Implement BLACKLIST section in the rules file

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2011-10-03 12:33:31 -07:00
parent e09aa8662b
commit 0e83e105c6
8 changed files with 356 additions and 200 deletions

View File

@ -110,6 +110,7 @@ our %EXPORT_TAGS = (
pop_comment
forward_chain
rules_chain
blacklist_chain
zone_forward_chain
use_forward_chain
input_chain
@ -1478,6 +1479,13 @@ sub rules_chain ($$) {
$renamed{$name} || $name;
}
#
# Name of the blacklist chain between an ordered pair of zones
#
sub blacklist_chain($$) {
&rules_chain(@_) . '~';
}
#
# Forward Chain for an interface
#
@ -2234,6 +2242,7 @@ sub initialize_chain_table($) {
'NFQUEUE!' => STANDARD + NFQ,
'ADD' => STANDARD + SET,
'DEL' => STANDARD + SET,
'WHITELIST' => STANDARD
);
for my $chain ( qw(OUTPUT PREROUTING) ) {

View File

@ -145,7 +145,8 @@ sub initialize( $ ) {
#
# These are set to 1 as sections are encountered.
#
%sections = ( ALL => 0,
%sections = ( BLACKLIST => 0,
ALL => 0,
ESTABLISHED => 0,
RELATED => 0,
NEW => 0
@ -744,7 +745,7 @@ sub ensure_rules_chain( $ )
my $chainref = ensure_chain 'filter', $chain;
unless ( $chainref->{referenced} ) {
if ( $section eq 'NEW' or $section eq 'DONE' ) {
if ( $section =~/^(NEW|DONE)$/ ) {
finish_chain_section $chainref , 'ESTABLISHED,RELATED';
} elsif ( $section eq 'RELATED' ) {
finish_chain_section $chainref , 'ESTABLISHED';
@ -1671,6 +1672,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
my $inaction = '';
my $normalized_target;
my $normalized_action;
my $blacklist = $section eq 'BLACKLIST';
( $inaction, undef, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 4 if defined $chainref;
@ -1737,7 +1739,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
#
# We can now dispense with the postfix character
#
$action =~ s/[\+\-!]$//;
fatal_error "The +, - and ! modifiers are not allowed in the BLACKLIST section" if $action =~ s/[\+\-!]$// && $blacklist;
#
# Handle actions
#
@ -1771,8 +1773,9 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
fatal_error "The $basictarget TARGET does not accept parameters" if $action =~ s/\(\)$//;
}
if ( $inaction ) {
$targets{$inaction} |= NATRULE if $actiontype & (NATRULE | NONAT | NATONLY )
if ( $actiontype & (NATRULE | NONAT | NATONLY ) ) {
$targets{$inaction} |= NATRULE if $inaction;
fatal_error "NAT rules are not allowed in the BLACKLIST section" if $blacklist;
}
#
# Take care of irregular syntax and targets
@ -1796,6 +1799,8 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
} ,
REJECT => sub { $action = 'reject'; } ,
CONTINUE => sub { $action = 'RETURN'; } ,
WHITELIST => sub { fatal_error "'WHITELIST' may only be used in the 'BLACKLIST' section" if $blacklist;
$action = 'RETURN'; } ,
COUNT => sub { $action = ''; } ,
LOG => sub { fatal_error 'LOG requires a log level' unless supplied $loglevel; } ,
);
@ -1921,7 +1926,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
#
# Handle Optimization
#
if ( $optimize > 0 ) {
if ( $optimize > 0 && $section eq 'NEW' ) {
my $loglevel = $filter_table->{$chainref->{policychain}}{loglevel};
if ( $loglevel ne '' ) {
return 0 if $target eq "${policy}:$loglevel}";
@ -1937,6 +1942,25 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
# Don't let the rules in this chain be moved elsewhere
#
dont_move $chainref;
#
# Handle creation of the blacklist chain
#
if ( $blacklist ) {
my $blacklistchain = blacklist_chain( ${sourcezone}, ${destzone} );
my $blacklistref = $filter_table->{$blacklistchain};
unless ( $blacklistref ) {
my @state;
$blacklistref = new_chain 'filter', $blacklistchain;
@state = state_imatch( 'NEW,INVALID' ) if $config{BLACKLISTNEWONLY};
add_ijump( $chainref, j => $blacklistref, @state );
}
$chain = $blacklistchain;
$chainref = $blacklistref;
}
dont_move $chainref if $action eq 'RETURN';
}
}
#
@ -1972,7 +1996,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ $) {
unless ( $section eq 'NEW' || $inaction ) {
fatal_error "Entries in the $section SECTION of the rules file not permitted with FASTACCEPT=Yes" if $config{FASTACCEPT};
fatal_error "$basictarget rules are not allowed in the $section SECTION" if $actiontype & ( NATRULE | NONAT );
$rule .= "$globals{STATEMATCH} $section " unless $section eq 'ALL';
$rule .= "$globals{STATEMATCH} $section " unless $section eq 'ALL' || $blacklist;
}
#
@ -2264,13 +2288,15 @@ sub process_section ($) {
fatal_error "Duplicate or out of order SECTION $sect" if $sections{$sect};
$sections{$sect} = 1;
if ( $sect eq 'ESTABLISHED' ) {
$sections{ALL} = 1;
if ( $sect eq 'ALL' ) {
$sections{BLACKLIST} = 1;
} elsif ( $sect eq 'ESTABLISHED' ) {
$sections{'BLACKLIST','ALL'} = ( 1, 1);
} elsif ( $sect eq 'RELATED' ) {
@sections{'ALL','ESTABLISHED'} = ( 1, 1);
@sections{'BLACKLIST','ALL','ESTABLISHED'} = ( 1, 1, 1);
finish_section 'ESTABLISHED';
} elsif ( $sect eq 'NEW' ) {
@sections{'ALL','ESTABLISHED','RELATED'} = ( 1, 1, 1 );
@sections{'BLACKLIST','ALL','ESTABLISHED','RELATED'} = ( 1, 1, 1, 1 );
finish_section ( ( $section eq 'RELATED' ) ? 'RELATED' : 'ESTABLISHED,RELATED' );
}

