mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-25 20:22:12 +02:00
Some post-1.2.12 documentation cleanup
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@389 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
4710fc7bdb
commit
2565081ff9
@ -755,7 +755,7 @@ in both the SOURCE and DEST columns.</li>
|
|||||||
<li> <b> LOG LEVEL</b> - Optional.
|
<li> <b> LOG LEVEL</b> - Optional.
|
||||||
If left empty, no log message is generated when the policy is applied.
|
If left empty, no log message is generated when the policy is applied.
|
||||||
Otherwise, this column should contain an integer or name indicating
|
Otherwise, this column should contain an integer or name indicating
|
||||||
a <a href="configuration_file_basics.htm#Levels">syslog level</a>.</li>
|
a <a href="shorewall_logging.html">syslog level</a>.</li>
|
||||||
|
|
||||||
<li> <b>LIMIT:BURST </b>- Optional.
|
<li> <b>LIMIT:BURST </b>- Optional.
|
||||||
If left empty, TCP connection requests from the <b>SOURCE</b> zone
|
If left empty, TCP connection requests from the <b>SOURCE</b> zone
|
||||||
@ -1251,7 +1251,7 @@ here as in the policy file above.</li>
|
|||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The ACTION may optionally be followed by ":" and a <a
|
<p>The ACTION may optionally be followed by ":" and a <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a> (example: REJECT:info). This causes the packet to be logged
|
level</a> (example: REJECT:info). This causes the packet to be logged
|
||||||
at the specified level prior to being processed according to the specified
|
at the specified level prior to being processed according to the specified
|
||||||
ACTION.<br>
|
ACTION.<br>
|
||||||
@ -2243,7 +2243,7 @@ is assumed.<br>
|
|||||||
This parameter determines the level at which packets logged under the <a
|
This parameter determines the level at which packets logged under the <a
|
||||||
href="file:///home/teastep/Shorewall-docs/Documentation.htm#rfc1918">'norfc1918'
|
href="file:///home/teastep/Shorewall-docs/Documentation.htm#rfc1918">'norfc1918'
|
||||||
mechanism </a> are logged. The value must be a valid <a
|
mechanism </a> are logged. The value must be a valid <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a> and if no level is given, then info is assumed. Prior to Shorewall
|
level</a> and if no level is given, then info is assumed. Prior to Shorewall
|
||||||
version 1.3.12, these packets are always logged at the info level.</li>
|
version 1.3.12, these packets are always logged at the info level.</li>
|
||||||
<li><b>TCP_FLAGS_DISPOSITION - </b>Added in Version 1.3.11<br>
|
<li><b>TCP_FLAGS_DISPOSITION - </b>Added in Version 1.3.11<br>
|
||||||
@ -2254,7 +2254,7 @@ DROP (ignore the packet). If not set or if set to the empty value (e.g.,
|
|||||||
TCP_FLAGS_DISPOSITION="") then TCP_FLAGS_DISPOSITION=DROP is assumed.</li>
|
TCP_FLAGS_DISPOSITION="") then TCP_FLAGS_DISPOSITION=DROP is assumed.</li>
|
||||||
<li><b>TCP_FLAGS_LOG_LEVEL - </b>Added in Version 1.3.11<br>
|
<li><b>TCP_FLAGS_LOG_LEVEL - </b>Added in Version 1.3.11<br>
|
||||||
Determines the <a
|
Determines the <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a> for logging packets that fail the checks enabled by the <a
|
level</a> for logging packets that fail the checks enabled by the <a
|
||||||
href="#Interfaces">tcpflags</a> interface option.The value must be a valid
|
href="#Interfaces">tcpflags</a> interface option.The value must be a valid
|
||||||
syslogd log level. If you don't want to log these packets, set to the empty
|
syslogd log level. If you don't want to log these packets, set to the empty
|
||||||
@ -2268,7 +2268,7 @@ or DROP (ignore the connection request). If not set or if set to the empty
|
|||||||
value (e.g., MACLIST_DISPOSITION="") then MACLIST_DISPOSITION=REJECT is assumed.</li>
|
value (e.g., MACLIST_DISPOSITION="") then MACLIST_DISPOSITION=REJECT is assumed.</li>
|
||||||
<li><b>MACLIST_LOG_LEVEL </b>- Added in Version 1.3.10<br>
|
<li><b>MACLIST_LOG_LEVEL </b>- Added in Version 1.3.10<br>
|
||||||
Determines the <a
|
Determines the <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a> for logging connection requests that fail <a
|
level</a> for logging connection requests that fail <a
|
||||||
href="MAC_Validation.html">MAC Verification</a>. The value must be a valid
|
href="MAC_Validation.html">MAC Verification</a>. The value must be a valid
|
||||||
syslogd log level. If you don't want to log these connection requests, set
|
syslogd log level. If you don't want to log these connection requests, set
|
||||||
@ -2295,7 +2295,7 @@ unless they are handled by an explicit entry in the <a
|
|||||||
Beginning with version 1.3.6, Shorewall drops non-SYN TCP
|
Beginning with version 1.3.6, Shorewall drops non-SYN TCP
|
||||||
packets that are not part of an existing connection. If you would
|
packets that are not part of an existing connection. If you would
|
||||||
like to log these packets, set LOGNEWNOTSYN to the <a
|
like to log these packets, set LOGNEWNOTSYN to the <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a> at which you want the packets logged. Example: LOGNEWNOTSYN=ULOG|<br>
|
level</a> at which you want the packets logged. Example: LOGNEWNOTSYN=ULOG|<br>
|
||||||
<br>
|
<br>
|
||||||
<b>Note: </b>Packets logged under this option are usually
|
<b>Note: </b>Packets logged under this option are usually
|
||||||
@ -2612,7 +2612,7 @@ assumed.</li>
|
|||||||
at. Its
|
at. Its
|
||||||
value
|
value
|
||||||
is a <a
|
is a <a
|
||||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
href="shorewall_logging.html">syslog
|
||||||
level</a>
|
level</a>
|
||||||
(Example:
|
(Example:
|
||||||
BLACKLIST_LOGLEVEL=debug).
|
BLACKLIST_LOGLEVEL=debug).
|
||||||
|
|||||||
@ -616,7 +616,7 @@ see "man syslog") in your <a href="Documentation.htm#Policy">policies</a>
|
|||||||
|
|
||||||
<div align="left">
|
<div align="left">
|
||||||
<pre align="left"> LOGLIMIT=""<br> LOGBURST=""<br><br>Beginning with Shorewall version 1.3.12, you can <a
|
<pre align="left"> LOGLIMIT=""<br> LOGBURST=""<br><br>Beginning with Shorewall version 1.3.12, you can <a
|
||||||
href="configuration_file_basics.htm#Levels">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
href="shorewall_logging.html">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<h4 align="left"><a name="faq6a"></a>6a. Are there any log parsers that work
|
<h4 align="left"><a name="faq6a"></a>6a. Are there any log parsers that work
|
||||||
|
|||||||
@ -2,110 +2,109 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
<title>MAC Verification</title>
|
<title>MAC Verification</title>
|
||||||
|
|
||||||
<meta http-equiv="content-type"
|
<meta http-equiv="content-type"
|
||||||
content="text/html; charset=ISO-8859-1">
|
content="text/html; charset=ISO-8859-1">
|
||||||
|
|
||||||
<meta name="author" content="Tom Eastep">
|
<meta name="author" content="Tom Eastep">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber4"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">MAC Verification</font><br>
|
<h1 align="center"><font color="#ffffff">MAC Verification</font><br>
|
||||||
</h1>
|
</h1>
|
||||||
<br>
|
<br>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
<br>
|
<br>
|
||||||
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
||||||
or from a subnet on an interface can be verified to originate from a defined
|
or from a subnet on an interface can be verified to originate from a defined
|
||||||
set of MAC addresses. Furthermore, each MAC address may be optionally associated
|
set of MAC addresses. Furthermore, each MAC address may be optionally associated
|
||||||
with one or more IP addresses. <br>
|
with one or more IP addresses. <br>
|
||||||
<br>
|
<br>
|
||||||
<b>You must have the iproute package (ip utility) installed to use MAC Verification.</b><br>
|
<b>You must have the iproute package (ip utility) installed to use MAC Verification
|
||||||
<br>
|
and your kernel must include MAC match support (CONFIG_IP_NF_MATCH_MAC -
|
||||||
There are four components to this facility.<br>
|
module name ipt_mac.o).</b><br>
|
||||||
|
<br>
|
||||||
|
There are four components to this facility.<br>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The <b>maclist</b> interface option in <a
|
<li>The <b>maclist</b> interface option in <a
|
||||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When
|
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When this
|
||||||
this option is specified, all traffic arriving on the interface is subjet
|
option is specified, all traffic arriving on the interface is subjet to MAC
|
||||||
to MAC verification.</li>
|
verification.</li>
|
||||||
<li>The <b>maclist </b>option in <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>.
|
<li>The <b>maclist </b>option in <a
|
||||||
When this option is specified for a subnet, all traffic from that subnet
|
href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>. When this option
|
||||||
is subject to MAC verification.</li>
|
is specified for a subnet, all traffic from that subnet is subject to MAC
|
||||||
<li>The /etc/shorewall/maclist file. This file is used to associate
|
verification.</li>
|
||||||
MAC addresses with interfaces and to optionally associate IP addresses with
|
<li>The /etc/shorewall/maclist file. This file is used to associate
|
||||||
MAC addresses.</li>
|
MAC addresses with interfaces and to optionally associate IP addresses
|
||||||
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
with MAC addresses.</li>
|
||||||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
|
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
||||||
The MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and
|
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a> The
|
||||||
determines the disposition of connection requests that fail MAC verification.
