I am not security nor Shorewall expert, but this set up seems to work for me. This is not as a replacement for AWS's security groups. More as an common sense extension.
This assumes a Ubuntu Linux instance
sudo apt-get update && sudo apt-get upgrade;
sudo apt-get install shorewall shorewall-core shorewall-docs
/usr/share/doc/shorewall/examples contains example configuration in various scenarios. We will copy a few of those and modify them slightly.
sudo cp one-interface/interfaces /etc/shorewall/;
sudo vi /etc/shorewall/interfaces
#ZONE INTERFACE OPTIONS
- eth0 dhcp,tcpflags,logmartians,nosmurfs,sourceroute=0
sudo cp one-interface/zones /etc/shorewall/;
sudo vi /etc/shorewall/zones
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
Change the last row to the two blocks of whatever is your VPC local IP range.
sudo vi /etc/shorewall/hosts
#ZONE HOSTS(S) OPTIONS
sudo cp one-interface/policy /etc/shorewall/;
sudo vi /etc/shorewall/policy
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
$FW vpc ACCEPT
$FW net ACCEPT
vpc all CONTINUE
net all DROP info
# The FOLLOWING POLICY MUST BE LAST
all all REJECT info
If for example this is a web server then also uncomment the two Web lines which allows traffic on port 80 and 443.
sudo cp one-interface/rules /etc/shorewall/;
sudo vi /etc/shorewall/rules
Invalid(DROP) net $FW tcp
Ping(ACCEPT) vpc $FW
Ping(DROP) net $FW
Trcrt(ACCEPT) vpc $FW
Trcrt(DROP) net $FW
DNS(ACCEPT) vpc $FW
DNS(DROP) net $FW
# Web(ACCEPT) vpc $FW
# Web(ACCEPT) net $FW
ACCEPT $FW vpc icmp
ACCEPT $FW net icmp
What is the default state for when shorewall is stopped.
sudo cp one-interface/stoppedroutes /etc/shorewall/;
sudo vi /etc/shorewall/stoppedroutes
#ACTION SOURCE DEST PROTO DEST SOURCE
# PORT(S) PORT(S)
ACCEPT eth0 -
ACCEPT - eth0
Make sure there is no typos that prevents Shorewall from starting.
sudo shorewall check
sudo shorewall status
sudo shorewall safe-start
sudo shorewall safe-restart
sudo vi /etc/default/shorewall
Please fork and send a pull request for to correct any typos, or useful additions.
Otherwise contact flurdy. Especially for things factually incorrect. Apologies for procrastinated replies.