shorewall_code/Shorewall-lite/manpages/shorewall-lite.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
  <refmeta>
    <refentrytitle>shorewall-lite</refentrytitle>

    <manvolnum>8</manvolnum>

    <refmiscinfo>Administrative Commands</refmiscinfo>
  </refmeta>

  <refnamediv>
    <refname>shorewall-lite</refname>

    <refpurpose>Administration tool for Shoreline Firewall Lite (Shorewall
    Lite)</refpurpose>
  </refnamediv>

  <refsynopsisdiv>
    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg rep="norepeat">-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>add</option></arg>

      <arg choice="plain"
      rep="repeat"><replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]</arg>

      <arg choice="plain"><replaceable>zone</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>allow</option></arg>

      <arg choice="plain"><replaceable>address</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg
      choice="plain"><option>clear</option><arg><option>-f</option></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>close</option><arg choice="req">
      <replaceable>open-number</replaceable> |
      <replaceable>source</replaceable><replaceable>dest</replaceable><arg><replaceable>protocol</replaceable><arg>
      <replaceable>port</replaceable> </arg></arg></arg><replaceable>
      </replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg rep="norepeat">-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>delete</option></arg>

      <arg choice="plain"
      rep="repeat"><replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]</arg>

      <arg choice="plain"><replaceable>zone</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>disable</option></arg>

      <arg choice="plain">{ <replaceable>interface</replaceable> |
      <replaceable>provider</replaceable> }</arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>drop</option></arg>

      <arg choice="plain"><replaceable>address</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>dump</option></arg>

      <arg><option>-x</option></arg>

      <arg><option>-l</option></arg>

      <arg><option>-m</option></arg>

      <arg><option>-c</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>enable</option></arg>

      <arg choice="plain">{ <replaceable>interface</replaceable> |
      <replaceable>provider</replaceable> }</arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>forget</option></arg>

      <arg><replaceable>filename</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>help</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg
      choice="plain"><option>hits</option><arg><option>-t</option></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>ipcalc</option></arg>

      <group choice="req">
        <arg choice="plain"><replaceable>address</replaceable>
        <replaceable>mask</replaceable></arg>

        <arg
        choice="plain"><replaceable>address</replaceable>/<replaceable>vlsm</replaceable></arg>
      </group>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>iprange</option></arg>

      <arg
      choice="plain"><replaceable>address1</replaceable><option>-</option><replaceable>address2</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>iptrace</option></arg>

      <arg choice="plain"><replaceable>iptables match
      expression</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>logdrop</option></arg>

      <arg choice="plain"><replaceable>address</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>logwatch</option></arg>

      <arg><option>-m</option></arg>

      <arg><replaceable>refresh-interval</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>logreject</option></arg>

      <arg choice="plain"><replaceable>address</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>noiptrace</option></arg>

      <arg choice="plain"><replaceable>iptables match
      expression</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="plain"><option>open</option><replaceable>
      source</replaceable><replaceable> dest</replaceable><arg>
      <replaceable>protocol</replaceable><arg> <replaceable>port</replaceable>
      </arg> </arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>reject</option></arg>

      <arg choice="plain"><replaceable>address</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>reset</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>restart</option></arg>

      <arg><option>-n</option></arg>

      <arg><option>-p</option><arg><option>-C</option></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>restore</option></arg>

      <arg><option>-C</option></arg>

      <arg><replaceable>filename</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>run</option></arg>

      <arg choice="plain">function</arg>

      <arg><replaceable>parameter ...</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg
      choice="plain"><option>save</option><arg><option>-C</option></arg></arg>

      <arg choice="opt"><replaceable>filename</replaceable></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>savesets</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-b</option></arg>

      <arg><option>-x</option></arg>

      <arg><option>-l</option></arg>

      <arg><option>-t</option>
      {<option>filter</option>|<option>mangle</option>|<option>nat</option>|<option>raw|rawpost</option>}</arg>

      <arg><arg><option>chain</option></arg><arg choice="plain"
      rep="repeat"><replaceable>chain</replaceable></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-x</option></arg>

      <arg choice="plain"><option>{bl|blacklists}</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-f</option></arg>

      <arg choice="plain"><option>capabilities</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg
      choice="req"><option>classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg choice="plain"><option>event</option><arg
      choice="plain"><replaceable>event</replaceable></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-c</option></arg>

