mirror of
https://gitlab.com/shorewall/code.git
synced 2025-01-14 17:48:17 +01:00
Some post-1.2.12 documentation cleanup
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@389 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
4710fc7bdb
commit
2565081ff9
@ -755,7 +755,7 @@ in both the SOURCE and DEST columns.</li>
|
||||
<li> <b> LOG LEVEL</b> - Optional.
|
||||
If left empty, no log message is generated when the policy is applied.
|
||||
Otherwise, this column should contain an integer or name indicating
|
||||
a <a href="configuration_file_basics.htm#Levels">syslog level</a>.</li>
|
||||
a <a href="shorewall_logging.html">syslog level</a>.</li>
|
||||
|
||||
<li> <b>LIMIT:BURST </b>- Optional.
|
||||
If left empty, TCP connection requests from the <b>SOURCE</b> zone
|
||||
@ -1251,7 +1251,7 @@ here as in the policy file above.</li>
|
||||
</ul>
|
||||
|
||||
<p>The ACTION may optionally be followed by ":" and a <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> (example: REJECT:info). This causes the packet to be logged
|
||||
at the specified level prior to being processed according to the specified
|
||||
ACTION.<br>
|
||||
@ -2243,7 +2243,7 @@ is assumed.<br>
|
||||
This parameter determines the level at which packets logged under the <a
|
||||
href="file:///home/teastep/Shorewall-docs/Documentation.htm#rfc1918">'norfc1918'
|
||||
mechanism </a> are logged. The value must be a valid <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> and if no level is given, then info is assumed. Prior to Shorewall
|
||||
version 1.3.12, these packets are always logged at the info level.</li>
|
||||
<li><b>TCP_FLAGS_DISPOSITION - </b>Added in Version 1.3.11<br>
|
||||
@ -2254,7 +2254,7 @@ DROP (ignore the packet). If not set or if set to the empty value (e.g.,
|
||||
TCP_FLAGS_DISPOSITION="") then TCP_FLAGS_DISPOSITION=DROP is assumed.</li>
|
||||
<li><b>TCP_FLAGS_LOG_LEVEL - </b>Added in Version 1.3.11<br>
|
||||
Determines the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> for logging packets that fail the checks enabled by the <a
|
||||
href="#Interfaces">tcpflags</a> interface option.The value must be a valid
|
||||
syslogd log level. If you don't want to log these packets, set to the empty
|
||||
@ -2268,7 +2268,7 @@ or DROP (ignore the connection request). If not set or if set to the empty
|
||||
value (e.g., MACLIST_DISPOSITION="") then MACLIST_DISPOSITION=REJECT is assumed.</li>
|
||||
<li><b>MACLIST_LOG_LEVEL </b>- Added in Version 1.3.10<br>
|
||||
Determines the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> for logging connection requests that fail <a
|
||||
href="MAC_Validation.html">MAC Verification</a>. The value must be a valid
|
||||
syslogd log level. If you don't want to log these connection requests, set
|
||||
@ -2295,7 +2295,7 @@ unless they are handled by an explicit entry in the <a
|
||||
Beginning with version 1.3.6, Shorewall drops non-SYN TCP
|
||||
packets that are not part of an existing connection. If you would
|
||||
like to log these packets, set LOGNEWNOTSYN to the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> at which you want the packets logged. Example: LOGNEWNOTSYN=ULOG|<br>
|
||||
<br>
|
||||
<b>Note: </b>Packets logged under this option are usually
|
||||
@ -2612,7 +2612,7 @@ assumed.</li>
|
||||
at. Its
|
||||
value
|
||||
is a <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a>
|
||||
(Example:
|
||||
BLACKLIST_LOGLEVEL=debug).
|
||||
|
||||
@ -616,7 +616,7 @@ see "man syslog") in your <a href="Documentation.htm#Policy">policies</a>
|
||||
|
||||
<div align="left">
|
||||
<pre align="left"> LOGLIMIT=""<br> LOGBURST=""<br><br>Beginning with Shorewall version 1.3.12, you can <a
|
||||
href="configuration_file_basics.htm#Levels">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
||||
href="shorewall_logging.html">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
||||
</div>
|
||||
|
||||
<h4 align="left"><a name="faq6a"></a>6a. Are there any log parsers that work
|
||||
|
||||
@ -2,110 +2,109 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>MAC Verification</title>
|
||||
|
||||
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">MAC Verification</font><br>
|
||||
</h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
||||
or from a subnet on an interface can be verified to originate from a defined
|
||||
set of MAC addresses. Furthermore, each MAC address may be optionally associated
|
||||
<br>
|
||||
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
||||
or from a subnet on an interface can be verified to originate from a defined
|
||||
set of MAC addresses. Furthermore, each MAC address may be optionally associated
|
||||
with one or more IP addresses. <br>
|
||||
<br>
|
||||
<b>You must have the iproute package (ip utility) installed to use MAC Verification.</b><br>
|
||||
<br>
|
||||
There are four components to this facility.<br>
|
||||
|
||||
<br>
|
||||
<b>You must have the iproute package (ip utility) installed to use MAC Verification
|
||||
and your kernel must include MAC match support (CONFIG_IP_NF_MATCH_MAC -
|
||||
module name ipt_mac.o).</b><br>
|
||||
<br>
|
||||
There are four components to this facility.<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>maclist</b> interface option in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When
|
||||
this option is specified, all traffic arriving on the interface is subjet
|
||||
to MAC verification.</li>
|
||||
<li>The <b>maclist </b>option in <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>.
|
||||
When this option is specified for a subnet, all traffic from that subnet
|
||||
is subject to MAC verification.</li>
|
||||
<li>The /etc/shorewall/maclist file. This file is used to associate
|
||||
MAC addresses with interfaces and to optionally associate IP addresses with
|
||||
MAC addresses.</li>
|
||||
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
||||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
|
||||
The MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and
|
||||
determines the disposition of connection requests that fail MAC verification.
