From 45446bc7544acdb00c9b41968d06bbf8bab0ab1c Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Fri, 14 Aug 2009 07:08:16 -0700 Subject: [PATCH] Web site last-minute changes for 4.4 --- web/Documentation.html | 250 ++++----- web/News.htm | 570 +++++++++---------- web/Notices.html | 4 +- web/download.htm | 1174 +++++++++++++++++++-------------------- web/shorewall_index.htm | 25 +- 5 files changed, 1011 insertions(+), 1012 deletions(-) mode change 100755 => 100644 web/Documentation.html diff --git a/web/Documentation.html b/web/Documentation.html old mode 100755 new mode 100644 index fe5598a60..728bd443c --- a/web/Documentation.html +++ b/web/Documentation.html @@ -1,125 +1,125 @@ - - - - - Shorewall Documentation - - -

Shorewall Documentation

- -Copyright © 2005-2009 Thomas M. -Eastep
-

Permission is granted to copy, distribute and/or modify this -document -under the terms of the GNU Free Documentation License, Version 1.2 or -any -later version published by the Free Software Foundation; with no -Invariant -Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of -the -license is included in the section entitled “GNU Free Documentation -License”.
-

-

2009-08-22
-

-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Shorewall -4.4
-(Stable)
- 		Shorewall -4.2
-(Previous Stable)
- 		Shorewall -4.0
-(Debian Lenny)
-Note: 1
- 		Shorewall -3.x
-(Obsolete)
- 		Description
-
IndexIndexIndexIndexAlphabetical index to over 70 -articles with -topics ranging from Accounting to Xen
FAQsFAQsFAQs FAQs Answers to the most commonly -asked -questions
IPv4 ManpagesIPv4 Manpages - ManpagesManpagesOnline version of the Shorewall -and Shorewall-lite man pages
IPv6 -ManpagesIPv6 Manpages - -
- 		-
- 		Online version of the Shorewall6 -and Shorewall6-lite man pages
-
-
-Note 1: Shorewall 4.2 packages -for Lenny are available from Roberto Sanchez's -repository. Roberto is the Debian Shorewall maintainer.
-
-
- - - - + + + + + Shorewall Documentation + + +

Shorewall Documentation

+ +Copyright © 2005-2009 Thomas M. +Eastep
+

Permission is granted to copy, distribute and/or modify this +document +under the terms of the GNU Free Documentation License, Version 1.2 or +any +later version published by the Free Software Foundation; with no +Invariant +Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of +the +license is included in the section entitled “GNU Free Documentation +License”.
+

+

2009-08-14
+

+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Shorewall +4.4
+(Stable)
+ 		Shorewall +4.2
+(Previous Stable)
+ 		Shorewall +4.0
+(Debian Lenny)
+Note: 1
+ 		Shorewall +3.x
+(Obsolete)
+ 		Description
+
IndexIndexIndexIndexAlphabetical index to over 70 +articles with +topics ranging from Accounting to Xen
FAQsFAQsFAQs FAQs Answers to the most commonly +asked +questions
IPv4 ManpagesIPv4 Manpages + ManpagesManpagesOnline version of the Shorewall +and Shorewall-lite man pages
IPv6 +ManpagesIPv6 Manpages + -
+ 		-
+ 		Online version of the Shorewall6 +and Shorewall6-lite man pages
+
+
+Note 1: Shorewall 4.2 packages +for Lenny are available from Roberto Sanchez's +repository. Roberto is the Debian Shorewall maintainer.
+
+
+ + + + diff --git a/web/News.htm b/web/News.htm index d17e11ccf..228d620ac 100644 --- a/web/News.htm +++ b/web/News.htm @@ -1,284 +1,286 @@ - - - - - - Shorewall News - - -

Shorewall News and Announcements
-

-

-Copyright © 2001-2009 Thomas M. Eastep

-

Permission is granted to copy, distribute and/or modify this -document -under the terms of the GNU Free Documentation License, Version 1.2 or -any -later version published by the Free Software Foundation; with no -Invariant -Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of -the -license is included in the section entitled "GNU Free Documentation -License". -

-

August 03, 2009
-

-
-

2009-08-02 Shorewall 4.4.0 RC 2
-

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt
-

2009-07-26 Shorewall 4.4.0 RC 1
-

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC1/releasenotes.txt
-

2009-07-12 Shorewall 4.4.0 Beta 4
-

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta4/releasenotes.txt
- - -

2009-06-29 Shorewall 4.4.0 Beta 3
-

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta3/releasenotes.txt
- -

2009-06-21 Shorewall 4.4.0 Beta 2
-

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta2/releasenotes.txt
- -

2009-06-18 Shorewall 4.2.10
-

-
Problems corrected in Shorewall 4.2.10

1)  A 'large quantum' warning log message during restart has been
    eliminated. The log message occurred when an interface with a large
    OUT-BANDWIDTH was defined in /etc/shorewall/tcdevices.

2)  When a REJECT rule included a log entry, the disposition in the log
    message was incorrectly shown as 'reject' rather than 'REJECT'.

3)  When 'forward' was specified on one or more interfaces in
    /etc/shorewall6/interfaces, the progress message "Compiling
    Interface forwarding..." was issued multiple times. Now, only one
    instance of the message is generated.

4)  A typing error in the IPv6 two-interface sample shorewall6.conf
    file has been corrected. This error prevented the compiler from
    being able to find macros in /usr/share/shorewall/.

Known Problems Remaining:

1)  When exclusion is used in an entry in /etc/shorewall/hosts, then
    Shorewall-shell produces an invalid iptables rule if any of the 
    following OPTIONS are also specified in the entry:    

        blacklist
        maclist
        norfc1918
        tcpflags

2)  Shorewall-shell generates inversion rules which produce
    warnings with iptables 1.4.3.  

    Example:

        iptables -A  lan2fw  -p 6  --dport 999  -s ! 192.168.20.1  -j ACCEPT

    with iptables 1.4.3.1 the following information message is produced:

    Using intrapositioned negation (`--option ! this`) is deprecated in
    favor of extrapositioned (`! --option this`).

    We don't intend to fix this. It's time to migrate to Shorewall-perl
    anyway.

New Features in Shorewall 4.2.10

1)  Shorewall's suppport for dynamic gateways on interfaces managed by
    dhclient works on OpenSuSE systems but not on some other
    distributions.

    In order to generalize support for learning the gateway for dynamic
    interfaces, a new 'findgw' extension script (user exit) has been
    added.

    The exit will be invoked in a function that has a single argument:

        $1 = <name of an interface>

    If the function can determine the gateway for the passed interface,
    it should write the gateway to standard out. Here is a sample
    /etc/shorewall/findgw that works with dhclient (dhcp3) in Debian
    Lenny:

    if [ -f /var/lib/dhcp3/dhclient.${1}.leases ]; then
       grep 'option routers' /var/lib/dhcp3/dhclient.${1}.leases |\
          tail -n 1 |\
          while read j1 j2 gateway; do\
              echo $gateway | sed 's/;//';\
          done
    fi

    The same code works on Ubuntu Jaunty if you replace the first '.'
    with '-' and replace '.leases' with '.lease' (don't you just love
    the consistency between distributions?).

    That code also works on CentOS if you replace 'dhcp3' by
    'dhclient'.

    'findgw' files that have been customized for various distributions
    may be found at
    http://www.shorewall.net/pub/shorewall/contrib/findgw.
-

-

2009-06-13 Shorewall 4.4.0 Beta 1

-
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta1/releasenotes.txt
-

2009-05-14 Shorewall 4.2.9

-

-
Problems corrected in Shorewall 4.2.9

1)  The Shorweall-perl 4.2.8 compiler did not rename the output script
    file with the result that:

     a) Shorewall would not start for the first time after
        installation.
     b) Configuration changes were apparently ignored.

2)   Placing a broadcast address in the BROADCAST column of
    /etc/shorewall/interfaces caused Shorewall-perl to generate an
    error:

        ERROR: Invalid BROADCAST address : /etc/shorewall/interfaces\
                 (line 225)

3)  When Shorewall could not determine the MAC address of of a gateway
    router where multiple providers are configured through the same
    interface, invalid iptables-restore input was generated. This
    resulted in an error message similar to the following:

        iptables-restore v1.3.5: Bad mac address `-j'

4)  Shorewall-perl was not processing the tcrules file when
    TC_ENABLED=No.

5)  When 'all' appeared in the SOURCE column of a DNAT rule, no rule to
    redirect output from the firewall itself was generated.
    
6)  The 'shorewall iprange' command failed to produce a minimal list of
    networks.

New Features in Shorewall 4.2.9

1)  Shorewall6 has now been validated on Ubuntu Hardy running kernel
    2.6.24. Shorewall6 is now supported on that kernel version.
-

2009-04-16 Shorewall 4.2.8
-

-

-
Problems Corrected in Shorewall 4.2.8

1)  The 'start -f' command would previously skip the compilation step
    unconditionally when the 'make' utility was not installed. Now, the
    compilation step is run unconditionally in this case.

2)  When ADD_IP_ALIASES=Yes in shorewall.conf, entries in
    /etc/shorewall/nat produce this failure at compile time when
    using Shorewall-perl:

    ERROR: Internal Error in emit : /etc/shorewall/nat (line 12)

3)  When LOG_MARTIANS=Yes with Shorewall-perl, setting logmartians=0 in
    an entry in /etc/shorewall/interface failed to suppress martian
    logging on the interface.

4)  Shorewall-perl now generates rules with inversion that are
    compatible with iptables 1.4.3.

5) When a network address was specified in the SOURCE or DEST column of
   /etc/shorewall/tcfilters, Shorewall-perl was generating an incorrect
   netmask.

New Features in 4.2.8

1)  The /usr/share/shorewall/modules and /usr/share/shorewall6/modules
    files have been updated for iptables 1.4.3/kernel 2.6.29.
-

2009-03-19 Shorewall 4.2.7

-

-
Problems corrected in 4.2.7

1)  Previously, the 'start' command set the permission flags on
    /var/lib/shorewall*/state so that it could be read by
    non-root users while the 'stop' command set the permissions such
    that the file could not be read by those users.

    Beginning with 4.2.7, both commands will secure the file for
    root-only access. If you want the file to be world-readable, then
    add 

        chmod 744 <file name>

    To your /etc/shorewall/started, /etc/shorewall/stopped and
    /etc/shorewall/restored files.

2)  The 'shorewall6 dump' command now correctly displays the installed
    version of Shorewall-perl. It also displays the IPv6 neighbor table
    contents rather than the ARP table contents.

3)  Under some circumstances, interface options like nosmurfs and
    tcpflags would not be applied to forwarded traffic when using
    Shorewall-perl.

4)  The following rule was badly mis-handled:

       DNAT-    loc     net:1.2.3.4:2525        tcp     25

    The result:

     WARNING: Destination zone (1.2.3.4) ignored : /etc/shorewall/rules (line 459)
     Can't call method "inet_htoa" without a package or object reference at
       /usr/share/shorewall-perl/Shorewall/IPAddrs.pm line 150,
      <$currentfile> line 459.

5)  Previously, OPTIONS were not allowed with a bridge port in
    /etc/shorewall/interfaces. That oversight has been corrected and
    now the following OPTIONS are allowed:

        blacklist
        maclist
        norfc1918
        nosmurfs
        routeback
        tcpflags

6)  Tuomo Soini provided a workaround patch for a problem seen in some
    kernel's (see FAQ 82) that caused 'shorewall start' to fail when
    USE_DEFAULT_RT=Yes .

New Features in Shorewall 4.2.7

1)  Prior to Shorewall version 3.0.0, rules generated by
    /etc/shorewall/tunnels were traversed before those generated by
    /etc/shorewall/rules. When SECTIONs were added to the rules file in
    3.0.0, traversal of the tunnel rules was deferred until after those
    generated by the NEW section of the rules file. 

    Beginning with Shorewall-perl 4.2.7, the tunnel rules are back
    where they started -- right before the first rule generated by the
    NEW section of /etc/shorewall/rules.

2)  To allow bypassing of connection tracking for certain traffic,
    /etc/shorewall/notrack and /etc/shorewall6/notrack files have been
    added.

    Columns in the file are:

        SOURCE - <zone>[:<interface>][:<address list>]

        DEST - [<address list>]

        PROTO - <protocol name or number>

        DEST PORT(S) - <port number list>

        SOURCE PORT(S) - <port number list>

        USER/GROUP - [<user>][:<group>]

            May only be specified if the SOURCE <zone> is $FW.

    Traffic that matches all given criteria will not be subject to
    connection tracking. For such traffic, your policies and/or rules
    must deal with ALL of the packets involved, in both the original
    and the opposite directions. All untracked traffic is passed
    through the relevant rules in the NEW section of the rules
    file. Untracked encapsulated tunnel traffic can be handled by
    entries in /etc/shorewall/tunnels just like tracked traffic
    is. Because every packet of an untracked connection must pass
    through the NEW section rules, it is suggested that rules that deal
    with untracked traffic should appear at the top of the file.

    Example:

    /etc/shorewall/tunnels:

        #TYPE   ZONE    GATEWAY
        6to4    net

    /etc/shorewall/notrack

        #SOURCE          DEST           PROTO   DEST    SOURCE  USER/
        #                                       PORT(S) PORT(S) GROUP
        net:!192.88.99.1 -              41

    Given that 192.88.99.1 is an anycast address, many hosts can
    respond to outward traffic to that address. The entry in
    /etc/shorewall/tunnels allows protocol 41 net<->fw. The entry in
    /etc/shorewall/notrack prevents the inbound traffic from creating
    additional useless conntrack entries.

    As part of this change, the 'show' command is enhanced to support a 
    'show raw' command that is an alias for 'show -t raw'. The raw
    table is where NOTRACK rules are created. The dump command is also
    enhanced to display the contents of the raw table.

3)  Shorewall-perl supports three additional columns in the
    /etc/shorewall/routestopped file:

    PROTO          -- Protocol name or number

    DEST PORT(S)   -- comma-separated list of service names and/or port
                      numbers
 
    SOURCE PORT(S) -- comma-separated list of service names and/or port
                      numbers.

