2002-12-28 16:38:03 +01:00
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
content="text/html; charset=windows-1252">
|
2003-07-22 00:06:18 +02:00
|
|
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
2003-10-07 00:38:40 +02:00
|
|
|
<base target="_self">
|
2002-12-28 16:38:03 +01:00
|
|
|
</head>
|
2003-10-07 00:38:40 +02:00
|
|
|
<body>
|
|
|
|
|
<div align="center">
|
|
|
|
|
<center>
|
2002-12-28 16:38:03 +01:00
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
2003-10-07 00:38:40 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="90%">
|
|
|
|
|
<h2>Introduction<br>
|
|
|
|
|
</h2>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a href="http://www.netfilter.org">Netfilter</a> - the
|
|
|
|
|
packet filter facility built into the 2.4 and later Linux kernels.</li>
|
|
|
|
|
<li>ipchains - the packet filter facility built into the 2.2
|
|
|
|
|
Linux kernels. Also the name of the utility program used to configure
|
|
|
|
|
and control that facility. Netfilter can be used in ipchains
|
|
|
|
|
compatibility mode.<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>iptables - the utility program used to configure and
|
2003-10-22 00:22:44 +02:00
|
|
|
control Netfilter. The term 'iptables' is often used to refer to the
|
|
|
|
|
combination of iptables+Netfilter (with Netfilter not in ipchains
|
|
|
|
|
compatibility mode).<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
</li>
|
|
|
|
|
</ul>
|
2003-10-22 00:22:44 +02:00
|
|
|
The Shoreline Firewall, more commonly known as "Shorewall", is
|
2003-10-07 00:38:40 +02:00
|
|
|
high-level tool for configuring Netfilter. You describe your
|
|
|
|
|
firewall/gateway requirements using entries in a set of configuration
|
|
|
|
|
files. Shorewall reads those configuration files and with the help of
|
|
|
|
|
the iptables utility, Shorewall configures Netfilter to match your
|
|
|
|
|
requirements. Shorewall can be used on a dedicated firewall system, a
|
|
|
|
|
multi-function gateway/router/server or on a standalone GNU/Linux
|
|
|
|
|
system. Shorewall does not use Netfilter's ipchains compatibility mode
|
|
|
|
|
and can thus take advantage of Netfilter's connection state tracking
|
|
|
|
|
capabilities.
|
|
|
|
|
<p>This program is free software; you can redistribute it and/or
|
|
|
|
|
modify it under the terms of <a
|
2003-10-22 00:22:44 +02:00
|
|
|
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
|
|
|
|
General Public License</a> as published by the Free Software Foundation.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
|
|
|
|
This program is distributed in the hope that it will be useful, but
|
|
|
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
2003-10-22 00:22:44 +02:00
|
|
|
General
|
|
|
|
|
Public License for more details.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
|
|
|
|
You should have received a copy of the GNU General Public License along
|
|
|
|
|
with this program; if not, write to the Free Software Foundation, Inc.,
|
|
|
|
|
675 Mass Ave, Cambridge, MA 02139, USA</p>
|
|
|
|
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M.
|
|
|
|
|
Eastep</a></p>
|
2003-07-22 00:06:18 +02:00
|
|
|
<h2>This is the Shorewall 1.4 Web Site</h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
The information on this site applies only to 1.4.x releases of
|
|
|
|
|
Shorewall. For older versions:<br>
|
2003-07-22 00:06:18 +02:00
|
|
|
<ul>
|
2003-10-07 00:38:40 +02:00
|
|
|
<li>The 1.3 site is <a href="http://www.shorewall.net/1.3"
|
|
|
|
|
target="_top">here.</a></li>
|
|
|
|
|
<li>The 1.2 site is <a href="http://shorewall.net/1.2/"
|
|
|
|
|
target="_top">here</a>.<br>
|
|
|
|
|
</li>
|
2003-07-22 00:06:18 +02:00
|
|
|
</ul>
|
2003-05-18 20:38:34 +02:00
|
|
|
<h2>Getting Started with Shorewall</h2>
|
2003-10-22 00:22:44 +02:00
|
|
|
New to Shorewall? Start by selecting the <a
|
|
|
|
|
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most
|
|
|
|
|
closely match your environment and follow the step by step instructions.<br>
|
2003-07-22 00:06:18 +02:00
|
|
|
<h2>Looking for Information?</h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
2003-11-17 22:06:32 +01:00
|
|
|
Index</a> is a good place to start as is the Quick Search in the frame
|
|
|
|
|
above.
