Re: [Shorewall-users] dynamic blacklisting

[Greg M <subtle1@ho...>]

>Greg M wrote:
>>Hi folks,
>>
>>If I do...
>>
>>shorewall drop x.x.x.x
>>
>>Then I do...
>>
>>shorewall save
>>
>>the blacklist file doesn't seem to be updated.
>
>Did you see anywhere in the documentation that said that it would be 
>updated?

No, it didn't clearly state how or where.
See what I get for assuming... :-)

>/var/lib/shorewall/save.

Thanks!

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

Re: [Shorewall-users] Rules for PPTP?

[j2 <spamfilter2@mu...>]

----- Original Message -----
From: "Tom Eastep" <teastep@...>
To: "j2" <spamfilter2@...>
Cc: <shorewall-users@...>
Sent: Tuesday, July 09, 2002 1:47 AM
Subject: Re: [Shorewall-users] Rules for PPTP?


> On Tue, 9 Jul 2002, j2 wrote:
>
> > Uhm,. one more Q. (This is prolly mor eWindows Networking then
shorewall..
> > but someone might know)
> >
> > i have set the PPTP server to allocate ips on the 192.168.10.[2-10]
range.
> > The server it self is 192.168.0.160.
>
> You shouldn't do that. You should allocate the remote IPs in the
> 192.168.0.0/24 subnet and specify 'proxyarp' in your /etc/ppp/options
> file.

And translated to a "pure windows" enviroment client is outside the
shorewall on a public IP, and the server is as above?

Re: [Shorewall-users] FWD: dns woes

[Tom Eastep <teastep@sh...>]

On Mon, 8 Jul 2002, Jim Van Eeckhoutte wrote:

> ---------- Original Message ----------------------------------
> From: "Jim Van Eeckhoutte" <jim@...>
> Reply-To: <jim@...>
> Date:  Mon,  8 Jul 2002 15:27:14 -0700
> 
> this is shorewall status output:
> 
> tcp      6 431899 ESTABLISHED src=192.168.20.5 dst=64.4.12.45 sport=2185 dport=1863 src=64.4.12.45 dst=63.25.123.58 sport=1863 dport=2185 [ASSURED] use=1
> udp      17 30 src=192.168.20.5 dst=192.168.20.254 sport=2359 dport=53 [UNREPLIED] src=192.168.20.254 dst=192.168.20.5 sport=53 dport=2359 use=1
> tcp      6 431999 ESTABLISHED src=192.168.20.5 dst=192.168.20.254 sport=2130 dport=22 src=192.168.20.254 dst=192.168.20.5 sport=22 dport=2130 [ASSURED] use=1
> udp      17 28 src=192.168.20.5 dst=192.168.20.254 sport=2358 dport=53 [UNREPLIED] src=192.168.20.254 dst=192.168.20.5 sport=53 dport=2358 use=1
> 
> i have dnscache.lrp and daemontl.lrp running on bering box. When setting
> client to point to bering router as dns , it cant resolve. Is there a
> reason why the above is UNREPLIED?

Because either dnscache hasn't replied (do you have rules allowing DNS 
queries from the firewall to the internet at large?) or you have a routing 
problem such that there isn't a route back to 192.168.20.5 (I think you 
would have noticed that before however).

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] Rules for PPTP?

[Tom Eastep <teastep@sh...>]

On Tue, 9 Jul 2002, j2 wrote:

> Uhm,. one more Q. (This is prolly mor eWindows Networking then shorewall..
> but someone might know)
> 
> i have set the PPTP server to allocate ips on the 192.168.10.[2-10] range.
> The server it self is 192.168.0.160.

You shouldn't do that. You should allocate the remote IPs in the 
192.168.0.0/24 subnet and specify 'proxyarp' in your /etc/ppp/options 
file.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] Rules for PPTP?

[j2 <spamfilter2@mu...>]

Uhm,. one more Q. (This is prolly mor eWindows Networking then shorewall..
but someone might know)

i have set the PPTP server to allocate ips on the 192.168.10.[2-10] range.
The server it self is 192.168.0.160. Now, is it possible to add routing on
the W2k server so that a client connected to pptp can access shares on
192.168.0.130?

Re: [Shorewall-users] dynamic blacklisting

[Tom Eastep <teastep@sh...>]

Greg M wrote:
> Hi folks,
> 
> If I do...
> 
> shorewall drop x.x.x.x
> 
> Then I do...
> 
> shorewall save
> 
> the blacklist file doesn't seem to be updated.