    These columns are only meaningful when the "-f" option to
    'shorewall stop' is used.

    As part of this change, the "-f" option to the 'stop' and 'clear'
    commands is now the default when FAST_STOP=Yes in shorewall.conf.
    To override this default, use the "-s" option:

        shorewall stop -s

    Note that if you have entries with one or more of the new columns,
    the -s option will result in warning messages.

        gateway:~ # shorewall stop -s
        Stopping Shorewall...
          WARNING: Unknown routestopped option ignored: notrack
          WARNING: Unknown routestopped option ignored: 41
          WARNING: Unknown routestopped option ignored: notrack
          WARNING: Unknown routestopped option ignored: 41
        done.
        gateway:~ #

4)  Shorewall-perl now handles SOURCE PORT lists of more than 15
    entries by breaking the containing rule into multiple rules.
-

2009-02-15 Shorewall 4.2.6

-
Problems corrected in 4.2.6

1)  The CONFIG_PATH in the two- and three-interface Shorewall6 sample
    configurations was incorrect with the result that this error
    occurred on 'shorewall6 check' or 'shorewall6 start'.

           ERROR: No IP zones defined

2)  Setting TCP_FLAGS_DISPOSITION=REJECT caused both Shorewall-shell
    and Shorewall-perl to create invalid iptables commands. This has
    been corrected but we still strongly recommend against that
    setting; TCP_FLAGS_DISPOSITION=DROP is preferred.

3)  Shorewall-perl was generating code that checked for state match
    before kernel modules were loaded. This caused start/restart to
    fail on systems without kernel module loading. 

4)  The Shorewall6 and Shorewall6-lite Makefiles were incorrect.

5)  If a service name is used in a port-mapping rule (a DNAT or
    REDIRECT rule that changes the destination port), and if the
    kernel and iptables include Extended Connection Match support, then
    invalid iptables-restore input is produced by Shorewall-perl.

6)  If iptables 1.4.1 or later was installed, Shorewall-perl generated
    incorrect iptables-restore input if exclusion was used in the
    ORIGINAL DEST field of a DNAT or REDIRECT rule.

7)  On kernels earlier than 2.6.20, the 'shorewall show connections'
    command fails.

New Feature in Shorewall 4.2.6

1)  A BitTorrent32 macro has been added. This macro matches the
    extended TCP port range used by BitTorrent 3.2 and later.

2)  A new COUNT action has been added to Shorewall-perl. This action
    creates an iptables (ip6tables) rule with no target. Connections
    matching such a rule are simply counted and the packet is passed on
    to the next rule.

    Shorewall-shell ignores COUNT in actions and macros, thus allowing
    the standard actions (action.Drop and action.Reject) to have a
    COUNT rule as their first entry.

3)  A new RESTORE_DEFAULT_ROUTE option has been added to
    shorewall.conf. It is used to determine whether to restore the
    default route saved when there are 'balance' providers defined but
    all of them are down.

    The default is RESTORE_DEFAULT_ROUTE=Yes which preserves the
    pre-4.2.6 behavior. 

    RESTORE_DEFAULT_ROUTE=No is appropriate when you don't want a
    default route in the main table (USE_DEFAULT_RT=No) or in the
    default table (USE_DEFAULT_RT=Yes) when there are no balance
    providers available. In that case, RESTORE_DEFAULT_ROUTE=No
    will cause any default route in the relevant table to be deleted.

4)  IPv4 firewall scripts produced by Shorewall-perl now use dhcpcd's
    database when trying to detect the gateway for an interface
    ("detect" in the GATEAWAY column in /etc/shorewall/interfaces).

    As part of this change, it is now permitted to specify 'detect'
    when USE_DEFAULT_RT=Yes; in that case, the script will only detect
    gateways for point-to-point devices and for devices configured by
    dhcpcd.

5)  Shorewall-perl now supports port inversion. A port number or list
    of port numbers may be preceded by '!" which will cause the rule to
    match all ports EXCEPT those listed:

    Example: To blacklist 206.124.146.176 for all tcp ports except 80:

             ADDRESS/SUBNET       PROTO           PORT(S)
             206.124.146.177      tcp             !80

6)  Shorewall-perl now supports protocol inversion. A protocol name or
    number may be preceded by '!' to specify all protocols except the
    one following '!'.

    Example: To blacklist 206.124.146.176 for all protocols except 
             UDP:

             ADDRESS/SUBNET       PROTO           PORT(S)
             206.124.146.177      !udp

    Note that ports may not be specified when protocol inversion
    is used.

7)  When using Shorewall-perl, neither the 'start' nor 'started'
    extension script is run during processing of the 'restore'
    command. To allow extension of that command, we have added a
    'restored' extension script that runs at the successful completion
    of 'restore'. This script is only available with Shorewall-perl.

    With Shorewall-shell, both scripts are run during 'restore' but in
    that case, the run_iptables() function does nothing. So any
    run_iptables() calls in the 'start' script are effectively ignored.

8)  Shorewall-perl now correctly handles 'here documents' quoting
    (<<EOF .... EOF) in run-time extension scripts.
-

2009-01-22 Shorewall 4.2.5
-

-

-
Problems corrected in 4.2.5

1)  If exclusion is used to define a zone in /etc/shorewall/hosts and
    that zone is used as the SOURCE zone in a DNAT or REDIRECT rule,
    then Shorewall-perl can generate invalid iptables-restore input.

2)  A bug in the Perl Cwd module (see
    http://rt.cpan.org/Public/Bug/Display.html?id=13851) causes the
    Shorewall-perl compiler to fail if it doesn't have at least read
    access to its current working directory. 4.2.5 contains a
    workaround.

3)  If 'critical' was specified on an entry in
    /etc/shorewall6/routestopped, Shorewall6 (Shorewall-perl) would
    generate an error.

4)  In certain cases where exclusion occurred in /etc/shorewall/hosts,
    Shorewall-perl would generate incorrect iptables-restore input.

5)  In certain cases where exclusion occurred in /etc/shorewall/hosts,
    Shorewall-perl would generate invalid iptables-restore input.

6)  The 'shorewall6 refresh' command runs iptables_restore rather than
    ip6tables_restore.

7)  The commands 'shorewall6 save-start', 'shorewall6-save-restart' and
    'shorewall6 restore' were previously broken.

8)  The Debian init script was checking $startup in
    /etc/default/shorewall rather than in /etc/default/shorweall6

9)  The Archlinux init scripts for Shorewall6 and Shorewall6 Lite were
    unconverted Shorewall scripts.

10) When 'detect' is used in the GATEWAY column of
    /etc/shorewall/providers, Shorewall-perl now ensures that the
    gateway was successfully detected. If the gateway cannot be
    detected, action is taken depending on whether the provider is
    'optional' or not. If the provider is optional, it's configuration
    is skipped; if the provider is not optional, the current operation
    is aborted.

11) The command 'shorewall6 debug start' would previously fail with
        ERROR: Command "/sbin/ip6tables -t nat -F" Failed

12) Both ipv4 and ipv6 compiled programs attempt to run the tcclear
    script itself at run time rather than running the copy of the
    file in the compiled script. This usually isn't noticable unless
    you are running Shorewall Lite or Shorewall6 Lite in which case,
    the script doesn't get run (since it is on the administrative
    system and not the firewall system).

13) If your iptables/kernel included "Extended Connection Tracking
    Match support" (see the output of "shorewall show capabilities"),
    then a REDIRECT rule that specified a port list or range would
    cause Shorewall-perl to create invalid iptables-restore input:

    Running /usr/sbin/iptables-restore...
    iptables-restore v1.4.2-rc1: conntrack: Bad value for
       "--ctorigdstport" option: "1025:65535"
       Error occurred at line: 191
       Try `iptables-restore -h' or 'iptables-restore --help' for more information.
      ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input

Known Problems Remaiining:

1)  When exclusion is used in an entry in /etc/shorewall/hosts, then
    Shorewall-shell produces an invalid iptables rule if any of the
    following OPTIONS are also specified in the entry:

        blacklist
        maclist
        norfc1918
        tcpflags

New Feature in Shorewall 4.2.5

1)  A new 'fallback' option is added in
    /etc/shorewall/providers. The option works similar to 'balance'
    except that the default route is added in the default routing table
    (253) rather than in the main table (254).

    The option can be used by itself or followed by =<number> (e.g,
    fallback=2).

    When the option is used by itself, a separate (not balanced)
    default route is added with a metric equal to the provider's NUMBER.

    When the option is used with a number, a balanced route is added
    with the weight set to the specified number.

    'fallback' is ignored if USE_DEFAULT_RT=Yes in shorewall.conf and
    is only available with Shorewall-perl.

    'fallback' is useful in situations where:

    - You want all traffic to be sent via one primary provider unless
      there is a compelling reason to use a different provider

    - If the primary provider is down, then you want to balance the
      outgoing traffic among a set of other providers or to a
      ordered list of providers.

    In this case:

    - Do not specify 'balance' on any of the providers.
    - Disable route filtering ('ROUTE_FILTER=No' in shorewall.conf).
    - Specify 'fallback' on those providers that you want to use if
      the primary is down.
    - Only the primary provider should have a default route in the main
      routing table.

    See http://www.shorewall.net/MultiISP.html#Complete for an example
    of this option's use.

2)  Shorewall-perl now transparently handles the xtables-addon version
    of ipp2p. Shorewall detects whether the installed ipp2p is from
    patch-o-matic-ng or from xtables-addon and proceeds accordingly.

    If the patch-o-matic-ng version is installed:

    a) If no DEST PORT is supplied, the default is "--ipp2p".
    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to
       iptables-restore as "--ipp2p".

    If the xtables-addons version is installed:

    a) If no DEST PORT is supplied, the default is "--edk --gnu --dc
       --kazaa".
    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to
       iptables-restore as "--edk --gnu --dc --kazaa".

    Shorewall-perl now also accepts a comma-separated list of options
    (e.g., "edk,gnu,dc,kazaa).

    Additionally, Shorewall now looks for modules in /lib/modules/$(uname
    -r)/extra and in /lib/modules/$(uname -r)/extra/ipset

    This change introduced a new capability ("Old IPP2P Match Syntax")
    so if you use a capabilities file, be sure to re-generate the
    file(s) after you have installed 4.2.5.

3)  There is now a macro.Git, which opens git-daemon's port (9418/tcp).

4)  There is also a macro.IRC which open's the Internet Relay Chat port
    (6667/tcp).
-

2009-01-06 Winner of the Shorewall Logo Design Competition -Announced

-The Shorewall developers are pleased to announce that after deliberating
-upon the matter, we have chosen Gareth Davies' #3 design.
-

See -http://trac.shorewall.net/wiki/LogoDesignCompetition for details.
-

-

2008-12-31 Shorewall 4.2.4

-

-
1) In 4.2.4, two new packages are included:

   a) Shorewall6 - analagous to Shorewall-common but handles IPv6
      rather than IPv4.

   b) Shorewall6-lite - analagous to Shorewall-lite but handles IPv6
      rather than IPv4.

   The packages store their configurations in /etc/shorewall6/ and
   /etc/shorewall6-lite/ respectively.  

   The fact that the packages are separate from their IPv4 counterparts
   means that you control IPv4 and IPv6 traffic separately (the same
   way that Netfilter does). Starting/Stopping the firewall for one
   address family has no effect on the other address family.

   For additional information, see
   http://www.shorewall.net/IPV6Support.html.

   Other features of Shorewall6 are:

   a) There is no NAT of any kind (most people see this as a giant step
      forward). When an ISP assigns you a public IPv6 address, you are
      actually assigned an IPv6 'prefix' which is like an IPv4
      subnet. A 64-bit prefix allows 4 billion squared individual hosts
      (the size of the current IPv4 address space squared).

   b) The default zone type is ipv6.

   c) The currently-supported interface options in Shorewall6 are:

        blacklist
        bridge
        dhcp
        nosmurfs (traps multicast and Subnet-router anycast addresses
        used as the packet source address).
        optional
        routeback
        sourceroute
        tcpflags
        mss
        forward (setting it to 0 makes the router behave like a host
                 on that interface rather than like a router).

   d)  The currently-supported host options in Shorewall6 are:

        blacklist
        routeback
        tcpflags

   e)  Traffic Shaping is disabled by default. The tcdevices and
       tcclasses files are address-family independent so
       to use the Shorewall builtin Traffic Shaper, TC_ENABLED=Internal
       should be specified in Shorewall or in Shorewall6 but not in
       both. In the configuration where the internal traffic shaper is
       not enabled, CLEAR_TC=No should be specified.

       tcfilters are not available in Shorewall6.

   f)  When both an interface and an address or address list need to
       be specified in a rule, the address or list must be enclosed in
       angle brackets. Example:

        #ACTION      SOURCE                                     DEST
        ACCEPT       net:eth0:<2001:19f0:feee::dead:beef:cafe>  dmz

       Note that this includes MAC addresses as well as IPv6 addresses.

       The HOSTS column in /etc/shorewall6/hosts also uses this
       convention:

           #ZONE      HOSTS                                     OPTIONS
           chat6      eth0:<2001:19f0:feee::dead:beef:cafe>

       Even when an interface is not specified, it is permitted to
       enclose addresses in <> to improve readability. Example:

           #ACTION      SOURCE          DEST
           ACCEPT       net:<2001:1::1> $FW

   g)  The options available in shorewall6.conf are a subset of those
       available in shorewall.conf.

   h)  The Socket6.pm Perl module is required if you include DNS names
       in your Shorewall6 configuration. Note that it is loaded the
       first time that a DNS name is encountered so if it is missing,
       you get a message similar to this one:

       ...
       Checking /etc/shorewall6/rules...
       Can't locate Socket6.pm in @INC (@INC contains: /root ...
       teastep@ursa:~/Configs/standalone6$
-

2008-12-16 Shorewall 4.2.3

-

-
Problems corrected in Shorewall 4.2.3

1)  Previously, Shorewall would allow compilation for export of a
    script named 'shorewall' with the unfortunate side effect that
    the 'shorewall.conf' file was overwritten. Scripts named
    'shorewall' now cause a fatal error to be raised.

