Port Forwarding With Shorewall

Question

I have Shorewall setup on my router, but even though I've read on how to set up port forwarding it doesn't seem to work.
Here's my /etc/shorewall/rules.conf
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
# Copyright (C) 2006,2007 by the Shorewall Team
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
# See the file README.txt for further details.
# For information about entries in this file, type "man shorewall-rules"
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
#SECTION INVALID
#SECTION UNTRACKED
SECTION NEW
# Don't allow connection pickup from the net
Invalid(DROP) net all tcp
# Accept DNS connections from the firewall to the network
DNS(ACCEPT) $FW net
# Accept SSH connections from the local network for administration
SSH(ACCEPT) loc $FW
SSH(ACCEPT) net $FW TCP 3000
# Allow Ping from the local network
Ping(ACCEPT) loc $FW
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
Ping(DROP) net $FW
ACCEPT $FW loc icmp
ACCEPT $FW net icmp
# Accept DNS connections from the local network to the firewall
DNS(ACCEPT) loc $FW
# Allow Webmin access from local net
ACCEPT loc $FW tcp 80
# Allow Transmission Traffic
DNAT net loc:192.168.1.100:51413 tcp 51413
DNAT net loc:192.168.1.100:32000 tcp 32000
DNAT net loc:192.168.1.114:6881 tcp 6881
DNAT net loc:192.168.1.114:8881 udp 8881
DNAT net loc:192.168.1.1:80 tcp 1017
Here's my /etc/shorewall/policy in case it's needed
# Shorewall version 4.0 - Sample Policy File for two-interface configuration.
# Copyright (C) 2006 by the Shorewall Team
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
# See the file README.txt for further details.
# For information about entries in this file, type "man shorewall-policy"
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
$FW net ACCEPT info
loc net ACCEPT info
net all REJECT info
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT info
SSH works internally, but not externally, and ping works both inside and outside of the network, web browsing also works fine. I just can't seem to get to anything inside the network from outside of the network. What am I doing wrong?
Last edited by brando56894 (2014-04-02 04:04:34)

Answer 1

Even if the forum policy is more to give people the possibility to help themself, I'd like to post a (hopfully) working configuration for the case above, so everyone trying to use shorewall get an idea how it works.
If someone finds errors please let me know, so I can correct this post. Thanks.
/etc/shorewall/interfaces
# change interface to your external iface
net eth0 dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
# change interface to your internal iface
# if running a dhcp server on your internal interface add ",dhcp" to the following line
# if the interface is a bridge add ",bridge" to the following line
loc eth1 nets=(192.168.1.0/24),tcpflags,nosmurfs,routefilter,logmartians
/etc/shorewall/zones
fw firewall
net ipv4
loc ipv4
/etc/shorewall/masq
# change interface to your internal iface
eth1 192.168.1.0/24
/etc/shorewall/policy
$FW all ACCEPT # FW may talk to everyone
loc net ACCEPT # LAN may talk to the internet
net all DROP info # Drop everything not in rules file
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT info
/etc/shorewall/rules
SECTION NEW
### FIREWALL INCOMING ###
# MISC
Invalid(DROP) net all tcp # prevent connection pickup
Ping(DROP) net $FW # no ping from outside allowed
# ALL -> FW
ACCEPT all $FW tcp 3031 # SSH from internet and LAN
# LOC -> FW
Ping(ACCEPT) loc $FW # Ping from LAN to FW
DNS(ACCEPT) loc $FW # DNS from LAN to FW
HTTP(ACCEPT) loc $FW # Webmin access from LAN to FW
### FIREWALL OUTGOING ###
# not needed, because everything allowed in policy file
### DNAT RULES ###
# leaved out rules not found in network diagram
# add them using the same scheme
DNAT net loc:192.168.1.100:32400 tcp 32400
DNAT net loc:192.168.1.100:8081 tcp 8081
# the following may not work, as it redirects to the FW itself
DNAT net loc:192.168.1.1:80 tcp 1017
Last edited by Tarqi (2014-04-01 23:40:46)