diff --git a/STABLE/changelog.txt b/STABLE/changelog.txt index ad9088bef..29425d6ba 100644 --- a/STABLE/changelog.txt +++ b/STABLE/changelog.txt @@ -9,3 +9,5 @@ Changes since 1.4.2 4. Return more appropriate ICMP responses if the systems supports them. +5. Silently drop UDP 135 in common.def. + diff --git a/STABLE/common.def b/STABLE/common.def index ef0b4a554..5e1ce0657 100644 --- a/STABLE/common.def +++ b/STABLE/common.def @@ -16,6 +16,7 @@ run_iptables -A common -p icmp -j icmpdef ############################################################################ # NETBIOS chatter # +run_iptables -A common -p udp --dport 135 -j reject run_iptables -A common -p udp --dport 137:139 -j reject run_iptables -A common -p udp --dport 445 -j reject run_iptables -A common -p tcp --dport 139 -j reject diff --git a/STABLE/documentation/NAT.htm b/STABLE/documentation/NAT.htm index b45526c6e..eb4530c3a 100644 --- a/STABLE/documentation/NAT.htm +++ b/STABLE/documentation/NAT.htm @@ -1,114 +1,117 @@ - + Shorewall NAT - + - + - -
+ +
- - - + + - - - + + + +
+

Static NAT

-
- -

IMPORTANT: If all you want to do is forward - ports to servers behind your firewall, you do NOT want to use static -NAT. Port forwarding can be accomplished with simple entries in the - rules file.

- -

Static NAT is a way to make systems behind a firewall and configured -with private IP addresses (those reserved for private use in RFC1918) -appear to have public IP addresses. Before you try to use this technique, + +

IMPORTANT: If all you want to do is forward + ports to servers behind your firewall, you do NOT want to use static +NAT. Port forwarding can be accomplished with simple entries in the + rules file.

+ +

Static NAT is a way to make systems behind a firewall and configured +with private IP addresses (those reserved for private use in RFC1918) +appear to have public IP addresses. Before you try to use this technique, I strongly recommend that you read the Shorewall Setup Guide.

- +

The following figure represents a static NAT environment.

- +

-

- +

+
- -

Static NAT can be used to make the systems with the - 10.1.1.* addresses appear to be on the upper (130.252.100.*) subnet. If -we assume that the interface to the upper subnet is eth0, then the following - /etc/shorewall/NAT file would make the lower left-hand system appear -to have IP address 130.252.100.18 and the right-hand one to have IP address - 130.252.100.19.

- + +

Static NAT can be used to make the systems with the 10.1.1.* +addresses appear to be on the upper (130.252.100.*) subnet. If we assume +that the interface to the upper subnet is eth0, then the following /etc/shorewall/NAT +file would make the lower left-hand system appear to have IP address +130.252.100.18 and the right-hand one to have IP address 130.252.100.19.

+ - - - - - - - - + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + +
EXTERNALINTERFACEINTERNALALL INTERFACESLOCAL
130.252.100.18eth010.1.1.2yesyes
130.252.100.19eth010.1.1.3yesyes
EXTERNALINTERFACEINTERNALALL INTERFACESLOCAL
130.252.100.18eth010.1.1.2yesyes
130.252.100.19eth010.1.1.3yesyes
- -

Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the above - example) is (are) not included in any specification in /etc/shorewall/masq + +

Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the above + example) is (are) not included in any specification in /etc/shorewall/masq or /etc/shorewall/proxyarp.

- -

Note 1: The "ALL INTERFACES" column -is used to specify whether access to the external IP from all firewall - interfaces should undergo NAT (Yes or yes) or if only access from the - interface in the INTERFACE column should undergo NAT. If you leave this - column empty, "Yes" is assumed. The ALL INTERFACES column was added -in version 1.1.6.

- -

Note 2: Shorewall will automatically add the external address to the + +

Note 1: The "ALL INTERFACES" column is used +to specify whether access to the external IP from all firewall interfaces +should undergo NAT (Yes or yes) or if only access from the interface in +the INTERFACE column should undergo NAT. If you leave this column empty, +"Yes" is assumed. The ALL INTERFACES column was added in version 1.1.6.

+ +

Note 2: Shorewall will automatically add the external address to the specified interface unless you specify ADD_IP_ALIASES="no" (or "No") in -/etc/shorewall/shorewall.conf; If you do not set ADD_IP_ALIASES or if -you set it to "Yes" or "yes" then you must NOT configure your own alias(es).

- -

Note 3: The contents of the "LOCAL" column -determine whether packets originating on the firewall itself and destined -for the EXTERNAL address are redirected to the internal ADDRESS. If this -column contains "yes" or "Yes" (and the ALL INTERFACES COLUMN also contains -"Yes" or "yes") then such packets are redirected; otherwise, such packets + href="Documentation.htm#Aliases">ADD_IP_ALIASES="no" (or "No") in +/etc/shorewall/shorewall.conf; If you do not set ADD_IP_ALIASES or if +you set it to "Yes" or "yes" then you must NOT configure your own alias(es). + RESTRICTION: Shorewall can only add external addresses to an interface +that is configured with a single subnetwork -- if your external interface +has addresses in more than one subnetwork, Shorewall can only add addresses +to the first one.

+ +

Note 3: The contents of the "LOCAL" column +determine whether packets originating on the firewall itself and destined +for the EXTERNAL address are redirected to the internal ADDRESS. If this +column contains "yes" or "Yes" (and the ALL INTERFACES COLUMN also contains +"Yes" or "yes") then such packets are redirected; otherwise, such packets are not redirected. The LOCAL column was added in version 1.1.8.

-
- +
+
- -

Last updated 1/11/2003 - Last updated 4/11/2003 - Tom Eastep

- Copyright © Copyright © 2001, 2002, 2003 Thomas M. Eastep.
+
diff --git a/STABLE/documentation/News.htm b/STABLE/documentation/News.htm index ce8c60946..43bd19380 100644 --- a/STABLE/documentation/News.htm +++ b/STABLE/documentation/News.htm @@ -4,7 +4,7 @@ - + Shorewall News @@ -13,947 +13,943 @@ - + - + - + - - - + + - + + - - + +
+
- +

Shorewall News Archive

-
- -

5/18/2003 - Shorewall 1.4.3
-

-     Problems Corrected:
- -
    -
  1. There were several cases where Shorewall would fail to remove a temporary -directory from /tmp. These cases have been corrected.
    2. -
  2. The rules for allowing all traffic via the loopback interface have -been moved to before the rule that drops status=INVALID packets. This insures -that all loopback traffic is allowed even if Netfilter connection tracking -is confused.
    3. -
-     New Features:
- -
    -
  1.  IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels -file.
    2. -
  2. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) - by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may - not use ULOG with fireparse unless you modify fireparse.
    3. -
-

5/10/2003 - Shorewall Mirror in Asia
-

- -

Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
-

- -

5/8/2003 - Shorewall Mirror in Chile

- Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile. + +

5/20/2003 - Shorewall-1.4.3a
+

+This version primarily corrects the documentation included in the .tgz and +in the .rpm. In addition:
-

4/21/2003 - Samples updated for Shorewall version 1.4.2

- -

Thanks to Francesca Smith, the sample configurations are now upgraded to -Shorewall version 1.4.2.

- -

4/9/2003 - Shorewall 1.4.2
-

- -

    Problems Corrected:

- -
-
    -
  1. TCP connection requests rejected out of the common chain - are now properly rejected with TCP RST; previously, some of these requests - were rejected with an ICMP port-unreachable response.
    2. -
  2. 'traceroute -I' from behind the firewall previously timed out - on the first hop (e.g., to the firewall). This has been worked around.
    3. - -
-
- -

    New Features:

-
    -
  1. Where an entry in the/etc/shorewall/hosts file specifies a particular - host or network, Shorewall now creates an intermediate chain for handling - input from the related zone. This can substantially reduce the number of - rules traversed by connections requests from such zones.
    -
    -
    2. -
  2. Any file may include an INCLUDE directive. An INCLUDE directive - consists of the word INCLUDE followed by a file name and causes the contents - of the named file to be logically included into the file containing the -INCLUDE. File names given in an INCLUDE directive are assumed to reside -in /etc/shorewall or in an alternate configuration directory if one has -been specified for the command.
    -  
    -    Examples:
    -    shorewall/params.mgmt:
    -    MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3
    -    TIME_SERVERS=4.4.4.4
    -    BACKUP_SERVERS=5.5.5.5
    -    ----- end params.mgmt -----
    -  
    -  
    -    shorewall/params:
    -    # Shorewall 1.3 /etc/shorewall/params
    -    [..]
    -    #######################################
    -  
    -    INCLUDE params.mgmt   
    -  
    -    # params unique to this host here
    -    #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
    -    ----- end params -----
    -  
    -  
    -    shorewall/rules.mgmt:
    -    ACCEPT net:$MGMT_SERVERS          $FW    tcp    22
    -    ACCEPT $FW          net:$TIME_SERVERS    udp    123
    -    ACCEPT $FW          net:$BACKUP_SERVERS  tcp    22
    -    ----- end rules.mgmt -----
    -  
    -    shorewall/rules:
    -    # Shorewall version 1.3 - Rules File
    -    [..]
    -    #######################################
    -  
    -    INCLUDE rules.mgmt    
    -  
    -    # rules unique to this host here
    -    #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
    -    ----- end rules -----
    -  
    - INCLUDE's may be nested to a level of 3 -- further nested INCLUDE -directives are ignored with a warning message.
    -
    -
    3. -
  3. Routing traffic from an interface back out that interface continues - to be a problem. While I firmly believe that this should never happen, -people continue to want to do it. To limit the damage that such nonsense -produces, I have added a new 'routeback' option in /etc/shorewall/interfaces -and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the 'ZONE' - column may not contain '-'; in other words, 'routeback' can't be used as - an option for a multi-zone interface. The 'routeback' option CAN be specified - however on individual group entries in /etc/shorewall/hosts.
    -  
    - The 'routeback' option is similar to the old 'multi' option with two - exceptions:
    -  
    -    a) The option pertains to a particular zone,interface,address tuple.
    -  
    -    b) The option only created infrastructure to pass traffic from -(zone,interface,address) tuples back to themselves (the 'multi' option -affected all (zone,interface,address) tuples associated with the given -'interface').
    -  
    - See the 'Upgrade Issues' for information - about how this new option may affect your configuration.
    -
    4. - +
  4. (This change is in 1.4.3 but is not documented) If you are running iptables +1.2.7a and kernel 2.4.20, then Shorewall will return reject replies as follows:
    +    a) tcp - RST
    +    b) udp - ICMP port unreachable
    +    c) icmp - ICMP host unreachable
    +    d) Otherwise - ICMP host prohibited
    + If you are running earlier software, Shorewall will follow it's traditional +convention:
    +    a) tcp - RST
    +    b) Otherwise - ICMP port unreachable
    5. +
  5. UDP port 135 is now silently dropped in the common.def chain. Remember +that this chain is traversed just before a DROP or REJECT policy is enforced.
    +
- -

3/24/2003 - Shorewall 1.4.1

- - - - - - - - - - - - - - - - - - - - -

This release follows up on 1.4.0. It corrects a problem introduced in -1.4.0 and removes additional warts.
-
- Problems Corrected:
+

5/18/2003 - Shorewall 1.4.3

- +     Problems Corrected:
+
    -
  1. When Shorewall 1.4.0 is run under the ash shell (such as on Bering/LEAF), - it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn - file is empty. That problem has been corrected so that ECN disabling rules - are only added if there are entries in /etc/shorewall/ecn.
    2. +
  2. There were several cases where Shorewall would fail to remove a temporary +directory from /tmp. These cases have been corrected.
    3. +
  3. The rules for allowing all traffic via the loopback interface have +been moved to before the rule that drops status=INVALID packets. This insures +that all loopback traffic is allowed even if Netfilter connection tracking +is confused.
    4. + +
+     New Features:
+ +
    +
  1.  IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels + file.
    2. +
  2. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) + by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may + not use ULOG with fireparse unless you modify fireparse.
    3. + +
+ +

5/10/2003 - Shorewall Mirror in Asia
+

+ +

Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
+

+ +

5/8/2003 - Shorewall Mirror in Chile

+ Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago +Chile. +

4/21/2003 - Samples updated for Shorewall version 1.4.2

+ +

Thanks to Francesca Smith, the sample configurations are now upgraded +to Shorewall version 1.4.2.

+ +

4/9/2003 - Shorewall 1.4.2
+

+ +

    Problems Corrected:

+ +
+
    +
  1. TCP connection requests rejected out of the common chain + are now properly rejected with TCP RST; previously, some of these requests + were rejected with an ICMP port-unreachable response.
    2. +
  2. 'traceroute -I' from behind the firewall previously timed out + on the first hop (e.g., to the firewall). This has been worked around.
    3. + +
+
+ +

    New Features:

+ +
    +
  1. Where an entry in the/etc/shorewall/hosts file specifies a particular + host or network, Shorewall now creates an intermediate chain for handling + input from the related zone. This can substantially reduce the number +of rules traversed by connections requests from such zones.
    +
    +
    2. +
  2. Any file may include an INCLUDE directive. An INCLUDE directive + consists of the word INCLUDE followed by a file name and causes the contents + of the named file to be logically included into the file containing the +INCLUDE. File names given in an INCLUDE directive are assumed to reside +in /etc/shorewall or in an alternate configuration directory if one has +been specified for the command.
    +  
    +    Examples:
    +    shorewall/params.mgmt:
    +    MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3
    +    TIME_SERVERS=4.4.4.4
    +    BACKUP_SERVERS=5.5.5.5
    +    ----- end params.mgmt -----
    +  
    +  
    +    shorewall/params:
    +    # Shorewall 1.3 /etc/shorewall/params
    +    [..]
    +    #######################################
    +  
    +    INCLUDE params.mgmt   
    +  
    +    # params unique to this host here
    +    #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
    +    ----- end params -----
    +  
    +  
    +    shorewall/rules.mgmt:
    +    ACCEPT net:$MGMT_SERVERS          $FW    tcp    22
    +    ACCEPT $FW          net:$TIME_SERVERS    udp    123
    +    ACCEPT $FW          net:$BACKUP_SERVERS  tcp    22
    +    ----- end rules.mgmt -----
    +  
    +    shorewall/rules:
    +    # Shorewall version 1.3 - Rules File
    +    [..]
    +    #######################################
    +  
    +    INCLUDE rules.mgmt    
    +  
    +    # rules unique to this host here
    +    #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
    +    ----- end rules -----
    +  
    + INCLUDE's may be nested to a level of 3 -- further nested INCLUDE +directives are ignored with a warning message.
    +
    +
    3. +
  3. Routing traffic from an interface back out that interface continues + to be a problem. While I firmly believe that this should never happen, + people continue to want to do it. To limit the damage that such nonsense + produces, I have added a new 'routeback' option in /etc/shorewall/interfaces + and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the +'ZONE' column may not contain '-'; in other words, 'routeback' can't +be used as an option for a multi-zone interface. The 'routeback' option +CAN be specified however on individual group entries in /etc/shorewall/hosts.
    +  
    + The 'routeback' option is similar to the old 'multi' option with +two exceptions:
    +  
    +    a) The option pertains to a particular zone,interface,address +tuple.
    +  
    +    b) The option only created infrastructure to pass traffic from +(zone,interface,address) tuples back to themselves (the 'multi' option +affected all (zone,interface,address) tuples associated with the given +'interface').
    +  
    + See the 'Upgrade Issues' for information + about how this new option may affect your configuration.
    +
- New Features:
- -
Note: In the list that follows, the term group refers to -a particular network or subnetwork (which may be 0.0.0.0/0 or it may be a -host address) accessed through a particular interface. Examples:
- + +

