Zero-To-Awall - Revision history

Prabuanand: added wikilink

2026-01-24T17:06:03Z

added wikilink

← Older revision		Revision as of 17:06, 24 January 2026
Line 1:		Line 1:
	This [https://git.alpinelinux.org/awall/about/ Alpine Wall] howto is aimed at users with no or little experience with iptables and other firewall framework. [[How-To Alpine Wall]] page is aimed at users familiar with shorewall.		This [https://git.alpinelinux.org/awall/about/ Alpine Wall] howto is aimed at users with no or little experience with iptables and other firewall framework. [[How-To Alpine Wall]] page is aimed at users familiar with shorewall and [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax.

	== Base policies ==		== Base policies ==

Prabuanand: fixed heading level and introduction page, added wikilink

2026-01-24T16:45:40Z

fixed heading level and introduction page, added wikilink

← Older revision		Revision as of 16:45, 24 January 2026
Line 1:		Line 1:
	~~= Awall for dummies =~~		This [https://git.alpinelinux.org/awall/about/ Alpine Wall] howto is aimed at users with no or little experience with iptables and other firewall framework. [[How-To Alpine Wall]] page is aimed at users familiar with shorewall.

	~~This howto is aimed at users with no (or little) experience with iptables and other firewall frameworks (like Shorewall).~~		== Base policies ==

	~~This howto~~ is ~~going~~ to ~~be split into 5 parts~~.		Be aware that all configuration files are stored as JSON files. JSON is not a human friendly standard, for instance it does not support comments so you will have to move them outside of the json structure.

	~~# Defining our base json file~~ which ~~holds our zones and base policies~~.		Beginners should use a decent text editor with JSON highlight support which will make your life easier. Recent versions of Alpine Wall support using yaml instead of json but this is out of scope of this howto.
	~~# Creating service policies.~~
	~~# Using aliases and custom services.~~
	~~# Enabling and testing policies~~.
	~~# Finishing up and making it start (at boot)~~

	~~NOTE: please be aware that all configuration files are stored as JSON files~~. ~~JSON is not a human friendly standard,~~		Creating zones depends on the function of your firewall. Is it installed on a endpoint (server) or will it act as a router and filter/forward.
	~~for instance~~ it ~~does not support comments so you will have to move them outside of the json structure.~~
	~~Beginners should use~~ a ~~decent text editor with JSON highlight support which~~ will ~~make your life easier.~~
	~~Since recent versions of [[Alpine Wall\|awall]]~~ it ~~is also possible to use yaml instead of json but this is out of the scope of this howto~~.

	~~== Base policies ==~~

	~~Creating zones depends on the function of your firewall. Is it installed on a endpoint (server) or will it act as a router and filter/forward.~~
	For this howto we assume you are going to setup a router and use NAT to forward services (ports) to different hosts on your network.		For this howto we assume you are going to setup a router and use NAT to forward services (ports) to different hosts on your network.

Line 385:		Line 375:


	= See also =		== See also ==
	* [[How-To Alpine Wall]]		* [[How-To Alpine Wall]]
			* [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide]
	[[Category:Firewall]]		[[Category:Firewall]]

Prabuanand: changed to :Category:Firewall

2025-04-09T11:21:19Z

changed to Category:Firewall

← Older revision		Revision as of 11:21, 9 April 2025
Line 388:		Line 388:
	* [[How-To Alpine Wall]]		* [[How-To Alpine Wall]]

	[[Category:~~Security~~]]		[[Category:Firewall]]

Zcrayfish: /* Custom services */ Rescued dead link.

2023-08-26T04:59:31Z

Custom services: Rescued dead link.

← Older revision		Revision as of 04:59, 26 August 2023
Line 246:		Line 246:
	=== Custom services ===		=== Custom services ===

	Awall includes a predefined list of [https://~~github~~.com/alpinelinux/awall~~/blob~~/master/~~json~~/services.json services]~~{{dead link}}~~. If the service you try to define in your policy does not exist in awalls services list you can define services yourself.		Awall includes a predefined list of [https://raw.githubusercontent.com/alpinelinux/awall/master/mandatory/services.json services]. If the service you try to define in your policy does not exist in awalls services list you can define services yourself.

