SHOREWALL-TUNNELS(5) | Configuration Files | SHOREWALL-TUNNELS(5) |
tunnels - Shorewall VPN definition file
/etc/shorewall[6]/tunnels
The tunnels file is used to define rules for encapsulated (usually encrypted) traffic to pass between the Shorewall system and a remote gateway. Traffic flowing through the tunnel is handled using the normal zone/policy/rule mechanism. See http://www.shorewall.net/VPNBasics.html[1] for details.
The columns in the file are as follows.
TYPE - {ipsec[:{noah|ah}]|ipsecnat|ipip|gre|l2tp|pptpclient|pptpserver|?COMMENT|{openvpn|openvpnclient|openvpnserver}[:{tcp|udp}][:port]|generic:protocol[:port]}
6to4 or 6in4 - 6to4 or 6in4 tunnel. The 6in4 synonym was added in 4.4.24.
ipsec - IPv4 IPSEC
ipsecnat - IPv4 IPSEC with NAT Traversal (UDP port 4500 encapsulation)
ipip - IPv4 encapsulated in IPv4 (Protocol 4)
gre - Generalized Routing Encapsulation (Protocol 47)
l2tp - Layer 2 Tunneling Protocol (UDP port 1701)
pptpclient - PPTP Client runs on the firewall
pptpserver - PPTP Server runs on the firewall
openvpn - OpenVPN in point-to-point mode
openvpnclient - OpenVPN client runs on the firewall
openvpnserver - OpenVPN server runs on the firewall
generic - Other tunnel type
tinc - TINC (added in Shorewall 4.6.6)
If the type is ipsec, it may be followed by :ah to indicate that the Authentication Headers protocol (51) is used by the tunnel (the default is :noah which means that protocol 51 is not used). NAT traversal is only supported with ESP (protocol 50) so ipsecnat tunnels don't allow the ah option (ipsecnat:noah may be specified but is redundant).
If type is openvpn, openvpnclient or openvpnserver it may optionally be followed by ":" and tcp or udp to specify the protocol to be used. If not specified, udp is assumed.
If type is openvpn, openvpnclient or openvpnserver it may optionally be followed by ":" and the port number used by the tunnel. if no ":" and port number are included, then the default port of 1194 will be used. . Where both the protocol and port are specified, the protocol must be given first (e.g., openvpn:tcp:4444).
If type is generic, it must be followed by ":" and a protocol name (from /etc/protocols) or a protocol number. If the protocol is tcp or udp (6 or 17), then it may optionally be followed by ":" and a port number.
Comments may be attached to Netfilter rules generated from entries in this file through the use of /COMMENT lines. These lines begin with ?COMMENT; the remainder of the line is treated as a comment which is attached to subsequent rules until another ?COMMENT line is found or until the end of the file is reached. To stop adding comments to rules, use a line containing only ?COMMENT.
ZONE - zone
GATEWAY(S) (gateway or gateways) - address-or-range [ , ... ]
Beginning with Shorewall 4.5.3, a list of addresses or ranges may be given. Exclusion (shorewall-exclusion[2] (5) ) is not supported.
GATEWAY ZONES (gateway_zone or gateway_zones) - [zone[,zone]...]
IPv4 Example 1:
The remote gateway is 4.33.99.124 and the remote subnet is 192.168.9.0/24. The tunnel does not use the AH protocol
#TYPE ZONE GATEWAY
ipsec:noah net 4.33.99.124
IPv4 Example 2:
#TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 0.0.0.0/0 gw
IPv4 Example 3:
#TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 4.33.99.124 gw
IPv4 Example 4:
#TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 0.0.0.0/0 vpn1,vpn2,vpn3
IPv4 Example 5:
#TYPE ZONE GATEWAY GATEWAY ZONES
pptpclient net 192.0.2.221
IPv4 Example 6:
#TYPE ZONE GATEWAY GATEWAY ZONES
pptpserver net 0.0.0.0/0
Example 7:
#TYPE ZONE GATEWAY GATEWAY ZONES
openvpn:7777 net 4.33.99.124
IPv4 Example 8:
#TYPE ZONE GATEWAY GATEWAY ZONES
generic:udp:4444 net 4.3.99.124
IPv4 Example 9:
#TYPE ZONE GATEWAY GATEWAY ZONES
tinc net 0.0.0.0/0
IPv6 Example 1:
The remote gateway is 2001:cec792b4:1::44. The tunnel does not use the AH protocol
#TYPE ZONE GATEWAY
ipsec:noah net 2002:cec792b4:1::44
IPv6 Example 2:
#TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net ::/0 gw
IPv6 Example 3:
#TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 2001:cec792b4:1::44 gw
IPv6 Example 4:
#TYPE ZONE GATEWAY GATEWAY ZONES
openvpn:7777 net 2001:cec792b4:1::44
IPv6 Example 8:
#TYPE ZONE GATEWAY GATEWAY ZONES
generic:udp:4444 net 2001:cec792b4:1::44
IPv6 Example 9:
#TYPE ZONE GATEWAY GATEWAY ZONES
tinc net ::/0
/etc/shorewall/tunnels
/etc/shorewall6/tunnels
http://www.shorewall.net/configuration_file_basics.htm#Pairs[3]
02/11/2019 | Configuration Files |