|
2003-07-22 00:06:18 +02:00
|
|
|
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
If so, the documentation<b> </b>on this site will not apply directly
|
2003-10-22 00:22:44 +02:00
|
|
|
to
|
|
|
|
|
your setup. If you want to use the documentation that you find here,
|
|
|
|
|
you will want to consider uninstalling what you have and installing a
|
|
|
|
|
setup that matches the documentation on this site. See the <a
|
|
|
|
|
href="two-interface.htm">Two-interface QuickStart Guide</a> for
|
2003-10-07 00:38:40 +02:00
|
|
|
details.
|
2003-07-22 00:06:18 +02:00
|
|
|
<h2></h2>
|
2003-04-13 17:28:32 +02:00
|
|
|
<h2><b>News</b></h2>
|
2003-11-17 22:06:32 +01:00
|
|
|
<p><b>11/01/2003 - Shorewall 1.4.8 RC2</b><b> <img
|
2003-10-22 00:22:44 +02:00
|
|
|
style="border: 0px solid ; width: 28px; height: 12px;"
|
2003-11-17 22:06:32 +01:00
|
|
|
src="file:///vfat/Shorewall-docs/images/new10.gif" alt="(New)" title=""></b><b>
|
|
|
|
|
</b></p>
|
|
|
|
|
Given the small number of new features and the relatively few lines of
|
|
|
|
|
code that were changed, there will be no Beta for 1.4.8.<br>
|
|
|
|
|
<p><b><a href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
|
|
|
|
|
<a href="ftp://shorewall.net/pub/shorewall/Beta" target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
|
|
|
|
|
<br>
|
|
|
|
|
</b>Problems Corrected since version 1.4.7:<br>
|
2003-10-22 00:22:44 +02:00
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Tuomo Soini has supplied a correction to a problem that
|
|
|
|
|
occurs
|
|
|
|
|
using some versions of 'ash'. The symptom is that "shorewall start"
|
|
|
|
|
fails with:<br>
|
|
|
|
|
<br>
|
|
|
|
|
local: --limit: bad variable name<br>
|
|
|
|
|
iptables v1.2.8: Couldn't load match
|
|
|
|
|
`-j':/lib/iptables/libipt_-j.so:<br>
|
|
|
|
|
cannot open shared object file: No such file or directory<br>
|
|
|
|
|
Try `iptables -h' or 'iptables --help' for more
|
2003-11-17 22:06:32 +01:00
|
|
|
information.</li>
|
2003-10-22 00:22:44 +02:00
|
|
|
<li>Andres Zhoglo has supplied a correction that avoids trying
|
|
|
|
|
to use the multiport match iptables facility on ICMP rules.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example of rule that previously caused "shorewall start"
|
|
|
|
|
to fail:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
ACCEPT loc $FW
|
|
|
|
|
icmp 0,8,11,12<br>
|
|
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Previously, if the following error message was issued,
|
|
|
|
|
Shorewall was left in an inconsistent state.<br>
|
|
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
Error: Unable to determine the routes through interface xxx<br>
|
2003-10-22 00:22:44 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Handling of the LOGUNCLEAN option in shorewall.conf has
|
|
|
|
|
been corrected.</li>
|
|
|
|
|
<li>In Shorewall 1.4.2, an optimization was added. This
|
|
|
|
|
optimization
|
|
|
|
|
involved creating a chain named "<zone>_frwd" for most zones
|
|
|
|
|
defined using the /etc/shorewall/hosts file. It has since been
|
|
|
|
|
discovered that in many cases these new chains contain redundant rules
|
|
|
|
|
and that the "optimization" turns out to be less than optimal. The
|
|
|
|
|
implementation has now been corrected.</li>
|
|
|
|
|
<li>When the MARK value in a tcrules entry is followed by ":F"
|
|
|
|
|
or
|
|
|
|
|
":P", the ":F" or ":P" was previously only applied to the first
|
|
|
|
|
Netfilter rule generated by the entry. It is now applied to all entries.</li>
|
2003-11-17 22:06:32 +01:00
|
|
|
<li>An incorrect comment concerning Debian's use of the
|
|
|
|
|
SYBSYSLOCK option has been removed from shorewall.conf.</li>
|
|
|
|
|
<li>Previously, neither the 'routefilter' interface option nor
|
|
|
|
|
the
|
|
|
