mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-21 02:08:48 +02:00
More 1.4.0 Updates
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@483 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
09fc5e317a
commit
07f66da156
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
42
Shorewall-docs/Forum.html
Normal file
42
Shorewall-docs/Forum.html
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
|
||||||
|
<meta http-equiv="Content-Type"
|
||||||
|
content="text/html; charset=windows-1252">
|
||||||
|
<title>Shorewall Support Forum</title>
|
||||||
|
|
||||||
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td width="100%">
|
||||||
|
<h1 align="center"><font color="#ffffff">Support Forum</font></h1>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<h3><font color="#ff6633"></font></h3>
|
||||||
|
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||||
|
read the <a href="support.htm">Shorewall Support Guide</a>.</h1>
|
||||||
|
<p><a href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||||
|
Forum</a><br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><font size="2">Updated 3/6/2003 - <a href="support.htm">Tom Eastep</a>
|
||||||
|
</font></p>
|
||||||
|
|
||||||
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
|
size="2">2003 Thomas M. Eastep.</font></a></p>
|
||||||
|
<br>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
File diff suppressed because it is too large
Load Diff
549
Shorewall-docs/Shorewall_and_Aliased_Interfaces.html
Normal file
549
Shorewall-docs/Shorewall_and_Aliased_Interfaces.html
Normal file
@ -0,0 +1,549 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Shorewall and Aliased Interfaces</title>
|
||||||
|
|
||||||
|
<meta http-equiv="content-type"
|
||||||
|
content="text/html; charset=ISO-8859-1">
|
||||||
|
|
||||||
|
<meta name="author" content="Tom Eastep">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
|
<h1 align="center"><font color="#ffffff">Shorewall and Aliased Interfaces</font></h1>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<h2>Background</h2>
|
||||||
|
The traditional net-tools contain a program called <i>ifconfig</i> which
|
||||||
|
is used to configure network devices. ifconfig introduced the concept of
|
||||||
|
<i>aliased </i>or <i>virtial </i>interfaces. These virtual interfaces have
|
||||||
|
names of the form <i>interface</i>:<i>integer </i>(e.g., eth0:0) and ifconfig
|
||||||
|
treats them more or less like real interfaces.<br>
|
||||||
|
<br>
|
||||||
|
Example:<br>
|
||||||
|
|
||||||
|
<pre>[root@gateway root]# ifconfig eth0:0<br>eth0:0 Link encap:Ethernet HWaddr 02:00:08:3:FA:55<br> inet addr:206.124.146.178 Bcast:206.124.146.255 Mask:255.255.255.0<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> Interrupt:11 Base address:0x2000<br>[root@gateway root]# <br></pre>
|
||||||
|
The ifconfig utility is being gradually phased out in favor of the <i>ip</i>
|
||||||
|
utility which is part of the <i>iproute </i>package. The ip utility does
|
||||||
|
not use the concept of aliases or virtual interfaces but rather treats additional
|
||||||
|
addresses on an interface as addresses. The ip utility does provide for interaction
|
||||||
|
with ifconfig in that it allows addresses to be <i>labeled.</i> <br>
|
||||||
|
<br>
|
||||||
|
Example:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<pre>[root@gateway root]# ip addr show dev eth0<br>2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb qlen 100<br> link/ether 02:00:08:e3:fa:55 brd ff:ff:ff:ff:ff:ff<br> inet 206.124.146.176/24 brd 206.124.146.255 scope global eth0<br> inet 206.124.146.178/24 brd 206.124.146.255 scope global secondary eth0:0<br>[root@gateway root]# <br></pre>
|
||||||
|
Note that one <u>cannot</u> type "ip addr show dev eth0:0"<br>
|
||||||
|
|
||||||
|
<pre>[root@gateway root]# ip addr show dev eth0:0<br>Device "eth0:0" does not exist.<br>[root@gateway root]#<br></pre>
|
||||||
|
The iptables program doesn't support virtual interfaces in either it's
|
||||||
|
"-i" or "-o" command options; as a consequence, Shorewall does not allow
|
||||||
|
them to be used in the /etc/shorewall/interfaces file.<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<h2>So how do I handle more than one address on an interface?</h2>
|
||||||
|
Depends on what you are trying to do with the interfaces. In the sub-sections
|
||||||
|
that follow, we'll take a look at common scenarios.<br>
|
||||||
|
|
||||||
|
<h3>Separate Rules</h3>
|
||||||
|
If you need to make a rule for traffic to/from the firewall itself only
|
||||||
|
apply to a particular IP address, simply qualify the $FW zone with the IP
|
||||||
|
address.<br>
|
||||||
|
<br>
|
||||||
|
Example (allow SSH from net to eth0:0 above):<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" border="1" cellspacing="0">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ACTION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PROTOCOL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">DNAT<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">net<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">fw:206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">tcp<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">22<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3>DNAT</h3>
|
||||||
|
Suppose that I had set up eth0:0 as above and I wanted to port forward
|
||||||
|
from that virtual interface to a web server running in my local zone at 192.168.1.3.
|
||||||
|
That is accomplised by a single rule in the /etc/shorewall/rules file:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" border="1" cellspacing="0">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ACTION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PROTOCOL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">DNAT<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">net<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">loc:192.168.1.3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">tcp<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">80<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">-<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3>SNAT</h3>
|
||||||
|
If you wanted to use eth0:0 as the IP address for outbound connections
|
||||||
|
from your local zone (eth1), then in /etc/shorewall/masq:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SUBNET<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ADDRESS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">eth0<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
Shorewall can create the alias (additional address) for you if you set
|
||||||
|
ADD_SNAT_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||||
|
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||||
|
that you can see the created address using ifconfig. In addition to setting
|
||||||
|
ADD_SNAT_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||||
|
column as follows:<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SUBNET<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ADDRESS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">eth0:0<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3>STATIC NAT</h3>
|
||||||
|
If you wanted to use static NAT to link eth0:0 with local address 192.168.1.3,
|
||||||
|
you would have the following in /etc/shorewall/nat:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>EXTERNAL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERNAL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ALL INTERFACES<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>LOCAL<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth0<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">192.168.1.3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">no<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">no<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
Shorewall can create the alias (additional address) for you if you set
|
||||||
|
ADD_IP_ALIASES=Yes in /etc/shorewall/shorewall.conf. Beginning with Shorewall
|
||||||
|
1.3.14, Shorewall can actually create the "label" (virtual interface) so
|
||||||
|
that you can see the created address using ifconfig. In addition to setting
|
||||||
|
ADD_IP_ALIASES=Yes, you specify the virtual interface name in the INTERFACE
|
||||||
|
column as follows:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>EXTERNAL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERNAL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ALL INTERFACES<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>LOCAL<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">206.124.146.178<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth0:0<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">192.168.1.3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">no<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">no<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
In either case, to create rules that pertain only to this NAT pair, you
|
||||||
|
simply qualify the local zone with the internal IP address.<br>
|
||||||
|
<br>
|
||||||
|
Example: You want to allow SSH from the net to 206.124.146.178 a.k.a. 192.168.1.3.<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" border="1" cellspacing="0">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ACTION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PROTOCOL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>SOURCE PORT(S)<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>ORIGINAL DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">ACCEPT<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">net<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">loc:192.168.1.3<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">tcp<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">22<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<h3>MULTIPLE SUBNETS</h3>
|
||||||
|
Sometimes multiple IP addresses are used because there are multiple subnetworks
|
||||||
|
configured on a LAN segment. This technique does not provide for any security
|
||||||
|
between the subnetworks if the users of the systems have administrative privileges
|
||||||
|
because in that case, the users can simply manipulate their system's routing
|
||||||
|
table to bypass your firewall/router. Nevertheless, there are cases where
|
||||||
|
you simply want to consider the LAN segment itself as a zone and allow your
|
||||||
|
firewall/router to route between the two subnetworks.<br>
|
||||||
|
<br>
|
||||||
|
Example 1: Local interface eth1 interfaces to 192.168.1.0/24 and
|
||||||
|
192.168.20.0/24. The primary IP address of eth1 is 192.168.1.254 and eth1:0
|
||||||
|
is 192.168.20.254. You want to simply route all requests between the two
|
||||||
|
subnetworks.<br>
|
||||||
|
<br>
|
||||||
|
In /etc/shorewall/interfaces:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ZONE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>BROADCAST<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>OPTIONS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Note 1:<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
Note 1: If you are running Shorewall 1.3.10 or earlier then you must specify
|
||||||
|
the <b>multi</b> option.<br>
|
||||||
|
<br>
|
||||||
|
In /etc/shorewall/policy:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>SOURCE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DESTINATION<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>POLICY<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>LOG LEVEL<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>BURST:LIMIT<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">loc<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">ACCEPT<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
Example 2: Local interface eth1 interfaces to 192.168.1.0/24 and 192.168.20.0/24.
|
||||||
|
The primary IP address of eth1 is 192.168.1.254 and eth1:0 is 192.168.20.254.
|
||||||
|
You want to make these subnetworks into separate zones and control the
|
||||||
|
access between them (the users of the systems do not have administrative
|
||||||
|
privileges).<br>
|
||||||
|
<br>
|
||||||
|
In /etc/shorewall/zones:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ZONE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DISPLAY<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>DESCRIPTION<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Local<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Local Zone 1<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc2<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Local2<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Local Zone 2<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
In /etc/shorewall/interfaces:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ZONE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>INTERFACE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>BROADCAST<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>OPTIONS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">-<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth1<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">192.168.1.255,192.168.20.255<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">Note 1:<br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
Note 1: If you are running Shorewall 1.3.10 or earlier then you must specify
|
||||||
|
the <b>multi</b> option.<br>
|
||||||
|
<br>
|
||||||
|
In /etc/shorewall/hosts:<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table cellpadding="2" cellspacing="0" border="1">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td valign="top"><b>ZONE<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>HOSTS<br>
|
||||||
|
</b></td>
|
||||||
|
<td valign="top"><b>OPTIONS<br>
|
||||||
|
</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth0:192.168.1.0/24<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td valign="top">loc2<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top">eth0:192.168.20.0/24<br>
|
||||||
|
</td>
|
||||||
|
<td valign="top"><br>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
</blockquote>
|
||||||
|
In /etc/shorewall/rules, simply specify ACCEPT rules for the traffic that
|
||||||
|
you want to permit.<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<p align="left"><font size="2">Last Updated 3/5/2003 A - <a
|
||||||
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
|
<p><a href="copyright.htm"><font size="2">Copyright</font> ©
|
||||||
|
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
|
<br>
|
||||||
|
</p>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -2,166 +2,170 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Index</title>
|
<title>Shorewall Index</title>
|
||||||
|
|
||||||
<base target="main">
|
<base
|
||||||
|
target="main">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#4b017c" height="90">
|
bgcolor="#4b017c" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" height="90">
|
<td width="100%" height="90">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" bgcolor="#ffffff">
|
<td width="100%" bgcolor="#ffffff">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li> <a
|
||||||
|
href="seattlefirewall_index.htm">Home</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_features.htm">Features</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||||
|
<li> <a href="download.htm">Download</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||||
|
<a href="Install.htm">Configuration</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <b><a
|
||||||
|
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||||
|
<li> <a href="Documentation.htm">Reference
|
||||||
|
Manual</a></li>
|
||||||
|
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||||
|
<li><a href="useful_links.html">Useful
|
||||||
|
Links</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a href="troubleshoot.htm">Troubleshooting</a></li>
|
||||||
|
<li> <a href="errata.htm">Errata</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||||
|
<li> <a href="support.htm">Support</a></li>
|
||||||
|
<li><a href="Forum.html">Support Forum</a> <img
|
||||||
|
src="images/new10.gif" alt="(New)" width="28" height="12">
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li> <a
|
||||||
|
href="http://lists.shorewall.net/mailing_list.htm">Mailing Lists</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_mirrors.htm">Mirrors</a>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://germany.shorewall.net">Germany</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://france.shorewall.net">France</a></li>
|
||||||
|
<li><a href="http://www.shorewall.net"
|
||||||
|
target="_top">Washington State, USA</a><br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a
|
<li> <a href="News.htm">News Archive</a></li>
|
||||||
href="seattlefirewall_index.htm">Home</a></li>
|
<li> <a
|
||||||
<li> <a
|
|
||||||
href="shorewall_features.htm">Features</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
|
||||||
<li> <a href="download.htm">Download</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
|
||||||
<a href="Install.htm">Configuration</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a href="shorewall_quickstart_guide.htm">QuickStart
|
|
||||||
Guides (HOWTOs)</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <b><a
|
|
||||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
|
||||||
<li> <a href="Documentation.htm">Reference
|
|
||||||
Manual</a></li>
|
|
||||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
|
||||||
<li><a href="useful_links.html">Useful
|
|
||||||
Links</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a href="troubleshoot.htm">Troubleshooting</a></li>
|
|
||||||
<li> <a href="errata.htm">Errata</a></li>
|
|
||||||
<li> <a href="upgrade_issues.htm">Upgrade
|
|
||||||
Issues</a></li>
|
|
||||||
<li> <a href="support.htm">Support</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="http://lists.shorewall.net/mailing_list.htm">Mailing Lists</a></li>
|
|
||||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://germany.shorewall.net">Germany</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://france.shorewall.net">France</a></li>
|
|
||||||
<li><a href="http://www.shorewall.net"
|
|
||||||
target="_top">Washington State, USA</a><br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li> <a href="News.htm">News Archive</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||||
<li> <a href="quotes.htm">Quotes from
|
<li> <a href="quotes.htm">Quotes
|
||||||
Users</a></li>
|
from Users</a></li>
|
||||||
<li> <a href="shoreline.htm">About the
|
<li> <a href="shoreline.htm">About
|
||||||
Author</a></li>
|
the Author</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
|
<strong><br>
|
||||||
|
<b>Note: </b></strong>Search is unavailable
|
||||||
|
Daily 0200-0330 GMT.<br>
|
||||||
|
<strong></strong>
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
|
||||||
<strong><br>
|
|
||||||
<b>Note: </b></strong>Search is unavailable Daily
|
|
||||||
0200-0330 GMT.<br>
|
|
||||||
<strong></strong>
|
|
||||||
|
|
||||||
<p><strong>Quick Search</strong><br>
|
<p><strong>Quick Search</strong><br>
|
||||||
<font face="Arial" size="-1"> <input
|
<font face="Arial" size="-1"> <input
|
||||||
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
||||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
value="long"> <input type="hidden" name="method" value="and"> <input
|
||||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
type="hidden" name="config" value="htdig"> <input type="submit"
|
||||||
value="Search"></font> </p>
|
value="Search"></font> </p>
|
||||||
<font face="Arial"> <input
|
<font face="Arial"> <input
|
||||||
type="hidden" name="exclude"
|
type="hidden" name="exclude"
|
||||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||||
|
|
||||||
|
|
||||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001-2003 Thomas M. Eastep.</font></a></p>
|
size="2">2001-2003 Thomas M. Eastep.</font></a></p>
|
||||||
|
|
||||||
<p><a href="http://www.shorewall.net" target="_top"> <img border="1"
|
<p><a href="http://www.shorewall.net" target="_top"> <img border="1"
|
||||||
src="images/shorewall.jpg" width="119" height="38" hspace="0">
|
src="images/shorewall.jpg" width="119" height="38" hspace="0">
|
||||||
</a><br>
|
</a><br>
|
||||||
<br>
|
</p>
|
||||||
</p>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -2,165 +2,164 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Index</title>
|
<title>Shorewall Index</title>
|
||||||
|
|
||||||
<base target="main">
|
<base
|
||||||
|
target="main">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#4b017c" height="90">
|
bgcolor="#4b017c" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" height="90">
|
<td width="100%" height="90">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%" bgcolor="#ffffff">
|
<td width="100%"
|
||||||
|
bgcolor="#ffffff">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li> <a
|
||||||
|
href="seattlefirewall_index.htm">Home</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_features.htm">Features</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||||
|
<li> <a href="download.htm">Download</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
||||||
|
<a href="Install.htm">Configuration</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <b><a
|
||||||
|
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
||||||
|
<li> <a
|
||||||
|
href="Documentation.htm">Reference Manual</a></li>
|
||||||
|
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||||
|
<li><a
|
||||||
|
href="useful_links.html">Useful Links</a><br>
|
||||||
|
</li>
|
||||||
|
<li> <a href="troubleshoot.htm">Troubleshooting</a></li>
|
||||||
|
<li> <a href="errata.htm">Errata</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||||
|
<li> <a href="support.htm">Support</a></li>
|
||||||
|
<li><a href="Forum.html">Support Forum</a> <img
|
||||||
|
src="images/new10.gif" alt="(New)" width="28" height="12">
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li> <a
|
||||||
|
href="http://lists.shorewall.net/mailing_list.htm">Mailing Lists</a></li>
|
||||||
|
<li> <a
|
||||||
|
href="shorewall_mirrors.htm">Mirrors</a>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://germany.shorewall.net">Germany</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
||||||
|
<li><a target="_top"
|
||||||
|
href="http://france.shorewall.net">France</a></li>
|
||||||
|
<li><a href="http://www.shorewall.net"
|
||||||
|
target="_top">Washington State, USA</a><br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a
|
<li> <a href="News.htm">News Archive</a></li>
|
||||||
href="seattlefirewall_index.htm">Home</a></li>
|
<li> <a
|
||||||
<li> <a
|
|
||||||
href="shorewall_features.htm">Features</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
|
||||||
<li> <a href="download.htm">Download</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a href="Install.htm">Installation/Upgrade/</a><br>
|
|
||||||
<a href="Install.htm">Configuration</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a
|
|
||||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <b><a
|
|
||||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a></b></li>
|
|
||||||
<li> <a href="Documentation.htm">Reference
|
|
||||||
Manual</a></li>
|
|
||||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
|
||||||
<li><a href="useful_links.html">Useful
|
|
||||||
Links</a><br>
|
|
||||||
</li>
|
|
||||||
<li> <a href="troubleshoot.htm">Troubleshooting</a></li>
|
|
||||||
<li> <a href="errata.htm">Errata</a></li>
|
|
||||||
<li> <a href="upgrade_issues.htm">Upgrade
|
|
||||||
Issues</a></li>
|
|
||||||
<li> <a href="support.htm">Support</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="http://lists.shorewall.net/mailing_list.htm">Mailing Lists</a></li>
|
|
||||||
<li> <a href="shorewall_mirrors.htm">Mirrors</a>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://germany.shorewall.net">Germany</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://shorewall.correofuego.com.ar">Argentina</a></li>
|
|
||||||
<li><a target="_top"
|
|
||||||
href="http://france.shorewall.net">France</a></li>
|
|
||||||
<li><a href="http://www.shorewall.net"
|
|
||||||
target="_top">Washington State, USA</a><br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li> <a href="News.htm">News Archive</a></li>
|
|
||||||
<li> <a
|
|
||||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||||
<li> <a href="quotes.htm">Quotes from
|
<li> <a href="quotes.htm">Quotes
|
||||||
Users</a></li>
|
from Users</a></li>
|
||||||
<li> <a href="shoreline.htm">About the
|
<li> <a href="shoreline.htm">About
|
||||||
Author</a></li>
|
the Author</a></li>
|
||||||
<li> <a
|
<li> <a
|
||||||
href="sourceforge_index.htm#Donations">Donations</a></li>
|
href="sourceforge_index.htm#Donations">Donations</a></li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
<strong><br>
|
<strong><br>
|
||||||
<b>Note: </b></strong>Search is unavailable Daily
|
<b>Note: </b></strong>Search is unavailable
|
||||||
0200-0330 GMT.<br>
|
Daily 0200-0330 GMT.<br>
|
||||||
<strong></strong>
|
<strong></strong>
|
||||||
|
|
||||||
<p><strong>Quick Search</strong><br>
|
<p><strong>Quick Search</strong><br>
|
||||||
<font face="Arial" size="-1"> <input
|
<font face="Arial" size="-1"> <input
|
||||||
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
type="text" name="words" size="15"></font><font size="-1"> </font> <font
|
||||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||||
value="long"> <input type="hidden" name="method" value="and"> <input
|
value="long"> <input type="hidden" name="method" value="and"> <input
|
||||||
type="hidden" name="config" value="htdig"> <input type="submit"
|
type="hidden" name="config" value="htdig"> <input type="submit"
|
||||||
value="Search"></font> </p>