	Create the file: {{path\|/etc/awall/private/custom-services.json}}		Create the file: {{path\|/etc/awall/private/custom-services.json}}

Zcrayfish: Marked a dead link. Used path template in a few places

2021-12-20T21:06:19Z

Marked a dead link. Used path template in a few places

← Older revision		Revision as of 21:06, 20 December 2021
Line 180:		Line 180:
	=== OpenVPN Service ===		=== OpenVPN Service ===

	This is the most generic config available. It does nothing more then opening port(s) defined for our openvpn service in ~~<code>~~/etc/awall/private/custom-services.json~~</code>~~		This is the most generic config available. It does nothing more then opening port(s) defined for our openvpn service in {{path\|/etc/awall/private/custom-services.json}}

	<pre>		<pre>
Line 246:		Line 246:
	=== Custom services ===		=== Custom services ===

	Awall includes a predefined list of [https://github.com/alpinelinux/awall/blob/master/json/services.json services]. If the service you try to define in your policy does not exist in awalls services list you can define services yourself.		Awall includes a predefined list of [https://github.com/alpinelinux/awall/blob/master/json/services.json services]{{dead link}}. If the service you try to define in your policy does not exist in awalls services list you can define services yourself.

	Create the file: ~~<code>~~/etc/awall/private/custom-services.json~~</code>~~		Create the file: {{path\|/etc/awall/private/custom-services.json}}

	<pre>		<pre>

Tsarna: /* Activating firewall rules at boot */

2020-06-28T16:12:28Z

Activating firewall rules at boot

← Older revision		Revision as of 16:12, 28 June 2020
Line 362:		Line 362:
	Make sure you have added iptables to an openrc runlevel. If using snat, also enable ipset for the masquerade set.		Make sure you have added iptables to an openrc runlevel. If using snat, also enable ipset for the masquerade set.

	<code>rc-update add iptables		<code>rc-update add iptables</code>
	rc-update add ipset</code>
			<code>rc-update add ipset</code>

	=== Allow IPv4 forwarding ===		=== Allow IPv4 forwarding ===

Tsarna: /* Activating firewall rules at boot */

2020-06-28T16:11:49Z

Activating firewall rules at boot

← Older revision		Revision as of 16:11, 28 June 2020
Line 362:		Line 362:
	Make sure you have added iptables to an openrc runlevel. If using snat, also enable ipset for the masquerade set.		Make sure you have added iptables to an openrc runlevel. If using snat, also enable ipset for the masquerade set.

	<code>rc-update add iptables~~</code>~~		<code>rc-update add iptables
	~~<code>~~rc-update add ipset</code>		rc-update add ipset</code>

	=== Allow IPv4 forwarding ===		=== Allow IPv4 forwarding ===

Tsarna at 16:11, 28 June 2020

2020-06-28T16:11:29Z

← Older revision		Revision as of 16:11, 28 June 2020
Line 360:		Line 360:

	When awall has been properly activated it will generate a file with all iptables rules which iptables will read when its is started via openrc.		When awall has been properly activated it will generate a file with all iptables rules which iptables will read when its is started via openrc.
	Make sure you have added iptables to an openrc runlevel.		Make sure you have added iptables to an openrc runlevel. If using snat, also enable ipset for the masquerade set.

	<code>rc-update add iptables</code>		<code>rc-update add iptables</code>
			<code>rc-update add ipset</code>

	=== Allow IPv4 forwarding ===		=== Allow IPv4 forwarding ===

Gray wolf at 13:31, 25 February 2019

2019-02-25T13:31:23Z

← Older revision		Revision as of 13:31, 25 February 2019
Line 274:		Line 274:
	You should now have two directories in your awall config directory named optional and private with multiple json files. The biggest difference between these two directories is the ability to enable and disable policies located in the optional directory. When you enable a policy by using <code>awall enable policy-name</code> awall will generate a symlink in your awall config directory and will automatically load them when you activate the firewall. To be able to also use the files in the private directory we will need to include them in one of our optional policies. You can name the file however you like as long it doesn't conflict with existing policies names (including the ones in private directory and awall's system policies). Example names would be hostname.json main.json firewall.json. For this example we will use main.json.		You should now have two directories in your awall config directory named optional and private with multiple json files. The biggest difference between these two directories is the ability to enable and disable policies located in the optional directory. When you enable a policy by using <code>awall enable policy-name</code> awall will generate a symlink in your awall config directory and will automatically load them when you activate the firewall. To be able to also use the files in the private directory we will need to include them in one of our optional policies. You can name the file however you like as long it doesn't conflict with existing policies names (including the ones in private directory and awall's system policies). Example names would be hostname.json main.json firewall.json. For this example we will use main.json.

	Create the file: <code>/etc/awall/main.json</code>		Create the file: <code>/etc/awall/optional/main.json</code>
	<pre>		<pre>
	{		{

John3-16: Added internal link to Alpine Wall; added See also: How-To Alpine Wall; added category: Security

2017-10-12T02:20:44Z

Added internal link to Alpine Wall; added See also: How-To Alpine Wall; added category: Security

← Older revision		Revision as of 02:20, 12 October 2017
Line 383:		Line 383:


	== See also ==		= See also =
	* [[How-To Alpine Wall]]		* [[How-To Alpine Wall]]

	[[Category:Security]]		[[Category:Security]]