3/24/2003 - Shorewall 1.4.1

+ + + + + + + + + + + + + + + + + + + + +

This release follows up on 1.4.0. It corrects a problem introduced in 1.4.0 +and removes additional warts.
+
+ Problems Corrected:
+

+ +
    +
  1. When Shorewall 1.4.0 is run under the ash shell (such as on +Bering/LEAF), it can attempt to add ECN disabling rules even if the /etc/shorewall/ecn + file is empty. That problem has been corrected so that ECN disabling rules + are only added if there are entries in /etc/shorewall/ecn.
    2. + +
+ New Features:
+ +
Note: In the list that follows, the term group refers +to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be +a host address) accessed through a particular interface. Examples:
+
eth0:0.0.0.0/0
- eth2:192.168.1.0/24
- eth3:192.0.2.123
-
- You can use the "shorewall check" command to see the groups associated - with each of your zones.
-
- + eth2:192.168.1.0/24
+ eth3:192.0.2.123
+
+ You can use the "shorewall check" command to see the groups associated + with each of your zones.
+ +
    -
  1. Beginning with Shorewall 1.4.1, if a zone Z comprises more than - one group then if there is no explicit Z to Z policy and there are - no rules governing traffic from Z to Z then Shorewall will permit all traffic - between the groups in the zone.
    2. -
  2. Beginning with Shorewall 1.4.1, Shorewall will never create rules - to handle traffic from a group to itself.
    3. -
  3. A NONE policy is introduced in 1.4.1. When a policy of NONE is - specified from Z1 to Z2:
    4. - +
  4. Beginning with Shorewall 1.4.1, if a zone Z comprises more than + one group then if there is no explicit Z to Z policy and there +are no rules governing traffic from Z to Z then Shorewall will permit all +traffic between the groups in the zone.
    5. +
  5. Beginning with Shorewall 1.4.1, Shorewall will never create +rules to handle traffic from a group to itself.
    6. +
  6. A NONE policy is introduced in 1.4.1. When a policy of NONE +is specified from Z1 to Z2:
    7. +
- + - See the upgrade issues for a discussion - of how these changes may affect your configuration. + See the upgrade issues for a discussion + of how these changes may affect your configuration.

3/17/2003 - Shorewall 1.4.0

- Shorewall 1.4 represents - the next step in the evolution of Shorewall. The main thrust of the - initial release is simply to remove the cruft that has accumulated in + Shorewall 1.4 represents + the next step in the evolution of Shorewall. The main thrust of the + initial release is simply to remove the cruft that has accumulated in Shorewall over time.
-
- IMPORTANT: Shorewall 1.4.0 requires the iproute package - ('ip' utility).
-
- Function from 1.3 that has been omitted from this version -include:
- +
+ IMPORTANT: Shorewall 1.4.0 requires the iproute package + ('ip' utility).
+
+ Function from 1.3 that has been omitted from this version + include:
+
    -
  1. The MERGE_HOSTS variable in shorewall.conf is no +
  2. The MERGE_HOSTS variable in shorewall.conf is no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.
    -
    -
    3. -
  3. Interface names of the form <device>:<integer> - in /etc/shorewall/interfaces now generate an error.
    -
    -
    4. -
  4. Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No. - OLD_PING_HANDLING=Yes will generate an error at startup as will specification - of the 'noping' or 'filterping' interface options.
    -
    -
    5. -
  5. The 'routestopped' option in the /etc/shorewall/interfaces - and /etc/shorewall/hosts files is no longer supported and will generate - an error at startup if specified.
    -
    -
    6. -
  6. The Shorewall 1.2 syntax for DNAT and REDIRECT rules -is no longer accepted.
    -
    -
    7. -
  7. The ALLOWRELATED variable in shorewall.conf is no longer - supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.
    -
    -
    8. -
  8. The icmp.def file has been removed.
    -
    9. - -
- Changes for 1.4 include:
- -
    -
  1. The /etc/shorewall/shorewall.conf file has been completely - reorganized into logical sections.
    -
    -
    2. -
  2. LOG is now a valid action for a rule (/etc/shorewall/rules).
    -
    -
    3. -
  3. The firewall script and version file are now installed - in /usr/share/shorewall.
    -
    -
    4. -
  4. Late arriving DNS replies are now silently dropped in - the common chain by default.
    -
    -
    5. -
  5. In addition to behaving like OLD_PING_HANDLING=No, Shorewall - 1.4 no longer unconditionally accepts outbound ICMP packets. So if -you want to 'ping' from the firewall, you will need the appropriate rule -or policy.
    -
    -
    6. -
  6. CONTINUE is now a valid action for a rule (/etc/shorewall/rules).
    -
    -
    7. -
  7. 802.11b devices with names of the form wlan<n> now support - the 'maclist' option.
    -
    -
    8. -
  8. Explicit Congestion Notification (ECN - RFC 3168) may now -be turned off on a host or network basis using the new /etc/shorewall/ecn - file. To use this facility:
    -
    -    a) You must be running kernel 2.4.20
    -    b) You must have applied the patch in
    -    http://www.shorewall/net/pub/shorewall/ecn/patch.
    -    c) You must have iptables 1.2.7a installed.
    -
    -
    9. -
  9. The /etc/shorewall/params file is now processed first so that - variables may be used in the /etc/shorewall/shorewall.conf file.
    -
    -
    10. -
  10. Shorewall now gives a more helpful diagnostic when - the 'ipchains' compatibility kernel module is loaded and a 'shorewall -start' command is issued.
    -
    -
    11. -
  11. The SHARED_DIR variable has been removed from shorewall.conf. - This variable was for use by package maintainers and was not documented - for general use.
    -
    -
    12. -
  12. Shorewall now ignores 'default' routes when detecting masq'd - networks.
    13. - -
- -

3/10/2003 - Shoreall 1.3.14a

- -

A roleup of the following bug fixes and other updates:

- - - - - -

2/8/2003 - Shoreawall 1.3.14

- -

New features include

- -
    -
  1. An OLD_PING_HANDLING option has been added to shorewall.conf. - When set to Yes, Shorewall ping handling is as it has always been - (see http://www.shorewall.net/ping.html).
    -
    - When OLD_PING_HANDLING=No, icmp echo (ping) is handled - via rules and policies just like any other connection request. - The FORWARDPING=Yes option in shorewall.conf and the 'noping' -and 'filterping' options in /etc/shorewall/interfaces will all -generate an error.
    -
    -
    2. -
  2. It is now possible to direct Shorewall to create -a "label" such as  "eth0:0" for IP addresses that it creates under - ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying - the label instead of just the interface name:
    -  
    -    a) In the INTERFACE column of /etc/shorewall/masq
    -    b) In the INTERFACE column of /etc/shorewall/nat
    -  
    3. -
  3. Support for OpenVPN Tunnels.
    -
    -
    4. -
  4. Support for VLAN devices with names of the form -$DEV.$VID (e.g., eth0.0)

    5. -
  5. In /etc/shorewall/tcrules, the MARK value may be optionally - followed by ":" and either 'F' or 'P' to designate that the marking - will occur in the FORWARD or PREROUTING chains respectively. If this - additional specification is omitted, the chain used to mark packets -will be determined by the setting of the MARK_IN_FORWARD_CHAIN option -in shorewall.conf.
    -
    -
    6. -
  6. When an interface name is entered in the SUBNET -column of the /etc/shorewall/masq file, Shorewall previously masqueraded - traffic from only the first subnet defined on that interface. It - did not masquerade traffic from:
    -  
    -    a) The subnets associated with other addresses -on the interface.
    -    b) Subnets accessed through local routers.
    -  
    - Beginning with Shorewall 1.3.14, if you enter an -interface name in the SUBNET column, shorewall will use the firewall's -routing table to construct the masquerading/SNAT rules.
    -  
    - Example 1 -- This is how it works in 1.3.14.
    -   
    - - - 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - - - 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
    - - - 
       [root@gateway test]# shorewall start
       ...
       Masqueraded Subnets and Hosts:
           To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
           To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
       Processing /etc/shorewall/tos...
    -  
    - When upgrading to Shorewall 1.3.14, if you have multiple - local subnets connected to an interface that is specified in -the SUBNET column of an /etc/shorewall/masq entry, your /etc/shorewall/masq - file will need changing. In most cases, you will simply be able to -remove redundant entries. In some cases though, you might want to change -from using the interface name to listing specific subnetworks if the -change described above will cause masquerading to occur on subnetworks - that you don't wish to masquerade.
    -  
    - Example 2 -- Suppose that your current config is -as follows:
    -   
    - - - 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       eth0                    192.168.10.0/24         206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - - - 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    -  
    -    In this case, the second entry in /etc/shorewall/masq - is no longer required.
    -  
    - Example 3 -- What if your current configuration is - like this?
    -  
    - - - 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - - - 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    -  
    -    In this case, you would want to change the entry - in  /etc/shorewall/masq to:
    - - - 
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    192.168.1.0/24          206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    -
    7. - +
  7. Interface names of the form <device>:<integer> + in /etc/shorewall/interfaces now generate an error.
    +
    +
    8. +
  8. Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No. + OLD_PING_HANDLING=Yes will generate an error at startup as will specification + of the 'noping' or 'filterping' interface options.
    +
    +
    9. +
  9. The 'routestopped' option in the /etc/shorewall/interfaces + and /etc/shorewall/hosts files is no longer supported and will generate + an error at startup if specified.
    +
    +
    10. +
  10. The Shorewall 1.2 syntax for DNAT and REDIRECT rules + is no longer accepted.
    +
    +
    11. +
  11. The ALLOWRELATED variable in shorewall.conf is no longer + supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.
    +
    +
    12. +
  12. The icmp.def file has been removed.
    +
    13. +
- -


- 2/5/2003 - Shorewall Support included in Webmin 1.060

- -

Webmin version 1.060 now has Shorewall support included as standard. See - http://www.webmin.com.
-
- 2/4/2003 - Shorewall 1.3.14-RC1

- -

Includes the Beta 2 content plus support for OpenVPN tunnels.

- -

1/28/2003 - Shorewall 1.3.14-Beta2

- -

Includes the Beta 1 content plus restores VLAN device names of the form - $dev.$vid (e.g., eth0.1)

- -

1/25/2003 - Shorewall 1.3.14-Beta1
-

- -

The Beta includes the following changes:
-

- + Changes for 1.4 include:
+
    -
  1. An OLD_PING_HANDLING option has been added -to shorewall.conf. When set to Yes, Shorewall ping handling is -as it has always been (see http://www.shorewall.net/ping.html).
    -
    - When OLD_PING_HANDLING=No, icmp echo (ping) is handled - via rules and policies just like any other connection request. - The FORWARDPING=Yes option in shorewall.conf and the 'noping' -and 'filterping' options in /etc/shorewall/interfaces will all -generate an error.
    -
    -
    2. -
  2. It is now possible to direct Shorewall to create - a "label" such as  "eth0:0" for IP addresses that it creates under - ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying - the label instead of just the interface name:
    -  
    -    a) In the INTERFACE column of /etc/shorewall/masq
    -    b) In the INTERFACE column of /etc/shorewall/nat
    -  
    3. -
  3. When an interface name is entered in the SUBNET - column of the /etc/shorewall/masq file, Shorewall previously masqueraded - traffic from only the first subnet defined on that interface. It - did not masquerade traffic from:
    -  
    -    a) The subnets associated with other addresses -on the interface.
    -    b) Subnets accessed through local routers.
    -  
    - Beginning with Shorewall 1.3.14, if you enter an -interface name in the SUBNET column, shorewall will use the firewall's +
  4. The /etc/shorewall/shorewall.conf file has been completely + reorganized into logical sections.
    +
    +
    5. +
  5. LOG is now a valid action for a rule (/etc/shorewall/rules).
    +
    +
    6. +
  6. The firewall script and version file are now installed + in /usr/share/shorewall.
    +
    +
    7. +
  7. Late arriving DNS replies are now silently dropped +in the common chain by default.
    +
    +
    8. +
  8. In addition to behaving like OLD_PING_HANDLING=No, +Shorewall 1.4 no longer unconditionally accepts outbound ICMP packets. +So if you want to 'ping' from the firewall, you will need the appropriate +rule or policy.
    +
    +
    9. +
  9. CONTINUE is now a valid action for a rule (/etc/shorewall/rules).
    +
    +
    10. +
  10. 802.11b devices with names of the form wlan<n> now +support the 'maclist' option.
    +
    +
    11. +
  11. Explicit Congestion Notification (ECN - RFC 3168) may now +be turned off on a host or network basis using the new /etc/shorewall/ecn + file. To use this facility:
    +
    +    a) You must be running kernel 2.4.20
    +    b) You must have applied the patch in
    +    http://www.shorewall/net/pub/shorewall/ecn/patch.
    +    c) You must have iptables 1.2.7a installed.
    +
    +
    12. +
  12. The /etc/shorewall/params file is now processed first so +that variables may be used in the /etc/shorewall/shorewall.conf file.
    +
    +
    13. +
  13. Shorewall now gives a more helpful diagnostic when + the 'ipchains' compatibility kernel module is loaded and a 'shorewall + start' command is issued.
    +
    +
    14. +
  14. The SHARED_DIR variable has been removed from shorewall.conf. + This variable was for use by package maintainers and was not documented + for general use.
    +
    +
    15. +
  15. Shorewall now ignores 'default' routes when detecting masq'd + networks.
    16. + +
+ +

3/10/2003 - Shoreall 1.3.14a

+ +

A roleup of the following bug fixes and other updates:

