2005-10-18 17:20:12 +02:00
|
|
|
Shorewall 3.0.0 RC 2.
|
2005-09-19 16:17:09 +02:00
|
|
|
|
2005-10-18 17:20:12 +02:00
|
|
|
Problems Corrected in 3.0.0 RC 2:
|
2005-09-19 16:17:09 +02:00
|
|
|
|
2005-10-18 17:20:12 +02:00
|
|
|
1) Support for OpenVPN tunnels was released in Shorewall 2.2.0 but the
|
|
|
|
implementation was incomplete. It has now been completed and is
|
|
|
|
documented in the /etc/shorewall/tunnels file.
|
2005-10-09 22:26:37 +02:00
|
|
|
|
2005-10-19 16:30:13 +02:00
|
|
|
2) When running on older kernels, the following message could be issued
|
|
|
|
during "shorewall start":
|
|
|
|
|
|
|
|
/usr/share/shorewall/firewall: line 1: \
|
|
|
|
/proc/sys/net/ipv4/conf/all/arp_ignore: No such file or directory
|
|
|
|
|
2005-10-21 00:47:10 +02:00
|
|
|
New Features in Shorewall 3.0.0 RC 2:
|
|
|
|
|
|
|
|
1) The sample configurations are now packaged with the product. They are
|
|
|
|
in the Samples directory on the tarball and are in the RPM they are
|
|
|
|
in the Samples sub-directory of the Shorewall documentation
|
|
|
|
directory.
|
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
Migration Considerations:
|
2004-02-09 21:46:22 +01:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
1) The "monitor" command has been eliminated.
|
2004-02-09 21:46:22 +01:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
2) The "DISPLAY" and "COMMENTS" columns in the /etc/shorewall/zones
|
2005-08-02 18:46:30 +02:00
|
|
|
file have been removed and have been replaced by the former
|
2005-07-26 01:08:09 +02:00
|
|
|
columns of the /etc/shorewall/ipsec file. The latter file has been
|
2005-07-28 22:22:25 +02:00
|
|
|
removed.
|
|
|
|
|
2005-09-02 22:46:53 +02:00
|
|
|
Additionally the FW option in shorewall.conf has been deprecated and
|
|
|
|
is no longer set to 'fw' by default. New users are expected to
|
|
|
|
define the firewall zone in /etc/shorewall/zones.
|
|
|
|
|
2005-07-29 20:32:50 +02:00
|
|
|
Adhering to the principle of least astonishment, the old
|
|
|
|
/etc/shorewall/ipsec file will continue to be supported. A new
|
2005-07-28 22:22:25 +02:00
|
|
|
IPSECFILE variable in /etc/shorewall/shorewall.conf determines the
|
|
|
|
name of the file that Shorewall looks in for IPSEC information. If
|
|
|
|
that variable is not set or is set to the empty value then
|
|
|
|
IPSECFILE=ipsec is assumed. So if you simply upgrade and don't do
|
|
|
|
something idiotic like replace your current shorewall.conf file with
|
|
|
|
the new one, your old configuration will continue to work. A dummy
|
|
|
|
'ipsec' file is included in the release so that your package manager
|
|
|
|
(e.g., rpm) won't remove your existing file.
|
|
|
|
|
|
|
|
The shorewall.conf file included in this release sets
|
|
|
|
IPSECFILE=zones so that new users are expected to use the new zone
|
2005-08-02 18:46:30 +02:00
|
|
|
file format.
|
2005-07-28 22:22:25 +02:00
|
|
|
|
|
|
|
As a result, the columns in the /etc/shorewall/zones file
|
2005-07-26 01:08:09 +02:00
|
|
|
are now as follows:
|
2004-03-04 16:24:59 +01:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
ZONE Short name of the zone (5 Characters or less in
|
2005-09-13 19:13:35 +02:00
|
|
|
length). The names "all" and "none" are
|
|
|
|
reserved and may not be used as zone names.
|
2004-03-04 16:24:59 +01:00
|
|
|
|
2005-09-13 19:13:35 +02:00
|
|
|
Where a zone is nested in one or more other
|
|
|
|
zones, you may follow the (sub)zone name by ":"
|
|
|
|
and a comma-separated list of the parent
|
|
|
|
zones. The parent zones must have been defined
|
|
|
|
in earlier records in this file.