|
value="Search"></font> </p>
|
||||||
<font face="Arial"> <input
|
<font face="Arial"> <input
|
||||||
type="hidden" name="exclude"
|
type="hidden" name="exclude"
|
||||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||||
|
|
||||||
|
|
||||||
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
<p><b><a href="http://lists.shorewall.net/htdig/search.html">Extended Search</a></b></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001-2003 Thomas M. Eastep.</font></a></p>
|
size="2">2001-2003 Thomas M. Eastep.</font></a></p>
|
||||||
|
<br>
|
||||||
<p><a href="http://www.shorewall.net" target="_top"> </a><br>
|
<br>
|
||||||
</p>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -1,392 +1,393 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Download</title>
|
<title>Download</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
<h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
<p><b>I strongly urge you to read and print a copy of the <a
|
<p><b>I strongly urge you to read and print a copy of the <a
|
||||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||||
for the configuration that most closely matches your own.<br>
|
for the configuration that most closely matches your own.<br>
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
<p>The entire set of Shorewall documentation is available in PDF format at:</p>
|
||||||
|
|
||||||
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
<p> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||||||
<a href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
<a href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||||||
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
<a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>The documentation in HTML format is included in the .rpm and in the .tgz
|
<p>Once you've printed the appropriate QuickStart Guide, download <u>
|
||||||
packages below.</p>
|
one</u> of the modules:</p>
|
||||||
|
|
||||||
<p> Once you've done that, download <u> one</u> of the modules:</p>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
<li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
|
||||||
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
<b> Linux PPC</b> or <b> TurboLinux</b> distribution
|
||||||
with a 2.4 kernel, you can use the RPM version (note: the
|
with a 2.4 kernel, you can use the RPM version (note: the
|
||||||
RPM should also work with other distributions that
|
RPM should also work with other distributions that
|
||||||
store init scripts in /etc/init.d and that include chkconfig
|
store init scripts in /etc/init.d and that include chkconfig
|
||||||
or insserv). If you find that it works in other cases, let <a
|
or insserv). If you find that it works in other cases, let <a
|
||||||
href="mailto:teastep@shorewall.net"> me</a> know so that
|
href="mailto:teastep@shorewall.net"> me</a> know so that
|
||||||
I can mention them here. See the <a href="Install.htm">Installation
|
I can mention them here. See the <a href="Install.htm">Installation
|
||||||
Instructions</a> if you have problems installing the RPM.</li>
|
Instructions</a> if you have problems installing the RPM.</li>
|
||||||
<li>If you are running LRP, download the .lrp file (you
|
<li>If you are running LRP, download the .lrp file (you
|
||||||
might also want to download the .tgz so you will have a copy of
|
might also want to download the .tgz so you will have a copy of
|
||||||
the documentation).</li>
|
the documentation).</li>
|
||||||
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
<li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
|
||||||
and would like a .deb package, Shorewall is included in both
|
and would like a .deb package, Shorewall is included in both
|
||||||
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
the <a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||||||
Testing Branch</a> and the <a
|
Testing Branch</a> and the <a
|
||||||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||||||
Unstable Branch</a>.</li>
|
Unstable Branch</a>.</li>
|
||||||
<li>Otherwise, download the <i>shorewall</i>
|
<li>Otherwise, download the <i>shorewall</i>
|
||||||
module (.tgz)</li>
|
module (.tgz)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The documentation in HTML format is included in the .tgz and .rpm files
|
<p>The documentation in HTML format is included in the .tgz and .rpm files
|
||||||
and there is an documentation .deb that also contains the documentation.</p>
|
and there is an documentation .deb that also contains the documentation. The
|
||||||
|
.rpm will install the documentation in your default document directory which
|
||||||
|
can be obtained using the following command:<br>
|
||||||
|
</p>
|
||||||
|
<blockquote>
|
||||||
|
<p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
|
||||||
|
</blockquote>
|
||||||
<p>Please verify the version that you have downloaded -- during the
|
<p>Please verify the version that you have downloaded -- during the
|
||||||
release of a new version of Shorewall, the links below may
|
release of a new version of Shorewall, the links below may
|
||||||
point to a newer or an older version than is shown below.</p>
|
point to a newer or an older version than is shown below.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>RPM - "rpm -qip LATEST.rpm"</li>
|
<li>RPM - "rpm -qip LATEST.rpm"</li>
|
||||||
<li>TARBALL - "tar -ztf LATEST.tgz" (the directory name
|
<li>TARBALL - "tar -ztf LATEST.tgz" (the directory
|
||||||
will contain the version)</li>
|
name will contain the version)</li>
|
||||||
<li>LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar
|
<li>LRP - "mkdir Shorewall.lrp; cd Shorewall.lrp; tar
|
||||||
-zxf <downloaded .lrp>; cat var/lib/lrpkg/shorwall.version"
|
-zxf <downloaded .lrp>; cat var/lib/lrpkg/shorwall.version"
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>Once you have verified the version, check the <font
|
<p>Once you have verified the version, check the <font
|
||||||
color="#ff0000"> <a href="errata.htm"> errata</a></font> to see
|
color="#ff0000"> <a href="errata.htm"> errata</a></font> to see
|
||||||
if there are updates that apply to the version that you have
|
if there are updates that apply to the version that you have
|
||||||
downloaded.</p>
|
downloaded.</p>
|
||||||
|
|
||||||
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
<p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY INSTALL
|
||||||
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||||
IS REQUIRED BEFORE THE FIREWALL WILL START. Once you have completed configuration
|
IS REQUIRED BEFORE THE FIREWALL WILL START as described in the QuickStart
|
||||||
of your firewall, you can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
Guides. Once you have completed configuration of your firewall, you
|
||||||
|
can enable startup by removing the file /etc/shorewall/startup_disabled.</b></font></p>
|
||||||
<p><b>Download Latest Version</b> (<b>1.3.14</b>): <b>Remember that updates
|
|
||||||
to the mirrors occur 1-12 hours after an update to the Washington
|
<p><b>Download Latest Version</b> (<b>1.4.0</b>): <b>Remember that updates
|
||||||
State site.</b></p>
|
to the mirrors occur 1-12 hours after an update to the Washington
|
||||||
|
State site.</b></p>
|
||||||
<blockquote>
|
|
||||||
|
<blockquote>
|
||||||
<table border="2" cellspacing="3" cellpadding="3"
|
<table border="2" cellspacing="3" cellpadding="3"
|
||||||
style="border-collapse: collapse;">
|
style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>SERVER LOCATION</b></td>
|
<td><b>SERVER LOCATION</b></td>
|
||||||
<td><b>DOMAIN</b></td>
|
<td><b>DOMAIN</b></td>
|
||||||
<td><b>HTTP</b></td>
|
<td><b>HTTP</b></td>
|
||||||
<td><b>FTP</b></td>
|
<td><b>FTP</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">SourceForge<br>
|
<td valign="top">SourceForge<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">sf.net<br>
|
<td valign="top">sf.net<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><a
|
<td valign="top"><a
|
||||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Download</a><br>
|
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Download</a><br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><br>
|
<td valign="top"><br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>Slovak Republic</td>
|
<td>Slovak Republic</td>
|
||||||
<td>Shorewall.net</td>
|
<td>Shorewall.net</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a
|
<a
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums">
|
href="http://slovakia.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||||
Download.md5sums</a></td>
|
Download.md5sums</a></td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.rpm">Download
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.rpm">Download
|
||||||
.rpm</a> <br>
|
.rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.tgz">Download
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.lrp">Download
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.lrp">Download
|
||||||
.rpm</a><br>
|
.rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums">
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/LATEST.md5sums">
|
||||||
Download.md5sums</a></td>
|
Download.md5sums</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>Texas, USA</td>
|
<td>Texas, USA</td>
|
||||||
<td>Infohiiway.com</td>
|
<td>Infohiiway.com</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.rpm">Download
|
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.rpm">Download
|
||||||
.rpm</a><br>
|
.rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a
|
<a
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.lrp">Download
|
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
href="http://shorewall.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||||
Download.md5sums</a></td>
|
Download.md5sums</a></td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.rpm">Download .rpm</a> <br>
|
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.rpm">Download .rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.lrp"> Download
|
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.lrp"> Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
href="ftp://ftp.infohiiway.com/pub/shorewall/LATEST.md5sums">
|
||||||
Download.md5sums</a></td>
|
Download.md5sums</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>Hamburg, Germany</td>
|
<td>Hamburg, Germany</td>
|
||||||
<td>Shorewall.net</td>
|
<td>Shorewall.net</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
href="http://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||||
.rpm</a><br>
|
.rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
href="http://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a><br>
|
.tgz</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
href="http://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums">
|
href="http://germany.shorewall.net/pub/shorewall/LATEST.md5sums">
|
||||||
Download.md5sums</a></td>
|
Download.md5sums</a></td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.rpm"> Download
|
||||||
.rpm</a> <br>
|
.rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
href="ftp://germany.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a></td>
|
.md5sums</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||||
<td>Correofuego.com.ar</td>
|
<td>Correofuego.com.ar</td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||||
.rpm</a> <br>
|
.rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||||
Download .lrp</a><br>
|
Download .lrp</a><br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a></td>
|
.md5sums</a></td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||||
.rpm</a> <br>
|
.rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.lrp">
|
||||||
Download .lrp</a><br>
|
Download .lrp</a><br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a></td>
|
.md5sums</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>Paris, France</td>
|
<td>Paris, France</td>
|
||||||
<td>Shorewall.net</td>
|
<td>Shorewall.net</td>
|
||||||
<td><a
|
<td><a
|
||||||
href="http://france.shorewall.net/pub/LATEST.rpm">Download .rpm</a><br>
|
href="http://france.shorewall.net/pub/LATEST.rpm">Download .rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://france.shorewall.net/pub/LATEST.tgz">Download .tgz</a> <br>
|
href="http://france.shorewall.net/pub/LATEST.tgz">Download .tgz</a> <br>
|
||||||
<a
|
<a
|
||||||
href="http://france.shorewall.net/pub/LATEST.lrp">Download .lrp</a><br>
|
href="http://france.shorewall.net/pub/LATEST.lrp">Download .lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://france.shorewall.net/pub/LATEST.md5sums">Download
|
href="http://france.shorewall.net/pub/LATEST.md5sums">Download
|
||||||
.md5sums</a></td>
|
.md5sums</a></td>
|
||||||
<td> <a target="_blank"
|
<td> <a target="_blank"
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.rpm">Download
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.rpm">Download
|
||||||
.rpm</a> <br>
|
.rpm</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.tgz">Download
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.lrp">Download
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums">Download
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a></td>
|
.md5sums</a></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="middle">Washington State, USA<br>
|
<td valign="middle">Washington State, USA<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="middle">Shorewall.net<br>
|
<td valign="middle">Shorewall.net<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><a
|
<td valign="top"><a
|
||||||
href="http://www.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
href="http://www.shorewall.net/pub/shorewall/LATEST.rpm">Download .rpm</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://www.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
href="http://www.shorewall.net/pub/shorewall/LATEST.tgz">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a
|
<a
|
||||||
href="http://www.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
href="http://www.shorewall.net/pub/shorewall/LATEST.lrp">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a
|
<a
|
||||||
href="http://www.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
href="http://www.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a><br>
|
.md5sums</a><br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><a
|
<td valign="top"><a
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.rpm" target="_blank">
|
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.rpm" target="_blank">
|
||||||
Download .rpm</a> <br>
|
Download .rpm</a> <br>
|
||||||
<a
|
<a
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.tgz" target="_blank">Download
|
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.tgz" target="_blank">Download
|
||||||
.tgz</a> <br>
|
.tgz</a> <br>
|
||||||
<a
|
<a
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.lrp" target="_blank">Download
|
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.lrp" target="_blank">Download
|
||||||
.lrp</a><br>
|
.lrp</a><br>
|
||||||
<a target="_blank"
|
<a target="_blank"
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
href="ftp://ftp.shorewall.net/pub/shorewall/LATEST.md5sums">Download
|
||||||
.md5sums</a><br>
|
.md5sums</a><br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p><b>Browse Download Sites:</b></p>
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
|
||||||
<tbody>
|
|
||||||
<tr>
|
|
||||||
<td><b>SERVER LOCATION</b></td>
|
|
||||||
<td><b>DOMAIN</b></td>
|
|
||||||
<td><b>HTTP</b></td>
|
|
||||||
<td><b>FTP</b></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>SourceForge<br>
|
|
||||||
</td>
|
|
||||||
<td>sf.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
|
||||||
<td>N/A</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Slovak Republic</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Texas, USA</td>
|
|
||||||
<td>Infohiiway.com</td>
|
|
||||||
<td><a
|
|
||||||
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
|
||||||
<td><a target="_blank"
|
|
||||||
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Hamburg, Germany</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
|
||||||
<td><a target="_blank"
|
|
||||||
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
|
||||||
<td>Correofuego.com.ar</td>
|
|
||||||
<td><a
|
|
||||||
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>France</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
|
||||||
<td> <a target="_blank"
|
|
||||||
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>Washington State, USA</td>
|
|
||||||
<td>Shorewall.net</td>
|
|
||||||
<td><a
|
|
||||||
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
|
||||||
<td><a
|
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
|
||||||
</tr>
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p align="left"><b>CVS:</b></p>
|
|
||||||
|
|
||||||
<blockquote>
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p><b>Browse Download Sites:</b></p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td><b>SERVER LOCATION</b></td>
|
||||||
|
<td><b>DOMAIN</b></td>
|
||||||
|
<td><b>HTTP</b></td>
|
||||||
|
<td><b>FTP</b></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>SourceForge (Incomplete)<br>
|
||||||
|
</td>
|
||||||
|
<td>sf.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
|
||||||
|
<td>N/A</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Slovak Republic</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
|
<td> <a target="_blank"
|
||||||
|
href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Texas, USA</td>
|
||||||
|
<td>Infohiiway.com</td>
|
||||||
|
<td><a
|
||||||
|
href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
|
||||||
|
<td><a target="_blank"
|
||||||
|
href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Hamburg, Germany</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
|
<td><a target="_blank"
|
||||||
|
href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Martinez (Zona Norte - GBA), Argentina</td>
|
||||||
|
<td>Correofuego.com.ar</td>
|
||||||
|
<td><a
|
||||||
|
href="http://shorewall.correofuego.com.ar/pub/mirrors/shorewall">Browse</a></td>
|
||||||
|
<td> <a target="_blank"
|
||||||
|
href="ftp://shorewall.correofuego.com.ar/pub/mirrors/shorewall"> Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>France</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
|
||||||
|
<td> <a target="_blank"
|
||||||
|
href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>Washington State, USA</td>
|
||||||
|
<td>Shorewall.net</td>
|
||||||
|
<td><a
|
||||||
|
href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
|
||||||
|
<td><a
|
||||||
|
href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
<p align="left"><b>CVS:</b></p>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
<p align="left">The <a target="_top"
|
<p align="left">The <a target="_top"
|
||||||
href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS repository
|
href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS repository
|
||||||
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
at cvs.shorewall.net</a> contains the latest snapshots of the each
|
||||||
Shorewall component. There's no guarantee that what you find there
|
Shorewall component. There's no guarantee that what you find there
|
||||||
will work at all.<br>
|
will work at all.<br>
|
||||||
</p>
|
</p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 2/7/2003 - <a
|
<p align="left"><font size="2">Last Updated 3/5/2003 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
File diff suppressed because one or more lines are too long
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||||
@ -15,25 +15,26 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
<base
|
<base
|
||||||
target="_self">
|
target="_self">
|
||||||
<meta name="author" content="Tom Eastep">
|
<meta name="author" content="Tom Eastep">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="4"
|
<table border="0" cellpadding="0" cellspacing="4"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
|
<td width="100%"
|
||||||
|
height="90">
|
||||||
|
|
||||||
<td width="100%" height="90">
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -42,14 +43,13 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"> <font size="4"><i> <a
|
<h1 align="center"> <font size="4"><i> <a
|
||||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||||
src="images/washington.jpg" border="0">
|
src="images/washington.jpg" border="0">
|
||||||
|
|
||||||
</a></i></font><font
|
</a></i></font><font
|
||||||
color="#ffffff">Shorewall 1.4 - <font size="4">"<i>iptables
|
color="#ffffff">Shorewall 1.4 - <font size="4">"<i>iptables
|
||||||
made easy"</i></font></font></h1>
|
made easy"</i></font></font></h1>
|
||||||
|
|
||||||
|
|
||||||
@ -61,43 +61,43 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div align="center"><a
|
<div align="center"><a
|
||||||
href="http://shorewall.sf.net/1.3/index.html" target="_top"><font
|
href="http://shorewall.sf.net/1.3/index.html" target="_top"><font
|
||||||
color="#ffffff">Shorewall 1.3 Site here</font></a><br>
|
color="#ffffff">Shorewall 1.3 Site here</font></a><br>
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div align="center">
|
<div align="center">
|
||||||
|
|
||||||
<center>
|
<center>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="90%">
|
<td width="90%">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -108,7 +108,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2 align="left">What is it?</h2>
|
<h2 align="left">What is it?</h2>
|
||||||
|
|
||||||
|
|
||||||
@ -121,11 +121,11 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is a
|
||||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
<a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
|
||||||
firewall that can be used on a dedicated firewall system, a multi-function
|
that can be used on a dedicated firewall system, a multi-function
|
||||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -137,28 +137,28 @@ firewall that can be used on a dedicated firewall system, a multi-functio
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>This program is free software; you can redistribute it and/or modify
|
<p>This program is free software; you can redistribute it and/or modify
|
||||||
it under the terms
|
it under the terms
|
||||||
of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||||
2 of the GNU General Public License</a> as published by the Free Software
|
2 of the GNU General Public License</a> as published by the Free Software
|
||||||
Foundation.<br>
|
Foundation.<br>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
This program is distributed
|
This program is distributed
|
||||||
in the hope that it will be useful, but
|
in the hope that it will be useful, but
|
||||||
WITHOUT ANY WARRANTY; without even the implied
|
WITHOUT ANY WARRANTY; without even the implied
|
||||||
warranty of MERCHANTABILITY or FITNESS FOR A
|
warranty of MERCHANTABILITY or FITNESS FOR A
|
||||||
PARTICULAR PURPOSE. See the GNU General Public License
|
PARTICULAR PURPOSE. See the GNU General Public License
|
||||||
for more details.<br>
|
for more details.<br>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
You should have received
|
You should have received
|
||||||
a copy of the GNU General Public License
|
a copy of the GNU General Public License
|
||||||
along with this program; if not, write to
|
along with this program; if not, write to
|
||||||
the Free Software Foundation, Inc., 675 Mass
|
the Free Software Foundation, Inc., 675 Mass
|
||||||
Ave, Cambridge, MA 02139, USA</p>
|
Ave, Cambridge, MA 02139, USA</p>
|
||||||
|
|
||||||
|
|
||||||
@ -171,7 +171,7 @@ the Free Software Foundation, Inc., 675 Mass
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||||
|
|
||||||
|
|
||||||
@ -184,21 +184,21 @@ the Free Software Foundation, Inc., 675 Mass
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||||
|
|
||||||
</a>Jacques Nilo and
|
</a>Jacques Nilo and
|
||||||
Eric Wolzak have a LEAF (router/firewall/gateway
|
Eric Wolzak have a LEAF (router/firewall/gateway
|
||||||
on a floppy, CD or compact flash) distribution called
|
on a floppy, CD or compact flash) distribution called
|
||||||
<i>Bering</i> that features Shorewall-1.3.14
|
<i>Bering</i> that features Shorewall-1.3.14
|
||||||
and Kernel-2.4.20. You can find their work at:
|
and Kernel-2.4.20. You can find their work at:
|
||||||
<a href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
<a href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
<p><b>Congratulations to Jacques and Eric on the recent release of
|
<p><b>Congratulations to Jacques and Eric on the recent release of Bering
|
||||||
Bering 1.1!!!</b><br>
|
1.1!!!</b><br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -208,9 +208,9 @@ Bering 1.1!!!</b><br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2>This is a mirror of the main Shorewall web site at SourceForge
|
<h2>This is a mirror of the main Shorewall web site at SourceForge (<a
|
||||||
(<a href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>)</h2>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -224,8 +224,8 @@ Bering 1.1!!!</b><br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2>News</h2>
|
<h2>News</h2>
|
||||||
|
|
||||||
|
|
||||||
@ -238,7 +238,7 @@ Bering 1.1!!!</b><br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2></h2>
|
<h2></h2>
|
||||||
|
|
||||||
|
|
||||||
@ -248,112 +248,130 @@ Bering 1.1!!!</b><br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><b>3/14/2003 - Shorewall 1.4.0</b><b> </b><b><img
|
<p><b>3/14/2003 - Shorewall 1.4.0</b><b> </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b></p>
|
</b></p>
|
||||||
|
|
||||||
|
|
||||||
<p></p>
|
<p></p>
|
||||||
Shorewall 1.4 represents the next step in the evolution of Shorewall.
