mirror of
https://gitlab.com/shorewall/code.git
synced 2025-08-09 15:41:19 +02:00
Shorewall 1.4.2
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@535 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
@ -1,451 +1,248 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" height="90">
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font
|
||||
</a></i></font><font
|
||||
color="#ffffff">Shorewall 1.4 - <font
|
||||
size="4">"<i>iptables made easy"</i></font></font><a
|
||||
href="http://www.sf.net"> </a></h1>
|
||||
size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font color="#ffffff">
|
||||
<small><small><small>Shorewall 1.3 Site here</small></small></small></font></a><br>
|
||||
<a target="_top" href="http://www1.shorewall.net/1.2/index.htm"><font
|
||||
color="#ffffff"><small><small><small>Shorewall 1.2 Site here<br>
|
||||
</small></small></small></font></a>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center"><a href="/1.3/index.html" target="_top"><font
|
||||
color="#ffffff">Shorewall 1.3 Site here</font></a></div>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<center>
|
||||
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="90%">
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as<61> "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall
|
||||
system, a multi-function gateway/router/server or on a standalone
|
||||
GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated firewall
|
||||
system, a multi-function gateway/router/server or on
|
||||
a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it under the
|
||||
terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
||||
2 of the GNU General Public License</a> as published by the Free
|
||||
Software Foundation.<br>
|
||||
|
||||
<br>
|
||||
|
||||
This program is distributed
|
||||
in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied
|
||||
warranty of MERCHANTABILITY or FITNESS FOR
|
||||
A PARTICULAR PURPOSE. See the GNU General Public
|
||||
License for more details.<br>
|
||||
|
||||
<br>
|
||||
|
||||
You should have received
|
||||
a copy of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
it under
|
||||
the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
This program
|
||||
is distributed in the hope that it will
|
||||
be useful, but WITHOUT ANY WARRANTY; without
|
||||
even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
<br>
|
||||
You should have
|
||||
received a copy of the GNU General Public
|
||||
License along with this program; if
|
||||
not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36">
|
||||
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
</a>Jacques Nilo
|
||||
and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can
|
||||
find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
</b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>3/24/2003 - Shorewall 1.4.1 </b><b> </b><b><img
|
||||
<b>Congratulations
|
||||
to Jacques and Eric on the recent release of Bering
|
||||
1.1!!! <br>
|
||||
</b>
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
<20></b><b> </b></p>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This release follows up on 1.4.0. It corrects a problem introduced
|
||||
in 1.4.0 and removes additional warts.<br>
|
||||
<br>
|
||||
<b>Problems Corrected:</b><br>
|
||||
</b><br>
|
||||
</p>
|
||||
<ol>
|
||||
<li>When Shorewall 1.4.0 is run under the ash shell (such as on Bering/LEAF),
|
||||
it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn file
|
||||
is empty. That problem has been corrected so that ECN disabling rules are
|
||||
only added if there are entries in /etc/shorewall/ecn.</li>
|
||||
</ol>
|
||||
<b>New Features:</b><br>
|
||||
|
||||
<blockquote>Note: In the list that follows, the term <i>group </i>refers
|
||||
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
|
||||
a host address) accessed through a particular interface. Examples:<br>
|
||||
|
||||
<blockquote>eth0:0.0.0.0/0<br>
|
||||
eth2:192.168.1.0/24<br>
|
||||
eth3:192.0.2.123<br>
|
||||
</blockquote>
|
||||
You can use the "shorewall check" command to see the groups associated with
|
||||
each of your zones.<br>
|
||||
|
||||
<p><b><EFBFBD><EFBFBD><EFBFBD> Problems Corrected:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b> chain
|
||||
are now properly rejected with TCP RST; previously, some of these requests
|
||||
were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously timed out
|
||||
on the first hop (e.g., to the firewall). This has been worked around.</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<ol>
|
||||
<li>Beginning with Shorewall 1.4.1, if a zone Z comprises more than
|
||||
one group<i> </i>then if there is no explicit Z to Z policy and there are
|
||||
no rules governing traffic from Z to Z then Shorewall will permit all traffic
|
||||
between the groups in the zone.</li>
|
||||
<li>Beginning with Shorewall 1.4.1, Shorewall will never create rules
|
||||
to handle traffic from a group to itself.</li>
|
||||
<li>A NONE policy is introduced in 1.4.1. When a policy of NONE is
|
||||
specified from Z1 to Z2:</li>
|
||||
</ol>
|
||||
|
||||
<ul>
|
||||
<li>There may be no rules created that govern connections from Z1
|
||||
to Z2.</li>
|
||||
<li>Shorewall will not create any infrastructure to handle traffic
|
||||
from Z1 to Z2.</li>
|
||||
</ul>
|
||||
See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion
|
||||
of how these changes may affect your configuration.
