fixed quotes, add CVS Id

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1005 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes 2003-12-28 18:41:13 +00:00
parent ce8e0a9771
commit 220f2c405b

View File

@ -2,7 +2,7 @@
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article> <article>
<!----> <!--$Id$-->
<articleinfo> <articleinfo>
<title>Starting/Stopping and Monitoring the Firewall</title> <title>Starting/Stopping and Monitoring the Firewall</title>
@ -38,12 +38,12 @@
<para>If you have a permanent internet connection such as DSL or Cable, I <para>If you have a permanent internet connection such as DSL or Cable, I
recommend that you start the firewall automatically at boot. Once you have recommend that you start the firewall automatically at boot. Once you have
installed &#34;firewall&#34; in your init.d directory, simply type installed <quote>firewall</quote> in your init.d directory, simply type
&#34;chkconfig --add firewall&#34;. This will start the firewall in run <quote>chkconfig --add firewall</quote>. This will start the firewall in
levels 2-5 and stop it in run levels 1 and 6. If you want to configure run levels 2-5 and stop it in run levels 1 and 6. If you want to configure
your firewall differently from this default, you can use the your firewall differently from this default, you can use the
&#34;--level&#34; option in chkconfig (see &#34;man chkconfig&#34;) or <quote>--level</quote> option in chkconfig (see <quote>man chkconfig</quote>)
using your favorite graphical run-level editor.</para> or using your favorite graphical run-level editor.</para>
<caution> <caution>
<itemizedlist> <itemizedlist>
@ -51,21 +51,20 @@
<para>Shorewall startup is disabled by default. Once you have <para>Shorewall startup is disabled by default. Once you have
configured your firewall, you can enable startup by removing the configured your firewall, you can enable startup by removing the
file /etc/shorewall/startup_disabled. Note: Users of the .deb file /etc/shorewall/startup_disabled. Note: Users of the .deb
package must edit /etc/default/shorewall and set package must edit /etc/default/shorewall and set <quote>startup=1</quote>.</para>
&#39;startup=1&#39;.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>If you use dialup, you may want to start the firewall in your <para>If you use dialup, you may want to start the firewall in your
/etc/ppp/ip-up.local script. I recommend just placing &#34;shorewall /etc/ppp/ip-up.local script. I recommend just placing
restart&#34; in that script. </para> <quote>shorewall restart</quote> in that script.</para>
</listitem> </listitem>
</itemizedlist> </itemizedlist>
</caution> </caution>
<para>You can manually start and stop Shoreline Firewall using the <para>You can manually start and stop Shoreline Firewall using the
&#34;shorewall&#34; shell program. Please refer to the Shorewall State <quote>shorewall</quote> shell program. Please refer to the Shorewall
Diagram as shown at the bottom of this page.</para> State Diagram as shown at the bottom of this page.</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
@ -93,7 +92,7 @@
<listitem> <listitem>
<para>shorewall clear - remove all rules and chains installed by <para>shorewall clear - remove all rules and chains installed by
Shoreline Firewall. The firewall is &#34;wide open&#34; </para> Shoreline Firewall. The firewall is <quote>wide open</quote></para>
</listitem> </listitem>
<listitem> <listitem>
@ -107,12 +106,12 @@
trace of the command is produced as in:</para> trace of the command is produced as in:</para>
<para><programlisting> shorewall debug start 2&#62; /tmp/trace</programlisting>The <para><programlisting> shorewall debug start 2&#62; /tmp/trace</programlisting>The
above command would trace the &#39;start&#39; command and place the trace above command would trace the <quote>start</quote> command and place the
information in the file /tmp/trace</para> trace information in the file /tmp/trace</para>
<para>Beginning with version 1.4.7, shorewall can give detailed help about <para>Beginning with version 1.4.7, shorewall can give detailed help about
each of its commands: <programlisting> shorewall help [ command | host | address ]</programlisting>The each of its commands: <programlisting> shorewall help [ command | host | address ]</programlisting>The
&#34;shorewall&#34; program may also be used to monitor the firewall.</para> <quote>shorewall</quote> program may also be used to monitor the firewall.</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