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
#ZONE TYPE OPTIONS
|
2005-09-30 19:16:22 +02:00
|
|
|
a ipv4
|
|
|
|
b ipv4
|
|
|
|
c:a,b ipv4
|
2005-09-13 19:13:35 +02:00
|
|
|
|
|
|
|
Currently, Shorewall uses this information only
|
|
|
|
to reorder the zone list so that parent zones
|
2005-10-15 21:13:33 +02:00
|
|
|
appear after their sub zones in the list. In the
|
2005-09-13 19:13:35 +02:00
|
|
|
future, Shorewall may make more extensive use
|
|
|
|
of that information.
|
|
|
|
|
2005-09-30 19:16:22 +02:00
|
|
|
TYPE ipv4 - This is the standard Shorewall zone type and is
|
2005-09-13 19:13:35 +02:00
|
|
|
the default if the column is left empty or if
|
|
|
|
it is entered as "-". Communication with some
|
|
|
|
zone hosts may be encrypted. Encrypted hosts
|
|
|
|
are designated using the 'ipsec' option in
|
|
|
|
/etc/shorewall/hosts.
|
|
|
|
ipsec - Communication with all zone hosts is encrypted
|
2005-09-02 22:46:53 +02:00
|
|
|
Your kernel and iptables must include policy
|
|
|
|
match support.
|
|
|
|
firewall
|
2005-09-30 18:54:24 +02:00
|
|
|
- Designates the firewall itself. You must have
|
2005-09-02 22:46:53 +02:00
|
|
|
exactly one 'firewall' zone. No options are
|
|
|
|
permitted with a 'firewall' zone.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-10-08 04:06:02 +02:00
|
|
|
OPTIONS, A comma-separated list of options as
|
2005-07-26 01:08:09 +02:00
|
|
|
IN OPTIONS, follows:
|
2005-09-30 18:54:24 +02:00
|
|
|
OUT OPTIONS
|
2005-07-26 01:08:09 +02:00
|
|
|
reqid=<number> where <number> is
|
|
|
|
specified using setkey(8) using the
|
|
|
|
'unique:<number> option for the SPD
|
|
|
|
level.
|
|
|
|
|
|
|
|
spi=<number> where <number> is the SPI
|
|
|
|
of the SA used to encrypt/decrypt
|
|
|
|
packets.
|
|
|
|
|
|
|
|
proto=ah|esp|ipcomp
|
|
|
|
|
|
|
|
mss=<number> (sets the MSS field in TCP
|
2005-08-02 18:46:30 +02:00
|
|
|
packets)
|
2005-07-26 01:08:09 +02:00
|
|
|
|
|
|
|
mode=transport|tunnel
|
|
|
|
|
|
|
|
tunnel-src=<address>[/<mask>] (only
|
|
|
|
available with mode=tunnel)
|
|
|
|
|
|
|
|
tunnel-dst=<address>[/<mask>] (only
|
|
|
|
available with mode=tunnel)
|
|
|
|
|
|
|
|
|
2005-10-08 04:06:49 +02:00
|
|
|
strict Means that packets must match
|
2005-07-26 01:08:09 +02:00
|
|
|
all rules.
|
|
|
|
|
|
|
|
|
|
|
|
next Separates rules; can only be
|
|
|
|
used with strict..
|
|
|
|
|
|
|
|
Example:
|
|
|
|
mode=transport,reqid=44
|
|
|
|
|
|
|
|
The options in the OPTIONS column are applied to both
|
|
|
|
incoming and outgoing traffic. The IN OPTIONS are
|
|
|
|
applied to incoming traffic (in addition to OPTIONS)
|
|
|
|
and the OUT OPTIONS are applied to outgoing traffic.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
If you wish to leave a column empty but need to make an
|
|
|
|
entry in a following column, use "-".
|
|
|
|
|
|
|
|
THE ORDER OF THE ENTRIES IN THIS FILE IS IMPORTANT IF YOU HAVE
|
|
|
|
NESTED OR OVERLAPPING ZONES DEFINED THROUGH /etc/shorewall/hosts.
|
|
|
|
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
3) The DROPINVALID option has been removed from shorewall.conf. The
|
|
|
|
behavior will be as if DROPINVALID=No had been specified. If you
|
|
|
|
wish to drop invalid state packets, use the dropInvalid built-in
|
|
|
|
action.
|
|
|
|
|
|
|
|
4) The 'nobogons' interface and hosts option as well as the
|
|
|
|
BOGON_LOG_LEVEL option have been eliminated.
