Shorewall

See http://www.shorewall.net/bridge-Shorewall-perl.html#veth

Interface Layout

                         ------ VMs
eth0 -- veth0 <--> veth1 |
                         ------ VMs

(-- = bridge, <--> = paired virtual interfaces)

Zones

• ext: Everything outside of our subnet
• offices: Our subnet w/o the servers
• int: The servers

Policy

Everybody inside the subnet may connect to everybody. Everybody outside of the subnet may connect to the specific services, but nothing else

Known Problems

As of now, ofc complains about martian packets (on average multiple times per minute). This warning can be triggered by e.g. pinging an unknown IP from the inside. While it's not entirely clear to us what causes these messages we deemed them not harmful and thus disabled them via sysctl (net.ipv4.conf.xenbr0.log_martians=0).