suse FW2 routet keine 2 subnetze

mitch-geht-ab · 13 Okt. 2004

hallo.

ich hab mal ne frage und zwar zu suse firewall2.
auf meinem system läuft suse 9.0.
so nun die frage =) ich hab 2 netze
192.168.1.0 und 10.0.0.0 beide subnetmask 255.255.255.0

jetzt will ich beide netze verbinden!
sprich 192.168.1.1 soll 10.0.0.1 abpingen können!

also muss ich eine bridge aufbauen!

da ich mir nen buch über firewall regeln gekauft und gelesen hab, und das auch schon 2 jahre her ist, und ich keine zeit und nerven hab das durchzuarbeiten, hab ich damals einfach die susefirewall2 genommen!
klingt doof ist aber so!

nun die eigentliche frage...

wie verbinde ich die 2 netze mit der susefirewall2 miteinander, damit ich aus netz 192.xxx einen rechner in netz 10.xxx anpingen bzw. mich auch verbinden kann!?

danke schonmal für die antworten

Martin Breidenbach · 13 Okt. 2004

voodoo-t schrieb:
also muss ich eine bridge aufbauen!

Nö. Du brauchst einen Router. Pack zwei Netzwerkkarten rein, schalte Routing ein, stell den in jedem Segment als Standardgateway ein, fertig.

Firewall brauchst Du nur wenn dazwischen gefiltert werden soll.

mitch-geht-ab · 13 Okt. 2004

?????? hää!? nen router hab ich doch!
mom ich schreib gerade nochmal auf was ich hab, und dann sagst du mir was sinnvoll währe!

also ich geh jetzt mal nur von 2pc's aus und 1 server!

server (suse9): eth0-192.168.1.99 und eth1-10.0.0.99
pc1(xp): 192.168.1.1, 255.255.255.0, gateway: 192.168.1.99
pc2(xp): 10.0.0.1, 255.255.255.0, gateway: 10.0.0.99

so ebenfalls ist der server mit dem inet verbunden! ppp0

auf dem server läuft dann noch die susefirewall2!

jetzt will ich von pc1 auf pc2 pingen können!
dazu muss ich doch eth0 und eth1 bridgen oder?

ahso, noch anzumerken, der server ist von beiden netzen aus erreichbar!
nur die netze gegenseitig nicht =(

Martin Breidenbach · 13 Okt. 2004

voodoo-t schrieb:
jetzt will ich von pc1 auf pc2 pingen können!
dazu muss ich doch eth0 und eth1 bridgen oder?

Nein - routen, nicht bridgen.

Da ist vermutlich nur die Firewall falsch konfiguriert.

Es gibt da in der SuSEFirewall2 eine Einstellung genau für den Fall daß man mehrere interne Netze hat. Lies Dir mal die Kommentare in der Konfigurationsdatei durch.

mitch-geht-ab · 13 Okt. 2004

hmmmm ja aber dann weis ich nicht wo!
ich poste einfach mal meine suse2FW einstellungen, vielleicht fällt dir ein wo.
ich hab mal die stellen makiert die ich schon geändert hatte:

Code:

# 1.)
# Should the Firewall run in quickmode?
#
# "Quickmode" means that only the interfaces pointing to external networks
# are secured, and no other. all interfaces not in the list of FW_DEV_EXT
# are allowed full network access! Additionally, masquerading is
# automatically activated for FW_MASQ_DEV devices. and last but not least:
# all incoming connection via external interfaces are REJECTED.
# You will only need to configure 2.) and FW_MASQ_DEV in 6.)
# Optionally, you may add entries to section 9a.)
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_QUICKMODE="no"

## Type:	string
# 2.)
# Which is the interface that points to the internet/untrusted networks?
#
# Enter all the network devices here which are untrusted.
#
# Choice: any number of devices, seperated by a space
# e.g. "eth0", "ippp0 ippp1 eth0:1"
#
FW_DEV_EXT="ppp0"

## Type:	string
#
# 3.)
# Which is the interface that points to the internal network?
#
# Enter all the network devices here which are trusted.
# If you are not connected to a trusted network (e.g. you have just a
# dialup) leave this empty.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_INT="eth0"  [b]hier stand noch eth1[/b]

## Type:	string
#
# 4.)
# Which is the interface that points to the dmz or dialup network?
#
# Enter all the network devices here which point to the dmz/dialups.
# A "dmz" is a special, seperated network, which is only connected to the
# firewall, and should be reachable from the internet to provide services,
# e.g. WWW, Mail, etc. and hence are at risk from attacks.
# See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example.
#
# Special note: You have to configure FW_FORWARD to define the services
# which should be available to the internet and set FW_ROUTE to yes.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_DMZ=""

## Type:	yesno
## Default:	no
#
# 5.)
# Should routing between the internet, dmz and internal network be activated?
# REQUIRES: FW_DEV_INT or FW_DEV_DMZ
#
# You need only set this to yes, if you either want to masquerade internal
# machines or allow access to the dmz (or internal machines, but this is not
# a good idea). This option supersedes IP_FORWARD from
# /etc/sysconfig/network/options
#
# Setting this option one alone doesn't do anything. Either activate
# massquerading with FW_MASQUERADE below if you want to masquerade your
# internal network to the internet, or configure FW_FORWARD to define
# what is allowed to be forwarded!
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ROUTE="yes"

## Type:	yesno
## Default:	no
#
# 6.)
# Do you want to masquerade internal networks to the outside?
# REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE
#
# "Masquerading" means that all your internal machines which use services on
# the internet seem to come from your firewall.
# Please note that it is more secure to communicate via proxies to the
# internet than masquerading. This option is required for FW_MASQ_NETS and
# FW_FORWARD_MASQ.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_MASQUERADE="yes"

## Type:	string
#
# You must also define on which interface(s) to masquerade on. This is
# normally your external device(s) to the internet.
# Most users can leave the default below.
#
# e.g. "ippp0" or "$FW_DEV_EXT"
FW_MASQ_DEV="$FW_DEV_EXT"

