#
# Shorewall 1.2 /etc/shorewall/params
#
# This sample can be used to implement a simple firewall on a system with
# two network interfaces. The first interface interfaces to the internet and
# the second interfaces to a local network.
##############################################################################
#
# Specify the name of your internet interface in the following variable.
#
# If you access the internet via dial-up, the interface name with be ppp0
# If you have an ethernet interface to the internet, your interface name will
# be eth0.

NET_IF=eth0

# Specify the broadcast address for your network interface here. If your
# internet interface is point-to-point (such as with dial-up), then set this
# to "-". If you want Shorewall to automatically detect the broadcast address,
# you can set the variable to "detect"; you will have to start your network
# interface before starting Shorewall for this to work.

NET_BCAST=detect

#
# Specify the interface options in this variable as a comma-separated list.
#
# Possible options are as follows:
#			dhcp	     - interface is managed by DHCP
#			noping	     - icmp echo-request (ping) packets should
#				       be ignored on this interface
#			routestopped - When the firewall is stopped, allow
#				       and route traffic to and from this
#				       interface.
#			norfc1918    - This interface should not receive
#				       any packets whose source is in one
#				       of the ranges reserved by RFC 1918
#				       (i.e., private or "non-routable"
#				       addresses.
#			multi	     - This interface has multiple IP
#				       addresses and you want to be able to
#				       route between them.
#			routefilter  - turn on kernel route filtering for this
#				       interface.
#

NET_OPTIONS=dhcp,noping,norfc1918

#
# Specify the name of your local interface in the following variable.
#

LOCAL_IF=eth1

# Specify the broadcast address for your network interface here. If your
# internet interface is point-to-point (such as with dial-up), then set this
# to "-". If you want Shorewall to automatically detect the broadcast address,
# you can set the variable to "detect"; you will have to start your network
# interface before starting Shorewall for this to work.

LOCAL_BCAST=detect

#
# Specify the interface options in this variable as a comma-separated list.
#
# Possible options are as follows:
#			dhcp	     - interface is managed by DHCP
#			noping	     - icmp echo-request (ping) packets should
#				       be ignored on this interface
#			routestopped - When the firewall is stopped, allow
#				       and route traffic to and from this
#				       interface.
#			norfc1918    - This interface should not receive
#				       any packets whose source is in one
#				       of the ranges reserved by RFC 1918
#				       (i.e., private or "non-routable"
#				       addresses.
#			multi	     - This interface has multiple IP
#				       addresses and you want to be able to
#				       route between them.
#			routefilter  - turn on kernel route filtering for this
#				       interface.
#

LOCAL_OPTIONS=routestopped

#
# Specify your local network address range as <network address>/<mask length>
# (example: 192.168.1.0/24).
#

LOCAL_NET=192.168.1.0/24

# Your firewall may need to access the internet for certain services. For example,
# your firewall probably needs have access to internet DNS servers (port 53). List
# the TCP ports/services that your firewall needs to access as a comma-separated
# list. If your firewall doesn't need to access any internet TCP services, set
# this variable to "none".
#
# Note: If you want open access to the internet from your firewall, uncomment the
# appropriate line in the "policy" file and set FW_TCP_OUT_PORTS and
# FW_UDP_OUT_PORTS to "none".

FW_TCP_OUT_PORTS=53

#
# Similarly, list the internet UDP ports/services that your firewall needs access
# to.
#

FW_UDP_OUT_PORTS=53

# This sample configuration allows you forward connections to up to two
# systems (servers) in your local network.
#
# List the TCP ports or services that you wish to forward to the first
# server in this variable as a comma-separated list. For example, if you want
# to forward www and https to the first, you would have LOC_TCP_PORTS1=www,https
# or LOC_TCP_PORTS1=80,443 and you would set SERVER1 to the IP address of the
# server. If you don't want to forward any tcp ports, set the
# variable's value to "none".
#

LOC_TCP_PORTS1=none

# List the UDP ports or services that you wish to forward to the first
# server in this variable as a comma-separated list. If you don't want to
# forward any tcp ports, set the variable's value to "none".

LOC_UDP_PORTS1=none

# List the TCP ports or services on your first server that you wish to be 
# able to access from your firewall (comma-separated list). If you don't
# want the firewall to be able to access any tcp ports on your first 
# server, set the variable's value to "none"

FW_LOC_TCP_PORTS1=none

# List the UDP ports or services on your first server that you wish to be 
# able to access from your firewall (comma-separated list). If you don't
# want the firewall to be able to access any udp ports on your first 
# server, set the variable's value to "none"

FW_LOC_UDP_PORTS1=none

#
# Enter the IP address of the server that you want the above ports forwarded
# to.
#

SERVER1=none

# List the TCP ports or services that you wish to forward to the second
# server in this variable as a comma-separated list. For example, if you want
# to forward www and https to the first, you would have LOC_TCP_PORTS2=www,https
# or LOC_TCP_PORTS2=80,443 and you would set SERVER1 to the IP address of the
# server. If you don't want to forward any tcp ports, set the
# variable's value to "none".
#

LOC_TCP_PORTS2=none

# List the UDP ports or services that you wish to forward to the second
# server in this variable as a comma-separated list. If you don't want to
# forward any tcp ports, set the variable's value to "none".

LOC_UDP_PORTS2=none

# List the TCP ports or services on your second server that you wish to be 
# able to access from your firewall (comma-separated list). If you don't
# want the firewall to be able to access any tcp ports on your first 
# server, set the variable's value to "none"

FW_LOC_TCP_PORTS2=none

# List the UDP ports or services on your second server that you wish to be 
# able to access from your firewall (comma-separated list). If you don't
# want the firewall to be able to access any udp ports on your first 
# server, set the variable's value to "none"

FW_LOC_UDP_PORTS2=none

#
# Enter the IP address of the server that you want the above ports forwarded
# to.
#

SERVER2=none

#
# If you wish to "open" incoming TCP ports for a server running on the
# firewall, list them in this variable as a comma-separated list. For example,
# if you want to enable secure shell (ssh) and FTP, from the internet to your
# firewall, you would have FW_TCP_PORTS=ssh,ftp or FW_TCP_PORTS=22,21.
#
# If you don't run any TCP servers on the firewall, use the value "none"

FW_TCP_IN_PORTS=none

#
# If you wish to "open" incoming UDP ports for servers running on the
# firewall, list them in this variable as a comma-separated list.
#
# If you don't want to open any UDP ports, use the value "none"

FW_UDP_IN_PORTS=none

#
# You will probably need access to your firewall from your local network for
# administrative task. A good way to do this is with ssh (TCP port 22).
#
# Enter the list of TCP ports to open from the local network to the firewall.
# If you don't wish to open any ports, use the value "none"
#
LOC_FW_TCP_PORTS=22

#
# Enter the list of UDP ports to open from the local network to the firewall.
# If you don't wish to open any ports, use the value "none"
#
LOC_FW_UDP_PORTS=none

#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