|
||||
The MACLIST_LOG_LEVEL variable gives the syslogd level at which connection
|
||||
requests that fail verification are to be logged. If set the the empty value
|
||||
(e.g., MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
||||
</li>
|
||||
|
||||
<li>The <b>maclist</b> interface option in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When this
|
||||
option is specified, all traffic arriving on the interface is subjet to MAC
|
||||
verification.</li>
|
||||
<li>The <b>maclist </b>option in <a
|
||||
href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>. When this option
|
||||
is specified for a subnet, all traffic from that subnet is subject to MAC
|
||||
verification.</li>
|
||||
<li>The /etc/shorewall/maclist file. This file is used to associate
|
||||
MAC addresses with interfaces and to optionally associate IP addresses
|
||||
with MAC addresses.</li>
|
||||
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
||||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a> The
|
||||
MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and determines
|
||||
the disposition of connection requests that fail MAC verification. The
|
||||
MACLIST_LOG_LEVEL variable gives the syslogd level at which connection requests
|
||||
that fail verification are to be logged. If set the the empty value (e.g.,
|
||||
MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
The columns in /etc/shorewall/maclist are:<br>
|
||||
|
||||
The columns in /etc/shorewall/maclist are:<br>
|
||||
|
||||
<ul>
|
||||
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
||||
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
||||
system.</li>
|
||||
<li>MAC - The MAC address of a device on the ethernet segment connected
|
||||
by INTERFACE. It is not necessary to use the Shorewall MAC format in this
|
||||
<li>MAC - The MAC address of a device on the ethernet segment connected
|
||||
by INTERFACE. It is not necessary to use the Shorewall MAC format in this
|
||||
column although you may use that format if you so choose.</li>
|
||||
<li>IP Address - An optional comma-separated list of IP addresses for
|
||||
the device whose MAC is listed in the MAC column.</li>
|
||||
|
||||
<li>IP Address - An optional comma-separated list of IP addresses
|
||||
for the device whose MAC is listed in the MAC column.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3>Example 1: Here are my files:</h3>
|
||||
<b>/etc/shorewall/shorewall.conf:<br>
|
||||
</b>
|
||||
<b>/etc/shorewall/shorewall.conf:<br>
|
||||
</b>
|
||||
<pre> MACLIST_DISPOSITION=REJECT<br> MACLIST_LOG_LEVEL=info<br></pre>
|
||||
<b>/etc/shorewall/interfaces:</b><br>
|
||||
|
||||
<b>/etc/shorewall/interfaces:</b><br>
|
||||
|
||||
<pre> #ZONE INTERFACE BROADCAST OPTIONS<br> net eth0 206.124.146.255 norfc1918,filterping,dhcp,blacklist<br> loc eth2 192.168.1.255 dhcp,filterping,maclist<br> dmz eth1 192.168.2.255 filterping<br> net eth3 206.124.146.255 filterping,blacklist<br> - texas 192.168.9.255 filterping<br> loc ppp+ - filterping<br></pre>
|
||||
<b>/etc/shorewall/maclist:</b><br>
|
||||
|
||||
<b>/etc/shorewall/maclist:</b><br>
|
||||
|
||||
<pre> #INTERFACE MAC IP ADDRESSES (Optional)<br> eth2 00:A0:CC:63:66:89 192.168.1.3 #Wookie<br> eth2 00:10:B5:EC:FD:0B 192.168.1.4 #Tarry<br> eth2 00:A0:CC:DB:31:C4 192.168.1.5 #Ursa<br> eth2 00:06:25:aa:a8:0f 192.168.1.7 #Eastept1 (Wireless)<br> eth2 00:04:5A:0E:85:B9 192.168.1.250 #Wap<br></pre>
|
||||
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
||||
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
||||
zone</a>.<br>
|
||||
|
||||
|
||||
<h3>Example 2: Router in Local Zone</h3>
|
||||
Suppose now that I add a second ethernet segment to my local zone and
|
||||
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
||||
IP address 192.168.1.253. Hosts in the second segment have IP addresses in
|
||||
the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
||||
Suppose now that I add a second ethernet segment to my local zone and
|
||||
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
||||
IP address 192.168.1.253. Hosts in the second segment have IP addresses
|
||||
in the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
||||
file:<br>
|
||||
|
||||
|
||||
<pre> eth2 00:06:43:45:C6:15 192.168.1.253,192.168.2.0/24<br></pre>
|
||||
This entry accomodates traffic from the router itself (192.168.1.253)
|
||||
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
||||
being sent to my firewall from the 192.168.2.0/24 segment will be forwarded
|
||||
by the router so that traffic's MAC address will be that of the router (00:06:43:45:C6:15)
|
||||
and not that of the host sending the traffic.
|
||||
<p><font size="2"> Updated 12/22/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
This entry accomodates traffic from the router itself (192.168.1.253)
|
||||
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
||||
being sent to my firewall from the 192.168.2.0/24 segment will be forwarded
|
||||
by the router so that traffic's MAC address will be that of the router (00:06:43:45:C6:15)
|
||||
and not that of the host sending the traffic.
|
||||
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -52,7 +52,7 @@ the current packet classification filters. The output from this command is
|
||||
the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -98,7 +98,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for
|
||||
|
||||
@ -1,435 +1,340 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Configuration File Basics</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
||||
run them through <a
|
||||
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
||||
before you use them with Shorewall.</b></p>
|
||||
|
||||
<h2>Files</h2>
|
||||
|
||||
|
||||
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
||||
run them through <a
|
||||
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
||||
before you use them with Shorewall.</b></p>
|
||||
|
||||
<h2><a name="Files"></a>Files</h2>
|
||||
|
||||
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>/etc/shorewall/shorewall.conf - used to set several
|
||||
firewall parameters.</li>
|
||||
<li>/etc/shorewall/params - use this file to set shell
|
||||
<li>/etc/shorewall/shorewall.conf - used to set several
|
||||
firewall parameters.</li>
|
||||
<li>/etc/shorewall/params - use this file to set shell
|
||||
variables that you will expand in other files.</li>
|
||||
<li>/etc/shorewall/zones - partition the firewall's
|
||||
view of the world into <i>zones.</i></li>
|
||||
<li>/etc/shorewall/policy - establishes firewall high-level
|
||||
policy.</li>
|
||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
||||
<li>/etc/shorewall/zones - partition the firewall's
|
||||
view of the world into <i>zones.</i></li>
|
||||
<li>/etc/shorewall/policy - establishes firewall high-level
|
||||
policy.</li>
|
||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
||||
on the firewall system.</li>
|
||||
<li>/etc/shorewall/hosts - allows defining zones in
|
||||
terms of individual hosts and subnetworks.</li>
|
||||
<li>/etc/shorewall/masq - directs the firewall where
|
||||
to use many-to-one (dynamic) Network Address Translation (a.k.a.
|
||||
Masquerading) and Source Network Address Translation (SNAT).</li>
|
||||
<li>/etc/shorewall/modules - directs the firewall to
|
||||
load kernel modules.</li>
|
||||
<li>/etc/shorewall/rules - defines rules that are exceptions
|
||||
to the overall policies established in /etc/shorewall/policy.</li>
|
||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||
<li>/etc/shorewall/hosts - allows defining zones in
|
||||
terms of individual hosts and subnetworks.</li>
|
||||
<li>/etc/shorewall/masq - directs the firewall where
|
||||
to use many-to-one (dynamic) Network Address Translation (a.k.a.