+ + + + + +

2/8/2003 - Shoreawall 1.3.14

+ +

New features include

+ +
    +
  1. An OLD_PING_HANDLING option has been added to shorewall.conf. + When set to Yes, Shorewall ping handling is as it has always been + (see http://www.shorewall.net/ping.html).
    +
    + When OLD_PING_HANDLING=No, icmp echo (ping) is handled + via rules and policies just like any other connection request. + The FORWARDPING=Yes option in shorewall.conf and the 'noping' and + 'filterping' options in /etc/shorewall/interfaces will all generate + an error.
    +
    +
    2. +
  2. It is now possible to direct Shorewall to create + a "label" such as  "eth0:0" for IP addresses that it creates under + ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying + the label instead of just the interface name:
    +  
    +    a) In the INTERFACE column of /etc/shorewall/masq
    +    b) In the INTERFACE column of /etc/shorewall/nat
    +  
    3. +
  3. Support for OpenVPN Tunnels.
    +
    +
    4. +
  4. Support for VLAN devices with names of the form +$DEV.$VID (e.g., eth0.0)
    +
    +
    5. +
  5. In /etc/shorewall/tcrules, the MARK value may be +optionally followed by ":" and either 'F' or 'P' to designate that +the marking will occur in the FORWARD or PREROUTING chains respectively. +If this additional specification is omitted, the chain used to mark +packets will be determined by the setting of the MARK_IN_FORWARD_CHAIN +option in shorewall.conf.
    +
    +
    6. +
  6. When an interface name is entered in the SUBNET +column of the /etc/shorewall/masq file, Shorewall previously masqueraded + traffic from only the first subnet defined on that interface. +It did not masquerade traffic from:
    +  
    +    a) The subnets associated with other addresses + on the interface.
    +    b) Subnets accessed through local routers.
    +  
    + Beginning with Shorewall 1.3.14, if you enter an +interface name in the SUBNET column, shorewall will use the firewall's routing table to construct the masquerading/SNAT rules.
    -  
    - Example 1 -- This is how it works in 1.3.14.
    -   
    +  
    + Example 1 -- This is how it works in 1.3.14.
    +   
    - + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
    - - 
       [root@gateway test]# shorewall start
       ...
       Masqueraded Subnets and Hosts:
           To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
           To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
       Processing /etc/shorewall/tos...
    -  
    - When upgrading to Shorewall 1.3.14, if you have multiple - local subnets connected to an interface that is specified in -the SUBNET column of an /etc/shorewall/masq entry, your /etc/shorewall/masq - file will need changing. In most cases, you will simply be able to -remove redundant entries. In some cases though, you might want to change -from using the interface name to listing specific subnetworks if the -change described above will cause masquerading to occur on subnetworks - that you don't wish to masquerade.
    -  
    - Example 2 -- Suppose that your current config is -as follows:
    -   
    - + + 
       [root@gateway test]# shorewall start
       ...
       Masqueraded Subnets and Hosts:
           To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
           To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
       Processing /etc/shorewall/tos...
    +  
    + When upgrading to Shorewall 1.3.14, if you have +multiple local subnets connected to an interface that is specified +in the SUBNET column of an /etc/shorewall/masq entry, your /etc/shorewall/masq + file will need changing. In most cases, you will simply be able to +remove redundant entries. In some cases though, you might want to change +from using the interface name to listing specific subnetworks if the change + described above will cause masquerading to occur on subnetworks that you + don't wish to masquerade.
    +  
    + Example 2 -- Suppose that your current config is +as follows:
    +   
    + + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       eth0                    192.168.10.0/24         206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - - 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    -  
    -    In this case, the second entry in /etc/shorewall/masq - is no longer required.
    -  
    - Example 3 -- What if your current configuration is - like this?
    -  
    - + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    +  
    +    In this case, the second entry in /etc/shorewall/masq + is no longer required.
    +  
    + Example 3 -- What if your current configuration +is like this?
    +  
    + + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    - - 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    -  
    -    In this case, you would want to change the entry - in  /etc/shorewall/masq to:
    - + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    +  
    +    In this case, you would want to change the entry + in  /etc/shorewall/masq to:
    + + + 
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    192.168.1.0/24          206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    -
    7. - + +
+ +


+ 2/5/2003 - Shorewall Support included in Webmin 1.060

+ +

Webmin version 1.060 now has Shorewall support included as standard. See + http://www.webmin.com.
+
+ 2/4/2003 - Shorewall 1.3.14-RC1

+ +

Includes the Beta 2 content plus support for OpenVPN tunnels.

+ +

1/28/2003 - Shorewall 1.3.14-Beta2

+

Includes the Beta 1 content plus restores VLAN device names of the form + $dev.$vid (e.g., eth0.1)

+ +

1/25/2003 - Shorewall 1.3.14-Beta1
+

+ +

The Beta includes the following changes:
+

+ +
    +
  1. An OLD_PING_HANDLING option has been added +to shorewall.conf. When set to Yes, Shorewall ping handling is +as it has always been (see http://www.shorewall.net/ping.html).
    +
    + When OLD_PING_HANDLING=No, icmp echo (ping) is handled + via rules and policies just like any other connection request. + The FORWARDPING=Yes option in shorewall.conf and the 'noping' and + 'filterping' options in /etc/shorewall/interfaces will all generate + an error.
    +
    +
    2. +
  2. It is now possible to direct Shorewall to +create a "label" such as  "eth0:0" for IP addresses that it creates +under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done +by specifying the label instead of just the interface name:
    +  
    +    a) In the INTERFACE column of /etc/shorewall/masq
    +    b) In the INTERFACE column of /etc/shorewall/nat
    +  
    3. +
  3. When an interface name is entered in the SUBNET + column of the /etc/shorewall/masq file, Shorewall previously masqueraded + traffic from only the first subnet defined on that interface. It + did not masquerade traffic from:
    +  
    +    a) The subnets associated with other addresses + on the interface.
    +    b) Subnets accessed through local routers.
    +  
    + Beginning with Shorewall 1.3.14, if you enter an +interface name in the SUBNET column, shorewall will use the firewall's +routing table to construct the masquerading/SNAT rules.
    +  
    + Example 1 -- This is how it works in 1.3.14.
    +   
    + + + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    + + + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
    + + + + 
       [root@gateway test]# shorewall start
       ...
       Masqueraded Subnets and Hosts:
           To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
           To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
       Processing /etc/shorewall/tos...
    +  
    + When upgrading to Shorewall 1.3.14, if you have +multiple local subnets connected to an interface that is specified +in the SUBNET column of an /etc/shorewall/masq entry, your /etc/shorewall/masq + file will need changing. In most cases, you will simply be able to +remove redundant entries. In some cases though, you might want to change +from using the interface name to listing specific subnetworks if the change + described above will cause masquerading to occur on subnetworks that you + don't wish to masquerade.
    +  
    + Example 2 -- Suppose that your current config is +as follows:
    +   
    + + + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       eth0                    192.168.10.0/24         206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    + + + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    +  
    +    In this case, the second entry in /etc/shorewall/masq + is no longer required.
    +  
    + Example 3 -- What if your current configuration +is like this?
    +  
    + + + + 
       [root@gateway test]# cat /etc/shorewall/masq
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    eth2                    206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    + + + + 
       [root@gateway test]# ip route show dev eth2
       192.168.1.0/24  scope link
       192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
       [root@gateway test]#
    +  
    +    In this case, you would want to change the entry + in  /etc/shorewall/masq to:
    + + + + 
       #INTERFACE              SUBNET                  ADDRESS
       eth0                    192.168.1.0/24          206.124.146.176
       #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
    +
    4. + +
+

1/18/2003 - Shorewall 1.3.13 Documentation in PDF Format

- -

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation. + +

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation. the PDF may be downloaded from

-     ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
-     http://slovakia.shorewall.net/pub/shorewall/pdf/ - +     http://slovakia.shorewall.net/pub/shorewall/pdf/ +

1/17/2003 - shorewall.net has MOVED 

- +

Thanks to the generosity of Alex Martin and Rett Consulting, www.shorewall.net and ftp.shorewall.net -are now hosted on a system in Bellevue, Washington. A big thanks to Alex -for making this happen.
-

- + href="http://www.rettc.com">Rett Consulting, www.shorewall.net and +ftp.shorewall.net are now hosted on a system in Bellevue, Washington. A +big thanks to Alex for making this happen.
+

+

1/13/2003 - Shorewall 1.3.13
-

- +

+

Just includes a few things that I had on the burner:
-

- +

+
    -
  1. A new 'DNAT-' action has been added for -entries in the /etc/shorewall/rules file. DNAT- is intended for -advanced users who wish to minimize the number of rules that connection - requests must traverse.
    -
    - A Shorewall DNAT rule actually generates two -iptables rules: a header rewriting rule in the 'nat' table and -an ACCEPT rule in the 'filter' table. A DNAT- rule only generates -the first of these rules. This is handy when you have several DNAT +
  2. A new 'DNAT-' action has been added for + entries in the /etc/shorewall/rules file. DNAT- is intended +for advanced users who wish to minimize the number of rules that +connection requests must traverse.
    +
    + A Shorewall DNAT rule actually generates two +iptables rules: a header rewriting rule in the 'nat' table and +an ACCEPT rule in the 'filter' table. A DNAT- rule only generates +the first of these rules. This is handy when you have several DNAT rules that would generate the same ACCEPT rule.
    -
    -    Here are three rules from my previous rules +
    +    Here are three rules from my previous rules file:
    -
    -         DNAT   net  dmz:206.124.146.177 tcp smtp - - 206.124.146.178
    -         DNAT   net  dmz:206.124.146.177 tcp smtp - - 206.124.146.179
    -         ACCEPT net  dmz:206.124.146.177 tcp www,smtp,ftp,...
    -
    -    These three rules ended up generating _three_ +
    +         DNAT   net  dmz:206.124.146.177 tcp +smtp - 206.124.146.178
    +         DNAT   net  dmz:206.124.146.177 tcp +smtp - 206.124.146.179
    +         ACCEPT net  dmz:206.124.146.177 tcp +www,smtp,ftp,...
    +
    +    These three rules ended up generating _three_ copies of
    -
    -          ACCEPT net  dmz:206.124.146.177 tcp +
    +          ACCEPT net  dmz:206.124.146.177 tcp smtp
    -
    -    By writing the rules this way, I end up with - only one copy of the ACCEPT rule.
    -
    -         DNAT-  net  dmz:206.124.146.177 tcp smtp - -  206.124.146.178
    -         DNAT-  net  dmz:206.124.146.177 tcp smtp - -  206.124.146.179
    -         ACCEPT net  dmz:206.124.146.177 tcp www,smtp,ftp,....
    -
    -
    3. -
  3. The 'shorewall check' command now prints +
    +    By writing the rules this way, I end up with + only one copy of the ACCEPT rule.
    +
    +         DNAT-  net  dmz:206.124.146.177 tcp +smtp -  206.124.146.178
    +         DNAT-  net  dmz:206.124.146.177 tcp +smtp -  206.124.146.179
    +         ACCEPT net  dmz:206.124.146.177 tcp +www,smtp,ftp,....
    +
    +
    4. +
  4. The 'shorewall check' command now prints out the applicable policy between each pair of zones.
    -
    -
    5. -
  5. A new CLEAR_TC option has been added to -shorewall.conf. If this option is set to 'No' then Shorewall won't -clear the current traffic control rules during [re]start. This -setting is intended for use by people that prefer to configure traffic -shaping when the network interfaces come up rather than when the firewall -is started. If that is what you want to do, set TC_ENABLED=Yes and -CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. That way, - your traffic shaping rules can still use the 'fwmark' classifier based -on packet marking defined in /etc/shorewall/tcrules.
    -
    -
    6. -
  6. A new SHARED_DIR variable has been added - that allows distribution packagers to easily move the shared -directory (default /usr/lib/shorewall). Users should never have -a need to change the value of this shorewall.conf setting.
    -
    7. - +
    + +
  7. A new CLEAR_TC option has been added to + shorewall.conf. If this option is set to 'No' then Shorewall +won't clear the current traffic control rules during [re]start. +This setting is intended for use by people that prefer to configure +traffic shaping when the network interfaces come up rather than when +the firewall is started. If that is what you want to do, set TC_ENABLED=Yes + and CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. +That way, your traffic shaping rules can still use the 'fwmark' classifier + based on packet marking defined in /etc/shorewall/tcrules.
    +
    +
    8. +
  8. A new SHARED_DIR variable has been added + that allows distribution packagers to easily move the shared directory + (default /usr/lib/shorewall). Users should never have a need +to change the value of this shorewall.conf setting.
    +
    9. +
- -

1/6/2003 - BURNOUT -

- -

Until further notice, I will not be involved in either Shorewall Development - or Shorewall Support

- + +

1/6/2003 - BURNOUT +

+ +

Until further notice, I will not be involved in either Shorewall Development + or Shorewall Support

+

-Tom Eastep
-

- +

+

12/30/2002 - Shorewall Documentation in PDF Format

- -

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation. + +

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation. the PDF may be downloaded from

- +

    ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
-     http://slovakia.shorewall.net/pub/shorewall/pdf/
-

+

- +

12/27/2002 - Shorewall 1.3.12 Released

- +

Features include:
-

- +

+
    -
  1. "shorewall refresh" now reloads the +
  2. "shorewall refresh" now reloads the traffic shaping rules (tcrules and tcstart).
    3. -
  3. "shorewall debug [re]start" now turns - off debugging after an error occurs. This places the point - of the failure near the end of the trace rather than up in the +
  4. "shorewall debug [re]start" now turns + off debugging after an error occurs. This places the point + of the failure near the end of the trace rather than up in the middle of it.
    5. -
  5. "shorewall [re]start" has been speeded - up by more than 40% with my configuration. Your milage may vary.
    6. -
  6. A "shorewall show classifiers" command - has been added which shows the current packet classification - filters. The output from this command is also added as a separate - page in "shorewall monitor"
    7. -
  7. ULOG (must be all caps) is now accepted - as a valid syslog level and causes the subject packets to -be logged using the ULOG target rather than the LOG target. -This allows you to run ulogd (available from http://www.gnumonks.org/projects/ulogd) +
  8. "shorewall [re]start" has been speeded + up by more than 40% with my configuration. Your milage may +vary.
    9. +
  9. A "shorewall show classifiers" command + has been added which shows the current packet classification + filters. The output from this command is also added as a +separate page in "shorewall monitor"
    10. +
  10. ULOG (must be all caps) is now accepted + as a valid syslog level and causes the subject packets to +be logged using the ULOG target rather than the LOG target. This + allows you to run ulogd (available from http://www.gnumonks.org/projects/ulogd) and log all Shorewall messages to a separate log file.
    11. -
  11. If you are running a kernel that has -a FORWARD chain in the mangle table ("shorewall show mangle" - will show you the chains in the mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes - in shorewall.conf. This allows - for marking input packets based on their destination even -when you are using Masquerading or SNAT.
    12. -
  12. I have cluttered up the /etc/shorewall - directory with empty 'init', 'start', 'stop' and 'stopped' - files. If you already have a file with one of these names, don't - worry -- the upgrade process won't overwrite your file.
    13. -
  13. I have added a new RFC1918_LOG_LEVEL -variable to shorewall.conf. -This variable specifies the syslog level at which packets are -logged as a result of entries in the /etc/shorewall/rfc1918 file. -Previously, these packets were always logged at the 'info' level.
    -
    14. - +
  14. If you are running a kernel that has + a FORWARD chain in the mangle table ("shorewall show mangle" + will show you the chains in the mangle table), you can set +MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. +This allows for marking input packets based on their destination +even when you are using Masquerading or SNAT.
    15. +
  15. I have cluttered up the /etc/shorewall + directory with empty 'init', 'start', 'stop' and 'stopped' + files. If you already have a file with one of these names, don't + worry -- the upgrade process won't overwrite your file.
    16. +
  16. I have added a new RFC1918_LOG_LEVEL + variable to shorewall.conf. + This variable specifies the syslog level at which packets +are logged as a result of entries in the /etc/shorewall/rfc1918 +file. Previously, these packets were always logged at the 'info' +level.
    +
    17. +
- +