|
Shorewall 1.4 represents the next step in the evolution of Shorewall.
|
||||||
The main thrust of the initial release is simply to remove the cruft that
|
The main thrust of the initial release is simply to remove the cruft that
|
||||||
has accumulated in Shorewall over time.<br>
|
has accumulated in Shorewall over time.<br>
|
||||||
<br>
|
<br>
|
||||||
<b>IMPORTANT: Shorewall 1.4.0 requires</b> <b>the iproute package
|
<b>IMPORTANT: Shorewall 1.4.0 requires</b> <b>the iproute package
|
||||||
('ip' utility).</b><br>
|
('ip' utility).</b><br>
|
||||||
<br>
|
<br>
|
||||||
Function from 1.3 that has been omitted from this version include:<br>
|
Function from 1.3 that has been omitted from this version include:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The MERGE_HOSTS variable in shorewall.conf is
|
<li>The MERGE_HOSTS variable in shorewall.conf is
|
||||||
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.<br>
|
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Interface names of the form <device>:<integer>
|
<li>Interface names of the form <device>:<integer>
|
||||||
in /etc/shorewall/interfaces now generate an error.<br>
|
in /etc/shorewall/interfaces now generate an error.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No.
|
<li>Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No.
|
||||||
OLD_PING_HANDLING=Yes will generate an error at startup as will specification
|
OLD_PING_HANDLING=Yes will generate an error at startup as will specification
|
||||||
of the 'noping' or 'filterping' interface options.<br>
|
of the 'noping' or 'filterping' interface options.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The 'routestopped' option in the /etc/shorewall/interfaces
|
<li>The 'routestopped' option in the /etc/shorewall/interfaces
|
||||||
and /etc/shorewall/hosts files is no longer supported and will generate
|
and /etc/shorewall/hosts files is no longer supported and will generate
|
||||||
an error at startup if specified.<br>
|
an error at startup if specified.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules
|
||||||
no longer accepted.<br>
|
is no longer accepted.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The ALLOWRELATED variable in shorewall.conf is no longer
|
<li>The ALLOWRELATED variable in shorewall.conf is no longer
|
||||||
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.<br>
|
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>The icmp.def file has been removed.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The icmp.def file has been removed.<br>
|
<li value="8">The 'multi' interface option is no longer supported.
|
||||||
<br>
|
Shorewall will generate rules for sending packets back out the same interface
|
||||||
</li>
|
|
||||||
<li value="8">The 'multi' interface option is no longer supported.
|
|
||||||
Shorewall will generate rules for sending packets back out the same interface
|
|
||||||
that they arrived on in two cases:</li>
|
that they arrived on in two cases:</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>There is an <u>explicit</u> policy for the source zone to
|
<li>There is an <u>explicit</u> policy for the source zone to
|
||||||
or from the destination zone. An explicit policy names both zones and does
|
or from the destination zone. An explicit policy names both zones and does
|
||||||
not use the 'all' reserved word.</li>
|
not use the 'all' reserved word.</li>
|
||||||
<li>There are one or more rules for traffic for the source zone
|
<li>There are one or more rules for traffic for the source zone
|
||||||
to or from the destination zone including rules that use the 'all' reserved
|
to or from the destination zone including rules that use the 'all' reserved
|
||||||
word. Exception: if the source zone and destination zone are the same then
|
word. Exception: if the source zone and destination zone are the same then
|
||||||
the rule must be explicit - it must name the zone in both the SOURCE and
|
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||||
DESTINATION columns.<br>
|
DESTINATION columns.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
Changes for 1.4 include:<br>
|
Changes for 1.4 include:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The /etc/shorewall/shorewall.conf file has been completely
|
<li>The /etc/shorewall/shorewall.conf file has been completely
|
||||||
reorganized into logical sections.<br>
|
reorganized into logical sections.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>LOG is now a valid action for a rule (/etc/shorewall/rules).<br>
|
<li>LOG is now a valid action for a rule (/etc/shorewall/rules).<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The firewall script and version file are now installed
|
<li>The firewall script and version file are now installed
|
||||||
in /usr/share/shorewall.<br>
|
in /usr/share/shorewall.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Late arriving DNS replies are now silently dropped in
|
<li>Late arriving DNS replies are now silently dropped in
|
||||||
the common chain by default.<br>
|
the common chain by default.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>In addition to behaving like OLD_PING_HANDLING=No, Shorewall
|
<li>In addition to behaving like OLD_PING_HANDLING=No, Shorewall
|
||||||
1.4 no longer unconditionally accepts outbound ICMP packets. So if you want
|
1.4 no longer unconditionally accepts outbound ICMP packets. So if you
|
||||||
to 'ping' from the firewall, you will need the appropriate rule or policy.<br>
|
want to 'ping' from the firewall, you will need the appropriate rule or
|
||||||
<br>
|
policy.<br>
|
||||||
</li>
|
<br>
|
||||||
<li>802.11b devices with names of the form wlan<i><n></i>
|
</li>
|
||||||
now support the 'maclist' option.<br>
|
<li>CONTINUE is now a valid action for a rule (/etc/shorewall/rules).<br>
|
||||||
</li>
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>802.11b devices with names of the form wlan<i><n></i>
|
||||||
|
now support the 'maclist' option.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li value="8">Explicit Congestion Notification (ECN - RFC 3168) may
|
||||||
|
now be turned off on a host or network basis using the new /etc/shorewall/ecn
|
||||||
|
file. To use this facility:<br>
|
||||||
|
<br>
|
||||||
|
a) You must be running kernel 2.4.20<br>
|
||||||
|
b) You must have applied the patch in<br>
|
||||||
|
http://www.shorewall/net/pub/shorewall/ecn/patch.<br>
|
||||||
|
c) You must have iptables 1.2.7a installed.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>The /etc/shorewall/params file is now processed first so that
|
||||||
|
variables may be used in the /etc/shorewall/shorewall.conf file.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
@ -362,7 +380,7 @@ the common chain by default.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><b></b><a href="News.htm">More News</a></p>
|
<p><b></b><a href="News.htm">More News</a></p>
|
||||||
|
|
||||||
|
|
||||||
@ -375,44 +393,44 @@ the common chain by default.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2><a name="Donations"></a>Donations</h2>
|
<h2><a name="Donations"></a>Donations</h2>
|
||||||
|
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
<td width="88"
|
<td width="88"
|
||||||
bgcolor="#4b017c" valign="top" align="center"> <a
|
bgcolor="#4b017c" valign="top" align="center"> <a
|
||||||
href="http://sourceforge.net">M</a></td>
|
href="http://sourceforge.net">M</a></td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
</center>
|
</center>
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="5" cellspacing="0"
|
<table border="0" cellpadding="5" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="100%"
|
<td width="100%"
|
||||||
style="margin-top: 1px;">
|
style="margin-top: 1px;">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -422,12 +440,12 @@ the common chain by default.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><a href="http://www.starlight.org"> <img
|
<p align="center"><a href="http://www.starlight.org"> <img
|
||||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||||
hspace="10">
|
hspace="10">
|
||||||
|
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -439,32 +457,33 @@ the common chain by default.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||||
but if you try it and find it useful, please consider making a donation
|
if you try it and find it useful, please consider making a donation
|
||||||
to <a
|
to <a
|
||||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||||
Children's Foundation.</font></a> Thanks!</font></p>
|
Foundation.</font></a> Thanks!</font></p>
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font size="2">Updated 2/28/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2">Updated 3/5/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -2,313 +2,313 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall QuickStart Guide</title>
|
<title>Shorewall QuickStart Guide</title>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
||||||
(HOWTO's)<br>
|
(HOWTO's)<br>
|
||||||
Version 3.1</font></h1>
|
Version 4.0</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="center">With thanks to Richard who reminded me once again that we
|
<p align="center">With thanks to Richard who reminded me once again that we
|
||||||
must all first walk before we can run.<br>
|
must all first walk before we can run.<br>
|
||||||
The French Translations are courtesy of Patrice Vetsel<br>
|
The French Translations are courtesy of Patrice Vetsel<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h2>The Guides</h2>
|
<h2>The Guides</h2>
|
||||||
|
|
||||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||||
in common firewall setups.</p>
|
in common firewall setups.</p>
|
||||||
|
|
||||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="standalone.htm">Standalone</a> Linux System
|
<li><a href="standalone.htm">Standalone</a> Linux
|
||||||
(<a href="standalone_fr.html">Version Française</a>)</li>
|
System (<a href="standalone_fr.html">Version Française</a>)</li>
|
||||||
<li><a href="two-interface.htm">Two-interface</a> Linux
|
<li><a href="two-interface.htm">Two-interface</a>
|
||||||
System acting as a firewall/router for a small local network (<a
|
Linux System acting as a firewall/router for a small local network
|
||||||
href="two-interface_fr.html">Version Française</a>)</li>
|
(<a href="two-interface_fr.html">Version Française</a>)</li>
|
||||||
<li><a href="three-interface.htm">Three-interface</a>
|
<li><a href="three-interface.htm">Three-interface</a>
|
||||||
Linux System acting as a firewall/router for a small local network
|
Linux System acting as a firewall/router for a small local network
|
||||||
and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The above guides are designed to get your first firewall up and running
|
<p>The above guides are designed to get your first firewall up and running
|
||||||
quickly in the three most common Shorewall configurations.</p>
|
quickly in the three most common Shorewall configurations.</p>
|
||||||
|
|
||||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
||||||
the steps necessary to set up a firewall where <b>there are multiple
|
the steps necessary to set up a firewall where <b>there are multiple
|
||||||
public IP addresses involved or if you want to learn more about Shorewall
|
public IP addresses involved or if you want to learn more about
|
||||||
than is explained in the single-address guides above.</b></p>
|
Shorewall than is explained in the single-address guides above.</b></p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0
|
<li><a href="shorewall_setup_guide.htm#Concepts">2.0
|
||||||
Shorewall Concepts</a></li>
|
Shorewall Concepts</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0
|
<li><a
|
||||||
Network Interfaces</a></li>
|
href="shorewall_setup_guide.htm#Interfaces">3.0 Network Interfaces</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0
|
<li><a
|
||||||
Addressing, Subnets and Routing</a>
|
href="shorewall_setup_guide.htm#Addressing">4.0 Addressing, Subnets
|
||||||
|
and Routing</a>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a
|
||||||
|
href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
||||||
|
<li><a
|
||||||
|
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||||
|
<li><a
|
||||||
|
href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#ARP">4.4
|
||||||
|
Address Resolution Protocol</a></li>
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a
|
||||||
|
href="shorewall_setup_guide.htm#RFC1918">4.5 RFC 1918</a></li>
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="shorewall_setup_guide.htm#Options">5.0
|
||||||
|
Setting up your Network</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
<li><a href="shorewall_setup_guide.htm#Routed">5.1
|
||||||
href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
Routed</a></li>
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3
|
|
||||||
Routing</a></li>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
|
||||||
Resolution Protocol</a></li>
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5
|
<li><a
|
||||||
RFC 1918</a></li>
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#Options">5.0
|
|
||||||
Setting up your Network</a>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1
|
|
||||||
Routed</a></li>
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a
|
|
||||||
href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1
|
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1
|
||||||
SNAT</a></li>
|
SNAT</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2
|
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2
|
||||||
DNAT</a></li>
|
DNAT</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#ProxyARP">5.2.3 Proxy ARP</a></li>
|
href="shorewall_setup_guide.htm#ProxyARP">5.2.3 Proxy ARP</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4
|
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4
|
||||||
Static NAT</a></li>
|
Static NAT</a></li>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3
|
<li><a href="shorewall_setup_guide.htm#Rules">5.3
|
||||||
Rules</a></li>
|
Rules</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds and Ends</a></li>
|
href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds and Ends</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||||
Stopping the Firewall</a></li>
|
Stopping the Firewall</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2><a name="Documentation"></a>Documentation Index</h2>
|
<h2><a name="Documentation"></a>Documentation Index</h2>
|
||||||
|
|
||||||
<p>The following documentation covers a variety of topics and <b>supplements
|
<p>The following documentation covers a variety of topics and <b>supplements
|
||||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||||
described above</b>. Please review the appropriate guide before trying
|
described above</b>. Please review the appropriate guide before trying
|
||||||
to use this documentation directly.</p>
|
to use this documentation directly.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
<li><a
|
||||||
|
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
||||||
|
(e.g., eth0:0)</a><br>
|
||||||
<ul>
|
</li>
|
||||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
</li>
|
|
||||||
<li><a href="configuration_file_basics.htm">Common
|
|
||||||
configuration file features</a>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a
|
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||||
|
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
</li>
|
||||||
|
<li><a href="configuration_file_basics.htm">Common
|
||||||
|
configuration file features</a>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li><a
|
||||||
href="configuration_file_basics.htm#Comments">Comments in configuration
|
href="configuration_file_basics.htm#Comments">Comments in configuration
|
||||||
files</a></li>
|
files</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||||
or Subnet</a></li>
|
or Subnet</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
||||||
(making a test configuration)</a></li>
|
(making a test configuration)</a></li>
|
||||||
<li><a href="configuration_file_basics.htm#MAC">Using
|
<li><a
|
||||||
MAC Addresses in Shorewall</a></li>
|
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="Documentation.htm">Configuration File
|
<li><a href="Documentation.htm">Configuration File
|
||||||
Reference Manual</a>
|
Reference Manual</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Zones">zones</a></font></li>
|
href="Documentation.htm#Zones">zones</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Policy">policy</a></font></li>
|
href="Documentation.htm#Policy">policy</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Rules">rules</a></font></li>
|
href="Documentation.htm#Rules">rules</a></font></li>
|
||||||
<li><a href="Documentation.htm#Common">common</a></li>
|
<li><a href="Documentation.htm#Common">common</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Masq">masq</a></font></li>
|
href="Documentation.htm#Masq">masq</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#NAT">nat</a></font></li>
|
href="Documentation.htm#NAT">nat</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="dhcp.htm">DHCP</a></li>
|
<li><a href="dhcp.htm">DHCP</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||||
(How to extend Shorewall without modifying Shorewall code)</li>
|
(How to extend Shorewall without modifying Shorewall code)</li>
|
||||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||||
<li><a href="shorewall_firewall_structure.htm">Firewall
|
<li><a href="shorewall_firewall_structure.htm">Firewall
|
||||||
Structure</a></li>
|
Structure</a></li>
|
||||||
<li><font color="#000099"><a href="kernel.htm">Kernel
|
<li><font color="#000099"><a href="kernel.htm">Kernel
|
||||||
Configuration</a></font></li>
|
Configuration</a></font></li>
|
||||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||||
</li>
|
|
||||||
<li><a href="myfiles.htm">My Shorewall Configuration
|
|
||||||
(How I personally use Shorewall)</a><br>
|
|
||||||
</li>
|
|
||||||
<li><a href="ping.html">'Ping' Management</a><br>
|
|
||||||
</li>
|
</li>
|
||||||
<li><a href="ports.htm">Port Information</a>
|
<li><a href="myfiles.htm">My Shorewall Configuration
|
||||||
|
(How I personally use Shorewall)</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="ping.html">'Ping' Management</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="ports.htm">Port Information</a>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Which applications use which ports</li>
|
<li>Which applications use which ports</li>
|
||||||
<li>Ports used by Trojans</li>
|
<li>Ports used by Trojans</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||||
<li><a href="samba.htm">Samba</a></li>
|
<li><a href="samba.htm">Samba</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Description of all /sbin/shorewall commands</li>