|
||||
Masquerading) and Source Network Address Translation (SNAT).</li>
|
||||
<li>/etc/shorewall/modules - directs the firewall
|
||||
to load kernel modules.</li>
|
||||
<li>/etc/shorewall/rules - defines rules that are
|
||||
exceptions to the overall policies established in /etc/shorewall/policy.</li>
|
||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||
ARP.</li>
|
||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
||||
later) - defines hosts accessible when Shorewall is stopped.</li>
|
||||
<li>/etc/shorewall/tcrules - defines marking of packets
|
||||
for later use by traffic control/shaping or policy routing.</li>
|
||||
<li>/etc/shorewall/tos - defines rules for setting
|
||||
<li>/etc/shorewall/tcrules - defines marking of packets
|
||||
for later use by traffic control/shaping or policy routing.</li>
|
||||
<li>/etc/shorewall/tos - defines rules for setting
|
||||
the TOS field in packet headers.</li>
|
||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
||||
IPIP tunnels with end-points on the firewall system.</li>
|
||||
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
||||
IPIP tunnels with end-points on the firewall system.</li>
|
||||
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
||||
addresses.</li>
|
||||
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
||||
of a "shorewall start" or "shorewall restart".</li>
|
||||
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
||||
of a "shorewall start" or "shorewall restart"</li>
|
||||
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
||||
of a "shorewall stop".</li>
|
||||
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
||||
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
||||
of a "shorewall start" or "shorewall restart".</li>
|
||||
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
||||
of a "shorewall start" or "shorewall restart"</li>
|
||||
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
||||
of a "shorewall stop".</li>
|
||||
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
||||
completion of a "shorewall stop".<br>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Comments</h2>
|
||||
|
||||
<p>You may place comments in configuration files by making the first non-whitespace
|
||||
character a pound sign ("#"). You may also place comments at
|
||||
the end of any line, again by delimiting the comment from the rest
|
||||
|
||||
<h2><a name="Comments"></a>Comments</h2>
|
||||
|
||||
<p>You may place comments in configuration files by making the first non-whitespace
|
||||
character a pound sign ("#"). You may also place comments at
|
||||
the end of any line, again by delimiting the comment from the rest
|
||||
of the line with a pound sign.</p>
|
||||
|
||||
|
||||
<p>Examples:</p>
|
||||
|
||||
|
||||
<pre># This is a comment</pre>
|
||||
|
||||
|
||||
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
||||
|
||||
<h2>Line Continuation</h2>
|
||||
|
||||
<p>You may continue lines in the configuration files using the usual backslash
|
||||
("\") followed immediately by a new line character.</p>
|
||||
|
||||
|
||||
<h2><a name="Continuation"></a>Line Continuation</h2>
|
||||
|
||||
<p>You may continue lines in the configuration files using the usual backslash
|
||||
("\") followed immediately by a new line character.</p>
|
||||
|
||||
<p>Example:</p>
|
||||
|
||||
|
||||
<pre>ACCEPT net fw tcp \<br>smtp,www,pop3,imap #Services running on the firewall</pre>
|
||||
|
||||
|
||||
<h2><a name="dnsnames"></a>Using DNS Names</h2>
|
||||
|
||||
<p align="left"> </p>
|
||||
|
||||
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
||||
using DNS names in Shorewall configuration files. If you use DNS names
|
||||
and you are called out of bed at 2:00AM because Shorewall won't start
|
||||
as a result of DNS problems then don't say that you were not forewarned.
|
||||
<br>
|
||||
</b></p>
|
||||
|
||||
<p align="left"><b> -Tom<br>
|
||||
</b></p>
|
||||
|
||||
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
||||
configuration files may be specified as either IP addresses or DNS
|
||||
Names.<br>
|
||||
<br>
|
||||
DNS names in iptables rules aren't nearly as useful as they
|
||||
first appear. When a DNS name appears in a rule, the iptables utility
|
||||
resolves the name to one or more IP addresses and inserts those addresses
|
||||
into the rule. So changes in the DNS->IP address relationship that
|
||||
occur after the firewall has started have absolutely no effect on the
|
||||
firewall's ruleset. </p>
|
||||
|
||||
<p align="left"> If your firewall rules include DNS names then:</p>
|
||||
|
||||
<p align="left"> </p>
|
||||
|
||||
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
||||
using DNS names in Shorewall configuration files. If you use DNS names
|
||||
and you are called out of bed at 2:00AM because Shorewall won't start
|
||||
as a result of DNS problems then don't say that you were not forewarned.
|
||||
<br>
|
||||
</b></p>
|
||||
|
||||
<p align="left"><b> -Tom<br>
|
||||
</b></p>
|
||||
|
||||
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
||||
configuration files may be specified as either IP addresses or DNS
|
||||
Names.<br>
|
||||
<br>
|
||||
DNS names in iptables rules aren't nearly as useful as they
|
||||
first appear. When a DNS name appears in a rule, the iptables utility
|
||||
resolves the name to one or more IP addresses and inserts those addresses
|
||||
into the rule. So changes in the DNS->IP address relationship that
|
||||
occur after the firewall has started have absolutely no effect on the
|
||||
firewall's ruleset. </p>
|
||||
|
||||
<p align="left"> If your firewall rules include DNS names then:</p>
|
||||
|
||||
<ul>
|
||||
<li>If your /etc/resolv.conf is wrong then your firewall won't
|
||||
start.</li>
|
||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||
<li>If your /etc/resolv.conf is wrong then your firewall
|
||||
won't start.</li>
|
||||
<li>If your Name Server(s) is(are) down then your firewall
|
||||
won't start.</li>
|
||||
<li>If your startup scripts try to start your firewall before
|
||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||
won't start.</li>
|
||||
<li>If your Name Server(s) is(are) down then your firewall
|
||||
won't start.</li>
|
||||
<li>If your startup scripts try to start your firewall before
|
||||
starting your DNS server then your firewall won't start.<br>
|
||||
</li>
|
||||
<li>Factors totally outside your control (your ISP's router
|
||||
</li>
|
||||
<li>Factors totally outside your control (your ISP's router
|
||||
is down for example), can prevent your firewall from starting.</li>
|
||||
<li>You must bring up your network interfaces prior to starting
|
||||
your firewall.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li>You must bring up your network interfaces prior to starting
|
||||
your firewall.<br>
|
||||
</li>
|
||||
|
||||
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
||||
of two periods (although one may be trailing). This restriction is imposed
|
||||
by Shorewall to insure backward compatibility with existing configuration
|
||||
files.<br>
|
||||
<br>
|
||||
Examples of valid DNS names:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>mail.shorewall.net</li>
|
||||
<li>shorewall.net. (note the trailing period).</li>
|
||||
|
||||
</ul>
|
||||
Examples of invalid DNS names:<br>
|
||||
|
||||
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
||||
of two periods (although one may be trailing). This restriction is
|
||||
imposed by Shorewall to insure backward compatibility with existing
|
||||
configuration files.<br>
|
||||
<br>
|
||||
Examples of valid DNS names:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>mail (not fully qualified)</li>
|
||||
<li>shorewall.net (only one period)</li>
|
||||
|
||||
</ul>
|
||||
DNS names may not be used as:<br>
|
||||
<li>mail.shorewall.net</li>