12/20/2002 - Shorewall 1.3.12 Beta 3
-

- This version corrects a problem with Blacklist - logging. In Beta 2, if BLACKLIST_LOG_LEVEL was set to anything - but ULOG, the firewall would fail to start and "shorewall refresh" +

+ This version corrects a problem with Blacklist + logging. In Beta 2, if BLACKLIST_LOG_LEVEL was set to anything + but ULOG, the firewall would fail to start and "shorewall refresh" would also fail.
- +

12/20/2002 - Shorewall 1.3.12 Beta 2

- -

The first public Beta version of Shorewall 1.3.12 is now available (Beta - 1 was made available only to a limited audience).
-

- Features include:
- + +

The first public Beta version of Shorewall 1.3.12 is now available (Beta + 1 was made available only to a limited audience).
+

+ Features include:
+
    -
  1. "shorewall refresh" now reloads -the traffic shaping rules (tcrules and tcstart).
    2. -
  2. "shorewall debug [re]start" now -turns off debugging after an error occurs. This places the -point of the failure near the end of the trace rather than up -in the middle of it.
    3. -
  3. "shorewall [re]start" has been -speeded up by more than 40% with my configuration. Your milage +
  4. "shorewall refresh" now reloads + the traffic shaping rules (tcrules and tcstart).
    5. +
  5. "shorewall debug [re]start" now + turns off debugging after an error occurs. This places +the point of the failure near the end of the trace rather than +up in the middle of it.
    6. +
  6. "shorewall [re]start" has been +speeded up by more than 40% with my configuration. Your milage may vary.
    7. -
  7. A "shorewall show classifiers" -command has been added which shows the current packet classification - filters. The output from this command is also added as a separate +
  8. A "shorewall show classifiers" +command has been added which shows the current packet classification + filters. The output from this command is also added as a separate page in "shorewall monitor"
    9. -
  9. ULOG (must be all caps) is now -accepted as a valid syslog level and causes the subject packets -to be logged using the ULOG target rather than the LOG target. -This allows you to run ulogd (available from http://www.gnumonks.org/projects/ulogd) +
  10. ULOG (must be all caps) is now +accepted as a valid syslog level and causes the subject packets +to be logged using the ULOG target rather than the LOG target. + This allows you to run ulogd (available from http://www.gnumonks.org/projects/ulogd) and log all Shorewall messages to a separate log file.
    11. -
  11. If you are running a kernel that - has a FORWARD chain in the mangle table ("shorewall show -mangle" will show you the chains in the mangle table), you -can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows -for marking input packets based on their destination even when - you are using Masquerading or SNAT.
    12. -
  12. I have cluttered up the /etc/shorewall - directory with empty 'init', 'start', 'stop' and 'stopped' - files. If you already have a file with one of these names, don't +
  13. If you are running a kernel that + has a FORWARD chain in the mangle table ("shorewall show +mangle" will show you the chains in the mangle table), you can +set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for + marking input packets based on their destination even when you +are using Masquerading or SNAT.
    14. +
  14. I have cluttered up the /etc/shorewall + directory with empty 'init', 'start', 'stop' and 'stopped' + files. If you already have a file with one of these names, don't worry -- the upgrade process won't overwrite your file.
    15. - +
- You may download the Beta from:
- + You may download the Beta from:
+
http://www.shorewall.net/pub/shorewall/Beta
- ftp://ftp.shorewall.net/pub/shorewall/Beta
-
- + +

12/12/2002 - Mandrake Multi Network Firewall Powered by Mandrake Linux -

- Shorewall is at the center of MandrakeSoft's - recently-announced Multi - Network Firewall (MNF) product. Here is the press +

+ Shorewall is at the center of MandrakeSoft's + recently-announced Multi + Network Firewall (MNF) product. Here is the press release.
- +

12/7/2002 - Shorewall Support for Mandrake 9.0

- -

Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered. - I have installed 9.0 on one of my systems and I am now - in a position to support Shorewall users who run Mandrake -9.0.

+ +

Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered. + I have installed 9.0 on one of my systems and I am now + in a position to support Shorewall users who run Mandrake 9.0.

- +

12/6/2002 - Debian 1.3.11a Packages Available
-

+

- +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

12/3/2002 - Shorewall 1.3.11a

- -

This is a bug-fix roll up which includes Roger Aich's fix for DNAT with - excluded subnets (e.g., "DNAT foo!bar ..."). Current -1.3.11 users who don't need rules of this type need not -upgrade to 1.3.11.

+ +

This is a bug-fix roll up which includes Roger Aich's fix for DNAT with + excluded subnets (e.g., "DNAT foo!bar ..."). Current +1.3.11 users who don't need rules of this type need not upgrade +to 1.3.11.

- +

11/24/2002 - Shorewall 1.3.11

- +

In this version:

- + - +

11/14/2002 - Shorewall Documentation in PDF Format

- -

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation. + +

Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation. the PDF may be downloaded from

- +

    ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
-     http://slovakia.shorewall.net/pub/shorewall/pdf/
-

+

- -

11/09/2002 - Shorewall is Back at SourceForge -

+ +

11/09/2002 - Shorewall is Back at SourceForge +

- +

The main Shorewall 1.3 web site is now back at SourceForge at http://shorewall.sf.net.
-

+

- +

11/09/2002 - Shorewall 1.3.10

- +

In this version:

- - - - -

10/24/2002 - Shorewall is now in Gentoo Linux
-

- Alexandru Hartmann reports - that his Shorewall package is now a part of the Gentoo Linux distribution. - Thanks Alex!
- - -

10/23/2002 - Shorewall 1.3.10 Beta 1

- In this version:
- - + - You may download the Beta + + +

10/24/2002 - Shorewall is now in Gentoo Linux
+

+ Alexandru Hartmann reports + that his Shorewall package is now a part of the Gentoo Linux distribution. + Thanks Alex!
+ + +

10/23/2002 - Shorewall 1.3.10 Beta 1

+ In this version:
+ + + + You may download the Beta from:
- + - +

10/10/2002 -  Debian 1.3.9b Packages Available
-

+

- +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

10/9/2002 - Shorewall 1.3.9b

- This release rolls up fixes + This release rolls up fixes to the installer and to the firewall script.
- +

10/6/2002 - Shorewall.net now running on RH8.0
-
- The firewall and server - here at shorewall.net are now running RedHat release +
+ The firewall and server + here at shorewall.net are now running RedHat release 8.0.
-
- 9/30/2002 - Shorewall 1.3.9a

- Roles up the fix for broken - tunnels.
- - -

9/30/2002 - TUNNELS Broken in 1.3.9!!!

- There is an updated firewall - script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall - -- copy that file to /usr/lib/shorewall/firewall.
+
+ 9/30/2002 - Shorewall +1.3.9a

+ Roles up the fix for +broken tunnels.
+

9/30/2002 - TUNNELS Broken in 1.3.9!!!

+ There is an updated firewall + script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall + -- copy that file to /usr/lib/shorewall/firewall.
+ +

9/28/2002 - Shorewall 1.3.9

- +

In this version:
-

+

- + - -

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
-

- 9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
+

+ Brown Paper Bag - A couple of recent - configuration changes at www.shorewall.net broke - the Search facility:
+ A couple of recent + configuration changes at www.shorewall.net broke + the Search facility:
- -
+ +
- +
    +
  1. Mailing +List Archive Search was not available.
    2. +
  2. The Site +Search index was incomplete
    3. +
  3. Only one +page of matches was presented.
    4. + + + + +
+
+ Hopefully these + problems are now corrected. + +

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
+

+ A couple of recent + configuration changes at www.shorewall.net had the + negative effect of breaking the Search facility:
+ + +
  1. Mailing List Archive Search was not available.
  2. The Site @@ -1071,2027 +1138,2003 @@ Search index was incomplete
  3. Only one page of matches was presented.
    4. - - - -
-
- Hopefully these - problems are now corrected. - -

9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
-

- A couple of recent - configuration changes at www.shorewall.net had the - negative effect of breaking the Search facility:
- - -
    -
  1. Mailing List - Archive Search was not available.
    2. -
  2. The Site Search - index was incomplete
    3. -
  3. Only one page - of matches was presented.
    4. - - +
- Hopefully these + Hopefully these problems are now corrected.
- -

9/18/2002 -  Debian 1.3.8 Packages Available
-

- +

9/18/2002 -  Debian 1.3.8 Packages Available
+

+ +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

9/16/2002 - Shorewall 1.3.8

- +

In this version:
-

+

- + - + - +

9/11/2002 - Debian 1.3.7c Packages Available

- +

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

- +

9/2/2002 - Shorewall 1.3.7c

- -

This is a role up of a fix for "DNAT" rules where the source zone is $FW + +

This is a role up of a fix for "DNAT" rules where the source zone is $FW (fw).

- +

8/31/2002 - I'm not available

- -

I'm currently on vacation  -- please respect my need for a couple of -weeks free of Shorewall problem reports.

+ +

I'm currently on vacation  -- please respect my need for a couple of + weeks free of Shorewall problem reports.

- +

-Tom

- +

8/26/2002 - Shorewall 1.3.7b

- -

This is a role up of the "shorewall refresh" bug fix and the change which - reverses the order of "dhcp" and "norfc1918" + +

This is a role up of the "shorewall refresh" bug fix and the change which + reverses the order of "dhcp" and "norfc1918" checking.

- +

8/26/2002 - French FTP Mirror is Operational

- +

ftp://france.shorewall.net/pub/mirrors/shorewall + href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall is now available.

- +

8/25/2002 - Shorewall Mirror in France

- -

Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored + +

Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored at http://france.shorewall.net.

- +

8/25/2002 - Shorewall 1.3.7a Debian Packages Available

- -

Lorenzo Martignoni reports that the packages for version 1.3.7a are available + +

Lorenzo Martignoni reports that the packages for version 1.3.7a are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

- -

8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author + +

8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author -- Shorewall 1.3.7a released -

+

- -

1.3.7a corrects problems occurring in rules file processing when starting + +

1.3.7a corrects problems occurring in rules file processing when starting Shorewall 1.3.7.

- +

8/22/2002 - Shorewall 1.3.7 Released 8/13/2002

- +

Features in this release include:

- + - -

I would like to thank John Distler for his valuable input regarding TCP - SYN and ICMP treatment in Shorewall. That -input has led to marked improvement in Shorewall + +

I would like to thank John Distler for his valuable input regarding TCP + SYN and ICMP treatment in Shorewall. That +input has led to marked improvement in Shorewall in the last two releases.

- +

8/13/2002 - Documentation in the CVS Repository

- -

The Shorewall-docs project now contains just the HTML and image files -- the Frontpage files have been removed.

+ +

The Shorewall-docs project now contains just the HTML and image files - +the Frontpage files have been removed.

- +

8/7/2002 - STABLE branch added to CVS Repository

- -

This branch will only be updated after I release a new version of Shorewall - so you can always update from this branch + +

This branch will only be updated after I release a new version of Shorewall + so you can always update from this branch to get the latest stable tree.

- -

8/7/2002 - Upgrade Issues section -added to the Errata Page

+ +

8/7/2002 - Upgrade Issues section added + to the Errata Page

- -

Now there is one place to go to look for issues involved with upgrading + +

Now there is one place to go to look for issues involved with upgrading to recent versions of Shorewall.

- +

8/7/2002 - Shorewall 1.3.6

- +

This is primarily a bug-fix rollup with a couple of new features:

- + +
  • The +processing of "New not SYN" packets may be extended + by commands in the new newnotsyn extension script.
    • + + +

    7/30/2002 - Shorewall 1.3.5b Released

    - +

    This interim release:

    - + - +

    7/29/2002 - New Shorewall Setup Guide Available

    - +

    The first draft of this guide is available at http://www.shorewall.net/shorewall_setup_guide.htm. - The guide is intended for use by people who - are setting up Shorewall to manage multiple public - IP addresses and by people who want to learn more about - Shorewall than is described in the single-address guides. + href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm. + The guide is intended for use by people who + are setting up Shorewall to manage multiple public + IP addresses and by people who want to learn more about + Shorewall than is described in the single-address guides. Feedback on the new guide is welcome.

    - +

    7/28/2002 - Shorewall 1.3.5 Debian Package Available

    - -

    Lorenzo Martignoni reports that the packages are version 1.3.5a and are + +

    Lorenzo Martignoni reports that the packages are version 1.3.5a and are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    7/27/2002 - Shorewall 1.3.5a Released

    - +

    This interim release restores correct handling of REDIRECT rules.

    - +

    7/26/2002 - Shorewall 1.3.5 Released

    - -

    This will be the last Shorewall release for a while. I'm going to be -focusing on rewriting a lot of the documentation.

    + +

    This will be the last Shorewall release for a while. I'm going to be + focusing on rewriting a lot of the documentation.

    - +

     In this version:

    - + +
  • The +Samples have been updated to reflect the new capabilities + in this release.
    • + + +

    7/16/2002 - New Mirror in Argentina

    - -

    Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in + +

    Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in Argentina. Thanks Buanzo!!!

    - +

    7/16/2002 - Shorewall 1.3.4 Released

    - +

    In this version:

    - + +
  • The + QuickStart Guide + has been broken into three guides and has been +almost entirely rewritten.
    • +
  • The +Samples have been updated to reflect the new capabilities + in this release.
    • + + +

    7/8/2002 - Shorewall 1.3.3 Debian Package Available

    - +

    Lorenzo Marignoni reports that the packages are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    7/6/2002 - Shorewall 1.3.3 Released

    - +

    In this version:

    - +
      -
    • Entries - in /etc/shorewall/interface that use the wildcard -character ("+") now have the "multi" option assumed.
      • -
    • The 'rfc1918' - chain in the mangle table has been renamed 'man1918' - to make log messages generated from that chain distinguishable - from those generated by the 'rfc1918' chain in - the filter table.
      • -
    • Interface - names appearing in the hosts file are now validated - against the interfaces file.
      • -
    • The TARGET - column in the rfc1918 file is now checked for correctness.
      • -
    • The chain - structure in the nat table has been changed to reduce - the number of rules that a packet must traverse and to - correct problems with NAT_BEFORE_RULES=No
      • -
    • The "hits" - command has been enhanced.
      • - - -
    +
  • Entries + in /etc/shorewall/interface that use the wildcard + character ("+") now have the "multi" option assumed.
    • +
  • The +'rfc1918' chain in the mangle table has been renamed + 'man1918' to make log messages generated from that +chain distinguishable from those generated by the + 'rfc1918' chain in the filter table.
    • +
  • Interface + names appearing in the hosts file are now validated + against the interfaces file.
    • +
  • The +TARGET column in the rfc1918 file is now checked for + correctness.
    • +
  • The +chain structure in the nat table has been changed + to reduce the number of rules that a packet must traverse + and to correct problems with NAT_BEFORE_RULES=No
    • +
  • The +"hits" command has been enhanced.
    • + + +

    6/25/2002 - Samples Updated for 1.3.2

    - -

    The comments in the sample configuration files have been updated to reflect + +

    The comments in the sample configuration files have been updated to reflect new features introduced in Shorewall 1.3.2.