      <arg choice="plain"><option>routing</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-x</option></arg>

      <arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg choice="plain"><option>tc</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="req"><option>show | list | ls </option></arg>

      <arg><option>-m</option></arg>

      <arg choice="plain"><option>log</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>start</option></arg>

      <arg><option>-n</option></arg>

      <arg><option>-p</option></arg>

      <arg><option>-f</option></arg>

      <arg><option>-C</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg
      choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><option>stop</option></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg choice="plain"><arg
      choice="plain"><option>status</option><arg><option>-i</option></arg></arg></arg>
    </cmdsynopsis>

    <cmdsynopsis>
      <command>shorewall-lite</command>

      <arg choice="opt"><option>trace</option>|<option>debug</option></arg>

      <arg>-<replaceable>options</replaceable></arg>

      <arg
      choice="plain"><option>version</option><arg><option>-a</option></arg></arg>
    </cmdsynopsis>
  </refsynopsisdiv>

  <refsect1>
    <title>Description</title>

    <para>The shorewall-lite utility is used to control the Shoreline Firewall
    Lite (Shorewall Lite).</para>
  </refsect1>

  <refsect1>
    <title>Options</title>

    <para>The <option>trace</option> and <option>debug</option> options are
    used for debugging. See <ulink
    url="http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace">http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace</ulink>.</para>

    <para>The nolock <option>option</option> prevents the command from
    attempting to acquire the Shorewall-lite lockfile. It is useful if you
    need to include <command>shorewall</command> commands in the
    <filename>started</filename> <ulink
    url="../shorewall_extension_scripts.html">extension script</ulink>.</para>

    <para>The <emphasis>options</emphasis> control the amount of output that
    the command produces. They consist of a sequence of the letters <emphasis
    role="bold">v</emphasis> and <emphasis role="bold">q</emphasis>. If the
    options are omitted, the amount of output is determined by the setting of
    the VERBOSITY parameter in <ulink
    url="shorewall.conf.html">shorewall.conf</ulink>(5). Each <emphasis
    role="bold">v</emphasis> adds one to the effective verbosity and each
    <emphasis role="bold">q</emphasis> subtracts one from the effective
    VERBOSITY. Alternately, <emphasis role="bold">v</emphasis> may be followed
    immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no
    white-space between <emphasis role="bold">v</emphasis> and the
    VERBOSITY.</para>

    <para>The <emphasis>options</emphasis> may also include the letter
    <option>t</option> which causes all progress messages to be
    timestamped.</para>
  </refsect1>

  <refsect1>
    <title>Commands</title>

    <para>The available commands are listed below.</para>

    <variablelist>
      <varlistentry>
        <term><emphasis role="bold">add </emphasis>{
        <replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]...
        <replaceable>zone</replaceable> | <replaceable>zone</replaceable>
        <replaceable>host-list</replaceable> }</term>

        <listitem>
          <para>Adds a list of hosts or subnets to a dynamic zone usually used
          with VPN's.</para>

          <para>The <emphasis>interface</emphasis> argument names an interface
          defined in the <ulink
          url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
          file. A <emphasis>host-list</emphasis> is comma-separated list whose
          elements are host or network addresses.</para>

          <caution>
            <para>The <command>add</command> command is not very robust. If
            there are errors in the <replaceable>host-list</replaceable>, you
            may see a large number of error messages yet a subsequent
            <command>shorewall-lite show zones</command> command will indicate
            that all hosts were added. If this happens, replace
            <command>add</command> by <command>delete</command> and run the
            same command again. Then enter the correct command.</para>
          </caution>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">allow
        </emphasis><replaceable>address</replaceable></term>

        <listitem>
          <para>Re-enables receipt of packets from hosts previously
          blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
          role="bold">logdrop</emphasis>, <emphasis
          role="bold">reject</emphasis>, or <emphasis
          role="bold">logreject</emphasis> command.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">clear
        </emphasis>[-<option>f</option>]</term>

        <listitem>
          <para>Clear will remove all rules and chains installed by
          Shorewall-lite. The firewall is then wide open and unprotected.
          Existing connections are untouched. Clear is often used to see if
          the firewall is causing connection problems.</para>