View File

@ -9,6 +9,7 @@
######################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH
# PORT PORT(S) DEST LIMIT GROUP
#SECTION BLACKLIST
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED

View File

@ -48,9 +48,10 @@
<section id="Intro">
<title>Introduction</title>
<para>Shorewall supports two different forms of blacklisting; static and
dynamic. The BLACKLISTNEWONLY option in /etc/shorewall/shorewall.conf
controls the degree of blacklist filtering:</para>
<para>Shorewall supports two different types of blackliisting; rule-based,
static and dynamic. The BLACKLISTNEWONLY option in
/etc/shorewall/shorewall.conf controls the degree of blacklist
filtering:</para>
<orderedlist>
<listitem>
@ -62,10 +63,28 @@
<listitem>
<para>BLACKLISTNEWONLY=Yes -- The blacklists are only consulted for
new connection requests. Blacklists may not be used to terminate
existing connections. Only the source address is checked against the
blacklists.</para>
existing connections.</para>
</listitem>
</orderedlist>
</section>
<section>
<title>Rule-based Blacklisting</title>
<para>Beginning with Shorewall 4.4.25, the preferred method of
blacklisting and whitelisting is to use the BLACKLIST section of the rules
file. There you have access to the DROP, ACCEPT, REJECT and WHITELIST
actions, standard and custom macros as well as standard and custom
actions. See <ulink
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).</para>
</section>
<section>
<title>Legacy Blacklisting</title>
<para>Prior to 4.4.25, two forms of blacklisting were supported; static
and dynamic. The dynamic variety is still appropriate for on the fly
blacklisting; the static form is deprecated.</para>
<important>
<para><emphasis role="bold">By default, only the source address is
@ -96,191 +115,197 @@
load, and will have a very negative effect on firewall
performance.</para>
</important>
</section>
<section id="Static">
<title>Static Blacklisting</title>
<section id="Static">
<title>Static Blacklisting</title>
<para>Shorewall static blacklisting support has the following
configuration parameters:</para>
<para>Shorewall static blacklisting support has the following
configuration parameters:</para>
<itemizedlist>
<listitem>
<para>You specify whether you want packets from blacklisted hosts
dropped or rejected using the BLACKLIST_DISPOSITION setting in <ulink
url="manpages/shorewall.conf.html"><filename>shorewall.conf</filename>(5).</ulink></para>
</listitem>
<itemizedlist>
<listitem>
<para>You specify whether you want packets from blacklisted hosts
dropped or rejected using the BLACKLIST_DISPOSITION setting in
<ulink
url="manpages/shorewall.conf.html"><filename>shorewall.conf</filename>(5).</ulink></para>
</listitem>
<listitem>
<para>You specify whether you want packets from blacklisted hosts
logged and at what syslog level using the BLACKLIST_LOGLEVEL setting
in <ulink
url="manpages/shorewall.conf.html"><filename>shorewall.conf</filename></ulink>(5).</para>
</listitem>
<listitem>
<para>You specify whether you want packets from blacklisted hosts
logged and at what syslog level using the BLACKLIST_LOGLEVEL setting
in <ulink
url="manpages/shorewall.conf.html"><filename>shorewall.conf</filename></ulink>(5).</para>
</listitem>
<listitem>
<para>You list the IP addresses/subnets that you wish to blacklist in
<ulink
url="manpages/shorewall-blacklist.html"><filename>shorewall-blacklist</filename></ulink>
(5). You may also specify PROTOCOL and Port numbers/Service names in
the blacklist file.</para>
</listitem>
<listitem>
<para>You list the IP addresses/subnets that you wish to blacklist
in <ulink
url="manpages/shorewall-blacklist.html"><filename>shorewall-blacklist</filename></ulink>
(5). You may also specify PROTOCOL and Port numbers/Service names in
the blacklist file.</para>
</listitem>
<listitem>
<para>You specify the interfaces whose incoming packets you want