    - +

    6/25/2002 - Shorewall 1.3.1 Debian Package Available

    - +

    Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    6/19/2002 - Documentation Available in PDF Format

    - -

    Thanks to Mike Martinez, the Shorewall Documentation is now available -for download in Adobe PDF format.

    + +

    Thanks to Mike Martinez, the Shorewall Documentation is now available for + download in Adobe + PDF format.

    - +

    6/16/2002 - Shorewall 1.3.2 Released

    - +

    In this version:

    - + +
  • A logwatch command has +been added to /sbin/shorewall.
    • +
  • A dynamic blacklist facility + has been added.
    • +
  • Support + for the Netfilter multiport + match function has been added.
    • +
  • The +files firewall, functions and version + have been moved from /etc/shorewall to /var/lib/shorewall.
    • + + +

    6/6/2002 - Why CVS Web access is Password Protected

    - -

    Last weekend, I installed the CVS Web package to provide brower-based -access to the Shorewall CVS repository. Since then, I have had several -instances where my server was almost unusable due to the high load generated -by website copying tools like HTTrack and WebStripper. These mindless tools:

    + +

    Last weekend, I installed the CVS Web package to provide brower-based access + to the Shorewall CVS repository. Since then, I have had several instances +where my server was almost unusable due to the high load generated by website +copying tools like HTTrack and WebStripper. These mindless tools:

    - +
      -
    • Ignore +
    • Ignore robot.txt files.
      • -
    • Recursively - copy everything that they find.
      • -
    • Should +
    • Recursively + copy everything that they find.
      • +
    • Should be classified as weapons rather than tools.
      • - +
    - -

    These tools/weapons are particularly damaging when combined with CVS Web - because they doggedly follow every link in - the cgi-generated HTML resulting in 1000s of -executions of the cvsweb.cgi script. Yesterday, I spend - several hours implementing measures to block these tools - but unfortunately, these measures resulted in my server - OOM-ing under even moderate load.

    + +

    These tools/weapons are particularly damaging when combined with CVS Web + because they doggedly follow every link in + the cgi-generated HTML resulting in 1000s of executions + of the cvsweb.cgi script. Yesterday, I spend several + hours implementing measures to block these tools but unfortunately, + these measures resulted in my server OOM-ing under + even moderate load.

    - -

    Until I have the time to understand the cause of the OOM (or until I buy - more RAM if that is what is required), CVS + +

    Until I have the time to understand the cause of the OOM (or until I buy + more RAM if that is what is required), CVS Web access will remain Password Protected.

    - +

    6/5/2002 - Shorewall 1.3.1 Debian Package Available

    - +

    Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    6/2/2002 - Samples Corrected

    - -

    The 1.3.0 samples configurations had several serious problems that prevented - DNS and SSH from working properly. These -problems have been corrected in the The 1.3.0 samples configurations had several serious problems that prevented + DNS and SSH from working properly. These problems + have been corrected in the 1.3.1 samples.

    - +

    6/1/2002 - Shorewall 1.3.1 Released

    - +

    Hot on the heels of 1.3.0, this release:

    - + - +

    5/29/2002 - Shorewall 1.3.0 Released

    - -

    In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 - includes:

    + +

    In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 + includes:

    - +
      -
    • A 'filterping' - interface option that allows ICMP echo-request -(ping) requests addressed to the firewall to be handled - by entries in /etc/shorewall/rules and /etc/shorewall/policy.
      • - - -
    +
  • A 'filterping' + interface option that allows ICMP echo-request (ping) + requests addressed to the firewall to be handled by + entries in /etc/shorewall/rules and /etc/shorewall/policy.
    • + + +

    5/23/2002 - Shorewall 1.3 RC1 Available

    - -

    In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) - incorporates the following:

    + +

    In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) + incorporates the following:

    - + - +

    5/19/2002 - Shorewall 1.3 Beta 2 Available

    - -

    In addition to the changes in Beta 1, this release which carries the -designation 1.2.91 adds:

    + +

    In addition to the changes in Beta 1, this release which carries the + designation 1.2.91 adds:

    - + - +

    5/17/2002 - Shorewall 1.3 Beta 1 Available

    - -

    Beta 1 carries the version designation 1.2.90 and implements the following + +

    Beta 1 carries the version designation 1.2.90 and implements the following features:

    - +
      -
    • Simplified - rule syntax which makes the intent of each rule clearer +
    • Simplified + rule syntax which makes the intent of each rule clearer and hopefully makes Shorewall easier to learn.
      • -
    • Upward - compatibility with 1.2 configuration files has been - maintained so that current users can migrate to the +
    • Upward + compatibility with 1.2 configuration files has been + maintained so that current users can migrate to the new syntax at their convenience.
      • -
    • WARNING:  Compatibility with the old - parameterized sample configurations has NOT been maintained. - Users still running those configurations should migrate - to the new sample configurations before upgrading - to 1.3 Beta 1.
      • - - -
    +
  • WARNING:  Compatibility with the old + parameterized sample configurations has NOT been maintained. + Users still running those configurations should migrate + to the new sample configurations before upgrading + to 1.3 Beta 1.
    • + + +

    5/4/2002 - Shorewall 1.2.13 is Available

    - +

    In this version:

    - + +
  • SYN-flood protection is + added.
    • +
  • IP addresses + added under ADD_IP_ALIASES + and ADD_SNAT_ALIASES now inherit the VLSM + and Broadcast Address of the interface's primary + IP address.
    • +
  • The +order in which port forwarding DNAT and Static DNAT + can now be reversed + so that port forwarding rules can override the contents +of /etc/shorewall/nat.
    • + + +

    4/30/2002 - Shorewall Debian News

    - -

    Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the -Debian - Testing Branch and the Debian - Unstable Branch.

    + +

    Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the Debian +Testing Branch and the Debian +Unstable Branch.

    - +

    4/20/2002 - Shorewall 1.2.12 is Available

    - +
      -
    • The 'try' - command works again
      • -
    • There -is now a single RPM that also works with SuSE.
      • - - -
    +
  • The +'try' command works again
    • +
  • There + is now a single RPM that also works with SuSE.
    • + + +

    4/17/2002 - Shorewall Debian News

    - +

    Lorenzo Marignoni reports that:

    - + +
  • Shorewall + 1.2.10 is in the Debian + Testing Branch
    • +
  • Shorewall + 1.2.11 is in the Debian + Unstable Branch
    • + + +

    Thanks, Lorenzo!

    - +

    4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE

    - -

    Thanks to Stefan Mohr, there + +

    Thanks to Stefan Mohr, there is now a Shorewall 1.2.11 - SuSE RPM available.

    + href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm"> + SuSE RPM available.

    - +

    4/13/2002 - Shorewall 1.2.11 Available

    - +

    In this version:

    - + - +

    4/13/2002 - Hamburg Mirror now has FTP

    - +

    Stefan now has an FTP mirror at ftp://germany.shorewall.net/pub/shorewall.  + href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall.  Thanks Stefan!

    - +

    4/12/2002 - New Mirror in Hamburg

    - -

    Thanks to Stefan Mohr, there - is now a mirror of the Shorewall website -at http://germany.shorewall.net. + +

    Thanks to Stefan Mohr, there + is now a mirror of the Shorewall website at + http://germany.shorewall.net.

    - +

    4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available

    - -

    Version 1.1 of the QuickStart - Guide is now available. Thanks to those - who have read version 1.0 and offered their suggestions. + +

    Version 1.1 of the QuickStart + Guide is now available. Thanks to those + who have read version 1.0 and offered their suggestions. Corrections have also been made to the sample scripts.

    - +

    4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available

    - -

    Version 1.0 of the QuickStart - Guide is now available. This Guide and - its accompanying sample configurations are expected - to provide a replacement for the recently withdrawn -parameterized samples.

    + +

    Version 1.0 of the QuickStart + Guide is now available. This Guide and + its accompanying sample configurations are expected + to provide a replacement for the recently withdrawn parameterized + samples.

    - +

    4/8/2002 - Parameterized Samples Withdrawn

    - +

    Although the parameterized - samples have allowed people to get a -firewall up and running quickly, they have unfortunately - set the wrong level of expectation among those who -have used them. I am therefore withdrawing support for -the samples and I am recommending that they not be used in -new Shorewall installations.

    + href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized + samples have allowed people to get a firewall + up and running quickly, they have unfortunately + set the wrong level of expectation among those who +have used them. I am therefore withdrawing support for the +samples and I am recommending that they not be used in new + Shorewall installations.

    - +

    4/2/2002 - Updated Log Parser

    - -

    John Lodge has provided an updated + +

    John Lodge has provided an updated version of his CGI-based log parser - with corrected date handling.

    + href="pub/shorewall/parsefw/">CGI-based log parser + with corrected date handling.

    - +

    3/30/2002 - Shorewall Website Search Improvements

    - -

    The quick search on the home page now excludes the mailing list archives. - The Extended -Search allows excluding the archives or -restricting the search to just the archives. An archive - search form is also available on the mailing list information + +

    The quick search on the home page now excludes the mailing list archives. + The Extended Search + allows excluding the archives or restricting +the search to just the archives. An archive search +form is also available on the mailing list information page.

    - +

    3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)

    - + +
  • Shorewall + 1.2.9 is now in the Debian + Unstable Distribution.
    • + + +

    3/25/2002 - Log Parser Available

    - +

    John Lodge has provided a CGI-based log parser for Shorewall. Thanks + href="pub/shorewall/parsefw/">CGI-based log parser for Shorewall. Thanks John.

    - +

    3/20/2002 - Shorewall 1.2.10 Released

    - +

    In this version:

    - +
      -
    • A "shorewall - try" command has been added (syntax: shorewall -try <configuration directory>). - This command attempts "shorewall -c <configuration -directory> start" and if that results in the firewall - being stopped due to an error, a "shorewall start" command - is executed. The 'try' command allows you to create a new - configuration and -attempt to start it; if there is an error that leaves your - firewall in the stopped state, it will automatically be restarted - using the default configuration (in /etc/shorewall).
      • -
    • A new -variable ADD_SNAT_ALIASES has been added to /etc/shorewall/shorewall.conf. - If this variable is set to "Yes", Shorewall will automatically - add IP addresses listed in the third column of -the /etc/shorewall/masq -file.
      • -
    • Copyright - notices have been added to the documenation.
      • - - -
    +
  • A "shorewall + try" command has been added (syntax: shorewall try + <configuration directory>). This + command attempts "shorewall -c <configuration +directory> start" and if that results in the firewall + being stopped due to an error, a "shorewall start" command + is executed. The 'try' command allows you to create a new + configuration and attempt + to start it; if there is an error that leaves your firewall + in the stopped state, it will automatically be restarted using + the default configuration (in /etc/shorewall).
    • +
  • A new + variable ADD_SNAT_ALIASES has been added to /etc/shorewall/shorewall.conf. + If this variable is set to "Yes", Shorewall will +automatically add IP addresses listed in the third + column of the /etc/shorewall/masq + file.
    • +
  • Copyright + notices have been added to the documenation.
    • + + +

    3/11/2002 - Shorewall 1.2.9 Released

    - +

    In this version:

    - + + + + +

    3/1/2002 - 1.2.8 Debian Package is Available

    + + + +

    See http://security.dsi.unimi.it/~lorenzo/debian.html

    + + + +

    2/25/2002 - New Two-interface Sample

    + + +

    I've enhanced the two interface sample to allow access from the firewall + to servers in the local zone - + http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

    + + +

    2/23/2002 - Shorewall 1.2.8 Released

    + + + +

    Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects + problems associated with the lock file used to prevent multiple state-changing + operations from occuring simultaneously. My + apologies for any inconvenience my carelessness + may have caused.

    + + + +

    2/22/2002 - Shorewall 1.2.7 Released

    + + + +

    In this version:

    + + + +
      +
    • UPnP +probes (UDP destination port 1900) are now silently + dropped in the common chain
      • +
    • RFC +1918 checking in the mangle table has been streamlined + to no longer require packet marking. RFC 1918 checking + in the filter table has been changed to require half as + many rules as previously.
      • +
    • A 'shorewall + check' command has been added that does a cursory + validation of the zones, interfaces, hosts, rules and + policy files.
      • + + +
    + + + +

    2/18/2002 - 1.2.6 Debian Package is Available

    + + + +

    See http://security.dsi.unimi.it/~lorenzo/debian.html

    + + + +

    2/8/2002 - Shorewall 1.2.6 Released

    + + + +

    In this version:

    + + + +
      +
    • $-variables + may now be used anywhere in the configuration files + except /etc/shorewall/zones.
      • +
    • The +interfaces and hosts files now have their contents + validated before any changes are made to the existing + Netfilter configuration. The appearance of a zone +name that isn't defined in /etc/shorewall/zones causes "shorewall + start" and "shorewall restart" to abort without changing + the Shorewall state. Unknown options in either file cause +a warning to be issued.
      • +
    • A problem + occurring when BLACKLIST_LOGLEVEL was not set has + been corrected.
      • + + +
    + + +

    2/4/2002 - Shorewall 1.2.5 Debian Package Available

    + + + +

    see http://security.dsi.unimi.it/~lorenzo/debian.html

    + + + +

    2/1/2002 - Shorewall 1.2.5 Released

    + + + +

    Due to installation problems with Shorewall 1.2.4, I have released Shorewall + 1.2.5. Sorry for the rapid-fire development.

    + + + +

    In version 1.2.5:

    + + + +
      +
    • The installation + problems have been corrected.
      • +
    • SNAT is now supported.
      • +
    • A "shorewall + version" command has been added
      • +
    • The default + value of the STATEDIR variable in /etc/shorewall/shorewall.conf + has been changed to /var/lib/shorewall in order + to conform to the GNU/Linux File Hierarchy Standard, + Version 2.2.
      • + + +
    + + +

    1/28/2002 - Shorewall 1.2.4 Released

    + + + +
      +
    • The "fw" + zone may now be given a + different name.
      • +
    • You may + now place end-of-line comments (preceded by '#') in + any of the configuration files
      • +
    • There +is now protection against against two state changing + operations occuring concurrently. This is implemented + using the 'lockfile' utility if it is available + (lockfile is part of procmail); otherwise, a less robust + technique is used. The lockfile is created in the STATEDIR + defined in /etc/shorewall/shorewall.conf and has the +name "lock".
      • +
    • "shorewall + start" no longer fails if "detect" is specified + in /etc/shorewall/interfaces + for an interface with subnet mask 255.255.255.255.
      • + + +
    + + +

    1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

    + + + +

    1/20/2002 - Corrected firewall script available 

    + + + +

    Corrects a problem with BLACKLIST_LOGLEVEL. See the + errata for details.