|
|
|
|
|
2005-10-15 21:13:33 +02:00
|
|
|
5) Most of the standard actions have been replaced by parametrized
|
2005-07-26 01:08:09 +02:00
|
|
|
macros (see below). So for example, the action.AllowSMTP and
|
2005-10-15 21:13:33 +02:00
|
|
|
action.DropSMTP have been removed an a parametrized macro
|
2005-08-02 18:46:30 +02:00
|
|
|
macro.SMTP has been added to replace them.
|
2005-07-26 01:08:09 +02:00
|
|
|
|
|
|
|
In order that current users don't have to immediately update their
|
|
|
|
rules and user-defined actions, Shorewall can substitute an
|
|
|
|
invocation of the a new macro for an existing invocation of one of
|
|
|
|
the old actions. So if your rules file calls AllowSMTP, Shorewall
|
|
|
|
will replace that call with SMTP/ACCEPT. Because this substitution
|
|
|
|
is expensive, it is conditional based on the setting of
|
|
|
|
MAPOLDACTIONS in shorewall.conf. If this option is set to YES or if
|
2005-10-15 21:13:33 +02:00
|
|
|
it is not set (such as if you are using your old shorewall.conf
|
2005-07-26 01:08:09 +02:00
|
|
|
file) then Shorewall will perform the substitution. Once you have
|
|
|
|
converted to use the new macros, you can set MAPOLDACTIONS=No and
|
2005-10-08 02:30:11 +02:00
|
|
|
invocations of those actions will go much quicker during 'shorewall
|
2005-07-26 01:08:09 +02:00
|
|
|
[re]start'.
|
|
|
|
|
|
|
|
6) The STATEDIR variable in /etc/shorewall/shorewall.conf has been
|
|
|
|
removed. STATEDIR is now fixed at /var/lib/shorewall. If you have
|
|
|
|
previously set STATEDIR to another directory, please copy the files
|
|
|
|
from that directory to /var/lib/shorewall/ before [re]starting
|
|
|
|
Shorewall after the upgrade to this version.
|
|
|
|
|
2005-07-28 16:37:56 +02:00
|
|
|
7) The "shorewall status" command now just gives the status of
|
|
|
|
Shorewall (started or not-started). The previous status command has
|
2005-07-30 23:59:12 +02:00
|
|
|
been renamed "dump". The command also shows the state relative to the
|
2005-07-29 21:06:37 +02:00
|
|
|
state diagram at
|
|
|
|
http://shorewall.net/starting_and_stopping_shorewall.htm. In
|
|
|
|
addition to the state, the time and date at which that state was
|
|
|
|
entered is shown.
|
|
|
|
|
|
|
|
Note that at least one "shorewall [re]start" must be issued after
|
2005-07-30 23:59:12 +02:00
|
|
|
upgrading to this release before "shorewall status" will show
|
2005-07-29 21:06:37 +02:00
|
|
|
anything but "Unknown" for the state.
|
|
|
|
|
2005-08-04 22:24:23 +02:00
|
|
|
8) The "shorewall forget" command now removes the dynamic blacklist
|
|
|
|
save file (/var/lib/shorewall/save).
|
|
|
|
|
2005-08-27 16:50:33 +02:00
|
|
|
9) In previous versions of Shorewall, the rules generated by entries in
|
|
|
|
/etc/shorewall/tunnels preceded those rules generated by entries in
|
2005-08-27 17:10:37 +02:00
|
|
|
/etc/shorewall/rules. Beginning with this release, the rules
|
2005-08-27 16:50:33 +02:00
|
|
|
generated by entries in the tunnels file will appear *AFTER* the
|
|
|
|
rules generated by the rules file. This may cause you problems if
|
|
|
|
you have REJECT, DENY or CONTINUE rules in your rules file that
|
|
|
|
would cause the tunnel transport packets to not reach the rules that
|
|
|
|
ACCEPT them. See http://www.shorewall.net/VPNBasics.html for
|
|
|
|
information on the rules generated by entries in the tunnels file.
|
|
|
|
|
2005-10-07 17:30:33 +02:00
|
|
|
10) The NEWNOTSYN and LOGNEWNOTSYN options in shorewall.conf have been
|
2005-10-01 17:55:41 +02:00
|
|
|
removed as have the 'newnotsyn' options in /etc/shorewall/interfaces
|
|
|
|
and /etc/shorewall/hosts.