2)  Previously, Shorewall-perl attempted to do Shell variable
    substitution on the first line in /etc/shorewall/compile.

3)  Following the Netfilter tradition, the IPP2P maintainer has made an
    incompatible syntax change (the --ipp2p option has been
    removed). Shorewall has always used "-m ipp2p --ipp2p" when
    detecting the presence of IPP2P support.

    Shorewall-common and Shorewall-perl have been modified to use
    "-m ipp2p --edk" instead.

4)  When Extended Conntrack Match support was available, Shorewall-perl
    would create invalid iptables-restore input for certain DNAT rules.

5)  An optimization in all Shorewall-perl 4.2 versions could  cause
    undesirable side effects. The optimization deleted the
    <interface>_in and <interface>_fwd chains and moved their rules
    to the appropriate rules chain (a <zone>2<xxx> chain).

    This worked badly in cases where a zone was associated with more
    than one interface. Rules could be duplicated or, worse, a rule
    that was intended for only input from one of the interfaces would
    be applied to input from all of the zone's interfaces.

    This problem has been corrected so that an interface-related
    chains is only deleted if:

    a) the chain has no rules in it; or
    b) the interface is associated with only one zone and that zone is
       associated with only that interface in which case it is safe to
       move the rules.

Other changes in Shorewall 4.2.3

1)  Except with the -e option is specified, the Shorewall-perl compiler
    now verifies user/group names appearing in the USER/GROUP column of
    the rules file.

2)  The output of 'shorewall dump' now includes the output from
    'netstat -tunap'.

3)  Shorewall-perl now accepts '+' as an interface name in
    /etc/shorewall/interfaces. That name matches any interface and is
    useful for defining a zone that will match any interface that might
    be added after Shorewall is started.

    A couple of words of caution are in order.

    a) Because '+' matches any interface name, Shorewall cannot
       verify interface names appearing in other files when '+' is
       defined in /etc/shorewall/interfaces.

    b) The zone assigned to '+' must be the last one defined in
       /etc/shorewall/zones.

4)  Shorewall-perl now uses the iptables --goto parameter in obvious
    cases.

5)  The 'reset' command now allows you to reset the packet and byte
    counter on individual chains:

            shorewall reset chain1 chain2 ...
            shorewall-lite reset chain1 chain2 ...
-

2008-11-20 Shorewall 4.2.2

-

-Problems corrected in Shorewall 4.2.2 -

1)  Shorewall-perl now insures that each line copied from a
    configuration file or user exit is terminated with a newline
    character.

2) When ipranges were used to define zones, Shorewall-perl could
   generate invalid iptables-restore input if 'Repeat Match' was not
   available. Repeat Match is not a true match -- it rather is a
   feature of recent iptables releases that allows a match to be
   repeated within a rule.

3)  With Shorewall-perl, if a destination port list had exactly 16
    ports, where a port-range counts as two ports, then Shorewall-perl
    would fail to split the rule into multiple rules and an
    iptables-restore error would result.

4)  The change to Shorewall-perl in 4.2.1 that promised iptables 1.4.1
    compatibility contained a typo that prevented it from working
    correctly.

5)  If a no-NAT rule (DNAT-, ACCEPT+, NONAT) included a destination IP
    address and no zone name in the DEST column, Shorewall-perl would
    reject the rule. If a zone name was specified, Shorewall-perl 
    would issue a Warning message.

6)  Previously, if Extended conntrack match support was available, a
    DNAT rule that specified a server port but no destination port 
    would generate invalid iptables-restore input.     

Other changes in Shorewall 4.2.2

1)  A macro supporting JAP (anonymization protocol) has been added.
    It can be used as any other macro (e.g., JAP/ACCEPT) in the rules
    file.

2)  A macro supporting DAAP (Digital Audio Access Protocol) has been added.
    It can be used as any other macro (e.g., DAAP/ACCEPT) in the rules
    file.

3)  A macro supporting DCC (Distributed Checksum Clearinghouse) has been
    added.  It can be used as any other macro (e.g., DCCP/ACCEPT) in the
    rules file.

4)  A macro supporting GNUnet (secure peer-to-peer networking) has been
    added.  It can be used as any other macro (e.g., GNUnet/ACCEPT) in the
    rules file.

5)  In 4.2.1, a single capability ("Extended conntrack match support")
    was used both to control the use of --ctorigport and to trigger use
    of the new syntax for inversion of --ctorigdst (e.g., "!
    --ctorigdst ..."). In 4.2.2, these are controlled by two separate
    capabilities. If you use a capabilities file when compiling your
    configuration, be sure to generate a new one after installing
    4.2.2.
-

2008-10-25 Shorewall 4.2.1
-

-
Problems corrected in Shorewall 4.2.1

1)  A description of the CONNBYTES column has been added to
    shorewall-tcrules(5).

2)  Previously, Shorewall-perl would accept zero as the <max> value in
    the CONNBYTES column of tcrules even when the <min> field was
    non-zero. A value of zero for <max> was equivalent to omitting
    <max>.

3)  iptables 1.4.1 discontinued support of syntax generated by
    shorewall in some cases. Shorewall now detects when the new syntax
    is required and uses it instead.

4)  The Shorewall-perl implementation of the LENGTH column in
    /etc/shorewall/tcrules was incomplete with the result that 
    all LENGTH rules matched. Thanks to Lennart Sorensen for the patch.

5)  The 'export' command no longer fails with the error:

    /sbin/shorewall: 1413: Syntax error: "(" unexpected (expecting "fi")

Other changes in Shorewall 4.2.1

1)  With the recent renewed interest in DOS attacks, it seems
    appropriate to have connection limiting support in Shorewall. To
    that end, a CONNLIMIT column has been added to both the policy and
    rules files.

    The content of these columns is of the format

        [!] <limit>[:<mask>]

    where

        <limit> is the limit on simultaneous TCP connections.

        <mask>  specifies the size of the network to which
                the limit applies and is specified as a
                CIDR mask length. The default value for
                <mask> is 32 which means that each remote
                IP address can have <limit> TCP connections
                active at once.

        !       Not allowed in the policy file. In the rules file, it
                causes connections to match when the number of
                current connections exceeds <limit>.
    
    When specified in the policy file, the limit is enforced on all
    connections that are subject to the given policy (just like
    LIMIT:BURST). The limit is checked on new connections before the
    connection is passed through the rules in the NEW section of the
    rules file.

    It is important to note that while the limit is only checked for
    those destinations specified in the DEST column, the number of
    current connections is calculated over all destinations and not
    just the destination specified in the DEST column.

    Use of this feature requires the connlimit match capability in your
    kernel and iptables. If you use a capabilities file when compiling
    your Shorewall configuration(s), then you need to regenerate the
    file using Shorewall or Shorewall-lite 4.2.1.

2)  Shorewall now supports time/date restrictions on entries in the 
    rules file via a new TIME column.

    The contents of this column is a series of one or more "time
    elements" separated by apersands ("&"). Possible time elements are:

    utc         Times are expressed in Greenwich Mean Time.
    localtz     Times are expressed in local civil time (default)
    timestart=hh:mm[:ss]
    timestop=hh:mm[:ss]   Start and stop time of day for rule
    weekdays=ddd[,ddd]... where ddd is Mon,Tue,Wed,Thu,Fri,Sat or
                          Sun
    monthdays=dd[,dd]...  where dd is an ordinal day of the month.
    datestart=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
    datestop=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
                          where       yyyy = Year
                                first mm   = Month
                                      dd   = Day
                                      hh   = Hour
                                  2nd mm   = Minute
                                      ss   = Second

    Examples:

    1)  utc&timestart=10:00&timestop=12:00

        Between 10am and 12 noon each day, GMT

    2)  datestart=2008-11-01T12:00

        Beginning November 1, 2008 at noon LCT.

    Use of this feature requires the time match capability in your
    kernel and iptables. If you use a capabilities file when compiling
    your Shorewall configuration(s), then you need to regenerate the
    file using Shorewall or Shorewall-lite 4.2.1.
-

2006-10-05 Shorewall 4.2.0

-
Release Highlights.

1) Support is included for multiple internet providers through the same
   ethernet interface.

2) Support for NFLOG has been added.

3) Enhanced operational logging.

4) The tarball installers now work under Cygwin.

5) Shorewall-perl now supports IFB devices which allow traffic shaping of
   incoming traffic.

6) Shorewall-perl supports definition of u32 traffic classification
   filters.
-

-
-

2008-03-29 Shorewall 4.0.10

-

-
Problems corrected in Shorewall-perl 4.0.10.

1)  Shorewall-perl 4.0.9 erroneously reported an error message when a
    bridge port was defined in /etc/shorewall/interfaces:

     ERROR: Your iptables is not recent enough to support bridge ports

2)  Under Shorewall-perl, if an empty action was invoked or was named
    in one of the DEFAULT_xxx options in shorewall.conf, an
    iptables-restore error occured.

3)  If $ADMIN was empty, then the rule:

        ACCEPT loc:$ADMIN all

     became

        ACCEPT loc   net

     It is now flagged as an error.

4)  Previously, Shorewall-perl would reject an IP address range in the
    ecn and routestopped files.

5)  A POLICY of ":" in /etc/shorewall/policy would produce Perl
    run-time errors.

6)  An INTERFACE of ":" in /etc/shorewall/interfaces would produce Perl
    run-time errors.

7)  A MARK of ":" in /etc/shorewall/tcrules would produce Perl
    run-time errors.

Problems corrected in Shorewall-shell 4.0.10.

1)  Specifying a value for ACCEPT_DEFAULT or QUEUE_DEFAULT resulted in
    a fatal error at compile time.

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.10.

1)  The Sample configurations have been updated to set
    LOG_MARTIANS=keep. In 4.2, this will be changed to
    LOG_MARTIANS=Yes.

2)  Shorewall-perl now generates a fatal error if a non-existant shell
    variable is used in any configuration file (except
    /etc/shorewall/params).

3)  Shorewall-perl now supports an 'l2tp' tunnel type. It opens UDP
    port 1701 in both directions and assumes that the source port will
    also be 1701. Some implementations (particularly OS X) use a
    different source port. In that case, you should use
    'generic:udp:1701' rather than 'l2tp'.
-

2008-03-01 Shorewall 3.4.8

-
1)  Shorewall now removes any default bindings of ipsets before
    attempting to reload them. Previously, default bindins were not
    removed with the result that the ipsets could not be destroyed.


2)  When HIGH_ROUTE_MARKS=Yes, unpredictable results could occur when
    marking in the PREROUTING or OUTPUT chains. When a rule specified a
    mark value > 255, the compiler was using the '--or-mark' operator
    rather than the '--set-mark' operator with the result that when a
    packet matched more than one rule, the resulting routing mark was
    the logical product of the mark values in the rules.


    Example:


        0x100   192.168.1.44    0.0.0.0/0
        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25


    A TCP packet from 192.168.1.44 with destination port 25 would end
    up with a mark value of 0x300.


3)  Shorewall now properly parses comma separated SOURCE (formerly
    SUBNET) values in the masq configuration file.  Previously, the comma
    separated list was not split up into its components, resulting in an
    invalid address being passed to the iptables command.


    Example:


        # /etc/shorewall/masq
        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC
        eth0        192.168.2.1,192.168.2.3


4)  Previously, specifying both an interface and a MAC address in the
    SOURCE column of the tcrules file caused a failure at runtime.
    Thanks to Justin Joseph for the patch.


5)  Previously, specifying both an interface and an address in the
    tcrules DEST column would cause an incomplete rule to be generated.


    Example:


    1   192.168.1.4     eth2:206.124.146.177    tcp     22


    The resulting tcrule would be as if this had been specified:


    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22


6)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match
    fwmarks to routing tables overflowed the designated range for such
    marks (10000 - 11000).
-
-

2008-02-23 Shorewall 4.0.9

-

-
Problems corrected in Shorewall-perl 4.0.9.1

1)  In 4.0.9, Shorewall-perl incorrectly generated the following error
    message:

    ERROR: Your iptables is not recent enough to support bridge ports

Problems corrected in Shorewall-perl 4.0.9

1)  If a zone was defined with exclusion in /etc/shorewall/hosts, then
    the rules generated for directing outgoing connections to the zone
    were incorrect.

    Example:

    /etc/shorewall/zones:

    z   ipv4

    /etc/shorewall/interfaces:

    -   eth2    

    /etc/shorewall/hosts:

    z   eth2:192.168.1.0/24!192.168.1.5

    Traffic from the firewall to 192.168.1.5 was incorrectly classified
    as $FW->z.

2)  Qualifying 'SOURCE' and 'DEST' with an IP address in a macro file
    caused 'SOURCE' or 'DEST' to be interpreted incorrectly as the name
    of an interface.

    Example:

        PARAM   DEST    SOURCE:224.0.0.22

3)  Specifying '!<user>' in the USER/GROUP column of the files that
    support it resulted in an invalid iptables rule under
    Shorewall-perl.

4)  Previously, Shorewall would accept both an interface and an IP
    address in tcrules POSTROUTING entries (such as CLASSIFY).

    Example:

    1:11      eth1:192.168.4.9  -       tcp     22

    It also allowed both a destination interface and address.

    Example:

    1:P       -         eth1:192.168.4.9        tcp     22

    Because Netfilter does not allow an input interface to be specified
    in POSTROUTING or an output interface to be specified in
    PREROUTING, Shorewall must use the routing table to generate a list
    of networks accessed through any interface specified in these
    cases. Given that a specific address (or set of addresses) has
    already been specified, it makes no sense qualify it (them) by
    another list of addresses.

5)  Shorewall-perl incorrectly generated a fatal error when ':C', 
    ':T' or ':CT' was used in a tcrules entry that gave $FW as the
    SOURCE.

6)  Users have been confused about this error message:

    ERROR: Bridge Ports require Repeat match in your kernel and iptables 

    The message has been replaced with:

    ERROR:  Your iptables is not recent enough to support bridge ports

    The minimum version required is 1.3.8.

Problems corrected in Shorewall-shell 4.0.9.

1)  An optimization added to Shorewall-shell in 4.0.0 has been backed
    out to work around a limitation of Busybox 'sed'.