    + + + +

    1/19/2002 - Shorewall 1.2.3 Released

    + + + +

    This is a minor feature and bugfix release. The single new feature is:

    + + + +
      +
    • Support + for TCP MSS Clamp to PMTU -- This support is usually + required when the internet connection is via PPPoE + or PPTP and may be enabled using the CLAMPMSS option in /etc/shorewall/shorewall.conf.
      • + + +
    + + +

    The following problems were corrected:

    + + +
      +
    • The "shorewall + status" command no longer hangs.
      • +
    • The "shorewall + monitor" command now displays the icmpdef chain
      • +
    • The CLIENT + PORT(S) column in tcrules is no longer ignored
      • + + +
    + + +

    1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release

    + + + +

    Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution + that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo + for details.

    + + + +

    1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 + Shorewall Debian package is now available. There + is a link to Lorenzo's site from the Shorewall download page.

    + + + +

    1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores + the "shorewall status" command to health.

    + + + +

    1/8/2002 - Shorewall 1.2.2 Released

    + + + +

    In version 1.2.2

    + + + +
      +
    • Support + for IP blacklisting has been added + + + + +
        +
      • You +specify whether you want packets from blacklisted +hosts dropped or rejected using the BLACKLIST_DISPOSITION + setting in /etc/shorewall/shorewall.conf
        • +
      • You +specify whether you want packets from blacklisted +hosts logged and at what syslog level using the + BLACKLIST_LOGLEVEL + setting in /etc/shorewall/shorewall.conf
        • +
      • You +list the IP addresses/subnets that you wish to blacklist + in /etc/shorewall/blacklist
        • +
      • You +specify the interfaces you want checked against the + blacklist using the new "blacklist" option + in /etc/shorewall/interfaces.
        • +
      • The +black list is refreshed from /etc/shorewall/blacklist + by the "shorewall refresh" command.
        • + - -
      • Several - bugs have been fixed
        • -
      • The 1.2.9 - Debian Package is also available at http://security.dsi.unimi.it/~lorenzo/debian.html.
        • +
      • Use of + TCP RST replies has been expanded  - -
      - -

      3/1/2002 - 1.2.8 Debian Package is Available

      - - - -

      See http://security.dsi.unimi.it/~lorenzo/debian.html

      - - - -

      2/25/2002 - New Two-interface Sample

      - - -

      I've enhanced the two interface sample to allow access from the firewall - to servers in the local zone - - http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

      - - -

      2/23/2002 - Shorewall 1.2.8 Released

      - - - -

      Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects - problems associated with the lock file used to prevent multiple state-changing - operations from occuring simultaneously. -My apologies for any inconvenience my carelessness - may have caused.

      - - - -

      2/22/2002 - Shorewall 1.2.7 Released

      - - - -

      In this version:

      - - - -
        -
      • UPnP -probes (UDP destination port 1900) are now silently - dropped in the common chain
        • -
      • RFC 1918 - checking in the mangle table has been streamlined - to no longer require packet marking. RFC 1918 checking - in the filter table has been changed to require half -as many rules as previously.
        • -
      • A 'shorewall - check' command has been added that does a cursory - validation of the zones, interfaces, hosts, rules -and policy files.
        • - - -
      - - - -

      2/18/2002 - 1.2.6 Debian Package is Available

      - - - -

      See http://security.dsi.unimi.it/~lorenzo/debian.html

      - - - -

      2/8/2002 - Shorewall 1.2.6 Released

      - - - -

      In this version:

      - - - -
        -
      • $-variables - may now be used anywhere in the configuration files - except /etc/shorewall/zones.
        • -
      • The interfaces - and hosts files now have their contents validated - before any changes are made to the existing Netfilter - configuration. The appearance of a zone name that isn't - defined in /etc/shorewall/zones causes "shorewall -start" and "shorewall restart" to abort without changing - the Shorewall state. Unknown options in either file cause -a warning to be issued.
        • -
      • A problem - occurring when BLACKLIST_LOGLEVEL was not set has - been corrected.
        • - - -
      - - -

      2/4/2002 - Shorewall 1.2.5 Debian Package Available

      - - - -

      see http://security.dsi.unimi.it/~lorenzo/debian.html

      - - - -

      2/1/2002 - Shorewall 1.2.5 Released

      - - - -

      Due to installation problems with Shorewall 1.2.4, I have released Shorewall - 1.2.5. Sorry for the rapid-fire development.

      - - - -

      In version 1.2.5:

      - - - -
        -
      • The installation - problems have been corrected.
        • -
      • SNAT is now supported.
        • -
      • A "shorewall - version" command has been added
        • -
      • The default - value of the STATEDIR variable in /etc/shorewall/shorewall.conf - has been changed to /var/lib/shorewall in -order to conform to the GNU/Linux File Hierarchy Standard, - Version 2.2.
        • - - -
      - - -

      1/28/2002 - Shorewall 1.2.4 Released

      - - - -
        -
      • The "fw" - zone may now be given a - different name.
        • -
      • You may - now place end-of-line comments (preceded by '#') -in any of the configuration files
        • -
      • There -is now protection against against two state changing - operations occuring concurrently. This is implemented - using the 'lockfile' utility if it is available -(lockfile is part of procmail); otherwise, a less robust - technique is used. The lockfile is created in the STATEDIR - defined in /etc/shorewall/shorewall.conf and has the name - "lock".
        • -
      • "shorewall - start" no longer fails if "detect" is specified - in /etc/shorewall/interfaces - for an interface with subnet mask 255.255.255.255.
        • - - -
      - - -

      1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

      - - - -

      1/20/2002 - Corrected firewall script available 

      - - - -

      Corrects a problem with BLACKLIST_LOGLEVEL. See the - errata for details.

      - - - -

      1/19/2002 - Shorewall 1.2.3 Released

      - - - -

      This is a minor feature and bugfix release. The single new feature is:

      - - - -
        -
      • Support - for TCP MSS Clamp to PMTU -- This support is usually - required when the internet connection is via PPPoE - or PPTP and may be enabled using the CLAMPMSS option in /etc/shorewall/shorewall.conf.
        • - - -
      - - -

      The following problems were corrected:

      - - -
        -
      • The "shorewall - status" command no longer hangs.
        • -
      • The "shorewall - monitor" command now displays the icmpdef chain
        • -
      • The CLIENT - PORT(S) column in tcrules is no longer ignored
        • - - -
      - - -

      1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release

      - - - -

      Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution - that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo - for details.

      - - - -

      1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 - Shorewall Debian package is now available. -There is a link to Lorenzo's site from the Shorewall download page.

      - - - -

      1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores - the "shorewall status" command to health.

      - - - -

      1/8/2002 - Shorewall 1.2.2 Released

      - - - -

      In version 1.2.2

      - - - -
        -
      • Support - for IP blacklisting has been added - - - - +
          -
        • You -specify whether you want packets from blacklisted - hosts dropped or rejected using the BLACKLIST_DISPOSITION - setting in /etc/shorewall/shorewall.conf
          • -
        • You -specify whether you want packets from blacklisted - hosts logged and at what syslog level using the - BLACKLIST_LOGLEVEL - setting in /etc/shorewall/shorewall.conf
          • -
        • You -list the IP addresses/subnets that you wish to blacklist - in /etc/shorewall/blacklist
          • -
        • You -specify the interfaces you want checked against the - blacklist using the new "blacklist" option - in /etc/shorewall/interfaces.
          • -
        • The -black list is refreshed from /etc/shorewall/blacklist - by the "shorewall refresh" command.
          • - - - - - -
        -
        • -
      • Use of -TCP RST replies has been expanded  - - - - -
          -
        • TCP -connection requests rejected because of a REJECT policy +
        • TCP +connection requests rejected because of a REJECT policy are now replied with a TCP RST packet.
          • -
        • TCP -connection requests rejected because of a protocol=all - rule in /etc/shorewall/rules are now replied +
        • TCP +connection requests rejected because of a protocol=all + rule in /etc/shorewall/rules are now replied with a TCP RST packet.
          • - -
        -
        • -
      • A LOGFILE specification - has been added to /etc/shorewall/shorewall.conf. LOGFILE is used - to tell the /sbin/shorewall program where to look for Shorewall - messages.
        • - + +
      +
      • +
    • A LOGFILE specification + has been added to /etc/shorewall/shorewall.conf. LOGFILE is +used to tell the /sbin/shorewall program where to look for +Shorewall messages.
      • + +
    - +

    1/5/2002 - New Parameterized Samples (version 1.2.0) released. These are minor updates - to the previously-released samples. There are + target="_blank">version 1.2.0) released. These are minor updates + to the previously-released samples. There are two new rules added:

    - + - - -

    See the README file for upgrade instructions.

    +
  • Unless + you have explicitly enabled Auth connections (tcp + port 113) to your firewall, these connections will be +REJECTED rather than DROPPED. This speeds up connection + establishment to some servers.
    • +
  • Orphan + DNS replies are now silently dropped.
    • + + + +

    See the README file for upgrade instructions.

    + +

    1/1/2002 - Shorewall Mailing List Moving

    - -

    The Shorewall mailing list hosted at - Sourceforge is moving to Shorewall.net. - If you are a current subscriber to the list at Sourceforge, - please see these -instructions. If you would like to subscribe -to the new list, visit The Shorewall mailing list hosted at + Sourceforge is moving to Shorewall.net. + If you are a current subscriber to the list at Sourceforge, + please see these instructions. + If you would like to subscribe to the new list, + visit http://www.shorewall.net/mailman/listinfo/shorewall-users.

    - +

    12/31/2001 - Shorewall 1.2.1 Released

    - +

    In version 1.2.1:

    - + +
  • 'shorewall + show tc' now correctly handles tunnels.
    • -

    12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist -releasing 1.2 on 12/21/2001

    - - - -

    Version 1.2 contains the following new features:

    - - - - - -

    For the next month or so, I will continue to provide corrections to version - 1.1.18 as necessary so that current version - 1.1.x users will not be forced into a quick upgrade - to 1.2.0 just to have access to bug fixes.

    - - -

    For those of you who have installed one of the Beta RPMS, you will need - to use the "--oldpackage" option when upgrading - to 1.2.0:

    - - -
    - - -

    rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

    -
    - - - -

    12/19/2001 - Thanks to Steve - Cowles, there is now a Shorewall mirror -in Texas. This web site is mirrored at http://www.infohiiway.com/shorewall - and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

    - - - -

    11/30/2001 - A new set of the parameterized Sample - Configurations has been released. In this version:

    - - - - - - -

    11/20/2001 - The current version of Shorewall is 1.1.18. 

    - - - -

    In this version:

    - - - - - - - -

    11/19/2001 - Thanks to Juraj - Ontkanin, there is now a Shorewall - mirror in the Slovak Republic. The website is -now mirrored at http://www.nrg.sk/mirror/shorewall - and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

    - - - -

    11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. - There are three sample configurations:

    - - - - + +

    12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist releasing +1.2 on 12/21/2001

    +

    Version 1.2 contains the following new features:

    + + + + + + +

    For the next month or so, I will continue to provide corrections to version + 1.1.18 as necessary so that current version + 1.1.x users will not be forced into a quick upgrade + to 1.2.0 just to have access to bug fixes.

    + + +

    For those of you who have installed one of the Beta RPMS, you will need + to use the "--oldpackage" option when upgrading + to 1.2.0:

    + + +
    + + +

    rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

    +
    + + + +

    12/19/2001 - Thanks to Steve + Cowles, there is now a Shorewall mirror + in Texas. This web site is mirrored at http://www.infohiiway.com/shorewall + and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

    + + + +

    11/30/2001 - A new set of the parameterized Sample +Configurations has been released. In this version:

    + + + + + + +

    11/20/2001 - The current version of Shorewall is 1.1.18. 

    + + + +

    In this version:

    + + + + + + + +

    11/19/2001 - Thanks to Juraj + Ontkanin, there is now a Shorewall + mirror in the Slovak Republic. The website is + now mirrored at http://www.nrg.sk/mirror/shorewall + and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

    + + + +

    11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. + There are three sample configurations:

    + + + + + + +

    Samples may be downloaded from ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 - . See the README file for instructions.

    + href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 + . See the README file for instructions.

    - -

    11/1/2001 - The current version of Shorewall is 1.1.17.  I intend - this to be the last of the 1.1 Shorewall - releases.

    + +

    11/1/2001 - The current version of Shorewall is 1.1.17.  I intend + this to be the last of the 1.1 Shorewall + releases.

    - +

    In this version:

    - + - -

    10/22/2001 - The current version of Shorewall is 1.1.16. In this - version:

    + +

    10/22/2001 - The current version of Shorewall is 1.1.16. In this + version:

    - + - -

    10/15/2001 - The current version of Shorewall is 1.1.15. In this - version:

    + +

    10/15/2001 - The current version of Shorewall is 1.1.15. In this + version:

    + + + + + +

    10/4/2001 - The current version of Shorewall is 1.1.14. In this + version

    - - -

    10/4/2001 - The current version of Shorewall is 1.1.14. In this - version

    - - - - -

    9/12/2001 - The current version of Shorewall is 1.1.13. In this + +

    9/12/2001 - The current version of Shorewall is 1.1.13. In this version

    - + - -

    8/28/2001 - The current version of Shorewall is 1.1.12. In this + +

    8/28/2001 - The current version of Shorewall is 1.1.12. In this version

    - + - -

    7/28/2001 - The current version of Shorewall is 1.1.11. In this + +

    7/28/2001 - The current version of Shorewall is 1.1.11. In this version

    - + - -

    7/6/2001 - The current version of Shorewall is 1.1.10. In this -version

    + +

    7/6/2001 - The current version of Shorewall is 1.1.10. In this version

    - + - -

    6/23/2001 - The current version of Shorewall is 1.1.9. In this -version

    + +

    6/23/2001 - The current version of Shorewall is 1.1.9. In this version

    - + - -

    6/18/2001 - The current version of Shorewall is 1.1.8. In this -version

    + +

    6/18/2001 - The current version of Shorewall is 1.1.8. In this version

    - + - +

    6/2/2001 - The current version of Shorewall is 1.1.7. In this version

    - + - -

    5/25/2001 - The current version of Shorewall is 1.1.6. In this -version

    + +

    5/25/2001 - The current version of Shorewall is 1.1.6. In this version

    - + - -

    5/20/2001 - The current version of Shorewall is 1.1.5. In this -version

    + +

    5/20/2001 - The current version of Shorewall is 1.1.5. In this version

    - + - -

    5/10/2001 - The current version of Shorewall is 1.1.4. In this -version

    + +

    5/10/2001 - The current version of Shorewall is 1.1.4. In this version

    - + - -

    4/28/2001 - The current version of Shorewall is 1.1.3. In this -version

    + +

    4/28/2001 - The current version of Shorewall is 1.1.3. In this version

    - + +
  • Previously, + placing "-" in the PORT(S) column in /etc/shorewall/rules + resulted in an error message during start. This has + been corrected.
    • +
  • The first + line of "install.sh" has been corrected -- I had + inadvertently deleted the initial "#".
    • -

    4/12/2001 - The current version of Shorewall is 1.1.2. In this -version

    + - + +

    4/12/2001 - The current version of Shorewall is 1.1.2. In this version

    + + +
  • Port +redirection now works again.
    • +
  • The icmpdef + and common chains may + now be user-defined.
    • +
  • The firewall + no longer fails to start if "routefilter" is + specified for an interface that isn't started. A warning + message is now issued in this case.
    • +
  • The LRP + Version is renamed "shorwall" for 8,3 MSDOS file + system compatibility.
    • +
  • A couple + of LRP-specific problems were corrected.
    • + + +

    4/8/2001 - Shorewall is now affiliated with the Leaf Project -

    +

    - +

    4/5/2001 - The current version of Shorewall is 1.1.1. In this version:

    - + +
  • The common + chain is traversed from INPUT, OUTPUT and FORWARD + before logging occurs
    • +
  • The source + has been cleaned up dramatically
    • +
  • DHCP +DISCOVER packets with RFC1918 source addresses no +longer generate log messages. Linux DHCP clients generate + such packets and it's annoying to see them logged. 
    • + + +

    3/25/2001 - The current version of Shorewall is 1.1.0. In this version:

    - + - +

    3/19/2001 - The current version of Shorewall is 1.0.4. This version:

    - + +
  • Compresses + the output of "shorewall monitor" if awk is installed. + Allows the command to work if awk isn't installed (although + it's not pretty).
    • -

    3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix - release with no new features.