## Type:	string
#
# Which internal computers/networks are allowed to access the internet
# directly (not via proxys on the firewall)?
# Only these networks will be allowed access and will be masqueraded!
#
# Choice: leave empty or any number of hosts/networks seperated by a space.
# Every host/network may get a list of allowed services, otherwise everything
# is allowed. A target network, protocol and service is appended by a comma to
# the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with
# unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows
# the 10.0.1.0 network to use www/ftp to the internet.
# "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too.
# Set this variable to "0/0" to allow unrestricted access to the internet.
#
FW_MASQ_NETS="192.168.1.0/24"    [b]hier stand noch das 10er netz[/b]

## Type:	yesno
## Default:	yes
#
# 7.)
# Do you want to protect the firewall from the internal network?
# REQUIRES: FW_DEV_INT
#
# If you set this to "yes", internal machines may only access services on
# the machine you explicitly allow. They will be also affected from the
# FW_AUTOPROTECT_SERVICES option.
# If you set this to "no", any user can connect (and attack) any service on
# the firewall.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
# "yes" is a good choice
FW_PROTECT_FROM_INTERNAL="no"

## Type:	yesno
## Default:	yes
#
# 8.)
# Do you want to autoprotect all running network services on the firewall?
#
# If set to "yes", all network access to services TCP and UDP on this machine
# will be prevented (except to those which you explicitly allow, see below:
# FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP})
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_AUTOPROTECT_SERVICES="yes"

## Type:	string
#
# 9.)
# Which services ON THE FIREWALL should be accessible from either the internet
# (or other untrusted networks), the dmz or internal (trusted networks)?
# (see no.13 & 14 if you want to route traffic through the firewall) XXX
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP.
# e.g. if a webserver on the firewall should be accessible from the internet:
# FW_SERVICES_EXT_TCP="www"
# e.g. if the firewall should receive syslog messages from the dmz:
# FW_SERVICES_DMZ_UDP="syslog"
# For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set
# FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols)
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# Common: smtp domain
FW_SERVICES_EXT_TCP="ssh www 2121 4000:8000 17100:17200 47624 2300:2400 34987 10266 5000"
#                                   esel        icq      aoe2    aoe2   rise  rise  vpn

## Type:	string
# Common: domain
FW_SERVICES_EXT_UDP="123 2121 4000:8000 2300:2600 5000"	# Common: domain
#                                esel      aoe2   vpn

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_EXT_IP=""

## Type:	string
#
# Common: smtp domain
FW_SERVICES_DMZ_TCP=""

## Type:	string
# Common: domain
FW_SERVICES_DMZ_UDP=""

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_DMZ_IP=""

## Type:	string
#
# Common: ssh smtp domain
FW_SERVICES_INT_TCP="ssh www 2121 17100:17200 47624 2300:2400 34987 10266 5000"
#                                     icq      aoe2    aoe2   rise  rise  vpn

## Type:	string
# Common: domain syslog
FW_SERVICES_INT_UDP="123 2121 2300:2400 5000"
#                                aoe2   vpn

# For VPN/Routing which END at the firewall!!
FW_SERVICES_INT_IP=""

## Type:	string
# 9a.)
# External services in QUICKMODE.
# This is only used for QUICKMODE (see 1.)!
# (The settings here are similar to section 9.)
# Which services ON THE FIREWALL should be accessible from either the 
# internet (or other untrusted networks), i.e. the external interface(s)
# $FW_DEV_EXT
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_QUICK_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_QUICK_UDP.
# e.g. if a secure shell daemon on the firewall should be accessible from
# the internet: 
# FW_SERVICES_QUICK_TCP="ssh"
# e.g. if the firewall should receive isakmp (IPsec) internet:
# FW_SERVICES_QUICK_UDP="isakmp"
# For IP protocols (like IPsec) you need to set
# FW_SERVICES_QUICK_IP="50"
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# QUICKMODE: TCP services open to external networks (InterNet)
# (Common: ssh smtp)
FW_SERVICES_QUICK_TCP=""

## Type:	string
# QUICKMODE: UDP services open to external networks (InterNet)
# (Common: isakmp)
FW_SERVICES_QUICK_UDP=""

## Type:	string
# QUICKMODE: IP protocols unconditionally open to external networks (InterNet)
# (For VPN firewall that is VPN gateway: 50)
FW_SERVICES_QUICK_IP=""

## Type:	string
#
# 10.)
# Which services should be accessible from trusted hosts/nets?
#
# Define trusted hosts/networks (doesnt matter if they are internal or
# external) and the TCP and/or UDP services they are allowed to use.
# Please note that a trusted host/net is *not* allowed to ping the firewall
# until you set it to allow also icmp!
#
# Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or
# networks, seperated by a space. e.g. "172.20.1.1 172.20.0.0/16"
# Optional, enter a protocol after a comma, e.g. "1.1.1.1,icmp"
# Optional, enter a port after a protocol, e.g. "2.2.2.2,tcp,22"
#
FW_TRUSTED_NETS=""

## Type:	string
#
# 11.)
# How is access allowed to high (unpriviliged [above 1023]) ports?
#
# You may either allow everyone from anyport access to your highports ("yes"),
# disallow anyone ("no"), anyone who comes from a defined port (portnumber or
# known portname) [note that this is easy to circumvent!], or just your
# defined nameservers ("DNS").
# Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root
# from a firewall using this script (well, you can if you include range
# 600:1023 in FW_SERVICES_EXT_UDP ...).
# Please note that with v2.1 "yes" is not mandatory for active FTP from
# the firewall anymore.
#
# Choice: "yes", "no", "DNS", portnumber or known portname,
#         if not set defaults to "no"
#
# Common: "ftp-data", better is "yes" to be sure that everything else works :-(
FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes"

## Type:	string
# Common: "DNS" or "domain ntp", better is "yes" to be sure ...
FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

## Type:	yesno
## Default:	yes
#
# 12.)
# Are you running some of the services below?
# They need special attention - otherwise they won´t work!
#
# Set services you are running to "yes", all others to "no",
# if not set defaults to "no"
# If you want to offer the below services to your DMZ as well,
# (and not just internally), set the switches below to "dmz",
# if you even want to offer to the world as well, set to "ext"
# instead of "yes" (NOT RECOMMENDED FOR SECURITY REASONS!)
#
FW_SERVICE_AUTODETECT="yes"	# Autodetect the services below when starting

