diff --git a/docs/images/Network2011b.dia b/docs/images/Network2011b.dia
new file mode 100644
index 000000000..86192e4ef
Binary files /dev/null and b/docs/images/Network2011b.dia differ
diff --git a/docs/images/Network2011b.png b/docs/images/Network2011b.png
new file mode 100644
index 000000000..d6c2deb02
Binary files /dev/null and b/docs/images/Network2011b.png differ
diff --git a/docs/netmap.xml b/docs/netmap.xml
index 7d92e7b0a..5e16510bb 100644
--- a/docs/netmap.xml
+++ b/docs/netmap.xml
@@ -22,6 +22,8 @@
2007
+ 2011
+
Thomas M. Eastep
@@ -113,8 +115,10 @@
NET1
- Must be expressed in CIDR format (e.g.,
- 192.168.1.0/24).
+ Must be expressed in CIDR format (e.g., 192.168.1.0/24).
+ Beginning with Shorewall 4.4.24, exclusion is
+ supported.
@@ -135,6 +139,71 @@
A second network expressed in CIDR format.
+
+
+ NET3 (Optional) -
+ network-address
+
+
+ Added in Shorewall 4.4.11. If specified, qualifies INTERFACE.
+ It specifies a SOURCE network for DNAT rules and a DESTINATON
+ network for SNAT rules.
+
+
+
+
+ PROTO (Optional - Added in Shorewall
+ 4.4.23.2) -
+ protocol-number-or-name
+
+
+ Only packets specifying this protocol will have their IP
+ header modified.
+
+
+
+
+ DEST PORT(S) (Optional - Added in
+ Shorewall 4.4.23.2) -
+ port-number-or-name-list
+
+
+ Destination Ports. A comma-separated list of Port names (from
+ services(5)), port numbers or port
+ ranges; if the protocol is icmp, this column is interpreted as the
+ destination icmp-type(s). ICMP types may be specified as a numeric
+ type, a numberic type and code separated by a slash (e.g., 3/4), or
+ a typename. See http://www.shorewall.net/configuration_file_basics.htm#ICMP.
+
+ If the protocol is ipp2p,
+ this column is interpreted as an ipp2p option without the leading
+ "--" (example bit for bit-torrent).
+ If no PORT is given, ipp2p is
+ assumed.
+
+ An entry in this field requires that the PROTO column specify
+ icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if
+ any of the following field is supplied.
+
+
+
+
+ DEST PORT(S) (Optional - Added in
+ Shorewall 4.4.23.2) -
+ port-number-or-name-list
+
+
+ Source port(s). If omitted, any source port is acceptable.
+ Specified as a comma-separated list of port names, port numbers or
+ port ranges.
+
+ An entry in this field requires that the PROTO column specify
+ tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of
+ the following fields is supplied.
+
+
Referring to the figure above, lets suppose that systems in the top
@@ -167,7 +236,7 @@
-
+
If you are running Shorewall 4.4.22 or Earlier
The entries in
@@ -318,6 +387,64 @@ DNAT:T 10.10.10.0/24 vpn 192.168.1.0/24
+
+ IPv6
+
+ Beginning with Shorewall6 4.4.24, IPv6 support for Netmap is
+ included. This provides a way to use site local IPv6 addresses internally
+ and still have access to the IPv6 internet.
+
+
+ IPv6 netmap is stateless which means that
+ there are no helpers for applications that need them. As a consequence,
+ applications that require a Netfilter helper (FTP, IRC, etc.) may
+ experience issues.
+
+
+ To use IPv6 Netmap, your kernel and iptables must include
+ Rawpost Table Support.
+
+ IPv6 Netmap has been verified at shorewall.net using the
+ configuration shown below.
+
+ ![]()
+
+ IPv6 support is supplied from Hurricane Electric; the IPv6 address
+ block is 2001:470:b:227::/64.
+
+ Because of the limitations of IPv6 NETMAP, The servers in the DMZ
+ have public addresses in the block 2001:470:b:227::/112. The local LAN
+ uses the private network fec0:470:b:227::/64 with the hosts autoconfigured
+ using radvd.
+
+ The /etc/shorewall6/netmap file is as follows:
+
+ #TYPE NET1 INTERFACE NET2 NET3 PROTO DEST SOURCE
+# PORT(S) PORT(S)
+SNAT:T fec0:470:b:227::/64 HE_IF 2001:470:b:227::/64
+DNAT:P 2001:470:b:227::/64!2001:470:b:227::/112\
+ HE_IF fec0:470:b:227::/64
+
+
+ HE_IF is the logical name for interface sit1. On output, the private
+ address block is mapped to the public block. Because autoconfiguration is
+ used, none of the local addresses falls into the range
+ fec0:470:b:227::/112. That range can therefore be excluded from
+ DNAT.
+
+
+ While the site local network that was used is very similar to the
+ public network (only the first word is different), that isn't a
+ requirement. We could have just as well used
+ fec0:bad:dead:beef::/64
+
+
+
+ The MacBook Pro running OS X Lion refused to autoconfigure a
+ site-local address.
+
+
+
Author's Notes
diff --git a/manpages/shorewall-netmap.xml b/manpages/shorewall-netmap.xml
index 188ff8fb3..343a14c4a 100644
--- a/manpages/shorewall-netmap.xml
+++ b/manpages/shorewall-netmap.xml
@@ -77,7 +77,10 @@
network-address
- Network in CIDR format (e.g., 192.168.1.0/24).
+ Network in CIDR format (e.g., 192.168.1.0/24). Beginning with
+ Shorewall 4.4.24, exclusion is
+ supported.
diff --git a/manpages6/shorewall6-netmap.xml b/manpages6/shorewall6-netmap.xml
index 0872445a4..1d2a0126e 100644
--- a/manpages6/shorewall6-netmap.xml
+++ b/manpages6/shorewall6-netmap.xml
@@ -78,7 +78,10 @@
network-address
- Network in CIDR format (e.g., 2001:470:b:227/64).
+ Network in CIDR format (e.g., 2001:470:b:227/64). Beginning in
+ Shorewall6 4.4.24, exclusion is
+ supported.