          <para>If <option>-f</option> is given, the command will be processed
          by the compiled script that executed the last successful <emphasis
          role="bold">start</emphasis>, <emphasis
          role="bold">restart</emphasis> or <emphasis
          role="bold">refresh</emphasis> command if that script exists.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">close</emphasis> {
        <replaceable>open-number</replaceable> |
        <replaceable>source</replaceable> <replaceable>dest</replaceable> [
        <replaceable>protocol</replaceable> [ <replaceable>port</replaceable>
        ] ] }</term>

        <listitem>
          <para>Added in Shorewall 4.5.8. This command closes a temporary open
          created by the <command>open</command> command. In the first form,
          an <replaceable>open-number</replaceable> specifies the open to be
          closed. Open numbers are displayed in the <emphasis
          role="bold">num</emphasis> column of the output of the
          <command>shorewall-lite show opens </command>command.</para>

          <para>When the second form of the command is used, the parameters
          must match those given in the earlier <command>open</command>
          command.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">delete </emphasis>{
        <replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]...
        <replaceable>zone</replaceable> | <replaceable>zone</replaceable>
        <replaceable>host-list</replaceable> }</term>

        <listitem>
          <para>The delete command reverses the effect of an earlier <emphasis
          role="bold">add</emphasis> command.</para>

          <para>The <emphasis>interface</emphasis> argument names an interface
          defined in the <ulink
          url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
          file. A <emphasis>host-list</emphasis> is comma-separated list whose
          elements are a host or network address.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">disable </emphasis>{
        <replaceable>interface</replaceable> |
        <replaceable>provider</replaceable> }</term>

        <listitem>
          <para>Added in Shorewall 4.4.26. Disables the optional provider
          associated with the specified <replaceable>interface</replaceable>
          or <replaceable>provider</replaceable>. Where more than one provider
          share a single network interface, a
          <replaceable>provider</replaceable> name must be given.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">drop
        </emphasis><replaceable>address</replaceable></term>

        <listitem>
          <para>Causes traffic from the listed <emphasis>address</emphasis>es
          to be silently dropped.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">dump </emphasis>[-<option>x</option>]
        [-<option>l</option>] [-<option>m</option>]
        [-<option>c</option>]</term>

        <listitem>
          <para>Produces a verbose report about the firewall configuration for
          the purpose of problem analysis.</para>

          <para>The <emphasis role="bold">-x</emphasis> option causes actual
          packet and byte counts to be displayed. Without that option, these
          counts are abbreviated. The <emphasis role="bold">-m</emphasis>
          option causes any MAC addresses included in Shorewall-lite log
          messages to be displayed.</para>

          <para>The <emphasis role="bold">-l</emphasis> option causes the rule
          number for each Netfilter rule to be displayed.</para>

          <para>The <option>-c</option> option causes the route cache to be
          dumped in addition to the other routing information.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">enable </emphasis>{
        <replaceable>interface</replaceable> |
        <replaceable>provider</replaceable> }</term>

        <listitem>
          <para>Added in Shorewall 4.4.26. Enables the optional provider
          associated with the specified <replaceable>interface</replaceable>
          or <replaceable>provider</replaceable>. Where more than one provider
          share a single network interface, a
          <replaceable>provider</replaceable> name must be given.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">forget </emphasis>[
        <replaceable>filename</replaceable> ]</term>

        <listitem>
          <para>Deletes /var/lib/shorewall-lite/<emphasis>filename</emphasis>
          and /var/lib/shorewall-lite/save. If no
          <emphasis>filename</emphasis> is given then the file specified by
          RESTOREFILE in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink>(5) is
          assumed.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">help</emphasis></term>

        <listitem>
          <para>Displays a syntax summary.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">hits </emphasis> [-<option>t</option>]
        </term>

        <listitem>
          <para>Generates several reports from Shorewall-lite log messages in
          the current log file. If the <option>-t</option> option is included,
          the reports are restricted to log messages generated today.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">ipcalc </emphasis>{ address mask |
        address/vlsm }</term>

        <listitem>
          <para>Ipcalc displays the network address, broadcast address,
          network in CIDR notation and netmask corresponding to the
          input[s].</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">iprange
        </emphasis><replaceable>address1</replaceable>-<replaceable>address2</replaceable></term>

        <listitem>
          <para>Iprange decomposes the specified range of IP addresses into
          the equivalent list of network/host addresses.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">iptrace </emphasis><replaceable>iptables
        match expression</replaceable></term>