checked against the blacklist using the <quote>blacklist</quote>
option in <ulink
url="manpages/shorewall-interfaces.html"><filename>shorewall-interfaces</filename></ulink>(5)
(<ulink url="manpages/shorewall-zones.html">shorewall-zones</ulink>(5)
in Shorewall 4.4.12 and later).</para>
</listitem>
</itemizedlist>
<listitem>
<para>You specify the interfaces whose incoming packets you want
checked against the blacklist using the <quote>blacklist</quote>
option in <ulink
url="manpages/shorewall-interfaces.html"><filename>shorewall-interfaces</filename></ulink>(5)
(<ulink
url="manpages/shorewall-zones.html">shorewall-zones</ulink>(5) in
Shorewall 4.4.12 and later).</para>
</listitem>
</itemizedlist>
<para>Users with a large static black list may want to set the
DELAYBLACKLISTLOAD option in shorewall.conf (added in Shorewall version
2.2.0). When DELAYBLACKLISTLOAD=Yes, Shorewall will enable new connections
before loading the blacklist rules. While this may allow connections from
blacklisted hosts to slip by during construction of the blacklist, it can
substantially reduce the time that all new connections are disabled during
"shorewall [re]start".</para>
<para>Prior to Shorewall 4.4.20, only source-address static blacklisting
was supported.</para>
<para>Beginning with Shorewall 2.4.0, you can use <ulink
url="ipsets.html">ipsets</ulink> to define your static blacklist. Here's
an example:</para>
<para>Users with a large static black list may want to set the
DELAYBLACKLISTLOAD option in shorewall.conf (added in Shorewall version
2.2.0). When DELAYBLACKLISTLOAD=Yes, Shorewall will enable new
connections before loading the blacklist rules. While this may allow
connections from blacklisted hosts to slip by during construction of the
blacklist, it can substantially reduce the time that all new connections
are disabled during "shorewall [re]start".</para>
<programlisting>#ADDRESS/SUBNET PROTOCOL PORT
<para>Beginning with Shorewall 2.4.0, you can use <ulink
url="ipsets.html">ipsets</ulink> to define your static blacklist. Here's
an example:</para>
<programlisting>#ADDRESS/SUBNET PROTOCOL PORT
+Blacklistports[dst]
+Blacklistnets[src,dst]
+Blacklist[src,dst]
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
<para>In this example, there is a portmap ipset
<emphasis>Blacklistports</emphasis> that blacklists all traffic with
destination ports included in the ipset. There are also
<emphasis>Blacklistnets</emphasis> (type <emphasis>nethash</emphasis>) and
<emphasis>Blacklist</emphasis> (type <emphasis>iphash</emphasis>) ipsets
that allow blacklisting networks and individual IP addresses. Note that
[src,dst] is specified so that individual entries in the sets can be bound
to other portmap ipsets to allow blacklisting (<emphasis>source
address</emphasis>, <emphasis>destination port</emphasis>) combinations.
For example:</para>
<para>In this example, there is a portmap ipset
<emphasis>Blacklistports</emphasis> that blacklists all traffic with
destination ports included in the ipset. There are also
<emphasis>Blacklistnets</emphasis> (type <emphasis>nethash</emphasis>)
and <emphasis>Blacklist</emphasis> (type <emphasis>iphash</emphasis>)
ipsets that allow blacklisting networks and individual IP addresses.
Note that [src,dst] is specified so that individual entries in the sets
can be bound to other portmap ipsets to allow blacklisting
(<emphasis>source address</emphasis>, <emphasis>destination
port</emphasis>) combinations. For example:</para>
<programlisting>ipset -N SMTP portmap --from 1 --to 31
<programlisting>ipset -N SMTP portmap --from 1 --to 31
ipset -A SMTP 25
ipset -A Blacklist 206.124.146.177
ipset -B Blacklist 206.124.146.177 -b SMTP</programlisting>
<para>This will blacklist SMTP traffic from host 206.124.146.177.</para>
</section>
<para>This will blacklist SMTP traffic from host 206.124.146.177.</para>
</section>
<section id="whitelisting">
<title>Static Whitelisting</title>