|
|
|
|
|
|
|
|
TCP new-not-syn packets may be blocked using the 'dropNonSyn' or
|
|
|
|
'rejNonSyn' built-in actions.
|
|
|
|
|
|
|
|
Example: Reject all new-not-syn packets from the net and log them at
|
|
|
|
the 'info' level.
|
|
|
|
|
|
|
|
#ACTION SOURCE DEST PROTO
|
|
|
|
SECTION NEW
|
|
|
|
rejNonSyn:info net all tcp
|
|
|
|
|
|
|
|
Note that the rule is added at the front of the NEW section of the
|
|
|
|
rules file.
|
|
|
|
|
2005-10-09 17:47:47 +02:00
|
|
|
11) A new value is defined for the TC_ENABLED option in shorewall.conf to
|
2005-10-15 21:13:33 +02:00
|
|
|
enable the built-in tc4shorewall traffic shaper. If you set
|
2005-10-09 17:47:47 +02:00
|
|
|
TC_ENABLED=internal then tc4shorewall will be used. If the option is
|
|
|
|
set to Yes then Shorewall will continue to look for a 'tcstart' script.
|
2005-10-06 00:51:29 +02:00
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
New Features in Shorewall 3.0.*
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
1) Error and warning messages are made easier to spot by using
|
|
|
|
capitalization (e.g., ERROR: and WARNING:).
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
2) A new option 'critical' has been added to
|
2005-07-26 01:08:09 +02:00
|
|
|
/etc/shorewall/routestopped. This option can be used to enable
|
|
|
|
communication with a host or set of hosts during the entire
|
|
|
|
"shorewall [re]start/stop" process. Listing a host with this option
|
|
|
|
differs from listing it without the option in several ways:
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
a) The option only affect traffic between the listed host(s) and the
|
|
|
|
firewall itself.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
b) If there are any entries with 'critical', the firewall
|
|
|
|
will be completely opened briefly during start, restart and stop but
|
|
|
|
there will be no chance of any packets to/from the listed host(s)
|
|
|
|
being dropped or rejected.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
Possible uses for this option are:
|
|
|
|
|
2005-10-15 21:13:33 +02:00
|
|
|
a) Root file system is NFS mounted. You will want to list the NFS server
|
2005-07-26 01:08:09 +02:00
|
|
|
in the 'critical' option.
|
|
|
|
|
|
|
|
b) You are running Shorewall in a Crossbeam environment
|
|
|
|
(www.crossbeam.com). You will want to list the Crossbeam interface
|
|
|
|
in this option
|
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
3) A new 'macro' feature has been added.
|
2005-07-26 01:08:09 +02:00
|
|
|
|
|
|
|
Macros are very similar to actions and can be used in similar
|
|
|
|
ways. The differences between actions and macros are as follows:
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
a) An action creates a separate chain with the same name as the
|
|
|
|
action (when logging is specified on the invocation of an action,
|
|
|
|
a chain beginning with "%" followed by the name of the action and
|
|
|
|
possibly followed by a number is created). When a macro is
|
|
|
|
invoked, it is expanded in-line and no new chain is created.
|
|
|
|
|
|
|
|
b) An action may be specified as the default action for a policy;
|
|
|
|
macros cannot be specified this way.
|
|
|
|
|
|
|
|
c) Actions must be listed in either /usr/share/shorewall/actions.std
|
|
|
|
or in /etc/shorewall/actions. Macros are defined simply by
|
|
|
|
placing their definition file in the CONFIG_PATH.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
d) Actions are defined in a file with a name beginning with
|
|
|
|
"action." and followed by the name of the action. Macro files are
|
|
|
|
defined in a file with a name beginning with "macro.".
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
e) Actions may invoke other actions. Macros may not directly invoke
|
|
|
|
other macros although they may invoke other macros indirectly
|
|
|
|
through an action.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
f) DNAT[-] and REDIRECT[-] rules may not appear in an action. They
|
|
|
|
are allowed in a macro with the restriction that the a macro
|
|
|
|
containing one of these rules may not be invoked from an action.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
g) The values specified in the various columns when you invoke a
|
|
|
|
macro are substituted in the corresponding column in each rule in
|
|
|
|
the macro. The first three columns get special treatment:
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-08-31 19:03:37 +02:00
|
|
|
ACTION If you code PARAM as the action in a macro then
|
2005-08-02 18:46:30 +02:00
|
|
|
when you invoke the macro, you can include the
|
2005-07-26 01:08:09 +02:00
|
|
|
name of the macro followed by a slash ("/") and
|
2005-10-15 21:13:33 +02:00
|
|
|
an ACTION (either built-in or user-defined. All
|
2005-07-26 01:08:09 +02:00
|
|
|
instances of PARAM in the body of the macro will be
|
|
|
|
replaced with the ACTION.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-08-31 19:03:37 +02:00
|
|
|
Any logging applied when the macro is invoked is
|
2005-07-26 01:08:09 +02:00
|
|
|
applied following the same rules as for actions.
