2002-08-13 22:45:21 +02:00
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
|
content="text/html; charset=windows-1252">
|
2003-02-20 00:21:55 +01:00
|
|
|
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
<base target="_self">
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</head>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<body>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="4"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
|
|
|
|
|
bgcolor="#4b017c">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
|
|
|
|
|
|
<td width="100%" height="90">
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<h1 align="center"> <font size="4"><i> <a
|
2002-09-29 23:42:38 +02:00
|
|
|
|
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
|
|
|
|
|
alt="Shorwall Logo" height="70" width="85" align="left"
|
|
|
|
|
|
src="images/washington.jpg" border="0">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</a></i></font><a
|
2003-03-18 02:13:38 +01:00
|
|
|
|
href="http://www.shorewall.net" target="_top"><img border="1"
|
|
|
|
|
|
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
|
|
|
|
|
alt="(Shorewall Logo)" align="right" vspace="4">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</a></h1>
|
|
|
|
|
|
<small><small><small><small><a
|
2003-03-23 19:47:54 +01:00
|
|
|
|
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div align="center">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
2003-04-13 17:28:32 +02:00
|
|
|
|
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
|
|
|
|
|
href="1.3" target="_top"><font color="#ffffff"><br>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</font></a><br>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</h1>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
|
|
|
|
|
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</table>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
<div align="center">
|
|
|
|
|
|
<center>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
|
|
|
|
|
|
<td width="90%">
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<h2 align="left">What is it?</h2>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-03-18 02:13:38 +01:00
|
|
|
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
|
|
|
|
|
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
|
|
|
|
|
firewall that can be used on a dedicated firewall system, a multi-function
|
|
|
|
|
|
gateway/router/server or on a standalone GNU/Linux system.</p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-03-18 02:13:38 +01:00
|
|
|
|
<p>This program is free software; you can redistribute it and/or modify
|
2003-05-15 21:39:23 +02:00
|
|
|
|
it
|
|
|
|
|
|
under the terms of <a
|
2003-04-13 17:28:32 +02:00
|
|
|
|
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
|
|
|
|
|
GNU General Public License</a> as published by the Free Software
|
|
|
|
|
|
Foundation.<br>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<br>
|
|
|
|
|
|
This
|
|
|
|
|
|
program is distributed in the hope that
|
|
|
|
|
|
it will be useful, but WITHOUT ANY WARRANTY;
|
|
|
|
|
|
without even the implied warranty of MERCHANTABILITY
|
|
|
|
|
|
or FITNESS FOR A PARTICULAR PURPOSE. See
|
|
|
|
|
|
the GNU General Public License for more details.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
You
|
|
|
|
|
|
should have received a copy of the GNU General
|
|
|
|
|
|
Public License along with this program;
|
|
|
|
|
|
if not, write to the Free Software Foundation,
|
|
|
|
|
|
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
|
|
|
|
|
USA</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-03-18 02:13:38 +01:00
|
|
|
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2><br>
|
|
|
|
|
|
Getting Started with Shorewall</h2>
|
|
|
|
|
|
New to Shorewall? Start by selecting the <a
|
|
|
|
|
|
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
|
|
|
|
|
match your environment and follow the step by step instructions.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<h2>News</h2>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>5/10/2003 - Shorewall Mirror in Asia </b><b><img border="0"
|
|
|
|
|
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
|
|
|
|
|
</b><br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>5/8/2003 - Shorewall Mirror in Chile </b><b><img border="0"
|
|
|
|
|
|
src="images/new10.gif" width="28" height="12" alt="(New)">
|
|
|
|
|
|
<20></b></p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>4/26/2003 - lists.shorewall.net Downtime </b><b><img
|
2003-01-31 22:50:51 +01:00
|
|
|
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</b></p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
|
|
|
|
|
</b><b><img border="0" src="images/new10.gif" width="28"
|
|
|
|
|
|
height="12" alt="(New)">
|
|
|
|
|
|
</b></p>
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
|
|
|
|
|
to Shorewall version 1.4.2.</p>
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
|
|
|
|
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
|
|
|
|
|
</b></p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
|
|
|
|
|
Shorewall presentation to GSLUG</a>. The presentation is in
|
|
|
|
|
|
HTML format but was generated from Microsoft PowerPoint and is best viewed
|
|
|
|
|
|
using Internet Explorer (although Konqueror also seems to work reasonably
|
|
|
|
|
|
well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to view
|
|
|
|
|
|
the presentation.<br>
|
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
|
|
|
|
