Documentation Updates

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1966 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall-docs2/Documentation_Index.xml

@@ -15,7 +15,7 @@
       </author>
     </authorgroup>
 
-    <pubdate>2005-01-19</pubdate>
+    <pubdate>2005-02-19</pubdate>
 
     <copyright>
       <year>2001-2005</year>
@@ -447,6 +447,11 @@
       url="shorewall_prerequisites.htm">Requirements</ulink></para>
     </listitem>
 
+    <listitem>
+      <para><ulink url="Shorewall_and_Routing.html">Routing and
+      Shorewall</ulink></para>
+    </listitem>
+
     <listitem>
       <para><ulink url="Multiple_Zones.html">Routing on One
       Interface</ulink></para>
@@ -663,4 +668,4 @@
       Creation</ulink></para>
     </listitem>
   </orderedlist>
-</article>
+</article>

Shorewall-docs2/IPSEC-2.6.xml

@@ -15,7 +15,7 @@
       </author>
     </authorgroup>
 
-    <pubdate>2005-02-17</pubdate>
+    <pubdate>2005-02-19</pubdate>
 
     <copyright>
       <year>2004</year>
@@ -42,7 +42,8 @@
     and you must be running Shorewall 2.1.5 or later (with Shorewall 2.2.0
     Beta 1 or later recommended). The Netfilter patches are available from
     Netfilter Patch-O-Matic-NG and are also included in some commercial
-    distributions (most notably <trademark>SuSE</trademark> 9.1).</para>
+    distributions (most notably <trademark>SuSE</trademark> 9.1 and
+    9.2).</para>
   </warning>
 
   <important>

Shorewall-docs2/OPENVPN.xml

@@ -21,7 +21,7 @@
       </author>
     </authorgroup>
 
-    <pubdate>2005-01-29</pubdate>
+    <pubdate>2005-02-08</pubdate>
 
     <copyright>
       <year>2003</year>
@@ -52,7 +52,7 @@
   Source project and is <ulink
   url="http://openvpn.sourceforge.net/license.html">licensed under the
   GPL</ulink>. OpenVPN can be downloaded from <ulink
-  url="http://openvpn.sourceforge.net/">http://openvpn.sourceforge.net/</ulink>.</para>
+  url="http://openvpn.net/">http://openvpn.net/</ulink>.</para>
 
   <para>OpenVPN support was added to Shorewall in version 1.3.14.</para>
 

Shorewall-docs2/Shorewall_Doesnt.xml

@@ -13,13 +13,15 @@
       <surname>Eastep</surname>
     </author>
 
-    <pubdate>2004-11-14</pubdate>
+    <pubdate>2005-02-20</pubdate>
 
     <copyright>
       <year>2003</year>
 
       <year>2004</year>
 
+      <year>2005</year>
+
       <holder>Thomas M Eastep</holder>
     </copyright>
 
@@ -48,6 +50,11 @@
         2.4.0)</para>
       </listitem>
 
+      <listitem>
+        <para>Act as a Proxy (although it can be used with a separate proxy
+        such as Squid or Socks).</para>
+      </listitem>
+
       <listitem>
         <para>Do content filtering:</para>
 