|
2004-03-20 16:40:06 +01:00
|
|
|
|
2005-08-02 18:46:30 +02:00
|
|
|
SOURCE and
|
2005-07-26 01:08:09 +02:00
|
|
|
DEST If the rule in the macro file specifies a value and
|
|
|
|
the invocation of the rule also specifies a value then
|
|
|
|
the value in the invocation is appended to the value
|
2005-08-02 18:46:30 +02:00
|
|
|
in the rule using ":" as a separator.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
Example:
|
2005-07-09 06:45:32 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
/etc/shorewall/macro.SMTP
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
PARAM - loc tcp 25
|
2005-07-09 06:45:32 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
/etc/shorewall/rules:
|
2005-07-09 06:45:32 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
SMTP/DNAT:info net 192.168.1.5
|
2005-07-09 06:45:32 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
Would be equivalent to the following in the rules file:
|
2005-07-09 06:45:32 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
DNAT:info net loc:192.168.1.5 tcp 25
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
Rest Any value in the invocation replaces the value in the
|
|
|
|
rule in the macro.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
One additional restriction applies to the mixing of macros and
|
|
|
|
actions. Macros that are invoked from actions cannot themselves
|
|
|
|
invoke other actions.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
4) If you have 'make' installed on your firewall, then when you use
|
2005-07-26 01:08:09 +02:00
|
|
|
the '-f' option to 'shorewall start' (as happens when you reboot),
|
|
|
|
if your /etc/shorewall/ directory contains files that were modified
|
|
|
|
after Shorewall was last restarted then Shorewall is started using
|
|
|
|
the config files rather than using the saved configuration.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
5) The 'arp_ignore' option has been added to /etc/shorewall/interfaces
|
2005-07-26 01:08:09 +02:00
|
|
|
entries. This option sets
|
|
|
|
/proc/sys/net/ipv4/conf/<interface>/arp_ignore. By default, the
|
|
|
|
option sets the value to 1. You can also write arp_ignore=<value>
|
|
|
|
where value is one of the following:
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
1 - reply only if the target IP address is local address
|
|
|
|
configured on the incoming interface
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
2 - reply only if the target IP address is local address
|
|
|
|
configured on the incoming interface and both with the sender's
|
|
|
|
IP address are part from same subnet on this interface
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
3 - do not reply for local addresses configured with scope
|
|
|
|
host, only resolutions for global and link addresses are
|
|
|
|
replied
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
4-7 - reserved
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
8 - do not reply for all local addresses
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-07-26 01:08:09 +02:00
|
|
|
WARNING -- DO NOT SPECIFY arp_ignore FOR ANY INTERFACE INVOLVED IN
|
|
|
|
PROXY ARP.
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
6) In /etc/shorewall/rules, "all+" in the SOURCE or DEST column works
|
2005-08-04 22:24:23 +02:00
|
|
|
like "all" but also includes intrazone traffic. So the rule:
|
|
|
|
|
|
|
|
ACCEPT loc all+ tcp 22
|
2005-07-09 07:45:05 +02:00
|
|
|
|
2005-09-30 18:54:24 +02:00
|
|
|
would allow SSH traffic from loc->loc whereas
|
2005-08-04 22:24:23 +02:00
|
|
|
|
|
|
|
ACCEPT loc all tcp 22
|
2005-09-30 18:54:24 +02:00
|
|
|
|
2005-08-04 22:24:23 +02:00
|
|
|
does not.
|
2005-08-11 21:53:07 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
7) A new FASTACCEPT option has been added to shorewall.conf.
|
2005-08-11 21:53:07 +02:00
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
Normally, Shorewall defers accepting ESTABLISHED/RELATED packets
|
|
|
|
until these packets reach the chain in which the original connection
|
|
|
|
was accepted. So for packets going from the 'loc' zone to the 'net'
|
2005-08-11 21:53:07 +02:00
|
|
|
zone, ESTABLISHED/RELATED packets are ACCEPTED in the 'loc2net'
|
|
|
|
chain.
