Setup Shorewall to function as a router on Debian

Topics including TCP/IP, OSI, Netbios, exploiting share, proxies and much more
Post Reply
Posts: 2
Joined: Sun Oct 26, 2008 5:37 pm

Setup Shorewall to function as a router on Debian

Post by BlueIce » Sun Jan 10, 2010 11:50 am

This is a how to setup Shorewall 4.4 on Debian Squeeze to function as a router (dhcp, dns, firewall).

This guide assumes you have some basic knowledge of linux (shell) and networking though it is recommended that you have basic knowledge about the following.

* networking
* DHCP – what is it used for
* DNS – what is it used for
* firewalls – same

If something is unclear in regard to protocols, or other tech thingies i recommend using Google / Wikipedia though you should know this already, if not.. go back to school.

Setting up Debian

Make sure you have a box setup with debian, debian runs fine from a USB stick so if you want it quiet, do that. A minimum Debian install is sufficient. Though it usually isn’t recommended, during the installation and configuration i tend to do everything as root so i don’t get annoyed with permissions problems. Furthermore 2 ethernet cards are required for a basic setup. I recommend installing atleast openssh-server and telnet so we can do some troubleshooting and manage it remotely.

Code: Select all

~# apt-get install openssh-server telnet
The idea for the network setup is quite simple, most dsl/broadband providers give you a modem / router that gives you an address by DHCP. So for most setups this is suitable though not all. Make sure you know the difference between eth0 and eth1. If you were able to install the package above, most likely this means your internet connection is working, to confirm lets ping google 2 times.

Code: Select all

~# ping -c2
PING (x.x.x.x) 56(84) bytes of data.
64 bytes from (x.x.x.x): icmp_seq=1 ttl=54 time=17.7 ms
64 bytes from (x.x.x.x): icmp_seq=2 ttl=54 time=50.4 ms
If you get a timeout, try pinging some other site or an ip and go on further when your connection is working.
Setting up your ip ranges

Computers are reached via certain routes in which it’s defined for what ip range to use what gateway and go where. To find out what’s your WAN nic type the following and find out what nic is used for your ‘default’ route.

~# ip route ls dev eth0 proto kernel scope link src
default via dev eth0

If you have a 10.x.x.x (/8) or 192.168.x.x (/16) or 172.16.x.x-172.31.x.x address make sure you use a different one for you internal network. More about these private addresses can be found at Wikipedia

We assume that eth0 is your WAN interface (the card where the internet is on). Now find out what other card you have using for e.g. mii-tool, lspci or ifconfig -a . We assume it’s eth1. Now setup an internal ip for it. We can do this in the /etc/network/interfaces file. Edit this using your favorite editor (nano, pico, vi, mc).

Code: Select all

~# vi /etc/networking/interfaces
You will probably find a line there

Code: Select all

allow-hotplug eth0
iface eth0 inet dhcp
append the following lines for your internal network i like to use since its quick to type. note: if eth0 has such an address go with a 192.168.x.x instead.

Code: Select all

auto eth1
iface eth1 inet static
Time to restart your network interfaces and see if they are up

Code: Select all

~# /etc/init.d/networking restart
The following should also list your new defined interface

Code: Select all

~# ip route ls
Congratulations, now we have setup a basic network.
Setting up Shorewall

Lets install shorewall some dependencies should be installed as well.

Code: Select all

~# apt-get install shorewall
Your default configuration directory is /etc/shorewall but on debian it’s empty by default so lets copy over some basics.

Code: Select all

~# cp /usr/share/doc/shorewall/examples/two-interfaces/* /etc/shorewall
By default shorewall is switched off, lets switch it on

Code: Select all

~# vi /etc/default/shorewall
and change startup=0 to startup=1

/etc/shorewall/ contains the following files

* interfaces – contains mapping information
* masq – used for masquerading (snat)
* policy – global policies for allowing or blocking traffic
* routestopped – allows the box to be reachable via this interface if shorewall is switched off
* rules – specific rules for your firewall
* shorewall.conf -global configuration
* zones – zone definition

At this point you should take a look in the files and see what it does.

In the zones file you will find definitions for the zones.

fw – the firewall itself
net – the internet
loc – your local (safe) network

these definitions are used throughout the shorewall configs so make yourself familiar.

now lets edit the interfaces file, this defines what interface is used for what zone.

Set your interfaces correctly and add the ‘dhcp’ option for the local zone.

Code: Select all

net      eth0         detect       dhcp,tcpflags,nosmurfs,routefilter,logmartians
loc      eth1         detect       dhcp,tcpflags,nosmurfs,routefilter,logmartians
lets change some options in the shorewall.conf file.




Lets setup masqerading since if we request Google from inside the network, we want Google to reply to our WAN address and not to 10.0.0.X .

edit the masquerading file and make sure it’s set to your wan interface (eth0)

Code: Select all

eth3  ,\

We also want to use DHCP and DNS for computers in the local network. Therefore we can either add a policy to allow communications from the local network to the firewall and vicaversa, or just open up specific ports
Option 1; policy

Allow communications from the local network to the firewall and back

Code: Select all

~# vi /etc/shorewall/policy
loc        net        ACCEPT
net        all        DROP        info
all        all        REJECT      info
and append the following above the last line

Code: Select all

loc        $FW        ACCEPT
$FW        loc        ACCEPT
If you want the ability to connect to the internet from your firewall (download stuff to your new router for e.g) also add the following

Code: Select all

$FW        net        ACCEPT
Option 2; rules

Edit the rules file and append some extra rules after the following:

Code: Select all

Ping(ACCEPT)    loc        $FW

Code: Select all

DNS(ACCEPT)        loc                     $FW
DNS(ACCEPT)       $FW                     loc
DHCP Should already be allowed since we added that option the the interfaces file.
Installing DHCP and DNS

There are several programs that give those feature though dnsmasq is easy to use and configure.

Code: Select all

~# apt-get install dnsmasq
Now we need to setup dnsmasq to function as a DHCP server, and serve DNS requests.

If we just wanted it to function as a nameserver, we are done configuring. dnsmasq does this by default.

Though to make life easy, lets setup a DHCP server.

Code: Select all

~# vi /etc/dnsmasq.conf
around line 85 you will find

Code: Select all

uncomment it and change it to your local interface

Code: Select all

near line 140 you will find

Code: Select all

uncomment it and change it to something in the local network.

Code: Select all

Now that you have configured everything, lets startup the dhcp-server and firewall

Code: Select all

~# /etc/init.d/dnsmasq start
~# shorewall restart
and that’s it you’ve now setup a Debian box, running Shorewall and functioning as router….

Now think of the nifty tools you can install like imspector, some user/password sniffing.. for as far as it’s legal and for educational purposes of course. nor do i take any responsibility for anything.

if things don’t work try pinging to the internet or issue a shorewall stop command

try pinging to an IP instead of hostname

Do your clients get an ip?

Make sure you don’t mixup your local and internet interfaces

When i setup Shorewall for the first time i had great help from the links below. See for yourself

Original Posting at my blog: ... ter-howto/

Post Reply