shorewall_code/STABLE/documentation/upgrade_issues.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
                                 
  <meta http-equiv="Content-Type"
 content="text/html; charset=windows-1252">
  <title>Upgrade Issues</title>
                                                          
  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                                 
  <meta name="ProgId" content="FrontPage.Editor.Document">
                                         
  <meta name="Microsoft Theme" content="none">
</head>
  <body>
              
<table border="0" cellpadding="0" cellspacing="0"
 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 bgcolor="#400169" height="90">
          <tbody>
          <tr>
            <td width="100%">                                           
    
      <h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
            </td>
          </tr>
                          
  </tbody>      
</table>
                                                        
<p>For upgrade instructions see the                               <a
 href="Install.htm">Install/Upgrade page</a>.</p>
                                            
<h3>Version &gt;= 1.3.14</h3>
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
<EFBFBD><EFBFBD> <20> Beginning in version 1.3.14, Shorewall treats entries in <a
 href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change 
involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second) 
<b>column</b>:<br>
 
<ul>
   <li>Prior to 1.3.14, Shorewall would detect the FIRST subnet on the interface 
(as shown by "ip addr show <i>interface</i>") and would masquerade traffic 
from that subnet. Any other subnets that routed through eth1 needed their 
own entry in /etc/shorewall/masq to be masqueraded or to have SNAT applied.</li>
   <li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's routing 
table to determine ALL subnets routed through the named interface. Traffic 
originating in ANY of those subnets is masqueraded or has SNAT applied.</li>
 
</ul>
 You will need to make a change to your configuration if:<br>
 
<ol>
   <li>You have one or more entries in /etc/shorewall/masq with an interface 
name in the SUBNET (second) column; and</li>
   <li>That interface connects to more than one subnetwork.</li>
 
</ol>
 Two examples:<br>
 <br>
 <20><b>Example 1</b> -- Suppose that your current config is as follows:<br>
 <20><> <br>
 
<pre>	[root@gateway test]# cat /etc/shorewall/masq<br>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.10.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br>	[root@gateway test]# ip route show dev eth2<br>	192.168.1.0/24<32> scope link<br>	192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254<br>	[root@gateway test]#</pre>
 
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer 
required.<br>
 </blockquote>
 <b>Example 2</b>-- What if your current configuration is like this?<br>
 
<pre>	[root@gateway test]# cat /etc/shorewall/masq	<br>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS	<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE	<br>	[root@gateway test]# ip route show dev eth2	<br>	192.168.1.0/24<32> scope link<br>	192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254	<br>	[root@gateway test]#</pre>
 
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq 
to:<br>
 </blockquote>
 
<pre>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS	<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.1.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
 <img src="images/BD21298_3.gif" alt="" width="13" height="13">
<EFBFBD><EFBFBD><EFBFBD> Version 1.3.14 also introduced simplified ICMP echo-request (ping) handling.
The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf is used
to specify that the old (pre-1.3.14) ping handling is to be used (If the
option is not set in your /etc/shorewall/shorewall.conf then OLD_PING_HANDLING=Yes
is assumed). I don't plan on supporting the old handling indefinitely so
I urge current users to migrate to using the new handling as soon as possible.
See the <a href="ping.html">'Ping' handling documentation</a> for details.<br>
<h3>Version 1.3.10</h3>
  If you have installed the 1.3.10 Beta 1 RPM and are now upgrading to version
 1.3.10, you will need to use the '--force' option:<br>
  <br>
   
<blockquote>      
  <pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm<70></pre>
  </blockquote>
   
<h3>Version &gt;= 1.3.9</h3>
    The 'functions' file has moved to /usr/lib/shorewall/functions. If you
 have  an application that uses functions from that file, your application
 will need to be changed to reflect this change of location.<br>
       
<h3>Version &gt;= 1.3.8</h3>
                                            
<p>If you have a pair of firewall systems configured for            failover
   or if you have asymmetric routing, you will need to modify           
                    your firewall setup slightly under Shorewall        
                       versions &gt;= 1.3.8. Beginning with version 1.3.8,
                               you must set NEWNOTSYN=Yes in your       
                        /etc/shorewall/shorewall.conf file.</p>
                                            
