Re: [gentoo-user] Setting up shorewall

[Peter Humphrey]

On Thursday 30 Mar 2017 17:23:13 Adam Carter wrote:
> On Thu, Mar 30, 2017 at 2:59 AM, Peter Humphrey <peter@××××××××××××.uk>
>
> wrote:
> > Hello list,
> >
> > I've been using shorewall happily for many years, but now I have a LAN
> > setup
> > that the docs seem not to cover. The new web-server box I mentioned
> > recently
> > has two Ethernet ports, which I want to connect as follows:
> >
> > Port 1 (enp1s0) will be connected to a spare port on my vDSL
> > modem/router
> > and be accessible from outside. An HTTP hole* will be opened in the
> > router for this.
> >
> > Port 2 (enp2s0) is connected to my LAN switch, which is connected in
> > turn
> > to
> > another port on the vDSL modem, which has no holes open to this port.
> > Once the server goes into service this interface will be down most of
> > the time.
> >
> > I want to ensure that no bridging occurs between the two ports in the
> > web
> > server.
>
> The term "bridging" implies layer 2 forwarding, like what a hub or switch
> does. You have to do a little work to set that up, so it wont happen by
> accident.
>
> Routing, at layer 3, just requires /proc/sys/net/ipv4/ip_forward to be set
> to 1. However since you're allowing connections to the webserver, any
> compromise of that webserver means that any network connected to the
> webserver is available without restriction. This is why webservers are
> typically put in a DMZ, and a firewall used to connect the outside, the
> DMZ and the inside.

Yes, I understand that last.

> For HTTPS, get a LetsEntrypt cert.

Ah! Thanks for the pointer. I'll follow it up.

> FWIW i'm running my home system pretty much the way you propose, and
> AFAICT i haven't been compromised...but there's little of value there.

A little confidence, then. Thanks for that too.

-- 
Regards
Peter