@ -139,8 +138,7 @@
</listitem> </listitem>
<listitem> <listitem>
<para>shorewall show log - display the last 20 packet log entries. <para>shorewall show log - display the last 20 packet log entries.</para>
</para>
</listitem> </listitem>
<listitem> <listitem>
@ -165,18 +163,17 @@
</listitem> </listitem>
<listitem> <listitem>
<para>shorewall version - Displays the installed version number. <para>shorewall version - Displays the installed version number.</para>
</para>
</listitem> </listitem>
<listitem> <listitem>
<para>shorewall check - Performs a cursory validation of the zones, <para>shorewall check - Performs a cursory validation of the zones,
interfaces, hosts, rules and policy files.<caution><para>The interfaces, hosts, rules and policy files.<caution><para>The
&#34;check&#34; command is totally unsuppored and does not parse and <quote>check</quote> command is totally unsuppored and does not parse
validate the generated iptables commands. Even though the and validate the generated iptables commands. Even though the
&#34;check&#34; command completes successfully, the configuration may <quote>check</quote> command completes successfully, the configuration
fail to start. Problem reports that complain about errors that the may fail to start. Problem reports that complain about errors that the
&#39;check&#39; command does not detect will not be accepted.</para><para>See <quote>check</quote> command does not detect will not be accepted.</para><para>See
the recommended way to make configuration changes described below.</para></caution></para> the recommended way to make configuration changes described below.</para></caution></para>
</listitem> </listitem>
@ -218,8 +215,7 @@
<itemizedlist> <itemizedlist>
<listitem> <listitem>
<para>shorewall drop &#60;ip address list&#62; - causes packets from <para>shorewall drop &#60;ip address list&#62; - causes packets from
the listed IP addresses to be silently dropped by the firewall. the listed IP addresses to be silently dropped by the firewall.</para>
</para>
</listitem> </listitem>
<listitem> <listitem>
@ -244,8 +240,8 @@
</listitem> </listitem>
</itemizedlist> </itemizedlist>
<para>Finally, the &#34;shorewall&#34; program may be used to dynamically <para>Finally, the <quote>shorewall</quote> program may be used to
alter the contents of a zone.</para> dynamically alter the contents of a zone.</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
@ -296,8 +292,7 @@
</listitem> </listitem>
<listitem> <listitem>
<para>&#60;correct any errors found by check and check again&#62; <para>&#60;correct any errors found by check and check again&#62;</para>
</para>
</listitem> </listitem>
<listitem> <listitem>
@ -306,9 +301,9 @@
</itemizedlist> </itemizedlist>
<para>If the configuration starts but doesn&#39;t work, just <para>If the configuration starts but doesn&#39;t work, just
&#34;shorewall restart&#34; to restore the old configuration. If the new <quote>shorewall restart</quote> to restore the old configuration. If the
configuration fails to start, the &#34;try&#34; command will automatically new configuration fails to start, the <quote>try</quote> command will
start the old one for you.</para> automatically start the old one for you.</para>
<para>When the new configuration works then just:</para> <para>When the new configuration works then just:</para>
@ -330,9 +325,10 @@
align="center" fileref="images/State_Diagram.png" /></para> align="center" fileref="images/State_Diagram.png" /></para>
<para>You will note that the commands that result in state transitions use <para>You will note that the commands that result in state transitions use
the word &#34;firewall&#34; rather than &#34;shorewall&#34;. That is the word <quote>firewall</quote> rather than <quote>shorewall</quote>.
because the actual transitions are done by /usr/share/shorewall/firewall; That is because the actual transitions are done by
/sbin/shorewall runs &#39;firewall&#34; according to the following table:</para> /usr/share/shorewall/firewall; /sbin/shorewall runs <quote>firewall</quote>
according to the following table:</para>
<informaltable> <informaltable>
<tgroup cols="3"> <tgroup cols="3">
@ -375,8 +371,7 @@
<entry>firewall restart</entry> <entry>firewall restart</entry>
<entry>Logically equivalent to &#34;firewall stop;firewall <entry>Logically equivalent to <quote>firewall stop;firewall start</quote></entry>
start&#34;</entry>
</row> </row>
<row> <row>