<section id="whitelisting">
<title>Static Whitelisting</title>
<para>Beginning with Shorewall 4.4.20, you can create
<firstterm>whitelist</firstterm> entries in the blacklist file.
Connections/packets matching a whitelist entry are not matched against the
entries in the blacklist file that follow. Whitelist entries are created
using the <emphasis role="bold">whitelist</emphasis> option (OPTIONS
column). See <ulink
url="manpages/shorewall-blacklist.html"><filename>shorewall-blacklist</filename></ulink>
(5).</para>
</section>
<para>Beginning with Shorewall 4.4.20, you can create
<firstterm>whitelist</firstterm> entries in the blacklist file.
Connections/packets matching a whitelist entry are not matched against
the entries in the blacklist file that follow. Whitelist entries are
created using the <emphasis role="bold">whitelist</emphasis> option
(OPTIONS column). See <ulink
url="manpages/shorewall-blacklist.html"><filename>shorewall-blacklist</filename></ulink>
(5).</para>
</section>
<section id="Dynamic">
<title>Dynamic Blacklisting</title>
<section id="Dynamic">
<title>Dynamic Blacklisting</title>
<para>Beginning with Shorewall 4.4.7, dynamic blacklisting is enabled by
setting DYNAMIC_BLACKLIST=Yes in <filename>shorewall.conf</filename>.
Prior to that release, the feature is always enabled.</para>
<para>Beginning with Shorewall 4.4.7, dynamic blacklisting is enabled by
setting DYNAMIC_BLACKLIST=Yes in <filename>shorewall.conf</filename>.
Prior to that release, the feature is always enabled.</para>
<para>Once enabled, dynamic blacklisting doesn't use any configuration
parameters but is rather controlled using /sbin/shorewall[-lite] commands.
<emphasis role="bold">Note</emphasis> that <emphasis
role="bold">to</emphasis> and <emphasis role="bold">from</emphasis> may
only be specified when running <emphasis role="bold">Shorewall 4.4.12 or
later</emphasis>.</para>
<para>Once enabled, dynamic blacklisting doesn't use any configuration
parameters but is rather controlled using /sbin/shorewall[-lite]
commands. <emphasis role="bold">Note</emphasis> that <emphasis
role="bold">to</emphasis> and <emphasis role="bold">from</emphasis> may
only be specified when running <emphasis role="bold">Shorewall 4.4.12 or
later</emphasis>.</para>
<itemizedlist>
<listitem>
<para>drop [to|from] <emphasis>&lt;ip address list&gt;</emphasis> -
causes packets from the listed IP addresses to be silently dropped by
the firewall.</para>
</listitem>
<itemizedlist>
<listitem>
<para>drop [to|from] <emphasis>&lt;ip address list&gt;</emphasis> -
causes packets from the listed IP addresses to be silently dropped
by the firewall.</para>
</listitem>
<listitem>
<para>reject [to|from]<emphasis>&lt;ip address list&gt;</emphasis> -
causes packets from the listed IP addresses to be rejected by the
firewall.</para>
</listitem>
<listitem>
<para>reject [to|from]<emphasis>&lt;ip address list&gt;</emphasis> -
causes packets from the listed IP addresses to be rejected by the
firewall.</para>
</listitem>
<listitem>
<para>allow [to|from] <emphasis>&lt;ip address list&gt;</emphasis> -
re-enables receipt of packets from hosts previously blacklisted by a
<emphasis>drop</emphasis> or <emphasis>reject</emphasis>
command.</para>
</listitem>
<listitem>
<para>allow [to|from] <emphasis>&lt;ip address list&gt;</emphasis> -
re-enables receipt of packets from hosts previously blacklisted by a
<emphasis>drop</emphasis> or <emphasis>reject</emphasis>
command.</para>
</listitem>
<listitem>
<para>save - save the dynamic blacklisting configuration so that it
will be automatically restored the next time that the firewall is
restarted.</para>
<listitem>
<para>save - save the dynamic blacklisting configuration so that it
will be automatically restored the next time that the firewall is
restarted.</para>
<para><emphasis role="bold">Update:</emphasis> Beginning with
Shorewall 4.4.10, the dynamic blacklist is automatically retained over