|
MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and determines
|
||||||
The MACLIST_LOG_LEVEL variable gives the syslogd level at which connection
|
the disposition of connection requests that fail MAC verification. The
|
||||||
requests that fail verification are to be logged. If set the the empty value
|
MACLIST_LOG_LEVEL variable gives the syslogd level at which connection requests
|
||||||
(e.g., MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
that fail verification are to be logged. If set the the empty value (e.g.,
|
||||||
</li>
|
MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
||||||
|
</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
The columns in /etc/shorewall/maclist are:<br>
|
The columns in /etc/shorewall/maclist are:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
||||||
system.</li>
|
system.</li>
|
||||||
<li>MAC - The MAC address of a device on the ethernet segment connected
|
<li>MAC - The MAC address of a device on the ethernet segment connected
|
||||||
by INTERFACE. It is not necessary to use the Shorewall MAC format in this
|
by INTERFACE. It is not necessary to use the Shorewall MAC format in this
|
||||||
column although you may use that format if you so choose.</li>
|
column although you may use that format if you so choose.</li>
|
||||||
<li>IP Address - An optional comma-separated list of IP addresses for
|
<li>IP Address - An optional comma-separated list of IP addresses
|
||||||
the device whose MAC is listed in the MAC column.</li>
|
for the device whose MAC is listed in the MAC column.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>Example 1: Here are my files:</h3>
|
<h3>Example 1: Here are my files:</h3>
|
||||||
<b>/etc/shorewall/shorewall.conf:<br>
|
<b>/etc/shorewall/shorewall.conf:<br>
|
||||||
</b>
|
</b>
|
||||||
<pre> MACLIST_DISPOSITION=REJECT<br> MACLIST_LOG_LEVEL=info<br></pre>
|
<pre> MACLIST_DISPOSITION=REJECT<br> MACLIST_LOG_LEVEL=info<br></pre>
|
||||||
<b>/etc/shorewall/interfaces:</b><br>
|
<b>/etc/shorewall/interfaces:</b><br>
|
||||||
|
|
||||||
<pre> #ZONE INTERFACE BROADCAST OPTIONS<br> net eth0 206.124.146.255 norfc1918,filterping,dhcp,blacklist<br> loc eth2 192.168.1.255 dhcp,filterping,maclist<br> dmz eth1 192.168.2.255 filterping<br> net eth3 206.124.146.255 filterping,blacklist<br> - texas 192.168.9.255 filterping<br> loc ppp+ - filterping<br></pre>
|
<pre> #ZONE INTERFACE BROADCAST OPTIONS<br> net eth0 206.124.146.255 norfc1918,filterping,dhcp,blacklist<br> loc eth2 192.168.1.255 dhcp,filterping,maclist<br> dmz eth1 192.168.2.255 filterping<br> net eth3 206.124.146.255 filterping,blacklist<br> - texas 192.168.9.255 filterping<br> loc ppp+ - filterping<br></pre>
|
||||||
<b>/etc/shorewall/maclist:</b><br>
|
<b>/etc/shorewall/maclist:</b><br>
|
||||||
|
|
||||||
<pre> #INTERFACE MAC IP ADDRESSES (Optional)<br> eth2 00:A0:CC:63:66:89 192.168.1.3 #Wookie<br> eth2 00:10:B5:EC:FD:0B 192.168.1.4 #Tarry<br> eth2 00:A0:CC:DB:31:C4 192.168.1.5 #Ursa<br> eth2 00:06:25:aa:a8:0f 192.168.1.7 #Eastept1 (Wireless)<br> eth2 00:04:5A:0E:85:B9 192.168.1.250 #Wap<br></pre>
|
<pre> #INTERFACE MAC IP ADDRESSES (Optional)<br> eth2 00:A0:CC:63:66:89 192.168.1.3 #Wookie<br> eth2 00:10:B5:EC:FD:0B 192.168.1.4 #Tarry<br> eth2 00:A0:CC:DB:31:C4 192.168.1.5 #Ursa<br> eth2 00:06:25:aa:a8:0f 192.168.1.7 #Eastept1 (Wireless)<br> eth2 00:04:5A:0E:85:B9 192.168.1.250 #Wap<br></pre>
|
||||||
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
||||||
zone</a>.<br>
|
zone</a>.<br>
|
||||||
|
|
||||||
<h3>Example 2: Router in Local Zone</h3>
|
<h3>Example 2: Router in Local Zone</h3>
|
||||||
Suppose now that I add a second ethernet segment to my local zone and
|
Suppose now that I add a second ethernet segment to my local zone and
|
||||||
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
||||||
IP address 192.168.1.253. Hosts in the second segment have IP addresses in
|
IP address 192.168.1.253. Hosts in the second segment have IP addresses
|
||||||
the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
in the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
||||||
file:<br>
|
file:<br>
|
||||||
|
|
||||||
<pre> eth2 00:06:43:45:C6:15 192.168.1.253,192.168.2.0/24<br></pre>
|
<pre> eth2 00:06:43:45:C6:15 192.168.1.253,192.168.2.0/24<br></pre>
|
||||||
This entry accomodates traffic from the router itself (192.168.1.253)
|
This entry accomodates traffic from the router itself (192.168.1.253)
|
||||||
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
||||||
being sent to my firewall from the 192.168.2.0/24 segment will be forwarded
|
being sent to my firewall from the 192.168.2.0/24 segment will be forwarded
|
||||||
by the router so that traffic's MAC address will be that of the router (00:06:43:45:C6:15)
|
by the router so that traffic's MAC address will be that of the router (00:06:43:45:C6:15)
|
||||||
and not that of the host sending the traffic.
|
and not that of the host sending the traffic.
|
||||||
<p><font size="2"> Updated 12/22/2002 - <a href="support.htm">Tom Eastep</a>
|
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||||
</font></p>
|
</font></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
@ -52,7 +52,7 @@ the current packet classification filters. The output from this command is
|
|||||||
the LOG target. This allows you to run ulogd (available from <a
|
the LOG target. This allows you to run ulogd (available from <a
|
||||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||||
@ -98,7 +98,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
|||||||
than the LOG target. This allows you to run ulogd (available from <a
|
than the LOG target. This allows you to run ulogd (available from <a
|
||||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||||
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for
|
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for
|
||||||
|
|||||||
@ -1,435 +1,340 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Configuration File Basics</title>
|
<title>Configuration File Basics</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
||||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
configuration files on a system running Microsoft Windows, you <u>must</u>
|
||||||
run them through <a
|
run them through <a
|
||||||
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
||||||
before you use them with Shorewall.</b></p>
|
before you use them with Shorewall.</b></p>
|
||||||
|
|
||||||
<h2>Files</h2>
|
<h2><a name="Files"></a>Files</h2>
|
||||||
|
|
||||||
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>/etc/shorewall/shorewall.conf - used to set several
|
<li>/etc/shorewall/shorewall.conf - used to set several
|
||||||
firewall parameters.</li>
|
firewall parameters.</li>
|
||||||
<li>/etc/shorewall/params - use this file to set shell
|
<li>/etc/shorewall/params - use this file to set shell
|
||||||
variables that you will expand in other files.</li>
|
variables that you will expand in other files.</li>
|
||||||
<li>/etc/shorewall/zones - partition the firewall's
|
<li>/etc/shorewall/zones - partition the firewall's
|
||||||
view of the world into <i>zones.</i></li>
|
view of the world into <i>zones.</i></li>
|
||||||
<li>/etc/shorewall/policy - establishes firewall high-level
|
<li>/etc/shorewall/policy - establishes firewall high-level
|
||||||
policy.</li>
|
policy.</li>
|
||||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
<li>/etc/shorewall/interfaces - describes the interfaces
|
||||||
on the firewall system.</li>
|
on the firewall system.</li>
|
||||||
<li>/etc/shorewall/hosts - allows defining zones in
|
<li>/etc/shorewall/hosts - allows defining zones in
|
||||||
terms of individual hosts and subnetworks.</li>
|
terms of individual hosts and subnetworks.</li>
|
||||||
<li>/etc/shorewall/masq - directs the firewall where
|
<li>/etc/shorewall/masq - directs the firewall where
|
||||||
to use many-to-one (dynamic) Network Address Translation (a.k.a.
|
to use many-to-one (dynamic) Network Address Translation (a.k.a.
|
||||||
Masquerading) and Source Network Address Translation (SNAT).</li>
|
Masquerading) and Source Network Address Translation (SNAT).</li>
|
||||||
<li>/etc/shorewall/modules - directs the firewall to
|
<li>/etc/shorewall/modules - directs the firewall
|
||||||
load kernel modules.</li>
|
to load kernel modules.</li>
|
||||||
<li>/etc/shorewall/rules - defines rules that are exceptions
|
<li>/etc/shorewall/rules - defines rules that are
|
||||||
to the overall policies established in /etc/shorewall/policy.</li>
|
exceptions to the overall policies established in /etc/shorewall/policy.</li>
|
||||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||||
ARP.</li>
|
ARP.</li>
|
||||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
||||||
later) - defines hosts accessible when Shorewall is stopped.</li>
|
later) - defines hosts accessible when Shorewall is stopped.</li>
|
||||||
<li>/etc/shorewall/tcrules - defines marking of packets
|
<li>/etc/shorewall/tcrules - defines marking of packets
|
||||||
for later use by traffic control/shaping or policy routing.</li>
|
for later use by traffic control/shaping or policy routing.</li>
|
||||||
<li>/etc/shorewall/tos - defines rules for setting
|
<li>/etc/shorewall/tos - defines rules for setting
|
||||||
the TOS field in packet headers.</li>
|
the TOS field in packet headers.</li>
|
||||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
||||||
IPIP tunnels with end-points on the firewall system.</li>
|
IPIP tunnels with end-points on the firewall system.</li>
|
||||||
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
||||||
addresses.</li>
|
addresses.</li>
|
||||||
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
||||||
of a "shorewall start" or "shorewall restart".</li>
|
of a "shorewall start" or "shorewall restart".</li>
|
||||||
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
||||||
of a "shorewall start" or "shorewall restart"</li>
|
of a "shorewall start" or "shorewall restart"</li>
|
||||||
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
||||||
of a "shorewall stop".</li>
|
of a "shorewall stop".</li>
|
||||||
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
||||||
completion of a "shorewall stop".<br>
|
completion of a "shorewall stop".<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2>Comments</h2>
|
<h2><a name="Comments"></a>Comments</h2>
|
||||||
|
|
||||||
<p>You may place comments in configuration files by making the first non-whitespace
|
<p>You may place comments in configuration files by making the first non-whitespace
|
||||||
character a pound sign ("#"). You may also place comments at
|
character a pound sign ("#"). You may also place comments at
|
||||||
the end of any line, again by delimiting the comment from the rest
|
the end of any line, again by delimiting the comment from the rest
|
||||||
of the line with a pound sign.</p>
|
of the line with a pound sign.</p>
|
||||||
|
|
||||||
<p>Examples:</p>
|
<p>Examples:</p>
|
||||||
|
|
||||||
<pre># This is a comment</pre>
|
<pre># This is a comment</pre>
|
||||||
|
|
||||||
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
||||||
|
|
||||||
<h2>Line Continuation</h2>
|
<h2><a name="Continuation"></a>Line Continuation</h2>
|
||||||
|
|
||||||
<p>You may continue lines in the configuration files using the usual backslash
|
<p>You may continue lines in the configuration files using the usual backslash
|
||||||
("\") followed immediately by a new line character.</p>
|
("\") followed immediately by a new line character.</p>
|
||||||
|
|
||||||
<p>Example:</p>
|
<p>Example:</p>
|
||||||
|
|
||||||
<pre>ACCEPT net fw tcp \<br>smtp,www,pop3,imap #Services running on the firewall</pre>
|
<pre>ACCEPT net fw tcp \<br>smtp,www,pop3,imap #Services running on the firewall</pre>
|
||||||
|
|
||||||
<h2><a name="dnsnames"></a>Using DNS Names</h2>
|
<h2><a name="dnsnames"></a>Using DNS Names</h2>
|
||||||
|
|
||||||
<p align="left"> </p>
|
|
||||||
|
|
||||||
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
|
||||||
using DNS names in Shorewall configuration files. If you use DNS names
|
|
||||||
and you are called out of bed at 2:00AM because Shorewall won't start
|
|
||||||
as a result of DNS problems then don't say that you were not forewarned.
