2002-11-09 22:34:47 +01:00
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2002-11-09 22:34:47 +01:00
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
|
content="text/html; charset=windows-1252">
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<base target="_self">
|
2002-11-09 22:34:47 +01:00
|
|
|
|
</head>
|
|
|
|
|
|
<body>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2002-11-09 22:34:47 +01:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="4"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
bgcolor="#3366ff">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tbody>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tr>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<td width="33%" height="90"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
valign="middle" align="left"><a href="http://www.cityofshoreline.com"><img
|
2003-06-18 22:03:19 +02:00
|
|
|
|
src="images/washington.jpg" alt="" width="97" height="80" hspace="4"
|
|
|
|
|
|
border="0">
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</a></td>
|
|
|
|
|
|
<td valign="middle"
|
|
|
|
|
|
bgcolor="#3366ff" width="34%" align="center">
|
|
|
|
|
|
<img
|
|
|
|
|
|
src="images/Logo1.png" alt="(Shorewall Logo)" width="430" height="90">
|
|
|
|
|
|
</td>
|
|
|
|
|
|
<td valign="top" width="33"><br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-11-09 22:34:47 +01:00
|
|
|
|
</table>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<div align="center">
|
|
|
|
|
|
<center>
|
2002-11-09 22:34:47 +01:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tbody>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tr>
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<td width="90%">
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<h2 align="left">What is it?</h2>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
|
|
|
|
|
a <a
|
|
|
|
|
|
href="http://www.netfilter.org">Netfilter</a> (iptables)
|
|
|
|
|
|
based firewall that can be used on a dedicated
|
|
|
|
|
|
firewall system, a multi-function gateway/router/server
|
|
|
|
|
|
or on a standalone GNU/Linux system.</p>
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<p>This program is free software; you can redistribute it and/or modify
|
|
|
|
|
|
|
|
|
|
|
|
it under the terms of <a
|
|
|
|
|
|
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
|
|
|
|
|
GNU General Public License</a> as published by the Free Software
|
|
|
|
|
|
Foundation.<br>
|
|
|
|
|
|
|
|
|
|
|
|
<br>
|
2003-05-20 01:38:24 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
This program is distributed
|
|
|
|
|
|
in the hope that it will be useful,
|
|
|
|
|
|
but WITHOUT ANY WARRANTY; without
|
|
|
|
|
|
even the implied warranty of MERCHANTABILITY
|
|
|
|
|
|
or FITNESS FOR A PARTICULAR PURPOSE.
|
|
|
|
|
|
See the GNU General Public License for more details.<br>
|
2003-05-20 01:38:24 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<br>
|
2003-05-20 01:38:24 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
You should have received a
|
|
|
|
|
|
copy of the GNU General Public License
|
|
|
|
|
|
along with this program; if not,
|
|
|
|
|
|
write to the Free Software Foundation,
|
|
|
|
|
|
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
|
|
|
|
|
USA</p>
|
2003-05-20 01:38:24 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-07-15 00:09:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-01-14 18:18:42 +01:00
|
|
|
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<h2>This is the Shorewall 1.4 Web Site</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
The information on this site applies only to 1.4.x releases of Shorewall.
|
|
|
|
|
|
For older versions:<br>
|
|
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The 1.3 site is <a href="http://www.shorewall.net/1.3"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
target="_top">here.</a></li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The 1.2 site is <a href="http://shorewall.net/1.2/"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
target="_top">here</a>.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-15 00:09:33 +02:00
|
|
|
|
<h2>Getting Started with Shorewall</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
New to Shorewall? Start by selecting
|
|
|
|
|
|
the <a
|
|
|
|
|
|
href="file:///vfat/Shorewall-docs/shorewall_quickstart_guide.htm">QuickStart
|
|
|
|
|
|
Guide</a> that most closely match your environment and
|
|
|
|
|
|
follow the step by step instructions.<br>
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
<h2>Looking for Information?</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
|
|
|
|
|
Index</a> is a good place to start as is the Quick Search to your right.
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
If so, the documentation<b> </b>on this site
|
|
|
|
|
|
will not apply directly to your setup. If you want to use the documentation
|
|
|
|
|
|
that you find here, you will want to consider uninstalling what you
|
|
|
|
|
|
have and installing a setup that matches the documentation on
|
|
|
|
|
|
this site. See the <a href="two-interface.htm">Two-interface QuickStart
|
|
|
|
|
|
Guide</a> for details.