## Type:	yesno
## Default:	no
# If you are running bind/named set to yes. Remember that you have to open
# port 53 (or "domain") as udp/tcp to allow incoming queries.
# Also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes"
FW_SERVICE_DNS="no"

## Type:	yesno
## Default:	no
# if you use dhclient to get an ip address you have to set this to "yes" !
FW_SERVICE_DHCLIENT="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is a DHCP server
FW_SERVICE_DHCPD="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running squid. You still have to open the
# tcp port 3128 to allow remote access to the squid proxy service.
FW_SERVICE_SQUID="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running a samba server. You still have to 
# open the tcp port 139 to allow remote access to SAMBA.
FW_SERVICE_SAMBA="no"

## Type:	string
#
# 13.)
# Which services accessed from the internet should be allowed to the
# dmz (or internal network - if it is not masqueraded)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must have valid, non-private, IP addresses which were assigned to
# you by your ISP. This opens a direct link to your network, so only use
# this option for access to your dmz!!!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forwarding rules, seperated each by a space.
# A forwarding rule consists of 1) source IP/net and 2) destination IP
# seperated by a comma. e.g. "1.1.1.1,2.2.2.2 3.3.3.3/16,4.4.4.4/24"
# Optional is a protocol, seperated by a comma, e.g. "5.5.5.5,6.6.6.6,igmp"
# Optional is a port after the protocol with a comma, e.g. "0/0,0/0,udp,514"
#
FW_FORWARD=""		# Beware to use this!

## Type:	string
#
# 14.)
# Which services accessed from the internet should be allowed to masqueraded
# servers (on the internal network or dmz)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must be in a masqueraded segment and may not have public IP addesses!
# Hint: if FW_DEV_MASQ is set to the external interface you have to set
# FW_FORWARD from internal to DMZ for the service as well to allow access
# from internal!
#
# Please note that this should *not* be used for security reasons! You are
# opening a hole to your precious internal network. If e.g. the webserver there
# is compromised - your full internal network is compromised!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forward masquerade rules, seperated each by a space.
# A forward masquerade rule consists of 1) source IP/net, 2) the IP to which
# the requests will be forwarded to (in the dmz/intern net), 3) a protocol
# (tcp/udp only!) and 4) destination port, seperated by a comma (","), e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80"
#
# Optional is a port after the destination port, to redirect the request to
# a different destination port on the destination IP, e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80,81"
#
# Optional is an target IP address on which should the masquerading be decided.
# You have to set the optional port option to use this.
#
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80,81,202.202.202.202
# The class C network 200.200.200.0/24 trying to access 202.202.202.202 port
# 80 will be forwarded to the internal server 10.0.0.10 on port 81.
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80
# The class C network 200.200.200.0/24 trying to access anything which goes
# through this firewall ill be forwarded to the internal server 10.0.0.10 on
# port 80
#

## Port-Beschreibungen WICHTIG!
#icq
#aoe2
#aoe2
#aoe2
#rise server
#rise client

FW_FORWARD_MASQ="                 		
0/0,192.168.1.11,tcp,17100:17200                    
0/0,192.168.1.11,tcp,47624         
0/0,192.168.1.11,tcp,2300:2400
0/0,192.168.1.11,udp,2300:2400
0/0,192.168.1.11,tcp,34987
0/0,192.168.1.11,tcp,10266"         		# Beware to use this!

## Type:	string
#
# 15.)
# Which accesses to services should be redirected to a localport on the
# firewall machine?
#
# This can be used to force all internal users to surf via your squid proxy,
# or transparently redirect incoming webtraffic to a secure webserver.
# 
# Choice: leave empty or use the following explained syntax of redirecting
# rules, seperated by a space.
# A redirecting rule consists of 1) source IP/net, 2) destination IP/net,
# 3) protocol (tcp or udp) 3) original destination port and 4) local port to
# redirect the traffic to, seperated by a colon. e.g.:
# "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080"
# Please note that as 2) destination, you may add '!' in front of the IP/net
# to specify everything EXCEPT this IP/net.
#
FW_REDIRECT=""

## Type:	yesno
## Default:	yes
#
# 16.)
# Which logging level should be enforced?
# You can define to log packets which were accepted or denied.
# You can also the set log level, the critical stuff or everything.
# Note that logging *_ALL is only for debugging purpose ...
#
# Choice: "yes" or "no", if not set FW_LOG_*_CRIT defaults to "yes", and
# FW_LOG_*_ALL defaults to "no"
#
FW_LOG_DROP_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_DROP_ALL="no"

## Type:	yesno
## Default:	yes
#
FW_LOG_ACCEPT_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_ACCEPT_ALL="no"

## Type:	string
#
# only change/activate this if you know what you are doing!
FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW"

## Type:	yesno
## Default:	yes
#
# 17.)
# Do you want to enable additional kernel TCP/IP security features?
# If set to yes, some obscure kernel options are set.
# (icmp_ignore_bogus_error_responses, icmp_echoreply_rate,
#  icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate,
#  ip_local_port_range, log_martians, mc_forwarding, mc_forwarding,
#  rp_filter, routing flush)
# Tip: Set this to "no" until you have verified that you have got a
# configuration which works for you. Then set this to "yes" and keep it
# if everything still works. (It should!) ;-)
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_KERNEL_SECURITY="yes"

## Type:	yesno
## Default:	no
#
# 18.)
# Keep the routing set on, if the firewall rules are unloaded?
# REQUIRES: FW_ROUTE
#
# If you are using diald, or automatic dialing via ISDN, if packets need
# to be sent to the internet, you need to turn this on. The script will then
# not turn off routing and masquerading when stopped.
# You *might* also need this if you have got a DMZ.
# Please note that this is *insecure*! If you unload the rules, but are still
# connected, you might your internal network open to attacks!
# The better solution is to remove "/sbin/SuSEfirewall2 stop" or
# "/sbin/init.d/firewall stop" from the ip-down script!
#
#
# Choices "yes" or "no", if not set defaults to "no"
#
FW_STOP_KEEP_ROUTING_STATE="no"

## Type:	yesno
## Default:	yes
#
# 19.)
# Allow (or don't) ICMP echo pings on either the firewall or the dmz from
# the internet? The internet option is for allowing the DMZ and the internal
# network to ping the internet.
# REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT
#
# Choice: "yes" or "no", defaults to "no" if not set
#
FW_ALLOW_PING_FW="no"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_DMZ="no"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_EXT="no"