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><a href="http://www.sf.net"><img align="left"
|
||||
alt="SourceForge Logo"
|
||||
|
||||
<p><b><EFBFBD><EFBFBD><EFBFBD> New Features:</b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file specifies a
|
||||
particular host or network, Shorewall now creates an intermediate chain for
|
||||
handling input from the related zone. This can substantially reduce the number
|
||||
of rules traversed by connections requests from such zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An INCLUDE directive
|
||||
consists of the word INCLUDE followed by a file name and causes the contents
|
||||
of the named file to be logically included into the file containing the INCLUDE.
|
||||
File names given in an INCLUDE directive are assumed to reside in /etc/shorewall
|
||||
or in an alternate configuration directory if one has been specified for the
|
||||
command. <br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><EFBFBD> Examples:<br>
|
||||
<20><> shorewall/params.mgmt:<br>
|
||||
<EFBFBD><EFBFBD> MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
<EFBFBD><EFBFBD> TIME_SERVERS=4.4.4.4<br>
|
||||
<EFBFBD><EFBFBD> BACKUP_SERVERS=5.5.5.5<br>
|
||||
<EFBFBD><EFBFBD> ----- end params.mgmt -----<br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><EFBFBD> shorewall/params:<br>
|
||||
<EFBFBD><EFBFBD> # Shorewall 1.3 /etc/shorewall/params<br>
|
||||
<EFBFBD><EFBFBD> [..]<br>
|
||||
<EFBFBD><EFBFBD> #######################################<br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><EFBFBD> INCLUDE params.mgmt<6D><74><EFBFBD> <br>
|
||||
<EFBFBD> <br>
|
||||
<EFBFBD><EFBFBD> # params unique to this host here<br>
|
||||
<EFBFBD><EFBFBD> #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
<EFBFBD><EFBFBD> ----- end params -----<br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><br>
|
||||
<EFBFBD><EFBFBD> shorewall/rules.mgmt:<br>
|
||||
<EFBFBD><EFBFBD> ACCEPT net:$MGMT_SERVERS<52><53><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> $FW<46><57><EFBFBD> tcp<63><70><EFBFBD> 22<br>
|
||||
<EFBFBD><EFBFBD> ACCEPT $FW<46><57><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> net:$TIME_SERVERS<52><53><EFBFBD> udp<64><70><EFBFBD> 123<br>
|
||||
<EFBFBD><EFBFBD> ACCEPT $FW<46><57><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> net:$BACKUP_SERVERS<52> tcp<63><70><EFBFBD> 22<br>
|
||||
<EFBFBD><EFBFBD> ----- end rules.mgmt -----<br>
|
||||
<EFBFBD><br>
|
||||
<20><> shorewall/rules:<br>
|
||||
<20><> # Shorewall version 1.3 - Rules File<br>
|
||||
<20><> [..]<br>
|
||||
<20><> #######################################<br>
|
||||
<20><br>
|
||||
<20><> INCLUDE rules.mgmt<6D><74><EFBFBD><EFBFBD> <br>
|
||||
<20> <br>
|
||||
<20><> # rules unique to this host here<br>
|
||||
<20><> #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
|
||||
<20><> ----- end rules -----<br>
|
||||
<20><br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives
|
||||
are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that interface continues
|
||||
to be a problem. While I firmly believe that this should never happen, people
|
||||
continue to want to do it. To limit the damage that such nonsense produces,
|
||||
I have added a new 'routeback' option in /etc/shorewall/interfaces and /etc/shorewall/hosts.
|
||||
When used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
||||
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on individual group
|
||||
entries in /etc/shorewall/hosts.<br>
|
||||
<20><br>
|
||||
The 'routeback' option is similar to the old 'multi' option with two exceptions:<br>
|
||||
<20><br>
|
||||
<20><> a) The option pertains to a particular zone,interface,address tuple.<br>
|
||||
<20><br>
|
||||
<20><> b) The option only created infrastructure to pass traffic from (zone,interface,address)
|
||||
tuples back to themselves (the 'multi' option affected all (zone,interface,address)
|
||||
tuples associated with the given 'interface').<br>
|
||||
<20><br>
|
||||
See the '<a href="file:///Z:/Shorewall-docs/upgrade_issues.htm">Upgrade
|
||||
Issues</a>' for information about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
</a></h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h4> </h4>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
|
||||
|
||||
</td>
|
||||
|
||||
<td width="88"
|
||||
bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<td
|
||||
width="88" bgcolor="#4b017c" valign="top" align="center"> <br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
style="margin-top: 1px;">
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</a></p>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2">Updated 3/21/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<p><font size="2">Updated 4/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Reference in New Issue
Block a user