How-To Alpine Wall

= General =
Purpose of this doc is to illustrate Alpine Wall () by example.
We will explain from the viewpoint of a Shorewall user.
awall is available since Alpine v2.4.
Please see Alpine Wall User's Guide for details about the syntax.
Some of the below features and examples assume you are running awall version 0.2.12 or later.
Make sure you are running the latest version by running the following commands:
== Structure ==
Your Alpine Wall configuration files go in 
Each such file is called a Policy.
You may have multiple Policy files (it is useful to have separate files for eg. HTTP, FTP, etc.).
The Policy(s) can be enabled or disabled by using the "awall [enable|disable]" command.
An awall Policy can contain definitions of:
* variables (like )
* zones (like )
* interfaces (like )
* policies (like )
* filters and NAT rules (like )
* services (like )
== Prerequisites ==
After installing awall, you need to load the following iptables modules:
This is needed only one time after awall installation.
To make the firewall autostart at boot and autoload the needed modules:
= A Basic Home Firewall =
We will give a example on how you can convert a "Basic home firewall" from Shorewall to AWall.
== Example firewall using Shorewall ==
Let's suppose you have the following Shorewall configuration:
== Example firewall using AWall ==
Now we will configure AWall to do the same thing as we just did with the above Shorewall example.
Create a new file called and add the following content to the file.
{
 "description": "Home firewall",
 "zone": {
 "inet": { "iface": "eth0" },
 "loc": { "iface": "eth1" }
 },
 "policy": [
 { "in": "_fw", "action": "accept" },
 { "in": "loc", "out": "inet", "action": "accept" }
 ],
 "snat": [
 { "out": "inet" }
 ]
}
The above configuration will:
* Create a description of your Policy
* Define zones
* Define policy
* Define snat (to masqurade the outgoing traffic)
=== Activating/Applying a Policy ===
After saving the Policy you can run the following commands to activate your firewall settings:
If you have multiple policies, after enabling or disabling them, you need to always run awall activate in order to update the iptables rules.
= Advanced Firewall settings =
Assuming you have your with your "Basic home firewall" settings, you could choose to modify that file to test the below examples.
== Logging ==
AWall will (since v0.2.7) automatically log dropped packets.
You could add the following row to the "policy" section in your Policy file in order to see the dropped packets.
{ "in": "inet", "out": "loc", "action": "drop" }
== Port-Forwarding ==
Let's suppose you have a local web server (192.168.1.10) that you want to make accessible from the "inet".
With Shorewall you would have a rule like this in your :
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT(S) PORT(S) DEST
DNAT inet loc:192.168.1.10 tcp 80
Lets configure our AWall Policy file likewise by adding the following content.
 "variable": {
 "APACHE": "192.168.1.10",
 "STATIC_IP": "1.2.3.4"
 },
 "filter": [
 { "in": "inet", 
 "dest": "$STATIC_IP", 
 "service": "http", 
 "action": "accept", 
 "dnat": "$APACHE" 
 }
 ]
As you can see in the above example, we create a
* "variable" section where we specify some IP-addresses
* "filter" section where we do the actual port-forwarding (using the variables we just created and using some preexisting "services" definitions)
If you need to forward to a different port (e.g. 8080) you can do:
"dnat": [
 {"in": "inet", "dest": "$STATIC_IP", "to-addr": "$APACHE", "service": "http", "to-port": 8080 }
]
== Create your own service definitions ==
You can add your own service definitions into your Policy files:
"service": { 
 "openvpn": { "proto": "udp", "port": 1194 }
 }
== Inherit services or variables == 
You can import a Policy into other Policy files for inheriting services or variables definitions:
"import": "myfirewall"
== Specify load order ==
By default policies are loaded on alphabetical order.<BR>
You can change the load order with the keywords "before" and "after":
"before": "myfirewall"
"after": "someotherpolicy"
= Other =
== Help and debugging ==
If you end up in some kind of trouble, you might find some commands useful when debugging:
== See also ==
* Zero-To-Awall
Category:Networking
Category:Security