|
|
||||||
<br>
|
|
||||||
</b></p>
|
|
||||||
|
|
||||||
<p align="left"><b> -Tom<br>
|
|
||||||
</b></p>
|
|
||||||
|
|
||||||
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
|
||||||
configuration files may be specified as either IP addresses or DNS
|
|
||||||
Names.<br>
|
|
||||||
<br>
|
|
||||||
DNS names in iptables rules aren't nearly as useful as they
|
|
||||||
first appear. When a DNS name appears in a rule, the iptables utility
|
|
||||||
resolves the name to one or more IP addresses and inserts those addresses
|
|
||||||
into the rule. So changes in the DNS->IP address relationship that
|
|
||||||
occur after the firewall has started have absolutely no effect on the
|
|
||||||
firewall's ruleset. </p>
|
|
||||||
|
|
||||||
<p align="left"> If your firewall rules include DNS names then:</p>
|
|
||||||
|
|
||||||
|
<p align="left"> </p>
|
||||||
|
|
||||||
|
<p align="left"><b>WARNING: I personally recommend strongly <u>against</u>
|
||||||
|
using DNS names in Shorewall configuration files. If you use DNS names
|
||||||
|
and you are called out of bed at 2:00AM because Shorewall won't start
|
||||||
|
as a result of DNS problems then don't say that you were not forewarned.
|
||||||
|
<br>
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p align="left"><b> -Tom<br>
|
||||||
|
</b></p>
|
||||||
|
|
||||||
|
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
||||||
|
configuration files may be specified as either IP addresses or DNS
|
||||||
|
Names.<br>
|
||||||
|
<br>
|
||||||
|
DNS names in iptables rules aren't nearly as useful as they
|
||||||
|
first appear. When a DNS name appears in a rule, the iptables utility
|
||||||
|
resolves the name to one or more IP addresses and inserts those addresses
|
||||||
|
into the rule. So changes in the DNS->IP address relationship that
|
||||||
|
occur after the firewall has started have absolutely no effect on the
|
||||||
|
firewall's ruleset. </p>
|
||||||
|
|
||||||
|
<p align="left"> If your firewall rules include DNS names then:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>If your /etc/resolv.conf is wrong then your firewall won't
|
<li>If your /etc/resolv.conf is wrong then your firewall
|
||||||
start.</li>
|
|
||||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
|
||||||
won't start.</li>
|
won't start.</li>
|
||||||
<li>If your Name Server(s) is(are) down then your firewall
|
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||||
won't start.</li>
|
won't start.</li>
|
||||||
<li>If your startup scripts try to start your firewall before
|
<li>If your Name Server(s) is(are) down then your firewall
|
||||||
|
won't start.</li>
|
||||||
|
<li>If your startup scripts try to start your firewall before
|
||||||
starting your DNS server then your firewall won't start.<br>
|
starting your DNS server then your firewall won't start.<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Factors totally outside your control (your ISP's router
|
<li>Factors totally outside your control (your ISP's router
|
||||||
is down for example), can prevent your firewall from starting.</li>
|
is down for example), can prevent your firewall from starting.</li>
|
||||||
<li>You must bring up your network interfaces prior to starting
|
<li>You must bring up your network interfaces prior to starting
|
||||||
your firewall.<br>
|
your firewall.<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
|
||||||
of two periods (although one may be trailing). This restriction is imposed
|
|
||||||
by Shorewall to insure backward compatibility with existing configuration
|
|
||||||
files.<br>
|
|
||||||
<br>
|
|
||||||
Examples of valid DNS names:<br>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>mail.shorewall.net</li>
|
|
||||||
<li>shorewall.net. (note the trailing period).</li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
Examples of invalid DNS names:<br>
|
|
||||||
|
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
||||||
|
of two periods (although one may be trailing). This restriction is
|
||||||
|
imposed by Shorewall to insure backward compatibility with existing
|
||||||
|
configuration files.<br>
|
||||||
|
<br>
|
||||||
|
Examples of valid DNS names:<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>mail (not fully qualified)</li>
|
<li>mail.shorewall.net</li>
|
||||||
<li>shorewall.net (only one period)</li>
|
<li>shorewall.net. (note the trailing period).</li>
|
||||||
|
|
||||||
</ul>
|
|
||||||
DNS names may not be used as:<br>
|
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
Examples of invalid DNS names:<br>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
<li>mail (not fully qualified)</li>
|
||||||
|
<li>shorewall.net (only one period)</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
DNS names may not be used as:<br>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||||
file)</li>
|
file)</li>
|
||||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||||
<li>In the /etc/shorewall/nat file.</li>
|
<li>In the /etc/shorewall/nat file.</li>
|
||||||
|
|
||||||
</ul>
|
|
||||||
These restrictions are not imposed by Shorewall simply for
|
|
||||||
your inconvenience but are rather limitations of iptables.<br>
|
|
||||||
|
|
||||||
<h2>Complementing an Address or Subnet</h2>
|
|
||||||
|
|
||||||
<p>Where specifying an IP address, a subnet or an interface, you can
|
|
||||||
precede the item with "!" to specify the complement of the item. For
|
|
||||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must be
|
|
||||||
no white space following the "!".</p>
|
|
||||||
|
|
||||||
<h2>Comma-separated Lists</h2>
|
|
||||||
|
|
||||||
<p>Comma-separated lists are allowed in a number of contexts within the
|
|
||||||
configuration files. A comma separated list:</p>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>Must not have any embedded white space.<br>
|
|
||||||
Valid: routestopped,dhcp,norfc1918<br>
|
|
||||||
Invalid: routestopped, dhcp, norfc1818</li>
|
|
||||||
<li>If you use line continuation to break a comma-separated
|
|
||||||
list, the continuation line(s) must begin in column 1 (or there
|
|
||||||
would be embedded white space)</li>
|
|
||||||
<li>Entries in a comma-separated list may appear in
|
|
||||||
any order.</li>
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
These restrictions are not imposed by Shorewall simply for
|
||||||
<h2>Port Numbers/Service Names</h2>
|
your inconvenience but are rather limitations of iptables.<br>
|
||||||
|
|
||||||
<p>Unless otherwise specified, when giving a port number you can use
|
<h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
|
||||||
either an integer or a service name from /etc/services. </p>
|
|
||||||
|
<p>Where specifying an IP address, a subnet or an interface, you can
|
||||||
<h2>Port Ranges</h2>
|
precede the item with "!" to specify the complement of the item. For
|
||||||
|
example, !192.168.1.4 means "any host but 192.168.1.4". There must
|
||||||
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
be no white space following the "!".</p>
|
||||||
port number</i>>:<<i>high port number</i>>. For example,
|
|
||||||
if you want to forward the range of tcp ports 4000 through 4100 to local
|
<h2><a name="Lists"></a>Comma-separated Lists</h2>
|
||||||
host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
|
||||||
</p>
|
<p>Comma-separated lists are allowed in a number of contexts within the
|
||||||
|
configuration files. A comma separated list:</p>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>Must not have any embedded white space.<br>
|
||||||
|
Valid: routestopped,dhcp,norfc1918<br>
|
||||||
|
Invalid: routestopped, dhcp, norfc1818</li>
|
||||||
|
<li>If you use line continuation to break a comma-separated
|
||||||
|
list, the continuation line(s) must begin in column 1 (or
|
||||||
|
there would be embedded white space)</li>
|
||||||
|
<li>Entries in a comma-separated list may appear in
|
||||||
|
any order.</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<h2><a name="Ports"></a>Port Numbers/Service Names</h2>
|
||||||
|
|
||||||
|
<p>Unless otherwise specified, when giving a port number you can use
|
||||||
|
either an integer or a service name from /etc/services. </p>
|
||||||
|
|
||||||
|
<h2><a name="Ranges"></a>Port Ranges</h2>
|
||||||
|
|
||||||
|
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
||||||
|
port number</i>>:<<i>high port number</i>>. For example,
|
||||||
|
if you want to forward the range of tcp ports 4000 through 4100 to
|
||||||
|
local host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
||||||
|
|
||||||
<h2>Using Shell Variables</h2>
|
<h2><a name="Variables"></a>Using Shell Variables</h2>
|
||||||
|
|
||||||
<p>You may use the /etc/shorewall/params file to set shell variables
|
<p>You may use the /etc/shorewall/params file to set shell variables
|
||||||
that you can then use in some of the other configuration files.</p>
|
that you can then use in some of the other configuration files.</p>
|
||||||
|
|
||||||
<p>It is suggested that variable names begin with an upper case letter<font
|
<p>It is suggested that variable names begin with an upper case letter<font
|
||||||
size="1"> </font>to distinguish them from variables used internally
|
size="1"> </font>to distinguish them from variables used internally
|
||||||
within the Shorewall programs</p>
|
within the Shorewall programs</p>
|
||||||
|
|
||||||
<p>Example:</p>
|
<p>Example:</p>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
|
|
||||||
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=noping,norfc1918</pre>
|
|
||||||
</blockquote>
|
|
||||||
|
|
||||||
<p><br>
|
|
||||||
Example (/etc/shorewall/interfaces record):</p>
|
|
||||||
<font
|
|
||||||
face="Century Gothic, Arial, Helvetica">
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
|
||||||
</blockquote>
|
|
||||||
</font>
|
|
||||||
|
|
||||||
<p>The result will be the same as if the record had been written</p>
|
|
||||||
<font
|
|
||||||
face="Century Gothic, Arial, Helvetica">
|
|
||||||
|
|
||||||
<blockquote>
|
|
||||||
|
|
||||||
<pre>net eth0 130.252.100.255 noping,norfc1918</pre>
|
|
||||||
</blockquote>
|
|
||||||
</font>
|
|
||||||
|
|
||||||
<p>Variables may be used anywhere in the other configuration
|
|
||||||
files.</p>
|
|
||||||
|
|
||||||
<h2>Using MAC Addresses</h2>
|
|
||||||
|
|
||||||
<p>Media Access Control (MAC) addresses can be used to specify packet
|
|
||||||
source in several of the configuration files. To use this feature,
|
|
||||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
|
||||||
included.</p>
|
|
||||||
|
|
||||||
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
|
||||||
unique MAC address.<br>
|
|
||||||
<br>
|
|
||||||
In GNU/Linux, MAC addresses are usually written as a
|
|
||||||
series of 6 hex numbers separated by colons. Example:<br>
|
|
||||||
<br>
|
|
||||||
[root@gateway root]# ifconfig eth0<br>
|
|
||||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
|
||||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
|
||||||
Mask:255.255.255.0<br>
|
|
||||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
|
||||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