        <listitem>
          <para>This is a low-level debugging command that causes iptables
          TRACE log records to be created. See iptables(8) for details.</para>

          <para>The <replaceable>iptables match expression</replaceable> must
          be one or more matches that may appear in both the raw table OUTPUT
          and raw table PREROUTING chains.</para>

          <para>The trace records are written to the kernel's log buffer with
          facility = kernel and priority = warning, and they are routed from
          there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
          Shorewall-lite has no control over where the messages go; consult
          your logging daemon's documentation.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">list</emphasis></term>

        <listitem>
          <para><command>list</command> is a synonym for
          <command>show</command> -- please see below.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">logdrop
        </emphasis><replaceable>address</replaceable></term>

        <listitem>
          <para>Causes traffic from the listed <emphasis>address</emphasis>es
          to be logged then discarded. Logging occurs at the log level
          specified by the BLACKLIST_LOGLEVEL setting in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink> (5).</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">logwatch </emphasis>[-<option>m</option>]
        [<replaceable>refresh-interval</replaceable>]</term>

        <listitem>
          <para>Monitors the log file specified by the LOGFILE option in
          <ulink url="shorewall.conf.html">shorewall.conf</ulink>(5) and
          produces an audible alarm when new Shorewall-lite messages are
          logged. The <emphasis role="bold">-m</emphasis> option causes the
          MAC address of each packet source to be displayed if that
          information is available. The
          <replaceable>refresh-interval</replaceable> specifies the time in
          seconds between screen refreshes. You can enter a negative number by
          preceding the number with "--" (e.g., <command>shorewall-lite
          logwatch -- -30</command>). In this case, when a packet count
          changes, you will be prompted to hit any key to resume screen
          refreshes.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">logreject
        </emphasis><replaceable>address</replaceable></term>

        <listitem>
          <para>Causes traffic from the listed <emphasis>address</emphasis>es
          to be logged then rejected. Logging occurs at the log level
          specified by the BLACKLIST_LOGLEVEL setting in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink> (5).</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">ls</emphasis></term>

        <listitem>
          <para><command>ls</command> is a synonym for <command>show</command>
          -- please see below.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">noiptrace </emphasis><replaceable>iptables
        match expression</replaceable></term>

        <listitem>
          <para>This is a low-level debugging command that cancels a trace
          started by a preceding <command>iptrace</command> command.</para>

          <para>The <replaceable>iptables match expression</replaceable> must
          be one given in the <command>iptrace</command> command being
          canceled.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">open</emphasis>
        <replaceable>source</replaceable> <replaceable>dest</replaceable> [
        <replaceable>protocol</replaceable> [ <replaceable>port</replaceable>
        ] ]</term>

        <listitem>
          <para>Added in Shorewall 4.6.8. This command requires that the
          firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in
          <ulink url="/manpages/shorewall.conf.html">shorewall.conf
          (5)</ulink>. The effect of the command is to temporarily open the
          firewall for connections matching the parameters.</para>

          <para>The <replaceable>source</replaceable> and
          <replaceable>dest</replaceable> parameters may each be specified as
          <emphasis role="bold">all</emphasis> if you don't wish to restrict
          the connection source or destination respectively. Otherwise, each
          must contain a host or network address or a valid DNS name.</para>

          <para>The <replaceable>protocol</replaceable> may be specified
          either as a number or as a name listed in /etc/protocols. The
          <replaceable>port</replaceable> may be specified numerically or as a
          name listed in /etc/services.</para>

          <para>To reverse the effect of a successful <command>open</command>
          command, use the <command>close</command> command with the same
          parameters or simply restart the firewall.</para>

          <para>Example: To open the firewall for SSH connections to address
          192.168.1.1, the command would be:</para>

          <programlisting>    shorewall-lite open all 192.168.1.1 tcp 22</programlisting>

          <para>To reverse that command, use:</para>

          <screen>    shorewall-lite close all 192.168.1.1 tcp 22</screen>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">reject</emphasis><replaceable>
        address</replaceable></term>

        <listitem>
          <para>Causes traffic from the listed <emphasis>address</emphasis>es
          to be silently rejected.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">reset [<replaceable>chain</replaceable>,
        ...]</emphasis><acronym></acronym></term>