<h3>Version &gt;= 1.3.7</h3>
                                            
<p>Users specifying ALLOWRELATED=No in                                /etc/shorewall.conf
   will need to include the                                following rules
 in  their /etc/shorewall/icmpdef                                file (creating
   this file if necessary):</p>
                                            
<pre>	run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
              
<p>Users having an /etc/shorewall/icmpdef file may remove the ".   /etc/shorewall/icmp.def"
   command from that file since the icmp.def file is now   empty.</p>
              
<h3><b><a name="Bering">Upgrading </a>Bering to                         
      Shorewall &gt;= 1.3.3</b></h3>
                                            
<p>To properly upgrade with Shorewall version                           
    1.3.3 and later:</p>
                                            
<ol>
                                       <li>Be sure you have a backup -- you 
 will  need                                  to transcribe any Shorewall configuration
                                   changes that you have made to the new
                                 configuration.</li>
                                       <li>Replace the shorwall.lrp package 
 provided  on                                  the Bering floppy with the 
later one.  If you did                                  not obtain the later 
version from Jacques's                                  site, see additional 
instructions  below.</li>
                                       <li>Edit the /var/lib/lrpkg/root.exclude.list
                                    file and remove the /var/lib/shorewall
 entry  if                                  present. Then do not forget to
 backup  root.lrp !</li>
                 
</ol>
              
<p>The .lrp that I release isn't set up for a two-interface firewall like
     Jacques's. You need to follow the <a href="two-interface.htm">instructions
   for   setting up a two-interface firewall</a> plus you also need to add
 the  following   two Bering-specific rules to /etc/shorewall/rules:</p>
              
<blockquote>                      
  <pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
        </blockquote>
                                        
<h3 align="left">Version  1.3.6 and 1.3.7</h3>
                                        
<p align="left">If you have a pair of firewall systems configured for   
        failover or if you have asymmetric routing, you will need to modify
              your firewall setup slightly under Shorewall versions 1.3.6
and   1.3.7</p>
                                        
<ol>
                   <li>                                                 
        
    <p align="left">Create the file /etc/shorewall/newnotsyn and in it add
              the following rule<br>
                 <br>
                 <font face="Courier">run_iptables -A newnotsyn -j RETURN 
#  So  that the            connection tracking table can be rebuilt<br>
       <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>            # from non-SYN packets
  after  takeover.<br>
       <20></font>  </p>
        </li>
        <li>                                                          
    <p align="left">Create /etc/shorewall/common (if you don't already  
         have that file) and include the following:<br>
                 <br>
                 <font face="Courier">run_iptables -A common -p tcp --tcp-flags
              ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection<br>
       <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
            #tracking table. <br>
                 . /etc/shorewall/common.def</font> </p>
        </li>
           
</ol>
                                        
<h3 align="left">Versions &gt;= 1.3.5</h3>
                                        
<p align="left">Some forms of pre-1.3.0 rules file syntax are no        
   longer supported. </p>
                                        
<p align="left">Example 1:</p>
                                        
<div align="left">                   
<pre>	ACCEPT    net    loc:192.168.1.12:22    tcp    11111    -    all</pre>
        </div>
                                        
<p align="left">Must be replaced with:</p>
                                        
<div align="left">                   
<pre>	DNAT	net	loc:192.168.1.12:22	tcp	11111</pre>
        </div>
              
<div align="left">          
<p align="left">Example 2:</p>
      </div>
              
<div align="left">          
<pre>	ACCEPT	loc	fw::3128	tcp	80	-	all</pre>
        </div>
              
<div align="left">          
<p align="left">Must be replaced with:</p>
      </div>
              
<div align="left">          
<pre>	REDIRECT	loc	3128	tcp	80</pre>
        </div>
                                        
<h3 align="left">Version &gt;= 1.3.2</h3>
                                        
<p align="left">The functions and versions files together with the      
     'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
              If you have applications that access these files, those applications
              should be modified accordingly.</p>
                               
<p><font size="2">  Last updated 1/25/2003 -                             
 <a href="support.htm">Tom Eastep</a></font> </p>
               