<command>stop/start</command> sequences and over
<command>restart</command>.</para>
</listitem>
<para><emphasis role="bold">Update:</emphasis> Beginning with
Shorewall 4.4.10, the dynamic blacklist is automatically retained
over <command>stop/start</command> sequences and over
<command>restart</command>.</para>
</listitem>
<listitem>
<para>show dynamic - displays the dynamic blacklisting
configuration.</para>
</listitem>
<listitem>
<para>show dynamic - displays the dynamic blacklisting
configuration.</para>
</listitem>
<listitem>
<para>logdrop [to|from] <emphasis>&lt;ip address list&gt;</emphasis> -
causes packets from the listed IP addresses to be dropped and logged
by the firewall. Logging will occur at the level specified by the
BLACKLIST_LOGLEVEL setting at the last [re]start (logging will be at
the 'info' level if no BLACKLIST_LOGLEVEL was given).</para>
</listitem>
<listitem>
<para>logdrop [to|from] <emphasis>&lt;ip address list&gt;</emphasis>
- causes packets from the listed IP addresses to be dropped and
logged by the firewall. Logging will occur at the level specified by
the BLACKLIST_LOGLEVEL setting at the last [re]start (logging will
be at the 'info' level if no BLACKLIST_LOGLEVEL was given).</para>
</listitem>
<listitem>
<para>logreject [to|from}<emphasis>&lt;ip address list&gt;</emphasis>
- causes packets from the listed IP addresses to be rejected and
logged by the firewall. Logging will occur at the level specified by
the BLACKLIST_LOGLEVEL setting at the last [re]start (logging will be
at the 'info' level if no BLACKLIST_LOGLEVEL was given).</para>
</listitem>
</itemizedlist>
<listitem>
<para>logreject [to|from}<emphasis>&lt;ip address
list&gt;</emphasis> - causes packets from the listed IP addresses to
be rejected and logged by the firewall. Logging will occur at the
level specified by the BLACKLIST_LOGLEVEL setting at the last
[re]start (logging will be at the 'info' level if no
BLACKLIST_LOGLEVEL was given).</para>
</listitem>
</itemizedlist>
<para>Dynamic blacklisting is not dependent on the
<quote>blacklist</quote> option in
<filename>/etc/shorewall/interfaces</filename>.</para>
<para>Dynamic blacklisting is not dependent on the
<quote>blacklist</quote> option in
<filename>/etc/shorewall/interfaces</filename>.</para>
<example id="Ignore">
<title>Ignore packets from a pair of systems</title>
<example id="Ignore">
<title>Ignore packets from a pair of systems</title>
<programlisting> <command>shorewall[-lite] drop 192.0.2.124 192.0.2.125</command></programlisting>
<programlisting> <command>shorewall[-lite] drop 192.0.2.124 192.0.2.125</command></programlisting>
<para>Drops packets from hosts 192.0.2.124 and 192.0.2.125</para>
</example>
<para>Drops packets from hosts 192.0.2.124 and 192.0.2.125</para>
</example>
<example id="Allow">
<title>Re-enable packets from a system</title>
<example id="Allow">
<title>Re-enable packets from a system</title>
<programlisting> <command>shorewall[-lite] allow 192.0.2.125</command></programlisting>
<programlisting> <command>shorewall[-lite] allow 192.0.2.125</command></programlisting>
<para>Re-enables traffic from 192.0.2.125.</para>
</example>
<para>Re-enables traffic from 192.0.2.125.</para>
</example>
<example>
<title>Displaying the Dynamic Blacklist</title>
<example>
<title>Displaying the Dynamic Blacklist</title>
<programlisting> <command>shorewall show dynamic</command></programlisting>
<programlisting> <command>shorewall show dynamic</command></programlisting>
<para>Displays the 'dynamic' chain which contains rules for the dynamic
blacklist. The <firstterm>source</firstterm> column contains the set of
blacklisted addresses.</para>
</example>
<para>Displays the 'dynamic' chain which contains rules for the
dynamic blacklist. The <firstterm>source</firstterm> column contains
the set of blacklisted addresses.</para>
</example>
</section>
</section>
</article>