        <listitem>
          <para>Resets the packet and byte counters in the specified
          <replaceable>chain</replaceable>(s). If no
          <replaceable>chain</replaceable> is specified, all the packet and
          byte counters in the firewall are reset.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">restart </emphasis>[-n] [-p]
        [-<option>C</option>]</term>

        <listitem>
          <para>Restart is similar to <emphasis role="bold">shorewall-lite
          start</emphasis> except that it assumes that the firewall is already
          started. Existing connections are maintained.</para>

          <para>The <option>-n</option> option causes Shorewall-lite to avoid
          updating the routing table(s).</para>

          <para>The <option>-p</option> option causes the connection tracking
          table to be flushed; the <command>conntrack</command> utility must
          be installed to use this option.</para>

          <para>The <option>-C</option> option was added in Shorewall 4.6.5.
          If the specified (or implicit) firewall script is the one that
          generated the current running configuration, then the running
          netfilter configuration will be reloaded as is so as to preserve the
          iptables packet and byte counters.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">restore </emphasis>[-<option>n</option>]
        [-<option>p</option>] [-<option>C</option>] [
        <replaceable>filename</replaceable> ]</term>

        <listitem>
          <para>Restore Shorewall-lite to a state saved using the <emphasis
          role="bold">shorewall-lite save</emphasis> command. Existing
          connections are maintained. The <emphasis>filename</emphasis> names
          a restore file in /var/lib/shorewall-lite created using <emphasis
          role="bold">shorewall-lite save</emphasis>; if no
          <emphasis>filename</emphasis> is given then Shorewall-lite will be
          restored from the file specified by the RESTOREFILE option in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>

          <caution>
            <para>If your iptables ruleset depends on variables that are
            detected at run-time, either in your params file or by
            Shorewall-generated code, <command>restore</command> will use the
            values that were current when the ruleset was saved, which may be
            different from the current values.</para>
          </caution>

          <para>The <option>-n</option> option causes Shorewall to avoid
          updating the routing table(s).</para>

          <para>The <option>-p</option> option, added in Shorewall 4.6.5,
          causes the connection tracking table to be flushed; the
          <command>conntrack</command> utility must be installed to use this
          option.</para>

          <para>The <option>-C</option> option was added in Shorewall 4.6.5.
          If the <option>-C</option> option was specified during <emphasis
          role="bold">shorewall save</emphasis>, then the counters saved by
          that operation will be restored.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">run
        </emphasis><replaceable>command</replaceable> [
        <replaceable>parameter</replaceable> ... ]</term>

        <listitem>
          <para>Added in Shorewall 4.6.3. Executes
          <replaceable>command</replaceable> in the context of the generated
          script passing the supplied <replaceable>parameter</replaceable>s.
          Normally, the <replaceable>command</replaceable> will be a function
          declared in <filename>lib.private</filename>.</para>

          <para>Before executing the <replaceable>command</replaceable>, the
          script will detect the configuration, setting all SW_* variables and
          will run your <filename>init</filename> extension script with
          $COMMAND = 'run'.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">save </emphasis>[-<option>C</option>] [
        <replaceable>filename</replaceable> ]</term>

        <listitem>
          <para>The dynamic blacklist is stored in
          /var/lib/shorewall-lite/save. The state of the firewall is stored in
          /var/lib/shorewall-lite/<emphasis>filename</emphasis> for use by the
          <emphasis role="bold">shorewall-lite restore</emphasis>. If
          <emphasis>filename</emphasis> is not given then the state is saved
          in the file specified by the RESTOREFILE option in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>

          <para>The <option>-C</option> option, added in Shorewall 4.6.5,
          causes the iptables packet and byte counters to be saved along with
          the chains and rules.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">savesets</emphasis></term>

        <listitem>
          <para>Added in shorewall 4.6.8. Performs the same action as the
          <command>stop</command> command with respect to saving ipsets (see
          the SAVE_IPSETS option in <ulink
          url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5)).
          This command may be used to proactively save your ipset contents in
          the event that a system failure occurs prior to issuing a
          <command>stop</command> command.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">show</emphasis></term>

        <listitem>
          <para>The show command can have a number of different
          arguments:</para>

          <variablelist>
            <varlistentry>
              <term><emphasis role="bold">bl|blacklists
              </emphasis>[-<option>x</option>]</term>