|
<li>Description of all /sbin/shorewall commands</li>
|
||||||
<li>How to safely test a Shorewall configuration change<br>
|
<li>How to safely test a Shorewall configuration change<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
<li><font color="#000099"><a href="NAT.htm">Static
|
<li><font color="#000099"><a href="NAT.htm">Static
|
||||||
NAT</a></font></li>
|
NAT</a></font></li>
|
||||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent Proxy
|
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent Proxy
|
||||||
with Shorewall</a><br>
|
with Shorewall</a><br>
|
||||||
</li>
|
|
||||||
<li><a href="traffic_shaping.htm">Traffic Shaping/QOS</a></li>
|
|
||||||
<li>VPN
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
|
||||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
|
||||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
|
||||||
</li>
|
</li>
|
||||||
<li><a href="PPTP.htm">PPTP</a></li>
|
<li><a href="traffic_shaping.htm">Traffic Shaping/QOS</a></li>
|
||||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system
|
<li>VPN
|
||||||
behind your firewall to a remote network.</li>
|
|
||||||
|
<ul>
|
||||||
|
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||||
|
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||||
|
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="PPTP.htm">PPTP</a></li>
|
||||||
|
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system
|
||||||
|
behind your firewall to a remote network.</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="whitelisting_under_shorewall.htm">White
|
<li><a href="whitelisting_under_shorewall.htm">White
|
||||||
List Creation</a></li>
|
List Creation</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||||
|
|
||||||
<p><font size="2">Last modified 2/26/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
<p><font size="2">Last modified 3/5/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||||
Eastep</font></a><br>
|
Eastep</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -7,7 +7,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||||
@ -17,24 +17,24 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
<base target="_self">
|
<base target="_self">
|
||||||
<meta name="author" content="Tom Eastep">
|
<meta name="author" content="Tom Eastep">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="4"
|
<table border="0" cellpadding="0" cellspacing="4"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="100%"
|
<td width="100%"
|
||||||
height="90">
|
height="90">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -44,14 +44,14 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"> <font size="4"><i> <a
|
<h1 align="center"> <font size="4"><i> <a
|
||||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||||
src="images/washington.jpg" border="0">
|
src="images/washington.jpg" border="0">
|
||||||
|
|
||||||
</a></i></font><font
|
</a></i></font><font
|
||||||
color="#ffffff">Shorewall 1.4 - <font size="4">"<i>iptables
|
color="#ffffff">Shorewall 1.4 - <font size="4">"<i>iptables
|
||||||
made easy"</i></font></font><a
|
made easy"</i></font></font><a
|
||||||
href="http://www.sf.net"> </a></h1>
|
href="http://www.sf.net"> </a></h1>
|
||||||
|
|
||||||
@ -64,35 +64,35 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div align="center"><a href="/1.3/index.html" target="_top"><font
|
<div align="center"><a href="/1.3/index.html" target="_top"><font
|
||||||
color="#ffffff">Shorewall 1.3 Site here</font></a></div>
|
color="#ffffff">Shorewall 1.3 Site here</font></a></div>
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div align="center">
|
<div align="center">
|
||||||
|
|
||||||
<center>
|
<center>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="90%">
|
<td width="90%">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -103,7 +103,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2 align="left">What is it?</h2>
|
<h2 align="left">What is it?</h2>
|
||||||
|
|
||||||
|
|
||||||
@ -117,12 +117,12 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||||
based firewall that can be used on a dedicated firewall system,
|
based firewall that can be used on a dedicated firewall system,
|
||||||
a multi-function gateway/router/server or on a standalone GNU/Linux
|
a multi-function gateway/router/server or on a standalone
|
||||||
system.</p>
|
GNU/Linux system.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -135,29 +135,29 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>This program is free software; you can redistribute it and/or modify
|
<p>This program is free software; you can redistribute it and/or modify
|
||||||
it under the terms
|
it under the
|
||||||
of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||||
2 of the GNU General Public License</a> as published by the Free Software
|
2 of the GNU General Public License</a> as published by the Free
|
||||||
Foundation.<br>
|
Software Foundation.<br>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
This program is distributed
|
This program is distributed
|
||||||
in the hope that it will be useful, but
|
in the hope that it will be useful, but
|
||||||
WITHOUT ANY WARRANTY; without even the implied
|
WITHOUT ANY WARRANTY; without even the implied
|
||||||
warranty of MERCHANTABILITY or FITNESS FOR A
|
warranty of MERCHANTABILITY or FITNESS FOR
|
||||||
PARTICULAR PURPOSE. See the GNU General Public License
|
A PARTICULAR PURPOSE. See the GNU General Public License
|
||||||
for more details.<br>
|
for more details.<br>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
You should have received
|
You should have received
|
||||||
a copy of the GNU General Public License
|
a copy of the GNU General Public License
|
||||||
along with this program; if not, write to
|
along with this program; if not, write
|
||||||
the Free Software Foundation, Inc., 675
|
to the Free Software Foundation, Inc., 675
|
||||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -170,7 +170,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||||
|
|
||||||
|
|
||||||
@ -184,25 +184,25 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||||
|
|
||||||
</a>Jacques Nilo
|
</a>Jacques Nilo
|
||||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||||
on a floppy, CD or compact flash) distribution
|
on a floppy, CD or compact flash) distribution
|
||||||
called <i>Bering</i> that features
|
called <i>Bering</i> that features
|
||||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||||
their work at: <a
|
their work at: <a
|
||||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||||
<b>
|
<b>
|
||||||
</b>
|
</b>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<b>Congratulations to Jacques and
|
<b>Congratulations to Jacques and
|
||||||
Eric on the recent release of Bering 1.1!!!</b><br>
|
Eric on the recent release of Bering 1.1!!!</b><br>
|
||||||
|
|
||||||
<h2>News</h2>
|
<h2>News</h2>
|
||||||
|
|
||||||
|
|
||||||
@ -218,105 +218,119 @@ Eric on the recent release of Bering 1.1!!!</b><br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><b>3/14/2003 - Shorewall 1.4.0</b><b> </b><b><img
|
<p><b>3/14/2003 - Shorewall 1.4.0</b><b> </b><b><img
|
||||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||||
</b></p>
|
</b></p>
|
||||||
Shorewall 1.4 represents the
|
Shorewall 1.4 represents
|
||||||
next step in the evolution of Shorewall. The main thrust of the initial
|
the next step in the evolution of Shorewall. The main thrust of the initial
|
||||||
release is simply to remove the cruft that has accumulated in Shorewall over
|
release is simply to remove the cruft that has accumulated in Shorewall
|
||||||
time. <br>
|
over time. <br>
|
||||||
<br>
|
<br>
|
||||||
<b>IMPORTANT: Shorewall 1.4.0 requires</b> <b>the iproute package
|
<b>IMPORTANT: Shorewall 1.4.0 requires</b> <b>the iproute package
|
||||||
('ip' utility).</b><br>
|
('ip' utility).</b><br>
|
||||||
<br>
|
<br>
|
||||||
Function from 1.3 that has been omitted from this version include:<br>
|
Function from 1.3 that has been omitted from this version include:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The MERGE_HOSTS variable in shorewall.conf is
|
<li>The MERGE_HOSTS variable in shorewall.conf is
|
||||||
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.<br>
|
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Interface names of the form <device>:<integer>
|
<li>Interface names of the form <device>:<integer>
|
||||||
in /etc/shorewall/interfaces now generate an error.<br>
|
in /etc/shorewall/interfaces now generate an error.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No.
|
<li>Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No.
|
||||||
OLD_PING_HANDLING=Yes will generate an error at startup as will specification
|
OLD_PING_HANDLING=Yes will generate an error at startup as will specification
|
||||||
of the 'noping' or 'filterping' interface options.<br>
|
of the 'noping' or 'filterping' interface options.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The 'routestopped' option in the /etc/shorewall/interfaces
|
<li>The 'routestopped' option in the /etc/shorewall/interfaces
|
||||||
and /etc/shorewall/hosts files is no longer supported and will generate
|
and /etc/shorewall/hosts files is no longer supported and will generate
|
||||||
an error at startup if specified.<br>
|
an error at startup if specified.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
|
||||||
no longer accepted.<br>
|
no longer accepted.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The ALLOWRELATED variable in shorewall.conf is no longer
|
<li>The ALLOWRELATED variable in shorewall.conf is no longer
|
||||||
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.<br>
|
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>The icmp.def file has been removed.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The icmp.def file has been removed.<br>
|
<li value="8">The 'multi' interface option is no longer supported.
|
||||||
<br>
|
Shorewall will generate rules for sending packets back out the same interface
|
||||||
</li>
|
that they arrived on in two cases:</li>
|
||||||
<li value="8">The 'multi' interface option is no longer supported.
|
|
||||||
Shorewall will generate rules for sending packets back out the same interface
|
|
||||||
that they arrived on in two cases:</li>
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>There is an <u>explicit</u> policy for the source zone to
|
<li>There is an <u>explicit</u> policy for the source zone to
|
||||||
or from the destination zone. An explicit policy names both zones and does
|
or from the destination zone. An explicit policy names both zones and does
|
||||||
not use the 'all' reserved word.</li>
|
not use the 'all' reserved word.</li>
|
||||||
<li>There are one or more rules for traffic for the source zone
|
<li>There are one or more rules for traffic for the source zone
|
||||||
to or from the destination zone including rules that use the 'all' reserved
|
to or from the destination zone including rules that use the 'all' reserved
|
||||||
word. Exception: if the source zone and destination zone are the same then
|
word. Exception: if the source zone and destination zone are the same then
|
||||||
the rule must be explicit - it must name the zone in both the SOURCE and
|
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||||
DESTINATION columns.</li>
|
DESTINATION columns.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Changes for 1.4 include:<br>
|
Changes for 1.4 include:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The /etc/shorewall/shorewall.conf file has been completely
|
<li>The /etc/shorewall/shorewall.conf file has been completely
|
||||||
reorganized into logical sections.<br>
|
reorganized into logical sections.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>LOG and CONTINUE are now a valid actions for a rule (/etc/shorewall/rules).<br>
|
<li>LOG and CONTINUE are now a valid actions for a rule (/etc/shorewall/rules).<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>The firewall script and version file are now installed
|
<li>The firewall script and version file are now installed
|
||||||
in /usr/share/shorewall.<br>
|
in /usr/share/shorewall.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Late arriving DNS replies are now silently dropped in the
|
<li>Late arriving DNS replies are now silently dropped in
|
||||||
common chain by default.<br>
|
the common chain by default.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>In addition to behaving like OLD_PING_HANDLING=No, Shorewall
|
<li>In addition to behaving like OLD_PING_HANDLING=No, Shorewall
|
||||||
1.4 no longer unconditionally accepts outbound ICMP packets. So if you
|
1.4 no longer unconditionally accepts outbound ICMP packets. So if you want
|
||||||
want to 'ping' from the firewall, you will need the appropriate rule or
|
to 'ping' from the firewall, you will need the appropriate rule or policy.<br>
|
||||||
policy.<br>
|
<br>
|
||||||
<br>
|
</li>
|
||||||
</li>
|
<li>CONTINUE is now a valid action for a rule (/etc/shorewall/rules).<br>
|
||||||
<li>802.11b devices with names of the form wlan<i><n></i>
|
<br>
|
||||||
now support the 'maclist' option.<br>
|
</li>
|
||||||
<br>
|
<li>802.11b devices with names of the form wlan<i><n></i>
|
||||||
</li>
|
now support the 'maclist' option.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li value="8">Explicit Congestion Notification (ECN - RFC 3168) may
|
||||||
|
now be turned off on a host or network basis using the new /etc/shorewall/ecn
|
||||||
|
file. To use this facility:<br>
|
||||||
|
<br>
|
||||||
|
a) You must be running kernel 2.4.20<br>
|
||||||
|
b) You must have applied the patch in<br>
|
||||||
|
http://www.shorewall/net/pub/shorewall/ecn/patch.<br>
|
||||||
|
c) You must have iptables 1.2.7a installed.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>The /etc/shorewall/params file is now processed first so that
|
||||||
|
variables may be used in the /etc/shorewall/shorewall.conf file.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
|
|
||||||
<p></p>
|
<p></p>
|
||||||
<b> </b>
|
<b> </b>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -325,7 +339,7 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
|
|
||||||
@ -334,16 +348,17 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a href="News.htm">More News</a></p>
|
<p><a href="News.htm">More News</a></p>
|
||||||
|
|
||||||
|
|
||||||
@ -357,7 +372,7 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2> </h2>
|
<h2> </h2>
|
||||||
|
|
||||||
|
|
||||||
@ -365,25 +380,26 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
||||||
alt="SourceForge Logo"
|
alt="SourceForge Logo"
|
||||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||||
</a></h1>
|
</a></h1>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h4> </h4>
|
<h4> </h4>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2>This site is hosted by the generous folks at <a
|
<h2>This site is hosted by the generous folks at <a
|
||||||
href="http://www.sf.net">SourceForge.net</a> </h2>
|
href="http://www.sf.net">SourceForge.net</a> </h2>
|
||||||
|
|
||||||
@ -392,44 +408,44 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h2><a name="Donations"></a>Donations</h2>
|
<h2><a name="Donations"></a>Donations</h2>
|
||||||
|
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
<td width="88"
|
<td width="88"
|
||||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
</center>
|
</center>
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="5" cellspacing="0"
|
<table border="0" cellpadding="5" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||||
bgcolor="#4b017c">
|
bgcolor="#4b017c">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="100%"
|
<td width="100%"
|
||||||
style="margin-top: 1px;">
|
style="margin-top: 1px;">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -439,12 +455,12 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><a href="http://www.starlight.org"> <img
|
<p align="center"><a href="http://www.starlight.org"> <img
|
||||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||||
hspace="10">
|
hspace="10">
|
||||||
|
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -456,32 +472,33 @@ policy.<br>
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||||
if you try it and find it useful, please consider making a donation
|
but if you try it and find it useful, please consider making a donation
|
||||||
to <a
|
to <a
|
||||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||||
Foundation.</font></a> Thanks!</font></p>
|
Children's Foundation.</font></a> Thanks!</font></p>
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font size="2">Updated 2/28/2003 - <a href="support.htm">Tom Eastep</a></font>
|
<p><font size="2">Updated 3/5/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,13 +1,13 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Starting and Stopping Shorewall</title>
|
<title>Starting and Stopping Shorewall</title>
|
||||||
@ -15,324 +15,327 @@
|
|||||||
<body>
|
<body>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
|
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
|
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
|
<h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
|
||||||
the Firewall</font></h1>
|
the Firewall</font></h1>
|
||||||
|
|
||||||
</td>
|
</td>
|
||||||
|
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> If you have a permanent internet connection such as DSL or Cable,
|
|
||||||
I recommend that you start the firewall automatically at boot. Once
|
|
||||||
you have installed "firewall" in your init.d directory, simply type
|
|
||||||
"chkconfig --add firewall". This will start the firewall in run
|
|
||||||
levels 2-5 and stop it in run levels 1 and 6. If you want to configure
|
|
||||||
your firewall differently from this default, you can use the "--level"
|
|
||||||
option in chkconfig (see "man chkconfig") or using your favorite
|
|
||||||
graphical run-level editor.</p>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><strong><u> <font color="#000099"> Important Notes:</font></u></strong><br>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>Shorewall startup is disabled by default. Once you have
|
|
||||||
configured your firewall, you can enable startup by removing the file
|
|
||||||
/etc/shorewall/startup_disabled. Note: Users of the .deb package must
|
|
||||||
edit /etc/default/shorewall and set 'startup=1'.<br>
|
|
||||||
</li>
|
|
||||||
<li>If you use dialup, you may want to start the firewall
|
|
||||||
in your /etc/ppp/ip-up.local script. I recommend just placing
|
|
||||||
"shorewall restart" in that script.</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> You can manually start and stop Shoreline Firewall using the "shorewall"
|
<p> If you have a permanent internet connection such as DSL or Cable,
|
||||||
|
I recommend that you start the firewall automatically at boot.