##
# END of /etc/sysconfig/SuSEfirewall2
##
#                                                                         #
# EXPERT OPTIONS - all others please don't change these!                  #
#                                                                         #

## Type:	yesno
## Default:	yes
#
# 20.)
# Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall.
# This is used for traceroutes to your firewall (or traceroute like tools).
#
# Please note that the unix traceroute only works if you say "yes" to
# FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say
# additionally "yes" to FW_ALLOW_PING_FW
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_TRACEROUTE="yes"

## Type:	yesno
## Default:	yes
#
# 21.)
# Allow ICMP sourcequench from your ISP?
#
# If set to yes, the firewall will notice when connection is choking, however
# this opens yourself to a denial of service attack. Choose your poison.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_ALLOW_FW_SOURCEQUENCH="yes"

## Type:	yesno
## Default:	no
#
# 22.)
# Allow/Ignore IP Broadcasts?
#
# If set to yes, the firewall will not filter broadcasts by default.
# This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast
# option is used.
# If you do not want to allow them however ignore the annoying log entries,
# set FW_IGNORE_FW_BROADCAST to yes.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_BROADCAST="no"

## Type:	yesno
## Default:	yes
#
FW_IGNORE_FW_BROADCAST="yes"

## Type:	yesno
## Default:	no
#
# 23.)
# Allow same class routing per default?
# REQUIRES: FW_ROUTE
#
# Do you want to allow routing between interfaces of the same class
# (e.g. between all internet interfaces, or all internal network interfaces)
# be default (so without the need setting up FW_FORWARD definitions)?
#
# Choice: "yes" or "no", if not set defaults to "no"
#
[b]FW_ALLOW_CLASS_ROUTING="no"[/b]

## Type:	string
#
# 25.)
# Do you want to load customary rules from a file?
#
# This is really an expert option. NO HELP WILL BE GIVEN FOR THIS!
# READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom
#
#FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
FW_CUSTOMRULES=""

## Type:	yesno
## Default:	no
#
# 26.)
# Do you want to REJECT packets instead of DROPing?
#
# DROPing (which is the default) will make portscans and attacks much
# slower, as no replies to the packets will be sent. REJECTing means, that
# for every illegal packet, a connection reject packet is sent to the
# sender.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_REJECT="no"

ping ist jetzt laut firewall verboten, aber normalerweise müste ich von 10.0.0.1 über \\192.168.1.1 zugreifen können, und dessen freigaben sehen, bzw. auch einfach mit der "computer suchen" funktion von xp

vielleicht kann mir da ja einer sagen, was ich falsch gemacht habe!?
oder wo ich was einstellen muss?

Martin Breidenbach · 14 Okt. 2004

Wir haben offenbar drei Netzwerkinterfaces - eth0, eth1 und ppp0.
eth0 ist als internes Interface definiert.
ppp0 ist als externes Interface definiert.
eth1 wird totgeschwiegen.

Was soll die Firewall denn filtern und was soll sie durchlassen ? Die in diesem Zusammenhang interessante Frage ist was zwischen eth0 und eth1 gefiltert werden soll. Und warum diesbezüglich nichts konfiguriert wurde.

mitch-geht-ab · 14 Okt. 2004

gut ok, wenn eth0 und eth1 2 interne netze sind, und ppp0 internet, sprich extern, wie müste ich den nun die FW konfigurieren!

wie gesagt ich hab ein paar sachen ausprobiert, die hier glaub ich nicht mehr drin waren... aber das hat net gefunzt!

kannst du mir da evt. nen vorschlag machen?

Martin Breidenbach · 14 Okt. 2004

Dann definiere doch mal eth0 und eth1 als interne Netze und schalte entweder Quickmode aus oder class routing ein oder so.

Bomber8475 · 14 Okt. 2004

setz Punkt 23 auf yes. Damit kann ich auch zwischen meinem W-Lan und Lan routen.
Natürlich müssen Deine Lan-Karten im internen Netzwerk sein.

mitch-geht-ab · 15 Okt. 2004

hallo hallo.
erstmal danke für die antworten.
ich hab jetzt eth1 auch zum internen netzwerk hinzugefügt...
ebenfalls hab ich unter punkt 23 class routing auf yes!

allerdings klapts immer noch net!

ich kann von meinem 10.0.0.0 netz zwar den server unter 10.0.0.99 und 192.168.1.99 erreichen, aber mein pc 192.168.1.11 bleibt weiterhin verborgen!! =(

also "routet" :wink:

der router noch net wirklich durch! quasi von eth1 nach eth0

Bomber8475 · 15 Okt. 2004

Hast Du im Explorer direkt die IP angegeben oder es über die Netzwerkumgebung versucht? Hier wirst Du die PCs im anderen Netz auch nicht sehen.
Ausschließlich direkt im Explorer (oder Ausführen)

Code:

\\IP_vom_PC_im_anderen_Netz

tippen und so sehe ich den Lappi meiner Freundin.

LAN Netz: 192.168.1.x
WLan Netz: 192.168.2.x

So siehts bei mir aus..

mitch-geht-ab · 15 Okt. 2004

ja ich hab mehrere sachen probiert!

im explorer \\ip
ping (kann auch sein das die FW das block, wobei es net sein sollte)
dann computer suchen

wie gesagt 192.168.1.99 (server) erreich ich, aber was hinter eth0 hängt nicht! :evil:

maxpowers · 16 Okt. 2004

Hallo was gibt denn der Befehl
von einem Rechner aus dem 192.168.1.0/24

Code:

pathping X

wobei X ein Rechner aus dem 10.0.0.0/24 Netz ist und umgekehrt.