|
|
|
|
|
|
|
|
If you set FASTACCEPT=Yes, then ESTABLISHED/RELEATED packets are
|
|
|
|
accepted early in the INPUT, FORWARD and OUTPUT chains. If you set
|
2005-08-27 00:42:35 +02:00
|
|
|
FASTACCEPT=Yes then you may not include rules in the ESTABLISHED or
|
|
|
|
RELATED sections of /etc/shorewall/rules.
|
2005-08-14 18:45:48 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
8) Shorewall now generates an error if the 'norfc1918' option is
|
2005-08-14 18:45:48 +02:00
|
|
|
specified for an interface with an RFC 1918 address.
|
2005-08-15 19:35:45 +02:00
|
|
|
|
2005-09-09 15:56:05 +02:00
|
|
|
9) You may now specify "!" followed by a list of addresses in the
|
2005-09-30 18:54:24 +02:00
|
|
|
SOURCE and DEST columns of entries in /etc/shorewall/rules,
|
2005-08-17 23:00:33 +02:00
|
|
|
/etc/shorewall/tcrules and in action files and Shorewall will
|
|
|
|
generate the rule that you expect.
|
2005-08-15 19:35:45 +02:00
|
|
|
|
2005-08-17 23:00:33 +02:00
|
|
|
Example 1 (/etc/shorewall/rules):
|
2005-08-15 19:35:45 +02:00
|
|
|
|
|
|
|
#ACTION SOURCE DEST PROTO DEST PORT(S)
|
|
|
|
ACCEPT loc:!192.168.1.0/24,10.0.0.0/8 net tcp 80
|
|
|
|
|
|
|
|
That rule would allow loc->net HTTP access except for the local
|
|
|
|
networks 192.168.1.0/24 and 10.0.0.0/8.
|
2005-08-17 22:35:39 +02:00
|
|
|
|
2005-08-17 23:00:33 +02:00
|
|
|
Example 2 (/etc/shorewall/rules):
|
|
|
|
|
|
|
|
#ACTION SOURCE DEST PROTO DEST PORT(S)
|
|
|
|
ACCEPT loc:10.0.0.0/24!10.0.0.4,10.0.0.22 \
|
|
|
|
net tcp 80
|
|
|
|
|
|
|
|
That rule would allow loc->net HTTP access from the local
|
|
|
|
network 10.0.0.0/24 except for hosts 10.0.0.4 and 10.0.0.22.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
10) Tunnel types "openvpnserver" and "openvpnclient" have been added
|
2005-08-17 22:35:39 +02:00
|
|
|
to reflect the introduction of client and server OpenVPN
|
|
|
|
configurations in OpenVPN 2.0.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
11) The COMMAND variable is now set to 'restore' in restore
|
2005-08-17 22:35:39 +02:00
|
|
|
scripts. The value of this variable is sometimes of interest to
|
|
|
|
programmers providing custom /etc/shorewall/tcstart scripts.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
12) Previously, if you defined any intra-zone rule(s) then any traffic
|
2005-08-27 00:42:35 +02:00
|
|
|
not matching the rule(s) was subject to normal policies (which
|
|
|
|
usually turned out to involve the all->all REJECT policy). Now, the
|
2005-10-15 21:13:33 +02:00
|
|
|
intra-zone ACCEPT policy will still be in effect in the presence of
|
2005-08-27 00:42:35 +02:00
|
|
|
intra-zone rules. That policy can still be overridden by an
|
|
|
|
explicit policy in your /etc/shorewall/policy file.
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
/etc/shorewall/rules:
|
|
|
|
|
|
|
|
DNAT loc:!192.168.1.4 loc:192.168.1.4:3128 tcp 80
|
|
|
|
|
|
|
|
Any other loc->loc traffic will still be accepted. If you want to
|
|
|
|
also log that other loc->loc traffic at the info log level then
|
|
|
|
insert this into /etc/shorewall/policy:
|
|
|
|
|
|
|
|
#SOURCE DEST POLICY LOG LEVEL
|
|
|
|
loc loc ACCEPT info
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
13) Prior to Shorewall 2.5.3, the rules file only controlled packets in
|
2005-08-27 00:42:35 +02:00
|
|
|
the Netfilter states NEW and INVALID. Beginning with this release,
|
|
|
|
the rules file can also deal with packets in the ESTABLISHED and
|
2005-09-30 18:54:24 +02:00
|
|
|
RELATED states.
