Shorewall

2 NIC machine

In /usr/share/doc/shorewall/examples/two-interfaces make the following edits to the following files and then copy them to /etc/shorewall

rules

# Public services
ACCEPT   net    fw      tcp     smtp
ACCEPT   net    fw      tcp     pop3
# 143 is for IMAP
ACCEPT  net     fw      tcp     143
ACCEPT   net    fw      tcp     ssh
FTP/ACCEPT      net     fw
ACCEPT   net    fw      tcp     domain
ACCEPT   net    fw      udp     domain
ACCEPT   net    fw      tcp     http
ACCEPT   net    fw      tcp     https
# X11 forwarding
ACCEPT   fw     loc     tcp     x11
ACCEPT   fw     loc     udp     x11

just copy the following files to /etc/shorewall/:

interfaces
masq
policy
routestopped
zones

/etc/default/shorewall

startup=1

To get NFS working

On both machines

Edit your /etc/shorewall/rules file like this:

# Permit NFS
ACCEPT net $FW tcp 111
ACCEPT net $FW udp 111
ACCEPT net $FW udp 2049
ACCEPT net $FW tcp 2049
ACCEPT net $FW tcp 32765:32767
ACCEPT net $FW udp 32765:32767

/etc/default/nfs-common:

STATDOPTS="-p 32765 -o 32766"

/etc/default/nfs-kernel-server:

RPCMOUNTDOPTS="-p 32767"

The change to /etc/services isn't necessary at all. It just helps produces a nice (sensible) output from netstat -tl on the NFS server.

# /etc/services
# NFS ports as per the NFS-HOWTO
# http://www.tldp.org/HOWTO/NFS-HOWTO/security.html#FIREWALLS
# Listing here does not mean they will bind to these ports. 
rpc.nfsd        2049/tcp                        # RPC nfsd
rpc.nfsd        2049/udp                        # RPC nfsd
rpc.statd-bc    32765/tcp                       # RPC statd broadcast
rpc.statd-bc    32765/udp                       # RPC statd broadcast
rpc.statd       32766/tcp                       # RPC statd listen
rpc.statd       32766/udp                       # RPC statd listen
rpc.mountd      32767/tcp                       # RPC mountd
rpc.mountd      32767/udp                       # RPC mountd
rcp.lockd       32768/tcp                       # RPC lockd/nlockmgr
rcp.lockd       32768/udp                       # RPC lockd/nlockmgr
rpc.quotad      32769/tcp                       # RPC quotad
rpc.quotad      32769/udp                       # RPC quotad

/etc/default/quota

RPCRQUOTADOPTS="-p 32769"

You can check which ports are being used with

rpcinfo -p

Single NIC Machine

/etc/default/shorewall
Set startup=1

In /usr/share/doc/shorewall-common/default-config
make the following edits to the following files and then copy them to /etc/shorewall

interfaces
net     eth1    82.94.91.79

modules
(no edits)

policy
fw      net     ACCEPT
net     all     DROP    info
all     all     REJECT  info

NB to drop logging, get rid of the 'info' and replace it with 'crit' or 'err' or get rid of it entirely

rules
(under SECTION NEW)
ACCEPT   net    fw      tcp     smtp
ACCEPT   net    fw      tcp     pop3
ACCEPT   net    fw      tcp     ssh
FTP/ACCEPT      net     fw
ACCEPT   net    fw      tcp     domain
ACCEPT   net    fw      udp     domain
ACCEPT   fw     net     udp     domain
ACCEPT   net    fw      tcp     http
ACCEPT   fw     net     tcp     http
ACCEPT   net    fw      tcp     https
ACCEPT   net    fw      tcp     snmp
ACCEPT   fw     net     tcp     snmp
ACCEPT   net    fw      udp     snmp
ACCEPT   fw     net     udp     snmp
ACCEPT  net     fw      tcp     143
ACCEPT  net     fw      udp     143

start
dmesg -n5

zones
net     ipv4
(above fw      firewall)