2)  Previously, specifying both an interface and an address in the
    tcrules DEST column would cause an incomplete rule to be generated.

    Example:

    1   192.168.1.4     eth2:206.124.146.177    tcp     22

    The resulting tcrule would be as if this had been specified:

    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22

3)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match
    fwmarks to routing tables previously overflowed the designated
    range defined for such marks (10000 - 11000). 

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.9.

1)  The Shorewall-perl now flags unprintable garbage characters in
    configuration files with the message:

        ERROR: Non-ASCII gunk in file 

2)  The /usr/share/shorewall/modules file has been updated to reflect
    module renaming in kernel 2.6.25.

3)  The 'ip route replace' command is broken in kernel 2.6.24. To work
    around this problem, the undocumented option BROKEN_ROUTING has
    been added to shorewall.conf. The default is BROKEN_ROUTING=No.

    If you are experiencing 'File Exists' errors from 'ip route
    replace' commands, then add the following line to your
    shorewall.conf:

        BROKEN_ROUTING=Yes

    Note: This workaround is only available in Shorewall-perl.
-

2008-01-25 Shorewall 4.0.8

-

-
Problems corrected in Shorewall-perl 4.0.8.

1)  Mark tests (such as in the TEST column of tcrules or the MARK
    column of the rules file) were ignoring the value 0. As part of
    this fix, the default mask generated by entries in these columns
    has been changed from 0xFF to 0xFFFF for compatibility with
    Shorewall-shell.

2)  The compilation date recorded in the firewall.conf file produced by
    Shorewall-perl was previously mangled.

3)  The ability to specify a DEST IP range (round-robin) in a DNAT rule
    has been restored. In versions 4.0.5 - 4.0.7, an IP range was
    incorrectly flagged as an error.

Problems corrected in Shorewall-shell 4.0.8.

1)  Shorewall-shell now properly parses comma separated SOURCE (formerly
    SUBNET) values in the masq configuration file.  Previously, the comma
    separated list was not split up into its components, resulting in an
    invalid address being passed to the iptables command.

    Example:

        # /etc/shorewall/masq
        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC
        eth0        192.168.2.1,192.168.2.3

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.8.

None.
-
2007-12-26 Shorewall 4.0.7 -
Problems corrected in Shorewall-perl 4.0.7
-
1)  If any of the following files was missing, a harmless Perl warning
    was issued:
-
       accounting
       maclist
       masq
       nat
       netmap
       rfc1918
       routestopped
       tunnels
-
    This problem was experienced mostly by Debian users and users of
    Debian derivatives such as Ubuntu.
-
2)  The iptables utility doesn't retry operations that fail due to
    resource shortage. Beginning with this release, Shorewall reruns
    iptables when such a failure occurs.
-
3)  Previously, Shorewall-perl did not accept log levels in upper case
    (e.g., INFO). Beginning with 4.0.7, log levels are treated in a
    case-insensitive manner by Shorewall-perl.
-
4)  The column headers in macro files were not aligned. This has been
    corrected, along with some inaccuracies in the macro.template file.
-
5)  The shorewall.conf files in the Samples did not contain some
    recently-defined options. They are now up to date.
-
6)  The names of the Jabber macros were shuffled. They are now named
    correctly.
-
7)  If ADD_IP_ALIASES=Yes, an alias was incorrectly added when the
    specified INTERFACE ended with ":" (e.g., eth0:).
-
8)  Shorewall-shell generated an incorrect iptables rule from the
    following:
-
    /etc/shorewall/rules:
-
    ACCEPT     loc:eth0:~00-02-02-02-02-02  ...
-
    /etc/shorewall/tcrules:
-
    xxxx        eth0:~00-02-02-02-02-02 ...
-
Known Problems Remaining.
-
1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.
-
Other changes in 4.0.7
-
1)  If the program named in SHOREWALL_SHELL doesn't exist or is not
    executable, Shorewall and Shorewall-lite now both fall back to
    /bin/sh after issuing a warning message. Previously, both
    terminated with a fatal error.
-
2)  The error message has been improved when a non-root user attempts
    "shorewall show capabilities".
-
3)  Shorewall-perl now generates fatal error conditions when there are
    no IPv4 zones defined and when there are no interfaces defined.
-

2007-12-26 Shorewall 4.1.3

-
Problems corrected in Shorewall 4.1.3.
-
1)  If NFLOG or ULOG was specified with parameters, the resulting
    iptables-restore input contained elements that were incorrectly
    up-cased.
-
2)  If STARTUP_LOG is specified without LOG_VERBOSITY, /sbin/shorewall
    produces an error.
-
3)  If LOG_VERBOSITY is specified without STARTUP_LOG, run-time error
    messages are produced.
-
4)  Shorewall-shell was mishandling the entries in /etc/shorewall/rules
    and in /etc/shorewall/tcrules where both a SOURCE interface and MAC
    address were specified.
-
    Example:
-
    ACCEPT      net:eth0:~01-02-03-04-05-06    $FW      tcp     22
-
Other changes in Shorewall 4.1.3.
-
1)  If the program named in SHOREWALL_SHELL doesn't exist or is not
    executable, Shorewall and Shorewall-lite now both fall back to
    /bin/sh after issuing a warning message. Previously, both
    terminated with a fatal error.
-
2)  The error message has been improved when a non-root user attempts
    "shorewall show capabilities".
-
3)  Shorewall-perl now generates fatal error conditions when there are
    no IPv4 zones defined and when there are no interfaces defined.
-
4)  Shorewall now unconditionally uses tc filter rules to classify
    traffic by MARK value. Previously, Shorewall used the CLASSIFY
    target in the POSTROUTING chain if it was available.
-
5)  The Shorewall-common installer (install.sh) now works on Windows
    under Cygwin.
-
    To install Shorewall-perl under Cygwin:
-
    $ tar -xf shorewall-perl-4.1.3.tar.bz2
    $ tar -xf shorewall-common-4.1.3.tar.bz2
    $ cd shorewall-perl-4.1.3
    $ ./install.sh
    $ cd ../shorewall-common-4.1.3
    $ USER=<your user id> GROUP=None ./install.sh
    
    The 'shorewall' program is installed in /bin/ (a.k.a, /usr/bin/).
-

2007-11-23 Shorewall 4.0.6

-
Problems corrected in Shorewall-perl 4.0.6.

1)  In a DNAT or REDIRECT rule, if no serverport was given and the DEST
    PORT(S) list contained a service name containing a hyphen ("-") then
    an ERROR was generated.

    Example -- Rules file:

        DNAT    net     loc:$WINDOWS_IP tcp     https,pptp,ms-wbt-server,4125

    Results in:

        ERROR: Invalid port range (ms:wbt:server) : rules (line 49)

    Problem was introduced in Shorewall 4.0.5 and does not occur in
    earlier releases.

2)  If a long destination port list needed to be broken at a port pair,
    the generated rule contained an extra comma which resulted in an
    iptables-restore failure.

3)  Several problems involving port ranges and port lists in REDIRECT
    rules have been corrected.

4)  Shorewall-perl no longer requires an address in the GATEWAY column
    of /etc/shorewall/tunnels. If the column is left empty (or contains
    '-') then 0.0.0.0/0 is assumed.

5)  Previously with Shorewall-perl, redirecting both STDOUT and STDERR
    to the same file descriptor resulted in scrambled output between
    the two. The error messages were often in the middle of the
    regular output far ahead of the point where the error occurred.

    This problem was possible in the Debian Shorewall init script
    (/etc/init.d/shorewall) which redirects output to the
    Debian-specific /var/log/shorewall-init.log file in this way:

        $SRWL $SRWL_OPTS start >> $INITLOG 2>&1 && ...

6)  With both compilers, when HIGH_ROUTE_MARKS=Yes, unpredictable
    results could occur when marking in the PREROUTING or OUTPUT
    chains. When a rule specified a mark value > 255, the compilers
    were using the '--or-mark' operator rather than the '--set-mark'
    operator. Consequently, when a packet matched more than one
    rule, the resulting routing mark was the logical product of the
    mark values in the matching rules rather than the mark value from
    the last matching rule.

    Example:

        0x100   192.168.1.44    0.0.0.0/0
        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25

    A TCP packet from 192.168.1.44 with destination port 25 would have
    a  mark value of 0x300 rather than the expected value of 0x200.

7)  Previously, a 'start -f' on Shorewall Lite would produce the
    following distressing output before starting the firewall:

    make: *** No rule to make target `/firewall', needed by
    `/var/lib/shorewall-lite/restore'.  Stop.

    Furthermore, the Makefile for both Shorewall and Shorewall Lite
    failed to take into account the /etc/shorewall/vardir file.

    This has been corrected. As part of the fix, both /sbin/shorewall
    and /sbin/shorewall-lite support a "show vardir" command that
    displays the VARDIR setting.

8)  Shorewall-perl was previously ignoring the USER/GROUP column of the
    tcrules file.

9)  Supplying the name of a built-in chain in the 'refresh' command
    caused entries in the chain to be duplicated. Since this is a
    feature of iptables-restore with the '-n' option, built-in chains
    in the 'refresh' list will now be rejected.

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in Shorewall 4.0.6.

1)  Shorewall-perl now uses the '--physdev-is-bridged' option when it
    is available. This option will suppress messages like the following:

    kernel: physdev match: using --physdev-out in the OUTPUT, FORWARD and
    POSTROUTING chains for non-bridged traffic is not supported
    anymore.

    This change only affects users who use bport/bport4 zones in a
    briged configuration and requires that capabilities files be
    regenerated using Shorewall-common or Shorewall-lite 4.0.6.

2)  Shorewall-perl now allows you to embed Shell or Perl scripts in
    all configuration files except /etc/shorewall/params and
    /etc/shorewall/shorewall.conf (As always, you can continue to
    include arbitrary shell code in /etc/shorewall/params).

    To embed a one-line script, use one of the following:

        SHELL <shell script>
        PERL <perl script>

    For multi-line scripts, use:

        BEGIN SHELL
        <shell script>
        END SHELL

        BEGIN PERL
        <perl script>
        END PERL

    For SHELL scripts, the output from the script is processed as if it
    were part of the file.

    Example 1 (Shell): To generate SMTP/ACCEPT rules from zones a b c d
    and e to the firewall:

        Either:

            BEGIN SHELL 
            for z in a b c d e; do
                echo SMTP/ACCEPT $z fw tcp 25
            done
            END SHELL

        or

            SHELL for z in a b c d e; do echo SMTP/ACCEPT $z fw tcp 25; done

    Either is equivalent to:

        SMTP/ACCEPT a fw tcp 25
        SMTP/ACCEPT b fw tcp 25
        SMTP/ACCEPT c fw tcp 25
        SMTP/ACCEPT d fw tcp 25
        SMTP/ACCEPT e fw tcp 25

    With a Perl script, if you want to output text to be processed as
    if it were part of the file, then pass the text to the shorewall()
    function.

    Example 2 (Perl): To generate SMTP/ACCEPT rules from zones a b c d
    and e to the firewall:

          BEGIN PERL 
          for ( qw/a b c d e/ ) { 
              shorewall "SMTP/ACCEPT $_ fw tcp 25";
          }
          END PERL

    PERL scripts have access to any context accumulated in earlier PERL
    scripts. All such embedded Perl, as well as conventional Perl
    extension scripts are placed in the Shorewall::User package. That
    way, your global variables and functions won't conflict with any of
    Shorewall's.

    To allow you to load Perl modules and initialize any global state,
    a new 'compile' compile-time extension script has been added. It is
    called early in the compilation process.

    For additional information, see

    - http://www.shorewall.net/configuration_file_basics.html#Embedded

3)  To complement Embedded Perl scripts, Shorewall 4.0.6 allows Perl
    scripts to create filter chains using
    Shorewall::Chains::new_manual_chain() and then use the chain as a
    target in subsequent entries in /etc/shorewall/rules.

    See http://www.shorewall.net/ManualChains.html for information.

4)  The 'hits' command now accepts a -t option which limits the report
    to those log records generated today.

5)  A DONT_LOAD option has been added to shorewall.conf. If there are
    kernel modules that you don't wish to have loaded, you can list
    them in this entry as a comma-separated list.

    Example:

        DONT_LOAD=nf_conntrack_sip,nf_nat_sip

6)  Shorewall-perl now supports the --random option of the iptables
    SNAT, MASQUERADE, DNAT and REDIRECT targets. Please note that
    iptables support for this option is currently broken for the DNAT
    and REDIRECT targets; I've sent a patch to the Netfilter team.

    For MASQUERADE, simply place the word 'random' in the ADDRESS
    column. This causes Netfilter to randomize the source port seen by
    the remote host.

     Example:

        #INTERFACE      SOURCE  ADDRESS
        eth0            eth1    random    

    For SNAT, follow the port list by ":random".

    Example:

        #INTERFACE      SOURCE  ADDRESS
        eth0            eth1    206.124.146.179:10000-10999:random

    For DNAT, follow the port list by ":random".

    Example:

        #ACTION SOURCE  DEST                            PROTO   DEST
        #                                               PORT(S)
        DNAT    net     loc:192.168.1.4:40-50:random    tcp     22

    For REDIRECT, you must use the fully-qualified form of the DEST:

        #ACTION   SOURCE        DEST                    PROTO   DEST
        #                                               PORT(S)
        REDIRECT        net     $FW::40-50:random       tcp     22

    Note that ':random' is only effective with SNAT, DNAT and REDIRECT
    when a port range is specified in the ADDRESS/DEST column. It is
    ignored by iptables/iptables-restore otherwise.
-
-

2007-10-22 Shorewall 4.0.5

-
Problems corrected in Shorewall 4.0.5.

1)  Previously, Shorewall-perl misprocessed $FW::<port> in the DEST
    column of a REDIRECT rule, generating an error. '$FW::<port>' now
    produces the same effect as '<port>'.

2)  If the PROTOCOL (PROTO) column contained 'TCP' or 'UDP' and SOURCE
    PORT(S) or DEST PORT(S) were given, then Shorewall-perl rejected
    the entry with the error:

    ERROR: SOURCE/DEST PORT(S) not allowed with PROTO TCP : /etc/shorewall/rules 

    The rule was accepted if 'tcp' or 'udp' was used instead.