View File

@ -46,11 +46,25 @@
<para>Sections are as follows and must appear in the order listed:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">BLACKLIST</emphasis></term>
<listitem>
<para>This section was added in Shorewall 4.4.25. Rules in this
section are applied depending on the setting of BLACKLISTNEWONLY in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5). If
BLACKLISTNEWONLY=No, then they are applied regardless of the
connection tracking state of the packet. If BLACKLISTNEWONLY=Yes,
they are applied to connections in the NEW and INVALID
states.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ALL</emphasis></term>
<listitem>
<para>This section was added in Shorewall 4.4.23. rules in this
<para>This section was added in Shorewall 4.4.23. Rules in this
section are applied, regardless of the connection tracking state of
the packet.</para>
</listitem>
@ -101,14 +115,15 @@
comfortable with the differences between the various connection tracking
states, then it is suggested that you omit the <emphasis
role="bold">ESTABLISHED</emphasis> and <emphasis
role="bold">RELATED</emphasis> sections and place all of your rules in
the NEW section (That's after the line that reads SECTION NEW').</para>
role="bold">RELATED</emphasis> sections and place all of your
non-blacklisting rules in the NEW section (That's after the line that
reads SECTION NEW').</para>
</note>
<warning>
<para>If you specify FASTACCEPT=Yes in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5) then the <emphasis
role="bold">ESTABLISHED</emphasis> and <emphasis
role="bold">BLACKLIST, ALL, ESTABLISHED</emphasis> and <emphasis
role="bold">RELATED</emphasis> sections must be empty.</para>
</warning>
@ -171,7 +186,8 @@
role="bold">DNAT</emphasis>[<emphasis
role="bold">-</emphasis>] or <emphasis
role="bold">REDIRECT</emphasis>[<emphasis
role="bold">-</emphasis>] rules</para>
role="bold">-</emphasis>] rules. Not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -181,7 +197,9 @@
<listitem>
<para>like ACCEPT but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
url="shorewall.conf.html">shorewall.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -191,7 +209,9 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of ACCEPT,
ACCEPT+ and ACCEPT! respectively. Require AUDIT_TARGET support
in the kernel and iptables.</para>
in the kernel and iptables. A_ACCEPT+ and A_ACCEPT! are not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -202,7 +222,8 @@
<para>Excludes the connection from any subsequent <emphasis
role="bold">DNAT</emphasis>[-] or <emphasis
role="bold">REDIRECT</emphasis>[-] rules but doesn't generate
a rule to accept the traffic.</para>
a rule to accept the traffic. Not available in the <emphasis
role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -220,7 +241,10 @@
<listitem>
<para>like DROP but exempts the rule from being suppressed by
OPTIMIZE=1 in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
url="shorewall.conf.html">shorewall.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section. Not available in the <emphasis
role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -230,7 +254,10 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of DROP and
DROP! respectively. Require AUDIT_TARGET support in the kernel
and iptables.</para>
and iptables. A_DROP! is not available in the <emphasis
role="bold">BLACKLIST</emphasis> section. A_DROP! is not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -249,7 +276,9 @@
<listitem>
<para>like REJECT but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
url="shorewall.conf.html">shorewall.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -259,7 +288,8 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of REJECT
and REJECT! respectively. Require AUDIT_TARGET support in the
kernel and iptables.</para>
kernel and iptables. A_REJECT! is not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -281,7 +311,8 @@
<para>Like <emphasis role="bold">DNAT</emphasis> but only
generates the <emphasis role="bold">DNAT</emphasis> iptables
rule and not the companion <emphasis
role="bold">ACCEPT</emphasis> rule.</para>
role="bold">ACCEPT</emphasis> rule. Not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -303,7 +334,8 @@
<para>Like <emphasis role="bold">REDIRECT</emphasis> but only
generates the <emphasis role="bold">REDIRECT</emphasis>
iptables rule and not the companion <emphasis
role="bold">ACCEPT</emphasis> rule.</para>
role="bold">ACCEPT</emphasis> rule. Not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -331,7 +363,9 @@
<listitem>
<para>like CONTINUE but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
url="shorewall.conf.html">shorewall.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -360,7 +394,9 @@
<listitem>
<para>like QUEUE but exempts the rule from being suppressed by
OPTIMIZE=1 in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
url="shorewall.conf.html">shorewall.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -497,6 +533,16 @@
rule, it is passed on to the next rule.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">WHITELIST</emphasis></term>
<listitem>
<para>Added in Shorewall 4.4.25. May only appear in the
<emphasis role="bold">BLACKLIST</emphasis> section and exempts
the packet from following rules in that section.</para>
</listitem>
</varlistentry>
</variablelist>
<para>The <replaceable>target</replaceable> may optionally be