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
<h2></h2>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h2><b>News</b></h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>7/20/2003 - Shorewall-1.4.6</b><b> <img border="0"
|
2003-07-07 16:18:52 +02:00
|
|
|
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
</b> </p>
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p><b>Problems Corrected:</b><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
<ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>A problem seen on RH7.3 systems where Shorewall encountered
|
|
|
|
|
|
start errors when started using the "service" mechanism has been worked
|
|
|
|
|
|
around.<br>
|
2003-07-15 00:09:33 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>Where a list of IP addresses appears in the DEST column of
|
|
|
|
|
|
a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the
|
|
|
|
|
|
nat table (one for each element in the list). Shorewall now correctly creates
|
2003-07-16 20:59:33 +02:00
|
|
|
|
a single DNAT rule with multiple "--to-destination" clauses.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>Corrected a problem in Beta 1 where DNS names containing a
|
|
|
|
|
|
"-" were mis-handled when they appeared in the DEST column of a rule.<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>A number of problems with rule parsing have been corrected.
|
|
|
|
|
|
Corrections involve the handling of "z1!z2" in the SOURCE column as well
|
|
|
|
|
|
as lists in the ORIGINAL DESTINATION column.<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The message "Adding rules for DHCP" is now suppressed if there
|
|
|
|
|
|
are no DHCP rules to add.</li>
|
|
|
|
|
|
</ol>
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>Migration Issues:</b><br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<ol>
|
|
|
|
|
|
<li>In earlier versions, an undocumented feature allowed entries
|
|
|
|
|
|
in the host file as follows:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20> <20> z<><7A><EFBFBD> eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
This capability was never documented and has been removed in 1.4.6
|
|
|
|
|
|
to allow entries of the following format:<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<20> <20> z<><7A> eth1:192.168.1.0/24,192.168.2.0/24<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options
|
|
|
|
|
|
have been removed from /etc/shorewall/shorewall.conf. These capabilities
|
|
|
|
|
|
are now automatically detected by Shorewall (see below).<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</li>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
</ol>
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>New Features:</b><br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<ol>
|
|
|
|
|
|
<li>A 'newnotsyn' interface option has been added. This option
|
|
|
|
|
|
may be specified in /etc/shorewall/interfaces and overrides the setting
|
|
|
|
|
|
NEWNOTSYN=No for packets arriving on the associated interface.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>The means for specifying a range of IP addresses in /etc/shorewall/masq
|
|
|
|
|
|
to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for
|
|
|
|
|
|
address ranges.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>Shorewall can now add IP addresses to subnets other than
|
|
|
|
|
|
the first one on an interface.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>DNAT[-] rules may now be used to load balance (round-robin)
|
|
|
|
|
|
over a set of servers. Servers may be specified in a range of addresses
|
|
|
|
|
|
given as <first address>-<last address>.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Example:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20> <20> DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
|
|
|
|
|
|
options have been removed and have been replaced by code that detects
|
|
|
|
|
|
whether these capabilities are present in the current kernel. The output
|
|
|
|
|
|
of the start, restart and check commands have been enhanced to report the
|
|
|
|
|
|
outcome:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
|
|
|
|
|
<20> <20>NAT: Available<br>
|
|
|
|
|
|
<20> <20>Packet Mangling: Available<br>
|
|
|
|
|
|
<20> <20>Multi-port Match: Available<br>
|
|
|
|
|
|
Verifying Configuration...<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>Support for the Connection Tracking Match Extension has
|
|
|
|
|
|
been added. This extension is available in recent kernel/iptables releases
|
|
|
|
|
|
and allows for rules which match against elements in netfilter's connection
|
|
|
|
|
|
tracking table. Shorewall automatically detects the availability of this
|
|
|
|
|
|
extension and reports its availability in the output of the start, restart
|
|
|
|
|
|
and check commands.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
|
|
|
|
|
<20> <20>NAT: Available<br>
|
|
|
|
|
|
<20> <20>Packet Mangling: Available<br>
|
|
|
|
|
|
<20> <20>Multi-port Match: Available<br>
|
|
|
|
|
|
<20> <20>Connection Tracking Match: Available<br>
|
|
|
|
|
|
Verifying Configuration...<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
If this extension is available, the ruleset generated by Shorewall
|
|
|
|
|
|
is changed in the following ways:</li>
|
|
|
|
|
|
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li>To handle 'norfc1918' filtering, Shorewall will not
|
|
|
|
|
|
create chains in the mangle table but will rather do all 'norfc1918'
|
|
|
|
|
|
filtering in the filter table (rfc1918 chain).</li>
|
|
|
|
|
|
<li>Recall that Shorewall DNAT rules generate two netfilter
|
|
|
|
|
|
rules; one in the nat table and one in the filter table. If the Connection
|
|
|
|
|
|
Tracking Match Extension is available, the rule in the filter table is
|
|
|
|
|
|
extended to check that the original destination address was the same as
|
|
|
|
|
|
specified (or defaulted to) in the DNAT rule.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall)
|
|
|
|
|
|
may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> ipcalc [ <address> <netmask> | <address>/<vlsm>
|
|
|
|
|
|
]<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Examples:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> CIDR=192.168.1.0/24<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> NETMASK=255.255.255.0<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> NETWORK=192.168.1.0<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> BROADCAST=192.168.1.255<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@wookie root]#<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> CIDR=192.168.1.0/24<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> NETMASK=255.255.255.0<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> NETWORK=192.168.1.0<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> BROADCAST=192.168.1.255<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@wookie root]#<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Warning:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
If your shell only supports 32-bit signed arithmatic (ash or dash),
|
|
|
|
|
|
then the ipcalc command produces incorrect information for IP addresses
|
|
|
|
|
|
128.0.0.0-1 and for /1 networks. Bash should produce correct information
|
|
|
|
|
|
for all valid IP addresses.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>An 'iprange' command has been added to /sbin/shorewall.
