extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 14:20:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

Updates to Documentation

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1533 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-08-11 00:18:47 +00:00
parent a193b7bbba
commit 291dc4df9d
5 changed files with 61 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Shorewall-docs2/Documentation.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-06-12</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -1657,14 +1657,23 @@ ACCEPT<emphasis role="bold">:info</emphasis> - - tc
addresses are specified in the ORIGINAL DEST column as a addresses are specified in the ORIGINAL DEST column as a
comma-separated list.</para> comma-separated list.</para>
<para>If this list begins with <quote>!</quote> then the rule will
only apply if the original destination address matches none of the
addresses listed.</para>
<para>The IP address(es) may be optionally followed by <para>The IP address(es) may be optionally followed by
<quote>:</quote> and a second IP address. This latter address, if <quote>:</quote> and a second IP address. This latter address, if
present, is used as the source address for packets forwarded to the present, is used as the source address for packets forwarded to the
server (This is called <quote>Source NAT</quote> or SNAT.</para> server (This is called <quote>Source NAT</quote> or SNAT.</para>
<para>If this list begins with <quote>!</quote> then the rule will <warning>
only apply if the original destination address matches none of the <para>Specifying SNAT in a DNAT rule is deprecated and this
addresses listed.</para> feature will be removed from Shorewall in version 2.1.0. An entry
in <link linkend="Masq">/etc/shorewall/masq</link> can serve the
same purpose and is the preferred method of performing SNAT with
Shorewall. See <ulink url="FAQ.htm#faq2">FAQ 2</ulink> for an
example.</para>
</warning>
<note> <note>
<para>When using SNAT, it is a good idea to qualify the source <para>When using SNAT, it is a good idea to qualify the source

16
Shorewall-docs2/FAQ.xml
View File

@ -17,7 +17,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-08-01</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -291,12 +291,18 @@ loc eth1 detect <emphasis role="bold">routeback</emphasis></p
</listitem> </listitem>
<listitem> <listitem>
<para>In <filename>/etc/shorewall/rules</filename> (Assuming that <para>In <filename>/etc/shorewall/masq</filename>:</para>
your local network is 192.168.1.0/24):</para>
<programlisting>#INTERFACE SUBNET ADDRESS PROTO PORT(S)
eth1 eth1 192.168.1.254 tcp www</programlisting>
</listitem>
<listitem>
<para>In <filename>/etc/shorewall/rules</filename>:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT SOURCE ORIGINAL <programlisting>#ACTION SOURCE DEST PROTO DEST PORT SOURCE ORIGINAL
# PORT DEST. # PORT DEST.
DNAT loc:192.168.1.0/24 loc:192.168.1.5 tcp www - 130.151.100.69:192.168.1.254</programlisting> DNAT loc loc:192.168.1.5 tcp www - 130.151.100.69</programlisting>
<para>That rule only works of course if you have a static external <para>That rule only works of course if you have a static external
IP address. If you have a dynamic IP address and are running IP address. If you have a dynamic IP address and are running
@ -308,7 +314,7 @@ DNAT loc:192.168.1.0/24 loc:192.168.1.5 tcp www -
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT SOURCE ORIGINAL <programlisting>#ACTION SOURCE DEST PROTO DEST PORT SOURCE ORIGINAL
# PORT DEST. # PORT DEST.
DNAT loc:192.168.1.0/24 loc:192.168.1.5 tcp www - $ETH0_IP:192.168.1.254</programlisting> DNAT loc loc:192.168.1.5 tcp www - $ETH0_IP</programlisting>
<para>Using this technique, you will want to configure your <para>Using this technique, you will want to configure your
DHCP/PPPoE client to automatically restart Shorewall each time that DHCP/PPPoE client to automatically restart Shorewall each time that

20
Shorewall-docs2/NAT.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-02-04</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -56,9 +56,13 @@
<para>One-to-one NAT can be used to make the systems with the 10.1.1.* <para>One-to-one NAT can be used to make the systems with the 10.1.1.*
addresses appear to be on the upper (130.252.100.*) subnet. If we assume addresses appear to be on the upper (130.252.100.*) subnet. If we assume
that the interface to the upper subnet is eth0, then the following that the interface to the upper subnet is eth0, then the following
/etc/shorewall/NAT file would make the lower left-hand system appear to <filename>/etc/shorewall/nat</filename> file would make the lower
have IP address 130.252.100.18 and the right-hand one to have IP address left-hand system appear to have IP address 130.252.100.18 and the
130.252.100.19.</para> right-hand one to have IP address 130.252.100.19. It should be stressed
that these entries in the <filename>/etc/shorewall/nat</filename> file do
not automatically enable traffic between the external network and the
internal host(s) — such traffic is still subject to your policies and
rules.</para>
<para><filename>/etc/shorewall/nat</filename><programlisting>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL <para><filename>/etc/shorewall/nat</filename><programlisting>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL
130.252.100.18 eth0 10.1.1.2 no no 130.252.100.18 eth0 10.1.1.2 no no
@ -66,7 +70,7 @@
<para>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the <para>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the
above example) is (are) not included in any specification in above example) is (are) not included in any specification in
/etc/shorewall/masq or /etc/shorewall/proxyarp.</para> <filename>/etc/shorewall/masq</filename> or <filename>/etc/shorewall/proxyarp</filename>.</para>
<note> <note>
<para>The <quote>ALL INTERFACES</quote> column is used to specify <para>The <quote>ALL INTERFACES</quote> column is used to specify
@ -86,9 +90,9 @@
<para>Shorewall will automatically add the external address to the <para>Shorewall will automatically add the external address to the
specified interface unless you specify <ulink specified interface unless you specify <ulink
url="Documentation.htm#Aliases">ADD_IP_ALIASES</ulink>=<quote>no</quote> url="Documentation.htm#Aliases">ADD_IP_ALIASES</ulink>=<quote>no</quote>
(or <quote>No</quote>) in /etc/shorewall/shorewall.conf; If you do not (or <quote>No</quote>) in <filename>/etc/shorewall/shorewall.conf</filename>;
set ADD_IP_ALIASES or if you set it to <quote>Yes</quote> or If you do not set ADD_IP_ALIASES or if you set it to <quote>Yes</quote>
<quote>yes</quote> then you must NOT configure your own alias(es).</para> or <quote>yes</quote> then you must NOT configure your own alias(es).</para>
<para><important><para>Shorewall versions earlier than 1.4.6 can only <para><important><para>Shorewall versions earlier than 1.4.6 can only
add external addresses to an interface that is configured with a single add external addresses to an interface that is configured with a single

