Ubuntu下设置shorewall防火墙

服务器采用Ubuntu作为操作系统，两块网卡，一块接外网（eth0），一块接内网（eth1）。采用shorewall作为防火墙。
配置网卡：
sudo vi /etc/network/interfaces
ubuntu下设置shorewall防火墙服务器采用Ubuntu作为操作系统，两块网卡，一块接外网（eth0），一块接内网（eth1）。采用shorewall作为防火墙。配置网卡：
sudo vi /etc/network/interfaces
------------------------------------------------
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces（5）.# The loopback network interface
auto lo
iface lo inet loopback# This is a list of hotpluggable network interfaces.
# They will be activated automatically by the hotplug subsystem.
mapping hotplug
script grep
map eth0# The primary network interface
iface eth0 inet static
address 192.168.2.250
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.168.2.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 202.96.209.6auto eth1
iface eth1 inet static
address 192.168.10.254
netmask 255.255.255.0
network 192.168.10.0
broadcast 192.168.10.255-----------------------------------------------------1、安装shorewall
sudo apt-get install shorewall2、拷贝配置文件
sudo cp /usr/share/shorewall/modules /etc/shorewall
sudo cp /usr/share/doc/shorewall/default-config/policy /etc/shorewall/
sudo cp /usr/share/doc/shorewall/default-config/nat /etc/shorewall/
sudo cp /usr/share/doc/shorewall/default-config/zones /etc/shorewall/
sudo cp /usr/share/doc/shorewall/default-config/maclist /etc/shorewall/
sudo cp /usr/share/doc/shorewall/default-config/blacklist /etc/shorewall/
sudo cp /usr/share/doc/shorewall/default-config/interfaces /etc/shorewall/interfaces
sudo cp /usr/share/doc/shorewall/default-config/rules /etc/shorewall/rules
sudo cp /usr/share/doc/shorewall/default-config/hosts /etc/shorewall/hosts
sudo cp /usr/share/doc/shorewall/default-config/masq /etc/shorewall/masq3、配置网卡
sudo vi /etc/shorewall/interfaces在倒数第二行，也就是在 “#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE” 这一行之后加上：net eth0 detect
loc eth1 detect4、配置网络别名
sudo vi /etc/shorewall/zones在倒数第二行，也就是在 “#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE” 这一行之后加上：net Net Internet
loc Local Local Networks5、配置IP伪装，也就是透明代理sudo vi /etc/shorewall/masq在倒数第二行，也就是在 “#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE” 这一行之后加上：eth0 eth16、配置策略
sudo vi /etc/shorewall/policy在#LAST LINE -- DO NOT REMOVE这一行最后加上：loc net ACCEPT
net all DROP info
all all REJECT info 7、配置防火墙规则sudo vi /etc/shorewall/rules在倒数第二行，也就是在 “#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE” 这一行后加上：#incoming traffic （由 internet 去 firewall）
AllowSSH net fw
AllowDNS net fw
AllowWeb net fw
AllowSMB net fw
AllowNNTP net fw
AllowNTP net fw
AllowRdate net fw
AllowSMTP net fw
DropPing net fw #outgoing traffic （由 firewall 去 internet）
AllowWeb fw net
AllowDNS fw net
AllowSMTP fw net
AllowSMB fw net
AllowSMTP fw net
AllowNNTP fw net
AllowNTP fw net
AllowRdate fw net
AllowSSH fw net #open special ports
ACCEPT net fw tcp 9980 8、修改 shorewall.conf 自动开启 IP 转发sudo gedit /etc/shorewall/shorewall.conf查找到：IP_FORWARDING=Keep修改为：IP_FORWARDING=On# 保存关闭文件9、修改 /etc/default/shorewall 自动运行防火墙sudo vi /etc/default/shorewall查找到：startup=0修改为：startup=110、启动防火墙sudo shorewall start11、至此防火墙配置完成。Linux系统Iptables防火墙使用手册Ubuntu初始化iptables的实现相关资讯 Linux防火墙 Ubuntu防火墙 shorewall shorewall防火墙

关于Linux防火墙"iptables"的面试（08/04/2015 09:59:31）
纯Linux的防火墙解决方案：（03/05/2014 16:27:07）
Ubuntu 下UFW防火墙简单设置攻略（04/12/2013 21:18:41）

Linux软防火墙ACL匹配的优化点（07/17/2015 09:21:24）
Debian/Ubuntu系统中安装和配置UFW （01/20/2014 11:01:24）
iptables 1.4.16.1 发布，Linux防（10/08/2012 21:41:56）

本文评论查看全部评论（0）

评论声明

尊重网上道德，遵守中华人民共和国的各项有关法律法规
承担一切因您的行为而直接或间接导致的民事或刑事法律责任