              <listitem>
                <para>Added in Shorewall 4.6.2. Displays the dynamic chain
                along with any chains produced by entries in
                shorewall-blrules(5).The <emphasis role="bold">-x</emphasis>
                option is passed directly through to iptables and causes
                actual packet and byte counts to be displayed. Without this
                option, those counts are abbreviated.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term>[-<option>f</option>] <emphasis
              role="bold">capabilities</emphasis></term>

              <listitem>
                <para>Displays your kernel/iptables capabilities. The
                <emphasis role="bold">-f</emphasis> option causes the display
                to be formatted as a capabilities file for use with <emphasis
                role="bold">compile -e</emphasis>.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term>[-<option>b</option>] [-<option>x</option>]
              [-<option>l</option>] [-<option>t</option>
              {<option>filter</option>|<option>mangle</option>|<option>nat</option>|<option>raw</option>|<option>rawpost</option>}]
              [ <emphasis>chain</emphasis>... ]</term>

              <listitem>
                <para>The rules in each <emphasis>chain</emphasis> are
                displayed using the <emphasis role="bold">iptables
                -L</emphasis> <emphasis>chain</emphasis> <emphasis
                role="bold">-n -v</emphasis> command. If no
                <emphasis>chain</emphasis> is given, all of the chains in the
                filter table are displayed. The <emphasis
                role="bold">-x</emphasis> option is passed directly through to
                iptables and causes actual packet and byte counts to be
                displayed. Without this option, those counts are abbreviated.
                The <emphasis role="bold">-t</emphasis> option specifies the
                Netfilter table to display. The default is <emphasis
                role="bold">filter</emphasis>.</para>

                <para>The <emphasis role="bold">-b</emphasis> ('brief') option
                causes rules which have not been used (i.e. which have zero
                packet and byte counts) to be omitted from the output. Chains
                with no rules displayed are also omitted from the
                output.</para>

                <para>The <emphasis role="bold">-l</emphasis> option causes
                the rule number for each Netfilter rule to be
                displayed.</para>

                <para>If the <emphasis role="bold">t</emphasis> option and the
                <option>chain</option> keyword are both omitted and any of the
                listed <replaceable>chain</replaceable>s do not exist, a usage
                message is displayed.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis
              role="bold">classifiers|filters</emphasis></term>

              <listitem>
                <para>Displays information about the packet classifiers
                defined on the system as a result of traffic shaping
                configuration.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">config</emphasis></term>

              <listitem>
                <para>Displays distribution-specific defaults.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">connections</emphasis></term>

              <listitem>
                <para>Displays the IP connections currently being tracked by
                the firewall.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">event</emphasis><replaceable>
              event</replaceable></term>

              <listitem>
                <para>Added in Shorewall 4.5.19. Displays the named
                event.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">events</emphasis></term>

              <listitem>
                <para>Added in Shorewall 4.5.19. Displays all events.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">ip</emphasis></term>

              <listitem>
                <para>Displays the system's IPv4 configuration.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">ipa</emphasis></term>

              <listitem>
                <para>Added in Shorewall 4.4.17. Displays the per-IP
                accounting counters (<ulink
                url="manpages/shorewall-accounting.html">shorewall-accounting</ulink>
                (5)).</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">log</emphasis></term>

              <listitem>
                <para>Displays the last 20 Shorewall-lite messages from the
                log file specified by the LOGFILE option in <ulink
                url="shorewall.conf.html">shorewall.conf</ulink>(5). The
                <emphasis role="bold">-m</emphasis> option causes the MAC
                address of each packet source to be displayed if that
                information is available.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">marks</emphasis></term>

              <listitem>
                <para>Added in Shorewall 4.4.26. Displays the various fields
                in packet marks giving the min and max value (in both decimal
                and hex) and the applicable mask (in hex).</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">nat</emphasis></term>

              <listitem>
                <para>Displays the Netfilter nat table using the command
                <emphasis role="bold">iptables -t nat -L -n -v</emphasis>.The
                <emphasis role="bold">-x</emphasis> option is passed directly
                through to iptables and causes actual packet and byte counts
                to be displayed. Without this option, those counts are
                abbreviated.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">opens</emphasis></term>

              <listitem>
                <para>Added in Shorewall 4.5.8. Displays the iptables rules in
                the 'dynamic' chain created through use of the <command>open
                </command>command..</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">policies</emphasis></term>