12
Shorewall-docs2/ProxyARP.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-07-22</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -92,7 +92,8 @@
<para>Be sure that the internal systems (130.242.100.18 and 130.252.100.19 <para>Be sure that the internal systems (130.242.100.18 and 130.252.100.19
in the above example) are not included in any specification in in the above example) are not included in any specification in
<filename>/etc/shorewall/masq</filename> or <filename>/etc/shorewall/nat</filename>.</para> <filename>/etc/shorewall/masq</filename> or <filename>/etc/shorewall/nat</filename>.
</para>
<note> <note>
<para>I&#39;ve used an RFC1918 IP address for eth1 - that IP address is <para>I&#39;ve used an RFC1918 IP address for eth1 - that IP address is
@ -111,6 +112,13 @@
this example) of the firewall.</para> this example) of the firewall.</para>
</warning> </warning>
<note>
<para>It should be stressed that entries in the proxyarp file do not
automatically enable traffic between the external network and the
internal host(s) — such traffic is still subject to your policies and
rules.</para>
</note>
<para>While the address given to the firewall interface is largely <para>While the address given to the firewall interface is largely
irrelevant, one approach you can take is to make that address the same as irrelevant, one approach you can take is to make that address the same as
the address of your external interface!</para> the address of your external interface!</para>

14
Shorewall-docs2/starting_and_stopping_shorewall.xml
View File

@ -15,7 +15,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-08-01</pubdate> <pubdate>2004-08-10</pubdate>
<copyright> <copyright>
<year>2004</year> <year>2004</year>
@ -57,7 +57,7 @@
</listitem> </listitem>
<listitem> <listitem>
<para><filename>/etc/shorewall</filename> ̶ The default directory <para><filename>/etc/shorewall</filename> — The default directory
where Shorewall looks for configuration files. See the section where Shorewall looks for configuration files. See the section
entitled <link linkend="AltConfig">Alternate Configuration Directories</link> entitled <link linkend="AltConfig">Alternate Configuration Directories</link>
for information about how you can direct Shorewall to look in other for information about how you can direct Shorewall to look in other
@ -66,19 +66,19 @@
<listitem> <listitem>
<para><filename>/etc/init.d/shorewall</filename> (<filename>/etc/rc.d/firewall.rc</filename> <para><filename>/etc/init.d/shorewall</filename> (<filename>/etc/rc.d/firewall.rc</filename>
on Slackware) ̶ The script run by <command>init</command> (the program on Slackware) — The script run by <command>init</command> (the program
responsible for startup and shutdown of your system) to start responsible for startup and shutdown of your system) to start
Shorewall at boot time and to stop Shorewall at shutdown.</para> Shorewall at boot time and to stop Shorewall at shutdown.</para>
</listitem> </listitem>
<listitem> <listitem>
<para><filename>/usr/share/shorewall/firewall</filename> ̶ The program <para><filename>/usr/share/shorewall/firewall</filename> — The program
responsible for configuring Netfilter based on your configuration responsible for configuring Netfilter based on your configuration
files.</para> files.</para>
</listitem> </listitem>
<listitem> <listitem>
<para><filename>/usr/share/shorewall/functions</filename> ̶ A library <para><filename>/usr/share/shorewall/functions</filename> — A library
of Bourne Shell functions used by both<filename> /sbin/shorewall</filename> of Bourne Shell functions used by both<filename> /sbin/shorewall</filename>
and <filename>/usr/share/shorewall/firewall</filename>.</para> and <filename>/usr/share/shorewall/firewall</filename>.</para>
</listitem> </listitem>
@ -188,8 +188,8 @@
<filename>/var/lib/shorewall/restore</filename>. The default may be <filename>/var/lib/shorewall/restore</filename>. The default may be
changed using the RESTOREFILE option in <ulink changed using the RESTOREFILE option in <ulink
url="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</ulink>. A url="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</ulink>. A
different file name may also be specified in the specified in the different file name may also be specified in the <command>save</command>
<command>save</command> command:</para> command:</para>
<programlisting><command>shorewall save &#60;filename&#62;</command></programlisting> <programlisting><command>shorewall save &#60;filename&#62;</command></programlisting>