|
2005-08-27 00:42:35 +02:00
|
|
|
|
|
|
|
The /etc/shorewall/rules file may now be divided into
|
|
|
|
"sections". Each section is introduced by a line that begins with
|
2005-09-09 18:53:01 +02:00
|
|
|
the keyword SECTION followed by the section name. Sections
|
2005-08-27 00:42:35 +02:00
|
|
|
are as listed below and must appear in the order shown.
|
|
|
|
|
|
|
|
ESTABLISHED
|
|
|
|
|
|
|
|
Rules in this section apply to packets in the ESTABLISHED
|
|
|
|
state.
|
|
|
|
|
|
|
|
RELATED
|
|
|
|
|
|
|
|
Rules in this section apply to packets in the RELATED state.
|
|
|
|
|
|
|
|
NEW
|
|
|
|
|
|
|
|
Rules in this section apply to packets in the NEW and INVALID
|
|
|
|
states.
|
|
|
|
|
|
|
|
Rules in the ESTABLISHED and RELATED sections are limited to the
|
|
|
|
following ACTIONs:
|
|
|
|
|
|
|
|
ACCEPT, DROP, REJECT, QUEUE, LOG and User-defined actions.
|
|
|
|
|
|
|
|
Macros may be used in these sections provided that they expand to
|
|
|
|
only these ACTIONs.
|
|
|
|
|
|
|
|
At the end of the ESTABLISHED and RELATED sections, there is an
|
|
|
|
implicit "ALLOW all all all" rule.
|
|
|
|
|
|
|
|
RESTRICTION: If you specify FASTACCEPT=Yes in
|
|
|
|
/etc/shorewall.shorewall.conf then the ESTABLISHED and RELATED
|
|
|
|
sections must be empty.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
14) The value 'ipp2p' is once again allowed in the PROTO column of
|
2005-08-27 00:42:35 +02:00
|
|
|
the rules file. It is recommended that rules specifying 'ipp2p'
|
|
|
|
only be included in the ESTABLISHED section of the file.
|
|
|
|
|
2005-08-17 22:35:39 +02:00
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
15) Shorewall actions lack a generalized way to pass parameters to an
|
2005-08-30 00:51:49 +02:00
|
|
|
extension script associated with an action. To work around this
|
|
|
|
lack, some users have used the log tag as a parameter. This works
|
|
|
|
but requires that a log level other than 'none' be specified when
|
|
|
|
the action is invoked. Beginning with this release, you can invoke
|
|
|
|
an action with 'none'.
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
#ACTION SOURCE DEST
|
2005-09-12 19:52:01 +02:00
|
|
|
A:none:these,are,parameters $FW net
|
2005-08-30 00:51:49 +02:00
|
|
|
|
|
|
|
When /etc/shorewall/A is invoked, the LEVEL variable will be empty
|
|
|
|
but the TAG variable will contain "these,are,parameters" which
|
|
|
|
can be easily parsed to isolate "these", "are" and "parameters":
|
|
|
|
|
|
|
|
ifs=$IFS
|
|
|
|
IFS=,
|
|
|
|
set -- $TAG
|
|
|
|
IFS=$ifs
|
|
|
|
|
|
|
|
Now, $1 = these, $2 = are and $3 = parameters
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
16) The "shorewall check" command now checks the /etc/shorewall/masq,
|
2005-09-30 18:54:24 +02:00
|
|
|
/etc/shorewall/blacklist, /etc/shorewall/proxyarp,
|
2005-09-05 22:07:00 +02:00
|
|
|
/etc/shorewall/nat and /etc/shorewall/providers files.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
17) Arne Bernin's "tc4shorewall" package has been integrated into
|
2005-10-19 00:47:44 +02:00
|
|
|
Shorewall.
|
|
|
|
|
|
|
|
See: http://www.shorewall.net/3.0/traffic_shaping.htm for details.
|
2005-09-05 22:07:00 +02:00
|
|
|
|
|
|
|
Thanks, Arne!