|
||||||
|
Once you have installed "firewall" in your init.d directory, simply
|
||||||
|
type "chkconfig --add firewall". This will start the firewall
|
||||||
|
in run levels 2-5 and stop it in run levels 1 and 6. If you want
|
||||||
|
to configure your firewall differently from this default, you can
|
||||||
|
use the "--level" option in chkconfig (see "man chkconfig") or using
|
||||||
|
your favorite graphical run-level editor.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p><strong><u> <font color="#000099"> Important Notes:</font></u></strong><br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>Shorewall startup is disabled by default. Once you have
|
||||||
|
configured your firewall, you can enable startup by removing the file
|
||||||
|
/etc/shorewall/startup_disabled. Note: Users of the .deb package must
|
||||||
|
edit /etc/default/shorewall and set 'startup=1'.<br>
|
||||||
|
</li>
|
||||||
|
<li>If you use dialup, you may want to start the firewall
|
||||||
|
in your /etc/ppp/ip-up.local script. I recommend just placing
|
||||||
|
"shorewall restart" in that script.</li>
|
||||||
|
|
||||||
|
</ol>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p> You can manually start and stop Shoreline Firewall using the "shorewall"
|
||||||
shell program: </p>
|
shell program: </p>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>shorewall start - starts the firewall</li>
|
<li>shorewall start - starts the firewall</li>
|
||||||
<li>shorewall stop - stops the firewall</li>
|
<li>shorewall stop - stops the firewall</li>
|
||||||
<li>shorewall restart - stops the firewall (if it's
|
<li>shorewall restart - stops the firewall (if it's
|
||||||
running) and then starts it again</li>
|
running) and then starts it again</li>
|
||||||
<li>shorewall reset - reset the packet and byte counters
|
<li>shorewall reset - reset the packet and byte counters
|
||||||
in the firewall</li>
|
in the firewall</li>
|
||||||
<li>shorewall clear - remove all rules and chains
|
<li>shorewall clear - remove all rules and chains
|
||||||
installed by Shoreline Firewall</li>
|
installed by Shoreline Firewall</li>
|
||||||
<li>shorewall refresh - refresh the rules involving the broadcast
|
<li>shorewall refresh - refresh the rules involving the broadcast
|
||||||
addresses of firewall interfaces, <a
|
addresses of firewall interfaces, <a
|
||||||
href="blacklisting_support.htm">the black list</a>, <a
|
href="blacklisting_support.htm">the black list</a>, <a
|
||||||
href="traffic_shaping.htm">traffic control rules</a> and <a
|
href="traffic_shaping.htm">traffic control rules</a> and <a
|
||||||
href="ECN.html">ECN control rules</a>.</li>
|
href="ECN.html">ECN control rules</a>.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
If you include the keyword <i>debug</i> as the first argument, then
|
If you include the keyword <i>debug</i> as the first argument, then
|
||||||
a shell trace of the command is produced as in:<br>
|
a shell trace of the command is produced as in:<br>
|
||||||
|
|
||||||
<pre> <font color="#009900"><b>shorewall debug start 2> /tmp/trace</b></font><br></pre>
|
<pre> <font color="#009900"><b>shorewall debug start 2> /tmp/trace</b></font><br></pre>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>The above command would trace the 'start' command and place the trace information
|
<p>The above command would trace the 'start' command and place the trace
|
||||||
in the file /tmp/trace<br>
|
information in the file /tmp/trace<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
|
<p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
|
||||||
bottom of this page.<br>
|
bottom of this page.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>The "shorewall" program may also be used to monitor the firewall.</p>
|
<p>The "shorewall" program may also be used to monitor the firewall.</p>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>shorewall status - produce a verbose report about the
|
<li>shorewall status - produce a verbose report about the
|
||||||
firewall (iptables -L -n -v)</li>
|
firewall (iptables -L -n -v)</li>
|
||||||
<li>shorewall show <i>chain</i> - produce a verbose report
|
<li>shorewall show <i>chain</i> - produce a verbose report
|
||||||
about <i>chain </i>(iptables -L <i>chain</i> -n -v)</li>
|
about <i>chain </i>(iptables -L <i>chain</i> -n -v)</li>
|
||||||
<li>shorewall show nat - produce a verbose report about the
|
<li>shorewall show nat - produce a verbose report about the
|
||||||
nat table (iptables -t nat -L -n -v)</li>
|
nat table (iptables -t nat -L -n -v)</li>
|
||||||
<li>shorewall show tos - produce a verbose report about the
|
<li>shorewall show tos - produce a verbose report about the
|
||||||
mangle table (iptables -t mangle -L -n -v)</li>
|
mangle table (iptables -t mangle -L -n -v)</li>
|
||||||
<li>shorewall show log - display the last 20 packet log entries.</li>
|
<li>shorewall show log - display the last 20 packet log entries.</li>
|
||||||
<li>shorewall show connections - displays the IP connections
|
<li>shorewall show connections - displays the IP connections
|
||||||
currently being tracked by the firewall.</li>
|
currently being tracked by the firewall.</li>
|
||||||
<li>shorewall
|
<li>shorewall
|
||||||
show
|
show
|
||||||
tc - displays
|
tc - displays
|
||||||
information about the traffic control/shaping configuration.</li>
|
information about the traffic control/shaping configuration.</li>
|
||||||
<li>shorewall monitor [ delay ] - Continuously display the
|
<li>shorewall monitor [ delay ] - Continuously display the
|
||||||
firewall status, last 20 log entries and nat. When the log entry
|
firewall status, last 20 log entries and nat. When the log
|
||||||
display changes, an audible alarm is sounded.</li>
|
entry display changes, an audible alarm is sounded.</li>
|
||||||
<li>shorewall hits - Produces several reports about the Shorewall
|
<li>shorewall hits - Produces several reports about the Shorewall
|
||||||
packet log messages in the current /var/log/messages file.</li>
|
packet log messages in the current /var/log/messages file.</li>
|
||||||
<li>shorewall version - Displays the installed version
|
<li>shorewall version - Displays the installed version
|
||||||
number.</li>
|
number.</li>
|
||||||
<li>shorewall check - Performs a <u>cursory</u> validation of the
|
<li>shorewall check - Performs a <u>cursory</u> validation of the
|
||||||
zones, interfaces, hosts, rules and policy files.<br>
|
zones, interfaces, hosts, rules and policy files.<br>
|
||||||
<br>
|
<br>
|
||||||
<font size="4" color="#ff6666"><b>The "check" command is totally unsuppored
|
<font size="4" color="#ff6666"><b>The "check" command is totally unsuppored
|
||||||
and does not parse and validate the generated iptables commands.
|
and does not parse and validate the generated iptables commands. Even
|
||||||
Even though the "check" command completes successfully, the configuration
|
though the "check" command completes successfully, the configuration
|
||||||
may fail to start. Problem reports that complain about errors that the 'check'
|
may fail to start. Problem reports that complain about errors that the 'check'
|
||||||
command does not detect will not be accepted.<br>
|
command does not detect will not be accepted.<br>
|
||||||
|
<br>
|
||||||
|
See the recommended way to make configuration changes described below.</b></font><br>
|
||||||
<br>
|
<br>
|
||||||
See the recommended way to make configuration changes described below.</b></font><br>
|
</li>
|
||||||
</li>
|
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
||||||
<li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
|
] - Restart shorewall using the specified configuration and if an
|
||||||
] - Restart shorewall using the specified configuration and if
|
error occurs or if the<i> timeout </i> option is given and the new
|
||||||
an error occurs or if the<i> timeout </i> option is given and the
|
configuration has been up for that many seconds then shorewall is
|
||||||
new configuration has been up for that many seconds then shorewall
|
restarted using the standard configuration.</li>
|
||||||
is restarted using the standard configuration.</li>
|
<li>shorewall deny, shorewall reject, shorewall accept and
|
||||||
<li>shorewall deny, shorewall reject, shorewall accept and
|
shorewall save implement <a href="blacklisting_support.htm">dynamic
|
||||||
shorewall save implement <a href="blacklisting_support.htm">dynamic
|
blacklisting</a>.</li>
|
||||||
blacklisting</a>.</li>
|
<li>shorewall logwatch (added in version 1.3.2) - Monitors
|
||||||
<li>shorewall logwatch (added in version 1.3.2) - Monitors
|
the <a href="#Conf">LOGFILE </a>and produces an audible alarm when
|
||||||
the <a href="#Conf">LOGFILE </a>and produces an audible alarm when
|
new Shorewall messages are logged.</li>
|
||||||
new Shorewall messages are logged.</li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Finally, the "shorewall" program may be used to dynamically alter
|
Finally, the "shorewall" program may be used to dynamically alter
|
||||||
the contents of a zone.<br>
|
the contents of a zone.<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
<li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
||||||
Adds the specified interface (and host if included) to the specified zone.</li>
|
Adds the specified interface (and host if included) to the specified
|
||||||
<li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
zone.</li>
|
||||||
Deletes the specified interface (and host if included) from the specified
|
<li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>-
|
||||||
|
Deletes the specified interface (and host if included) from the specified
|
||||||
zone.</li>
|
zone.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<blockquote>Examples:<br>
|
<blockquote>Examples:<br>
|
||||||
|
|
||||||
<blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
|
<blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
|
||||||
-- adds the address 192.0.2.24 from interface ipsec0 to the zone vpn1<br>
|
-- adds the address 192.0.2.24 from interface ipsec0 to the zone vpn1<br>
|
||||||
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24
|
<font color="#009900"><b> shorewall delete ipsec0:192.0.2.24
|
||||||
vpn1</b></font> -- deletes the address 192.0.2.24 from interface ipsec0
|
vpn1</b></font> -- deletes the address 192.0.2.24 from interface ipsec0
|
||||||
from zone vpn1<br>
|
from zone vpn1<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check, </b>and
|
<p> The <b>shorewall start</b>, <b>shorewall restart, shorewall check, </b>and
|
||||||
<b>shorewall try </b>commands allow you to specify which <a
|
<b>shorewall try </b>commands allow you to specify which <a
|
||||||
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
href="configuration_file_basics.htm#Configs"> Shorewall configuration</a>
|
||||||
to use:</p>
|
to use:</p>
|
||||||
|
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
|
<p> shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
|
||||||
shorewall try <i>configuration-directory</i></p>
|
shorewall try <i>configuration-directory</i></p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
<p> If a <i>configuration-directory</i> is specified, each time that Shorewall
|
||||||
is going to use a file in /etc/shorewall it will first look in the
|
is going to use a file in /etc/shorewall it will first look in the
|
||||||
<i>configuration-directory</i> . If the file is present in the <i>configuration-directory</i>,
|
<i>configuration-directory</i> . If the file is present in the <i>configuration-directory</i>,
|
||||||
that file will be used; otherwise, the file in /etc/shorewall will be
|
that file will be used; otherwise, the file in /etc/shorewall will be
|
||||||
used.</p>
|
used.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> When changing the configuration of a production firewall, I recommend
|
<p> When changing the configuration of a production firewall, I recommend
|
||||||
the following:</p>
|
the following:</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
<li><font color="#009900"><b>mkdir /etc/test</b></font></li>
|
<li><font color="#009900"><b>mkdir /etc/test</b></font></li>
|
||||||
|
|
||||||
<li><font color="#009900"><b>cd /etc/test</b></font></li>
|
<li><font color="#009900"><b>cd /etc/test</b></font></li>
|
||||||
|
|
||||||
<li><copy any files that you need to change from
|
<li><copy any files that you need to change from
|
||||||
/etc/shorewall to . and change them here></li>
|
/etc/shorewall to . and change them here></li>
|
||||||
<li><font color="#009900"><b>shorewall -c . check</b></font></li>
|
<li><font color="#009900"><b>shorewall -c . check</b></font></li>
|
||||||
<li><correct any errors found by check and check again></li>
|
<li><correct any errors found by check and check again></li>
|
||||||
|
|
||||||
|
|
||||||
<li><font color="#009900"><b>/sbin/shorewall
|
<li><font color="#009900"><b>/sbin/shorewall
|
||||||
try .</b></font></li>
|
try .</b></font></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
<p> If the configuration starts but doesn't work, just "shorewall restart"
|
<p> If the configuration starts but doesn't work, just "shorewall restart"
|
||||||
to restore the old configuration. If the new configuration fails to
|
to restore the old configuration. If the new configuration fails
|
||||||
start, the "try" command will automatically start the old one for you.</p>
|
to start, the "try" command will automatically start the old one for
|
||||||
|
you.</p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p> When the new configuration works then just </p>
|
<p> When the new configuration works then just </p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
<li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
|
<li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
|
||||||
|
|
||||||
<li><font color="#009900"><b>cd</b></font></li>
|
<li><font color="#009900"><b>cd</b></font></li>
|
||||||
|
|
||||||
<li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
|
<li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><a name="StateDiagram"></a>The Shorewall State Diargram is depicted below.<br>
|
<p><a name="StateDiagram"></a>The Shorewall State Diargram is depicted below.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<div align="center"><img src="images/State_Diagram.png"
|
<div align="center"><img src="images/State_Diagram.png"
|
||||||
alt="(State Diagram)" width="747" height="714" align="middle">
|
alt="(State Diagram)" width="747" height="714" align="middle">
|
||||||
<br>
|
<br>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p> <br>
|
<p> <br>
|
||||||
</p>
|
</p>
|
||||||
You will note that the commands that result in state transitions
|
You will note that the commands that result in state transitions
|
||||||
use the word "firewall" rather than "shorewall". That is because the actual
|
use the word "firewall" rather than "shorewall". That is because the actual
|
||||||
transitions are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
|
transitions are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
|
||||||
on Debian); /sbin/shorewall runs 'firewall" according to the following
|
on Debian); /sbin/shorewall runs 'firewall" according to the following table:<br>
|
||||||
table:<br>
|
<br>
|
||||||
<br>
|
|
||||||
|
|
||||||
<table cellpadding="2" cellspacing="2" border="1">
|
<table cellpadding="2" cellspacing="2" border="1">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall start<br>
|
<td valign="top">shorewall start<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall start<br>
|
<td valign="top">firewall start<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall stop<br>
|
<td valign="top">shorewall stop<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall stop<br>
|
<td valign="top">firewall stop<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall restart<br>
|
<td valign="top">shorewall restart<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall restart<br>
|
<td valign="top">firewall restart<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall add<br>
|
<td valign="top">shorewall add<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall add<br>
|
<td valign="top">firewall add<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall delete<br>
|
<td valign="top">shorewall delete<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall delete<br>
|
<td valign="top">firewall delete<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall refresh<br>
|
<td valign="top">shorewall refresh<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall refresh<br>
|
<td valign="top">firewall refresh<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">shorewall try<br>
|
<td valign="top">shorewall try<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">firewall -c <new configuration> restart<br>
|
<td valign="top">firewall -c <new configuration> restart<br>
|
||||||
If unsuccessful then firewall start (standard configuration)<br>
|
If unsuccessful then firewall start (standard configuration)<br>
|
||||||
If timeout then firewall restart (standard configuration)<br>
|
If timeout then firewall restart (standard configuration)<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<p><font size="2"> Updated 2/27/2003 - <a href="support.htm">Tom Eastep</a>
|
<p><font size="2"> Updated 2/27/2003 - <a href="support.htm">Tom Eastep</a>
|
||||||
</font></p>
|
</font></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -2,131 +2,139 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Support</title>
|
<title>Shorewall Support Guide</title>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||||
</font></h1>
|
</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
|
||||||
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
|
||||||
<p> <b><big><big><font color="#ff0000">While I don't answer Shorewall questions
|
<p> <b><big><big><font color="#ff0000">While I don't answer Shorewall questions
|
||||||
emailed directly to me, I try to spend some time each day answering questions
|
emailed directly to me, I try to spend some time each day answering questions
|
||||||
on the Shorewall Users Mailing List.</font></big><span
|
on the Shorewall Users Mailing List and on the Support Forum.</font></big><span
|
||||||
style="font-weight: 400;"></span></big></b></p>
|
style="font-weight: 400;"></span></big></b></p>
|
||||||
|
|
||||||
<h2 align="center"><big><font color="#ff0000"><b>-Tom Eastep</b></font></big></h2>
|
<h2 align="center"><big><font color="#ff0000"><b>-Tom Eastep</b></font></big></h2>
|
||||||
|
|
||||||
<h1>Before Reporting a Problem</h1>
|
<h1>Before Reporting a Problem</h1>
|
||||||
<i>"Well at least you tried to read the documentation, which is a lot more
|
<i>"Well at least you tried to read the documentation, which is a lot
|
||||||
than some people on this list appear to do.</i>"<br>
|
more than some people on this list appear to do.</i>"<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<div align="center">- Wietse Venema - On the Postfix mailing list<br>
|
<div align="center">- Wietse Venema - On the Postfix mailing list<br>
|
||||||
</div>
|
</div>
|
||||||
<br>
|
<br>
|
||||||
There are a number of sources for
|
There are a number of sources
|
||||||
problem solution information. Please try these before you post.
|
for problem solution information. Please try these before you
|
||||||
|
post.
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>More than half of the questions posted on the support
|
<li>More than half of the questions posted on the
|
||||||
list have answers directly accessible from the <a
|
support list have answers directly accessible from the <a
|
||||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a><br>
|
href="shorewall_quickstart_guide.htm#Documentation">Documentation Index</a><br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li> The <a href="FAQ.htm">FAQ</a>
|
<li> The <a
|
||||||
has solutions to more than 20 common problems. </li>
|
href="FAQ.htm">FAQ</a> has solutions to more than 20 common problems.
|
||||||
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> The <a
|
<li> The <a
|
||||||
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
href="troubleshoot.htm">Troubleshooting</a> Information contains
|
||||||
a number of tips to help you solve common problems. </li>
|
a number of tips to help you solve common problems. </li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> The <a
|
<li> The <a
|
||||||
href="errata.htm"> Errata</a> has links to download updated
|
href="errata.htm"> Errata</a> has links to download updated
|
||||||
components. </li>
|
components. </li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> The Mailing List
|
<li> The Mailing
|
||||||
Archives search facility can locate posts about similar
|
List Archives search facility can locate posts about similar
|
||||||
problems: </li>
|
problems: </li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2> </h2>
|
<h2> </h2>
|
||||||
|
|
||||||
<h2>Mailing List Archive Search</h2>
|
|
||||||
|
|
||||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
|
||||||
|
|
||||||
|
<h2>Mailing List Archive Search</h2>
|
||||||
<p> <font size="-1"> Match:
|
|
||||||
|
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||||
|
|
||||||
|
|
||||||
|
<p> <font size="-1"> Match:
|
||||||
|
|
||||||
<select name="method">
|
<select name="method">
|
||||||
<option value="and">All </option>
|
<option value="and">All </option>
|
||||||
<option value="or">Any </option>
|
<option value="or">Any </option>
|
||||||
<option value="boolean">Boolean </option>
|
<option value="boolean">Boolean </option>
|
||||||
</select>
|
</select>
|
||||||
Format:
|
Format:
|
||||||
|
|
||||||
|
|
||||||
<select name="format">
|
<select name="format">
|
||||||
<option value="builtin-long">Long </option>
|
<option value="builtin-long">Long </option>
|
||||||
<option value="builtin-short">Short </option>
|
<option value="builtin-short">Short </option>
|
||||||
</select>
|
</select>
|
||||||
Sort by:
|
Sort by:
|
||||||
|
|
||||||
|
|
||||||
<select name="sort">
|
<select name="sort">
|
||||||
<option value="score">Score </option>
|
<option value="score">Score </option>
|
||||||
<option value="time">Time </option>
|
<option value="time">Time </option>
|
||||||
@ -135,261 +143,265 @@ problems: </li>
|
|||||||
<option value="revtime">Reverse Time </option>
|
<option value="revtime">Reverse Time </option>
|
||||||
<option value="revtitle">Reverse Title </option>
|
<option value="revtitle">Reverse Title </option>
|
||||||
</select>
|
</select>
|
||||||
</font> <input type="hidden"
|
</font> <input type="hidden"
|
||||||
name="config" value="htdig"> <input type="hidden" name="restrict"
|
name="config" value="htdig"> <input type="hidden" name="restrict"
|
||||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||||
name="exclude" value=""> <br>
|
name="exclude" value=""> <br>
|
||||||
Search: <input type="text" size="30"
|
Search: <input type="text"
|
||||||
name="words" value=""> <input type="submit" value="Search"> </p>
|
size="30" name="words" value=""> <input type="submit" value="Search">
|
||||||
</form>
|
</p>
|
||||||
|
</form>
|
||||||
|
|
||||||
<h2>Problem Reporting Guidelines </h2>
|
<h2>Problem Reporting Guidelines </h2>
|
||||||
<i>"Let me see if I can translate your message into a real-world
|
<i>"Let me see if I can translate your message into a
|
||||||
example. It would be like saying that you have three rooms at home,
|
real-world example. It would be like saying that you have three
|
||||||
and when you walk into one of the rooms, you detect this strange smell.
