Setup Shorewall to function as a router on Debian

[BlueIce]

This is a how to setup Shorewall 4.4 on Debian Squeeze to function as a router (dhcp, dns, firewall).

This guide assumes you have some basic knowledge of linux (shell) and networking though it is recommended that you have basic knowledge about the following.

* networking
* DHCP – what is it used for
* DNS – what is it used for
* firewalls – same

If something is unclear in regard to protocols, or other tech thingies i recommend using Google / Wikipedia though you should know this already, if not.. go back to school.

Setting up Debian

Make sure you have a box setup with debian, debian runs fine from a USB stick so if you want it quiet, do that. A minimum Debian install is sufficient. Though it usually isn’t recommended, during the installation and configuration i tend to do everything as root so i don’t get annoyed with permissions problems. Furthermore 2 ethernet cards are required for a basic setup. I recommend installing atleast openssh-server and telnet so we can do some troubleshooting and manage it remotely.

Code: Select all

~# apt-get install openssh-server telnet

The idea for the network setup is quite simple, most dsl/broadband providers give you a modem / router that gives you an address by DHCP. So for most setups this is suitable though not all. Make sure you know the difference between eth0 and eth1. If you were able to install the package above, most likely this means your internet connection is working, to confirm lets ping google 2 times.

Code: Select all

~# ping google.com -c2
PING google.com (x.x.x.x) 56(84) bytes of data.
64 bytes from google.com (x.x.x.x): icmp_seq=1 ttl=54 time=17.7 ms
64 bytes from google.com (x.x.x.x): icmp_seq=2 ttl=54 time=50.4 ms

If you get a timeout, try pinging some other site or an ip and go on further when your connection is working.
Setting up your ip ranges

Computers are reached via certain routes in which it’s defined for what ip range to use what gateway and go where. To find out what’s your WAN nic type the following and find out what nic is used for your ‘default’ route.

~# ip route ls
24.123.123.0/24 dev eth0 proto kernel scope link src 24.123.123.123
default via 24.123.123.1 dev eth0

If you have a 10.x.x.x (/8) or 192.168.x.x (/16) or 172.16.x.x-172.31.x.x address make sure you use a different one for you internal network. More about these private addresses can be found at Wikipedia

We assume that eth0 is your WAN interface (the card where the internet is on). Now find out what other card you have using for e.g. mii-tool, lspci or ifconfig -a . We assume it’s eth1. Now setup an internal ip for it. We can do this in the /etc/network/interfaces file. Edit this using your favorite editor (nano, pico, vi, mc).

Code: Select all

~# vi /etc/networking/interfaces

You will probably find a line there

Code: Select all

allow-hotplug eth0
iface eth0 inet dhcp

append the following lines for your internal network i like to use 10.0.0.0 since its quick to type. note: if eth0 has such an address go with a 192.168.x.x instead.

Code: Select all

auto eth1
iface eth1 inet static
    address 10.0.0.1
    netmask 255.255.255.0
    broadcast 10.0.0.255

Time to restart your network interfaces and see if they are up

Code: Select all

~# /etc/init.d/networking restart

The following should also list your new defined interface

Code: Select all

~# ip route ls

Congratulations, now we have setup a basic network.
Setting up Shorewall

Lets install shorewall some dependencies should be installed as well.

Code: Select all

~# apt-get install shorewall

Your default configuration directory is /etc/shorewall but on debian it’s empty by default so lets copy over some basics.

Code: Select all

~# cp /usr/share/doc/shorewall/examples/two-interfaces/* /etc/shorewall

By default shorewall is switched off, lets switch it on

Code: Select all

~# vi /etc/default/shorewall

and change startup=0 to startup=1

/etc/shorewall/ contains the following files

* interfaces – contains mapping information
* masq – used for masquerading (snat)
* policy – global policies for allowing or blocking traffic
* routestopped – allows the box to be reachable via this interface if shorewall is switched off
* rules – specific rules for your firewall
* shorewall.conf -global configuration
* zones – zone definition

At this point you should take a look in the files and see what it does.