|
||||
<li>shorewall.net. (note the trailing period).</li>
|
||||
|
||||
</ul>
|
||||
Examples of invalid DNS names:<br>
|
||||
|
||||
<ul>
|
||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||
<li>mail (not fully qualified)</li>
|
||||
<li>shorewall.net (only one period)</li>
|
||||
|
||||
</ul>
|
||||
DNS names may not be used as:<br>
|
||||
|
||||
<ul>
|
||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||
file)</li>
|
||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||
<li>In the /etc/shorewall/nat file.</li>
|
||||
|
||||
</ul>
|
||||
These restrictions are not imposed by Shorewall simply for
|
||||
your inconvenience but are rather limitations of iptables.<br>
|
||||
|
||||
<h2>Complementing an Address or Subnet</h2>
|
||||
|
||||
<p>Where specifying an IP address, a subnet or an interface, you can
|
||||
precede the item with "!" to specify the complement of the item. For
|
||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must be
|
||||
no white space following the "!".</p>
|
||||
|
||||
<h2>Comma-separated Lists</h2>
|
||||
|
||||
<p>Comma-separated lists are allowed in a number of contexts within the
|
||||
configuration files. A comma separated list:</p>
|
||||
|
||||
<ul>
|
||||
<li>Must not have any embedded white space.<br>
|
||||
Valid: routestopped,dhcp,norfc1918<br>
|
||||
Invalid: routestopped, dhcp, norfc1818</li>
|
||||
<li>If you use line continuation to break a comma-separated
|
||||
list, the continuation line(s) must begin in column 1 (or there
|
||||
would be embedded white space)</li>
|
||||
<li>Entries in a comma-separated list may appear in
|
||||
any order.</li>
|
||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||
<li>In the /etc/shorewall/nat file.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Port Numbers/Service Names</h2>
|
||||
|
||||
<p>Unless otherwise specified, when giving a port number you can use
|
||||
either an integer or a service name from /etc/services. </p>
|
||||
|
||||
<h2>Port Ranges</h2>
|
||||
|
||||
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
||||
port number</i>>:<<i>high port number</i>>. For example,
|
||||
if you want to forward the range of tcp ports 4000 through 4100 to local
|
||||
host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||
</p>
|
||||
|
||||
These restrictions are not imposed by Shorewall simply for
|
||||
your inconvenience but are rather limitations of iptables.<br>
|
||||
|
||||
<h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
|
||||
|
||||
<p>Where specifying an IP address, a subnet or an interface, you can
|
||||
precede the item with "!" to specify the complement of the item. For
|
||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must
|
||||
be no white space following the "!".</p>
|
||||
|
||||
<h2><a name="Lists"></a>Comma-separated Lists</h2>
|
||||
|
||||
<p>Comma-separated lists are allowed in a number of contexts within the
|
||||
configuration files. A comma separated list:</p>
|
||||
|
||||
<ul>
|
||||
<li>Must not have any embedded white space.<br>
|
||||
Valid: routestopped,dhcp,norfc1918<br>
|
||||
Invalid: routestopped, dhcp, norfc1818</li>
|
||||
<li>If you use line continuation to break a comma-separated
|
||||
list, the continuation line(s) must begin in column 1 (or
|
||||
there would be embedded white space)</li>
|
||||
<li>Entries in a comma-separated list may appear in
|
||||
any order.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2><a name="Ports"></a>Port Numbers/Service Names</h2>
|
||||
|
||||
<p>Unless otherwise specified, when giving a port number you can use
|
||||
either an integer or a service name from /etc/services. </p>
|
||||
|
||||
<h2><a name="Ranges"></a>Port Ranges</h2>
|
||||
|
||||
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
||||
port number</i>>:<<i>high port number</i>>. For example,
|
||||
if you want to forward the range of tcp ports 4000 through 4100 to
|
||||
local host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||
</p>
|
||||
|
||||
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
||||
|
||||
<h2>Using Shell Variables</h2>
|
||||
|
||||
<p>You may use the /etc/shorewall/params file to set shell variables
|
||||
that you can then use in some of the other configuration files.</p>
|
||||
|
||||
|
||||
<h2><a name="Variables"></a>Using Shell Variables</h2>
|
||||
|
||||
<p>You may use the /etc/shorewall/params file to set shell variables
|
||||
that you can then use in some of the other configuration files.</p>
|
||||
|
||||
<p>It is suggested that variable names begin with an upper case letter<font
|
||||
size="1"> </font>to distinguish them from variables used internally
|
||||
within the Shorewall programs</p>
|
||||
|
||||
size="1"> </font>to distinguish them from variables used internally
|
||||
within the Shorewall programs</p>
|
||||
|
||||
<p>Example:</p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
|
||||
<p><br>
|
||||
Example (/etc/shorewall/interfaces record):</p>
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>The result will be the same as if the record had been written</p>
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre>net eth0 130.252.100.255 noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>Variables may be used anywhere in the other configuration
|
||||
files.</p>
|
||||
|
||||
<h2>Using MAC Addresses</h2>
|
||||
|
||||
<p>Media Access Control (MAC) addresses can be used to specify packet
|
||||
source in several of the configuration files. To use this feature,
|
||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||
included.</p>
|
||||
|
||||
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
||||
unique MAC address.<br>
|
||||
<br>
|
||||
In GNU/Linux, MAC addresses are usually written as a
|
||||
series of 6 hex numbers separated by colons. Example:<br>
|
||||
<br>
|
||||
[root@gateway root]# ifconfig eth0<br>
|
||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||
Mask:255.255.255.0<br>
|
||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||
frame:0<br>
|
||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||
carrier:0<br>
|
||||
collisions:30394 txqueuelen:100<br>
|
||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||
(1582.8 Mb)<br>
|
||||
Interrupt:11 Base address:0x1800<br>
|
||||
<br>
|
||||
Because Shorewall uses colons as a separator for address
|
||||
fields, Shorewall requires MAC addresses to be written in another
|
||||
way. In Shorewall, MAC addresses begin with a tilde ("~") and
|
||||
consist of 6 hex numbers separated by hyphens. In Shorewall, the
|
||||
MAC address in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||
</p>
|
||||
|
||||
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||
</p>
|
||||
|
||||
<h2><a name="Levels"></a>Logging</h2>
|
||||
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
||||
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
||||
the notation <i>facility.priority</i>). <br>
|
||||
<br>
|
||||
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
||||
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
||||
<i>local7</i>.<br>
|
||||
<br>
|
||||
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
||||
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
||||
The syslog documentation uses the term <i>priority</i>.<br>
|
||||
|
||||
<h3>Syslog Levels<br>
|
||||
</h3>
|
||||
Syslog levels are a method of describing to syslog (8) the importance
|
||||
of a message and a number of Shorewall parameters have a syslog level
|
||||
as their value.<br>
|
||||
<br>
|
||||
Valid levels are:<br>
|
||||
<br>
|
||||
7 debug<br>
|
||||
6 info<br>
|
||||
5 notice<br>
|
||||
4 warning<br>
|
||||
3 err<br>
|
||||
2 crit<br>
|
||||
1 alert<br>
|
||||
0 emerg<br>
|
||||
<br>
|
||||
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
||||
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
||||