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</b><br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p><b> Problems Corrected:</b></p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<ol>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<li>TCP connection requests rejected out of the
|
|
|
|
|
|
<b>common</b> chain are now properly rejected with TCP
|
|
|
|
|
|
RST; previously, some of these requests were rejected with an ICMP
|
|
|
|
|
|
port-unreachable response.</li>
|
|
|
|
|
|
<li>'traceroute -I' from behind the firewall previously
|
|
|
|
|
|
timed out on the first hop (e.g., to the firewall). This has been
|
|
|
|
|
|
worked around.</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
</ol>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p><b> New Features:</b></p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
<ol>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<li>Where an entry in the/etc/shorewall/hosts file
|
|
|
|
|
|
specifies a particular host or network, Shorewall now creates an intermediate
|
|
|
|
|
|
chain for handling input from the related zone. This can substantially
|
|
|
|
|
|
reduce the number of rules traversed by connections requests from such
|
|
|
|
|
|
zones.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>Any file may include an INCLUDE directive. An
|
|
|
|
|
|
INCLUDE directive consists of the word INCLUDE followed by a file
|
|
|
|
|
|
name and causes the contents of the named file to be logically included
|
|
|
|
|
|
into the file containing the INCLUDE. File names given in an INCLUDE
|
|
|
|
|
|
directive are assumed to reside in /etc/shorewall or in an alternate
|
|
|
|
|
|
configuration directory if one has been specified for the command. <br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Examples:<br>
|
|
|
|
|
|
shorewall/params.mgmt:<br>
|
|
|
|
|
|
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
|
|
|
|
|
TIME_SERVERS=4.4.4.4<br>
|
|
|
|
|
|
BACKUP_SERVERS=5.5.5.5<br>
|
|
|
|
|
|
----- end params.mgmt -----<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
shorewall/params:<br>
|
|
|
|
|
|
# Shorewall 1.3 /etc/shorewall/params<br>
|
|
|
|
|
|
[..]<br>
|
|
|
|
|
|
#######################################<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
INCLUDE params.mgmt <br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
# params unique to this host here<br>
|
|
|
|
|
|
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT
|
|
|
|
|
|
REMOVE<br>
|
|
|
|
|
|
----- end params -----<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
shorewall/rules.mgmt:<br>
|
|
|
|
|
|
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
|
|
|
|
|
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
|
|
|
|
|
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
|
|
|
|
|
----- end rules.mgmt -----<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
shorewall/rules:<br>
|
|
|
|
|
|
# Shorewall version 1.3 - Rules File<br>
|
|
|
|
|
|
[..]<br>
|
|
|
|
|
|
#######################################<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
INCLUDE rules.mgmt <br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
# rules unique to this host here<br>
|
|
|
|
|
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
|
|
|
|
|
|
REMOVE<br>
|
|
|
|
|
|
----- end rules -----<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
INCLUDE's may be nested to a level of 3 -- further nested
|
|
|
|
|
|
INCLUDE directives are ignored with a warning message.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li>Routing traffic from an interface back out that
|
|
|
|
|
|
interface continues to be a problem. While I firmly believe that
|
|
|
|
|
|
this should never happen, people continue to want to do it. To limit
|
|
|
|
|
|
the damage that such nonsense produces, I have added a new 'routeback'
|
|
|
|
|
|
option in /etc/shorewall/interfaces and /etc/shorewall/hosts. When
|
|
|
|
|
|
used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
|
|
|
|
|
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
|
|
|
|
|
interface. The 'routeback' option CAN be specified however on individual
|
|
|
|
|
|
group entries in /etc/shorewall/hosts.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
The 'routeback' option is similar to the old 'multi' option
|
|
|
|
|
|
with two exceptions:<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
a) The option pertains to a particular zone,interface,address
|
|
|
|
|
|
tuple.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
b) The option only created infrastructure to pass traffic
|
|
|
|
|
|
from (zone,interface,address) tuples back to themselves (the 'multi'
|
|
|
|
|
|
option affected all (zone,interface,address) tuples associated with
|
|
|
|
|
|
the given 'interface').<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>'
|
|
|
|
|
|
for information about how this new option may affect your configuration.<br>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
|
</ol>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-03-18 02:13:38 +01:00
|
|
|
|
<p><a href="News.htm">More News</a></p>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
|
|
|
|
border="0" src="images/leaflogo.gif" width="49" height="36"
|
|
|
|
|
|
alt="(Leaf Logo)">
|
|
|
|
|
|
</a>Jacques
|
|
|
|
|
|
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
|
|
|
|
|
on a floppy, CD or compact flash) distribution
|
|
|
|
|
|
called <i>Bering</i> that
|
|
|
|
|
|
features Shorewall-1.3.14 and Kernel-2.4.20.