|
||||||
frame:0<br>
|
|
||||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
|
||||||
carrier:0<br>
|
|
||||||
collisions:30394 txqueuelen:100<br>
|
|
||||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
|
||||||
(1582.8 Mb)<br>
|
|
||||||
Interrupt:11 Base address:0x1800<br>
|
|
||||||
<br>
|
|
||||||
Because Shorewall uses colons as a separator for address
|
|
||||||
fields, Shorewall requires MAC addresses to be written in another
|
|
||||||
way. In Shorewall, MAC addresses begin with a tilde ("~") and
|
|
||||||
consist of 6 hex numbers separated by hyphens. In Shorewall, the
|
|
||||||
MAC address in the example above would be written "~02-00-08-E3-FA-55".<br>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
|
||||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<h2><a name="Levels"></a>Logging</h2>
|
|
||||||
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
|
||||||
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
|
||||||
the notation <i>facility.priority</i>). <br>
|
|
||||||
<br>
|
|
||||||
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
|
||||||
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
|
||||||
<i>local7</i>.<br>
|
|
||||||
<br>
|
|
||||||
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
|
||||||
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
|
||||||
The syslog documentation uses the term <i>priority</i>.<br>
|
|
||||||
|
|
||||||
<h3>Syslog Levels<br>
|
|
||||||
</h3>
|
|
||||||
Syslog levels are a method of describing to syslog (8) the importance
|
|
||||||
of a message and a number of Shorewall parameters have a syslog level
|
|
||||||
as their value.<br>
|
|
||||||
<br>
|
|
||||||
Valid levels are:<br>
|
|
||||||
<br>
|
|
||||||
7 debug<br>
|
|
||||||
6 info<br>
|
|
||||||
5 notice<br>
|
|
||||||
4 warning<br>
|
|
||||||
3 err<br>
|
|
||||||
2 crit<br>
|
|
||||||
1 alert<br>
|
|
||||||
0 emerg<br>
|
|
||||||
<br>
|
|
||||||
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
|
||||||
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
|
||||||
facility and the level that you specify. If you are unsure of the level
|
|
||||||
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
|
||||||
number.<br>
|
|
||||||
<br>
|
|
||||||
Syslogd writes log messages to files (typically in /var/log/*) based
|
|
||||||
on their facility and level. The mapping of these facility/level pairs to
|
|
||||||
log files is done in /etc/syslog.conf (5). If you make changes to this file,
|
|
||||||
you must restart syslogd before the changes can take effect.<br>
|
|
||||||
|
|
||||||
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
|
||||||
There are a couple of limitations to syslogd-based logging:<br>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>If you give, for example, kern.info it's own log destination then
|
|
||||||
that destination will also receive all kernel messages of levels 5 (notice)
|
|
||||||
through 0 (emerg).</li>
|
|
||||||
<li>All kernel.info messages will go to that destination and not just
|
|
||||||
those from NetFilter.<br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
|
||||||
support (and most vendor-supplied kernels do), you may also specify a log
|
|
||||||
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
|
||||||
netfilter to log the related messages via the ULOG target which will send
|
|
||||||
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
|
||||||
and can be configured to log all Shorewall message to their own log file.<br>
|
|
||||||
<br>
|
|
||||||
Download the ulod tar file and:<br>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
|
||||||
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
|
||||||
<li>cd ulogd-<i>version</i><br>
|
|
||||||
</li>
|
|
||||||
<li>./configure</li>
|
|
||||||
<li>make</li>
|
|
||||||
<li>make install<br>
|
|
||||||
</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
If you are like me and don't have a development environment on your firewall,
|
|
||||||
you can do the first five steps on another system then either NFS mount your
|
|
||||||
/usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
|
||||||
directory and move it to your firewall system.<br>
|
|
||||||
<br>
|
|
||||||
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
|
||||||
|
|
||||||
<ol>
|
|
||||||
<li>syslogfile <i><file that you wish to log to></i></li>
|
|
||||||
<li>syslogsync 1</li>
|
|
||||||
|
|
||||||
</ol>
|
|
||||||
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
|
||||||
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
|
||||||
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
|
||||||
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
|
||||||
something else done to activate the script.<br>
|
|
||||||
<br>
|
|
||||||
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file that
|
|
||||||
you wish to log to></i>. This tells the /sbin/shorewall program where to
|
|
||||||
look for the log when processing its "show log", "logwatch" and "monitor"
|
|
||||||
commands.<br>
|
|
||||||
|
|
||||||
<h2><a name="Configs"></a>Shorewall Configurations</h2>
|
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=noping,norfc1918</pre>
|
||||||
|
</blockquote>
|
||||||
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
|
||||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start and
|
<p><br>
|
||||||
restart</a> commands allow you to specify an alternate configuration
|
Example (/etc/shorewall/interfaces record):</p>
|
||||||
directory and Shorewall will use the files in the alternate directory
|
<font
|
||||||
rather than the corresponding files in /etc/shorewall. The alternate directory
|
face="Century Gothic, Arial, Helvetica">
|
||||||
need not contain a complete configuration; those files not in the alternate
|
|
||||||
directory will be read from /etc/shorewall.</p>
|
<blockquote>
|
||||||
|
|
||||||
<p> This facility permits you to easily create a test or temporary configuration
|
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
||||||
by:</p>
|
</blockquote>
|
||||||
|
</font>
|
||||||
|
|
||||||
|
<p>The result will be the same as if the record had been written</p>
|
||||||
|
<font
|
||||||
|
face="Century Gothic, Arial, Helvetica">
|
||||||
|
|
||||||
|
<blockquote>
|
||||||
|
|
||||||
|
<pre>net eth0 130.252.100.255 noping,norfc1918</pre>
|
||||||
|
</blockquote>
|
||||||
|
</font>
|
||||||
|
|
||||||
|
<p>Variables may be used anywhere in the other configuration
|
||||||
|
files.</p>
|
||||||
|
|
||||||
|
<h2><a name="MAC"></a>Using MAC Addresses</h2>
|
||||||
|
|
||||||
|
<p>Media Access Control (MAC) addresses can be used to specify packet
|
||||||
|
source in several of the configuration files. To use this feature,
|
||||||
|
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||||
|
included.</p>
|
||||||
|
|
||||||
|
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
||||||
|
unique MAC address.<br>
|
||||||
|
<br>
|
||||||
|
In GNU/Linux, MAC addresses are usually written as a
|
||||||
|
series of 6 hex numbers separated by colons. Example:<br>
|
||||||
|
<br>
|
||||||
|
[root@gateway root]# ifconfig eth0<br>
|
||||||
|
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||||
|
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||||
|
Mask:255.255.255.0<br>
|
||||||
|
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||||
|
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||||
|
frame:0<br>
|
||||||
|
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||||
|
carrier:0<br>
|
||||||
|
collisions:30394 txqueuelen:100<br>
|
||||||
|
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||||
|
(1582.8 Mb)<br>
|
||||||
|
Interrupt:11 Base address:0x1800<br>
|
||||||
|
<br>
|
||||||
|
Because Shorewall uses colons as a separator for address
|
||||||
|
fields, Shorewall requires MAC addresses to be written in another
|
||||||
|
way. In Shorewall, MAC addresses begin with a tilde ("~") and consist
|
||||||
|
of 6 hex numbers separated by hyphens. In Shorewall, the MAC address
|
||||||
|
in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
||||||
|
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<h2><a name="Levels"></a>Shorewall Configurations</h2>
|
||||||
|
|
||||||
|
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
||||||
|
The <a href="starting_and_stopping_shorewall.htm">shorewall start
|
||||||
|
and restart</a> commands allow you to specify an alternate configuration
|
||||||
|
directory and Shorewall will use the files in the alternate directory
|
||||||
|
rather than the corresponding files in /etc/shorewall. The alternate
|
||||||
|
directory need not contain a complete configuration; those files not
|
||||||
|
in the alternate directory will be read from /etc/shorewall.</p>
|
||||||
|
|
||||||
|
<p> This facility permits you to easily create a test or temporary configuration
|
||||||
|
by:</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li> copying the files that need modification from
|
<li> copying the files that need modification from
|
||||||
/etc/shorewall to a separate directory;</li>
|
/etc/shorewall to a separate directory;</li>
|
||||||
<li> modify those files in the separate directory;
|
<li> modify those files in the separate directory;
|
||||||
and</li>
|
and</li>
|
||||||
<li> specifying the separate directory in a shorewall
|
<li> specifying the separate directory in a shorewall
|
||||||
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
||||||
restart</b></i> ).</li>
|
restart</b></i> ).</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font size="2"> Updated 12/20/2002 - <a href="support.htm">Tom Eastep</a>
|
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||||
</font></p>
|
</font></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@ -1,76 +1,79 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>GNU Mailman</title>
|
<title>GNU Mailman</title>
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
<h1 align="center"><font color="#ffffff">GNU Mailman/Postfix the Easy
|
<h1 align="center"><font color="#ffffff">GNU Mailman/Postfix the Easy
|
||||||
Way</font></h1>
|
Way</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<h1 align="center"> </h1>
|
<h1 align="center"> </h1>
|
||||||
|
|
||||||
<h4>The following was posted on the Postfix mailing list on 5/4/2002 by Michael
|
<h4>The following was posted on the Postfix mailing list on 5/4/2002 by Michael
|
||||||
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
||||||
|
|
||||||
<p>Q: Mailman does not work with Postfix, complaining about GID mismatch<br>
|
<p>Q: Mailman does not work with Postfix, complaining about GID mismatch<br>
|
||||||
<br>
|
<br>
|
||||||
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
||||||
aliases file so that rest of mailman's mail handling processes will run
|
aliases file so that rest of mailman's mail handling processes will run
|
||||||
with proper uid/gid. Postfix has an ability to run a command specified in
|
with proper uid/gid. Postfix has an ability to run a command specified in
|
||||||
an alias as owner of that alias, thus mailman's wrapper is not needed here.
|
an alias as owner of that alias, thus mailman's wrapper is not needed here.