    + - + +

    3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix + release with no new features.

    + + - -

    3/8/2001 - The current version of Shorewall is 1.0.2. It supports an - additional "gw" (gateway) zone for tunnels - and it supports IPSEC tunnels with end-points on the - firewall. There is also a .lrp available now.

    + +

    3/8/2001 - The current version of Shorewall is 1.0.2. It supports an + additional "gw" (gateway) zone for tunnels + and it supports IPSEC tunnels with end-points on +the firewall. There is also a .lrp available now.

    - -

    Updated 5/18/2003 - Tom Eastep + +

    Updated 5/19/2003 - Tom Eastep

    - +

    Copyright © 2001, 2002 Thomas M. Eastep.
    -
    -

    +

    +
    diff --git a/STABLE/documentation/images/network.png b/STABLE/documentation/images/network.png index fab0fcace..8e07ed5c8 100644 Binary files a/STABLE/documentation/images/network.png and b/STABLE/documentation/images/network.png differ diff --git a/STABLE/documentation/seattlefirewall_index.htm b/STABLE/documentation/seattlefirewall_index.htm index c1cbb868b..22580a69b 100644 --- a/STABLE/documentation/seattlefirewall_index.htm +++ b/STABLE/documentation/seattlefirewall_index.htm @@ -2,107 +2,107 @@ - + Shoreline Firewall (Shorewall) 1.4 - + - + - - + + - - - - - + + + + +
    + - +

    Shorwall Logo - (Shorewall Logo) -

    - - + + - -
    - + +
    + +

    Shorewall 1.4 "iptables made easy"
    -
    +
    -

    -
    + +
    - +

    -
    - -
    -
    + +
    +
    - - - + - + + - +
    + - + - - + +
    +
    + +

    What is it?

    - -

    The Shoreline Firewall, more commonly known as "Shorewall", is a - Netfilter (iptables) based firewall - that can be used on a dedicated firewall system, a multi-function - gateway/router/server or on a standalone GNU/Linux system.

    + +

    The Shoreline Firewall, more commonly known as "Shorewall", is +a Netfilter (iptables) based +firewall that can be used on a dedicated firewall system, a multi-function + gateway/router/server or on a standalone GNU/Linux system.

    - -

    This program is free software; you can redistribute it and/or modify - it - under the terms of Version 2 of the GNU -General Public License as published by the Free Software - Foundation.
    + +

    This program is free software; you can redistribute it and/or modify + it + under the terms of Version 2 of the +GNU General Public License as published by the Free Software + Foundation.
    -
    - This - program is distributed in the hope that - it will be useful, but WITHOUT ANY WARRANTY; - without even the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. - See the GNU General Public License for more -details.
    +
    + This + program is distributed in the hope that + it will be useful, but WITHOUT ANY WARRANTY; + without even the implied warranty of MERCHANTABILITY + or FITNESS FOR A PARTICULAR PURPOSE. + See the GNU General Public License for more details.
    -
    - You - should have received a copy of the GNU -General Public License along with - this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, +
    + You + should have received a copy of the GNU + General Public License along with + this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

    - +

    Copyright 2001, 2002, 2003 Thomas M. Eastep

    @@ -110,192 +110,216 @@ General Public License along with - +

    Running Shorewall on Mandrake with a two-interface setup?

    - If so, almost NOTHING on this site will apply directly to your setup. - If you want to use the documentation that you find here, it is best if you - uninstall what you have and install a setup that matches the documentation - on this site. See the Two-interface QuickStart + If so, almost NOTHING on this site will apply directly to your +setup. If you want to use the documentation that you find here, it is best +if you uninstall what you have and install a setup that matches the documentation + on this site. See the Two-interface QuickStart Guide for details.
    - +

    Getting Started with Shorewall

    - New to Shorewall? Start by selecting the QuickStart Guide that most closely - match your environment and follow the step by step instructions.
    - - + New to Shorewall? Start by selecting the QuickStart Guide that most closely + match your environment and follow the step by step instructions.
    + +

    News

    - + +

    5/20/2003 - Shorewall-1.4.3a (New) +
    +

    +This version primarily corrects the documentation included in the .tgz and +in the .rpm. In addition:
    +
      +
    1. (This change is in 1.4.3 but is not documented) If you are running +iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject replies +as follows:
      +   a) tcp - RST
      +   b) udp - ICMP port unreachable
      +   c) icmp - ICMP host unreachable
      +   d) Otherwise - ICMP host prohibited
      +If you are running earlier software, Shorewall will follow it's traditional +convention:
      +   a) tcp - RST
      +   b) Otherwise - ICMP port unreachable
      2. +
    2. UDP port 135 is now silently dropped in the common.def chain. +Remember that this chain is traversed just before a DROP or REJECT policy +is enforced.
      +
      3. +

    5/18/2003 - Shorewall 1.4.3 (New) -
    -

    -     Problems Corrected:
    -     +
    +

    +     Problems Corrected:
    +
      -
    1. There were several cases where Shorewall would fail to remove +
    2. There were several cases where Shorewall would fail to remove a temporary directory from /tmp. These cases have been corrected.
      3. -
    3. The rules for allowing all traffic via the loopback interface - have been moved to before the rule that drops status=INVALID packets. This - insures that all loopback traffic is allowed even if Netfilter connection +
    4. The rules for allowing all traffic via the loopback interface + have been moved to before the rule that drops status=INVALID packets. This + insures that all loopback traffic is allowed even if Netfilter connection tracking is confused.
      5. - +
    -     New Features:
    -     +     New Features:
    +
      -
    1.  IPV6-IPV4 (6to4) tunnels are now supported +
    2.  IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels file.
      3. -
    3. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) - by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. +
    4. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) + by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may not use ULOG with fireparse unless you modify fireparse.
      5. - +
    - +

    5/10/2003 - Shorewall Mirror in Asia
    -

    - Ed Greshko has established a mirror in Taiwan -- Thanks Ed! - -

    5/8/2003 - Shorewall Mirror in Chile  

    - -

    Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.

    - + Ed Greshko has established a mirror in Taiwan -- Thanks Ed! + +

    5/8/2003 - Shorewall Mirror in Chile  

    + +

    Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.
    +

    +

    4/26/2003 - lists.shorewall.net Downtime

    - +

    The list server will be down this morning for upgrade to RH9.0.
    -

    +

    - -

    4/21/2003 - Samples updated for Shorewall version 1.4.2 + +

    4/21/2003 - Samples updated for Shorewall version 1.4.2

    - -

    Thanks to Francesca Smith, the sample configurations are now upgraded - to Shorewall version 1.4.2.

    + +

    Thanks to Francesca Smith, the sample configurations are now upgraded + to Shorewall version 1.4.2.

    - -

    4/12/2002 - Greater Seattle Linux Users Group Presentation + +

    4/12/2002 - Greater Seattle Linux Users Group Presentation

    - -
    This morning, I gave a - Shorewall presentation to GSLUG. The presentation is in - HTML format but was generated from Microsoft PowerPoint and is best viewed - using Internet Explorer (although Konqueror also seems to work reasonably - well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to -view the presentation.
    -
    + +
    This morning, I gave a + Shorewall presentation to GSLUG. The presentation is +in HTML format but was generated from Microsoft PowerPoint and is best +viewed using Internet Explorer (although Konqueror also seems to work +reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape work +well to view the presentation.
    +
    - +

    - -
    + +
      - +
    -
    +
    - +

    More News

    - +

    (Leaf Logo) - Jacques - Nilo and Eric Wolzak have a LEAF (router/firewall/gateway - on a floppy, CD or compact flash) distribution - called Bering that -features Shorewall-1.3.14 and Kernel-2.4.20. - You can find their work at: Jacques + Nilo and Eric Wolzak have a LEAF (router/firewall/gateway + on a floppy, CD or compact flash) distribution + called Bering that + features Shorewall-1.3.14 and Kernel-2.4.20. + You can find their work at: http://leaf.sourceforge.net/devel/jnilo
    -

    +

    - Congratulations to Jacques and Eric on the recent release of Bering + Congratulations to Jacques and Eric on the recent release of Bering 1.2!!!
    - +

    Donations

    -     		- + + +
    -
    - Note: -     Search is unavailable -Daily 0200-0330 GMT.
    - - + action="http://lists.shorewall.net/cgi-bin/htsearch"> +
    + Note: +     Search is unavailable + Daily 0200-0330 GMT.
    + + +

    Quick Search
    -

    -
    - + +

    Extended Search

    -
    -
    -
    -
    - +
    +
    + - - - + + - + +

    Shorewall is free +but if you try it and find it useful, please consider making a donation + to + Starlight +Children's Foundation. Thanks!

    + + - - + +
    +
    - +

    -

    +

    - -

    Shorewall is free but -if you try it and find it useful, please consider making a donation - to - Starlight Children's - Foundation. Thanks!

    -
    - -

    Updated 5/18/2003 - Tom Eastep -
    -
    -

    -
    + +

    Updated 5/19/2003 - Tom Eastep +
    +

    diff --git a/STABLE/documentation/sourceforge_index.htm b/STABLE/documentation/sourceforge_index.htm index a114c08cc..5f6fd28dd 100644 --- a/STABLE/documentation/sourceforge_index.htm +++ b/STABLE/documentation/sourceforge_index.htm @@ -2,307 +2,335 @@ - + Shoreline Firewall (Shorewall) 1.3 - + - + - - - + + + - + + + - - + +
    +
    + -

    Shorwall Logo - Shorewall 1.4 - + Shorewall 1.4 - "iptables made easy"
    -
    -     +     -

    -
    - -
    -
    + +
    +
    - - + + - + - + - + - - + +
    + - +

    What is it?

    - -

    The Shoreline Firewall, more commonly known as "Shorewall", is - a Netfilter - (iptables) based firewall that can be used on -a dedicated firewall system, a multi-function gateway/router/server - or on a standalone GNU/Linux system.

    + +

    The Shoreline Firewall, more commonly known as "Shorewall", is + a Netfilter + (iptables) based firewall that can be used on + a dedicated firewall system, a multi-function gateway/router/server + or on a standalone GNU/Linux system.

    - -

    This program is free software; you can redistribute it and/or modify - it - under the terms of Version 2 of the GNU -General Public License as published by the Free Software - Foundation.
    + +

    This program is free software; you can redistribute it and/or modify + it + under the terms of Version 2 of the +GNU General Public License as published by the Free Software + Foundation.
    -
    - This - program is distributed in the hope that - it will be useful, but WITHOUT ANY WARRANTY; - without even the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. - See the GNU General Public License for more -details.
    +
    -
    - You - should have received a copy of the GNU - General Public License along with - this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, +This program is distributed in the hope + that it will be useful, but WITHOUT ANY + WARRANTY; without even the implied warranty + of MERCHANTABILITY or FITNESS FOR A PARTICULAR + PURPOSE. See the GNU General Public License + for more details.
    + +
    + +You should have received a copy of the GNU + General Public License along with + this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

    - +

    Copyright 2001, 2002, 2003 Thomas M. Eastep

    - +

    Running Shorewall on Mandrake with a two-interface setup?

    - If so, almost NOTHING on this site will apply directly to your setup. - If you want to use the documentation that you find here, it is best if you - uninstall what you have and install a setup that matches the documentation - on this site. See the Two-interface QuickStart + If so, almost NOTHING on this site will apply directly to your +setup. If you want to use the documentation that you find here, it is best +if you uninstall what you have and install a setup that matches the documentation + on this site. See the Two-interface QuickStart Guide for details.
    - +

    Getting Started with Shorewall

    - New to Shorewall? Start by selecting the QuickStart Guide that most closely + New to Shorewall? Start by selecting the QuickStart Guide that most closely match your environment and follow the step by step instructions.
    - +

    News

    - + - + +

    5/20/2003 - Shorewall-1.4.3a (New) +
    +

    +This version primarily corrects the documentation included in the .tgz and +in the .rpm. In addition:
    + +
      +
    1. (This change is in 1.4.3 but is not documented) If you are running +iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject replies +as follows:
      +    a) tcp - RST
      +    b) udp - ICMP port unreachable
      +    c) icmp - ICMP host unreachable
      +    d) Otherwise - ICMP host prohibited
      + If you are running earlier software, Shorewall will follow it's traditional +convention:
      +    a) tcp - RST
      +    b) Otherwise - ICMP port unreachable
      2. +
    2. UDP port 135 is now silently dropped in the common.def chain. +Remember that this chain is traversed just before a DROP or REJECT policy +is enforced.
      +
      3. +

    5/18/2003 - Shorewall 1.4.3 (New) -
    -

    -     Problems Corrected:
    -     +
    +

    +     Problems Corrected:
    +
      -
    1. There were several cases where Shorewall would fail to remove +
    2. There were several cases where Shorewall would fail to remove a temporary directory from /tmp. These cases have been corrected.
      3. -
    3. The rules for allowing all traffic via the loopback interface - have been moved to before the rule that drops status=INVALID packets. This - insures that all loopback traffic is allowed even if Netfilter connection +
    4. The rules for allowing all traffic via the loopback interface + have been moved to before the rule that drops status=INVALID packets. This + insures that all loopback traffic is allowed even if Netfilter connection tracking is confused.
      5. - +
    -     New Features:
    -     +     New Features:
    +
      -
    1.  IPV6-IPV4 (6to4) +
    2.  IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels file.
      3. -
    3. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) by setting -LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. +
    4. Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) by setting +LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may not use ULOG with fireparse unless you modify fireparse.
      5. - +
    - +

    5/10/2003 - Shorewall Mirror in Asia
    -

    - Ed Greshko has established a mirror in Taiwan -- Thanks Ed! - -

    5/8/2003 - Shorewall Mirror in Chile  

    - -

    Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.

