Closing the Firewall before the Network Interfaces are brought
up
- When Shorewall-init is first installed, it does nothing until you
+ When Shorewall-init is first installed, it does nothing until you
configure it.The configuration file is /etc/default/shorewall-init
on Debian-based systems and
/etc/sysconfig/shorewall-init otherwise. There are
- two settings in the file:
+ two settings in the file:
@@ -115,7 +115,7 @@
Be sure that your current firewall script(s) (normally in
/var/lib/<product>/firewall) is(are)
- compiled with the 4.4.10 compiler.
+ compiled with the 4.4.10 compiler.
Shorewall and Shorewall6 users can execute these
commands:
@@ -139,7 +139,7 @@
- That's all that is required.
+ That's all that is required.
@@ -147,7 +147,7 @@
To integrate with NetworkManager and ifup/ifdown, additional steps
are required. You probably don't want to enable this feature if you run a
- link status monitor like swping or LSM.
+ link status monitor like swping or LSM.
@@ -165,15 +165,21 @@
Optional) -- If you have specified at least one
or interface, you
- can then disable automatic firewall startup at boot time. On
- Debian-based systems, set startup=0 in
+ can then disable automatic firewall startup at boot time. On Debian
+ systems, set startup=0 in
/etc/default/product.
On other systems, use your service startup configuration tool
- (chkconfig, insserv, ...) to disable startup.
+ (chkconfig, insserv, ...) to disable startup.
+
+
+ If your system uses Upstart as it's system initialization
+ daemon, you should not disable startup. Upstart is standard on
+ recent Ubuntu and Fedora releases and is optional on Debian.
+
- The following actions occur when an interface comes up:
+ The following actions occur when an interface comes up:
@@ -253,7 +259,7 @@
- For optional interfaces, the
+ For optional interfaces, the
/var/lib/product/interface.state
files are maintained to reflect the state of the interface so that they
may be used by the standard isusable script. Please
@@ -272,13 +278,13 @@
Similarly, if an optional interface goes down and there are no
optional interfaces remaining in the up state, then the firewall is
- stopped.
+ stopped.On Debian-based systems, during system shutdown the firewall is
opened prior to network shutdown (/etc/init.d/shorewall
stop performs a 'clear' operation rather than a 'stop'). This is
required by Debian standards. You can change this default behavior by
setting SAFESTOP=1 in /etc/default/shorewall
- (/etc/default/shorewall6, ...).
+ (/etc/default/shorewall6, ...).