facility and the level that you specify. If you are unsure of the level
|
||||
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
||||
number.<br>
|
||||
<br>
|
||||
Syslogd writes log messages to files (typically in /var/log/*) based
|
||||
on their facility and level. The mapping of these facility/level pairs to
|
||||
log files is done in /etc/syslog.conf (5). If you make changes to this file,
|
||||
you must restart syslogd before the changes can take effect.<br>
|
||||
|
||||
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
||||
There are a couple of limitations to syslogd-based logging:<br>
|
||||
|
||||
<ol>
|
||||
<li>If you give, for example, kern.info it's own log destination then
|
||||
that destination will also receive all kernel messages of levels 5 (notice)
|
||||
through 0 (emerg).</li>
|
||||
<li>All kernel.info messages will go to that destination and not just
|
||||
those from NetFilter.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
||||
support (and most vendor-supplied kernels do), you may also specify a log
|
||||
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
||||
netfilter to log the related messages via the ULOG target which will send
|
||||
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
||||
and can be configured to log all Shorewall message to their own log file.<br>
|
||||
<br>
|
||||
Download the ulod tar file and:<br>
|
||||
|
||||
<ol>
|
||||
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
||||
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
||||
<li>cd ulogd-<i>version</i><br>
|
||||
</li>
|
||||
<li>./configure</li>
|
||||
<li>make</li>
|
||||
<li>make install<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
If you are like me and don't have a development environment on your firewall,
|
||||
you can do the first five steps on another system then either NFS mount your
|
||||
/usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
||||
directory and move it to your firewall system.<br>
|
||||
<br>
|
||||
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
||||
|
||||
<ol>
|
||||
<li>syslogfile <i><file that you wish to log to></i></li>
|
||||
<li>syslogsync 1</li>
|
||||
|
||||
</ol>
|
||||
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
||||
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
||||
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
||||
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
||||
something else done to activate the script.<br>
|
||||
<br>
|
||||
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file that
|
||||
you wish to log to></i>. This tells the /sbin/shorewall program where to
|
||||
look for the log when processing its "show log", "logwatch" and "monitor"
|
||||
commands.<br>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<h2><a name="Configs"></a>Shorewall Configurations</h2>
|
||||
|
||||
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start and
|
||||
restart</a> commands allow you to specify an alternate configuration
|
||||
directory and Shorewall will use the files in the alternate directory
|
||||
rather than the corresponding files in /etc/shorewall. The alternate directory
|
||||
need not contain a complete configuration; those files not in the alternate
|
||||
directory will be read from /etc/shorewall.</p>
|
||||
|
||||
<p> This facility permits you to easily create a test or temporary configuration
|
||||
by:</p>
|
||||
|
||||
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
|
||||
<p><br>
|
||||
Example (/etc/shorewall/interfaces record):</p>
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>The result will be the same as if the record had been written</p>
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre>net eth0 130.252.100.255 noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>Variables may be used anywhere in the other configuration
|
||||
files.</p>
|
||||
|
||||
<h2><a name="MAC"></a>Using MAC Addresses</h2>
|
||||
|
||||
<p>Media Access Control (MAC) addresses can be used to specify packet
|
||||
source in several of the configuration files. To use this feature,
|
||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||
included.</p>
|
||||
|
||||
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
||||
unique MAC address.<br>
|
||||
<br>
|
||||
In GNU/Linux, MAC addresses are usually written as a
|
||||
series of 6 hex numbers separated by colons. Example:<br>
|
||||
<br>
|
||||
[root@gateway root]# ifconfig eth0<br>
|
||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||
Mask:255.255.255.0<br>
|
||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||
frame:0<br>
|
||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||
carrier:0<br>
|
||||
collisions:30394 txqueuelen:100<br>
|
||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||
(1582.8 Mb)<br>
|
||||
Interrupt:11 Base address:0x1800<br>
|
||||
<br>
|
||||
Because Shorewall uses colons as a separator for address
|
||||
fields, Shorewall requires MAC addresses to be written in another
|
||||
way. In Shorewall, MAC addresses begin with a tilde ("~") and consist
|
||||
of 6 hex numbers separated by hyphens. In Shorewall, the MAC address
|
||||
in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||
</p>
|
||||
|
||||
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||
</p>
|
||||
|
||||
<h2><a name="Levels"></a>Shorewall Configurations</h2>
|
||||
|
||||
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start
|
||||
and restart</a> commands allow you to specify an alternate configuration
|
||||
directory and Shorewall will use the files in the alternate directory
|
||||
rather than the corresponding files in /etc/shorewall. The alternate
|
||||
directory need not contain a complete configuration; those files not
|
||||
in the alternate directory will be read from /etc/shorewall.</p>
|
||||
|
||||
<p> This facility permits you to easily create a test or temporary configuration
|
||||
by:</p>
|
||||
|
||||
<ol>
|
||||
<li> copying the files that need modification from
|
||||
/etc/shorewall to a separate directory;</li>
|
||||
<li> modify those files in the separate directory;
|
||||
and</li>
|
||||
<li> specifying the separate directory in a shorewall
|
||||
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
||||
restart</b></i> ).</li>
|
||||
|
||||
<li> copying the files that need modification from
|
||||
/etc/shorewall to a separate directory;</li>
|
||||
<li> modify those files in the separate directory;
|
||||
and</li>
|
||||
<li> specifying the separate directory in a shorewall
|
||||
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
||||
restart</b></i> ).</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2"> Updated 12/20/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
|
||||
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,76 +1,79 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>GNU Mailman</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">GNU Mailman/Postfix the Easy
|
||||
Way</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
Way</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h1 align="center"> </h1>
|
||||
|
||||
|
||||
<h4>The following was posted on the Postfix mailing list on 5/4/2002 by Michael
|
||||
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
||||
|
||||
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
||||
|
||||
<p>Q: Mailman does not work with Postfix, complaining about GID mismatch<br>
|
||||
<br>
|
||||
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
||||
aliases file so that rest of mailman's mail handling processes will run
|
||||
<br>
|
||||
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
||||
aliases file so that rest of mailman's mail handling processes will run
|
||||
with proper uid/gid. Postfix has an ability to run a command specified in
|
||||
an alias as owner of that alias, thus mailman's wrapper is not needed here.