View File

@ -330,6 +330,10 @@
<para>A_DROP and A_REJECT are audited versions of DROP and REJECT
respectively and were added in Shorewall 4.4.20. They require
AUDIT_TARGET in the kernel and iptables.</para>
<para> The BLACKLIST_DISPOSITION setting has no effect on entries in
the BLACKLIST section of <ulink
url="shorewall-rules.html">shorewall-rules</ulink> (5).</para>
</listitem>
</varlistentry>
@ -343,7 +347,9 @@
logged at. Its value is a syslog level (Example:
BLACKLIST_LOGLEVEL=debug). If you do not assign a value or if you
assign an empty value then packets from blacklisted hosts are not
logged.</para>
logged. The BLACKLIST_LOGLEVEL setting has no effect on entries in
the BLACKLIST section of <ulink
url="shorewall-rules.html">shorewall-rules</ulink> (5).</para>
</listitem>
</varlistentry>
@ -354,11 +360,15 @@
<listitem>
<para>When set to <emphasis role="bold">Yes</emphasis> or <emphasis
role="bold">yes</emphasis>, blacklists are only consulted for new
connections. When set to <emphasis role="bold">No</emphasis> or
<emphasis role="bold">no</emphasis>, blacklists are consulted for
every packet (will slow down your firewall noticably if you have
large blacklists). If the BLACKLISTNEWONLY option is not set or is
set to the empty value then BLACKLISTNEWONLY=No is assumed.</para>
connections. That includes entries in the BLACKLIST section of
<ulink url="shorewall-rules.html">shorewall-rules</ulink> (5).
</para>
<para>When set to <emphasis role="bold">No</emphasis> or <emphasis
role="bold">no</emphasis>, blacklists are consulted for every packet
(will slow down your firewall noticably if you have large
blacklists). If the BLACKLISTNEWONLY option is not set or is set to
the empty value then BLACKLISTNEWONLY=No is assumed.</para>
<note>
<para>BLACKLISTNEWONLY=No is incompatible with