In the zones file you will find definitions for the zones.

fw – the firewall itself
net – the internet
loc – your local (safe) network

these definitions are used throughout the shorewall configs so make yourself familiar.

now lets edit the interfaces file, this defines what interface is used for what zone.

Set your interfaces correctly and add the ‘dhcp’ option for the local zone.

Code: Select all

#ZONE    INTERFACE    BROADCAST    OPTIONS
net      eth0         detect       dhcp,tcpflags,nosmurfs,routefilter,logmartians
loc      eth1         detect       dhcp,tcpflags,nosmurfs,routefilter,logmartians

lets change some options in the shorewall.conf file.

STARTUP_ENABLED=No

to

STARTUP_ENABLED=Yes

Lets setup masqerading since if we request Google from inside the network, we want Google to reply to our WAN address and not to 10.0.0.X .

edit the masquerading file and make sure it’s set to your wan interface (eth0)

Code: Select all

#INTERFACE        SOURCE        ADDRESS        PROTO    PORT(S)    IPSEC    MARK
eth3            10.0.0.0/8,\
                169.254.0.0/16,\
                172.16.0.0/12,\
                192.168.0.0/16

DHCP and DNS

We also want to use DHCP and DNS for computers in the local network. Therefore we can either add a policy to allow communications from the local network to the firewall and vicaversa, or just open up specific ports
Option 1; policy

Allow communications from the local network to the firewall and back

Code: Select all

~# vi /etc/shorewall/policy
#SOURCE    DEST       POLICY      LOG LEVEL    LIMIT:BURST
loc        net        ACCEPT
net        all        DROP        info
# THE FOLLOWING POLICY MUST BE LAST
all        all        REJECT      info

and append the following above the last line

Code: Select all

loc        $FW        ACCEPT
$FW        loc        ACCEPT

If you want the ability to connect to the internet from your firewall (download stuff to your new router for e.g) also add the following

Code: Select all

$FW        net        ACCEPT

Option 2; rules

Edit the rules file and append some extra rules after the following:

Code: Select all

Ping(ACCEPT)    loc        $FW

Append

Code: Select all

DNS(ACCEPT)        loc                     $FW
DNS(ACCEPT)       $FW                     loc

DHCP Should already be allowed since we added that option the the interfaces file.
Installing DHCP and DNS

There are several programs that give those feature though dnsmasq is easy to use and configure.

Code: Select all

~# apt-get install dnsmasq

Now we need to setup dnsmasq to function as a DHCP server, and serve DNS requests.

If we just wanted it to function as a nameserver, we are done configuring. dnsmasq does this by default.

Though to make life easy, lets setup a DHCP server.

Code: Select all

~# vi /etc/dnsmasq.conf

around line 85 you will find

Code: Select all

#interface=

uncomment it and change it to your local interface

Code: Select all

interface=eth1

near line 140 you will find

Code: Select all

#dhcp-range=192.168.0.50,192.168.0.150,12h

uncomment it and change it to something in the local network.

Code: Select all

dhcp-range=10.0.0.2-10.0.0.100,12h

Now that you have configured everything, lets startup the dhcp-server and firewall

Code: Select all

~# /etc/init.d/dnsmasq start
~# shorewall restart

and that’s it you’ve now setup a Debian box, running Shorewall and functioning as router….

Now think of the nifty tools you can install like imspector, some user/password sniffing.. for as far as it’s legal and for educational purposes of course. nor do i take any responsibility for anything.
Troubleshooting

if things don’t work try pinging to the internet or issue a shorewall stop command

try pinging to an IP instead of hostname

Do your clients get an ip?

Make sure you don’t mixup your local and internet interfaces
References

When i setup Shorewall for the first time i had great help from the links below. See for yourself

http://wiki.debian.org/HowTo/dnsmasq
http://www.shorewall.net/two-interface.htm

Original Posting at my blog: http://www.owit.nl/2010/01/debian-shore ... ter-howto/