LinuxQuestions.org - check this shorewall script

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - check this shorewall script (https://www.linuxquestions.org/questions/linux-security-4/check-this-shorewall-script-826943/)

check this shorewall script

I marked my previous post as solved and maybe nobody can reply there but me,

Just in case i made a new thread..

I was about to add another NIC to my box to replace the ip aliases config i did and well, i dont have any more PCI slots...

Regardless of the security issue discussed in the thread about the insecurity with differents subnets in the same segment, check please if this config is "enough"

eth2 -> 192.168.1.0
eth2:0 ->192.168.50.0
eth1 and eth0 are the net interfaces, 1 router each to provide wan failover (not implemented here)

Hosts:

Quote:

loc1 eth2:192.168.1.0/24
loc50 eth2:192.168.50.0/24

Interfaces

Quote:

net6 eth0 detect
net7 eth1 detect
- eth2 192.168.1.255,192.168.50.255

Masq

Quote:

eth0 eth2
eth1 eth2
eth2 eth2

Policy

Quote:

all all ACCEPT info

Rules
SECTION NEW

Quote:

REJECT loc50 loc1 all

Zones

Quote:

fw firewall
net6 ipv4
net7 ipv4
loc1 ipv4
loc50 ipv4

Problems / Doubs:

1) Is the hosts file required?

2) I guess i need doing masq from local to each external, and also from local to local even if they share the same interface, hence the eth2 eth2 in the masq file...

3) So is shorewall well implemented in these scritps to handle aliases?

Quote:

Originally Posted by fdelval (Post 4069947)

I marked my previous post as solved and maybe nobody can reply there but me,

Just in case i made a new thread..

I'm closing this thread, as it's unnecessary. I've marked your original thread back to unsolved (although marking as solved doesn't prevent members from replying), and I've also given it a courtesy bump for you. I'm not familiar with Shorewall so I can't be of much assistance, but surely someone will be along to help you out soon. Good luck!