|
|
ROUTE_FILTER parameter were working properly. This has been corrected
|
|
|
|
|
(thanks to Eric Bowles for his analysis and patch). The definition of
|
|
|
|
|
the ROUTE_FILTER option has changed however. Previously,
|
|
|
|
|
ROUTE_FILTER=Yes was documented as enabling route filtering on all
|
|
|
|
|
interfaces (which didn't work). Beginning with this release, setting
|
|
|
|
|
ROUTE_FILTER=Yes will enable route filtering of all interfaces brought
|
|
|
|
|
up while Shorewall is started. As a consequence, ROUTE_FILTER=Yes can
|
|
|
|
|
coexist with the use of the 'routefilter' option in the interfaces file.</li>
|
|
|
|
|
<li>If MAC verification was enabled on an interface with a /32
|
|
|
|
|
address and
|
|
|
|
|
a broadcast address then an error would occur during startup.</li>
|
2003-10-22 00:22:44 +02:00
|
|
|
</ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
Migration Issues:<br>
|
2003-06-23 22:24:51 +02:00
|
|
|
<ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
<li>The definition of the ROUTE_FILTER option in shorewall.conf
|
|
|
|
|
has changed as described in item 8) above.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
</li>
|
2003-11-17 22:06:32 +01:00
|
|
|
</ol>
|
|
|
|
|
New Features:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>A new QUEUE action has been introduced for rules. QUEUE
|
|
|
|
|
allows
|
|
|
|
|
you to pass connection requests to a user-space filter such as ftwall
|
|
|
|
|
(http://p2pwall.sourceforge.net). The ftwall program
|
|
|
|
|
allows for effective filtering of p2p applications such as Kazaa. For
|
|
|
|
|
example, to use ftwall to filter P2P clients in the 'loc' zone, you
|
|
|
|
|
would add the following rules:<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
QUEUE loc
|
|
|
|
|
net tcp<br>
|
|
|
|
|
QUEUE loc
|
|
|
|
|
net udp<br>
|
|
|
|
|
QUEUE loc
|
|
|
|
|
fw udp<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
You would normally want to place those three rules BEFORE any ACCEPT
|
|
|
|
|
rules for loc->net udp or tcp.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Note: When the protocol specified is TCP ("tcp", "TCP" or "6"),
|
|
|
|
|
Shorewall will only pass connection requests (SYN packets) to user
|
|
|
|
|
space. This is for compatibility with ftwall.</li>
|
|
|
|
|
<li>A
|
|
|
|
|
BLACKLISTNEWNONLY option has been added to shorewall.conf. When this
|
|
|
|
|
option is set to "Yes", the blacklists (dynamic and static) are only
|
|
|
|
|
consulted for new connection requests. When set to "No" (the default if
|
|
|
|
|
the variable is not set), the blacklists are consulted on every packet.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
Setting this option to "No" allows blacklisting to stop existing
|
|
|
|
|
connections from a newly blacklisted host but is more expensive in
|
|
|
|
|
terms of packet processing time. This is especially true if the
|
|
|
|
|
blacklists contain a large number of entries.</li>
|
|
|
|
|
<li>Chain names used in the /etc/shorewall/accounting file may
|
|
|
|
|
now begin with a digit ([0-9]) and may contain embedded dashes ("-").</li>
|
2003-06-23 22:24:51 +02:00
|
|
|
</ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
<p><b>10/26/2003 - Shorewall 1.4.7a and 1.4.7b win brown paper
|
|
|
|
|
bag awards </b><b><img
|
|
|
|
|
style="border: 0px solid ; width: 50px; height: 80px;"
|
|
|
|
|
src="images/j0233056.gif" align="middle" title="" alt="">Shorewall
|
|
|
|
|
1.4.7c released.</b> </p>
|
2003-06-23 22:24:51 +02:00
|
|
|
<ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
<li>The saga with "<zone>_frwd" chains continues. The
|
|
|
|
|
1.4.7c script
|
|
|
|
|
produces a ruleset that should work for everyone even if it is not
|
|
|
|
|