|
rooms at home, and when you walk into one of the rooms, you detect
|
||||||
Can anyone tell you what that strange smell is?<br>
|
this strange smell. Can anyone tell you what that strange smell is?<br>
|
||||||
<br>
|
<br>
|
||||||
Now, all of us could do some wonderful guessing as to the
|
Now, all of us could do some wonderful guessing as to
|
||||||
smell and even what's causing it. You would be absolutely amazed
|
the smell and even what's causing it. You would be absolutely amazed
|
||||||
at the range and variety of smells we could come up with. Even more
|
at the range and variety of smells we could come up with. Even more
|
||||||
amazing is that all of the explanations for the smells would be completely
|
amazing is that all of the explanations for the smells would be completely
|
||||||
plausible."<br>
|
plausible."<br>
|
||||||
</i><br>
|
</i><br>
|
||||||
|
|
||||||
<div align="center"> - <i>Russell Mosemann</i> on the Postfix mailing list<br>
|
<div align="center"> - <i>Russell Mosemann</i> on the Postfix mailing list<br>
|
||||||
</div>
|
</div>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Please remember we only know what is posted in your message.
|
|
||||||
Do not leave out any information that appears to be correct, or was
|
|
||||||
mentioned in a previous post. There have been countless posts by people
|
|
||||||
who were sure that some part of their configuration was correct when it
|
|
||||||
actually contained a small error. We tend to be skeptics where detail
|
|
||||||
is lacking.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>Please keep in mind that you're asking for <strong>free</strong>
|
|
||||||
technical support. Any help we offer is an act of generosity, not an
|
|
||||||
obligation. Try to make it easy for us to help you. Follow good, courteous
|
|
||||||
practices in writing and formatting your e-mail. Provide details that
|
|
||||||
we need if you expect good answers. <em>Exact quoting </em> of error messages,
|
|
||||||
log entries, command output, and other output is better than a paraphrase
|
|
||||||
or summary.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li> Please don't describe
|
|
||||||
your environment and then ask us to send you custom
|
|
||||||
configuration files. We're here to answer your questions but we
|
|
||||||
can't do your job for you.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>When reporting a problem, <strong>ALWAYS</strong> include
|
|
||||||
this information:</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>the exact version of Shorewall you are running.<br>
|
|
||||||
<br>
|
|
||||||
<b><font color="#009900">shorewall version</font><br>
|
|
||||||
</b> <br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>the exact kernel version you are running<br>
|
|
||||||
<br>
|
|
||||||
<font color="#009900"><b>uname -a<br>
|
|
||||||
<br>
|
|
||||||
</b></font></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>the complete, exact output of<br>
|
|
||||||
<br>
|
|
||||||
<font color="#009900"><b>ip addr show<br>
|
|
||||||
<br>
|
|
||||||
</b></font></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>the complete, exact output of<br>
|
|
||||||
<br>
|
|
||||||
<font color="#009900"><b>ip route show<br>
|
|
||||||
<br>
|
|
||||||
</b></font></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>If your kernel is modularized, the exact output from<br>
|
|
||||||
<br>
|
|
||||||
<font color="#009900"><b>lsmod</b></font><br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>the exact wording of any <code
|
|
||||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>If you installed Shorewall using one of the QuickStart Guides,
|
|
||||||
please indicate which one. <br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
|
||||||
installation of Shorewall, please say so.</b><br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li><b>NEVER </b>include the output of "<b><font
|
|
||||||
color="#009900">iptables -L</font></b>". Instead,<font
|
|
||||||
color="#ff0000"><u><i><big> <b>if you are having connection problems of
|
|
||||||
any kind then:</b></big></i></u></font><br>
|
|
||||||
<br>
|
|
||||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
|
||||||
<br>
|
|
||||||
2. Try the connection that is failing.<br>
|
|
||||||
<br>
|
|
||||||
3.<b><font color="#009900"> /sbin/shorewall status > /tmp/status.txt</font></b><br>
|
|
||||||
<br>
|
|
||||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>As a general matter, please <strong>do not edit the diagnostic
|
|
||||||
information</strong> in an attempt to conceal your IP address, netmask,
|
|
||||||
nameserver addresses, domain name, etc. These aren't secrets, and concealing
|
|
||||||
them often misleads us (and 80% of the time, a hacker could derive them
|
|
||||||
anyway from information contained in the SMTP headers of your post).<strong></strong></li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> Do you see any
|
<li>Please remember we only know what is posted in your message.
|
||||||
"Shorewall" messages ("<b><font color="#009900">/sbin/shorewall show
|
Do not leave out any information that appears to be correct, or was
|
||||||
log</font></b>") when you exercise the function that is giving
|
mentioned in a previous post. There have been countless posts by people
|
||||||
you problems? If so, include the message(s) in your post along with a
|
who were sure that some part of their configuration was correct when
|
||||||
copy of your /etc/shorewall/interfaces file.<br>
|
it actually contained a small error. We tend to be skeptics where detail
|
||||||
<br>
|
is lacking.<br>
|
||||||
</li>
|
<br>
|
||||||
<li>Please include any of the Shorewall configuration files
|
</li>
|
||||||
(especially the /etc/shorewall/hosts file if you have modified
|
<li>Please keep in mind that you're asking for <strong>free</strong>
|
||||||
that file) that you think are relevant. If you include /etc/shorewall/rules,
|
technical support. Any help we offer is an act of generosity, not
|
||||||
please include /etc/shorewall/policy as well (rules are meaningless unless
|
an obligation. Try to make it easy for us to help you. Follow good,
|
||||||
one also knows the policies). </li>
|
courteous practices in writing and formatting your e-mail. Provide
|
||||||
|
details that we need if you expect good answers. <em>Exact quoting </em>
|
||||||
|
of error messages, log entries, command output, and other output is better
|
||||||
|
than a paraphrase or summary.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li> Please don't describe
|
||||||
|
your environment and then ask us to send you custom
|
||||||
|
configuration files. We're here to answer your questions but
|
||||||
|
we can't do your job for you.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>When reporting a problem, <strong>ALWAYS</strong> include
|
||||||
|
this information:</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>the exact version of Shorewall you are running.<br>
|
||||||
|
<br>
|
||||||
|
<b><font color="#009900">shorewall version</font><br>
|
||||||
|
</b> <br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>the exact kernel version you are running<br>
|
||||||
|
<br>
|
||||||
|
<font color="#009900"><b>uname -a<br>
|
||||||
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>the complete, exact output of<br>
|
||||||
|
<br>
|
||||||
|
<font color="#009900"><b>ip addr show<br>
|
||||||
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>the complete, exact output of<br>
|
||||||
|
<br>
|
||||||
|
<font color="#009900"><b>ip route show<br>
|
||||||
|
<br>
|
||||||
|
</b></font></li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>If your kernel is modularized, the exact output from<br>
|
||||||
|
<br>
|
||||||
|
<font color="#009900"><b>lsmod</b></font><br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>the exact wording of any <code
|
||||||
|
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>If you installed Shorewall using one of the QuickStart Guides,
|
||||||
|
please indicate which one. <br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li><b>If you are running Shorewall under Mandrake using the Mandrake
|
||||||
|
installation of Shorewall, please say so.</b><br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> If an error occurs
|
<li><b>NEVER </b>include the output of "<b><font
|
||||||
when you try to "<font color="#009900"><b>shorewall start</b></font>",
|
color="#009900">iptables -L</font></b>". Instead,<font
|
||||||
include a trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
color="#ff0000"><u><i><big> <b>if you are having connection problems of
|
||||||
section for instructions). </li>
|
any kind then:</b></big></i></u></font><br>
|
||||||
|
<br>
|
||||||
|
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||||
|
<br>
|
||||||
|
2. Try the connection that is failing.<br>
|
||||||
|
<br>
|
||||||
|
3.<b><font color="#009900"> /sbin/shorewall status > /tmp/status.txt</font></b><br>
|
||||||
|
<br>
|
||||||
|
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||||
|
<br>
|
||||||
|
</li>
|
||||||
|
<li>As a general matter, please <strong>do not edit the diagnostic
|
||||||
|
information</strong> in an attempt to conceal your IP address, netmask,
|
||||||
|
nameserver addresses, domain name, etc. These aren't secrets, and concealing
|
||||||
|
them often misleads us (and 80% of the time, a hacker could derive
|
||||||
|
them anyway from information contained in the SMTP headers of your post).<strong></strong></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
|
||||||
|
|
||||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
|
||||||
your network layout, etc. to the Mailing List -- your
|
|
||||||
post will be rejected.</b></h3>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
The author gratefully acknowleges that the above list was heavily
|
|
||||||
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
<h3> </h3>
|
||||||
found at <a
|
|
||||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
<ul>
|
||||||
|
|
||||||
<h2>Please post in plain text</h2>
|
</ul>
|
||||||
|
|
||||||
<blockquote> </blockquote>
|
<h3> </h3>
|
||||||
A growing number of MTAs serving list subscribers are rejecting
|
|
||||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
<ul>
|
||||||
shorewall.net "for continuous abuse" because it has been my policy to
|
<li> Do you see
|
||||||
allow HTML in list posts!!<br>
|
any "Shorewall" messages ("<b><font color="#009900">/sbin/shorewall
|
||||||
<br>
|
show log</font></b>") when you exercise the function that
|
||||||
I think that blocking all HTML is a Draconian way to control
|
is giving you problems? If so, include the message(s) in your post
|
||||||
spam and that the ultimate losers here are not the spammers but the
|
along with a copy of your /etc/shorewall/interfaces file.<br>
|
||||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
<br>
|
||||||
one list subscriber wrote to me privately "These e-mail admin's need
|
</li>
|
||||||
to get a <i>(expletive deleted)</i> life instead of trying to rid the
|
<li>Please include any of the Shorewall configuration files
|
||||||
planet of HTML based e-mail". Nevertheless, to allow subscribers to receive
|
(especially the /etc/shorewall/hosts file if you have
|
||||||
list posts as must as possible, I have now configured the list server
|
modified that file) that you think are relevant. If you
|
||||||
at shorewall.net to strip all HTML from outgoing posts.<br>
|
include /etc/shorewall/rules, please include /etc/shorewall/policy
|
||||||
|
as well (rules are meaningless unless one also knows the policies).
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h3> </h3>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h3> </h3>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li> If an error occurs
|
||||||
|
when you try to "<font color="#009900"><b>shorewall start</b></font>",
|
||||||
|
include a trace (See the <a href="troubleshoot.htm">Troubleshooting</a>
|
||||||
|
section for instructions). </li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h3> </h3>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>
|
||||||
|
|
||||||
|
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||||
|
your network layout, etc. to the Mailing List -- your
|
||||||
|
post will be rejected.</b></h3>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
The author gratefully acknowleges that the above list was heavily
|
||||||
|
plagiarized from the excellent LEAF document by <i>Ray</i> <em>Olszewski</em>
|
||||||
|
found at <a
|
||||||
|
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||||
|
|
||||||
|
<h2>Please post in plain text</h2>
|
||||||
|
|
||||||
|
<blockquote> </blockquote>
|
||||||
|
A growing number of MTAs serving list subscribers are rejecting
|
||||||
|
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||||
|
shorewall.net "for continuous abuse" because it has been my policy to
|
||||||
|
allow HTML in list posts!!<br>
|
||||||
|
<br>
|
||||||
|
I think that blocking all HTML is a Draconian way to control
|
||||||
|
spam and that the ultimate losers here are not the spammers but the
|
||||||
|
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||||
|
one list subscriber wrote to me privately "These e-mail admin's need
|
||||||
|
to get a <i>(expletive deleted)</i> life instead of trying to rid the planet
|
||||||
|
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||||
|
posts as must as possible, I have now configured the list server at shorewall.net
|
||||||
|
to strip all HTML from outgoing posts.<br>
|
||||||
|
|
||||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
<h4>If you run Shorewall under Bering -- <span
|
|
||||||
style="font-weight: 400;">please post your question or problem
|
|
||||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users
|
|
||||||
mailing list</a>.</span></h4>
|
|
||||||
<b>If you run Shorewall under MandrakeSoft Multi Network
|
|
||||||
Firewall (MNF) and you have not purchased an MNF license from MandrakeSoft
|
|
||||||
then you can post non MNF-specific Shorewall questions to the </b><a
|
|
||||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
|
||||||
list.</a> <b>Do not expect to get free MNF support on the list.</b><br>
|
|
||||||
|
|
||||||
<p>Otherwise, please post your question or problem to the <a
|
|
||||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
|
||||||
list.</a></p>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p>To Subscribe to the mailing list go to <a
|
|
||||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
|
||||||
.</p>
|
|
||||||
|
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 2/22/2003 - Tom Eastep</font></p>
|
|
||||||
|
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
<h4>If you run Shorewall under Bering -- <span
|
||||||
|
style="font-weight: 400;">please post your question or problem
|
||||||
|
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users
|
||||||
|
mailing list</a>.</span></h4>
|
||||||
|
<b>If you run Shorewall under MandrakeSoft Multi Network
|
||||||
|
Firewall (MNF) and you have not purchased an MNF license from MandrakeSoft
|
||||||
|
then you can post non MNF-specific Shorewall questions to the </b><a
|
||||||
|
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||||
|
list</a> or to the <a
|
||||||
|
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||||
|
Forum</a>. <b>Do not expect to get free MNF support on the list or forum.</b><br>
|
||||||
|
|
||||||
|
|
||||||
|
<p>Otherwise, please post your question or problem to the <a
|
||||||
|
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||||
|
list</a> or to the <a
|
||||||
|
href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support
|
||||||
|
Forum</a>.</p>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p>To Subscribe to the mailing list go to <a
|
||||||
|
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||||
|
.</p>
|
||||||
|
|
||||||
|
|
||||||
|
<p align="left"><font size="2">Last Updated 3/4/2003 - Tom Eastep</font></p>
|
||||||
|
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -1,332 +1,338 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Traffic Shaping</title>
|
<title>Traffic Shaping</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Traffic Shaping/Control</font></h1>
|
<h1 align="center"><font color="#ffffff">Traffic Shaping/Control</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="left">Shorewall has limited support for traffic shaping/control.
|
<p align="left">Shorewall has limited support for traffic shaping/control.
|
||||||
In order to use traffic shaping under Shorewall, it is essential that
|
In order to use traffic shaping under Shorewall, it is essential that
|
||||||
you get a copy of the <a href="http://ds9a.nl/lartc">Linux Advanced Routing
|
you get a copy of the <a href="http://ds9a.nl/lartc">Linux Advanced Routing
|
||||||
and Shaping HOWTO</a>, version 0.3.0 or later.</p>
|
and Shaping HOWTO</a>, version 0.3.0 or later.</p>
|
||||||
|
|
||||||
<p align="left">Shorewall traffic shaping support consists of the following:</p>
|
<p align="left">Shorewall traffic shaping support consists of the following:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf.
|
<li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf.
|
||||||
Traffic Shaping also requires that you enable packet mangling.</li>
|
Traffic Shaping also requires that you enable packet mangling.</li>
|
||||||
<li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added in
|
<li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added
|
||||||
Shorewall 1.3.13). When Traffic Shaping is enabled (TC_ENABLED=Yes), the
|
in Shorewall 1.3.13). When Traffic Shaping is enabled (TC_ENABLED=Yes),
|
||||||
setting of this variable determines whether Shorewall clears the traffic
|
the setting of this variable determines whether Shorewall clears the traffic
|
||||||
shaping configuration during Shorewall [re]start and Shorewall stop. <br>
|
shaping configuration during Shorewall [re]start and Shorewall stop. <br>
|
||||||
</li>
|
</li>
|
||||||
<li><b>/etc/shorewall/tcrules</b> - A file where you can
|
<li><b>/etc/shorewall/tcrules</b> - A file where you can
|
||||||
specify firewall marking of packets. The firewall mark value may
|
specify firewall marking of packets. The firewall mark value may
|
||||||
be used to classify packets for traffic shaping/control.<br>
|
be used to classify packets for traffic shaping/control.<br>
|
||||||
</li>
|
</li>
|
||||||
<li><b>/etc/shorewall/tcstart </b>- A user-supplied file
|
<li><b>/etc/shorewall/tcstart </b>- A user-supplied file
|
||||||
that is sourced by Shorewall during "shorewall start" and which
|
that is sourced by Shorewall during "shorewall start" and which
|
||||||
you can use to define your traffic shaping disciplines and classes.
|
you can use to define your traffic shaping disciplines and classes.
|
||||||
I have provided a <a
|
I have provided a <a
|
||||||
href="ftp://ftp.shorewall.net/pub/shorewall/cbq">sample</a> that does
|
href="ftp://ftp.shorewall.net/pub/shorewall/cbq">sample</a> that does
|
||||||
table-driven CBQ shaping but if you read the traffic shaping sections
|
table-driven CBQ shaping but if you read the traffic shaping sections
|
||||||
of the HOWTO mentioned above, you can probably code your own faster
|
of the HOWTO mentioned above, you can probably code your own faster
|
||||||
than you can learn how to use my sample. I personally use <a
|
than you can learn how to use my sample. I personally use <a
|
||||||
href="http://luxik.cdi.cz/%7Edevik/qos/htb/">HTB</a> (see below).
|
href="http://luxik.cdi.cz/%7Edevik/qos/htb/">HTB</a> (see below).