|
||||||
The best method to invoke mailman's mail handling via aliases is to use
|
The best method to invoke mailman's mail handling via aliases is to use
|
||||||
separate alias file especially for mailman, and made it owned by mailman
|
separate alias file especially for mailman, and made it owned by mailman
|
||||||
and group mailman. Like:<br>
|
and group mailman. Like:<br>
|
||||||
<br>
|
<br>
|
||||||
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
||||||
<br>
|
<br>
|
||||||
Make sure that /var/mailman/aliases.db is owned by mailman user (this may
|
Make sure that /var/mailman/aliases.db is owned by mailman user (this
|
||||||
be done by executing postalias as mailman userid).<br>
|
may be done by executing postalias as mailman userid).<br>
|
||||||
<br>
|
<br>
|
||||||
Next, instead of using mailman-suggested aliases entries with wrapper, use
|
Next, instead of using mailman-suggested aliases entries with wrapper,
|
||||||
the following:<br>
|
use the following:<br>
|
||||||
<br>
|
<br>
|
||||||
instead of<br>
|
instead of<br>
|
||||||
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
||||||
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
||||||
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
||||||
...<br>
|
...<br>
|
||||||
<br>
|
<br>
|
||||||
use<br>
|
use<br>
|
||||||
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
||||||
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
||||||
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
||||||
...</p>
|
...</p>
|
||||||
|
|
||||||
<h4>The Shorewall mailing lists are currently running Postfix 1.1.11 together
|
<h4>The above tip works with Mailman 2.0; Mailman 2.1 has adopted something
|
||||||
with the stock RedHat Mailman-2.0.13 RPM configured as shown above.</h4>
|
very similar so that no workaround is necessary. See the README.POSTFIX file
|
||||||
|
included with Mailman-2.1. </h4>
|
||||||
<p align="left"><font size="2">Last updated 9/14/2002 - <a
|
|
||||||
|
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -1,124 +1,127 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Shorewall Mailing Lists</title>
|
<title>Shorewall Mailing Lists</title>
|
||||||
|
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||||
border="0">
|
border="0">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><a
|
<h1 align="center"><a
|
||||||
href="http://www.centralcommand.com/linux_products.html"><img
|
href="http://www.centralcommand.com/linux_products.html"><img
|
||||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||||
height="79" align="left">
|
height="79" align="left">
|
||||||
</a><a href="http://www.gnu.org/software/mailman/mailman.html">
|
</a><a
|
||||||
<img border="0" src="images/logo-sm.jpg" align="left" hspace="5"
|
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||||
width="110" height="35">
|
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||||
</a><a href="http://www.postfix.org/"> <img
|
height="35">
|
||||||
|
</a><a href="http://www.postfix.org/"> <img
|
||||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
src="images/small-picture.gif" align="right" border="0" width="115"
|
||||||
height="45">
|
height="45">
|
||||||
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
||||||
href="http://www.inter7.com/courierimap/"><img
|
href="http://www.inter7.com/courierimap/"><img
|
||||||
src="images/courier-imap.png" alt="Courier-Imap" width="100"
|
src="images/courier-imap.png" alt="Courier-Imap" width="100"
|
||||||
height="38" align="right">
|
height="38" align="right">
|
||||||
</a></font></h1>
|
</a></font></h1>
|
||||||
|
|
||||||
|
|
||||||
<p align="right"><font color="#ffffff"><b><br>
|
<p align="right"><font color="#ffffff"><b><br>
|
||||||
</b></font></p>
|
</b></font></p>
|
||||||
|
|
||||||
<p align="right"><font color="#ffffff"><b><br>
|
<p align="right"><font color="#ffffff"><b><br>
|
||||||
Powered by Postfix </b></font> </p>
|
Powered by Postfix </b></font> </p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.</p>
|
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.</p>
|
||||||
|
|
||||||
<h2 align="left">Not getting List Mail? -- <a
|
<h2 align="left">Not getting List Mail? -- <a
|
||||||
href="mailing_list_problems.htm">Check Here</a></h2>
|
href="mailing_list_problems.htm">Check Here</a></h2>
|
||||||
|
|
||||||
<p align="left">If you experience problems with any of these lists, please
|
<p align="left">If you experience problems with any of these lists, please
|
||||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||||
|
|
||||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||||
|
|
||||||
<p align="left">You can report such problems by sending mail to tom dot eastep
|
<p align="left">You can report such problems by sending mail to tom dot eastep
|
||||||
at hp dot com.</p>
|
at hp dot com.</p>
|
||||||
|
|
||||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"> <img border="0"
|
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
||||||
src="images/but3.png" hspace="3" width="88" height="31">
|
href="http://osirusoft.com/"> </a></h2>
|
||||||
</a><a href="http://osirusoft.com/"> </a></h2>
|
|
||||||
|
|
||||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
||||||
about list traffic that bounces.</a> Also please note that the mail server
|
about list traffic that bounces.</a> Also please note that the mail server
|
||||||
at shorewall.net checks incoming mail:<br>
|
at shorewall.net checks incoming mail:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>against the open relay databases at <a
|
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||||
href="http://ordb.org">ordb.org.</a></li>
|
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||||
<li>to ensure that the sender address is fully qualified.</li>
|
</li>
|
||||||
<li>to verify that the sender's domain has an A or MX record in DNS.</li>
|
<li>to ensure that the sender address is fully qualified.</li>
|
||||||
<li>to ensure that the host name in the HELO/EHLO command is a valid
|
<li>to verify that the sender's domain has an A or MX record in
|
||||||
fully-qualified DNS name.</li>
|
DNS.</li>
|
||||||
|
<li>to ensure that the host name in the HELO/EHLO command is a
|
||||||
|
valid fully-qualified DNS name that resolves.</li>
|
||||||
|
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<h2>Please post in plain text</h2>
|
<h2>Please post in plain text</h2>
|
||||||
While the list server here at shorewall.net accepts and distributes HTML
|
A growing number of MTAs serving list subscribers are rejecting all HTML
|
||||||
posts, a growing number of MTAs serving list subscribers are rejecting this
|
traffic. At least one MTA has gone so far as to blacklist shorewall.net "for
|
||||||
HTML list traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
continuous abuse" because it has been my policy to allow HTML in list posts!!<br>
|
||||||
"for continuous abuse"!!<br>
|
<br>
|
||||||
<br>
|
I think that blocking all HTML is a Draconian way to control spam and
|
||||||
I think that blocking all HTML is a rather draconian way to control spam
|
that the ultimate losers here are not the spammers but the list subscribers
|
||||||
and that the unltimate loser here is not the spammers but the list subscribers
|
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you
|
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||||
can help by restricting your list posts to plain text.<br>
|
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||||
<br>
|
to allow subscribers to receive list posts as must as possible, I have now
|
||||||
And as a bonus, subscribers who use email clients like pine and mutt will
|
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||||
be able to read your plain text posts whereas they are most likely simply
|
posts.<br>
|
||||||
ignoring your HTML posts.<br>
|
<h2>Other Mail Delivery Problems</h2>
|
||||||
<br>
|
If you find that you are missing an occasional list post, your e-mail admin
|
||||||
A final bonus for the use of HTML is that it cuts down the size of messages
|
may be blocking mail whose <i>Received:</i> headers contain the names of
|
||||||
by a large percentage -- that is important when the same message must be
|
certain ISPs. Again, I believe that such policies hurt more than they help
|
||||||
sent 500 times over the slow DSL line connecting the list server to the internet.<br>
|
but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
||||||
|
headers to circumvent those policies.<br>
|
||||||
<h2></h2>
|
|
||||||
|
|
||||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||||
|
|
||||||
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
|
||||||
|
|
||||||
<p> <font size="-1"> Match:
|
<form method="post" action="http://mail.shorewall.net/cgi-bin/htsearch">
|
||||||
|
|
||||||
|
<p> <font size="-1"> Match:
|
||||||
<select name="method">
|
<select name="method">
|
||||||
<option value="and">All </option>
|
<option value="and">All </option>
|
||||||
<option value="or">Any </option>
|
<option value="or">Any </option>
|
||||||
<option value="boolean">Boolean </option>
|
<option value="boolean">Boolean </option>
|
||||||
</select>
|
</select>
|
||||||
Format:
|
Format:
|
||||||
<select name="format">
|
<select name="format">
|
||||||
<option value="builtin-long">Long </option>
|
<option value="builtin-long">Long </option>
|
||||||
<option value="builtin-short">Short </option>
|
<option value="builtin-short">Short </option>
|
||||||
</select>
|
</select>
|
||||||
Sort by:
|
Sort by:
|
||||||
<select name="sort">
|
<select name="sort">
|
||||||
<option value="score">Score </option>
|
<option value="score">Score </option>
|
||||||
<option value="time">Time </option>
|
<option value="time">Time </option>
|
||||||
@ -127,120 +130,127 @@ sent 500 times over the slow DSL line connecting the list server to the internet
|
|||||||
<option value="revtime">Reverse Time </option>
|
<option value="revtime">Reverse Time </option>
|
||||||
<option value="revtitle">Reverse Title </option>
|
<option value="revtitle">Reverse Title </option>
|
||||||
</select>
|
</select>
|
||||||
</font> <input type="hidden" name="config" value="htdig"> <input
|
</font> <input type="hidden" name="config" value="htdig"> <input
|
||||||
type="hidden" name="restrict"
|
type="hidden" name="restrict"
|
||||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
value="[http://mail.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||||
name="exclude" value=""> <br>
|
name="exclude" value=""> <br>
|
||||||
Search: <input type="text" size="30" name="words" value=""> <input
|
Search: <input type="text" size="30" name="words" value=""> <input
|
||||||
type="submit" value="Search"> </p>
|
type="submit" value="Search"> </p>
|
||||||
</form>
|
</form>
|
||||||
|
|
||||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||||
Archive -- its 75MB (and growing daily) and my slow DSL line simply won't
|
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||||
stand the traffic. If I catch you, you'll be blacklisted.<br>
|
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||||
</font></h2>
|
</font></h2>
|
||||||
|
|
||||||
<h2 align="left">Shorewall CA Certificate</h2>
|
<h2 align="left">Shorewall CA Certificate</h2>
|
||||||
If you want to trust X.509 certificates issued by Shoreline Firewall
|
If you want to trust X.509 certificates issued by Shoreline Firewall
|
||||||
(such as the one used on my web site), you may <a
|
(such as the one used on my web site), you may <a
|
||||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||||
in your browser. If you don't wish to trust my certificates then you
|
in your browser. If you don't wish to trust my certificates then you
|
||||||
can either use unencrypted access when subscribing to Shorewall mailing
|
can either use unencrypted access when subscribing to Shorewall mailing
|
||||||
lists or you can use secure access (SSL) and accept the server's certificate
|
lists or you can use secure access (SSL) and accept the server's certificate
|
||||||
when prompted by your browser.<br>
|
when prompted by your browser.<br>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||||
to get answers to questions and to report problems. Information of general
|
to get answers to questions and to report problems. Information of
|
||||||
interest to the Shorewall user community is also posted to this list.</p>
|
general interest to the Shorewall user community is also posted to
|
||||||
|
this list.</p>
|
||||||
|
|
||||||
<p align="left"><b>Before posting a problem report to this list, please see
|
<p align="left"><b>Before posting a problem report to this list, please see
|
||||||
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
||||||
|
|
||||||
<p align="left">To subscribe to the mailing list, go to <a
|
<p align="left">To subscribe to the mailing list, go to <a
|
