fixed quotes, add CVS Id

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@991 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes 2003-12-28 15:58:02 +00:00
parent 9feb0d8e1d
commit 3d6746412c

View File

@ -2,7 +2,7 @@
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article> <article>
<!----> <!--$Id$-->
<articleinfo> <articleinfo>
<title>User-defined Actions</title> <title>User-defined Actions</title>
@ -56,8 +56,8 @@
<listitem> <listitem>
<para>Once you have defined your new action name (ActionName), then copy <para>Once you have defined your new action name (ActionName), then copy
/etc/shorewall/action.template to /etc/shorewall/action.ActionName (for /etc/shorewall/action.template to /etc/shorewall/action.ActionName (for
example, if your new action name is &#34;Foo&#34; then copy example, if your new action name is <quote>Foo</quote> then copy
/etc/shorewall/action.template to /etc/shorewall/action.foo). </para> /etc/shorewall/action.template to /etc/shorewall/action.foo).</para>
</listitem> </listitem>
<listitem> <listitem>
@ -71,24 +71,24 @@
<listitem> <listitem>
<para>TARGET - Must be ACCEPT, DROP, REJECT, LOG, QUEUE or <para>TARGET - Must be ACCEPT, DROP, REJECT, LOG, QUEUE or
&#60;action&#62; where &#60;action&#62; is a previously-defined action. &#60;action&#62; where &#60;action&#62; is a previously-defined action.
The TARGET may optionally be followed by a colon (&#34;:&#34;) and a The TARGET may optionally be followed by a colon (<quote>:</quote>) and
syslog log level (e.g, REJECT:info or ACCEPT:debugging). This causes the a syslog log level (e.g, REJECT:info or ACCEPT:debugging). This causes
packet to be logged at the specified level. You may also specify ULOG the packet to be logged at the specified level. You may also specify
(must be in upper case) as a log level.This will log to the ULOG target ULOG (must be in upper case) as a log level.This will log to the ULOG
for routing to a separate log through use of ulogd target for routing to a separate log through use of ulogd
(http://www.gnumonks.org/projects/ulogd).</para> (http://www.gnumonks.org/projects/ulogd).</para>
</listitem> </listitem>
<listitem> <listitem>
<para>SOURCE - Source hosts to which the rule applies. A comma-separated <para>SOURCE - Source hosts to which the rule applies. A comma-separated
list of subnets and/or hosts. Hosts may be specified by IP or MAC list of subnets and/or hosts. Hosts may be specified by IP or MAC
address; mac addresses must begin with &#34;~&#34; and must use address; mac addresses must begin with <quote>~</quote> and must use
&#34;-&#34; as a separator.</para> <quote>-</quote> as a separator.</para>
<para>Alternatively, clients may be specified by interface name. For <para>Alternatively, clients may be specified by interface name. For
example, eth1 specifies a client that communicates with the firewall example, eth1 specifies a client that communicates with the firewall
system through eth1. This may be optionally followed by another colon system through eth1. This may be optionally followed by another colon (<quote>:</quote>)
(&#34;:&#34;) and an IP/MAC/subnet address as described above (e.g., and an IP/MAC/subnet address as described above (e.g.,
eth1:192.168.1.5).</para> eth1:192.168.1.5).</para>
</listitem> </listitem>
@ -97,19 +97,18 @@
MAC addresses are not allowed.</para> MAC addresses are not allowed.</para>
<para>Unlike in the SOURCE column, you may specify a range of up to 256 <para>Unlike in the SOURCE column, you may specify a range of up to 256
IP addresses using the syntax &#60;first ip&#62;-&#60;last ip&#62;. IP addresses using the syntax &#60;first ip&#62;-&#60;last ip&#62;.</para>
</para>
</listitem> </listitem>
<listitem> <listitem>
<para>PROTO - Protocol - Must be &#34;tcp&#34;, &#34;udp&#34;, <para>PROTO - Protocol - Must be <quote>tcp</quote>, <quote>udp</quote>,
&#34;icmp&#34;, a number, or &#34;all&#34;.</para> <quote>icmp</quote>, a number, or <quote>all</quote>.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>DEST PORT(S) - Destination Ports. A comma-separated list of Port <para>DEST PORT(S) - Destination Ports. A comma-separated list of Port
names (from /etc/services), port numbers or port ranges; if the protocol names (from /etc/services), port numbers or port ranges; if the protocol
is &#34;icmp&#34;, this column is interpreted as the destination is <quote>icmp</quote>, this column is interpreted as the destination
icmp-type(s).</para> icmp-type(s).</para>
<para>A port range is expressed as &#60;low port&#62;:&#60;high <para>A port range is expressed as &#60;low port&#62;:&#60;high
@ -117,7 +116,7 @@
<para>This column is ignored if PROTOCOL = all but must be entered if <para>This column is ignored if PROTOCOL = all but must be entered if
any of the following ields are supplied. In that case, it is suggested any of the following ields are supplied. In that case, it is suggested
that this field contain &#34;-&#34;.</para> that this field contain <quote>-</quote>.</para>
<para>If your kernel contains multi-port match support, then only a <para>If your kernel contains multi-port match support, then only a
single Netfilter rule will be generated if in this list and the CLIENT single Netfilter rule will be generated if in this list and the CLIENT
@ -141,10 +140,10 @@
this column:</para> this column:</para>
<para><programlisting> &#60;rate&#62;/&#60;interval&#62;[:&#60;burst&#62;]</programlisting>where <para><programlisting> &#60;rate&#62;/&#60;interval&#62;[:&#60;burst&#62;]</programlisting>where
&#60;rate&#62; is the number of connections per &#60;interval&#62; &#60;rate&#62; is the number of connections per &#60;interval&#62; (<quote>sec</quote>
(&#34;sec&#34; or &#34;min&#34;) and &#60;burst&#62; is the largest or <quote>min</quote>) and &#60;burst&#62; is the largest burst
burst permitted. If no &#60;burst&#62; is given, a value of 5 is permitted. If no &#60;burst&#62; is given, a value of 5 is assumed.
assumed. There may be no whitespace embedded in the specification.</para> There may be no whitespace embedded in the specification.</para>
<para><programlisting> Example: 10/sec:20</programlisting></para> <para><programlisting> Example: 10/sec:20</programlisting></para>
</listitem> </listitem>
@ -157,6 +156,4 @@
<para><programlisting> LogAndAccept</programlisting><emphasis <para><programlisting> LogAndAccept</programlisting><emphasis
role="bold">/etc/shorewall/action.LogAndAccept</emphasis><programlisting> LOG:info role="bold">/etc/shorewall/action.LogAndAccept</emphasis><programlisting> LOG:info
ACCEPT</programlisting></para> ACCEPT</programlisting></para>
<para> </para>
</article> </article>