|
||||||
HTB support may eventually become an integral part of Shorewall
|
HTB support may eventually become an integral part of Shorewall
|
||||||
since HTB is a lot simpler and better-documented than CBQ. As of 2.4.20,
|
since HTB is a lot simpler and better-documented than CBQ. As of 2.4.20,
|
||||||
HTB is a standard part of the kernel but iproute2 must be patched in
|
HTB is a standard part of the kernel but iproute2 must be patched in
|
||||||
order to use it.<br>
|
order to use it.<br>
|
||||||
<br>
|
<br>
|
||||||
In tcstart, when you want to run the 'tc' utility, use
|
In tcstart, when you want to run the 'tc' utility, use
|
||||||
the run_tc function supplied by shorewall if you want tc errors
|
the run_tc function supplied by shorewall if you want tc errors
|
||||||
to stop the firewall.<br>
|
to stop the firewall.<br>
|
||||||
<br>
|
<br>
|
||||||
You can generally use off-the-shelf traffic shaping scripts by simply
|
You can generally use off-the-shelf traffic shaping scripts by
|
||||||
copying them to /etc/shorewall/tcstart. I use <a
|
simply copying them to /etc/shorewall/tcstart. I use <a
|
||||||
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (HTB version)
|
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (HTB version)
|
||||||
that way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart and
|
that way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart
|
||||||
modified it according to the Wonder Shaper README). <b>WARNING: </b>If
|
and modified it according to the Wonder Shaper README). <b>WARNING: </b>If
|
||||||
you use use Masquerading or SNAT (i.e., you only have one external IP address)
|
you use use Masquerading or SNAT (i.e., you only have one external IP address)
|
||||||
then listing internal hosts in the NOPRIOHOSTSRC variable in the wshaper[.htb]
|
then listing internal hosts in the NOPRIOHOSTSRC variable in the wshaper[.htb]
|
||||||
script won't work. Traffic shaping occurs after SNAT has already been applied
|
script won't work. Traffic shaping occurs after SNAT has already been
|
||||||
so when traffic shaping happens, all outbound traffic will have as a source
|
applied so when traffic shaping happens, all outbound traffic will have
|
||||||
address the IP addresss of your firewall's external interface.<br>
|
as a source address the IP addresss of your firewall's external interface.<br>
|
||||||
</li>
|
</li>
|
||||||
<li><b>/etc/shorewall/tcclear</b> - A user-supplied file
|
<li><b>/etc/shorewall/tcclear</b> - A user-supplied file
|
||||||
that is sourced by Shorewall when it is clearing traffic shaping.
|
that is sourced by Shorewall when it is clearing traffic shaping.
|
||||||
This file is normally not required as Shorewall's method of clearing
|
This file is normally not required as Shorewall's method of clearing
|
||||||
qdisc and filter definitions is pretty general.</li>
|
qdisc and filter definitions is pretty general.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Shorewall allows you to start traffic shaping when Shorewall itself starts
|
Shorewall allows you to start traffic shaping when Shorewall itself
|
||||||
or it allows you to bring up traffic shaping when you bring up your interfaces.<br>
|
starts or it allows you to bring up traffic shaping when you bring up your
|
||||||
<br>
|
interfaces.<br>
|
||||||
To start traffic shaping when Shorewall starts:<br>
|
<br>
|
||||||
|
To start traffic shaping when Shorewall starts:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
|
<li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
|
||||||
<li>Supply an /etc/shorewall/tcstart script to configure your traffic
|
<li>Supply an /etc/shorewall/tcstart script to configure your traffic
|
||||||
shaping rules.</li>
|
shaping rules.</li>
|
||||||
<li>Optionally supply an /etc/shorewall/tcclear script to stop traffic
|
<li>Optionally supply an /etc/shorewall/tcclear script to stop traffic
|
||||||
shaping. That is usually unnecessary.</li>
|
shaping. That is usually unnecessary.</li>
|
||||||
<li>If your tcstart script uses the 'fwmark' classifier, you can mark
|
<li>If your tcstart script uses the 'fwmark' classifier, you can
|
||||||
packets using entries in /etc/shorewall/tcrules.</li>
|
mark packets using entries in /etc/shorewall/tcrules.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
To start traffic shaping when you bring up your network interfaces, you
|
To start traffic shaping when you bring up your network interfaces,
|
||||||
will have to arrange for your traffic shaping configuration script to be
|
you will have to arrange for your traffic shaping configuration script to
|
||||||
run at that time. How you do that is distribution dependent and will not be
|
be run at that time. How you do that is distribution dependent and will not
|
||||||
covered here. You then should:<br>
|
be covered here. You then should:<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
|
<li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
|
||||||
<li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear
|
<li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear
|
||||||
scripts.</li>
|
scripts.</li>
|
||||||
<li value="4">If your tcstart script uses the 'fwmark' classifier,
|
<li value="4">If your tcstart script uses the 'fwmark' classifier,
|
||||||
you can mark packets using entries in /etc/shorewall/tcrules.</li>
|
you can mark packets using entries in /etc/shorewall/tcrules.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h3 align="left">Kernel Configuration</h3>
|
<h3 align="left">Kernel Configuration</h3>
|
||||||
|
|
||||||
<p align="left">This screen shot show how I've configured QoS in my Kernel:</p>
|
<p align="left">This screen shot show how I've configured QoS in my Kernel:</p>
|
||||||
|
|
||||||
<p align="center"><img border="0" src="images/QoS.png" width="590"
|
<p align="center"><img border="0" src="images/QoS.png" width="590"
|
||||||
height="764">
|
height="764">
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h3 align="left"><a name="tcrules"></a>/etc/shorewall/tcrules</h3>
|
<h3 align="left"><a name="tcrules"></a>/etc/shorewall/tcrules</h3>
|
||||||
|
|
||||||
<p align="left">The fwmark classifier provides a convenient way to classify
|
<p align="left">The fwmark classifier provides a convenient way to classify
|
||||||
packets for traffic shaping. The /etc/shorewall/tcrules file provides
|
packets for traffic shaping. The /etc/shorewall/tcrules file provides
|
||||||
a means for specifying these marks in a tabular fashion.<br>
|
a means for specifying these marks in a tabular fashion.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left">Normally, packet marking occurs in the PREROUTING chain before
|
<p align="left">Normally, packet marking occurs in the PREROUTING chain before
|
||||||
any address rewriting takes place. This makes it impossible to mark inbound
|
any address rewriting takes place. This makes it impossible to mark inbound
|
||||||
packets based on their destination address when SNAT or Masquerading are
|
packets based on their destination address when SNAT or Masquerading
|
||||||
being used. Beginning with Shorewall 1.3.12, you can cause packet marking
|
are being used. Beginning with Shorewall 1.3.12, you can cause packet
|
||||||
to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN option
|
marking to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN
|
||||||
in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="left">Columns in the file are as follows:</p>
|
<p align="left">Columns in the file are as follows:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>MARK - Specifies the mark value is to be assigned in
|
<li>MARK - Specifies the mark value is to be assigned in
|
||||||
case of a match. This is an integer in the range 1-255. Beginning
|
case of a match. This is an integer in the range 1-255. Beginning
|
||||||
with Shorewall version 1.3.14, this value may be optionally followed by
|
with Shorewall version 1.3.14, this value may be optionally followed by
|
||||||
":" and either 'F' or 'P' to designate that the marking will occur in the
|
":" and either 'F' or 'P' to designate that the marking will occur in the
|
||||||
FORWARD or PREROUTING chains respectively. If this additional specification
|
FORWARD or PREROUTING chains respectively. If this additional specification
|
||||||
is omitted, the chain used to mark packets will be determined by the setting
|
is omitted, the chain used to mark packets will be determined by the setting
|
||||||
of the MARK_IN_FORWARD_CHAIN option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
of the MARK_IN_FORWARD_CHAIN option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
|
||||||
<br>
|
<br>
|
||||||
Example - 5<br>
|
Example - 5<br>
|
||||||
</li>
|
</li>
|
||||||
<li>SOURCE - The source of the packet. If the packet originates
|
<li>SOURCE - The source of the packet. If the packet originates
|
||||||
on the firewall, place "fw" in this column. Otherwise, this is a
|
on the firewall, place "fw" in this column. Otherwise, this is a
|
||||||
comma-separated list of interface names, IP addresses, MAC addresses
|
comma-separated list of interface names, IP addresses, MAC addresses
|
||||||
in <a href="Documentation.htm#MAC">Shorewall Format</a> and/or Subnets.<br>
|
in <a href="Documentation.htm#MAC">Shorewall Format</a> and/or Subnets.<br>
|
||||||
<br>
|
<br>
|
||||||
Examples<br>
|
Examples<br>
|
||||||
eth0<br>
|
eth0<br>
|
||||||
192.168.2.4,192.168.1.0/24<br>
|
192.168.2.4,192.168.1.0/24<br>
|
||||||
</li>
|
</li>
|
||||||
<li>DEST -- Destination of the packet. Comma-separated list
|
<li>DEST -- Destination of the packet. Comma-separated
|
||||||
of IP addresses and/or subnets.<br>
|
list of IP addresses and/or subnets.<br>
|
||||||
</li>
|
</li>
|
||||||
<li>PROTO - Protocol - Must be the name of a protocol from
|
<li>PROTO - Protocol - Must be the name of a protocol from
|
||||||
/etc/protocol, a number or "all"<br>
|
/etc/protocol, a number or "all"<br>
|
||||||
</li>
|
</li>
|
||||||
<li>PORT(S) - Destination Ports. A comma-separated list of
|
<li>PORT(S) - Destination Ports. A comma-separated list
|
||||||
Port names (from /etc/services), port numbers or port ranges (e.g.,
|
of Port names (from /etc/services), port numbers or port ranges (e.g.,
|
||||||
21:22); if the protocol is "icmp", this column is interpreted as
|
21:22); if the protocol is "icmp", this column is interpreted
|
||||||
the destination icmp type(s).<br>
|
as the destination icmp type(s).<br>
|
||||||
</li>
|
</li>
|
||||||
<li>CLIENT PORT(S) - (Optional) Port(s) used by the client.
|
<li>CLIENT PORT(S) - (Optional) Port(s) used by the client.
|
||||||
If omitted, any source port is acceptable. Specified as a comma-separate
|
If omitted, any source port is acceptable. Specified as a comma-separate
|
||||||
list of port names, port numbers or port ranges.</li>
|
list of port names, port numbers or port ranges.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p align="left">Example 1 - All packets arriving on eth1 should be marked
|
<p align="left">Example 1 - All packets arriving on eth1 should be marked
|
||||||
with 1. All packets arriving on eth2 and eth3 should be marked with
|
with 1. All packets arriving on eth2 and eth3 should be marked with
|
||||||
2. All packets originating on the firewall itself should be marked with
|
2. All packets originating on the firewall itself should be marked with
|
||||||
3.</p>
|
3.</p>
|
||||||
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>MARK</b></td>
|
<td><b>MARK</b></td>
|
||||||
<td><b>SOURCE</b></td>
|
<td><b>SOURCE</b></td>
|
||||||
<td><b>DEST</b></td>
|
<td><b>DEST</b></td>
|
||||||
<td><b>PROTO</b></td>
|
<td><b>PROTO</b></td>
|
||||||
<td><b>PORT(S)</b></td>
|
<td><b>PORT(S)</b></td>
|
||||||
<td><b>CLIENT PORT(S)</b></td>
|
<td><b>CLIENT PORT(S)</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>1</td>
|
<td>1</td>
|
||||||
<td>eth1</td>
|
<td>eth1</td>
|
||||||
<td>0.0.0.0/0</td>
|
<td>0.0.0.0/0</td>
|
||||||
<td>all</td>
|
<td>all</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>2</td>
|
<td>2</td>
|
||||||
<td>eth2</td>
|
<td>eth2</td>
|
||||||
<td>0.0.0.0/0</td>
|
<td>0.0.0.0/0</td>
|
||||||
<td>all</td>
|
<td>all</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td valign="top">2<br>
|
<td valign="top">2<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">eth3<br>
|
<td valign="top">eth3<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">0.0.0.0/0<br>
|
<td valign="top">0.0.0.0/0<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">all<br>
|
<td valign="top">all<br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><br>
|
<td valign="top"><br>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top"><br>
|
<td valign="top"><br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>3</td>
|
<td>3</td>
|
||||||
<td>fw</td>
|
<td>fw</td>
|
||||||
<td>0.0.0.0/0</td>
|
<td>0.0.0.0/0</td>
|
||||||
<td>all</td>
|
<td>all</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="left">Example 2 - All GRE (protocol 47) packets not originating
|
<p align="left">Example 2 - All GRE (protocol 47) packets not originating
|
||||||
on the firewall and destined for 155.186.235.151 should be marked with
|
on the firewall and destined for 155.186.235.151 should be marked with
|
||||||
12.</p>
|
12.</p>
|
||||||
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>MARK</b></td>
|
<td><b>MARK</b></td>
|
||||||
<td><b>SOURCE</b></td>
|
<td><b>SOURCE</b></td>
|
||||||
<td><b>DEST</b></td>
|
<td><b>DEST</b></td>
|
||||||
<td><b>PROTO</b></td>
|
<td><b>PROTO</b></td>
|
||||||
<td><b>PORT(S)</b></td>
|
<td><b>PORT(S)</b></td>
|
||||||
<td><b>CLIENT PORT(S)</b></td>
|
<td><b>CLIENT PORT(S)</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>12</td>
|
<td>12</td>
|
||||||
<td>0.0.0.0/0</td>
|
<td>0.0.0.0/0</td>
|
||||||
<td>155.186.235.151</td>
|
<td>155.186.235.151</td>
|
||||||
<td>47</td>
|
<td>47</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="left">Example 3 - All SSH packets originating in 192.168.1.0/24
|
<p align="left">Example 3 - All SSH packets originating in 192.168.1.0/24
|
||||||
and destined for 155.186.235.151 should be marked with 22.</p>
|
and destined for 155.186.235.151 should be marked with 22.</p>
|
||||||
|
|
||||||
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
<table border="2" cellpadding="2" style="border-collapse: collapse;">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td><b>MARK</b></td>
|
<td><b>MARK</b></td>
|
||||||
<td><b>SOURCE</b></td>
|
<td><b>SOURCE</b></td>
|
||||||
<td><b>DEST</b></td>
|
<td><b>DEST</b></td>
|
||||||
<td><b>PROTO</b></td>
|
<td><b>PROTO</b></td>
|
||||||
<td><b>PORT(S)</b></td>
|
<td><b>PORT(S)</b></td>
|
||||||
<td><b>CLIENT PORT(S)</b></td>
|
<td><b>CLIENT PORT(S)</b></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td>22</td>
|
<td>22</td>
|
||||||
<td>192.168.1.0/24</td>
|
<td>192.168.1.0/24</td>
|
||||||
<td>155.186.235.151</td>
|
<td>155.186.235.151</td>
|
||||||
<td>tcp</td>
|
<td>tcp</td>
|
||||||
<td>22</td>
|
<td>22</td>
|
||||||
<td> </td>
|
<td> </td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h3>My Setup<br>
|
<h3>My Setup<br>
|
||||||
</h3>
|
</h3>
|
||||||
|
|
||||||
<p>While I am currently using the HTB version of <a
|
<p>While I am currently using the HTB version of <a
|
||||||
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (I just copied
|
href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (I just copied
|
||||||
wshaper.htb to <b>/etc/shorewall/tcstart</b> and modified it as shown
|
wshaper.htb to <b>/etc/shorewall/tcstart</b> and modified it as shown
|
||||||
in the Wondershaper README), I have also run with the following set of
|
in the Wondershaper README), I have also run with the following set of
|
||||||
hand-crafted rules in my <b>/etc/shorewall/tcstart</b> file:<br>
|
hand-crafted rules in my <b>/etc/shorewall/tcstart</b> file:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre>run_tc qdisc add dev eth0 root handle 1: htb default 30<br><br>run_tc class add dev eth0 parent 1: classid 1:1 htb rate 384kbit burst 15k<br><br>echo " Added Top Level Class -- rate 384kbit"</pre>
|
<pre>run_tc qdisc add dev eth0 root handle 1: htb default 30<br><br>run_tc class add dev eth0 parent 1: classid 1:1 htb rate 384kbit burst 15k<br><br>echo " Added Top Level Class -- rate 384kbit"</pre>
|
||||||
|
|
||||||
<pre>run_tc class add dev eth0 parent 1:1 classid 1:10 htb rate 140kbit ceil 384kbit burst 15k prio 1<br>run_tc class add dev eth0 parent 1:1 classid 1:20 htb rate 224kbit ceil 384kbit burst 15k prio 0<br>run_tc class add dev eth0 parent 1:1 classid 1:30 htb rate 20kbit ceil 384kbit burst 15k quantum 1500 prio 1</pre>
|
<pre>run_tc class add dev eth0 parent 1:1 classid 1:10 htb rate 140kbit ceil 384kbit burst 15k prio 1<br>run_tc class add dev eth0 parent 1:1 classid 1:20 htb rate 224kbit ceil 384kbit burst 15k prio 0<br>run_tc class add dev eth0 parent 1:1 classid 1:30 htb rate 20kbit ceil 384kbit burst 15k quantum 1500 prio 1</pre>
|
||||||
|
|
||||||
<pre>echo " Added Second Level Classes -- rates 140kbit, 224kbit, 20kbit"</pre>
|
<pre>echo " Added Second Level Classes -- rates 140kbit, 224kbit, 20kbit"</pre>
|
||||||
|
|
||||||
<pre>run_tc qdisc add dev eth0 parent 1:10 pfifo limit 5<br>run_tc qdisc add dev eth0 parent 1:20 pfifo limit 10<br>run_tc qdisc add dev eth0 parent 1:30 pfifo limit 5</pre>
|
<pre>run_tc qdisc add dev eth0 parent 1:10 pfifo limit 5<br>run_tc qdisc add dev eth0 parent 1:20 pfifo limit 10<br>run_tc qdisc add dev eth0 parent 1:30 pfifo limit 5</pre>
|
||||||
|
|
||||||
<pre>echo " Enabled PFIFO on Second Level Classes"</pre>
|
<pre>echo " Enabled PFIFO on Second Level Classes"</pre>
|
||||||
|
|
||||||
<pre>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:10<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 0 handle 2 fw classid 1:20<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 3 fw classid 1:30</pre>
|
<pre>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:10<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 0 handle 2 fw classid 1:20<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 3 fw classid 1:30</pre>
|
||||||
|
|
||||||
<pre>echo " Defined fwmark filters"<br></pre>
|
<pre>echo " Defined fwmark filters"<br></pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<p>My tcrules file that went with this tcstart file is shown in Example 1
|
<p>My tcrules file that went with this tcstart file is shown in Example 1
|
||||||
above.<br>
|
above. You can look at <a href="myfiles.htm">my configuration</a> to
|
||||||
</p>
|
see why I wanted shaping of this type.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>I wanted to allow up to 140kbits/second for traffic outbound
|
<li>I wanted to allow up to 140kbits/second for traffic outbound
|
||||||
from my DMZ (note that the ceiling is set to 384kbit so outbound DMZ traffic
|
from my DMZ (note that the ceiling is set to 384kbit so outbound DMZ traffic
|
||||||
can use all available bandwidth if there is no traffic from the local
|
can use all available bandwidth if there is no traffic from the local
|
||||||
systems or from my laptop or firewall).</li>
|
systems or from my laptop or firewall).</li>
|
||||||
<li>My laptop and local systems could use up to 224kbits/second.</li>
|
<li>My laptop and local systems could use up to 224kbits/second.</li>
|
||||||
<li>My firewall could use up to 20kbits/second.<br>
|
<li>My firewall could use up to 20kbits/second.</li>
|
||||||
</li>
|
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
You see <a href="myfiles.htm">the rest of my Shorewall configuration</a>
|
||||||
|
to see how this fit in. <br>
|
||||||
|
|
||||||
|
<p><font size="2">Last Updated 3/5/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><font size="2">Last Updated 2/18/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -1,300 +1,306 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Upgrade Issues</title>
|
<title>Upgrade Issues</title>
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
<h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p>For upgrade instructions see the <a
|
<p>For upgrade instructions see the <a
|
||||||
href="Install.htm">Install/Upgrade page</a>.</p>
|
href="Install.htm">Install/Upgrade page</a>.</p>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<h3>Version >= 1.4.0</h3>
|
<h3>Version >= 1.4.0</h3>
|
||||||
<b>IMPORTANT: Shorewall >=1.4.0 <u>REQUIRES</u></b> <b>the iproute package
|
<b>IMPORTANT: Shorewall >=1.4.0 <u>REQUIRES</u></b> <b>the iproute package
|
||||||
('ip' utility).</b><br>
|
('ip' utility).</b><br>
|
||||||
<br>
|
<br>
|
||||||
If you are upgrading from a version < 1.4.0, then:<br>
|
If you are upgrading from a version < 1.4.0, then:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>The <b>noping </b>and <b>forwardping</b> interface options are no
|
<li>The <b>noping </b>and <b>forwardping</b> interface options are
|
||||||
longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
no longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
|
||||||
ICMP echo-request (ping) packets are treated just like any other connection
|
ICMP echo-request (ping) packets are treated just like any other connection
|
||||||
request and are subject to rules and policies.</li>
|
request and are subject to rules and policies.</li>
|
||||||
<li>Interface names of the form <device>:<integer> in /etc/shorewall/interfaces
|
<li>Interface names of the form <device>:<integer> in
|
||||||
now generate a Shorewall error at startup (they always have produced warnings
|
/etc/shorewall/interfaces now generate a Shorewall error at startup (they
|
||||||
in iptables).</li>
|
always have produced warnings in iptables).</li>
|
||||||
<li>The MERGE_HOSTS variable has been removed from shorewall.conf. Shorewall
|
<li>The MERGE_HOSTS variable has been removed from shorewall.conf.