|
||||
The best method to invoke mailman's mail handling via aliases is to use
|
||||
The best method to invoke mailman's mail handling via aliases is to use
|
||||
separate alias file especially for mailman, and made it owned by mailman
|
||||
and group mailman. Like:<br>
|
||||
<br>
|
||||
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
||||
<br>
|
||||
Make sure that /var/mailman/aliases.db is owned by mailman user (this may
|
||||
be done by executing postalias as mailman userid).<br>
|
||||
<br>
|
||||
Next, instead of using mailman-suggested aliases entries with wrapper, use
|
||||
the following:<br>
|
||||
<br>
|
||||
instead of<br>
|
||||
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
||||
...<br>
|
||||
<br>
|
||||
use<br>
|
||||
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
||||
...</p>
|
||||
|
||||
<h4>The Shorewall mailing lists are currently running Postfix 1.1.11 together
|
||||
with the stock RedHat Mailman-2.0.13 RPM configured as shown above.</h4>
|
||||
|
||||
<p align="left"><font size="2">Last updated 9/14/2002 - <a
|
||||
<br>
|
||||
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
||||
<br>
|
||||
Make sure that /var/mailman/aliases.db is owned by mailman user (this
|
||||
may be done by executing postalias as mailman userid).<br>
|
||||
<br>
|
||||
Next, instead of using mailman-suggested aliases entries with wrapper,
|
||||
use the following:<br>
|
||||
<br>
|
||||
instead of<br>
|
||||
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
||||
...<br>
|
||||
<br>
|
||||
use<br>
|
||||
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
||||
...</p>
|
||||
|
||||
<h4>The above tip works with Mailman 2.0; Mailman 2.1 has adopted something
|
||||
very similar so that no workaround is necessary. See the README.POSTFIX file
|
||||
included with Mailman-2.1. </h4>
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,124 +1,127 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a><a href="http://www.gnu.org/software/mailman/mailman.html">
|
||||
<img border="0" src="images/logo-sm.jpg" align="left" hspace="5"
|
||||
width="110" height="35">
|
||||
</a><a href="http://www.postfix.org/"> <img
|
||||
</a><a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35">
|
||||
</a><a href="http://www.postfix.org/"> <img
|
||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
||||
height="45">
|
||||
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
||||
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
||||
href="http://www.inter7.com/courierimap/"><img
|
||||
src="images/courier-imap.png" alt="Courier-Imap" width="100"
|
||||
height="38" align="right">
|
||||
</a></font></h1>
|
||||
</a></font></h1>
|
||||
|
||||
|
||||
|
||||
<p align="right"><font color="#ffffff"><b><br>
|
||||
</b></font></p>
|
||||
|
||||
</b></font></p>
|
||||
|
||||
<p align="right"><font color="#ffffff"><b><br>
|
||||
Powered by Postfix </b></font> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
Powered by Postfix </b></font> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.</p>
|
||||
|
||||
|
||||
<h2 align="left">Not getting List Mail? -- <a
|
||||
href="mailing_list_problems.htm">Check Here</a></h2>
|
||||
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tom dot eastep
|
||||
at hp dot com.</p>
|
||||
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"> <img border="0"
|
||||
src="images/but3.png" hspace="3" width="88" height="31">
|
||||
</a><a href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
at hp dot com.</p>
|
||||
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against the open relay databases at <a
|
||||
href="http://ordb.org">ordb.org.</a></li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command is a valid
|
||||
fully-qualified DNS name.</li>
|
||||
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX record in
|
||||
DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command is a
|
||||
valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
While the list server here at shorewall.net accepts and distributes HTML
|
||||
posts, a growing number of MTAs serving list subscribers are rejecting this
|
||||
HTML list traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse"!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a rather draconian way to control spam
|
||||
and that the unltimate loser here is not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you
|
||||
can help by restricting your list posts to plain text.<br>
|
||||
<br>
|
||||
And as a bonus, subscribers who use email clients like pine and mutt will
|
||||
be able to read your plain text posts whereas they are most likely simply
|
||||
ignoring your HTML posts.<br>
|
||||
<br>
|
||||
A final bonus for the use of HTML is that it cuts down the size of messages
|
||||
by a large percentage -- that is important when the same message must be
|
||||
sent 500 times over the slow DSL line connecting the list server to the internet.<br>
|
||||
|
||||
<h2></h2>
|
||||
|
||||
A growing number of MTAs serving list subscribers are rejecting all HTML
|
||||
traffic. At least one MTA has gone so far as to blacklist shorewall.net "for
|
||||
continuous abuse" because it has been my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control spam and
|
||||
that the ultimate losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I have now
|
||||
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||
posts.<br>
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post, your e-mail admin
|
||||
may be blocking mail whose <i>Received:</i> headers contain the names of
|
||||
certain ISPs. Again, I believe that such policies hurt more than they help
|
||||
but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
||||
headers to circumvent those policies.<br>
|
||||
|
||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||
|
||||
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
<form method="post" action="http://mail.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -127,120 +130,127 @@ sent 500 times over the slow DSL line connecting the list server to the internet
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config" value="htdig"> <input
|
||||
</font> <input type="hidden" name="config" value="htdig"> <input
|
||||
type="hidden" name="restrict"
|
||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
value="[http://mail.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
type="submit" value="Search"> </p>
|
||||
</form>
|
||||
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- its 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you'll be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued by Shoreline Firewall
|
||||
(such as the one used on my web site), you may <a
|
||||
If you want to trust X.509 certificates issued by Shoreline Firewall
|
||||
(such as the one used on my web site), you may <a
|
||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates then you
|
||||
in your browser. If you don't wish to trust my certificates then you
|
||||
can either use unencrypted access when subscribing to Shorewall mailing
|
||||
lists or you can use secure access (SSL) and accept the server's certificate
|
||||
when prompted by your browser.<br>
|
||||
|
||||
when prompted by your browser.<br>
|
||||
|
||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information of general
|
||||
interest to the Shorewall user community is also posted to this list.</p>
|
||||
|
||||
to get answers to questions and to report problems. Information of
|
||||
general interest to the Shorewall user community is also posted to
|
||||
this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
||||
|
||||
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
||||
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@shorewall.net">shorewall-users@shorewall.net</a>.</p>
|
||||
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-users/index.html">http://www.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-users/index.html">http://mail.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
list may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-announce">http://www.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
||||
</a><br>
|
||||
The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-announce">http://www.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
Shorewall community. To subscribe, go to <a
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-announce">http://mail.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
||||
</a><br>
|
||||
The list archives are at <a
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-announce">http://mail.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for coordinating
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
the exchange of ideas about the future of Shorewall and for coordinating
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-devel">http://www.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
||||
To post to the list, post to <a
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-devel">http://mail.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
||||
To post to the list, post to <a
|
||||
href="mailto:shorewall-devel@shorewall.net">shorewall-devel@shorewall.net</a>. </p>
|
||||
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-devel">http://www.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-devel">http://mail.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
the Mailing Lists</h2>
|
||||
|
||||
the Mailing Lists</h2>
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists. To unsubscribe:</p>
|
||||
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted to make
|
||||
this less confusing. To unsubscribe:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
"To change your subscription (set options like digest and delivery
|
||||
modes, get a reminder of your password, <b>or unsubscribe</b> from
|
||||
<name of list>), enter your subscription email address:". Enter
|
||||
your email address in the box and click on the "Edit Options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
||||
reminder, or change your subscription options enter your subscription
|
||||
email address:". Enter your email address in the box and click
|
||||
on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password, there
|
||||
is another button that will cause your password to be emailed to you.</p>
|
||||
</li>
|
||||
|
||||
