2003-02-08 21:58:44 +01:00
|
|
|
This is a major release of Shorewall.
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
Function from 1.3 that has been omitted from this version include:
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
1) The MERGE_HOSTS variable in shorewall.conf is no longer
|
2003-02-15 01:09:44 +01:00
|
|
|
supported. Shorewall 1.4 behavior is the same as 1.3 with
|
2003-02-08 21:58:44 +01:00
|
|
|
MERGE_HOSTS=Yes.
|
2002-12-31 02:10:28 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
2. Interface names of the form <device>:<integer> in
|
|
|
|
/etc/shorewall/interfaces now generate an error.
|
2002-12-31 02:10:28 +01:00
|
|
|
|
2003-02-15 01:09:44 +01:00
|
|
|
3. Shorewall 1.4 implements behavior consistent with
|
2003-02-08 21:58:44 +01:00
|
|
|
OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate an error
|
|
|
|
at startup as will specification of the 'noping' or 'filterping'
|
|
|
|
interface options.
|
2002-12-31 02:10:28 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
4. The 'routestopped' option in the /etc/shorewall/interfaces and
|
|
|
|
/etc/shorewall/hosts files is no longer supported and will generate
|
|
|
|
an error at startup if specified.
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
5. The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer
|
|
|
|
accepted.
|
2003-01-27 18:03:43 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
6. The ALLOWRELATED variable in shorewall.conf is no longer
|
2003-02-15 01:09:44 +01:00
|
|
|
supported. Shorewall 1.4 behavior is the same as 1.3 with
|
2003-02-08 21:58:44 +01:00
|
|
|
ALLOWRELATED=Yes.
|
2003-01-31 20:10:22 +01:00
|
|
|
|
2003-02-15 01:09:44 +01:00
|
|
|
Changes for 1.4 include:
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
1. shorewall.conf has been completely reorganized into logical
|
|
|
|
sections.
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
2. LOG is now a valid action for a rule (/etc/shorewall/rules).
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
3. The firewall script and version file are now installed in
|
|
|
|
/usr/share/shorewall.
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
4. Late arriving DNS replies are now silently dropped in the common
|
|
|
|
chain by default.
|
2003-01-25 01:15:55 +01:00
|
|
|
|
2003-02-11 02:34:52 +01:00
|
|
|
5. In addition to behaving like OLD_PING_HANDLING=No, Shorewall 2.0 no
|
|
|
|
longer unconditionally accepts outbound ICMP packets. So if you want
|
|
|
|
to 'ping' from the firewall, you will need the appropriate rule or
|
|
|
|
policy.
|
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
|