3)  Shorewall-shell now removes any default bindings of ipsets before
    attempting to reload them. Previously, default bindings were not
    removed with the result that the ipsets could not be destroyed.

Other changes in Shorewall 4.0.5.

1)  Two new options have been added to /etc/shorewall/hosts
    (Shorewall-perl only).

    broadcast: Permits limited broadcast (destination 255.255.255.255)
               to the zone.

    destonly: Normally used with the Multi-cast range. Specifies that
              traffic will be sent to the specified net(s) but that 
              no traffic will be received from the net(s).

    Example:

    wifi        eth1:192.168.3.0/24             broadcast
    wifi        eth1:224.0.0.0/4                destonly

    In that example, limited broadcasts from the firewall with a source
    IP in the 192.168.3.0/24 range will be acccepted as will multicasts
    (with any source address).

2)  A MULTICAST option has been added to shorewall.conf. This option
    will normally be set to 'No' (the default). It should be set to 
    'Yes' under the following circumstances:

    a) You have an interface that has parallel zones defined via
       /etc/shorewall/hosts.
    b) You want to forward multicast packets to two or more of those
       parallel zones.

    In such cases, you will configure a 'destonly' network on each 
    zone receiving multicasts.

    The MULTICAST option is only recognized by Shorewall-perl and is
    ignored by Shorewall-shell.

3)  As announced in the Shorewall 4.0.4 release notes, Shorewall-perl
    no longer supports the 'detectnets' option. Specifying that option
    now results in the following message:

    WARNING: Support for the 'detectnets' option has been removed

    It is suggested that 'detectnets' be replaced by
    'routefilter,logmartians'. That will produce the same filtering
    effect as 'detectnets' while eliminating 1-2 rules per connection.

    One user has asked how to retain the output of 'shorewall show
    zones' if the 'detectnets' option is removed. While I don't advise
    doing so, you can reproduce the current 'shorewall show' behavior
    as follows.

    Suppose that you have a zone named 'wifi' that produces the
    following output with 'detectnets':

    wifi (ipv4)
      eth1:192.168.3.0/24
 
    You can reproduce this behavior as follows:

    /etc/shorewall/interfaces:

    -   eth1    detect  ...

    /etc/shorewall/hosts:

    wifi        eth1:192.168.3.0/24     broadcast

    If you send multicast to the 'wifi' zone, you also need this entry
    in your hosts file:

    wifi        eth1:224.0.0.0/4                destonly

4)  (Shorewall-perl only) The server port in a DNAT or REDIRECT rule
    may now be specified as a service name from
    /etc/services. Additionally:

    a) A port-range may be specified as the service port expressed in
       the format <low port>-<high port>. Connections are assigned to
       server ports in round-robin fashion.

    b) The compiler only permits a server port to be specified if the
       protocol is tcp or udp.

    c) The compiler ensures that the server IP address is valid (note
       that it is still not permitted to specify the server address as a
       DNS name).

5)  (Shorewall-perl only) Users are complaining that when they migrate
    to Shorewall-perl, they have to restrict their port lists to 15
    ports. In this release, we relax that restriction on destination
    port lists. Since the SOURCE PORT(s) column in the configuration
    files is rarely used, we have no plans to relax the restriction in
    that column.

6)  There have been several cases where iptables-restore has failed
    while executing a COMMIT command in the .iptables_restore_input
    file. This gives neither the user nor Shorewall support much to go
    on when analyzing the problem. As a new debugging aid, the meaning
    of 'trace' and 'debug' have been changed.

    Traditionally, /sbin/shorewall and /sbin/shorewall-lite have
    allowed either 'trace' or 'debug' as the first run-line
    parameter. Prior to 4.0.5, the two words produced the same effect.

    Beginning with Shorewall 4.0.5, the two words have different
    effects when Shorewall-perl is used.

    trace - Like the previous behavior.

            In the Shorewall-perl compiler, generate a stack trace
            on WARNING and ERROR messages.

            In the generated script, sets the shell's -x option to
            trace execution of the script.

    debug - Ignored by the Shorewall-perl compiler.

            In the generated script, causes the commands in
            .iptables_restore_input to be executed as discrete iptables
            commands. The failing command can thus be identified and a
            diagnosis of the cause can be made.

    Users of Shorewall-lite will see the following change when using a
    script that was compiled with Shorewall-perl 4.0.5 or later.

    trace - In the generated script, sets the shell's -x option to
            trace execution of the script.

    debug - In the generated script, causes the commands in
            .iptables_restore_input to be executed as discrete iptables
            commands. The failing command can thus be identified and a
            diagnosis of the cause can be made.

    In all other cases, 'debug' and 'trace' remain synonymous. In
    particular, users of Shorewall-shell will see no change in
    behavior.

    WARNING: The 'debug' feature in Shorewall-perl is strictly for
    problem analysis. When 'debug' is used:

    a) The firewall is made 'wide open' before the rules are applied.
    b) The routestopped file is not consulted and the rules are applied
       in the canonical iptables-restore order (ASCIIbetical by chain).
       So if you need critical hosts to be always available during
       start/restart, you may not be able to use 'debug'.

7)  /usr/share/shorewall-perl/buildports.pl,
    /usr/share/shorewall-perl/FallbackPorts.pm and 
    /usr/share/shorewall-perl/Shorewall/Ports.pm have been removed.

    Shorewall now resolves protocol and port names as using Perl's
    interface to the the standard C library APIs getprotobyname() and
    getservbyname().

    Note 1: 

           The protocol names 'tcp', 'TCP', 'udp', 'UDP', 'all', 'ALL',
           'icmp' and 'ICMP' are still resolved by Shorewall-perl
           itself.

    Note 2:

           Those of you running Shorewall-perl under Cygwin may wish to
           install "real" /etc/protocols and /etc/services files
           in place of the symbolic links installed by Cygwin.

8)  The contents of the Shorewall::*::$VERSION variables are now a
    only of interest for Perl programs that are using the modules and
    specifying a minimum version (e.g., "use Shorewall::Config
    4.0.5;"). Each module continues to carry a separate version which
    indicates the release of Shorewall-perl when the module was last
    modified
-
-

2007-10-02 Shorewall 3.4.7

-
Problems Corrected in Shorewall 3.4.7

1)  A bug prevented proper handling of PREROUTING marks when
    HIGH_ROUTE_MARKS=No and the track option was specified in
    /etc/shorewall/providers.

2) Previously, if the following sequence of routing rules was
   specified, then the first rule would always be omitted.

   #SOURCE    DEST      PROVIDER     PRIORITY
   $SRC_A     $DESTIP1  ISP1         1000
   $SRC_A     $DESTIP2  SOMEISP      1000
   $SRC_A     -         ISP2         1000

   The reason for this omission was that Shorewall uses a
   delete-before-add approach and attempting to delete the third rule
   resulted in the deletion of the first one instead. 

   This problem occurred with both compilers.

3) When using Shorewall-shell, provider numbers were not recognized in
   the PROVIDER column of /etc/shorewall/route_rules.
-
-

2007-09-28 Shorewall 4.0.4

-
Problems Corrected in Shorewall 4.0.4

1)  If no interface had the 'blacklist' option, then when using
    Shorewall-perl, the 'start' and 'restart' command failed:

        ERROR: No filter chain found with name blacklst

    New Shorewall-perl 4.0.3 packages were released that corrected this
    problem; it is included here for completeness.

2)  If no interface had the 'blacklist' option, then when using
    Shorewall-perl, the generated script would issue this harmless
    message during 'shorewall refresh':

        chainlist_reload: Not found

3)  If /bin/sh was a light-weight shell such as ash or dash, then
    'shorewall refresh' failed.

4)  During start/restart, the script generated by Shorewall-perl was
    clearing the proxy_arp flag on all interfaces; that is not the
    documented behavior.

5)  If the module-init-tools package was not installed and
    /etc/shorewall/modules did not exist or was non-empty, then
    Shorewall-perl would fail with the message:

       ERROR: Can't run lsmod : /etc/shorewall/modules (line 0)

6)  Shorewall-perl now makes a compile-time check to insure that
    iptables-restore exists and is executable. This check is made when
    the compiler is being run by root and the -e option is not
    given.

    Note that iptables-restore must reside in the same directory as the
    iptables executable specified by IPTABLES in shorewall.conf or
    located by the PATH in the event that IPTABLES is not specified.

7)  When using Shorewall-perl, if an action was invoked with more than
    10 different combinations of log-levels/tags, some of those
    invocations would have incorrect logging.

8)  Previously, when 'shorewall restore' was executed, the
    iptables-restore utility was always located using the PATH setting
    rather than the IPTABLES setting.

    With Shorewall-perl, the IPTABLES setting is now used to locate
    this utility during 'restore' as it is during the processing of
    other commands.

9)  Although the shorewall.conf manpage indicates that the value
    'internal' is allowed for TC_ENABLED, that value was previously
    rejected ('Internal' was accepted).

10) The meaning of the 'loose' provider option was accidentally reversed
    in Shorewall-perl. Rather than causing certain routing rules to be
    omitted when specified, it actually caused them to be added (these
    rules were omitted when the option was NOT specified).

11) If the 'bridge' option was specified on an interface but there were
    no bport zones, then traffic originating on the firewall was not
    passed through the accounting chain.

12) In commands such as:

       shorewall compile <directory>
       shorewall restart <directory>
       shorewall check <directory>

    if the name of the <directory> contained a period ("."), then
    Shorewall-perl would incorrectly substitute the current working
    directory for the name.

13) Previously, if the following sequence of routing rules was
    specified, then the first rule would always be omitted.

    #SOURCE    DEST      PROVIDER     PRIORITY
    $SRC_A     $DESTIP1  ISP1         1000
    $SRC_A     $DESTIP2  SOMEISP      1000
    $SRC_A     -         ISP2         1000

    The reason for this omission was that Shorewall uses a
    delete-before-add approach and attempting to delete the third rule
    resulted in the deletion of the first one instead. 

    This problem occurred with both compilers.

14) When using Shorewall-shell, provider numbers were not recognized in
    the PROVIDER column of /etc/shorewall/route_rules.

15) An off-by-one problem in Shorewall-perl caused the value 255 to be
    rejected in the MARK column of /etc/shorewall/tcclasses.

16) When HIGH_ROUTE_MARKS=Yes, marks with values > 255 must be a
    multiple of 256. That restriction was being enforced by
    Shorewall-shell but not by Shorewall-perl. Shorewall-perl now also
    enforces this restriction.

17) Using REDIRECT with a parameterized macro (e.g., DNS/REDIRECT)
    failed with an "Unknown interface" error when using Shorewall-perl.

Other Changes in Shorewall 4.0.4

1)  The detection of 'Repeat Match' has been improved. 'Repeat Match'
    is not a match at all but rather is a feature of recent versions of
    iptables that allows a particular match to be used multiple times
    within a single rule.

    Example:

      -A foo -m physdev --physdev-in eth0 -m physdev --physdev-out ...

    When using Shorewall-shell, the availability of 'Repeat Match' can
    speed up compilation very slightly.

2)  Apparently recent Fedora releases are broken. The
    following sequence of commands demonstrates the problem:

    ip rule add from 1.1.1.1 to 10.0.0.0/8 priority 1000 table 5
    ip rule add from 1.1.1.1 to 0.0.0.0/0 priority 1000 table main
    ip rule del from 1.1.1.1 to 0.0.0.0/0 priority 1000

    The third command should fail but doesn't; instead, it incorrectly
    removes the rule added by the first command.
    To work around this issue, you can set DELETE_THEN_ADD=No in
    shorewall.conf which prevents Shorewall from deleting ip rules
    before attempting to add a similar rule.

3)  When using Shorewall-perl, the following message is now issued if
    the 'detectnets' option is specified in /etc/shorewall/interfaces:

    WARNING: Support for the 'detectnets' option will be removed from
    Shorewall-perl in version 4.0.5; better to use 'routefilter' and
    'logmartians

    The 'detect' options has always been rather silly. On input, it
    duplicates the function of 'routefilter'. On output, it is a no-op
    since traffic that doesn't match a route out of an interface won't
    be sent through that interface (duh!).

    Beginning with Shorewall 4.0.5, the warning message will read:

    WARNING: Support for the 'detectnets' option has been removed
-
-

2007-09-01 Shorewall 4.0.3

-
Problems Corrected in 4.0.3

1) Using the LOG target in the rules file could result in two LOG
   rules being generated by Shorewall-shell. Additionally, using an IP
   address range in a rule that performed logging could result in an
   invalid iptables command.

2)  Shorewall now loads the act_police kernel module needed by traffic
    shaping.

3)  Previously, "shorewall show -f capabilities" and "shorecap" omitted
    the "TCPMSS Match" capability. This made it appear to a compiler
    using a capabilities file that the TCPMSS Match capability was not
    available.

4)  Previously, Shorewall would truncate long log prefixes to 29
    characters. This resulted in there being no space between the log
    prefix and the IN= part of the message.

    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0

    Beginning with this release, Shorewall will truncate the prefix to
    28 bytes and add a trailing space.

    Example: fw2net:LOG:HTTPSou IN= OUT=eth0

5)  Previously, if:

    - FASTACCEPT=No
    - The policy from Z1 to Z2 was CONTINUE
    - Neither Z1 nor Z2 had parent zones
    - There were no Z1->Z2 rules

    then connections from Z2->Z1 would fail even if there were
    rules/policies allowing them. This has been
    corrected.

6)  The 'shorewall add' and 'shorewall delete' command would fail when:

    - The running configuration was compiled with Shorewall-perl.
    - The name of the interface specified in the command contained an
      embedded special character such as '.' or '-'.

    This problem was the result of the change in Shorewall 4.0.2 that
    removed the legacy mapping of interface names when embedding such
    names in a Netfilter chain name. To correct the problem, the
    pre-4.0.2 name mapping is restored when DYNAMIC_ZONES=Yes.

5)  A bug in Shorewall-shell prevented proper handling of PREROUTING
    marks when HIGH_ROUTE_MARKS=No and the track option was specified
    in /etc/shorewall/providers.

