Shorewall-init works on RedHat-based, SuSE-based and Debian-based
distributions.</para>
</section>
<section id="Close">
<title>Closing the Firewall before the Network Interfaces are brought
up</title>
<para>When Shorewall-init is first installed, it does nothing until you
configure it.</para>
<para>The configuration file is <filename>/etc/default/shorewall-init
</filename>on Debian-based systems and
<filename>/etc/sysconfig/shorewall-init</filename> otherwise. There are
two settings in the file:</para>
<variablelist>
<varlistentry>
<term>PRODUCTS</term>
<listitem>
<para>Lists the Shorewall packages that you want to integrate with
Shorewall-init.</para>
<para>Example: PRODUCTS="shorewall shorewall6"</para>
</listitem>
</varlistentry>
<varlistentry>
<term>IFUPDOWN</term>
<listitem>
<para>When set to 1, enables integration with NetworkManager and the
ifup/ifdown scripts.</para>
</listitem>
</varlistentry>
</variablelist>
<para>To close your firewall before networking starts:</para>
<orderedlist numeration="loweralpha">
<listitem>
<para>In the Shorewall-init configuration file, set PRODUCTS to the
firewall products installed on your system.</para>
</listitem>
<listitem>
<para>Be sure that your current firewall script(s) (normally in
<filename>/var/lib/<product>/firewall</filename>) is(are)
compiled with the 4.4.10 compiler.</para>
<para>Shorewall and Shorewall6 users can execute these
commands:</para>
<simplelist>
<member>shorewall compile</member>
<member><command>shorewall6 compile</command></member>
</simplelist>
<para>Shorewall-lite and Shorewall6-lite users can execute these
commands on the administrative system:</para>
<simplelist>
<member><command>shorewall export
<replaceable>firewall-name-or-ip-address</replaceable></command></member>
<member><command>shorewall6 export
<replaceable>firewall-name-or-ip-address</replaceable></command></member>
</simplelist>
</listitem>
</orderedlist>
<para>That's all that is required.</para>
</section>
<section id="NM">
<title>Integration with NetworkManager and ifup/ifdown Scripts</title>
<para>To integrate with NetworkManager and ifup/ifdown, additional steps
are required. You probably don't want to enable this feature if you run a
link status monitor like FOOLSM.</para>
<orderedlist numeration="loweralpha">
<listitem>
<para>In the Shorewall-init configuration file, set IFUPDOWN=1.</para>
</listitem>
<listitem>
<para>In your Shorewall interfaces file(s), set the
<option>required</option> option on any interfaces that must be up in
order for the firewall to start. At least one interface must have the
<option>required</option> or <option>optional</option> option if you
perform the next optional step.</para>
</listitem>
<listitem>
<para>Optional) -- If you have specified at least one
<option>required</option> or <option>optional</option> interface, you
can then disable automatic firewall startup at boot time. On Debian
systems, set startup=0 in
<filename>/etc/default/<replaceable>product</replaceable></filename>.
On other systems, use your service startup configuration tool
(chkconfig, insserv, ...) to disable startup.</para>
<warning>
<para>If your system uses Upstart as it's system initialization
daemon, you should not disable startup. Upstart is standard on
recent Ubuntu and Fedora releases and is optional on Debian.</para>
</warning>
</listitem>
</orderedlist>
<para>The following actions occur when an interface comes up:</para>
<informaltable>
<tgroup cols="3">
<tbody>
<row>
<entry><emphasis role="bold">FIREWALL STATE</emphasis></entry>
<entry><emphasis role="bold">INTERFACE</emphasis></entry>
<entry><emphasis role="bold">ACTION</emphasis></entry>
</row>
<row>
<entry>Any</entry>
<entry>Required</entry>
<entry>start</entry>
</row>
<row>
<entry>stopped</entry>
<entry>Optional</entry>
<entry>start</entry>
</row>
<row>
<entry>started</entry>
<entry>Optional</entry>
<entry>enable</entry>
</row>
<row>
<entry>started</entry>
<entry>Any</entry>
<entry>restart</entry>
</row>
</tbody>
</tgroup>
</informaltable>
<para>The following actions occur when an interface goes down:</para>
<informaltable>
<tgroup cols="3">
<tbody>
<row>
<entry><emphasis role="bold">FIREWALL STATE</emphasis></entry>
<entry><emphasis role="bold">INTERFACE</emphasis></entry>
<entry><emphasis role="bold">ACTION</emphasis></entry>
</row>
<row>
<entry>Any</entry>
<entry>Required</entry>
<entry>stop</entry>
</row>
<row>
<entry>stopped</entry>
<entry>Optional</entry>
<entry>start</entry>
</row>
<row>
<entry>started</entry>
<entry>Optional</entry>
<entry>disable</entry>
</row>
<row>
<entry>started</entry>
<entry>Any</entry>
<entry>restart</entry>
</row>
</tbody>
</tgroup>
</informaltable>
<para>For optional interfaces, the
<filename>/var/lib/<replaceable>product</replaceable>/<replaceable>interface</replaceable>.state</filename>
files are maintained to reflect the state of the interface so that they
may be used by the standard <firstterm>isusable</firstterm> script. Please
note that the action is carried out using the current compiled script; the
configuration is not recompiled.</para>
<para>A new option has been added to <filename>shorewall.conf</filename>
and <filename>shorewall6.conf</filename>. The REQUIRE_INTERFACE option
determines the outcome when an attempt to start/restart/restore/refresh
the firewall is made and none of the optional interfaces are available.
With REQUIRE_INTERFACE=No (the default), the operation is performed. If
REQUIRE_INTERFACE=Yes, then the operation fails and the firewall is placed
in the stopped state. This option is suitable for a laptop with both
ethernet and wireless interfaces. If either come up, the firewall starts.
If neither comes up, the firewall remains in the stopped state.</para>
<para>Similarly, if an optional interface goes down and there are no
optional interfaces remaining in the up state, then the firewall is
stopped.</para>
<para>On Debian-based systems, during system shutdown the firewall is
opened prior to network shutdown (<command>/etc/init.d/shorewall
stop</command> performs a 'clear' operation rather than a 'stop'). This is
required by Debian standards. You can change this default behavior by
setting SAFESTOP=1 in <filename>/etc/default/shorewall</filename>
(<filename>/etc/default/shorewall6</filename>, ...).</para>
</section>
</article>
|