    - + Ed Greshko has established a mirror in Taiwan -- Thanks Ed! + +

    5/8/2003 - Shorewall Mirror in Chile  

    + +

    Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.
    +

    +

    4/26/2003 - lists.shorewall.net Downtime  

    - + +

    The list server will be down this morning for upgrade to RH9.0.
    -

    - -

    4/21/2003 - Samples updated for Shorewall version 1.4.2 +

    + + +

    4/21/2003 - Samples updated for Shorewall version 1.4.2

    - -

    Thanks to Francesca Smith, the sample configurations are now upgraded - to Shorewall version 1.4.2.

    + +

    Thanks to Francesca Smith, the sample configurations are now upgraded + to Shorewall version 1.4.2.

    - -

    4/12/2002 - Greater Seattle Linux Users Group Presentation + +

    4/12/2002 - Greater Seattle Linux Users Group Presentation

    - +
    This morning, I gave a Shorewall presentation to GSLUG. The presentation - is in HTML format but was generated from Microsoft PowerPoint and is - best viewed using Internet Explorer (although Konqueror also seems to - work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape - work well to view the presentation.
    + target="_top">a Shorewall presentation to GSLUG. The presentation + is in HTML format but was generated from Microsoft PowerPoint and +is best viewed using Internet Explorer (although Konqueror also seems +to work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape + work well to view the presentation. - +

    - -
    + +
      - +
    -
    +
    - +

    - + - +

    More News

    - + - +

    - + - +

    (Leaf Logo) - Jacques Nilo and Eric Wolzak have - a LEAF (router/firewall/gateway on a floppy, - CD or compact flash) distribution called - Bering that features Shorewall-1.3.14 - and Kernel-2.4.20. You can find their -work at: http://leaf.sourceforge.net/devel/jnilo

    + Jacques Nilo and Eric Wolzak have + a LEAF (router/firewall/gateway on a floppy, + CD or compact flash) distribution called + Bering that features Shorewall-1.3.14 + and Kernel-2.4.20. You can find their work +at: + http://leaf.sourceforge.net/devel/jnilo

    - Congratulations to Jacques and Eric on + Congratulations to Jacques and Eric on the recent release of Bering 1.2!!!
    - +

    SourceForge Logo -

    - +     + - +

    - + - +

    This site is hosted by the generous folks at SourceForge.net

    - + - +

    Donations

    -     		+ +
    - + action="http://lists.shorewall.net/cgi-bin/htsearch"> +


    - Note:     - Search is unavailable Daily 0200-0330 -GMT.
    -  

    - + Note: + Search is unavailable Daily 0200-0330 + GMT.
    +  

    + +

    Quick Search
    - - +

    - -
    - + + +

    Extended Search

    - - +
    -
    -
    -
    - +
    +
    + - - + + - - + + - - + +
    + +

    -

    +

    - -

    Shorewall is free but -if you try it and find it useful, please consider making a donation - to - Starlight -Children's Foundation. Thanks!

    + +

    Shorewall is free +but if you try it and find it useful, please consider making a donation + to + Starlight + Children's Foundation. Thanks!

    -
    - -

    Updated 5/18/2003 - Tom Eastep -
    -

    -
    -
    + +

    Updated 5/19/2003 - Tom Eastep +
    +

    diff --git a/STABLE/fallback.sh b/STABLE/fallback.sh index 8c9cd5152..c0e2744cd 100755 --- a/STABLE/fallback.sh +++ b/STABLE/fallback.sh @@ -28,7 +28,7 @@ # shown below. Simply run this script to revert to your prior version of # Shoreline Firewall. -VERSION=1.4.3 +VERSION=1.4.3a usage() # $1 = exit status { diff --git a/STABLE/firewall b/STABLE/firewall index 0c0f74f26..b20fc8b84 100755 --- a/STABLE/firewall +++ b/STABLE/firewall @@ -95,7 +95,11 @@ error_message() # $* = Error Message fatal_error() # $* = Error Message { echo " Error: $@" >&2 - [ $command = check ] || stop_firewall + if [ $command = check ]; then + [ -n "$TMP_DIR" ] && rm -rf $TMP_DIR + else + stop_firewall + fi exit 2 } @@ -1130,6 +1134,9 @@ setup_tunnels() # $1 = name of tunnels file gre|GRE) setup_one_other GRE $gateway 47 ;; + 6to4|6TO4) + setup_one_other 6to4 $gateway 41 + ;; pptpclient|PPTPCLIENT) setup_pptp_client $gateway ;; @@ -1316,7 +1323,7 @@ setup_mac_lists() { done [ -n "$logpart" ] && \ - run_iptables -A $chain $logpart "Shorewall:$chain:$MACLIST_DISPOSITION:" + run_iptables -A $chain $logpart "${LOGMARKER}$chain:$MACLIST_DISPOSITION:" run_iptables -A $chain -j $maclist_target done @@ -2015,11 +2022,11 @@ add_a_rule() if [ "$loglevel" = ULOG ]; then run_iptables2 -A $chain $proto $multiport \ $state $cli $sports $serv $dports -j ULOG $LOGPARMS \ - --ulog-prefix "Shorewall:$chain:$logtarget:" + --ulog-prefix "${LOGMARKER}$chain:$logtarget:" else run_iptables2 -A $chain $proto $multiport \ $state $cli $sports $serv $dports -j LOG $LOGPARMS \ - --log-prefix "Shorewall:$chain:$logtarget:" \ + --log-prefix "${LOGMARKER}$chain:$logtarget:" \ --log-level $loglevel fi fi @@ -2042,11 +2049,11 @@ add_a_rule() if [ "$loglevel" = ULOG ]; then run_iptables2 -A $chain $proto $multiport \ $dest_interface $state $cli $sports $dports -j ULOG \ - $LOGPARMS --ulog-prefix "Shorewall:$chain:$logtarget:" + $LOGPARMS --ulog-prefix "${LOGMARKER}$chain:$logtarget:" else run_iptables2 -A $chain $proto $multiport \ $dest_interface $state $cli $sports $dports -j LOG \ - $LOGPARMS --log-prefix "Shorewall:$chain:$logtarget:" \ + $LOGPARMS --log-prefix "${LOGMARKER}$chain:$logtarget:" \ --log-level $loglevel fi fi @@ -2551,10 +2558,10 @@ policy_rules() # $1 = chain to add rules to if [ $# -eq 3 -a "x${3}" != "x-" ]; then if [ "$3" = ULOG ]; then run_iptables -A $1 -j ULOG $LOGPARMS \ - --ulog-prefix "Shorewall:${1}:${2}:" + --ulog-prefix "${LOGMARKER}${1}:${2}:" else run_iptables -A $1 -j LOG $LOGPARMS \ - --log-prefix "Shorewall:${1}:${2}:" --log-level $3 + --log-prefix "${LOGMARKER}${1}:${2}:" --log-level $3 fi fi @@ -2878,11 +2885,11 @@ add_blacklist_rule() { if [ "$BLACKLIST_LOGLEVEL" = ULOG ]; then run_iptables2 -A blacklst $source $proto $dport -j \ ULOG $LOGPARMS --ulog-prefix \ - "Shorewall:blacklst:$BLACKLIST_DISPOSITION:" + "${LOGMARKER}blacklst:$BLACKLIST_DISPOSITION:" else run_iptables2 -A blacklst $source $proto $dport -j \ LOG $LOGPARMS --log-prefix \ - "Shorewall:blacklst:$BLACKLIST_DISPOSITION:" \ + "${LOGMARKER}blacklst:$BLACKLIST_DISPOSITION:" \ --log-level $BLACKLIST_LOGLEVEL fi fi @@ -3195,9 +3202,10 @@ initialize_netfilter () { setcontinue FORWARD setcontinue INPUT setcontinue OUTPUT - + # # Enable the Loopback interface + # run_iptables -A INPUT -i lo -j ACCEPT run_iptables -A OUTPUT -o lo -j ACCEPT @@ -3221,10 +3229,10 @@ initialize_netfilter () { if [ -n "$LOGNEWNOTSYN" ]; then if [ "$LOGNEWNOTSYN" = ULOG ]; then run_iptables -A newnotsyn -j ULOG $LOGPARMS \ - --ulog-prefix "Shorewall:newnotsyn:DROP:" + --ulog-prefix "${LOGMARKER}newnotsyn:DROP:" else run_iptables -A newnotsyn -j LOG $LOGPARMS \ - --log-prefix "Shorewall:newnotsyn:DROP:" --log-level $LOGNEWNOTSYN + --log-prefix "${LOGMARKER}newnotsyn:DROP:" --log-level $LOGNEWNOTSYN fi fi @@ -3299,16 +3307,26 @@ add_common_rules() { logdisp() # $1 = Chain Name { if [ "$RFC1918_LOG_LEVEL" = ULOG ]; then - echo "ULOG $LOGPARMS --ulog-prefix Shorewall:${1}:DROP:" + echo "ULOG $LOGPARMS --ulog-prefix ${LOGMARKER}${1}:DROP:" else - echo "LOG $LOGPARMS --log-prefix Shorewall:${1}:DROP: --log-level $RFC1918_LOG_LEVEL" + echo "LOG $LOGPARMS --log-prefix ${LOGMARKER}${1}:DROP: --log-level $RFC1918_LOG_LEVEL" fi } # # Reject Rules # - run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset - run_iptables -A reject -j REJECT + run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset + run_iptables -A reject -p udp -j REJECT + # + # Not all versions of iptables support these so don't complain if they don't work + # + qt iptables -A reject -p icmp -j REJECT --reject-with icmp-host-unreachable + if ! qt iptables -A reject -j REJECT --reject-with icmp-host-prohibited; then + # + # In case the above doesn't work + # + run_iptables -A reject -j REJECT + fi # # dropunclean rules # @@ -3319,10 +3337,10 @@ add_common_rules() { if [ -n "$LOGUNCLEAN" ]; then if [ "$LOGUNCLEAN" = ULOG ]; then - logoptions="-j ULOG $LOGPARMS --ulog-prefix Shorewall:badpkt:DROP:" + logoptions="-j ULOG $LOGPARMS --ulog-prefix ${LOGMARKER}badpkt:DROP:" logoptions="$logoptions --log-ip-options" else - logoptions="-j LOG $LOGPARMS --log-prefix Shorewall:badpkt:DROP:" + logoptions="-j LOG $LOGPARMS --log-prefix ${LOGMARKER}badpkt:DROP:" logoptions="$logoptions --log-level $LOGUNCLEAN --log-ip-options" fi @@ -3351,10 +3369,10 @@ add_common_rules() { [ -z"$LOGUNCLEAN" ] && LOGUNCLEAN=info if [ "$LOGUNCLEAN" = ULOG ]; then - logoptions="-j ULOG $LOGPARMS --ulog-prefix Shorewall:logpkt:LOG:" + logoptions="-j ULOG $LOGPARMS --ulog-prefix ${LOGMARKER}logpkt:LOG:" logoptions="$logoptions --log-ip-options" else - logoptions="-j LOG $LOGPARMS --log-prefix Shorewall:logpkt:LOG:" + logoptions="-j LOG $LOGPARMS --log-prefix ${LOGMARKER}logpkt:LOG:" logoptions="$logoptions --log-level $LOGUNCLEAN --log-ip-options" fi @@ -3455,12 +3473,12 @@ add_common_rules() { if [ "$TCP_FLAGS_LOG_LEVEL" = ULOG ]; then run_iptables -A logflags -j ULOG $LOGPARMS \ - --ulog-prefix "Shorewall:logflags:$TCP_FLAGS_DISPOSITION:" \ + --ulog-prefix "${LOGMARKER}logflags:$TCP_FLAGS_DISPOSITION:" \ --log-tcp-options --log-ip-options else run_iptables -A logflags -j LOG $LOGPARMS \ --log-level $TCP_FLAGS_LOG_LEVEL \ - --log-prefix "Shorewall:logflags:$TCP_FLAGS_DISPOSITION:" \ + --log-prefix "${LOGMARKER}logflags:$TCP_FLAGS_DISPOSITION:" \ --log-tcp-options --log-ip-options fi case $TCP_FLAGS_DISPOSITION in @@ -4101,7 +4119,7 @@ add_to_zone() # $1 = [:] $2 = zone done < ${STATEDIR}/chains rm -rf $TMP_DIR - + echo "$1 added to zone $2" } @@ -4210,7 +4228,7 @@ delete_from_zone() # $1 = [:] $2 = zone qt iptables -D OUTPUT -o $interface -d $host -j $chain else eval source_hosts=\"\$${z1}_hosts\" - + for h in $source_hosts; do iface=${h%:*} hosts=${h#*:} @@ -4326,6 +4344,7 @@ do_initialize() { SHARED_DIR=/usr/share/shorewall FUNCTIONS= VERSION_FILE= + LOGMARKER= stopping= have_mutex= @@ -4452,6 +4471,8 @@ do_initialize() { CLEAR_TC= fi + [ -n "$LOGMARKER" ] || LOGMARKER="Shorewall:" + # # Strip the files that we use often # diff --git a/STABLE/install.sh b/STABLE/install.sh index 910bb8923..8d5a62d45 100755 --- a/STABLE/install.sh +++ b/STABLE/install.sh @@ -54,7 +54,7 @@ # /etc/rc.d/rc.local file is modified to start the firewall. # -VERSION=1.4.3 +VERSION=1.4.3a usage() # $1 = exit status { diff --git a/STABLE/releasenotes.txt b/STABLE/releasenotes.txt index 35bb2a1d7..48c70abe5 100644 --- a/STABLE/releasenotes.txt +++ b/STABLE/releasenotes.txt @@ -19,3 +19,19 @@ New Features: (http://www.fireparse.com) by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may not use ULOG with fireparse unless you modify fireparse. + +3) If you are running iptables 1.2.7a and kernel 2.4.20, then + Shorewall will return reject replies as follows: + + a) tcp - RST + b) udp - ICMP port unreachable + c) icmp - ICMP host unreachable + d) Otherwise - ICMP host prohibited + + If you are running earlier software, Shorewall will follow it's + traditional convention: + + a) tcp - RST + b) Otherwise - ICMP port unreachable + +4) UDP Port 135 is now silently dropped in the common.def chain. diff --git a/STABLE/shorewall.spec b/STABLE/shorewall.spec index 5c359345b..77d3ed105 100644 --- a/STABLE/shorewall.spec +++ b/STABLE/shorewall.spec @@ -1,5 +1,5 @@ %define name shorewall -%define version 1.4.3 +%define version 1.4.3a %define release 1 %define prefix /usr @@ -105,6 +105,8 @@ fi %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel %changelog +* Mon May 19 2003 Tom Eastep +- Changed version to 1.4.3a-1 * Sun May 18 2003 Tom Eastep - Changed version to 1.4.3-1 * Mon Apr 07 2003 Tom Eastep diff --git a/STABLE/uninstall.sh b/STABLE/uninstall.sh index bf1ea7dad..fa6541f73 100755 --- a/STABLE/uninstall.sh +++ b/STABLE/uninstall.sh @@ -26,7 +26,7 @@ # You may only use this script to uninstall the version # shown below. Simply run this script to remove Seattle Firewall -VERSION=1.4.3 +VERSION=1.4.3a usage() # $1 = exit status {