||||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||||
SSL: <a
|
SSL: <a
|
||||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-users"
|
href="https://mail.shorewall.net/mailman/listinfo/shorewall-users"
|
||||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
||||||
|
|
||||||
<p align="left">To post to the list, post to <a
|
<p align="left">To post to the list, post to <a
|
||||||
href="mailto:shorewall-users@shorewall.net">shorewall-users@shorewall.net</a>.</p>
|
href="mailto:shorewall-users@shorewall.net">shorewall-users@shorewall.net</a>.</p>
|
||||||
|
|
||||||
<p align="left">The list archives are at <a
|
<p align="left">The list archives are at <a
|
||||||
href="http://www.shorewall.net/pipermail/shorewall-users/index.html">http://www.shorewall.net/pipermail/shorewall-users</a>.</p>
|
href="http://mail.shorewall.net/pipermail/shorewall-users/index.html">http://mail.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||||
|
|
||||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||||
list may be found at <a
|
list may be found at <a
|
||||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">This list is for announcements of general interest to the
|
<p align="left">This list is for announcements of general interest to the
|
||||||
Shorewall community. To subscribe, go to <a
|
Shorewall community. To subscribe, go to <a
|
||||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-announce">http://www.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
href="http://mail.shorewall.net/mailman/listinfo/shorewall-announce">http://mail.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
||||||
SSL: <a
|
SSL: <a
|
||||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-announce"
|
href="https://mail.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
||||||
</a><br>
|
</a><br>
|
||||||
The list archives are at <a
|
The list archives are at <a
|
||||||
href="http://www.shorewall.net/pipermail/shorewall-announce">http://www.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
href="http://mail.shorewall.net/pipermail/shorewall-announce">http://mail.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||||
|
|
||||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||||
|
|
||||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||||
the exchange of ideas about the future of Shorewall and for coordinating
|
the exchange of ideas about the future of Shorewall and for coordinating
|
||||||
ongoing Shorewall Development.</p>
|
ongoing Shorewall Development.</p>
|
||||||
|
|
||||||
<p align="left">To subscribe to the mailing list, go to <a
|
<p align="left">To subscribe to the mailing list, go to <a
|
||||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-devel">http://www.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
href="http://mail.shorewall.net/mailman/listinfo/shorewall-devel">http://mail.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
||||||
SSL: <a
|
SSL: <a
|
||||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-devel"
|
href="https://mail.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
||||||
To post to the list, post to <a
|
To post to the list, post to <a
|
||||||
href="mailto:shorewall-devel@shorewall.net">shorewall-devel@shorewall.net</a>. </p>
|
href="mailto:shorewall-devel@shorewall.net">shorewall-devel@shorewall.net</a>. </p>
|
||||||
|
|
||||||
<p align="left">The list archives are at <a
|
<p align="left">The list archives are at <a
|
||||||
href="http://www.shorewall.net/pipermail/shorewall-devel">http://www.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
href="http://mail.shorewall.net/pipermail/shorewall-devel">http://mail.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||||
|
|
||||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||||
the Mailing Lists</h2>
|
the Mailing Lists</h2>
|
||||||
|
|
||||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||||
from Mailman-managed lists. To unsubscribe:</p>
|
from Mailman-managed lists although Mailman 2.1 has attempted to make
|
||||||
|
this less confusing. To unsubscribe:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
|
|
||||||
<p align="left">Follow the same link above that you used to subscribe
|
<p align="left">Follow the same link above that you used to subscribe
|
||||||
to the list.</p>
|
to the list.</p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
|
|
||||||
<p align="left">Down at the bottom of that page is the following text:
|
<p align="left">Down at the bottom of that page is the following text:
|
||||||
"To change your subscription (set options like digest and delivery
|
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
||||||
modes, get a reminder of your password, <b>or unsubscribe</b> from
|
reminder, or change your subscription options enter your subscription
|
||||||
<name of list>), enter your subscription email address:". Enter
|
email address:". Enter your email address in the box and click
|
||||||
your email address in the box and click on the "Edit Options" button.</p>
|
on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||||
</li>
|
</li>
|
||||||
<li>
|
<li>
|
||||||
|
|
||||||
<p align="left">There will now be a box where you can enter your password
|
<p align="left">There will now be a box where you can enter your password
|
||||||
and click on "Unsubscribe"; if you have forgotten your password, there
|
and click on "Unsubscribe"; if you have forgotten your password, there
|
||||||
is another button that will cause your password to be emailed to you.</p>
|
is another button that will cause your password to be emailed to you.</p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<hr>
|
<hr>
|
||||||
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
||||||
|
|
||||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||||
|
|
||||||
<p align="left"><font size="2">Last updated 12/27/2002 - <a
|
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||||
href="support.htm">Tom Eastep</a></font></p>
|
href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
|
<br>
|
||||||
|
<br>
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -213,7 +213,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
|||||||
than the LOG target. This allows you to run ulogd (available from <a
|
than the LOG target. This allows you to run ulogd (available from <a
|
||||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||||
@ -269,7 +269,7 @@ refresh" would also fail.<br>
|
|||||||
rather than the LOG target. This allows you to run ulogd (available from
|
rather than the LOG target. This allows you to run ulogd (available from
|
||||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in
|
<li>If you are running a kernel that has a FORWARD chain in
|
||||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||||
|
|||||||
137
Shorewall-docs/shorewall_logging.html
Normal file
137
Shorewall-docs/shorewall_logging.html
Normal file
@ -0,0 +1,137 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Shorewall Logging</title>
|
||||||
|
<meta http-equiv="content-type"
|
||||||
|
content="text/html; charset=ISO-8859-1">
|
||||||
|
<meta name="author" content="Tom Eastep">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||||
|
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td width="100%">
|
||||||
|
|
||||||
|
<h1 align="center"><font color="#ffffff">Logging</font></h1>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br>
|
||||||
|
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
||||||
|
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
||||||
|
the notation <i>facility.priority</i>). <br>
|
||||||
|
<br>
|
||||||
|
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
||||||
|
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
||||||
|
<i>local7</i>.<br>
|
||||||
|
<br>
|
||||||
|
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
||||||
|
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
||||||
|
The syslog documentation uses the term <i>priority</i>.<br>
|
||||||
|
|
||||||
|
<h3>Syslog Levels<br>
|
||||||
|
</h3>
|
||||||
|
Syslog levels are a method of describing to syslog (8) the importance
|
||||||
|
of a message and a number of Shorewall parameters have a syslog level as
|
||||||
|
their value.<br>
|
||||||
|
<br>
|
||||||
|
Valid levels are:<br>
|
||||||
|
<br>
|
||||||
|
7
|
||||||
|
debug<br>
|
||||||
|
6
|
||||||
|
info<br>
|
||||||
|
5
|
||||||
|
notice<br>
|
||||||
|
4
|
||||||
|
warning<br>
|
||||||
|
3
|
||||||
|
err<br>
|
||||||
|
2
|
||||||
|
crit<br>
|
||||||
|
1
|
||||||
|
alert<br>
|
||||||
|
0
|
||||||
|
emerg<br>
|
||||||
|
<br>
|
||||||
|
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
||||||
|
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
||||||
|
facility and the level that you specify. If you are unsure of the level
|
||||||
|
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
||||||
|
number.<br>
|
||||||
|
<br>
|
||||||
|
Syslogd writes log messages to files (typically in /var/log/*) based
|
||||||
|
on their facility and level. The mapping of these facility/level pairs
|
||||||
|
to log files is done in /etc/syslog.conf (5). If you make changes to this
|
||||||
|
file, you must restart syslogd before the changes can take effect.<br>
|
||||||
|
|
||||||
|
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
||||||
|
There are a couple of limitations to syslogd-based logging:<br>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>If you give, for example, kern.info it's own log destination then
|
||||||
|
that destination will also receive all kernel messages of levels 5 (notice)
|
||||||
|
through 0 (emerg).</li>
|
||||||
|
<li>All kernel.info messages will go to that destination and not just
|
||||||
|
those from NetFilter.<br>
|
||||||
|
</li>
|
||||||
|
</ol>
|
||||||
|
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
||||||
|
support (and most vendor-supplied kernels do), you may also specify a log
|
||||||
|
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
||||||
|
netfilter to log the related messages via the ULOG target which will send
|
||||||
|
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
||||||
|
and can be configured to log all Shorewall message to their own log file.<br>
|
||||||
|
<br>
|
||||||
|
Download the ulod tar file and:<br>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
||||||
|
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
||||||
|
<li>cd ulogd-<i>version</i><br>
|
||||||
|
</li>
|
||||||
|
<li>./configure</li>
|
||||||
|
<li>make</li>
|
||||||
|
<li>make install<br>
|
||||||
|
</li>
|
||||||
|
</ol>
|
||||||
|
If you are like me and don't have a development environment on your firewall,
|
||||||
|
you can do the first five steps on another system then either NFS mount
|
||||||
|
your /usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
||||||
|
directory and move it to your firewall system.<br>
|
||||||
|
<br>
|
||||||
|
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
||||||
|
|
||||||
|
<ol>
|
||||||
|
<li>syslogfile <i><file that you wish to log to></i></li>
|
||||||
|
<li>syslogsync 1</li>
|
||||||
|
</ol>
|
||||||
|
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
||||||
|
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
||||||
|
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
||||||
|
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
||||||
|
something else done to activate the script.<br>
|
||||||
|
<br>
|
||||||
|
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file
|
||||||
|
that you wish to log to></i>. This tells the /sbin/shorewall program
|
||||||
|
where to look for the log when processing its "show log", "logwatch" and
|
||||||
|
"monitor" commands.<br>
|
||||||
|
|
||||||
|
<p><font size="2"> Updated 12/29/2002 - <a
|
||||||
|
href="file:///home/teastep/Shorewall-docs/support.htm">Tom Eastep</a>
|
||||||
|
</font></p>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||||
|
© <font size="2">2001, 2002 Thomas M. Eastep</font></a></font><br>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<h2><br>
|
||||||
|
</h2>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -1,269 +1,274 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
<title>Shorewall QuickStart Guide</title>
|
<title>Shorewall QuickStart Guide</title>
|
||||||
|
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides<br>
|
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides<br>
|
||||||
Version 3.1</font></h1>
|
Version 3.1</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p align="center">With thanks to Richard who reminded me once again that
|
<p align="center">With thanks to Richard who reminded me once again that we
|
||||||
we must all first walk before we can run.</p>
|
must all first walk before we can run.</p>
|
||||||
|
|
||||||
<h2>The Guides</h2>
|
<h2>The Guides</h2>
|
||||||
|
|
||||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||||
