Konfigurasi Mandriva Linux Warnet

Terusan dari tulisan :

http://bayuart.wordpress.com/2009/06/05/mandriva-2009-1-spring-in-action-d-part-deux/
http://bayu.blitar.org/2009/06/02/warung-internet-1/
http://bayu.blitar.org/2009/06/05/mandriva-20091-spring-in-action-d/

Sekarang kita mo menginjak ke konfigurasi dari mandriva linux yang sebelomnya telah terinstall sebagai gateway server warnet / pc router. Dari tulisan sebelumnya mandriva linux yang digunakan adalah versi mandriva linux 2009.1 spring free edition dual iso serta menggunakan aplikasi server gateway seperti :

• shorewall untuk firewall
• squid untuk layanan proxy
• dhcp-server untuk layanan ip dinamis
• bind untul layanan dns / cache lokal

Shorewall
Shorewall yang merupakan kependekan dari Shoreline Firewal, merupakan firewall yang berbasiskan kepada iptables yang dipermudah dalam penggunaanya, apabila anda telah terbiasa menggunakan iptables maka anda mungkin tidak akan membutuhkan tools semacam ini, shorewall dapat di installasi pada kebanyakan sistem Linux, disini saya menggunakan mandriva linux 2009.1 spring untuk dijadikan sebagai Gateway+Router dan juga transparent proxy, untuk mendapatkan versi terbarunya anda dapat mengunjungi web resmi Shorewall.

The Shoreline Firewall, more commonly known as “Shorewall”, is high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and with the help of the iptables, iptables-restore, ip and tc utilities, Shorewall configures Netfilter and the Linux networking subsystem to match your requirements. Shorewall can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system. Shorewall does not use Netfilter's ipchains compatibility mode and can thus take advantage of Netfilter's connection state tracking capabilities... from Shorewall.

Ok langsung aja. Di Mandriva Linux 2009.1 untuk file konfigurasi shorewall diletakkan di :
/etc/shorewall

list nya sebagai berikut :

[root@localhost box]# ls -l /etc/shorewall/
total 152
-rw------- 1 root root 491 2009-04-17 12:33 accounting
-rw------- 1 root root 502 2009-04-17 12:33 actions
-rw------- 1 root root 388 2009-04-17 12:33 blacklist
-rw------- 1 root root 457 2009-04-17 12:33 continue
-rw------- 1 root root 362 2009-04-17 12:33 ecn
-rw------- 1 root root 376 2009-04-17 12:33 hosts
-rw------- 1 root root 423 2009-04-17 12:33 init
-rw------- 1 root root 508 2009-04-17 12:33 initdone
-rw------- 1 root root 430 2009-06-05 06:30 interfaces
-rw------- 1 root root 225 2009-04-17 12:33 ipsec
-rw------- 1 root root 393 2009-04-17 12:33 maclist
-rw------- 1 root root 453 2009-04-17 12:33 Makefile
-rw------- 1 root root 420 2009-06-05 06:30 masq
-rw------- 1 root root 377 2009-04-17 12:33 nat
-rw------- 1 root root 370 2009-04-17 12:33 netmap
-rw------- 1 root root 343 2009-04-17 12:33 notrack
-rw------- 1 root root 714 2009-04-17 12:33 params
-rw------- 1 root root 478 2009-06-05 06:30 policy
-rw------- 1 root root 411 2009-04-17 12:33 providers
-rw------- 1 root root 383 2009-04-17 12:33 proxyarp
-rw------- 1 root root 408 2009-04-17 12:33 restored
-rw------- 1 root root 377 2009-04-17 12:33 route_rules
-rw------- 1 root root 538 2009-04-17 12:33 routestopped
-rw------- 1 root root 602 2009-06-05 05:26 rules
-rw------- 1 root root 93 2009-06-05 06:30 rules.drakx
-rw------- 1 root root 4162 2009-06-05 06:30 shorewall.conf
-rw------- 1 root root 73 2009-06-05 05:26 start
-rw------- 1 root root 836 2009-04-17 12:33 started
-rw------- 1 root root 443 2009-06-05 05:26 stop
-rw------- 1 root root 403 2009-04-17 12:33 stopped
-rw------- 1 root root 392 2009-04-17 12:33 tcclasses
-rw------- 1 root root 426 2009-04-17 12:33 tcdevices
-rw------- 1 root root 416 2009-04-17 12:33 tcfilters
-rw------- 1 root root 695 2009-04-17 12:33 tcrules
-rw------- 1 root root 308 2009-04-17 12:33 tos
-rw------- 1 root root 397 2009-04-17 12:33 tunnels
-rw------- 1 root root 419 2009-06-05 06:30 zones

Yang perlu diperhatikan file :

• /etc/shorewall/interfaces
• /etc/shorewall/masq
• /etc/shorewall/policy
• /etc/shorewall/rules.drakx
• /etc/shorewall/shorewall.conf
• /etc/shorewall/zones

File :

/etc/shorewall/interfaces

# For information about entries in this file, type "man shorewall-interfaces"
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-interfaces.html
#
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect
loc eth1 detect
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

file diatas digunakan untuk mengindentifikasi ethernet mana yang tersambung ke loc untuk LAN dan net untuk yang tersambung ke internet.


/etc/shorewall/masq

# For information about entries in this file, type "man shorewall-masq"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-masq.html
#
###############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
eth0 192.168.0.0/24
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

masq, berfungsi untuk me-masquerade / membungkus paket dari jaringan LAN (loc) ke internet sehingga IP lokal akan di kenali sebagai IP internet.

/etc/shorewall/policy

# For information about entries in this file, type "man shorewall-policy"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-policy.html
#
###############################################################################
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
loc net ACCEPT
loc fw ACCEPT
fw loc ACCEPT
fw net ACCEPT
net all DROP info
all all REJECT info
#LAST LINE -- DO NOT REMOVE

file policy diatas gunae ya buat bikin aturan jaringan yang sudah ada boleh di lewatin or dilewatkan melalui atau dari internet ke loc dan sebaliknya.

/etc/shorewall/rules

# For information on the settings in this file, type "man shorewall-rules"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-rules.html
#
####################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP
#SECTION ESTABLISHED
#SECTION RELATED
INCLUDE rules.drakx
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

langsung liat ke bawah aja.

/etc/shorewall/rules.drakx

ACCEPT+ fw net tcp http - - - squid
REDIRECT fw 3128 tcp http -
REDIRECT loc 3128 tcp http -

rules / aturan firewall diatas berfungsi untuk mengaktifkan transparent proxy. aturan lain isa juga langsung di masukin ke file ini.

/etc/shorewall/shorewall.conf (udah jelas) / biarkan standar/default

/etc/shorewall/zones

# For information about this file, type "man shorewall-zones"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-zones.html
#
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
net ipv4
loc ipv4
fw firewall
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

bersambung (kode 69)