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> iprange <address>-<address><br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
This command decomposes a range of IP addressses into a list of network
|
|
|
|
|
|
and host addresses. The command can be useful if you need to construct
|
|
|
|
|
|
an efficient set of rules that accept connections from a range of network
|
2003-07-16 20:59:33 +02:00
|
|
|
|
addresses.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
Note: If your shell only supports 32-bit signed arithmetic (ash or
|
|
|
|
|
|
dash) then the range may not span 128.0.0.0.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Example:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.4/30<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.8/29<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.16/28<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.32/27<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.64/26<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.1.128/25<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.2.0/23<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.4.0/22<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.8.0/22<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.12.0/29<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> 192.168.12.8/31<br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD> [root@gateway root]#<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>A list of host/net addresses is now allowed in an entry
|
|
|
|
|
|
in /etc/shorewall/hosts.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Example:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<20><><EFBFBD> foo<6F><6F><EFBFBD> eth1:192.168.1.0/24,192.168.2.0/24<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li value="11">The "shorewall check" command now includes the chain
|
|
|
|
|
|
name when printing the applicable policy for each pair of zones.<br>
|
|
|
|
|
|
<20><br>
|
|
|
|
|
|
<20><><EFBFBD> Example:<br>
|
|
|
|
|
|
<20><br>
|
|
|
|
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> Policy for dmz to net is REJECT using chain all2all<br>
|
|
|
|
|
|
<20><br>
|
|
|
|
|
|
This means that the policy for connections from the dmz to the internet
|
|
|
|
|
|
is REJECT and the applicable entry in the /etc/shorewall/policy was the all->all
|
|
|
|
|
|
policy.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>Support for the 2.6 Kernel series has been added.<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
</ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
|
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
<ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
</ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>7/15/2003 - New Mirror in Brazil</b><b> <img border="0"
|
|
|
|
|
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</b></p>
|
|
|
|
|
|
Thanks to the folks at securityopensource.org.br, there is now a <a
|
|
|
|
|
|
href="http://shorewall.securityopensource.org.br" target="_top">Shorewall
|
|
|
|
|
|
mirror in Brazil</a>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p><b>6/17/2003 - Shorewall-1.4.5</b><b> </b></p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p>Problems Corrected:<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
<ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The command "shorewall debug try <directory>"
|
|
|
|
|
|
now correctly traces the attempt.</li>
|
|
|
|
|
|
<li>The INCLUDE directive now works properly in the
|
|
|
|
|
|
zones file; previously, INCLUDE in that file was ignored.</li>
|
|
|
|
|
|
<li>/etc/shorewall/routestopped records with an empty
|
|
|
|
|
|
second column are no longer ignored.<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
</ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p>New Features:<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
<ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-]
|
|
|
|
|
|
rule may now contain a list of addresses. If the list begins with "!'
|
|
|
|
|
|
then the rule will take effect only if the original destination address
|
|
|
|
|
|
in the connection request does not match any of the addresses listed.</li>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
</ol>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b>
|
|
|
|
|
|
</b></p>
|
|
|
|
|
|
The firewall at shorewall.net has been upgraded to the 2.4.21
|
|
|
|
|
|
kernel and iptables 1.2.8 (using the "official" RPM from netfilter.org).
|
|
|
|
|
|
No problems have been encountered with this set of software. The Shorewall
|
|
|
|
|
|
version is 1.4.4b plus the accumulated changes for 1.4.5.