in common firewall setups.</p>
|
in common firewall setups.</p>
|
||||||
|
|
||||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
||||||
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
||||||
acting as a firewall/router for a small local network</li>
|
acting as a firewall/router for a small local network</li>
|
||||||
<li><a href="three-interface.htm">Three-interface</a> Linux
|
<li><a href="three-interface.htm">Three-interface</a> Linux
|
||||||
System acting as a firewall/router for a small local network and
|
System acting as a firewall/router for a small local network and a
|
||||||
a DMZ.</li>
|
DMZ.</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>The above guides are designed to get your first firewall up and running
|
<p>The above guides are designed to get your first firewall up and running
|
||||||
quickly in the three most common Shorewall configurations.</p>
|
quickly in the three most common Shorewall configurations.</p>
|
||||||
|
|
||||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> outlines
|
||||||
the steps necessary to set up a firewall where <b>there are multiple
|
the steps necessary to set up a firewall where <b>there are multiple
|
||||||
public IP addresses involved or if you want to learn more about Shorewall
|
public IP addresses involved or if you want to learn more about Shorewall
|
||||||
than is explained in the single-address guides above.</b></p>
|
than is explained in the single-address guides above.</b></p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
<li><a href="shorewall_setup_guide.htm#Introduction">1.0
|
||||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
Introduction</a></li>
|
||||||
Concepts</a></li>
|
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
Concepts</a></li>
|
||||||
Interfaces</a></li>
|
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
Interfaces</a></li>
|
||||||
Subnets and Routing</a>
|
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||||
|
Subnets and Routing</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||||
Addresses</a></li>
|
Addresses</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||||
Resolution Protocol</a></li>
|
Resolution Protocol</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||||
1918</a></li>
|
1918</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||||
up your Network</a>
|
up your Network</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||||
Proxy ARP</a></li>
|
Proxy ARP</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||||
NAT</a></li>
|
NAT</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
||||||
Odds and Ends</a></li>
|
Odds and Ends</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||||
<li><a
|
<li><a
|
||||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||||
Stopping the Firewall</a></li>
|
Stopping the Firewall</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2><a name="Documentation"></a>Documentation Index</h2>
|
<h2><a name="Documentation"></a>Documentation Index</h2>
|
||||||
|
|
||||||
<p>The following documentation covers a variety of topics and <b>supplements
|
<p>The following documentation covers a variety of topics and <b>supplements
|
||||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||||
described above</b>. Please review the appropriate guide before trying
|
described above</b>. Please review the appropriate guide before trying
|
||||||
to use this documentation directly.</p>
|
to use this documentation directly.</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="configuration_file_basics.htm">Common configuration
|
<li><a href="configuration_file_basics.htm">Common configuration
|
||||||
file features</a>
|
file features</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Comments in configuration files</li>
|
<li><a href="configuration_file_basics.htm#Comments">Comments
|
||||||
<li>Line Continuation</li>
|
in configuration files</a></li>
|
||||||
<li>Port Numbers/Service Names</li>
|
<li><a
|
||||||
<li>Port Ranges</li>
|
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||||
<li>Using Shell Variables</li>
|
<li><a href="configuration_file_basics.htm#Ports">Port
|
||||||
<li>Using DNS Names<br>
|
Numbers/Service Names</a></li>
|
||||||
</li>
|
<li><a href="configuration_file_basics.htm#Ranges">Port
|
||||||
<li>Complementing an IP address or Subnet</li>
|
Ranges</a></li>
|
||||||
<li>Shorewall Configurations (making a test configuration)</li>
|
<li><a href="configuration_file_basics.htm#Variables">Using
|
||||||
<li>Using MAC Addresses in Shorewall</li>
|
Shell Variables</a></li>
|
||||||
<li>Logging<br>
|
<li><a href="configuration_file_basics.htm#dnsnames">Using
|
||||||
</li>
|
DNS Names</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="configuration_file_basics.htm#Compliment">Complementing
|
||||||
|
an IP address or Subnet</a></li>
|
||||||
|
<li><a href="configuration_file_basics.htm#Configs">Shorewall
|
||||||
|
Configurations (making a test configuration)</a></li>
|
||||||
|
<li><a href="configuration_file_basics.htm#MAC">Using MAC
|
||||||
|
Addresses in Shorewall</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="Documentation.htm">Configuration File Reference
|
<li><a href="Documentation.htm">Configuration File Reference
|
||||||
Manual</a>
|
Manual</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Zones">zones</a></font></li>
|
href="Documentation.htm#Zones">zones</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Policy">policy</a></font></li>
|
href="Documentation.htm#Policy">policy</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Rules">rules</a></font></li>
|
href="Documentation.htm#Rules">rules</a></font></li>
|
||||||
<li><a href="Documentation.htm#Common">common</a></li>
|
<li><a href="Documentation.htm#Common">common</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Masq">masq</a></font></li>
|
href="Documentation.htm#Masq">masq</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#NAT">nat</a></font></li>
|
href="Documentation.htm#NAT">nat</a></font></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="dhcp.htm">DHCP</a></li>
|
<li><a href="dhcp.htm">DHCP</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font> (How
|
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||||
to extend Shorewall without modifying Shorewall code)</li>
|
(How to extend Shorewall without modifying Shorewall code)</li>
|
||||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||||
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||||
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
||||||
<li><a href="configuration_file_basics.htm#Levels">Logging</a><br>
|
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||||
</li>
|
|
||||||
<li><a href="myfiles.htm">My Configuration Files</a> (How
|
|
||||||
I personally use Shorewall)</li>
|
|
||||||
<li><a href="ping.html">'Ping' Management</a><br>
|
|
||||||
</li>
|
</li>
|
||||||
<li><a href="ports.htm">Port Information</a>
|
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="myfiles.htm">My Configuration Files</a> (How I personally
|
||||||
|
use Shorewall)</li>
|
||||||
|
<li><a href="ping.html">'Ping' Management</a><br>
|
||||||
|
</li>
|
||||||
|
<li><a href="ports.htm">Port Information</a>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Which applications use which ports</li>
|
<li>Which applications use which ports</li>
|
||||||
<li>Ports used by Trojans</li>
|
<li>Ports used by Trojans</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||||
<li><a href="samba.htm">Samba</a></li>
|
<li><a href="samba.htm">Samba</a></li>
|
||||||
<li><font color="#000099"><a
|
<li><font color="#000099"><a
|
||||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>Description of all /sbin/shorewall commands</li>
|
<li>Description of all /sbin/shorewall commands</li>
|
||||||
<li>How to safely test a Shorewall configuration change<br>
|
<li>How to safely test a Shorewall configuration change<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||||
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
||||||
<li>VPN
|
<li>VPN
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||||
<li><a href="PPTP.htm">PPTP</a></li>
|
<li><a href="PPTP.htm">PPTP</a></li>
|
||||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
||||||
your firewall to a remote network.</li>
|
your firewall to a remote network.</li>
|
||||||
|
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
<li><a href="whitelisting_under_shorewall.htm">White List
|
<li><a href="whitelisting_under_shorewall.htm">White List
|
||||||
Creation</a></li>
|
Creation</a></li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||||
|
|
||||||
<p><font size="2">Last modified 12/13/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
<p><font size="2">Last modified 12/29/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||||
|
|
||||||
<p><a href="copyright.htm"><font size="2">Copyright 2002 Thomas M. Eastep</font></a><br>
|
<p><a href="copyright.htm"><font size="2">Copyright 2002 Thomas M. Eastep</font></a><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@ -239,7 +239,7 @@ the request is first checked against the rules in /etc/shorewall/common.def.</
|
|||||||
<li>allow all connection requests from your local network to the internet</li>
|
<li>allow all connection requests from your local network to the internet</li>
|
||||||
<li>drop (ignore) all connection requests from the internet to your
|
<li>drop (ignore) all connection requests from the internet to your
|
||||||
firewall or local network and log a message at the <i>info</i> level
|
firewall or local network and log a message at the <i>info</i> level
|
||||||
(<a href="configuration_file_basics.htm#Levels">here</a> is a description
|
(<a href="shorewall_logging.html">here</a> is a description
|
||||||
of log levels).</li>
|
of log levels).</li>
|
||||||
<li>reject all other connection requests and log a message at the <i>info</i>
|
<li>reject all other connection requests and log a message at the <i>info</i>
|
||||||
level. When a request is rejected, the firewall will return an RST (if
|
level. When a request is rejected, the firewall will return an RST (if
|
||||||
|
|||||||
@ -200,7 +200,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
|||||||
than the LOG target. This allows you to run ulogd (available from <a
|
than the LOG target. This allows you to run ulogd (available from <a
|
||||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in the
|
<li>If you are running a kernel that has a FORWARD chain in the
|
||||||
mangle table ("shorewall show mangle" will show you the chains in the
|
mangle table ("shorewall show mangle" will show you the chains in the
|
||||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||||
@ -257,7 +257,7 @@ to start and "shorewall refresh" would also fail.<br>
|
|||||||
rather than the LOG target. This allows you to run ulogd (available from
|
rather than the LOG target. This allows you to run ulogd (available from
|
||||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||||
and log all Shorewall messages <a
|
and log all Shorewall messages <a
|
||||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||||
<li>If you are running a kernel that has a FORWARD chain in
|
<li>If you are running a kernel that has a FORWARD chain in
|
||||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||||
|
|||||||
@ -2,121 +2,121 @@
|
|||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Language" content="en-us">
|
<meta http-equiv="Content-Language" content="en-us">
|
||||||
|
|
||||||
|
|
||||||
<meta http-equiv="Content-Type"
|
<meta http-equiv="Content-Type"
|
||||||
content="text/html; charset=windows-1252">
|
content="text/html; charset=windows-1252">
|
||||||
|
|
||||||
|
|
||||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||||
|
|
||||||
|
|
||||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||||
<title>Support</title>
|
<title>Support</title>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<meta name="Microsoft Theme" content="none">
|
<meta name="Microsoft Theme" content="none">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
|
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
<table border="0" cellpadding="0" cellspacing="0"
|
||||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||||
bgcolor="#400169" height="90">
|
bgcolor="#400169" height="90">
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="100%">
|
<td width="100%">
|
||||||
|
|
||||||
|
|
||||||
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
||||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||||
</font></h1>
|
</font></h1>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
|
||||||
|
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
<p> <br>
|
<p> <br>
|
||||||
<span style="font-weight: 400;"></span></p>
|
<span style="font-weight: 400;"></span></p>
|
||||||
|
|
||||||
