#
# Shorewall version 1.0 - Rules File
#
# /etc/shorewall/rules 
#
#	Rules in this file govern connection establishment. Requests and responses are automatically
#       allowed using connection tracking.
#
# Columns are:
#
#
#	RESULT		ACCEPT, DROP or REJECT
#
#				ACCEPT -- allow the connection request
#				DROP   -- ignore the request
#				REJECT -- disallow the request and return an icmp-unreachable packet.
#
#			May optionally be followed by ":" and a syslog log level (e.g, REJECT:info).
#			This causes the packet to be logged at the specified level.
#	
#	CLIENT(S)	Hosts permitted to be clients. May be a zone defined in /etc/shorewall/zones
# 			or "fw" to indicate the firewall itself.
#
#                       Clients may be further restricted to a particular subnet or host by appending
#                       ":" and the subnet or host.
#
#			dmz:192.168.2.2                  Host 192.168.2.2 in the DMZ
#			net:155.186.235.0/24	 	 Subnet 155.186.235.0/24 on the Internet
#
#			Alternatively, clients may be specified by interface by appending ":" followed
#			by the interface name. For example, local:eth1 specifies a client that communicates
#			with the firewall system through eth1.
#
#	SERVER		Location of Server. May be a zone defined in /etc/shorewall/zones or "fw" to 
#                       indicate the firewall itself.
#
#			The server may be further restricted to a particular subnet, host or interface by
#			appending ":" and the subnet, host or interface. See above.
#
#			The port that the server is listening on may be included and separated from the
#			server's IP address by ":". If omitted, the firewall will not modifiy the destination
#			port. 
#
#			Example: local:192.168.1.3:8080 specifies a local server at IP address 192.168.1.3 
#			and listening on port 8080. The port number MUST be specified as an integer and not as a 
#			name from /etc/services.
#
#	PROTO		Protocol - Must be "tcp", "udp", "icmp", a number or "all"
#
#	PORT(S)		Destination Port. A Port name (from /etc/services), port number or port 
#			range; if the protocol is "icmp", this column is
#                       interpreted as the destination icmp-type.
#
#			This column is ignored if PROTOCOL = all but must be entered if any of the following
#			fields are supplied. In that case, it is suggested that this field contain "-"
#
#	CLIENT PORT(S)  (Optional) Port(s) used by the client. If omitted, any source port is acceptable.
#
#			If you don't want to restrict client ports but need to specify an ADDRESS in the
#			next column, then place "-" in this column.
#
#	ADDRESS 	(0ptional) If included and different from the IP address given in the SERVER column, 
#                       this is an address on some interface on the firewall and connections to that address
#			will be forwarded to the IP and port specified in the SERVER column.
#
#			If the special value "all" is used, then requests from the client zone given in
#			the CLIENT(s) column with the destination port given in PORT(s) will be forwarded to
#			the IP address given in SERVER.
#
#			Example: Forward all ssh connection requests from the internet to local system
#				 192.168.1.3
#
#			#RESULT CLIENTS	SERVER(S)		PROTO	PORT(S)		CLIENT PORT(S)	ADDRESS
#			ACCEPT	net	local:192.168.1.3	tcp	ssh		-		all
#
#			Example: Redirect all locally-originating www connection requests to port 8080 on the 
#				 firewall (Squid running on the firewall system)
#
#			#CLIENTS	SERVER(S)		PROTO	PORTS(S)	CLIENT PORT(S)	ADDRESS
#                       local		fw::8080		tcp	www		-		all
################################################################################################################
#RESULT		CLIENT(S)		SERVER(S)	PROTO	PORT(S)			CLIENT PORT(S)	ADDRESS
#
# Allow SSH from the local network
#
ACCEPT		local			fw		tcp	ssh
#
# Allow SSH from the internet
#
ACCEPT		net			fw		tcp	ssh
#
# Run an identd on the firewall that is accessible from outside.
#
ACCEPT		net			fw		tcp	auth
#
# Run an NTP daemon on the firewall that is synced with outside sources
#
ACCEPT		fw			net		udp	ntp
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