quite optimal. My apologies for this ongoing mess.</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b>10/24/2003 - Shorewall 1.4.7b</b><b> <img
|
|
|
|
|
style="border: 0px solid ; width: 28px; height: 12px;"
|
|
|
|
|
src="images/new10.gif" alt="(New)" title=""></b></p>
|
|
|
|
|
<p>This is a bugfx rollup of the 1.4.7a fixes plus:<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>The fix for problem 5 in 1.4.7a was wrong with the result
|
|
|
|
|
that
|
|
|
|
|
"<zone>_frwd" chains might contain too few rules. That wrong code
|
|
|
|
|
is corrected in this release.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
</li>
|
2003-06-23 22:24:51 +02:00
|
|
|
</ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
<p><b>10/21/2003 - Shorewall 1.4.7a</b></p>
|
|
|
|
|
<p>This is a bugfix rollup of the following problem corrections:<br>
|
|
|
|
|
</p>
|
2003-05-21 01:21:38 +02:00
|
|
|
<ol>
|
2003-11-17 22:06:32 +01:00
|
|
|
<li>Tuomo Soini has supplied a correction to a problem that
|
|
|
|
|
occurs
|
|
|
|
|
using some versions of 'ash'. The symptom is that "shorewall start"
|
|
|
|
|
fails with:<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
local: --limit: bad variable name<br>
|
|
|
|
|
iptables v1.2.8: Couldn't load match
|
|
|
|
|
`-j':/lib/iptables/libipt_-j.so:<br>
|
|
|
|
|
cannot open shared object file: No such file or directory<br>
|
|
|
|
|
Try `iptables -h' or 'iptables --help' for more
|
|
|
|
|
information.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
</li>
|
|
|
|
|
<li>Andres Zhoglo has supplied a correction that avoids trying
|
|
|
|
|
to use the multiport match iptables facility on ICMP rules.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
Example of rule that previously caused "shorewall start"
|
|
|
|
|
to fail:<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
|
|
|
|
|
ACCEPT loc $FW
|
|
|
|
|
icmp 0,8,11,12<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
</li>
|
|
|
|
|
<li>Previously, if the following error message was issued,
|
|
|
|
|
Shorewall was left in an inconsistent state.<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
2003-11-17 22:06:32 +01:00
|
|
|
Error: Unable to determine the routes through
|
|
|
|
|
interface xxx<br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
2003-11-17 22:06:32 +01:00
|
|
|
<li>Handling of the LOGUNCLEAN option in shorewall.conf has
|
|
|
|
|
been corrected.</li>
|
|
|
|
|
<li>In Shorewall 1.4.2, an optimization was added. This
|
|
|
|
|
optimization
|
|
|
|
|
involved creating a chain named "<zone>_frwd" for most zones
|
|
|
|
|
defined using the /etc/shorewall/hosts file. It has since been
|
|
|
|
|
discovered that in many cases these new chains contain redundant rules
|
|
|
|
|
and that the "optimization" turns out to be less than optimal. The
|
|
|
|
|
implementation has now been corrected.</li>
|
|
|
|
|
<li>When the MARK value in a tcrules entry is followed by ":F"
|
|
|
|
|
or
|
|
|
|
|
":P", the ":F" or ":P" was previously only applied to the first
|
|
|
|
|
Netfilter rule generated by the entry. It is now applied to all entries.</li>
|
2003-07-22 00:06:18 +02:00
|
|
|
</ol>
|
2003-04-13 17:28:32 +02:00
|
|
|
<p><b><a href="News.htm">More News</a></b></p>
|
2003-10-07 00:38:40 +02:00
|
|
|
<b> </b>
|
2003-04-13 17:28:32 +02:00
|
|
|
<h2><b> </b></h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
<b> </b>
|
2003-05-18 20:38:34 +02:00
|
|
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
|
|
|
border="0" src="images/leaflogo.gif" width="49" height="36"
|
2003-10-07 00:38:40 +02:00
|
|
|
alt="(Leaf Logo)"> </a>Jacques Nilo and Eric Wolzak have a LEAF
|
|
|
|
|
(router/firewall/gateway on a floppy, CD or compact flash) distribution
|
|
|
|
|
called <i>Bering</i> that features Shorewall-1.4.2 and Kernel-2.4.20.