Dabach poste mal den Output von

Code:

ifconfig

des Routers

mitch-geht-ab · 17 Okt. 2004

also, da gibt es schon die ersten probleme, ich hab jetzt wie gesagt dies gemacht

ich hab jetzt eth1 auch zum internen netzwerk hinzugefügt...
ebenfalls hab ich unter punkt 23 class routing auf yes!

allerdings kann ich jetzt weder server/router 10.0.0.99 noch sonst was anpingen, geschweige denn erreichen (mit \\10.0.0.99 im explorer!

wenn ich die firewall deaktiviere, kann ich wenigstens den server erreichen, komm aber nicht ins interne netzwerk (192.168.1.0)

pathping funzt am server (suse) nicht! am laptop wird einfach angezeigt wenn er erreichen will, und das wars dann... zeitüberschreitung!

ifconfig ist wenig spektakulär, wärds trotzdem mal reinschreiben

Code:

server:~ # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:40:63:D7:E8:79
          inet addr:192.168.1.99  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::240:63ff:fed7:e879/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2942100 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4026979 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:236341425 (225.3 Mb)  TX bytes:1025762207 (978.2 Mb)
          Interrupt:11 Base address:0xe400

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:3092 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3092 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:226034 (220.7 Kb)  TX bytes:226034 (220.7 Kb)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:xx.xx.xx.xx  P-t-P:217.5.98.14  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:168171 errors:0 dropped:0 overruns:0 frame:0
          TX packets:227898 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:39351827 (37.5 Mb)  TX bytes:23304863 (22.2 Mb)

eth1      Link encap:Ethernet  HWaddr 00:FF:64:93:28:D7
          inet addr:10.0.0.99  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2ff:64ff:fe93:28d7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:148 (148.0 b)

und hier ist nochmal die firewall regeln wie ich se im moment habe!

Code:

# ------------------------------------------------------------------------

## Path:	Network/Firewall/SuSEfirewall2
## Description:	SuSEfirewall2 configuration
## Type:	yesno
## Default:	no
## ServiceRestart: SuSEfirewall2_setup
#
# 1.)
# Should the Firewall run in quickmode?
#
# "Quickmode" means that only the interfaces pointing to external networks
# are secured, and no other. all interfaces not in the list of FW_DEV_EXT
# are allowed full network access! Additionally, masquerading is
# automatically activated for FW_MASQ_DEV devices. and last but not least:
# all incoming connection via external interfaces are REJECTED.
# You will only need to configure 2.) and FW_MASQ_DEV in 6.)
# Optionally, you may add entries to section 9a.)
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_QUICKMODE="no"

## Type:	string
# 2.)
# Which is the interface that points to the internet/untrusted networks?
#
# Enter all the network devices here which are untrusted.
#
# Choice: any number of devices, seperated by a space
# e.g. "eth0", "ippp0 ippp1 eth0:1"
#
FW_DEV_EXT="ppp0"

## Type:	string
#
# 3.)
# Which is the interface that points to the internal network?
#
# Enter all the network devices here which are trusted.
# If you are not connected to a trusted network (e.g. you have just a
# dialup) leave this empty.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_INT="eth0 eth1"

## Type:	string
#
# 4.)
# Which is the interface that points to the dmz or dialup network?
#
# Enter all the network devices here which point to the dmz/dialups.
# A "dmz" is a special, seperated network, which is only connected to the
# firewall, and should be reachable from the internet to provide services,
# e.g. WWW, Mail, etc. and hence are at risk from attacks.
# See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example.
#
# Special note: You have to configure FW_FORWARD to define the services
# which should be available to the internet and set FW_ROUTE to yes.
#
# Choice: leave empty or any number of devices, seperated by a space
# e.g. "tr0", "eth0 eth1 eth1:1" or ""
#
FW_DEV_DMZ=""

## Type:	yesno
## Default:	no
#
# 5.)
# Should routing between the internet, dmz and internal network be activated?
# REQUIRES: FW_DEV_INT or FW_DEV_DMZ
#
# You need only set this to yes, if you either want to masquerade internal
# machines or allow access to the dmz (or internal machines, but this is not
# a good idea). This option supersedes IP_FORWARD from
# /etc/sysconfig/network/options
#
# Setting this option one alone doesn't do anything. Either activate
# massquerading with FW_MASQUERADE below if you want to masquerade your
# internal network to the internet, or configure FW_FORWARD to define
# what is allowed to be forwarded!
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ROUTE="yes"

## Type:	yesno
## Default:	no
#
# 6.)
# Do you want to masquerade internal networks to the outside?
# REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE
#
# "Masquerading" means that all your internal machines which use services on
# the internet seem to come from your firewall.
# Please note that it is more secure to communicate via proxies to the
# internet than masquerading. This option is required for FW_MASQ_NETS and
# FW_FORWARD_MASQ.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_MASQUERADE="yes"

## Type:	string
#
# You must also define on which interface(s) to masquerade on. This is
# normally your external device(s) to the internet.
# Most users can leave the default below.
#
# e.g. "ippp0" or "$FW_DEV_EXT"
FW_MASQ_DEV="$FW_DEV_EXT"

## Type:	string
#
# Which internal computers/networks are allowed to access the internet
# directly (not via proxys on the firewall)?
# Only these networks will be allowed access and will be masqueraded!
#
# Choice: leave empty or any number of hosts/networks seperated by a space.
# Every host/network may get a list of allowed services, otherwise everything
# is allowed. A target network, protocol and service is appended by a comma to
# the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with
# unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows
# the 10.0.1.0 network to use www/ftp to the internet.
# "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too.
# Set this variable to "0/0" to allow unrestricted access to the internet.
#
FW_MASQ_NETS="192.168.1.0/24 10.0.0.0/24"

## Type:	yesno
## Default:	yes
#
# 7.)
# Do you want to protect the firewall from the internal network?
# REQUIRES: FW_DEV_INT
#
# If you set this to "yes", internal machines may only access services on
# the machine you explicitly allow. They will be also affected from the
# FW_AUTOPROTECT_SERVICES option.
# If you set this to "no", any user can connect (and attack) any service on
# the firewall.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
# "yes" is a good choice
FW_PROTECT_FROM_INTERNAL="no"

## Type:	yesno
## Default:	yes
#
# 8.)
# Do you want to autoprotect all running network services on the firewall?
#
# If set to "yes", all network access to services TCP and UDP on this machine
# will be prevented (except to those which you explicitly allow, see below:
# FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP})
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_AUTOPROTECT_SERVICES="yes"