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
18) When /usr/share/shorewall/functions is loaded it now sets
|
2005-09-13 19:13:35 +02:00
|
|
|
|
|
|
|
SHOREWALL_LIBRARY=Loaded
|
|
|
|
|
|
|
|
Application code such as /etc/shorewall/tcstart may test that
|
|
|
|
variable to determine if the library has been loaded into the
|
|
|
|
current shell process.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
19) The install.sh script now does a much cleaner job of backing up the
|
2005-09-30 18:54:24 +02:00
|
|
|
current installation. It copies the directories /etc/shorewall,
|
|
|
|
/usr/share/shorewall and /var/lib/shorewall to a directory of the
|
|
|
|
same name with "-$VERSION.bkout" appended. The init script and
|
|
|
|
/sbin/shorewall are backed up to the /usr/share/shorewall and
|
|
|
|
/var/lib/shorewall directories respectively. This makes it very
|
|
|
|
simple to remove the backups:
|
|
|
|
|
|
|
|
rm -rf /etc/shorewall-*.bkout
|
|
|
|
rm -rf /usr/share/shorewall-*.bkout
|
|
|
|
rm -rf /var/lib/shorewall-*.bkout
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
20) A new '-n' option has been added to the "start", "restart",
|
2005-09-30 18:54:24 +02:00
|
|
|
"restore", "stop" and "try" commands. This option instructs
|
|
|
|
Shorewall to not alter the routing in any way.
|
|
|
|
|
|
|
|
This option is useful when you have a multi-ISP environment because
|
|
|
|
it prevents the route cache from being flushed which preserves the
|
|
|
|
mapping of end-point address pairs to routes.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
21) The output of "shorewall dump" now includes a capabilities report
|
2005-10-06 22:30:27 +02:00
|
|
|
such as the one produced by "shorewall show capabilities".
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
22) The "plain" zone type has been replaced by "ipv4". The types
|
2005-10-06 22:30:27 +02:00
|
|
|
"IPv4" and "IPV4" are synonyms for "ipv4". In addition, "IPSEC",
|
|
|
|
"ipsec4" and "IPSEC4" are recognized synonyms for "ipsec".
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
23) The NEWNOTSYN and LOGNEWNOTSYN options in shorewall.conf have been
|
2005-10-06 22:30:27 +02:00
|
|
|
removed as have the 'newnotsyn' options in /etc/shorewall/interfaces
|
|
|
|
and /etc/shorewall/hosts. See the Migration Considerations for
|
|
|
|
instructions if you wish to block "new-not-syn" TCP packets.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
24) The "shorewall show zones" command now displays the zone type. You
|
2005-10-06 22:30:27 +02:00
|
|
|
must have restarted Shorewall using this release before this feature
|
|
|
|
will work correctly.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
25) The multi-ISP code now requires that that you set MARK_IN_FORWARD_CHAIN=Yes
|
2005-10-06 22:30:27 +02:00
|
|
|
in shorewall.conf. This is done to ensure that "shorewall refresh" will
|
|
|
|
work correctly.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
26) Shorewall now supports UDP IPP2P matching. In addition to the "ipp2p"
|
2005-10-06 22:30:27 +02:00
|
|
|
keyword in the PROTOCOL column of the relevant files, the following
|
|
|
|
values may be specified:
|
|
|
|
|
|
|
|
ipp2p:tcp Equivalent to ipp2p and matches TCP traffic
|
|
|
|
only.
|
|
|
|
ipp2p:udp Matches UDP traffic.
|
|
|
|
ipp2p:all Matches both UDP and TCP traffic. You may
|
|
|
|
not specify a SOURCE PORT with this PROTOCOL.
|
|
|
|
|
2005-10-10 16:57:56 +02:00
|
|
|
27) Normally MAC verification triggered by the 'maclist' interface and host
|
2005-10-08 00:16:03 +02:00
|
|
|
options is done out of the INPUT and FORWARD chains of the filter table.
|
|
|
|
Users have reported that under some circumstances, MAC verification is
|
|
|
|
failing for forwarded packets when the packets are being forwarded out
|
|
|
|
of a bridge.
|
|
|
|
|
|
|
|
To work around this problem, a MACLIST_TABLE option has been added to
|
|
|
|
shorewall.conf. The default value is MACLIST_TABLE=filter which results
|
|
|
|
in the current behavior. If MACLIST_TABLE=mangle then filtering will
|
|
|
|
take place out of the PREROUTING chain of the mangle table. Because
|
|
|
|
the REJECT target may not be used in the PREROUTING chain, the settings
|
|
|
|
MACLIST_DISPOSITION=REJECT and MACLIST_TABLE=mangle are incompatible.
|
|
|
|
|
2005-10-06 22:30:27 +02:00
|
|
|
|