Shorewall-docs2/Shorewall_and_Routing.xml

@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+<article>
+  <!--$Id$-->
+
+  <articleinfo>
+    <title>Shorewall and Routing</title>
+
+    <authorgroup>
+      <author>
+        <firstname>Tom</firstname>
+
+        <surname>Eastep</surname>
+      </author>
+    </authorgroup>
+
+    <pubdate>2005-02-19</pubdate>
+
+    <copyright>
+      <year>2005</year>
+
+      <holder>Thomas M. Eastep</holder>
+    </copyright>
+
+    <legalnotice>
+      <para>Permission is granted to copy, distribute and/or modify this
+      document under the terms of the GNU Free Documentation License, Version
+      1.2 or any later version published by the Free Software Foundation; with
+      no Invariant Sections, with no Front-Cover, and with no Back-Cover
+      Texts. A copy of the license is included in the section entitled
+      <quote><ulink url="GnuCopyright.htm">GNU Free Documentation
+      License</ulink></quote>.</para>
+    </legalnotice>
+  </articleinfo>
+
+  <section>
+    <title>Routing vs. Firewalling.</title>
+
+    <para>One of the most misunderstood aspects of Shorewall is its
+    releationship with routing. This article attempts to clear some of the fog
+    that surrounds this issue.</para>
+
+    <para>As a general principle:</para>
+
+    <orderedlist>
+      <listitem>
+        <para>Routing determines where packets are to be sent.</para>
+      </listitem>
+
+      <listitem>
+        <para>Once routing determines where the packet is to go, the firewall
+        (Shorewall) determines if the packet is allowed to go there.</para>
+      </listitem>
+    </orderedlist>
+
+    <para>There are ways that Shorewall can affect routing which are described
+    in the following sections.</para>
+  </section>
+
+  <section>
+    <title>Routing and Netfilter</title>
+
+    <para>The following diagram shows the relationship between routing
+    decisions and Netfilter.</para>
+
+    <graphic fileref="images/Netfilter.png" />
+
+    <para>The light blue boxes indicate where routing decisions are made. The
+    green boxes show where Netfilter processing takes place (as directed by
+    Shorewall). You will notice that there are two different paths through
+    this maze, depending on where the packet originates. We will look at each
+    of these separately.</para>
+
+    <section>
+      <title>Packets Entering the Firewall from Outside</title>
+
+      <para>When a packet arrives from outside, it first undergoes Netfilter
+      PREROUTING processing. In Shorewall terms:</para>
+
+      <orderedlist>
+        <listitem>
+          <para>Packets may be marked using entries in the <ulink
+          url="???">/etc/shorewall/tcrules</ulink> file. Entries in that file
+          containing ":P" in the mark column are applied here as are rules
+          that default to the MARK_IN_FORWARD_CHAIN=No setting in
+          <filename>/etc/shorewall/shorewall.conf</filename>. These marks may
+          be used to specify that the packet should be routed using an
+          <firstterm>alternate routing table</firstterm>; see the <ulink
+          url="Shorewall_Squid_Usage.html">Shorewall Squid
+          documentation</ulink> for examples.</para>
+        </listitem>
+
+        <listitem>
+          <para>The destination IP address may be rewritten as a consequence
+          of:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para>DNAT[-] rules.</para>
+            </listitem>
+
+            <listitem>
+              <para>REDIRECT[-] rules.</para>
+            </listitem>
+
+            <listitem>
+              <para>Entries in <filename>/etc/shorewall/nat</filename>.</para>
+            </listitem>
+          </itemizedlist>
+        </listitem>
+      </orderedlist>
+
+      <para>So the only influence that Shorewall has over where these packets
+      go is via NAT or by marking them so that they may be routed using an
+      alternate routing table.</para>
+    </section>
+
+    <section>
+      <title>Packets Originating on the Firewall</title>
+
+      <para>Processing of packets that originate on the firewall itself are
+      initially routed using the default routing table then passed through the
+      OUTPUT chains. Shorewall can influence what happens here:</para>
+
+      <orderedlist>
+        <listitem>
+          <para>Packets may be marked using entries in the <ulink
+          url="???">/etc/shorewall/tcrules</ulink> file (rules with "$FW" in
+          the SOURCE column). These marks may be used to specify that the
+          packet should be re-routed using an alternate routing table.</para>
+        </listitem>
+
+        <listitem>
+          <para>The destination IP address may be rewritten as a consequence
+          of:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para>DNAT[-] rules that specify $FW as the SOURCE.</para>
+            </listitem>
+
+            <listitem>
+              <para>Entries in <filename>/etc/shorewall/nat</filename> that
+              have "Yes" in LOCAL column.</para>
+            </listitem>
+          </itemizedlist>
+        </listitem>
+      </orderedlist>
+
+      <para>So again in this case, the only influence that Shorewall has over
+      the packet destination is NAT or marking.</para>
+    </section>
+  </section>
+
+  <section>
+    <title>Alternate Routing Table Configuration</title>
+
+    <para>The <ulink url="Shorewall_Squid_Usage.html">Shorewall Squid
+    documentation</ulink> shows how alternate routing tables can be created
+    and used. That documentation shows how you can use logic in
+    <filename>/etc/shorewall/init</filename> to create and populate an
+    alternate table and to add a routing rule for its use. It is fine to use
+    that technique so long as you understand that you are basically just using
+    the Shorewall init script (<filename>/etc/init.d/shorewall</filename>) to
+    configure your alternate routing table at boot time and that <emphasis
+    role="bold">other than as described in the previous section, there is no
+    connection between Shorewall and routing</emphasis>. </para>
+  </section>
+</article>

Shorewall-docs2/support.xml

@@ -15,7 +15,7 @@
       </author>
     </authorgroup>
 
-    <pubdate>2005-01-24</pubdate>
+    <pubdate>2005-02-20</pubdate>
 
     <copyright>
       <year>2001-2005</year>
@@ -123,9 +123,9 @@
 
             <orderedlist>
               <listitem>
-                <para>If Shorewall isn't started then
+                <para>If Shorewall isn't started then <command>/sbin/shorewall
-                <command>/sbin/shorewall/start</command>. Otherwise
+                start</command>. Otherwise <command>/sbin/shorewall
-                <command>/sbin/shorewall reset</command>.</para>
+                reset</command>.</para>
               </listitem>
 
               <listitem>