## Type:	string
#
# 9.)
# Which services ON THE FIREWALL should be accessible from either the internet
# (or other untrusted networks), the dmz or internal (trusted networks)?
# (see no.13 & 14 if you want to route traffic through the firewall) XXX
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP.
# e.g. if a webserver on the firewall should be accessible from the internet:
# FW_SERVICES_EXT_TCP="www"
# e.g. if the firewall should receive syslog messages from the dmz:
# FW_SERVICES_DMZ_UDP="syslog"
# For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set
# FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols)
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# Common: smtp domain
FW_SERVICES_EXT_TCP="ssh www 2121 4000:8000 17100:17200 47624 2300:2400 34987 10266 5000"
#                                 
## Type:	string
# Common: domain
FW_SERVICES_EXT_UDP="123 2121 4000:8000 2300:2600 5000"	# Common: domain
#                                

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_EXT_IP=""

## Type:	string
#
# Common: smtp domain
FW_SERVICES_DMZ_TCP=""

## Type:	string
# Common: domain
FW_SERVICES_DMZ_UDP=""

## Type:	string
# For VPN/Routing which END at the firewall!!
FW_SERVICES_DMZ_IP=""

## Type:	string
#
# Common: ssh smtp domain
FW_SERVICES_INT_TCP="ssh www 2121 17100:17200 47624 2300:2400 34987 10266 5000"
#                                

## Type:	string
# Common: domain syslog
FW_SERVICES_INT_UDP="123 2121 2300:2400 5000"
#                                

# For VPN/Routing which END at the firewall!!
FW_SERVICES_INT_IP=""

## Type:	string
# 9a.)
# External services in QUICKMODE.
# This is only used for QUICKMODE (see 1.)!
# (The settings here are similar to section 9.)
# Which services ON THE FIREWALL should be accessible from either the 
# internet (or other untrusted networks), i.e. the external interface(s)
# $FW_DEV_EXT
#
# Enter all ports or known portnames below, seperated by a space.
# TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_QUICK_TCP, and
# UDP services (e.g. syslog) must be set in FW_SERVICES_QUICK_UDP.
# e.g. if a secure shell daemon on the firewall should be accessible from
# the internet: 
# FW_SERVICES_QUICK_TCP="ssh"
# e.g. if the firewall should receive isakmp (IPsec) internet:
# FW_SERVICES_QUICK_UDP="isakmp"
# For IP protocols (like IPsec) you need to set
# FW_SERVICES_QUICK_IP="50"
#
# Choice: leave empty or any number of ports, known portnames (from
# /etc/services) and port ranges seperated by a space. Port ranges are
# written like this: allow port 1 to 10 -> "1:10"
# e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514"
# For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2")
#
# QUICKMODE: TCP services open to external networks (InterNet)
# (Common: ssh smtp)
FW_SERVICES_QUICK_TCP=""

## Type:	string
# QUICKMODE: UDP services open to external networks (InterNet)
# (Common: isakmp)
FW_SERVICES_QUICK_UDP=""

## Type:	string
# QUICKMODE: IP protocols unconditionally open to external networks (InterNet)
# (For VPN firewall that is VPN gateway: 50)
FW_SERVICES_QUICK_IP=""

## Type:	string
#
# 10.)
# Which services should be accessible from trusted hosts/nets?
#
# Define trusted hosts/networks (doesnt matter if they are internal or
# external) and the TCP and/or UDP services they are allowed to use.
# Please note that a trusted host/net is *not* allowed to ping the firewall
# until you set it to allow also icmp!
#
# Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or
# networks, seperated by a space. e.g. "172.20.1.1 172.20.0.0/16"
# Optional, enter a protocol after a comma, e.g. "1.1.1.1,icmp"
# Optional, enter a port after a protocol, e.g. "2.2.2.2,tcp,22"
#
FW_TRUSTED_NETS=""

## Type:	string
#
# 11.)
# How is access allowed to high (unpriviliged [above 1023]) ports?
#
# You may either allow everyone from anyport access to your highports ("yes"),
# disallow anyone ("no"), anyone who comes from a defined port (portnumber or
# known portname) [note that this is easy to circumvent!], or just your
# defined nameservers ("DNS").
# Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root
# from a firewall using this script (well, you can if you include range
# 600:1023 in FW_SERVICES_EXT_UDP ...).
# Please note that with v2.1 "yes" is not mandatory for active FTP from
# the firewall anymore.
#
# Choice: "yes", "no", "DNS", portnumber or known portname,
#         if not set defaults to "no"
#
# Common: "ftp-data", better is "yes" to be sure that everything else works :-(
FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes"

## Type:	string
# Common: "DNS" or "domain ntp", better is "yes" to be sure ...
FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes"

## Type:	yesno
## Default:	yes
#
# 12.)
# Are you running some of the services below?
# They need special attention - otherwise they won´t work!
#
# Set services you are running to "yes", all others to "no",
# if not set defaults to "no"
# If you want to offer the below services to your DMZ as well,
# (and not just internally), set the switches below to "dmz",
# if you even want to offer to the world as well, set to "ext"
# instead of "yes" (NOT RECOMMENDED FOR SECURITY REASONS!)
#
FW_SERVICE_AUTODETECT="yes"	# Autodetect the services below when starting

## Type:	yesno
## Default:	no
# If you are running bind/named set to yes. Remember that you have to open
# port 53 (or "domain") as udp/tcp to allow incoming queries.
# Also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes"
FW_SERVICE_DNS="no"

## Type:	yesno
## Default:	no
# if you use dhclient to get an ip address you have to set this to "yes" !
FW_SERVICE_DHCLIENT="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is a DHCP server
FW_SERVICE_DHCPD="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running squid. You still have to open the
# tcp port 3128 to allow remote access to the squid proxy service.
FW_SERVICE_SQUID="no"

## Type:	yesno
## Default:	no
# set to "yes" if this server is running a samba server. You still have to 
# open the tcp port 139 to allow remote access to SAMBA.
FW_SERVICE_SAMBA="no"

## Type:	string
#
# 13.)
# Which services accessed from the internet should be allowed to the
# dmz (or internal network - if it is not masqueraded)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must have valid, non-private, IP addresses which were assigned to
# you by your ISP. This opens a direct link to your network, so only use
# this option for access to your dmz!!!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forwarding rules, seperated each by a space.
# A forwarding rule consists of 1) source IP/net and 2) destination IP
# seperated by a comma. e.g. "1.1.1.1,2.2.2.2 3.3.3.3/16,4.4.4.4/24"
# Optional is a protocol, seperated by a comma, e.g. "5.5.5.5,6.6.6.6,igmp"
# Optional is a port after the protocol with a comma, e.g. "0/0,0/0,udp,514"
#
FW_FORWARD=""		# Beware to use this!