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
     <20> <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
  </p>
  <br>
 <br>
</body>
</html>
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 								<html>
 								<head>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								  <meta http-equiv="Content-Type"
 								 content="text/html; charset=windows-1252">
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								  <title>Upgrade Issues</title>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								  <meta name="ProgId" content="FrontPage.Editor.Document">
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								  <meta name="Microsoft Theme" content="none">
 								</head>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								  <body>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<table border="0" cellpadding="0" cellspacing="0"
 								 style="border-collapse: collapse;" width="100%" id="AutoNumber1"
 								 bgcolor="#400169" height="90">
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								          <tbody>
 								          <tr>
 								            <td width="100%">
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								      <h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								            </td>
 								          </tr>
 								  </tbody>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								</table>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<p>For upgrade instructions see the                               <a
 								 href="Install.htm">Install/Upgrade page</a>.</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
 								<h3>Version &gt;= 1.3.14</h3>
 								<img src="images/BD21298_3.gif" alt="" width="13" height="13">
 								<EFBFBD><EFBFBD> <20> Beginning in version 1.3.14, Shorewall treats entries in <a
 								 href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change
 								involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second)
 								<b>column</b>:<br>
 								<ul>
 								   <li>Prior to 1.3.14, Shorewall would detect the FIRST subnet on the interface
 								(as shown by "ip addr show <i>interface</i>") and would masquerade traffic
 								from that subnet. Any other subnets that routed through eth1 needed their
 								own entry in /etc/shorewall/masq to be masqueraded or to have SNAT applied.</li>
 								   <li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's routing
 								table to determine ALL subnets routed through the named interface. Traffic
 								originating in ANY of those subnets is masqueraded or has SNAT applied.</li>
 								</ul>
 								 You will need to make a change to your configuration if:<br>
 								<ol>
 								   <li>You have one or more entries in /etc/shorewall/masq with an interface
 								name in the SUBNET (second) column; and</li>
 								   <li>That interface connects to more than one subnetwork.</li>
 								</ol>
 								 Two examples:<br>
 								 <br>
 								 <20><b>Example 1</b> -- Suppose that your current config is as follows:<br>
 								 <20><> <br>
 								<pre>	[root@gateway test]# cat /etc/shorewall/masq<br>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.10.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br>	[root@gateway test]# ip route show dev eth2<br>	192.168.1.0/24<32> scope link<br>	192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254<br>	[root@gateway test]#</pre>
 								<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
 								required.<br>
 								 </blockquote>
 								 <b>Example 2</b>-- What if your current configuration is like this?<br>
 								<pre>	[root@gateway test]# cat /etc/shorewall/masq	<br>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS	<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE	<br>	[root@gateway test]# ip route show dev eth2	<br>	192.168.1.0/24<32> scope link<br>	192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254	<br>	[root@gateway test]#</pre>
 								<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
 								to:<br>
 								 </blockquote>
 								<pre>	#INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS	<br>	eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.1.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
 								 <img src="images/BD21298_3.gif" alt="" width="13" height="13">
 								<EFBFBD><EFBFBD><EFBFBD> Version 1.3.14 also introduced simplified ICMP echo-request (ping) handling.
 								The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf is used
 								to specify that the old (pre-1.3.14) ping handling is to be used (If the
 								option is not set in your /etc/shorewall/shorewall.conf then OLD_PING_HANDLING=Yes
 								is assumed). I don't plan on supporting the old handling indefinitely so
 								I urge current users to migrate to using the new handling as soon as possible.
 								See the <a href="ping.html">'Ping' handling documentation</a> for details.<br>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<h3>Version 1.3.10</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								  If you have installed the 1.3.10 Beta 1 RPM and are now upgrading to version
 .3.10, you will need to use the '--force' option:<br>
 								  <br>
 								<blockquote>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								  <pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm<70></pre>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								  </blockquote>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								<h3>Version &gt;= 1.3.9</h3>
 								    The 'functions' file has moved to /usr/lib/shorewall/functions. If you
 								 have  an application that uses functions from that file, your application
 								 will need to be changed to reflect this change of location.<br>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<h3>Version &gt;= 1.3.8</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p>If you have a pair of firewall systems configured for            failover
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								   or if you have asymmetric routing, you will need to modify
 								                    your firewall setup slightly under Shorewall
 								                       versions &gt;= 1.3.8. Beginning with version 1.3.8,
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								                               you must set NEWNOTSYN=Yes in your
 								                        /etc/shorewall/shorewall.conf file.</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<h3>Version &gt;= 1.3.7</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p>Users specifying ALLOWRELATED=No in                                /etc/shorewall.conf
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								   will need to include the                                following rules
 								 in  their /etc/shorewall/icmpdef                                file (creating
 								   this file if necessary):</p>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<pre>	run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p>Users having an /etc/shorewall/icmpdef file may remove the ".   /etc/shorewall/icmp.def"