|
|
|
|
|
You can find their work at: <a
|
|
|
|
|
href="http://leaf.sourceforge.net/devel/jnilo">
|
|
|
|
|
http://leaf.sourceforge.net/devel/jnilo</a></p>
|
|
|
|
|
<b>Congratulations to Jacques and Eric on the recent release of
|
|
|
|
|
Bering 1.2!!! </b><br>
|
2003-04-13 17:28:32 +02:00
|
|
|
<h1 align="center"><b><a href="http://www.sf.net"><img
|
|
|
|
|
align="left" alt="SourceForge Logo"
|
2003-10-07 00:38:40 +02:00
|
|
|
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3"> </a></b></h1>
|
|
|
|
|
<b> </b>
|
|
|
|
|
<h4><b> </b></h4>
|
|
|
|
|
<b> </b>
|
2003-04-13 17:28:32 +02:00
|
|
|
<h2><b>This site is hosted by the generous folks at <a
|
2003-10-07 00:38:40 +02:00
|
|
|
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
|
|
|
|
<b> </b>
|
2003-04-13 17:28:32 +02:00
|
|
|
<h2><b><a name="Donations"></a>Donations</b></h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
<b> </b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
2002-12-28 16:38:03 +01:00
|
|
|
</table>
|
2003-10-07 00:38:40 +02:00
|
|
|
</center>
|
|
|
|
|
</div>
|
2002-12-28 16:38:03 +01:00
|
|
|
<table border="0" cellpadding="5" cellspacing="0"
|
2003-11-17 22:06:32 +01:00
|
|
|
style="border-collapse: collapse; width: 100%; background-color: rgb(51, 102, 255);"
|
|
|
|
|
id="AutoNumber2">
|
2003-10-07 00:38:40 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
2003-11-17 22:06:32 +01:00
|
|
|
<td style="width: 100%; margin-top: 1px;">
|
2003-10-07 00:38:40 +02:00
|
|
|
<p align="center"><a href="http://www.starlight.org"> <img
|
2002-12-28 16:38:03 +01:00
|
|
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
2003-10-07 00:38:40 +02:00
|
|
|
hspace="10"> </a></p>
|
2003-06-23 22:24:51 +02:00
|
|
|
<p align="center"><font size="4" color="#ffffff"><br>
|
2003-10-07 00:38:40 +02:00
|
|
|
<font size="+2">Shorewall is free but if you try it and find it
|
|
|
|
|
useful, please consider making a donation to <a
|
|
|
|
|
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
|
|
|
|
Children's Foundation.</font></a> Thanks!</font></font></p>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
2003-01-14 21:32:45 +01:00
|
|
|
</table>
|
2003-11-17 22:06:32 +01:00
|
|
|
<p><font size="2">Updated 11/01/2003 - <a href="support.htm">Tom Eastep</a></font>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
|
|
|
|
</p>
|
2002-12-28 16:38:03 +01:00
|
|
|
</body>
|
|
|
|
|
</html>
|
