Simple setting of Shorewall for a single user

Shorewall's single-user simple settings-Linux Enterprise Application-Linux server application information. The following is a detailed description. Why did this: Because my machine configuration is not high and firestarter is too unstable, it crashes on my breezy. The shorewall mentioned in the beginner's guide is not for standalone users, the syntax rule shorewall3.0.4 has changed.

Local condition: China Telecom ADSL, and the ISP dynamically allocates ip addresses. Connect a single Nic to the Internet using the adsl modem (PPPoE) and install shorewall.

I. Basic knowledge about linux Firewall:

Apart from the classification of software and hardware firewalls, if the classification is based on the packet resistance mechanism, it can be divided into proxy and IP Filter.
Basically, linux IP Filter has two basic firewall mechanisms: Ip Filter and TCP_Wrapper.
Here we will talk about IP Filter, because shorewall can use IPTABLES to set IP Filter rules.
Or, if you do not need to bother iptables syntax rules, or you can write some shell program batch processing iptables commands by yourself, you can not install shorewall or other firewalls. In linux, the firewall is basically completed by setting iptables rules.

1. First, confirm (the uname command determines the core, and lsmod determines the current loading module. If it is ipchains, execute rmmod ipchains.
Then modprobe ip_tables can load iptables into the current module.) What kind of resistance mechanism does your kernel adopt?
Iptables we need (iptables for Ubuntu5.10)

Linux Kernel Version 2.0: Using ipfwadm
Linux Kernel Version 2.2: ipchains
Linux Kernel Version 2.4: iptables is mainly used, but to be compatible with ipchains, in Version 2.4, ipchains are compiled into modules for use, so that users can still use them? Firewall Rules of ipchains of Version 2.2 of IPv6.
---------------
Then execute the following code to view the current firewall rules (root user)
$ Sudo iptables-L-n)
$ Sudo iptables-t nat-L-n (-t nat means to display the nat filter. Iptables includes nat tables and filter tables. The filter parameter is not added. For more information about iptables, see iptables ;)
---------------
Next, we need to clear all existing firewall rules (when connected)

Root @ *** root] #/sbin/iptables [-t tables] [-FXZ]
The parameter description is as follows:
-F: Clear the rules that have been created;
-X: Kill the chain (tables) created by all users );
-Z: the count and traffic statistics of all chains are classified as 0;
? Example:
[Root @ *** root] #/sbin/iptables-F
[Root @ *** root] #/sbin/iptables-X
[Root @ *** root] #/sbin/iptables-Z
[Root @ *** root] #/sbin/iptables-t nat-F
---------------

Ii. Install Shorewall3.0.4

Download shorewall's latest stable version 3.0.4 (tarball installation, that is, source code make installation. Are you sure your machine has installed the basic compilation tool following the 'newbie Guide'). Because there are still 2. Many versions in the new version, we will see 3 Introduction on the official website, so install 3.0.4. The installation is simple and there will be no other dependency issues.


------------
1.: http://www1.shorewall.net/pub/shorewall/3.0/shorewall-3.0.4/

2. Before installation, You Need To: iptables (mentioned above) + iproute (the command to check this is sudo Which ip) (basically ubuntu5.10 is available, so do not consider it)

3. Try not to edit the shorewall configuration file in ms-windows, because the text layout of ms and lin is not the same, such as carriage return.

4. cd to the directory after decompression, and then press./install. sh and press Enter. If there is no error message, it will be OK. But shorewall is not started at the moment. Let's start it later. After the default installation, the firewall is automatically started every time it is started (the setting file is in/etc/shorewall. conf. Find STARTUP_ENABLED = Yes
Yes indicates automatic start upon startup !)

5. After the installation, all the files are located at/usr/shorewall and/sbin and/etc/shorewall. Note that/etc/shorewall is required. Here is the configuration file. (Personal suggestion: For important files that do not need to be changed frequently, you can add the hidden attributes chattr + I. For detailed instructions, refer to 'male' man)

6. Check the installed version: sudo shorewall version to get the message 3.0.4.