## Type:	string
#
# 14.)
# Which services accessed from the internet should be allowed to masqueraded
# servers (on the internal network or dmz)?
# REQUIRES: FW_ROUTE
#
# With this option you may allow access to e.g. your mailserver. The
# machines must be in a masqueraded segment and may not have public IP addesses!
# Hint: if FW_DEV_MASQ is set to the external interface you have to set
# FW_FORWARD from internal to DMZ for the service as well to allow access
# from internal!
#
# Please note that this should *not* be used for security reasons! You are
# opening a hole to your precious internal network. If e.g. the webserver there
# is compromised - your full internal network is compromised!!
#
# Choice: leave empty (good choice!) or use the following explained syntax
# of forward masquerade rules, seperated each by a space.
# A forward masquerade rule consists of 1) source IP/net, 2) the IP to which
# the requests will be forwarded to (in the dmz/intern net), 3) a protocol
# (tcp/udp only!) and 4) destination port, seperated by a comma (","), e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80"
#
# Optional is a port after the destination port, to redirect the request to
# a different destination port on the destination IP, e.g.
# "4.0.0.0/8,1.1.1.1,tcp,80,81"
#
# Optional is an target IP address on which should the masquerading be decided.
# You have to set the optional port option to use this.
#
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80,81,202.202.202.202
# The class C network 200.200.200.0/24 trying to access 202.202.202.202 port
# 80 will be forwarded to the internal server 10.0.0.10 on port 81.
# Example:
# 200.200.200.0/24,10.0.0.10,tcp,80
# The class C network 200.200.200.0/24 trying to access anything which goes
# through this firewall ill be forwarded to the internal server 10.0.0.10 on
# port 80
#
FW_FORWARD_MASQ="                 		
0/0,192.168.1.11,tcp,17100:17200                    
0/0,192.168.1.11,tcp,47624         
0/0,192.168.1.11,tcp,2300:2400
0/0,192.168.1.11,udp,2300:2400
0/0,192.168.1.11,tcp,34987
0/0,192.168.1.11,tcp,10266"         		# Beware to use this!

## Type:	string
#
# 15.)
# Which accesses to services should be redirected to a localport on the
# firewall machine?
#
# This can be used to force all internal users to surf via your squid proxy,
# or transparently redirect incoming webtraffic to a secure webserver.
# 
# Choice: leave empty or use the following explained syntax of redirecting
# rules, seperated by a space.
# A redirecting rule consists of 1) source IP/net, 2) destination IP/net,
# 3) protocol (tcp or udp) 3) original destination port and 4) local port to
# redirect the traffic to, seperated by a colon. e.g.:
# "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080"
# Please note that as 2) destination, you may add '!' in front of the IP/net
# to specify everything EXCEPT this IP/net.
#
FW_REDIRECT=""

## Type:	yesno
## Default:	yes
#
# 16.)
# Which logging level should be enforced?
# You can define to log packets which were accepted or denied.
# You can also the set log level, the critical stuff or everything.
# Note that logging *_ALL is only for debugging purpose ...
#
# Choice: "yes" or "no", if not set FW_LOG_*_CRIT defaults to "yes", and
# FW_LOG_*_ALL defaults to "no"
#
FW_LOG_DROP_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_DROP_ALL="no"

## Type:	yesno
## Default:	yes
#
FW_LOG_ACCEPT_CRIT="yes"

## Type:	yesno
## Default:	no
#
FW_LOG_ACCEPT_ALL="no"

## Type:	string
#
# only change/activate this if you know what you are doing!
FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW"

## Type:	yesno
## Default:	yes
#
# 17.)
# Do you want to enable additional kernel TCP/IP security features?
# If set to yes, some obscure kernel options are set.
# (icmp_ignore_bogus_error_responses, icmp_echoreply_rate,
#  icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate,
#  ip_local_port_range, log_martians, mc_forwarding, mc_forwarding,
#  rp_filter, routing flush)
# Tip: Set this to "no" until you have verified that you have got a
# configuration which works for you. Then set this to "yes" and keep it
# if everything still works. (It should!) ;-)
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_KERNEL_SECURITY="yes"

## Type:	yesno
## Default:	no
#
# 18.)
# Keep the routing set on, if the firewall rules are unloaded?
# REQUIRES: FW_ROUTE
#
# If you are using diald, or automatic dialing via ISDN, if packets need
# to be sent to the internet, you need to turn this on. The script will then
# not turn off routing and masquerading when stopped.
# You *might* also need this if you have got a DMZ.
# Please note that this is *insecure*! If you unload the rules, but are still
# connected, you might your internal network open to attacks!
# The better solution is to remove "/sbin/SuSEfirewall2 stop" or
# "/sbin/init.d/firewall stop" from the ip-down script!
#
#
# Choices "yes" or "no", if not set defaults to "no"
#
FW_STOP_KEEP_ROUTING_STATE="no"

## Type:	yesno
## Default:	yes
#
# 19.)
# Allow (or don't) ICMP echo pings on either the firewall or the dmz from
# the internet? The internet option is for allowing the DMZ and the internal
# network to ping the internet.
# REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT
#
# Choice: "yes" or "no", defaults to "no" if not set
#
FW_ALLOW_PING_FW="no"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_DMZ="no"

## Type:	yesno
## Default:	no
#
FW_ALLOW_PING_EXT="no"

##
# END of /etc/sysconfig/SuSEfirewall2
##

#                                                                         #
#-------------------------------------------------------------------------#
#                                                                         #
# EXPERT OPTIONS - all others please don't change these!                  #
#                                                                         #
#-------------------------------------------------------------------------#
#                                                                         #

## Type:	yesno
## Default:	yes
#
# 20.)
# Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall.
# This is used for traceroutes to your firewall (or traceroute like tools).
#
# Please note that the unix traceroute only works if you say "yes" to
# FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say
# additionally "yes" to FW_ALLOW_PING_FW
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_TRACEROUTE="yes"

