#
# Shorewall version 1.1 - Rules File
#
# /etc/shorewall/rules

##############################################################################
#RESULT	CLIENT	SERVER(S)		PROTO	PORT(S)	CLIENT	ADDRESS
#							PORT(S)
# Secure Shell -- Local->fw and forward net->loc:192.168.1.3
#
ACCEPT	loc	fw			tcp	ssh
ACCEPT	net	loc:192.168.1.3 	tcp	ssh	-	all

#
# We don't run identd so reject connection requests to that service
#
REJECT	net	fw			tcp	auth

#
# Our IP was previously used by someone who ran an online game server on UDP
# port 27015. Silently drop those packets
#
REJECT	net	fw			udp	27015

#
# DNS -- fw->net for backup.
#	 fw->192.168.1.3 (our local name server)
#	 drop late replies from the network and from our local server
#
ACCEPT	fw	net			udp	domain
ACCEPT	fw	net			tcp	domain
ACCEPT	net	loc:192.168.1.3		udp	domain		-	all
DROP	net	fw			udp	-	domain
DROP	loc:192.168.1.3		fw	udp	-  	domain
#
# We run the Linux PPTP client on the firewall and connect to servers in
# 161.114.0.0/16
#
ACCEPT	net:161.114.0.0/16	fw	47
ACCEPT  fw	net:161.114.0.0/16	tcp	1723
ACCEPT	fw	net:161.114.0.0/16	47
#
# There is an ICQ client running on 192.168.1.8. It is configured to use the
# default TCP port range (4000-4100)
#
ACCEPT	net	loc:192.168.1.8		tcp	4000:4100	-	all
#
# We run ntpd on the firewall. Our upstream ntpd runs on 206.191.149.193
#
ACCEPT	fw	net:206.191.149.193	udp	ntp
#
# Allow running whois on the firewall
#
ACCEPT	fw	net			tcp	whois

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
