[SOLVED]Very basic Shorewall assistance needed - won't go

stardotstar · Last edited by stardotstar on Sat Oct 11, 2008 1:06 am; edited 1 time in total

Must be my bad but I have been trying to get the most basic shorewall running all night since getting the chance to colocate my server tomorrow.

Everything is pretty much in readyness and I have based my configs on my existing shorewall install but that was debian and I am at a loss with the error I now have.

I had some kernel configs wrong but now I am stumped.

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

Looks like you have not defined the local zone/interface. Could you post your:

/etc/shorewall/zones
/etc/shorewall/interfaces

// Steve

stardotstar · Posted: Thu Sep 25, 2008 9:04 pm Post subject:

Thank you!

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

stardotstar · Posted: Thu Sep 25, 2008 9:38 pm Post subject:

SteveB - Thank you very much - as soon as I get the server on power I will do as you say and report back!

Will
_________________
]8P

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

stardotstar · Posted: Sat Sep 27, 2008 7:38 am Post subject:

Now I am in over my head; cant wait for the penny to drop...

I have a server on the web at my co-location site. It currently has one operating lan interface eth0, connected directly to the net via the local vlan gateway.

I have another interface eth1 but it is not up or connected yet.

I also have iLO on another IP.

I don't understand the implications of zones when using a single interface. Basically I guess I really only have net and fw not loc... So thinking I should drop the loc policies and try to get fw and net to do what I want.

Initially I want to deny everything from the net to my server but make an exception rule for ssh...

policy

net deny all

rule
net ssh accept

or something like that.

I have been rushed into getting onto site but then again I have no critical services that can be too badly abused... Apache is not running, proftpd, mysql and so on are all stopped until I get myself sorted.

I would appreciate the support Steve.

Fully appreciate the time zone implications. thanks for the efforts so far.

Will
_________________
]8P

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

Okay. I see. The iLO is non existent for Shorewall since it is sitting on a different system. I know that the iLO is inside the server but it is not running under the control of Shorewall. So forget the iLO for a moment.

Since you only have eth0 and that interface is connected directly to the internet: you only have zone fw (the firewall it self which is anyway nothing more then eth0 but for Shorewall it is the fw zone) and you have zone net (this is everything outside. Any address from the internet).

So in your case you need in zones:

stardotstar · Posted: Sat Sep 27, 2008 7:52 am Post subject:

yup - +/-/== what I need :-)

tHanks steve!

Will

I'll report my success - that makes sense - the fw/net zones - I don't need/have a loc unless I use it to route too right?>

Anyway I won't do anything until they get my iLO IP available outside the facility - for some reason I can get the "It Works" from apache to the eth0 IP from anywhere; but the iLO https connects on the correct IP from the localhost (checking with Lynx) but not from outside. And having locked myself out several times and having to resort to iLO I won't touch *anything* till it is working 100% - no exceptions. I have a ticket open - must be a range or vlan thingo.
_________________
]8P

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

To get Apache to work, you need to add:

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

stardotstar · Posted: Sat Sep 27, 2008 8:10 am Post subject:

you misunderstand me steveb;

I cant reach iLO from remote; from remote I can reach apache "It Works"

BUT I can connect to iLO from lynx in an ssh session on the server...

ya?
_________________
]8P

stardotstar · Posted: Sat Sep 27, 2008 8:15 am Post subject:

mtr google.com

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

stardotstar · Posted: Sun Sep 28, 2008 9:57 pm Post subject:

Yes, I can ping iLO interface from the ssh session and I just used lynx to confirm that I could see something on port 443 on that IP... So still waiting for support to get the physical connections outside the localhost sorted and I should be ok to play.

Kind of not wanting to have the box live on the internet for too long without a fully functioning firewall. Even though the services are stopped.

Thanks for the ongoing interest steveb.

\\'
_________________
]8P

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

Then it is the Java requirement which is giving you problems. You can not access iLO from within Lynx. Lynx can not display the graphical login done as a Java applet. That's your problem. What system is that where you have the iLO? Is it one of the old iLO interfaces or is it already one of the new ones where you could use SSH to connect to iLO?

// SteveB

stardotstar · Posted: Tue Sep 30, 2008 1:57 am Post subject:

I understand that Lynx won't actually allow me to use the iLO but it confirms that the iLO is responding to browser requests on https://iLOIPaddr from the localhost ...

Unfortunately I can't get any connection from the outside world - times out.

Clearly the iLO is up and running but not accessible from the OSW so its of no use to me...

The support is reporting that the vlan is correctly connected and all ports are live. They believe that I have a wrong subnet or gateway programmed into my iLO - which I can't get to from an ssh shell as far as I know - though I haven't explored the dedicated hp toolset I have just installed. I would have thought that if I could "see" it from the Lynx browser (even if not actually use it due to the java constraints) that would confirm that the subnet mask was ok. I suppose that I therefore have incorrectly configured the gateway - but wouldn't that just mean that the iLO interface be unable to send out by itself - surely the outside gateway will make a connection from my remote host to the iLO IP without the need for the default gateway to be set on the iLO>>>?>

\\'
_________________
]8P

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

How have you configured your iLO? Manual IP address or have you set it to use DHCP? If you have manual setup, then you should (/must) set the gateway as well. Else iLO will have problem to talk back.
You have mentioned, that you have access to the iLO. If you have that access, then you can easy verify what network setup you have configured into iLO. And you can change it there.

// SteveB

stardotstar · Posted: Wed Oct 01, 2008 11:24 am Post subject:

All sorted, basically I couldn't get to the ilo via a java enabled browser since I didn't have X on my server and only way into ilo was from the local subnet - ie the ssh/console - anyway - its sorted.

So I am about to start up the firewall.
_________________
]8P

stardotstar · Posted: Wed Oct 01, 2008 11:34 am Post subject:

she still won't play:

steveb · Advocate Joined: 18 Sep 2002 Posts: 4564

Looks okay to me. But could you post the other config files as well? Can you execute this command and post the output:

stardotstar · Posted: Sat Oct 04, 2008 6:27 am Post subject:

Hi Steve - thanks for staying with me on this!

Here is the result of your neat script:

stardotstar · Posted: Sat Oct 11, 2008 1:05 am Post subject:

OK I have unmasked (~x86) shorewall-common and shorewall-shell and reconfigured everything and it is working fine - so it looks like the unmasked portage version is incompatible with the current IPTables??

Anyway - on with the show.

\\'

thanks for all the guidance Steve.
_________________
]8P