6)  With Shorewall-perl, if EXPORTPARAMS=Yes then INCLUDE directives in
    the params file would fail at script execution time with "INCLUDE:
    not found". This has been corrected.

7)  Shorewall-perl was mis-sorting the zone list when zones were nested
    more than one deep.

8)  Stale references to http://www.shorewall.net/Documentation.htm have
    been removed from the config files (including samples). That URL
    has been replaced by the online manpages.

Other Changes in 4.0.3

1)  A script generated by Shorewall-perl now tries to modify/restore
    /etc/iproute2/rt_tables only if the file is writable. This prevents
    run-time errors when /etc is mounted read-only.
  
    A new KEEP_RT_TABLES option has been added to shorewall.conf. When
    set to Yes, this option prevents Shorewall from altering the
    /etc/iproute2/rt_tables database. The KEEP_RT_TABLES option is only
    recognized by Shorewall-perl and is ignored by Shorewall-shell.

2)  Shorewall-perl now requires the FindBin Perl module.

3)  When an optional provider is not available, a script generated by
    Shorewall-perl will no longer add the corresponding
    routing rules.

4)  A new 'isusable' extension script has been added. This script
    allows you to extend the availability test that Shorewall performs
    on optional providers.

    Here's an example that uses ping to ensure that the default
    gateways through eth0 and eth1 are reachable:

    case $1 in
        eth0)
            ping -c 4 -I eth0 206.124.146.254 > /dev/null 2>&1
            return
           ;;
        eth1)
            ping -c 4 -I eth1 192.168.12.254 > /dev/null 2>&1
            return
            ;;
        *)
            # Assume we don't need to do any additional testing
            # for this interface beyond Shorewall's
            return 0
            ;;
    esac

    Additional information is available at
    http://www.shorewall.net/shorewall_extension_scripts.htm.

5)  Processing of the message log in the 'show log', 'logwatch' and
    'dump' commands has been speeded up thanks to a suggestion by
    Andrew Suffield.

6)  Beginning with Shorewall 4.0, the shorewall 'stop', and 'clear'
    commands were processed by the generated script from the
    last successful 'start', 'restart' or 'refresh' command. This had
    the side effect that updates to the /etc/shorewall/routestopped
    file did not take effect until one of those three commands was
    successfully processed.

    Beginning with Shorewall 4.0.3, the old 3.x behavior is restored as
    the default and the 4.0 behavior is enabled using the '-f' command
    option.

    Example: shorewall stop -f

    is only recognized by Shorewall-perl and causes Shorewall to set
    the MSS field in forwarded TCP SYN packets going in or out the
    interface to the value that you specify.

    Example:

    #ZONE       INTERFACE       BROADCAST       OPTIONS
    vpn         ppp0            -               mss=1400

    The mss option only affects incoming traffic that has not been
    decrypted by IPSEC and outgoing traffic that will not subsequently
    be encrypted by IPSEC. The MSS for IPSEC traffic is managed by the
    'mss' option in /etc/shorewall/zones.

8)  Shorewall now detects the presence of the 'hashlimit match'
    capability. There is no builtin support yet for hashlimit but
    detection allows extension scripts for user-supplied actions to
    determine if the capability exists.

    With Shorewall-shell, $HASHLIMIT_MATCH will be non-empty if the
    capability exists.

    With Shorewall-perl, $capabilities{HASHLIMIT_MATCH} will be true in
    a boolean context if the capability exists. Shorewall-perl users
    may also code the following in their extension script:

    use Shorewall::Config;

    require_capability( 'HASHLIMIT_MATCH',      #Capability
                        'My hashlimit action' , #Feature requiring 
                                                #capability
                        's' );                  #Feature is singular
                                                #(if plural, pass the
                                                  empty string)

    That call would procduce the following fatal error if the
    capability isn't available:

    ERROR: My hashlimit action requires the Hashlimit match capability
           in your kernel and iptables

9)  NFQUEUE support has been added to Shorewall-perl.

    NFQUEUE may appear in actions, macros, rules and as a policy.
    When NFQUEUE is used by itself, queue number zero is assumed. To
    specify a queue number, follow NFQUEUE by a slash ("/") and the
    queue number.

    Examples (/etc/shorewall/rules):

    NFQUEUE             loc     net     tcp #Queue number 0
    NFQUEUE/22          loc     net     udp #Queue number 22
    NFQUEUE/22:info     loc     net     gre #With logging

    An NFQUEUE_DEFAULT option has been added to shorewall.conf for
    specifying the default action to use with NFQUEUE policies.

    Use of NFQUEUE requires the NFQUEUE Target capability in your
    kernel/iptables. If you intend to use NFQUEUE with Shorewall-lite,
    then you must install Shorewall-lite 4.0.3 in order to build a
    capabilities file that includes NFQUEUE Target. If your
    capabilities file was generated by a Shorewall/Shorewall-lite
    version earlier that 4.0.3, you will receive a warning during
    compilation.

10) The 'refresh' command can now refresh chains other than 'blacklst'.

    The syntax of the command is now:

        shorewall refresh [ <chain> ... ]

    If no <chain> is given then 'blacklst' is assumed. Otherwise, the
    Shorewall-perl compiler compiles a script whose 'refresh' command
    refreshes the listed <chain>(s).

    The listed chains are assumed to be in the filter table. You can
    refresh chains in other tables by prefixing the chain name with the
    table name followed by ":" (e.g., nat:net_dnat). Chain names which
    follow are assumed to be in that table until the end of the list or
    until an entry in the list names another table.

    This feature requires Shorewall-perl 4.0.3 as well as
    Shorewall-common 4.0.3.
-
-

2007-08-19 Shorewall 3.4.6

-
Problems Corrected in 3.4.6.

1)  If the "Mangle FORWARD Chain" capability was supported, entries in
    the /etc/shorewall/ecn file would cause invalid iptables
    commands to be generated.

2)  Certain errors occurring during
    start/restart/safe-start/safe-restart/try processing could cause
    the lockfile to be left behind. This resulted in a 60-second delay
    the next time one of these commands was run.

3)  It was not previously possible to define traffic shaping on a
    bridge port; the generated script complained that the
    interface was not up and configured.

4)  Previously, using a port list in the DEST PORT(S) column of the
    rules file or in an action file caused an invalid iptables command
    to be generated.

5)  Using the LOG target in the rules file could result in two LOG
    rules being generated. Additionally, using an IP address range in a
    rule that performed logging could result in an invalid iptables
    command.

6)  Shorewall now loads the act_police kernel module needed by traffic
    shaping.

7)  Previously, "shorewall show -f capabilities" and "shorecap" omitted
    the "TCPMSS Match" capability. This made it appear to a compiler
    using a capabilities file that the TCPMSS Match capability was not
    available.

8)  Previously, Shorewall would truncate long log prefixes to 29
    characters. This resulted in there being no space between the log
    prefix and the IN= part of the message.

    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0

    Beginning with this release, Shorewall will truncate the prefix to
    28 bytes and add a trailing space.

    Example: fw2net:LOG:HTTPSou IN= OUT=eth0

9)  Previously, if:

    - FASTACCEPT=No
    - The policy from Z1 to Z2 was CONTINUE
    - Z1 and Z2 were orphans (neither had parent zones)
    - There were no Z1->Z2 rules

    then connections from Z2->Z1 would fail even if there were
    rules/policies allowing them. This has been
    corrected. 
    
Other changes in 3.4.6.

1)  Processing of the message log in the 'show log', 'logwatch' and
    'dump' commands has been speeded up thanks to a suggestion by
    Andrew Suffield.
-
-

2007-08-10 Shorewall 4.0.2

-
Problems corrected in 4.0.2

1)  The Shorewall-perl compiler was still generating invalid
    iptables-restore input from entries in /etc/shorewall/ecn.

2)  When using Shorewall-perl, unless an interface was specified as
    'optional' in the interfaces file, the 'restore' command would
    fail if the routes through the interface or the addresses on the
    interface could not be detected.

    Route detection occurs when the interface is named in the SOURCE
    column of the masq file. Address detection occurs when
    DETECT_DNAT_IPADDRS=Yes and the interface is the SOURCE for a DNAT
    or REDIRECT rule or when 'maclist' is specified for the interface.
   
    Since the 'restore' command doesn't use the detected information,
    detection is now skipped if the command is 'restore'.

3)  It was not previously possible to define traffic shaping on a
    bridge port; the generated script complained that the
    interface was not up and configured.

4)  When Shorewall-shell was not installed, certain options in
    /etc/shorewall/interfaces and /etc/shorewall/hosts would cause the
    'add' and 'delete' commands to fail with a missing library error.

          OPTION               FILE
          maclist              interfaces,hosts
          proxyarp             interfaces

5)  The /var/lib/shorewall/zones file was being overwritten during
    processing of the 'refresh' command by a script generated with
    Shorewall-perl. The result was that hosts previously added to
    dynamic zones could not be deleted after the 'refresh'.

6)  If the file named as the output file in a Shorewall-perl 'compile'
    command was a symbolic link, the generated error message
    erroneously stated that the file's parent directory was a symbolic
    link.

    As part of this change, cosmetic changes were made to a number of
    other error messages.

7)  Some intra-zone rules were missing when a zone involved multiple
    interfaces or when a zone included both IPSEC and non-IPSEC
    networks.

8)  Shorewall was not previously loading the xt_multiport kernel
    module.

9)  The Russian and French translations no longer have English headings
    on notes, cautions, etc..

10) Previously, using a port list in the DEST PORT(S) column of the
    rules file or in an action file could cause an invalid iptables
    command to be generated by Shorewall-shell.

11) If there were no bridges in a configuration, Shorewall-perl would
    ignore the CHAIN column in /etc/shorewall/accounting.

Other changes in 4.0.2

1)  Shorewall-perl now detects when a port range is included in a list
    of ports and iptables/kernel support for Extended Multi-port Match
    is not available. This avoids an iptables-restore failure at
    run-time.

2)  Most chains created by Shorewall-shell have names that can be
    embedded within shell variable names. This is a workaround for
    limitations in the shell programming language which has no
    equivalent to Perl hashes. Often chain names must have the name of
    a network interface encoded in them. Given that interface names can
    contain characters that are invalid in a shell variable name,
    Shorewall-shell performs a name mapping which was carried forward to
    Shorewall-perl:

    - Trailing '+' is dropped.
    - The characters ".", "-", "%' and "@" are translated to "_".

    This mapping has been elminated in the 4.0.2 release of Shorewall-
    perl. So where before you would see chain "eth0_0_in", you may now
    see the same chain named "eth0.0_in". Similarly, a chain previously
    named "ppp_fwd" may now be called "ppp+_fwd".

3)  Shorewall-perl now uses the contents of the BROADCAST column in
    /etc/shorewall/interfaces when the Address Type match capability is
    not available.
-
-

2007-07-30 Shorewall 4.0.1

-
Problems corrected in 4.0.1.

1)  The Shorewall Lite installer was producing an empty shorewall-lite
    manpage. Since the installer runs as part of creating the RPM, the
    RPM also suffered from this problem. The 4.0.0 Shorewall-lite 
    packages were re-uploaded with this problem corrected.

2)  The Shorewall Lite uninstaller incorrectly removed /sbin/shorewall
    rather than /sbin/shorewall-lite.

3)  Both the Shorewall and Shorewall Lite uninstallers did a "shorewall
    clear" if Shorewall [Lite] was running. Now, the Shorewall Lite
    uninstaller correctly does "shorewall-lite clear" and both
    uninstallers only perform the 'clear' operation if the other
    product is not installed. This prevents the removal of one of the
    two products from clearing the firewall configuration established
    by the other one.

4)  The 'ipsec' OPTION in /etc/shorewall/hosts was mis-handled by
    Shorewall-perl. If the zone type was changed to 'ipsec' or
    'ipsec4' and the 'ipsec' option removed from the hosts file entry,
    the configuration worked properly.

5)  If a CLASSID was specified in a tcrule and TC_ENABLED=No, then
    Shorewall-perl produced the following:

    Compiling...
    Use of uninitialized value in string ne at /usr/share/shorewall-perl/Shorewall/Tc.pm line 285, <$currentfile> line 18.
       ERROR: Class Id n:m is not associated with device eth0 : /etc/shorewall/tcrules (line 18)

6)  If IPTABLES was not specified in shorewall.conf, Shorewall-perl was
    locating the binary using the PATH environmental variable rather
    than the PATH setting in shorewall.conf.  If no PATH was available
    when Shorewall-perl was run and IPTABLES was not set in
    shorewall.conf, the following messages were issued:

    Use of uninitialized value in split at /usr/share/shorewall-perl/Shorewall/Config.pm line 1054.
       ERROR: Can't find iptables executable
       ERROR: Shorewall restart failed

7)  If the "Mangle FORWARD Chain" capability was supported, entries in
    the /etc/shorewall/ecn file would cause invalid iptables commands
    to be generated. This problem occurred with both compilers.

8)  Shorewall now starts at reboot after an upgrade from shorewall <
    4.0.0. Previously, Shorewall was not started automatically at
    reboot after an upgrade using the RPMs.

9)  Shorewall-perl was generating invalid iptables-restore input when a
    log level was specified with the dropBcast and allowBcast builtin
    actions and when a log level followed by '!' was used with any
    builtin actions.

10) Shorewall-perl was incorrectly rejecting 'min' as a valid unit of
    time in rate-limiting specifications.

11) Certain errors occurring during
    start/restart/safe-start/safe-restart/try processing could cause
    the lockfile to be left behind. This resulted in a 60-second delay
    the next time one of these commands was run.

Other changes in Shorewall 4.0.1.

1)  A new EXPAND_POLICIES option is added to shorewall.conf. The
    option is recognized by Shorewall-perl and is ignored by
    Shorewall-shell.

    Normally, when the SOURCE or DEST columns in shorewall-policy(5)
    contains 'all', a single policy chain is created and the policy is
    enforced in that chain. For example, if the policy entry is

             #SOURCE DEST POLICY LOG
             #                   LEVEL
             net     all  DROP   info

    then the chain name is 'net2all' which is also the chain named in
    Shorewall log messages generated as a result of the policy. If
    EXPAND_POLICIES=Yes, then Shorewall-perl will create a separate
    chain for each pair of zones covered by the policy. This makes the
    resulting log messages easier to interpret since the chain in the
    messages will have a name of the form 'a2b' where 'a' is the SOURCE
    zone and 'b' is the DEST zone. See
    http://linuxman.wikispaces.com/PPPPPPS for more information.