and click on "Unsubscribe"; if you have forgotten your password, there
|
||||
is another button that will cause your password to be emailed to you.</p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
|
||||
<hr>
|
||||
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
||||
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/27/2002 - <a
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -213,7 +213,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -269,7 +269,7 @@ refresh" would also fail.<br>
|
||||
rather than the LOG target. This allows you to run ulogd (available from
|
||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in
|
||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||
|
||||
137
Shorewall-docs/shorewall_logging.html
Normal file
137
Shorewall-docs/shorewall_logging.html
Normal file
@ -0,0 +1,137 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
<title>Shorewall Logging</title>
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Logging</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
||||
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
||||
the notation <i>facility.priority</i>). <br>
|
||||
<br>
|
||||
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
||||
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
||||
<i>local7</i>.<br>
|
||||
<br>
|
||||
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
||||
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
||||
The syslog documentation uses the term <i>priority</i>.<br>
|
||||
|
||||
<h3>Syslog Levels<br>
|
||||
</h3>
|
||||
Syslog levels are a method of describing to syslog (8) the importance
|
||||
of a message and a number of Shorewall parameters have a syslog level as
|
||||
their value.<br>
|
||||
<br>
|
||||
Valid levels are:<br>
|
||||
<br>
|
||||
7
|
||||
debug<br>
|
||||
6
|
||||
info<br>
|
||||
5
|
||||
notice<br>
|
||||
4
|
||||
warning<br>
|
||||
3
|
||||
err<br>
|
||||
2
|
||||
crit<br>
|
||||
1
|
||||
alert<br>
|
||||
0
|
||||
emerg<br>
|
||||
<br>
|
||||
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
||||
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
||||
facility and the level that you specify. If you are unsure of the level
|
||||
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
||||
number.<br>
|
||||
<br>
|
||||
Syslogd writes log messages to files (typically in /var/log/*) based
|
||||
on their facility and level. The mapping of these facility/level pairs
|
||||
to log files is done in /etc/syslog.conf (5). If you make changes to this
|
||||
file, you must restart syslogd before the changes can take effect.<br>
|
||||
|
||||
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
||||
There are a couple of limitations to syslogd-based logging:<br>
|
||||
|
||||
<ol>
|
||||
<li>If you give, for example, kern.info it's own log destination then
|
||||
that destination will also receive all kernel messages of levels 5 (notice)
|
||||
through 0 (emerg).</li>
|
||||
<li>All kernel.info messages will go to that destination and not just
|
||||
those from NetFilter.<br>
|
||||
</li>
|
||||
</ol>
|
||||
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
||||
support (and most vendor-supplied kernels do), you may also specify a log
|
||||
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
||||
netfilter to log the related messages via the ULOG target which will send
|
||||
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
||||
and can be configured to log all Shorewall message to their own log file.<br>
|
||||
<br>
|
||||
Download the ulod tar file and:<br>
|
||||
|
||||
<ol>
|
||||
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
||||
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
||||
<li>cd ulogd-<i>version</i><br>
|
||||
</li>
|
||||
<li>./configure</li>
|
||||
<li>make</li>
|
||||
<li>make install<br>
|
||||
</li>
|
||||
</ol>
|
||||
If you are like me and don't have a development environment on your firewall,
|
||||
you can do the first five steps on another system then either NFS mount
|
||||
your /usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
||||
directory and move it to your firewall system.<br>
|
||||
<br>
|
||||
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
||||
|
||||
<ol>
|
||||
<li>syslogfile <i><file that you wish to log to></i></li>
|
||||
<li>syslogsync 1</li>
|
||||
</ol>
|
||||
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
||||
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
||||
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
||||
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
||||
something else done to activate the script.<br>
|
||||
<br>
|
||||
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file
|
||||
that you wish to log to></i>. This tells the /sbin/shorewall program
|
||||
where to look for the log when processing its "show log", "logwatch" and
|
||||
"monitor" commands.<br>
|
||||
|
||||
<p><font size="2"> Updated 12/29/2002 - <a
|
||||
href="file:///home/teastep/Shorewall-docs/support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep</font></a></font><br>
|
||||
</p>
|
||||
|
||||
<h2><br>
|
||||
</h2>
|
||||
</body>
|
||||
</html>
|
||||
@ -1,269 +1,274 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall QuickStart Guide</title>
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides<br>
|
||||
Version 3.1</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
Version 3.1</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that
|
||||
we must all first walk before we can run.</p>
|
||||
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that we
|
||||
must all first walk before we can run.</p>
|
||||
|
||||
<h2>The Guides</h2>
|
||||
|
||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||
|
||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||
in common firewall setups.</p>
|
||||
|
||||
|
||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
||||
acting as a firewall/router for a small local network</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a> Linux
|
||||
System acting as a firewall/router for a small local network and
|
||||
a DMZ.</li>
|
||||
|
||||
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
||||
acting as a firewall/router for a small local network</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a> Linux
|
||||
System acting as a firewall/router for a small local network and a
|
||||
DMZ.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p>The above guides are designed to get your first firewall up and running
|
||||
|
||||
<p>The above guides are designed to get your first firewall up and running
|
||||
quickly in the three most common Shorewall configurations.</p>
|
||||
|
||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
||||
the steps necessary to set up a firewall where <b>there are multiple
|
||||
public IP addresses involved or if you want to learn more about Shorewall
|
||||
|
||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
||||
the steps necessary to set up a firewall where <b>there are multiple
|
||||
public IP addresses involved or if you want to learn more about Shorewall
|
||||
than is explained in the single-address guides above.</b></p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
Concepts</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
Interfaces</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0
|
||||
Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
Concepts</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
Interfaces</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||
Addresses</a></li>
|
||||
<li><a
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||
Addresses</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
Resolution Protocol</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||
1918</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
up your Network</a>
|
||||
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
up your Network</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
||||
Odds and Ends</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||
Stopping the Firewall</a></li>
|
||||
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||
Stopping the Firewall</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2><a name="Documentation"></a>Documentation Index</h2>
|
||||
|
||||
<p>The following documentation covers a variety of topics and <b>supplements
|
||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||
described above</b>. Please review the appropriate guide before trying
|
||||
|
||||
<p>The following documentation covers a variety of topics and <b>supplements
|
||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||
described above</b>. Please review the appropriate guide before trying
|
||||
to use this documentation directly.</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
<ul>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common configuration
|
||||
file features</a>
|
||||
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common configuration
|
||||
file features</a>
|
||||
|
||||
<ul>
|
||||
<li>Comments in configuration files</li>
|
||||
<li>Line Continuation</li>
|
||||
<li>Port Numbers/Service Names</li>
|
||||
<li>Port Ranges</li>
|
||||
<li>Using Shell Variables</li>
|
||||
<li>Using DNS Names<br>
|
||||
</li>
|
||||
<li>Complementing an IP address or Subnet</li>
|
||||
<li>Shorewall Configurations (making a test configuration)</li>
|
||||
<li>Using MAC Addresses in Shorewall</li>
|
||||
<li>Logging<br>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm#Comments">Comments
|
||||
in configuration files</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Ports">Port
|
||||
Numbers/Service Names</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Ranges">Port
|
||||
Ranges</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Variables">Using
|
||||
Shell Variables</a></li>
|
||||
<li><a href="configuration_file_basics.htm#dnsnames">Using
|
||||
DNS Names</a><br>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm#Compliment">Complementing
|
||||
an IP address or Subnet</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Configs">Shorewall
|
||||
Configurations (making a test configuration)</a></li>
|
||||
<li><a href="configuration_file_basics.htm#MAC">Using MAC
|
||||
Addresses in Shorewall</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File Reference
|
||||
Manual</a>
|
||||
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File Reference