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p><b>6/8/2003 - Updated Samples</b><b> </b></p>
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
|
|
|
|
|
|
version 1.4.4.</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p><b></b></p>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
<ol>
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
</ol>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
<p><b></b></p>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
<p><b></b></p>
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<ol>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
</ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</blockquote>
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<p><b><a href="News.htm">More News</a></b></p>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h2><b> </b></h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
|
|
|
|
border="0" src="images/leaflogo.gif" width="49" height="36"
|
|
|
|
|
|
alt="(Leaf Logo)">
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</a>Jacques Nilo and Eric
|
|
|
|
|
|
Wolzak have a LEAF (router/firewall/gateway
|
|
|
|
|
|
on a floppy, CD or compact flash) distribution
|
|
|
|
|
|
called <i>Bering</i> that
|
|
|
|
|
|
features Shorewall-1.4.2 and Kernel-2.4.20.
|
|
|
|
|
|
You can find their work at:
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<a href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b>Congratulations to Jacques
|
|
|
|
|
|
and Eric on the recent release of Bering
|
2003-07-16 20:59:33 +02:00
|
|
|
|
1.2!!! </b><br>
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-07 16:18:52 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h1 align="center"><b><a href="http://www.sf.net"><img
|
|
|
|
|
|
align="left" alt="SourceForge Logo"
|
2002-12-28 16:38:03 +01:00
|
|
|
|
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</a></b></h1>
|
|
|
|
|
|
<b> </b>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h4><b> </b></h4>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h2><b>This site is hosted by the generous folks at <a
|
|
|
|
|
|
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b> </b>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<h2><b><a name="Donations"></a>Donations</b></h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<b>
|
|
|
|
|
|
</b></td>
|
2003-07-15 00:09:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<td width="88" bgcolor="#3366ff"
|
|
|
|
|
|
valign="top" align="center">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<form method="post"
|
2003-07-19 17:07:31 +02:00
|
|
|
|
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p><strong><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<font color="#ffffff"><b>Note:
|
|
|
|
|
|
</b></font></strong> <font
|
|
|
|
|
|
color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
|
|
|
|
|
<20></p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<font face="Arial" size="-1">
|
|
|
|
|
|
<input type="text" name="words" size="15"></font><font
|
2003-07-07 16:18:52 +02:00
|
|
|
|
size="-1"> </font><font face="Arial" size="-1"> <input
|
|
|
|
|
|
type="hidden" name="format" value="long"> <input
|
|
|
|
|
|
type="hidden" name="method" value="and"> <input type="hidden"
|
|
|
|
|
|
name="config" value="htdig"> <input type="submit"
|
|
|
|
|
|
value="Search"></font> </p>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<font face="Arial"> <input
|
2003-05-28 21:20:23 +02:00
|
|
|
|
type="hidden" name="exclude"
|
2003-07-19 17:07:31 +02:00
|
|
|
|
value="[http://lists.shorewall.net/pipermail/*]"> </font>
|
|
|
|
|
|
</form>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p><font color="#ffffff"><b> <a
|
|
|
|
|
|
href="http://lists.shorewall.net/htdig/search.html"> <font
|
|
|
|
|
|
color="#ffffff">Extended Search</font></a></b></font></p>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<a target="_top"
|
|
|
|
|
|
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
|
|
|
|
|
</font></a><a target="_top"
|
2003-05-15 21:39:23 +02:00
|
|
|
|
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</td>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</tr>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-12-28 16:38:03 +01:00
|
|
|
|
</table>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</center>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</div>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<table border="0" cellpadding="5" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
2003-07-16 20:59:33 +02:00
|
|
|
|
bgcolor="#3366ff">
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tbody>
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<tr>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<td width="100%" style="margin-top: 1px;">
|
|
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-07-15 00:09:33 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<p align="center"><a href="http://www.starlight.org"> <img
|
|
|
|
|
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
|
|
|
|
|
hspace="10">
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</a></p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
|
2003-06-18 22:03:19 +02:00
|
|
|
|
<p align="center"><font size="4" color="#ffffff"><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
<font size="+2">Shorewall is free but if you
|
|
|
|
|
|
try it and find it useful, please consider making a donation
|
|
|
|
|
|
to
|
|
|
|
|
|
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
|
|
|
|
|
Children's Foundation.</font></a> Thanks!</font></font></p>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</td>
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
</tr>
|
2003-05-18 20:27:36 +02:00
|
|
|
|
|
2003-05-28 21:20:23 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-14 18:18:42 +01:00
|
|
|
|
</table>
|
2003-07-04 18:41:22 +02:00
|
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
|
|
<p><font size="2">Updated 7/19/2003 - <a href="support.htm">Tom Eastep</a></font>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</p>
|
2002-11-09 22:34:47 +01:00
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