|
||||||
1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone contents are
|
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone contents
|
||||||
determined by BOTH the interfaces and hosts files when there are entries for
|
are determined by BOTH the interfaces and hosts files when there are entries
|
||||||
the zone in both files.</li>
|
for the zone in both files.</li>
|
||||||
<li>The <b>routestopped</b> option in the interfaces and hosts file
|
<li>The <b>routestopped</b> option in the interfaces and hosts file
|
||||||
has been eliminated; use entries in the routestopped file instead.</li>
|
has been eliminated; use entries in the routestopped file instead.</li>
|
||||||
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer
|
<li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer
|
||||||
accepted; you must convert to using the new syntax.</li>
|
accepted; you must convert to using the new syntax.</li>
|
||||||
<li value="6">The ALLOWRELATED variable in shorewall.conf is no longer
|
<li value="6">The ALLOWRELATED variable in shorewall.conf is no longer
|
||||||
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.</li>
|
||||||
<li value="6">Late-arriving DNS replies are not dropped by default;
|
<li value="6">Late-arriving DNS replies are not dropped by default;
|
||||||
there is no need for your own /etc/shorewall/common file simply to avoid
|
there is no need for your own /etc/shorewall/common file simply to avoid
|
||||||
logging these packets.</li>
|
logging these packets.</li>
|
||||||
<li value="6">The 'firewall', 'functions' and 'version' file have been
|
<li value="6">The 'firewall', 'functions' and 'version' file have been
|
||||||
moved to /usr/share/shorewall.</li>
|
moved to /usr/share/shorewall.</li>
|
||||||
<li value="6">The icmp.def file has been removed. If you include it from
|
<li value="6">The icmp.def file has been removed. If you include it
|
||||||
/etc/shorewall/icmpdef, you will need to modify that file.</li>
|
from /etc/shorewall/icmpdef, you will need to modify that file.</li>
|
||||||
<li value="8">The 'multi' interface option is no longer supported. Shorewall
|
<li value="8">The 'multi' interface option is no longer supported. Shorewall
|
||||||
will generate rules for sending packets back out the same interface that
|
will generate rules for sending packets back out the same interface that
|
||||||
they arrived on in two cases:</li>
|
they arrived on in two cases:</li>
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>There is an <u>explicit</u> policy for the source zone to or from
|
|
||||||
the destination zone. An explicit policy names both zones and does not use
|
|
||||||
the 'all' reserved word.</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>There are one or more rules for traffic for the source zone to or
|
|
||||||
from the destination zone including rules that use the 'all' reserved word.
|
|
||||||
Exception: if the source zone and destination zone are the same then the
|
|
||||||
rule must be explicit - it must name the zone in both the SOURCE and DESTINATION
|
|
||||||
columns.</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>Version >= 1.3.14</h3>
|
|
||||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
|
||||||
Beginning in version 1.3.14, Shorewall treats entries in <a
|
|
||||||
href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change
|
|
||||||
involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second)
|
|
||||||
<b>column</b>:<br>
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet on the
|
|
||||||
interface (as shown by "ip addr show <i>interface</i>") and would masquerade
|
|
||||||
traffic from that subnet. Any other subnets that routed through eth1 needed
|
|
||||||
their own entry in /etc/shorewall/masq to be masqueraded or to have SNAT
|
|
||||||
applied.</li>
|
|
||||||
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
|
||||||
routing table to determine ALL subnets routed through the named interface.
|
|
||||||
Traffic originating in ANY of those subnets is masqueraded or has SNAT applied.</li>
|
|
||||||
|
|
||||||
</ul>
|
|
||||||
You will need to make a change to your configuration if:<br>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>You have one or more entries in /etc/shorewall/masq with an interface
|
|
||||||
name in the SUBNET (second) column; and</li>
|
|
||||||
<li>That interface connects to more than one subnetwork.</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
Two examples:<br>
|
|
||||||
<br>
|
|
||||||
<b>Example 1</b> -- Suppose that your current config is as follows:<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
|
||||||
|
|
||||||
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
|
||||||
required.<br>
|
|
||||||
</blockquote>
|
|
||||||
<b>Example 2</b>-- What if your current configuration is like this?<br>
|
|
||||||
|
|
||||||
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
|
||||||
|
|
||||||
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
|
||||||
to:<br>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
|
||||||
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
|
||||||
Version 1.3.14 also introduced simplified ICMP echo-request (ping)
|
|
||||||
handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
|
||||||
is used to specify that the old (pre-1.3.14) ping handling is to be used
|
|
||||||
(If the option is not set in your /etc/shorewall/shorewall.conf then OLD_PING_HANDLING=Yes
|
|
||||||
is assumed). I don't plan on supporting the old handling indefinitely so
|
|
||||||
I urge current users to migrate to using the new handling as soon as possible.
|
|
||||||
See the <a href="ping.html">'Ping' handling documentation</a> for details.<br>
|
|
||||||
|
|
||||||
<h3>Version 1.3.10</h3>
|
<ul>
|
||||||
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading to
|
<li>There is an <u>explicit</u> policy for the source zone to or from
|
||||||
version 1.3.10, you will need to use the '--force' option:<br>
|
the destination zone. An explicit policy names both zones and does not use
|
||||||
<br>
|
the 'all' reserved word.</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>There are one or more rules for traffic for the source zone to
|
||||||
|
or from the destination zone including rules that use the 'all' reserved
|
||||||
|
word. Exception: if the source zone and destination zone are the same then
|
||||||
|
the rule must be explicit - it must name the zone in both the SOURCE and
|
||||||
|
DESTINATION columns.</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
<li>If you followed the advice in FAQ #2 and call find_interface_address
|
||||||
|
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h3>Version >= 1.3.14</h3>
|
||||||
|
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||||
|
Beginning in version 1.3.14, Shorewall treats entries in <a
|
||||||
|
href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. The change
|
||||||
|
involves entries with an <b>interface name</b> in the <b>SUBNET</b> (second)
|
||||||
|
<b>column</b>:<br>
|
||||||
|
|
||||||
<blockquote>
|
<ul>
|
||||||
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
<li>Prior to 1.3.14, Shorewall would detect the FIRST subnet on the
|
||||||
|
interface (as shown by "ip addr show <i>interface</i>") and would masquerade
|
||||||
|
traffic from that subnet. Any other subnets that routed through eth1 needed
|
||||||
|
their own entry in /etc/shorewall/masq to be masqueraded or to have SNAT
|
||||||
|
applied.</li>
|
||||||
|
<li>Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
|
||||||
|
routing table to determine ALL subnets routed through the named interface.
|
||||||
|
Traffic originating in ANY of those subnets is masqueraded or has SNAT
|
||||||
|
applied.</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
You will need to make a change to your configuration if:<br>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>You have one or more entries in /etc/shorewall/masq with an interface
|
||||||
|
name in the SUBNET (second) column; and</li>
|
||||||
|
<li>That interface connects to more than one subnetwork.</li>
|
||||||
|
|
||||||
|
</ol>
|
||||||
|
Two examples:<br>
|
||||||
|
<br>
|
||||||
|
<b>Example 1</b> -- Suppose that your current config is as follows:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<pre> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS<br> eth0 eth2 206.124.146.176<br> eth0 192.168.10.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254<br> [root@gateway test]#</pre>
|
||||||
|
|
||||||
|
<blockquote>In this case, the second entry in /etc/shorewall/masq is no longer
|
||||||
|
required.<br>
|
||||||
|
</blockquote>
|
||||||
|
<b>Example 2</b>-- What if your current configuration is like this?<br>
|
||||||
|
|
||||||
|
<pre> [root@gateway test]# cat /etc/shorewall/masq <br> #INTERFACE SUBNET ADDRESS <br> eth0 eth2 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE <br> [root@gateway test]# ip route show dev eth2 <br> 192.168.1.0/24 scope link<br> 192.168.10.0/24 proto kernel scope link src 192.168.10.254 <br> [root@gateway test]#</pre>
|
||||||
|
|
||||||
|
<blockquote>In this case, you would want to change the entry in /etc/shorewall/masq
|
||||||
|
to:<br>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
<pre> #INTERFACE SUBNET ADDRESS <br> eth0 192.168.1.0/24 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||||
|
<img src="images/BD21298_3.gif" alt="" width="13" height="13">
|
||||||
|
Version 1.3.14 also introduced simplified ICMP echo-request (ping)
|
||||||
|
handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
|
||||||
|
is used to specify that the old (pre-1.3.14) ping handling is to be used
|
||||||
|
(If the option is not set in your /etc/shorewall/shorewall.conf then OLD_PING_HANDLING=Yes
|
||||||
|
is assumed). I don't plan on supporting the old handling indefinitely so
|
||||||
|
I urge current users to migrate to using the new handling as soon as possible.
|
||||||
|
See the <a href="ping.html">'Ping' handling documentation</a> for details.<br>
|
||||||
|
|
||||||
|
<h3>Version 1.3.10</h3>
|
||||||
|
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
|
||||||
|
to version 1.3.10, you will need to use the '--force' option:<br>
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
<pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
|
||||||
|
</blockquote>
|
||||||
|
|
||||||
<h3>Version >= 1.3.9</h3>
|
<h3>Version >= 1.3.9</h3>
|
||||||
The 'functions' file has moved to /usr/lib/shorewall/functions. If
|
The 'functions' file has moved to /usr/lib/shorewall/functions.
|
||||||
you have an application that uses functions from that file, your application
|
If you have an application that uses functions from that file, your application
|
||||||
will need to be changed to reflect this change of location.<br>
|
will need to be changed to reflect this change of location.<br>
|
||||||
|
|
||||||
<h3>Version >= 1.3.8</h3>
|
<h3>Version >= 1.3.8</h3>
|
||||||
|
|
||||||
<p>If you have a pair of firewall systems configured for failover
|
<p>If you have a pair of firewall systems configured for failover
|
||||||
or if you have asymmetric routing, you will need to modify
|
or if you have asymmetric routing, you will need to modify
|
||||||
your firewall setup slightly under Shorewall
|
your firewall setup slightly under Shorewall
|
||||||
versions >= 1.3.8. Beginning with version 1.3.8,
|
versions >= 1.3.8. Beginning with version 1.3.8,
|
||||||
you must set NEWNOTSYN=Yes in your
|
you must set NEWNOTSYN=Yes in your
|
||||||
/etc/shorewall/shorewall.conf file.</p>
|
/etc/shorewall/shorewall.conf file.</p>
|
||||||
|
|
||||||
<h3>Version >= 1.3.7</h3>
|
<h3>Version >= 1.3.7</h3>
|
||||||
|
|
||||||
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
<p>Users specifying ALLOWRELATED=No in /etc/shorewall.conf
|
||||||
will need to include the following rules
|
will need to include the following rules
|
||||||
in their /etc/shorewall/icmpdef file (creating
|
in their /etc/shorewall/icmpdef file (creating
|
||||||
this file if necessary):</p>
|
this file if necessary):</p>
|
||||||
|
|
||||||
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
<pre> run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br> run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
|
||||||
|
|
||||||
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
<p>Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
|
||||||
command from that file since the icmp.def file is now empty.</p>
|
command from that file since the icmp.def file is now empty.</p>
|
||||||
|
|
||||||
<h3><b><a name="Bering">Upgrading </a>Bering to
|
<h3><b><a name="Bering">Upgrading </a>Bering to
|
||||||
Shorewall >= 1.3.3</b></h3>
|
Shorewall >= 1.3.3</b></h3>
|
||||||
|
|
||||||
<p>To properly upgrade with Shorewall version
|
<p>To properly upgrade with Shorewall version
|
||||||
1.3.3 and later:</p>
|
1.3.3 and later:</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Be sure you have a backup
|
<li>Be sure you have a backup
|
||||||
-- you will need to transcribe any Shorewall
|
-- you will need to transcribe any Shorewall
|
||||||
configuration changes that you have made
|
configuration changes that you have
|
||||||
to the new configuration.</li>
|
made to the new configuration.</li>
|
||||||
<li>Replace the shorwall.lrp package
|
<li>Replace the shorwall.lrp
|
||||||
provided on the Bering floppy with the
|
package provided on the Bering floppy
|
||||||
later one. If you did not obtain the later
|
with the later one. If you did not obtain
|
||||||
version from Jacques's site, see additional
|
the later version from Jacques's site,
|
||||||
instructions below.</li>
|
see additional instructions below.</li>
|
||||||
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
<li>Edit the /var/lib/lrpkg/root.exclude.list
|
||||||
file and remove the /var/lib/shorewall
|
file and remove the /var/lib/shorewall
|
||||||
entry if present. Then do not forget
|
entry if present. Then do not forget
|
||||||
to backup root.lrp !</li>
|
to backup root.lrp !</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
<p>The .lrp that I release isn't set up for a two-interface firewall like
|
||||||
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
Jacques's. You need to follow the <a href="two-interface.htm">instructions
|
||||||
for setting up a two-interface firewall</a> plus you also need to
|
for setting up a two-interface firewall</a> plus you also need to add
|
||||||
add the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
the following two Bering-specific rules to /etc/shorewall/rules:</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
<pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
<h3 align="left">Version 1.3.6 and 1.3.7</h3>
|
||||||
|
|
||||||
<p align="left">If you have a pair of firewall systems configured for
|
<p align="left">If you have a pair of firewall systems configured for
|
||||||
failover or if you have asymmetric routing, you will need to modify
|
failover or if you have asymmetric routing, you will need to modify
|
||||||
your firewall setup slightly under Shorewall versions 1.3.6
|
your firewall setup slightly under Shorewall versions 1.3.6
|
||||||
and 1.3.7</p>
|
and 1.3.7</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>
|
<li>
|
||||||
|
|
||||||
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
<p align="left">Create the file /etc/shorewall/newnotsyn and in it add
|
||||||
the following rule<br>
|
the following rule<br>
|
||||||
<br>
|
<br>
|
||||||
<font face="Courier">run_iptables -A newnotsyn -j RETURN
|
<font face="Courier">run_iptables -A newnotsyn -j RETURN
|
||||||
# So that the connection tracking table can be rebuilt<br>
|
# So that the connection tracking table can be rebuilt<br>
|
||||||
# from non-SYN
|
# from non-SYN
|
||||||
packets after takeover.<br>
|
packets after takeover.<br>
|
||||||
</font> </p>
|
</font> </p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
|
|
||||||
<p align="left">Create /etc/shorewall/common (if you don't already
|
<p align="left">Create /etc/shorewall/common (if you don't already
|
||||||
have that file) and include the following:<br>
|
have that file) and include the following:<br>
|
||||||
<br>
|
<br>
|
||||||
<font face="Courier">run_iptables -A common -p tcp --tcp-flags
|
<font face="Courier">run_iptables -A common -p tcp
|
||||||
ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection<br>
|
--tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild
|
||||||
|
connection<br>
|
||||||
|
|
||||||
#tracking table. <br>
|
#tracking table. <br>
|
||||||
. /etc/shorewall/common.def</font> </p>
|
. /etc/shorewall/common.def</font> </p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h3 align="left">Versions >= 1.3.5</h3>
|
<h3 align="left">Versions >= 1.3.5</h3>
|
||||||
|
|
||||||
<p align="left">Some forms of pre-1.3.0 rules file syntax are no
|
<p align="left">Some forms of pre-1.3.0 rules file syntax are no
|
||||||
longer supported. </p>
|
longer supported. </p>
|
||||||
|
|
||||||
<p align="left">Example 1:</p>
|
<p align="left">Example 1:</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
<pre> ACCEPT net loc:192.168.1.12:22 tcp 11111 - all</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p align="left">Must be replaced with:</p>
|
<p align="left">Must be replaced with:</p>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
<pre> DNAT net loc:192.168.1.12:22 tcp 11111</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Example 2:</p>
|
<p align="left">Example 2:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
<pre> ACCEPT loc fw::3128 tcp 80 - all</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<p align="left">Must be replaced with:</p>
|
<p align="left">Must be replaced with:</p>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre> REDIRECT loc 3128 tcp 80</pre>
|
<pre> REDIRECT loc 3128 tcp 80</pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<h3 align="left">Version >= 1.3.2</h3>
|
<h3 align="left">Version >= 1.3.2</h3>
|
||||||
|
|
||||||
<p align="left">The functions and versions files together with the
|
<p align="left">The functions and versions files together with the
|
||||||
'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
|
||||||
If you have applications that access these files, those applications
|
If you have applications that access these files, those applications
|
||||||
should be modified accordingly.</p>
|
should be modified accordingly.</p>
|
||||||
|
|
||||||
<p><font size="2"> Last updated 2/14/2003 -
|
<p><font size="2"> Last updated 3/6/2003 -
|
||||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user