|
||||
Manual</a>
|
||||
|
||||
<ul>
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Zones">zones</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Policy">policy</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Rules">rules</a></font></li>
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Masq">masq</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#NAT">nat</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font> (How
|
||||
to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
||||
<li><a href="configuration_file_basics.htm#Levels">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Configuration Files</a> (How
|
||||
I personally use Shorewall)</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||
(How to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Configuration Files</a> (How I personally
|
||||
use Shorewall)</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
<ul>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
||||
<li>VPN
|
||||
|
||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
||||
<li>VPN
|
||||
|
||||
<ul>
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
||||
your firewall to a remote network.</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White List
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White List
|
||||
Creation</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||
|
||||
<p><font size="2">Last modified 12/13/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
|
||||
<p><font size="2">Last modified 12/29/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002 Thomas M. Eastep</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -239,7 +239,7 @@ the request is first checked against the rules in /etc/shorewall/common.def.</
|
||||
<li>allow all connection requests from your local network to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to your
|
||||
firewall or local network and log a message at the <i>info</i> level
|
||||
(<a href="configuration_file_basics.htm#Levels">here</a> is a description
|
||||
(<a href="shorewall_logging.html">here</a> is a description
|
||||
of log levels).</li>
|
||||
<li>reject all other connection requests and log a message at the <i>info</i>
|
||||
level. When a request is rejected, the firewall will return an RST (if
|
||||
|
||||
@ -200,7 +200,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the
|
||||
mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -257,7 +257,7 @@ to start and "shorewall refresh" would also fail.<br>
|
||||
rather than the LOG target. This allows you to run ulogd (available from
|
||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in
|
||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||
|
||||
@ -2,121 +2,121 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Support</title>
|
||||
|
||||
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p> <br>
|
||||
<span style="font-weight: 400;"></span></p>
|
||||
|
||||
<span style="font-weight: 400;"></span></p>
|
||||
|
||||
<h2><big><font color="#ff0000"><b>I don't look at problems sent to me directly
|
||||
but I try to spend some amount of time each day responding to problems
|
||||
posted on the Shorewall mailing list.</b></font></big></h2>
|
||||
|
||||
but I try to spend some amount of time each day responding to
|
||||
problems posted on the Shorewall mailing list.</b></font></big></h2>
|
||||
|
||||
<h2 align="center"><big><font color="#ff0000"><b>-Tom</b></font></big></h2>
|
||||
|
||||
|
||||
<h2>Before Reporting a Problem</h2>
|
||||
|
||||
|
||||
<h3>T<b>here are a number of sources for problem solution information. Please
|
||||
try these before you post.</b></h3>
|
||||
|
||||
try these before you post.</b></h3>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
||||
problems.</b></h3>
|
||||
</li>
|
||||
|
||||
problems.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="troubleshoot.htm">Troubleshooting</a> Information
|
||||
contains a number of tips to help you solve common problems.</b></h3>
|
||||
</li>
|
||||
|
||||
contains a number of tips to help you solve common problems.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="errata.htm"> Errata</a> has links to download
|
||||
updated components.</b></h3>
|
||||
</li>
|
||||
|
||||
updated components.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The Mailing List Archives search facility can locate posts
|
||||
about similar problems:</b></h3>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2> </h2>
|
||||
|
||||
|
||||
<h2>Mailing List Archive Search</h2>
|
||||
|
||||
|
||||
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -125,163 +125,166 @@
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
|
||||
</form>
|
||||
|
||||
<h2>Problem Reporting Guidelines</h2>
|
||||
<i>"Let me see if I can translate your message into a real-world example.
|
||||
It would be like saying that you have three rooms at home, and when you
|
||||
<i>"Let me see if I can translate your message into a real-world example.
|
||||
It would be like saying that you have three rooms at home, and when you
|
||||
walk into one of the rooms, you detect this strange smell. Can anyone tell
|
||||
you what that strange smell is?<br>
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the smell and even
|
||||
what's causing it. You would be absolutely amazed at the range and variety
|
||||
of smells we could come up with. Even more amazing is that all of the explanations
|
||||
for the smells would be completely plausible."<br>
|
||||
</i><br>
|
||||
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the smell and even
|
||||
what's causing it. You would be absolutely amazed at the range and variety
|
||||
of smells we could come up with. Even more amazing is that all of the
|
||||
explanations for the smells would be completely plausible."<br>
|
||||
</i><br>
|
||||
|
||||
<div align="center"> - Russell Mosemann<br>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
</div>
|
||||
<br>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>When reporting a problem, give as much information as you can.
|
||||
Reports that say "I tried XYZ and it didn't work" are not at all helpful.</b></h3>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Please don't describe your environment and then ask us to send
|
||||
you custom configuration files. We're here to answer your
|
||||
questions but we can't do your job for you.</b></h3>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Do you see any "Shorewall" messages in /var/log/messages
|
||||
when you exercise the function that is giving you problems?</b></h3>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Have you looked at the packet flow with a tool like tcpdump
|
||||
to try to understand what is going on?</b></h3>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Have you tried using the diagnostic capabilities of the
|
||||
application that isn't working? For example, if "ssh" isn't able
|
||||
to connect, using the "-v" option gives you a lot of valuable diagnostic
|
||||
information.</b></h3>
|
||||
</li>
|
||||
|
||||
information.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Please include any of the Shorewall configuration files (especially
|
||||
the /etc/shorewall/hosts file if you have modified that file)
|
||||
that you think are relevant.</b></h3>
|
||||
</li>
|
||||
<li>
|
||||
<h3><b>If an error occurs when you try to "shorewall start", include
|
||||
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
||||
for instructions).</b></h3>
|
||||
the /etc/shorewall/hosts file if you have modified that file)
|
||||
that you think are relevant.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||
your network layout, etc to the Mailing List -- your post
|
||||
will be rejected.</b></h3>
|
||||
</li>
|
||||
|
||||
<h3><b>If an error occurs when you try to "shorewall start", include
|
||||
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
||||
for instructions).</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||
your network layout, etc to the Mailing List -- your post
|
||||
will be rejected.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<br>
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
<blockquote>
|
||||
<h3><b> While the list server here at shorewall.net accepts and distributes
|
||||
HTML posts, a growing number of MTAs serving list subscribers are rejecting
|
||||
this HTML list traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse"!!</b></h3>
|
||||
<h3><b> I think that blocking all HTML is a rather draconian way to control
|
||||
spam and that the unltimate loser here is not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you can
|
||||
help by restricting your list posts to plain text.</b></h3>
|
||||
<h3><b> And as a bonus, subscribers who use email clients like pine and
|
||||
mutt will be able to read your plain text posts whereas they are most likely
|
||||
simply ignoring your HTML posts.</b></h3>
|
||||
<h3><b> A final bonus for the use of HTML is that it cuts down the size
|
||||
of messages by a large percentage -- that is important when the same message
|
||||
must be sent 500 times over the slow DSL line connecting the list server
|
||||
to the internet.</b> </h3>
|
||||
|
||||
<blockquote>
|
||||
<h3> A growing number of MTAs serving list subscribers are rejecting all
|
||||
HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in list
|
||||
posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control spam and
|
||||
that the ultimate losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I have now
|
||||
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||
posts.<br>
|
||||
</h3>
|
||||
<h3></h3>
|
||||
</blockquote>
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
|
||||
<h3></h3>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft Multi Network Firewall (MNF)
|
||||
and you have not purchased an MNF license from MandrakeSoft then you can post
|
||||
non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a>
|
||||
<b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a></p>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><big><font color="#ff0000"><b></b></font></big></p>
|
||||
|
||||
|
||||
|
||||
<p>To Subscribe to the mailing list go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 12/27/2002 - Tom Eastep</font></p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 12/29/2002 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user