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								   command from that file since the icmp.def file is now   empty.</p>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<h3><b><a name="Bering">Upgrading </a>Bering to
 								      Shorewall &gt;= 1.3.3</b></h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p>To properly upgrade with Shorewall version
 .3.3 and later:</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<ol>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								                                       <li>Be sure you have a backup -- you
 								 will  need                                  to transcribe any Shorewall configuration
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								                                   changes that you have made to the new
 								                                 configuration.</li>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								                                       <li>Replace the shorwall.lrp package
 								 provided  on                                  the Bering floppy with the
 								later one.  If you did                                  not obtain the later
 								version from Jacques's                                  site, see additional
 								instructions  below.</li>
 								                                       <li>Edit the /var/lib/lrpkg/root.exclude.list
 								                                    file and remove the /var/lib/shorewall
 								 entry  if                                  present. Then do not forget to
 								 backup  root.lrp !</li>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								</ol>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p>The .lrp that I release isn't set up for a two-interface firewall like
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								     Jacques's. You need to follow the <a href="two-interface.htm">instructions
 								   for   setting up a two-interface firewall</a> plus you also need to add
 								 the  following   two Bering-specific rules to /etc/shorewall/rules:</p>
 								<blockquote>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								  <pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								        </blockquote>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<h3 align="left">Version  1.3.6 and 1.3.7</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p align="left">If you have a pair of firewall systems configured for
 								        failover or if you have asymmetric routing, you will need to modify
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								              your firewall setup slightly under Shorewall versions 1.3.6
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								and   1.3.7</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<ol>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								                   <li>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								    <p align="left">Create the file /etc/shorewall/newnotsyn and in it add
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								              the following rule<br>
 								                 <br>
 								                 <font face="Courier">run_iptables -A newnotsyn -j RETURN
 								#  So  that the            connection tracking table can be rebuilt<br>
 								       <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>            # from non-SYN packets
 								  after  takeover.<br>
 								       <20></font>  </p>
 								        </li>
 								        <li>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								    <p align="left">Create /etc/shorewall/common (if you don't already
 								         have that file) and include the following:<br>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								                 <br>
 								                 <font face="Courier">run_iptables -A common -p tcp --tcp-flags
 								              ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection<br>
 								       <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								            #tracking table. <br>
 								                 . /etc/shorewall/common.def</font> </p>
 								        </li>
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								</ol>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<h3 align="left">Versions &gt;= 1.3.5</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p align="left">Some forms of pre-1.3.0 rules file syntax are no
 								   longer supported. </p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<p align="left">Example 1:</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
 								<div align="left">
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<pre>	ACCEPT    net    loc:192.168.1.12:22    tcp    11111    -    all</pre>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								        </div>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<p align="left">Must be replaced with:</p>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
 								<div align="left">
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<pre>	DNAT	net	loc:192.168.1.12:22	tcp	11111</pre>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								        </div>
 								<div align="left">
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<p align="left">Example 2:</p>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								      </div>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
 								<div align="left">
 								<pre>	ACCEPT	loc	fw::3128	tcp	80	-	all</pre>
 								        </div>
 								<div align="left">
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<p align="left">Must be replaced with:</p>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								      </div>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
 								<div align="left">
 								<pre>	REDIRECT	loc	3128	tcp	80</pre>
 								        </div>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								<h3 align="left">Version &gt;= 1.3.2</h3>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p align="left">The functions and versions files together with the
 								     'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								              If you have applications that access these files, those applications
 								              should be modified accordingly.</p>
 								<p><font size="2">  Last updated 1/25/2003 -
 								 <a href="support.htm">Tom Eastep</a></font> </p>
-												Version 1.3.10


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-11-09 19:10:22 +01:00
+								<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
-												Shoreawall 1.3.14 Changes


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@440 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2003-02-08 21:48:47 +01:00
+								     <20> <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
 								  </p>
 								  <br>
 								 <br>
-												Additions for 1.3.8


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-16 19:04:56 +02:00
+								</body>
-												Shorewall-1.3.9a


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@271 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

											
										
										
											2002-09-30 20:11:25 +02:00
+								</html>