Did you see anywhere in the documentation that said that it would be 
updated?

> 
> http://www.shorewall.net/blacklisting_support.htm states "save the 
> dynamic blacklisting configuration so that it will be automatically 
> restored the next time that the firewall is restarted".
> 
> This infers the blacklisted ip's will be saved, but where?

/var/lib/shorewall/save.

> 
> Am I misinterpreting the documentation on how this feature works?

Yes and No

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] Rules for PPTP?

[Tom Eastep <teastep@sh...>]

j2 wrote:
>>>I tried the following as per the Documentation, but i get
>>>
>>>#
>>>#PPTP
>>>DNAT           net     loc     tcp     1723
>>>DNAT           net     loc     47      -
>>>#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
>>>
>>>Error: DNAT rules require a  server address; rule: "DNAT net loc tcp
>>
> 1723"
> 
>>Did you mean to have a dash in the first rule????

No.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

[Shorewall-users] dynamic blacklisting

[Greg M <subtle1@ho...>]

Hi folks,

If I do...

shorewall drop x.x.x.x

Then I do...

shorewall save

the blacklist file doesn't seem to be updated.

http://www.shorewall.net/blacklisting_support.htm states "save the dynamic 
blacklisting configuration so that it will be automatically restored the 
next time that the firewall is restarted".

This infers the blacklisted ip's will be saved, but where?

Am I misinterpreting the documentation on how this feature works?

I'm using shorewall-1.3.2-1 RPM package on Mandrake 8.2.

Thanks,

Greg

_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com

Re: [Shorewall-users] Rules for PPTP?

[j2 <spamfilter2@mu...>]

> Duh -- looks like I get to wear the pointy hat this time. Try:
> 
> DNAT           net     loc:192.168.0.160     tcp     1723
> DNAT           net     loc:192.168.0.160     47      -

Worked (and looks) better.. but i figured "THIS time ill just gobythebook"

Thanks :)

[Shorewall-users] FWD: dns woes

[Jim Van Eeckhoutte <jim@va...>]

---------- Original Message ----------------------------------
From: "Jim Van Eeckhoutte" <jim@...>
Reply-To: <jim@...>
Date:  Mon,  8 Jul 2002 15:27:14 -0700

this is shorewall status output:

tcp      6 431899 ESTABLISHED src=192.168.20.5 dst=64.4.12.45 sport=2185 dport=1863 src=64.4.12.45 dst=63.25.123.58 sport=1863 dport=2185 [ASSURED] use=1
udp      17 30 src=192.168.20.5 dst=192.168.20.254 sport=2359 dport=53 [UNREPLIED] src=192.168.20.254 dst=192.168.20.5 sport=53 dport=2359 use=1
tcp      6 431999 ESTABLISHED src=192.168.20.5 dst=192.168.20.254 sport=2130 dport=22 src=192.168.20.254 dst=192.168.20.5 sport=22 dport=2130 [ASSURED] use=1
udp      17 28 src=192.168.20.5 dst=192.168.20.254 sport=2358 dport=53 [UNREPLIED] src=192.168.20.254 dst=192.168.20.5 sport=53 dport=2358 use=1

i have dnscache.lrp and daemontl.lrp running on bering box. When setting client to point to bering router as dns , it cant resolve. Is there a reason why the above is UNREPLIED?

Re: [Shorewall-users] Rules for PPTP?

[Tom Eastep <teastep@sh...>]

j2 wrote:
> I tried the following as per the Documentation, but i get
> 
> #
> #PPTP
> DNAT           net     loc     tcp     1723
> DNAT           net     loc     47      -
> #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
> 
> Error: DNAT rules require a  server address; rule: "DNAT net loc tcp 1723"
> 
> when doing a check/restart?
> 
> Firewall with one public IP. A w2k Pro living behind it is to act as PPTP
> server on 192.168.0.160. Uhm i am sure i am missing some RTFM (but i DID
> read the errata this time Tom, promise! ;) )
> 

Duh -- looks like I get to wear the pointy hat this time. Try:

DNAT           net     loc:192.168.0.160     tcp     1723
DNAT           net     loc:192.168.0.160     47      -

And I'll fix the documentation...

-Tom

-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] Rules for PPTP?