<h2><big><font color="#ff0000"><b>I don't look at problems sent to me directly
|
<h2><big><font color="#ff0000"><b>I don't look at problems sent to me directly
|
||||||
but I try to spend some amount of time each day responding to problems
|
but I try to spend some amount of time each day responding to
|
||||||
posted on the Shorewall mailing list.</b></font></big></h2>
|
problems posted on the Shorewall mailing list.</b></font></big></h2>
|
||||||
|
|
||||||
<h2 align="center"><big><font color="#ff0000"><b>-Tom</b></font></big></h2>
|
<h2 align="center"><big><font color="#ff0000"><b>-Tom</b></font></big></h2>
|
||||||
|
|
||||||
<h2>Before Reporting a Problem</h2>
|
<h2>Before Reporting a Problem</h2>
|
||||||
|
|
||||||
<h3>T<b>here are a number of sources for problem solution information. Please
|
<h3>T<b>here are a number of sources for problem solution information. Please
|
||||||
try these before you post.</b></h3>
|
try these before you post.</b></h3>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>The <a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
<h3><b>The <a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
||||||
problems.</b></h3>
|
problems.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>The <a href="troubleshoot.htm">Troubleshooting</a> Information
|
<h3><b>The <a href="troubleshoot.htm">Troubleshooting</a> Information
|
||||||
contains a number of tips to help you solve common problems.</b></h3>
|
contains a number of tips to help you solve common problems.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>The <a href="errata.htm"> Errata</a> has links to download
|
<h3><b>The <a href="errata.htm"> Errata</a> has links to download
|
||||||
updated components.</b></h3>
|
updated components.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>The Mailing List Archives search facility can locate posts
|
<h3><b>The Mailing List Archives search facility can locate posts
|
||||||
about similar problems:</b></h3>
|
about similar problems:</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h2> </h2>
|
<h2> </h2>
|
||||||
|
|
||||||
<h2>Mailing List Archive Search</h2>
|
<h2>Mailing List Archive Search</h2>
|
||||||
|
|
||||||
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
||||||
|
|
||||||
<p> <font size="-1"> Match:
|
<p> <font size="-1"> Match:
|
||||||
|
|
||||||
<select name="method">
|
<select name="method">
|
||||||
<option value="and">All </option>
|
<option value="and">All </option>
|
||||||
<option value="or">Any </option>
|
<option value="or">Any </option>
|
||||||
<option value="boolean">Boolean </option>
|
<option value="boolean">Boolean </option>
|
||||||
</select>
|
</select>
|
||||||
Format:
|
Format:
|
||||||
|
|
||||||
<select name="format">
|
<select name="format">
|
||||||
<option value="builtin-long">Long </option>
|
<option value="builtin-long">Long </option>
|
||||||
<option value="builtin-short">Short </option>
|
<option value="builtin-short">Short </option>
|
||||||
</select>
|
</select>
|
||||||
Sort by:
|
Sort by:
|
||||||
|
|
||||||
<select name="sort">
|
<select name="sort">
|
||||||
<option value="score">Score </option>
|
<option value="score">Score </option>
|
||||||
<option value="time">Time </option>
|
<option value="time">Time </option>
|
||||||
@ -125,163 +125,166 @@
|
|||||||
<option value="revtime">Reverse Time </option>
|
<option value="revtime">Reverse Time </option>
|
||||||
<option value="revtitle">Reverse Title </option>
|
<option value="revtitle">Reverse Title </option>
|
||||||
</select>
|
</select>
|
||||||
</font> <input type="hidden" name="config"
|
</font> <input type="hidden" name="config"
|
||||||
value="htdig"> <input type="hidden" name="restrict"
|
value="htdig"> <input type="hidden" name="restrict"
|
||||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||||
name="exclude" value=""> <br>
|
name="exclude" value=""> <br>
|
||||||
Search: <input type="text" size="30" name="words"
|
Search: <input type="text" size="30" name="words"
|
||||||
value=""> <input type="submit" value="Search"> </p>
|
value=""> <input type="submit" value="Search"> </p>
|
||||||
</form>
|
</form>
|
||||||
|
|
||||||
<h2>Problem Reporting Guidelines</h2>
|
<h2>Problem Reporting Guidelines</h2>
|
||||||
<i>"Let me see if I can translate your message into a real-world example.
|
<i>"Let me see if I can translate your message into a real-world example.
|
||||||
It would be like saying that you have three rooms at home, and when you
|
It would be like saying that you have three rooms at home, and when you
|
||||||
walk into one of the rooms, you detect this strange smell. Can anyone tell
|
walk into one of the rooms, you detect this strange smell. Can anyone tell
|
||||||
you what that strange smell is?<br>
|
you what that strange smell is?<br>
|
||||||
<br>
|
<br>
|
||||||
Now, all of us could do some wonderful guessing as to the smell and even
|
Now, all of us could do some wonderful guessing as to the smell and even
|
||||||
what's causing it. You would be absolutely amazed at the range and variety
|
what's causing it. You would be absolutely amazed at the range and variety
|
||||||
of smells we could come up with. Even more amazing is that all of the explanations
|
of smells we could come up with. Even more amazing is that all of the
|
||||||
for the smells would be completely plausible."<br>
|
explanations for the smells would be completely plausible."<br>
|
||||||
</i><br>
|
</i><br>
|
||||||
|
|
||||||
<div align="center"> - Russell Mosemann<br>
|
<div align="center"> - Russell Mosemann<br>
|
||||||
</div>
|
</div>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>When reporting a problem, give as much information as you can.
|
<h3><b>When reporting a problem, give as much information as you can.
|
||||||
Reports that say "I tried XYZ and it didn't work" are not at all helpful.</b></h3>
|
Reports that say "I tried XYZ and it didn't work" are not at all helpful.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>Please don't describe your environment and then ask us to send
|
<h3><b>Please don't describe your environment and then ask us to send
|
||||||
you custom configuration files. We're here to answer your
|
you custom configuration files. We're here to answer your
|
||||||
questions but we can't do your job for you.</b></h3>
|
questions but we can't do your job for you.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>Do you see any "Shorewall" messages in /var/log/messages
|
<h3><b>Do you see any "Shorewall" messages in /var/log/messages
|
||||||
when you exercise the function that is giving you problems?</b></h3>
|
when you exercise the function that is giving you problems?</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>Have you looked at the packet flow with a tool like tcpdump
|
<h3><b>Have you looked at the packet flow with a tool like tcpdump
|
||||||
to try to understand what is going on?</b></h3>
|
to try to understand what is going on?</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>Have you tried using the diagnostic capabilities of the
|
<h3><b>Have you tried using the diagnostic capabilities of the
|
||||||
application that isn't working? For example, if "ssh" isn't able
|
application that isn't working? For example, if "ssh" isn't able
|
||||||
to connect, using the "-v" option gives you a lot of valuable diagnostic
|
to connect, using the "-v" option gives you a lot of valuable diagnostic
|
||||||
information.</b></h3>
|
information.</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>
|
<li>
|
||||||
<h3><b>Please include any of the Shorewall configuration files (especially
|
<h3><b>Please include any of the Shorewall configuration files (especially
|
||||||
the /etc/shorewall/hosts file if you have modified that file)
|
the /etc/shorewall/hosts file if you have modified that file)
|
||||||
that you think are relevant.</b></h3>
|
that you think are relevant.</b></h3>
|
||||||
</li>
|
|
||||||
<li>
|
|
||||||
<h3><b>If an error occurs when you try to "shorewall start", include
|
|
||||||
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
|
||||||
for instructions).</b></h3>
|
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
|
||||||
|
|
||||||
<h3> </h3>
|
|
||||||
|
|
||||||
<ul>
|
|
||||||
<li>
|
<li>
|
||||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
<h3><b>If an error occurs when you try to "shorewall start", include
|
||||||
your network layout, etc to the Mailing List -- your post
|
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
||||||
will be rejected.</b></h3>
|
for instructions).</b></h3>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
<h3> </h3>
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li>
|
||||||
|
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||||
|
your network layout, etc to the Mailing List -- your post
|
||||||
|
will be rejected.</b></h3>
|
||||||
|
</li>
|
||||||
|
|
||||||
|
</ul>
|
||||||
|
|
||||||
<h3> </h3>
|
<h3> </h3>
|
||||||
|
<br>
|
||||||
|
|
||||||
<h2>Please post in plain text</h2>
|
<h2>Please post in plain text</h2>
|
||||||
<blockquote>
|
|
||||||
<h3><b> While the list server here at shorewall.net accepts and distributes
|
<blockquote>
|
||||||
HTML posts, a growing number of MTAs serving list subscribers are rejecting
|
<h3> A growing number of MTAs serving list subscribers are rejecting all
|
||||||
this HTML list traffic. At least one MTA has gone so far as to blacklist
|
HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||||
shorewall.net "for continuous abuse"!!</b></h3>
|
"for continuous abuse" because it has been my policy to allow HTML in list
|
||||||
<h3><b> I think that blocking all HTML is a rather draconian way to control
|
posts!!<br>
|
||||||
spam and that the unltimate loser here is not the spammers but the list subscribers
|
<br>
|
||||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you can
|
I think that blocking all HTML is a Draconian way to control spam and
|
||||||
help by restricting your list posts to plain text.</b></h3>
|
that the ultimate losers here are not the spammers but the list subscribers
|
||||||
<h3><b> And as a bonus, subscribers who use email clients like pine and
|
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||||
mutt will be able to read your plain text posts whereas they are most likely
|
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||||
simply ignoring your HTML posts.</b></h3>
|
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||||
<h3><b> A final bonus for the use of HTML is that it cuts down the size
|
to allow subscribers to receive list posts as must as possible, I have now
|
||||||
of messages by a large percentage -- that is important when the same message
|
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||||
must be sent 500 times over the slow DSL line connecting the list server
|
posts.<br>
|
||||||
to the internet.</b> </h3>
|
</h3>
|
||||||
|
<h3></h3>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||||
|
|
||||||
<h3></h3>
|
<h3></h3>
|
||||||
|
|
||||||
<blockquote>
|
<blockquote>
|
||||||
<h4>If you run Shorewall under Bering -- <span
|
<h4>If you run Shorewall under Bering -- <span
|
||||||
style="font-weight: 400;">please post your question or problem
|
style="font-weight: 400;">please post your question or problem
|
||||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||||
list</a>.</span></h4>
|
list</a>.</span></h4>
|
||||||
|
<b>If you run Shorewall under MandrakeSoft Multi Network Firewall (MNF)
|
||||||
|
and you have not purchased an MNF license from MandrakeSoft then you can post
|
||||||
|
non MNF-specific Shorewall questions to the </b><a
|
||||||
|
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a>
|
||||||
|
<b>Do not expect to get free MNF support on the list.</b><br>
|
||||||
|
|
||||||
<p>Otherwise, please post your question or problem to the <a
|
<p>Otherwise, please post your question or problem to the <a
|
||||||
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a></p>
|
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a></p>
|
||||||
</blockquote>
|
</blockquote>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p align="center"><big><font color="#ff0000"><b></b></font></big></p>
|
<p align="center"><big><font color="#ff0000"><b></b></font></big></p>
|
||||||
|
|
||||||
|
|
||||||
<p>To Subscribe to the mailing list go to <a
|
<p>To Subscribe to the mailing list go to <a
|
||||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||||
.</p>
|
.</p>
|
||||||
|
|
||||||
|
|
||||||
<p align="left"><font size="2">Last Updated 12/27/2002 - Tom Eastep</font></p>
|
<p align="left"><font size="2">Last Updated 12/29/2002 - Tom Eastep</font></p>
|
||||||
|
|
||||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||||
</p>
|
</p>
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
|
||||||
<br>
|
<br>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user