View File

@ -39,6 +39,20 @@
<para>Sections are as follows and must appear in the order listed:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">BLACKLIST</emphasis></term>
<listitem>
<para>This section was added in Shorewall 4.4.25. Rules in this
section are applied depending on the setting of BLACKLISTNEWONLY in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5). If
BLACKLISTNEWONLY=No, then they are applied regardless of the
connection tracking state of the packet. If BLACKLISTNEWONLY=Yes,
they are applied to connections in the NEW and INVALID
states.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ALL</emphasis></term>
@ -157,7 +171,9 @@
<listitem>
<para>like ACCEPT but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -167,7 +183,8 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of ACCEPT
and ACCEPT! respectively. Require AUDIT_TARGET support in the
kernel and ip6tables.</para>
kernel and ip6tables. A_ACCEPT! is not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -185,7 +202,9 @@
<listitem>
<para>like DROP but exempts the rule from being suppressed by
OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -195,7 +214,8 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of DROP and
DROP! respectively. Require AUDIT_TARGET support in the kernel
and ip6tables.</para>
and ip6tables. A_DROP! is not available in the <emphasis
role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -214,7 +234,9 @@
<listitem>
<para>like REJECT but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -224,7 +246,8 @@
<listitem>
<para>Added in Shorewall 4.4.20. Audited versions of REJECT
and REJECT! respectively. Require AUDIT_TARGET support in the
kernel and ip6tables.</para>
kernel and ip6tables. A_REJECT! is not available in the
<emphasis role="bold">BLACKLIST</emphasis> section.</para>
</listitem>
</varlistentry>
@ -252,7 +275,9 @@
<listitem>
<para>like CONTINUE but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -281,7 +306,9 @@
<listitem>
<para>like QUEUE but exempts the rule from being suppressed by
OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>
@ -313,7 +340,9 @@
<listitem>
<para>like NFQUEUE but exempts the rule from being suppressed
by OPTIMIZE=1 in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Not
available in the <emphasis role="bold">BLACKLIST</emphasis>
section.</para>
</listitem>
</varlistentry>

View File

@ -261,7 +261,10 @@
blacklisted hosts. It may have the value DROP if the packets are to
be dropped or REJECT if the packets are to be replied with an ICMP
port unreachable reply or a TCP RST (tcp only). If you do not assign
a value or if you assign an empty value then DROP is assumed.</para>
a value or if you assign an empty value then DROP is assumed. The
BLACKLIST_DISPOSITION setting has no effect on entries in the
BLACKLIST section of <ulink
url="shorewall6-rules.html">shorewall6-rules</ulink> (5).</para>
</listitem>
</varlistentry>
@ -275,7 +278,9 @@
logged at. Its value is a syslog level (Example:
BLACKLIST_LOGLEVEL=debug). If you do not assign a value or if you
assign an empty value then packets from blacklisted hosts are not
logged.</para>
logged. The BLACKLIST_LOGLEVEL setting has no effect on entries in
the BLACKLIST section of <ulink
url="shorewall6-rules.html">shorewall6-rules</ulink> (5).</para>
</listitem>
</varlistentry>
@ -286,11 +291,15 @@
<listitem>
<para>When set to <emphasis role="bold">Yes</emphasis> or <emphasis
role="bold">yes</emphasis>, blacklists are only consulted for new
connections. When set to <emphasis role="bold">No</emphasis> or
<emphasis role="bold">no</emphasis>, blacklists are consulted for
every packet (will slow down your firewall noticably if you have
large blacklists). If the BLACKLISTNEWONLY option is not set or is
set to the empty value then BLACKLISTNEWONLY=No is assumed.</para>
connections. This includes entries in the BLACKLIST section of
<ulink url="shorewall6-rules.html">shorewall6-rules</ulink>
(5).</para>
<para>When set to <emphasis role="bold">No</emphasis> or <emphasis
role="bold">no</emphasis>, blacklists are consulted for every packet
(will slow down your firewall noticably if you have large
blacklists). If the BLACKLISTNEWONLY option is not set or is set to
the empty value then BLACKLISTNEWONLY=No is assumed.</para>
<note>
<para>BLACKLISTNEWONLY=No is incompatible with
@ -1691,8 +1700,9 @@ net all DROP info</programlisting>then the chain name is 'net2all'
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-ipsec(5), shorewall6-maclist(5), shorewall6-masq(5),
shorewall6-nat(5), shorewall6-netmap(5), shoewall6-netmap(5),shorewall6-params(5),
shorewall6-policy(5), shorewall6-providers(5), shorewall6-proxyarp(5),
shorewall6-nat(5), shorewall6-netmap(5),
shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
shorewall6-providers(5), shorewall6-proxyarp(5),
shorewall6-route_rules(5), shorewall6-routestopped(5),
shorewall6-rules(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),