|
|
|
|
|
|
You can find their work at: <a
|
|
|
|
|
|
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
|
|
|
|
|
|
|
|
|
|
|
</a></p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<b>Congratulations to Jacques and Eric on the recent release of Bering
|
|
|
|
|
|
1.2!!! </b><br>
|
2002-12-28 16:38:03 +01:00
|
|
|
|
<h2><a name="Donations"></a>Donations</h2>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</td>
|
|
|
|
|
|
|
|
|
|
|
|
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
|
|
|
|
|
|
|
|
|
|
|
<form method="post"
|
|
|
|
|
|
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
|
|
|
|
|
<strong><br>
|
|
|
|
|
|
<font color="#ffffff"><b>Note: </b></font></strong><font
|
|
|
|
|
|
color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
|
|
|
|
|
<strong></strong>
|
|
|
|
|
|
|
|
|
|
|
|
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
|
|
|
|
|
<font face="Arial"
|
|
|
|
|
|
size="-1"> <input type="text" name="words" size="15"></font><font
|
|
|
|
|
|
size="-1"> </font> <font face="Arial" size="-1"> <input
|
|
|
|
|
|
type="hidden" name="format" value="long"> <input type="hidden"
|
|
|
|
|
|
name="method" value="and"> <input type="hidden" name="config"
|
|
|
|
|
|
value="htdig"> <input type="submit" value="Search"></font> </p>
|
|
|
|
|
|
<font face="Arial"> <input
|
|
|
|
|
|
type="hidden" name="exclude"
|
|
|
|
|
|
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
|
|
|
|
|
|
|
|
|
|
|
<p><font color="#ffffff"><b><a
|
|
|
|
|
|
href="http://lists.shorewall.net/htdig/search.html"><font
|
|
|
|
|
|
color="#ffffff">Extended Search</font></a></b></font></p>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2002-12-28 16:38:03 +01:00
|
|
|
|
</table>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</center>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<table border="0" cellpadding="5" cellspacing="0"
|
|
|
|
|
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
|
|
|
|
|
bgcolor="#4b017c">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<tbody>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td
|
|
|
|
|
|
width="100%" style="margin-top: 1px;">
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-09-16 19:13:10 +02:00
|
|
|
|
<p align="center"><a href="http://www.starlight.org"> <img
|
|
|
|
|
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
|
|
|
|
|
hspace="10">
|
2003-05-15 21:39:23 +02:00
|
|
|
|
</a></p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-03-18 02:13:38 +01:00
|
|
|
|
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
|
|
|
|
|
but if you try it and find it useful, please consider making a donation
|
2003-05-15 21:39:23 +02:00
|
|
|
|
to
|
|
|
|
|
|
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
|
|
|
|
|
Children's Foundation.</font></a> Thanks!</font></p>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-31 22:50:51 +01:00
|
|
|
|
</table>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
|
|
|
|
|
|
<p><font size="2">Updated 5/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
</p>
|
2002-09-16 19:13:10 +02:00
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