              <listitem>
                <para>Added in Shorewall 4.4.4. Displays the applicable policy
                between each pair of zones. Note that implicit intrazone
                ACCEPT policies are not displayed for zones associated with a
                single network where that network doesn't specify
                <option>routeback</option>.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">routing</emphasis></term>

              <listitem>
                <para>Displays the system's IPv4 routing configuration. The -c
                option causes the route cache to be displayed in addition to
                the other routing information.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">raw</emphasis></term>

              <listitem>
                <para>Displays the Netfilter raw table using the command
                <emphasis role="bold">iptables -t raw -L -n -v</emphasis>.The
                <emphasis role="bold">-x</emphasis> option is passed directly
                through to iptables and causes actual packet and byte counts
                to be displayed. Without this option, those counts are
                abbreviated.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">tc</emphasis></term>

              <listitem>
                <para>Displays information about queuing disciplines, classes
                and filters.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">zones</emphasis></term>

              <listitem>
                <para>Displays the current composition of the Shorewall zones
                on the system.</para>
              </listitem>
            </varlistentry>
          </variablelist>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">start</emphasis> [-<option>p</option>]
        [-<option>n</option>] [<option>-f</option>]
        [-<option>C</option>]</term>

        <listitem>
          <para>Start Shorewall Lite. Existing connections through
          shorewall-lite managed interfaces are untouched. New connections
          will be allowed only if they are allowed by the firewall rules or
          policies.</para>

          <para>The <option>-p</option> option causes the connection tracking
          table to be flushed; the <command>conntrack</command> utility must
          be installed to use this option.</para>

          <para>The <option>-n</option> option prevents the firewall script
          from modifying the current routing configuration.</para>

          <para>The <option>-f</option> option was added in Shorewall 4.6.5.
          If the RESTOREFILE named in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink>(5) exists, is
          executable and is not older than the current filewall script, then
          that saved configuration is restored.</para>

          <para>The <option>-C</option> option was added in Shorewall 4.6.5
          and is only meaningful when the <option>-f</option> option is also
          specified. If the previously-saved configuration is restored, and if
          the <option>-C</option> option was also specified in the <emphasis
          role="bold">save</emphasis> command, then the packet and byte
          counters will be restored.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">stop</emphasis></term>

        <listitem>
          <para>Stops the firewall. All existing connections, except those
          listed in <ulink
          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
          or permitted by the ADMINISABSENTMINDED option in <ulink
          url="shorewall.conf.html">shorewall.conf</ulink>(5), are taken down.
          The only new traffic permitted through the firewall is from systems
          listed in <ulink
          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
          or by ADMINISABSENTMINDED.</para>

          <para>If <option>-f</option> is given, the command will be processed
          by the compiled script that executed the last successful <emphasis
          role="bold">start</emphasis>, <emphasis
          role="bold">restart</emphasis> or <emphasis
          role="bold">refresh</emphasis> command if that script exists.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">status</emphasis></term>

        <listitem>
          <para>Produces a short report about the state of the
          Shorewall-configured firewall.</para>

          <para>The <option>-i </option>option was added in Shorewall 4.6.2
          and causes the status of each optional or provider interface to be
          displayed.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">version</emphasis></term>

        <listitem>
          <para>Displays Shorewall's version. The <option>-a</option> option
          is included for compatibility with earlier Shorewall releases and is
          ignored.</para>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>EXIT STATUS</title>

    <para>In general, when a command succeeds, status 0 is returned; when the
    command fails, a non-zero status is returned.</para>

    <para>The <command>status</command> command returns exit status as
    follows:</para>

    <para>0 - Firewall is started.</para>

    <para>3 - Firewall is stopped or cleared</para>

    <para>4 - Unknown state; usually means that the firewall has never been
    started.</para>
  </refsect1>

  <refsect1>
    <title>FILES</title>

    <para>/etc/shorewall-lite/</para>
  </refsect1>

  <refsect1>
    <title>See ALSO</title>

    <para><ulink
    url="http://www.shorewall.net/starting_and_stopping_shorewall.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>

    <para>shorewall-accounting(5), shorewall-actions(5),
    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
    shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
    shorewall-tunnels(5), shorewall-zones(5)</para>
  </refsect1>
</refentry>