[j2 <spamfilter2@mu...>]

> > I tried the following as per the Documentation, but i get
> >
> > #
> > #PPTP
> > DNAT           net     loc     tcp     1723
> > DNAT           net     loc     47      -
> > #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
> >
> > Error: DNAT rules require a  server address; rule: "DNAT net loc tcp
1723"
> >
>
> Did you mean to have a dash in the first rule????

http://www.shorewall.net/PPTP.htm I stole the config from there. What _do_ i
want then?

[Shorewall-users] Rules for PPTP?

[j2 <spamfilter2@mu...>]

I tried the following as per the Documentation, but i get

#
#PPTP
DNAT           net     loc     tcp     1723
DNAT           net     loc     47      -
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Error: DNAT rules require a  server address; rule: "DNAT net loc tcp 1723"

when doing a check/restart?

Firewall with one public IP. A w2k Pro living behind it is to act as PPTP
server on 192.168.0.160. Uhm i am sure i am missing some RTFM (but i DID
read the errata this time Tom, promise! ;) )

[Shorewall-users] Shorewall 1.3.3 Debian Packages

[Tom Eastep <teastep@sh...>]

Lorenzo Marignoni reports that the packages are available at 
http://security.dsi.unimi.it/~lorenzo/debian.html.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] How can I secure samba dmz <> loc?

[Tom Eastep <teastep@sh...>]

Tom Eastep wrote:

> 
> 
> A VPN would be more secure but it definitely isn't easier. And given 
> that your firewall runs Bering, I suspend that you don't want to add
                                     -------

Make that "suspect" :-)

> large packages to your firewall?
> 

I knew I should have stayed on vacation...

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

Re: [Shorewall-users] How can I secure samba dmz <> loc?

[Tom Eastep <teastep@sh...>]

Steve Sobka wrote:
> 
> Everything DOES work, but I am wondering if there is some easier way to go
> about this? Like using aVPN or somthing similar? I just have no idea what to
> look for if there is a better way, or what it would be called?

A VPN would be more secure but it definitely isn't easier. And given 
that your firewall runs Bering, I suspend that you don't want to add 
large packages to your firewall?

> 
> Could anyone make a suggestion on a more secure way of accomplishing the
> same task?

Do any of the boxes behind your firewall support a VPN server (W2K, NT 
Server)? If so, setting one of them up as a VPN server then using your 
laptop as a VPN client would probably be the easiest.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@...

[Shorewall-users] How can I secure samba dmz <> loc?

[Steve Sobka <hickbot@fu...>]

I am not sure if this setup is correct, or if I could go about doing this in
a more secure manner. I thought I would post here for suggestions.

I have a somewhat strange setup here at my house.

I have a leaf-bering box running shorewall 1.3.1. I get my IP via DHCP from
cable company.  I have a 3 nic setup.

I have most of my computers in the loc zone, including a Samba Server at
192.168.1.200.

I use the setup:

loc=192.168.1.0/24
dmz =192.168.2.0/24

Now the only thing I have in the dmz zome is a wireless router (not an
Access Point).  It was given to me free and I use it to allow me access to
the internet while walking around the house.
Now this router will not let me put the WAN and LAN ip's on the same subnet
(i.e. wont allow both WAN and LAN on the 192.168.2.0/24), therefore I put
the routers WAN IP at 192.168.2.253 so it's on the subnet of the leaf-bering
box and the LAN IP as 10.150.150.1 and my wireless nic on my laptop as
10.150.150.2 with the .1 address of the wireless router specified as the
gateway, dns, etc for my laptop and it works fine, I can browse the internet
and connect to the Samba shares on the loc zone.

Since I wanted to allow samba between the wireless NIC at 10.150.150.2 and
the samba server on the loc zone at 192.168.1.200.

I've added this to my rules file:

ACCEPT          dmz     loc                     udp     137:139
ACCEPT          dmz     loc                     tcp     137,139
ACCEPT          dmz     loc                     udp     1024:           137
ACCEPT          loc     dmz                     udp     137:139
ACCEPT          loc     dmz                     tcp     137,139
ACCEPT          loc     dmz                     udp     1024:           137

Everything DOES work, but I am wondering if there is some easier way to go
about this? Like using aVPN or somthing similar? I just have no idea what to
look for if there is a better way, or what it would be called?

Could anyone make a suggestion on a more secure way of accomplishing the
same task?
All I really want to do is allow my laptop to browse the internet and
connect to shares & printers on the loc zone, but I really dont want to open
the loc zone up to the entire dmz incase someone hitches a free ride onto my
wireless router.

I hope that made sense :-)

Steve Sobka