diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml index cbcc91b82..0a1325b31 100644 --- a/Shorewall/manpages/shorewall.conf.xml +++ b/Shorewall/manpages/shorewall.conf.xml @@ -2470,7 +2470,7 @@ INLINE - - - ; -j REJECT SAVE_IPSETS={Yes|No|setlist} + role="bold">No|ipv4|setlist} Re-enabled in Shorewall 4.4.6. If SAVE_IPSETS=Yes, then the @@ -2482,7 +2482,8 @@ INLINE - - - ; -j REJECT Beginning with Shorewall 4.6.4, you can restrict the set of ipsets saved by specifying a setlist (a comma-separated list of ipv4 - ipset names). + ipset names). You may also restrict the saved sets to just the ipv4 + ones by specifying ipv4. diff --git a/docs/ipsets.xml b/docs/ipsets.xml index aef381c23..bc15bbd62 100644 --- a/docs/ipsets.xml +++ b/docs/ipsets.xml @@ -154,6 +154,11 @@ ACCEPT net:+sshok $FW tcp 22 firewall is first stopped. + + Beginning with Shorewall 4.6.4, you can save selective ipsets by + setting SAVE_IPSETS to a comma-separated list of ipset names. You can also + restrict the group of sets saved to ipv4 sets by setting + SAVE_IPSETS=ipv4.
@@ -161,17 +166,21 @@ ACCEPT net:+sshok $FW tcp 22 Ipset support in Shorewall6 was added in Shorewall 4.4.21. - Unlike iptables, which has separate configurations for IPv4 and - IPv6, ipset has a single configuration that handles both. This means the - SAVE_IPSETS=Yes in shorewall.conf or shorewall6.conf won't work correctly - because . To work around this issue, Shorewall-init is now capable - restoring ipset contents during 'start' and saving them during 'stop'. To - direct Shorewall-init to save/restore ipset contents, set the SAVE_IPSETS - option in /etc/sysconfig/shorewall-init (/etc/default/shorewall-init on - Debian and derivatives). The value of the option is a file name where the - contents of the ipsets will be save to and restored from. Shorewall-init - will create any necessary directories during the first 'save' operation. - If you configure Shorewall-init to save/restore ipsets, be sure to set + Beginning with Shorewall 4.6.4, SAVE_IPSETS is available in shorewall6-conf(5). When set + to Yes, the ipv6 ipsets will be set. You can also save selective ipsets by + setting SAVE_IPSETS to a comma-separated list of ipset names. + + Prior to Shorewall 4.6.4, SAVE_IPSETS=Yes in shorewall.conf won't + work correctly because it saves both IPv4 and IPv6 ipsets. To work around + this issue, Shorewall-init is capable restoring ipset contents during + 'start' and saving them during 'stop'. To direct Shorewall-init to + save/restore ipset contents, set the SAVE_IPSETS option in + /etc/sysconfig/shorewall-init (/etc/default/shorewall-init on Debian and + derivatives). The value of the option is a file name where the contents of + the ipsets will be save to and restored from. Shorewall-init will create + any necessary directories during the first 'save' operation. If you + configure Shorewall-init to save/restore ipsets, be sure to set SAVE_IPSETS=No in shorewall.conf and shorewall6.conf.