## Type:	yesno
## Default:	yes
#
# 21.)
# Allow ICMP sourcequench from your ISP?
#
# If set to yes, the firewall will notice when connection is choking, however
# this opens yourself to a denial of service attack. Choose your poison.
#
# Choice: "yes" or "no", if not set defaults to "yes"
#
FW_ALLOW_FW_SOURCEQUENCH="yes"

## Type:	yesno
## Default:	no
#
# 22.)
# Allow/Ignore IP Broadcasts?
#
# If set to yes, the firewall will not filter broadcasts by default.
# This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast
# option is used.
# If you do not want to allow them however ignore the annoying log entries,
# set FW_IGNORE_FW_BROADCAST to yes.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_FW_BROADCAST="no"

## Type:	yesno
## Default:	yes
#
FW_IGNORE_FW_BROADCAST="yes"

## Type:	yesno
## Default:	no
#
# 23.)
# Allow same class routing per default?
# REQUIRES: FW_ROUTE
#
# Do you want to allow routing between interfaces of the same class
# (e.g. between all internet interfaces, or all internal network interfaces)
# be default (so without the need setting up FW_FORWARD definitions)?
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_ALLOW_CLASS_ROUTING="yes"

## Type:	string
#
# 25.)
# Do you want to load customary rules from a file?
#
# This is really an expert option. NO HELP WILL BE GIVEN FOR THIS!
# READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom
#
#FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
FW_CUSTOMRULES=""

## Type:	yesno
## Default:	no
#
# 26.)
# Do you want to REJECT packets instead of DROPing?
#
# DROPing (which is the default) will make portscans and attacks much
# slower, as no replies to the packets will be sent. REJECTing means, that
# for every illegal packet, a connection reject packet is sent to the
# sender.
#
# Choice: "yes" or "no", if not set defaults to "no"
#
FW_REJECT="no"

ich flip ehrlich bald aus! alles was ich will ist doch einfach mal drucken, oder nen anderen rechner erreichen (sprich freigaben)

[/code]

gaw · 17 Okt. 2004

Eine Frage, über welche physikalische Schnittstelle läuft dein ppp0?

mfG
gaw

mitch-geht-ab · 17 Okt. 2004

über eth0.
ist im moment zum experimentieren!
sobald das subnetz funzt, wird eine 3. NIC eingebaut!

gaw · 17 Okt. 2004

Vielleicht bin ich heute zu langsam. Ich dachte eth0 wäre bei dir 192.168.1.99:

server:~ # ifconfig
eth0 Link encap:Ethernet HWaddr 00:40:637:E8:79
inet addr:192.168.1.99 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::240:63ff:fed7:e879/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2942100 errors:0 dropped:0 overruns:0 frame:0
TX packets:4026979 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:236341425 (225.3 Mb) TX bytes:1025762207 (978.2 Mb)
Interrupt:11 Base address:0xe400

Hängt an deinem eth0 gleichzeitig ein dsl-modem und ein internes Netz?

mfG
gaw

mitch-geht-ab · 17 Okt. 2004

jupp! ich hab noch nen ollen switch gehabt, aber keine 3. NIC! =)
also bevor ich mir ne NIC für ganze 10 euro kaufe =) hab ich es erstmal so gemacht!
weil wenn ich mir eine kauf, ist die nächste ne 1GBit! und die sind teurer!

aber zurück zum Problem =) weist du ne lösung?

gaw · 18 Okt. 2004

Das scheint mir aber sehr merkwürdig, etwa so?

192.168.x.x
|
eth1
linuxbox
eth0
|
switch--------------dslmodem
|
192.168.1.x

Du weißt dass das dslmodem nur über einen 10MBit-Ethernet Anschluß verfügt? Außerdem müsstest du wahrscheinlich das gesamte Firewallscript umschreiben, denn du hast kein internes und externes Netz sondern, nicht böse sein, wenn ich es so hart formuliere, bullshit.
Nicht nur dass du einen Teil deines Netzes auf 10MBit ausbremst du müsstest die Regeln schon im iptables selber umschreiben, weil die Pakete zum Teil ja wieder über die gleiche Schnittstelle raussollen als sie reinkommen. Ich weiß nicht, ob man die SuSEFirewall dazu bewegen kann mit dieser Konfiguration zu arbeiten. Ich habe auch keine Lust das auszutesten.

Mein Vorschlag, kauf dir eine dritte Netzwerkkarte oder bau dein lokales Netz so um das du den einen switch an einen up-link des anderen hängst.

192.168.1.x (Mehrere Clients)
|
switch------switch----192.168.1.x (Mehrere Clients)
|
eth1
linuxbox
eth0
|
dslmodem.

Das ist wahrscheinlich die beste Lösung. Dann funktioniert wahrscheinlich auch die SuSE-Firewall. So wird die Konfiguration verinfacht, die Sicherheit wieder erhöht und die Hardwareressourcen geschont. Vielleicht hast du aber wirklich gute Gründe dein Netz in 2 Subnetze zu teilen, dann wäre aber eine 3 Netztwerkkarte schon notwendig.

mfG
gaw

mitch-geht-ab · 18 Okt. 2004

wieso?
es funktioniert alles bestens!

ppp0 ist doch quasi nur eine virtuelle schnittstelle! bremst auch nicht eth0 aus!

es funktioniert eigentlich alles bestens, obwohl es öfters zu collisionen kommt, da wie schon gesagt dsl und subnetz1 über die selbe physikalische schnittstelle laufen!

wenn ich ppp0 anspreche, spricht er mir sauber das inet an!
wenn ich eth0 anspreche, spricht er mir sauber das subnetz1 an!

wie ich auch schon sagte ist das nicht professionell sondern nur zum testen!

sobald das mal essenziell funktioniert ist eine 3. NIC da, und ich setz den server eh neu auf!
ist ja auch noch ne ram erweiterung fällig!

von daher...

suse FW2 routet keine 2 subnetze

Member

Ultimate Guru

Member

Ultimate Guru

Member

Ultimate Guru

Member

Ultimate Guru

Member

Member

Member

Member

Member

Member

Hacker

Member

Hacker

Member

Hacker

Member