2)  The Shorewall-perl dependency on the "Address Type Match"
    capability has been relaxed. This allows Shorewall 4.0.1 to be used
    on releases like RHEL4 that don't support that capability.

3)  Shorewall-perl now detects dead policy file entries that result
    when an entry is masked by an earlier entry. Example:

         all     all      REJECT    info
         loc     net      ACCEPT

4)  Recent kernels are apparently hard to configure and we have been
    seeing a lot of problem reports where the root cause is the lack of
    state match support in the kernel. This problem is difficult to
    diagnose when using Shorewall-perl so the generated shell program
    now checks specifically for this problem and terminates with an
    error if the capability doesn't exist.
-
-

2007-07-20 Shorewall 4.0.0

-
----------------------------------------------------------------------------
                   R E L E A S E  H I G H L I G H T S
----------------------------------------------------------------------------
1) This is the first Shorewall release that fully integrates the new
   Shorewall-perl compiler. See the "New Features" section below.

2) You are now offered a choice as to which compiler(s) you install. In
   4.0.0, there are the following packages:

   - Shorewall-common ( common files )
   - Shorewall-shell ( the shell-based compiler )
   - Shorewall-perl (the Perl-based compiler )

   You must install at least one of the compiler packages (you may
   install them both) along with Shorewall-common.

   YOU DO NOT NEED TO UNINSTALL ANY OF YOUR CURRENT PACKAGES.

   See the Migration Considerations below for further information.

3) The facilities for supporting bridge/firewalls under earlier
   releases are deprecated and their documentation is omitted from the
   4.0 distribution. New bridge support is implemented in the
   Shorewall-perl compiler. This support utilizes the reduced-function
   physdev match support available in Linux kernel 2.6.20 and later.

Problems corrected in 4.0.0 Final.

1)  The shorewall-lite install.sh may now be run multiple times from
    the same directory. Previously, the manpages were gzipped in-place
    which made it impossible to rerun the script.

2)  If shorewall.conf contained SHOREWALL_COMPILER=shell (which it can
    on Shorewall 3.4.2-4 systems) and the shorewall-shell RPM was
    removed, subsequent "shorewall [re]start" operations failed. When
    shorewall-shell is removed, the shorewall.conf file is modified to
    specify SHOREWALL_COMPILER= and the original is saved in
    shorewall.conf.rpmsave.

3)  The contents of the LOG LEVEL column in /etc/shorewall/policy are
    now validated at compile time by Shorewall-perl.

Other changes in Shorewall 4.0.0 Final.

1)  The Perl modules in /usr/share/shorewall-perl/Shorewall/ have been
    consolidated somewhat, leading to slightly faster compilation.

Migration Considerations:

1)  Beginning with Shorewall 4.0.0, there is no single 'shorewall'
    package. Rather there are two compiler packages (shorewall-shell
    and shorewall-perl) and a set of base files (shorewall-common)
    which are required by either compiler package.

    Although the names of the packages are changing, you can upgrade
    without having to uninstall/reinstall.

    To repeat: YOU DO NOT NEED TO UNINSTALL ANY EXISTING PACKAGE.

    If you attempt to upgrade using the shorewall-common RPM, you get
    this result:
    gateway:~ # rpm -Uvh shorewall-common-4.0.0.noarch.rpm 
    error: Failed dependencies:
        shorewall_compiler is needed by shorewall-common-4.0.0-1.noarch
    gateway:~ #

    You must either:

        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \
            shorewall-common-4.0.0.noarch.rpm

    or

        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \
            shorewall-perl-4.0.0.noarch.rpm \
            shorewall-common-4.0.0.noarch.rpm

    If you don't want to use shorewall-perl exclusively then use the
    second command above then

        rpm -e shorewall-shell
 
    If you are upgrading using the tarball, you must install 
    shorewall-shell and/or shorewall-perl before you upgrade
    using shorewall-common. Otherwise, the install.sh script fails with:

         ERROR: No Shorewall compiler is installed

    The shorewall-shell and shorewall-perl packages are installed from
    the tarball in the expected way; untar the package, and run the
    install.sh script.

    Example 1: You have 'shorewall' installed and you want to continue
    to use the shorewall-shell compiler.

        tar -jxf shorewall-common-4.0.0.tar.bz2
        tar -jxf shorewall-shell-4.0.0.tar.bz2

        cd shorewall-shell-4.0.0
        ./install.sh
        cd ../shorewall-common-4.0.0
        ./install.sh
        shorewall check
        shorewall restart

    Example 2: You have shorewall 3.4.4 and shorewall-perl 4.0.0-Beta7
    installed and you want to upgrade to 4.0. You do not need the
    shell-based compiler.

        tar -jxf shorewall-common-4.0.0.tar.bz2
        tar -jxf shorewall-perl-4.0.0.tar.bz2

        cd shorewall-perl-4.0.0
        ./install.sh
        cd ../shorewall-common-4.0.0
        ./install.sh
        shorewall check
        shorewall restart

        Be sure to modify shorewall.conf if it still has
        SHOREWALL_COMPILER=shell.

2)  The ROUTE_FILTER and LOG_MARTIANS options in shorewall.conf work
    slightly differently in Shorewall 4.0.0. In prior releases, leaving
    these options empty was equivalent to setting them to 'No' which
    caused the corresponding flag in /proc to be reset for all
    interfaces. Beginning in Shorewall 4.0.0, leaving these options
    empty causes Shorewall to leave the flags in /proc as they are. You
    must set the option to 'No' in order to obtain the old behavior.

3)  The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.

    If you plan on continuing to use Shorewall-shell and you want to
    use the "-f" option at boot time, then you must add the following
    to /etc/sysconfig/shorewall or /etc/default/shorewall:

       OPTIONS="-f"

    If you currently have neither of those files, you will need to
    create one of them. 

4)  This issue will only affect you if you use Shorewall Lite and have
    modified /usr/share/configpath to specify a different LITEDIR.

    The implementation of LITEDIR has always been
    unsatisfactory. Furthermore, there have been other cases where
    people have asked to be able to designate the state directory
    (default /var/lib/shorewall[-lite]).

    To meet these objectives:

    a)  The LITEDIR variable has been eliminated in
        /usr/share/shorewall[-lite]/configpath.

    b)  A new file /etc/shorewall[-lite]/vardir has been added. This
        file is not created by default but may be added as needed. It
        is expected to contain a single variable assignment:

           VARDIR=<directory>

        Example:

           VARDIR=/root/shorewall
    
    To change VARDIR, copy the old directory to the new one before you
    restart Shorewall[-lite].

    To use this feature with Shorewall-lite, all packages involved
    (compiler, shorewall-common and shorewall-lite) must be version
    4.0.0-RC2 or later.

----------------------------------------------------------------------------
                         N E W  F E A T U R E S
----------------------------------------------------------------------------
1)  Shorewall-perl

    This Shorewall package includes a complete rewrite of the compiler
    in Perl.

    I decided to make Shorewall-perl a separate package for several reasons:

    a) Embedded applications are unlikely to adopt Shorewall-perl; even
       Mini-Perl has a substantial disk and RAM footprint.

    b) Because of the gross incompatibilities between the new compiler and the
       old (see below), migration to the new compiler must be voluntary.
    ------------------------------------------------------------------------
                      T H E   G O O D   N E W S:
    ------------------------------------------------------------------------
    a) The compiler has a small disk footprint.
    b) The compiler is very fast.
    c) The compiler generates a firewall script that uses iptables-restore;
       so the script is very fast.
    d) The new compiler does a much better job of validating the
       configuration and catches many errors that resulted in run-time
       failures with the old compiler.
    e) Use of the Shorewall-perl is optional! The old slow clunky
       Bourne-shell compiler is still available.
    ------------------------------------------------------------------------
                      T H E   B A D   N E W S:
    ------------------------------------------------------------------------
    There are a number of incompatibilities between the Perl-based compiler
    and the Bourne-shell one.

    a) The Perl-based compiler requires the following capabilities in your
       kernel and iptables.

       - addrtype match
       - multiport match

       These capabilities are in current distributions.

    b) Now that Netfilter has features to deal reasonably with port lists,
       I see no reason to duplicate those features in Shorewall. The
       Bourne-shell compiler goes to great pain (in some cases) to
       break very long port lists ( > 15 where port ranges in lists
       count as two ports) into individual rules. In the new compiler, I'm
       avoiding the ugliness required to do that. The new compiler just
       generates an error if your list is too long. It will also produce
       an error if you insert a port range into a port list and you don't
       have extended multiport support.

    c) The old BRIDGING=Yes support has been replaced by new bridge
       support that uses the reduced 'physdev match' capabilities found
       in kernel 2.6.20 and later. This new implementation may be used
       where it is desired to control traffic through a bridge.

       The new implementation includes the following features:

       a)  A new "Bridge Port" zone type is defined. Specify 'bport' or
           'bport4' in the TYPE column of /etc/shorewall/zones.

           Bridge Port zones should be a sub-zone of a regular ipv4 zone
           that represents all hosts attached to the bridge.

       b)  A new 'bridge' option is defined for entries in      
           /etc/shorewall/interfaces. Bridges should have this option
           specified, even if you don't want to filter traffic going
           through the bridge.

       c)  Bridge ports must now be defined in
           /etc/shorewall/interfaces. The INTERFACE column contains
           both the bridge name and the port name separated by a colon
           (e.g., "br0:eth1"). No OPTIONS are allowed for bridge
           ports. The bridge must be defined before its ports and must
           have the 'bridge' option.

       Bridge Port (BP) zones have a number of limitations:

       a)  Each BP zone may only be associated with ports on a single
           bridge.

       b)  BP zones may not be associated with interfaces that are not
           bridge ports.

       c)  You may not have policies or rules where the DEST is a BP
           zone but the source is not a BP zone. If you need such
           rules, you must use the BP zone's parent zone as the DEST
           zone.

       Example (Bridge br0 with ports eth1 and tap0):

       /etc/shorewall/zones:

        fw      firewall
        net     ipv4
        loc     ipv4
        lan:loc bport
        vpn:loc bport

       /etc/shorewall/interfaces:

        net     eth0    -       ...
        loc     br0     -       ...
        lan     eth1
        vpn     tap0

       When using the /etc/shorewall/hosts file to define a bport4
       zone, you specify only the port name:

       Example:

       /etc/shorewall/zones:

        fw      firewall
        net     ipv4
        loc     ipv4
        lan:loc bport
        vpn:loc bport

       /etc/shorewall/hosts

        lan     eth1:192.168.2.0/24     ...

       The structure of the accounting rules changes slightly when
       there are bridges defined in the Shorewall
       configuration. Because of the restrictions imposed by Netfilter
       in kernel 2.6.21 and later, output accounting rules must be
       segregated from forwarding and input rules.

       To accomplish this separation, Shorewall-perl creates two
       accounting chains:

       - accounting - for input and forwarded traffic.
       - accountout - for output traffic.

       If the CHAIN column contains '-', then:

       - If the SOURCE column in a rule includes the name of the
         firewall zone (e.g., $FW), then the rule is add only
         to the accountout chain.

       - Otherwise, if the DEST in the rule is any or all or 0.0.0.0/0,
         then the rule is added to both accounting and accountout.

       - Otherwise, the rule is added to accounting only.

       See http://www.shorewall.net/bridge-Shorewall-perl.html for
       additional information about the new bridge support.     

    d) The BROADCAST column in the interfaces file is essentially unused;
       if you enter anything in this column but '-' or 'detect', you will
       receive a warning.

    e) Because the compiler is written in Perl, some of your extension
       scripts from earlier versions will no longer work because
       Shorewall-perl runs those extension scripts at compile-time rather
       than at run-time. 

       Compile-time scripts are:

           initdone
           maclog
           All per-chain scripts including those associated with actions.

       Compile-time extension scripts are executed using the Perl 'eval
       `cat <file>`' mechanism. Be sure that each script returns a
       'true' value; otherwise, the compiler will assume that the
       script failed and will abort the compilation.

       All scripts will need to begin with the following line:

           use Shorewall::Chains;

       For more complex scripts, you may need to 'use' other Shorewall
       Perl modules -- browse /usr/share/shorewall-perl/Shorewall/ to
       see what's available.

       When a script is invoked, the $chainref scalar variable will hold a
       reference to a chain table entry. 

           $chainref->{name}  contains the name of the chain
           $chainref->{table} holds the table name
       
           To add a rule to the chain:

              add_rule( $chainref, <the rule> );

           Where

              <the rule> is a scalar argument holding the rule text. Do
              not include "-A <chain name>"

           Example:

              add_rule( $chainref, '-j ACCEPT' );

           To insert a rule into the chain:

              insert_rule( $chainref, <rulenum>, <the rule> );

           The log_rule_limit function works like it does in the shell
           compiler with two exceptions:

              - You pass the chain reference rather than the name of
                the chain.
              - The commands are 'add' and 'insert' rather than '-A'
                and '-I'.
              - There is only a single "pass as-is to iptables"
                argument (so you must quote that part).

           Example:

              log_rule_limit(
                             'info' , 
                              $chainref ,            
                              $chainref->{name},
                              'DROP' , 
                              '',      #Limit
                              '' ,     #Log tag
                              'add',   #Command
                              '-p tcp' #Pass as-is
                             );

       Note that in the 'initdone' script, there is no default chain
       ($chainref). You can objtain a reference to a standard chain by:

           my $chainref = $chain_table{<table>}{<chain name>};

       Example:

           my $chainref = $chain_table{'filter'}{'INPUT'};

       The continue script is eliminated. That script was designed to
       allow you to add special rules during [re]start. Shorewall-perl
       doesn't need such rules.

       See http://www.shorewall.net/shorewall_extension_scripts.htm
       for further information about extension scripts under
       Shorewall-perl.

    f) The 'refresh' command now works like 'restart' with the
       following exceptions:

       - The refresh command is rejected if Shorewall is not running.
       - The refresh command only rebuilds the 'blacklst' chain.
       - A directory name may not be specified in the refresh command.

    g) The /etc/shorewall/tos file now has zone-independent SOURCE and
       DEST columns as do all other files except the rules and policy
       files.

       The SOURCE column may be one of the following:

           [all:]<address>[,...]
           [all:]<interface>[:<address>[,...]]
           $FW[:<address>[,...]]

       The DEST column may be one of the following:
       
           [all:]<address>[,...]
           [all:]<interface>[:<address>[,...]]

       This is a permanent change. The old zone-based rules have never
       worked right and this is a good time to replace them. I've tried
       to make the new syntax cover the most common cases without
       requiring change to existing files. In particular, it will
       handle the tos file released with Shorewall 1.4 and earlier.

    h) Shorewall is now out of the ipset load/reload business. With
       scripts generated by the Perl-based Compiler, the Netfilter
       ruleset is never cleared. That means that there is no
       opportunity for Shorewall to load/reload your ipsets since that
       cannot be done while there are any current rules using ipsets.

       So:

        i)   Your ipsets must be loaded before Shorewall starts. You
             are free to try to do that with the following code in
             /etc/shorewall/start:

             if [ "$COMMAND" = start ]; then
                ipset -U :all: :all:
                ipset -F
                ipset -X
                ipset -R < /my/ipset/contents
             fi

             The file '/my/ipset/contents' (not its real name of
             course) will normally be produced using the ipset -S
             command.

             The above will work most of the time but will fail in a
             'shorewall stop' - 'shorewall start' sequence if you
             use ipsets in your routestopped file (see below).

        ii)  Your ipsets may not be reloaded until Shorewall is stopped
             or cleared.

        iii) If you specify ipsets in your routestopped file then
             Shorewall must be cleared in order to reload your ipsets.

       As a consequence, scripts generated by the Perl-based compiler
       will ignore /etc/shorewall/ipsets and will issue a warning if
       you set SAVE_IPSETS=Yes in shorewall.conf.

    i) Because the configuration files (with the exception of
       /etc/shorewall/params) are now processed by the Perl-based
       compiler rather than by the shell, only the basic forms of Shell
       expansion ($variable and ${variable}) are supported. The more
       exotic forms such as ${variable:=default} are not
       supported. Both variables defined in /etc/shorewall/params and
       environmental variables (exported by the shell) can be used in
       configuration files.

    j) USE_ACTIONS=No is not supported. That option is intended to
       minimize Shorewall's footprint in embedded applications. As a
       consequence, Default Macros are not supported.

    k) DELAYBLACKLISTLOAD=Yes is not supported. The entire ruleset is
       atomically loaded with one execution of iptables-restore.

    l) MAPOLDACTIONS=Yes is not supported. People should have converted
       to using macros by now.

    m) The pre Shorewall-3.0 format of the zones file is not supported;
       neither is the /etc/shorewall/ipsec file.

    n) BLACKLISTNEWONLY=No is not permitted with FASTACCEPT=Yes. This
       combination doesn't work in previous versions of Shorewall so
       the Perl-based compiler simply rejects it.

    o) Shorewall-perl has a single rule generator that is used for all
       rule-oriented files. So it is important that the syntax is
       consistent between files.
       
       With shorewall-shell, there is a special syntax in the SOURCE
       column of /etc/shorewall/masq to designate "all traffic entering
       the firewall on this interface except...".

       Example:

       #INTERFACE       SOURCE                  ADDRESSES
       eth0             eth1!192.168.4.9        ...

       Shorewall-perl uses syntax that is consistent with the rest of
       Shorewall:

       #INTERFACE       SOURCE                  ADDRESSES
       eth0             eth1:!192.168.4.9       ...

    p) The 'allowoutUPnP' built-in action is no longer supported. The
       Netfilter team have removed support for '-m owner --owner-cmd'
       which that action depended on. 

    q) The treatment of the following interface options has changed under
       Shorewall-perl.

       - arp_filter
       - routefilter
       - logmartians
       - proxy_arp
       - sourceroute

       With the Shorewall-shell compiler, Shorewall resets these options
       on all interfaces then sets the option on those interfaces
       for which the option is defined in /etc/shorewall/interfaces.

       Under Shorewall-perl, these options can be specified with the value
       0 or 1 (e.g., proxy_arp=0). If no value is specified, the value 1
       is assumed. Shorewall will modify only the setting of those
       interfaces for which the option is specified and will set the
       option to the given value.

       A fatal compilation error is also generated if you specify one of
       these options with a wildcard interface (one ending with '+').

    r) The LOG_MARTIANS and ROUTE_FILTER options are now tri-valued in
       Shorewall-perl.

        Yes -  Same as before
        No  -  Same as before except that it applies regardless of
               whether any interfaces have the logmartians/routefilter
               option
        Keep - Shorewall ignores the option entirely (which is the
        default).

    s)  Shorewall-perl support nn 'optional' option has been added to
        /etc/shorewall/interfaces. This option is recognized by
        Shorewall-perl but not by Shorewall-shell. When 'optional' is
        specified for an interface, Shorewall will be silent when:

        - a /proc/sys/net/ipv4/conf/ entry for the interface cannot be
          modified (including for proxy ARP).

        - The first address of the interface cannot be obtained.

        I specify 'optional' on interfaces to Xen virtual machines that
        may or may not be running when Shorewall is [re]started.

        CAUTION: Use 'optional' at your own risk. If you [re]start
        Shorewall when an 'optional' interface is not available and then
        do a 'shorewall save', subsequent 'shorewall restore' and
        'shorewall -f start' operations will instantiate a ruleset that
        does not support that interface, even if it is available at the
        time of the restore/start.

     t) Shorewall-perl validates all IP addresses and addresses ranges
        in rules. DNS names are resolved and an error is issued for any
        name that cannot be resolved.
     u) Shorewall-perl checks configuration files for the presense of
        characters that can cause problems if they are allowed into the
        generated firewall script:

        - Double Quotes. These are prohibited except in the
          shorewall.conf and params files.

        - Single Quotes. These are prohibited except in the
          shorewall.conf and params files and in COMMENT lines.

        - Single back quotes. These are prohibited except in the 
          shorewall.conf and params files.

        - Backslash. Probibited except as the last character on a line
          to denote line continuation.

     v) Under Shorewall-perl, macros may invoke other macros with the
        restriction that such macros may not be invoked within an action
        body.

        When marcros are invoked recursively, the parameter passed to an
        invocation are automatically propagated to lower level macros.

         Macro invocations may be nested to a maximum level of 5.
    ------------------------------------------------------------------------
                      P R E R E Q U I S I T E S
    ------------------------------------------------------------------------
    - Perl (I use Perl 5.8.8 but other versions should work fine)
    - Perl Cwd Module
    - Perl File::Basename Module
    - Perl File::Temp Module
    - Perl Getopt::Long Module
    ------------------------------------------------------------------------
               U S I N G   T H E   N E W   C O M P I L E R
    If you only install one compiler, then that compiler will be used.

    If you install both compilers, then the compiler actually used depends
    on the SHOREWALL_COMPILER setting in shorewall.conf.

    The value of this new option can be either 'perl' or 'shell'.

    If you add 'SHOREWALL_COMPILER=perl' to /etc/shorewall/shorewall.conf
    then by default, the new compiler will be used on the system. If you
    add it to shorewall.conf in a separate directory (such as a
    Shorewall-lite export directory) then the new compiler will only be
    used when you compile from that directory.

    If you only install one compiler, it is suggested that you do not set
    SHOREWALL_COMPILER.

    You can also select the compiler to use on the command line using the
    'C option:

       '-C shell' means use the shell compiler
       '-C perl' means use the perl compiler

    The -C option overrides the setting in shorewall.conf. 

    Example:

        shorewall restart -C perl

2)  Thanks to Paul Gear, an IPPServer macro has been added. Be sure to
    read the comments in the macro file before trying to use this
    macro.

3)  Eariler generations of Shorewall Lite required that remote root
    login via ssh be enabled in order to use the 'load' and 'reload'
    commands.

    Beginning with this release, you may define an alternative means
    for accessing the remote firewall system.

    Two new options have been added to shorewall.conf:

        RSH_COMMAND
        RCP_COMMAND

    The default values for these are as follows:

        RSH_COMMAND: ssh ${root}@${system} ${command}
        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}

    Shell variables that will be set when the commands are envoked are
    as follows:

       root  - root user. Normally 'root' but may be overridden using
               the '-r' option.

       system - The name/IP address of the remote firewall system.

       command - For RSH_COMMAND, the command to be executed on the 
                 firewall system.

       files   - For RCP_COMMAND, a space-separated list of files to
                 be copied to the remote firewall system.

       destination - The directory on the remote system that the files 
                     are to be copied into. 

4)  The accounting, masq, rules and tos files now have a 'MARK' column
    similar to the column of the same name in the tcrules file. This
    column allows filtering by MARK and CONNMARK value (CONNMARK is
    only accepted under Shorewall Perl).

5)  SOURCE and DEST are now reserved zone names to avoid problems with
    bi-directional macro definitions which use these as names as key
    words.

6)  The "shorewall show zones" command now flags zone members that have
    been added using "shorewall add" by preceding them with a plus sign
    ("+").

    Example:

    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007

    fw (firewall)
    net (ipv4)
        eth0:0.0.0.0/0
    loc (ipv4)
        br0:0.0.0.0/0
        eth4:0.0.0.0/0
        eth5:0.0.0.0/0
        +eth1:0.0.0.0/0
    dmz (ipv4)
        eth3:0.0.0.0/0
    vpn (ipv4)
        tun+:0.0.0.0/0

    In the above output, "eth1:0.0.0.0/0" was dynamically added to the
    'loc' zone. As part of this change, "shorewall delete" will only
    delete entries that have been added dynamically. In earlier
    versions, any entry could be deleted although the ruleset was only
    changed by deleting entries that had been added dynamically.

7)  The 'shorewall version' command now lists the version of the
    installed compiler(s) if the -a option is used:

    gateway:/bulk/backup # shorewall version -a
    4.0.0-Beta1
    Shorewall-shell 4.0.0-Beta1
    Shorewall-perl 4.0.0-Beta1
    gateway:/bulk/backup #

8)  The Perl compiler is externalized. Both the compiler.pl program
    and the Perl Module interface are documented.

    The compiler program is /usr/share/shorewall-perl/compiler.pl:

        compiler.pl [ <option> ... ] [ <filename> ]

    If a <filename> is given, then the configuration will be compiled
    output placed in the named file. If <filename> is not given, then
    the configuration will simply be syntax checked.

    Options are:

    -v <verbosity>
    --verbosity=<verbosity>
    
        The <verbosity> is a number between 0 and 2 and corresponds to
        the VERBOSITY setting in shorewall.conf. This setting controls
        the verbosity of the compiler itself.

    -e
    --export

        If given, the configuration will be compiled for export to
        another system.

    -d <directory>
    --directory=<directory>

        If this option is omitted, the configuration in /etc/shorewall
        is compiled/checked. Otherwise, the configuration in the named
        directory will be compiled/checked.

    -t
    --timestamp

        If given, each progress message issued by the compiler and by
        the compiled program will be timestamped.

    --debug

        If given, when a warning or error message is issued, it is 
        supplimented with a stack trace. Requires the Carp Perl
        module.

    Example (compiles the configuration in the current directory 
             generating a script named 'firewall' and using VERBOSITY
             2).

       /usr/share/shorewall-perl/compiler.pl -v 2 -d . firewall

    Note: For compatibility with the Shorewall 3.4.2 and 3.4.3
    releases, options not passed on the run-line get their values from
    environmental variables:

           Option                 Variable

           --verbosity            VERBOSE
           --export               EXPORT
           --directory            SHOREWALL_DIR
           --timestamp            TIMESTAMP

    The Perl Module is externalized as follows:

        use lib '/usr/share/shorewall-perl';
        use Shorewall::Compiler;
        
            compiler $filename, $directory, $verbose, $options

    The arguments to the compiler function are as follows:

        $filename -   Name of the compiled script to be created.
                      If the arguments evaluates to false, the
                      configuration is syntax checked
                      
        $directory -  The directory containing the configuration.
                      If passed as '', then /etc/shorewall/ is assumed.

        $verbose -    The verbosity level (0-2).

        $options -    A bitmap of options. Shorewall::Compiler
                      exports two constants to help building this
                      argument:

                        EXPORT    = 0x01
                        TIMESTAMP = 0x02

    The compiler raises an exception with 'die' if it encounters an
    error; $@ contains the 'ERROR' messages describing the problem.
    
    The compiler function can be called repeatedly with different
    inputs.

9)  When TC_ENABLED=Internal, Shorewall-perl now validates classids in
    the MARK/CLASSIFY column of /etc/shorewall/tcrules against the
    classes generated by /etc/shorewall/tcclasses.

10) During installation, Shorewall generates the Perl module
    /usr/share/shorewall-perl/Shorewall/Ports.pm, using your
    /etc/protocols and /etc/services as input.

    To re-generate the module from those two files:

        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm
           file.
        2. /usr/share/shorewall-perl/buildports.pl > \
           /usr/share/shorewall-perl/Shorewall/Ports.pm

    Note: If the buildports.pl program fails to run to a successful
    completion during installation, a fallback version of
    module will be installed. That fallback module was generated from
    the /etc/protocols and /etc/services shipped with Ubuntu Feisty
    Fawn.

    Even if the buildports.pl program runs successfully, the fallback
    module is also installed as
    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you
    encounter problems with the generated module, simply copy the
    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.

11) Tuomo Soini has contributed bi-directional macros for various
    tunnel types:

          IPsecah
          GRE
          IPsec
          IPIP
          IPsecnat
          L2TP

12) The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.


    To re-generate the module from those two files:

        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm
           file.
        2. /usr/share/shorewall-perl/buildports.pl > \
           /usr/share/shorewall-perl/Shorewall/Ports.pm

    Note: If the buildports.pl program fails to run to a successful
    completion during installation, a fallback version of
    module will be installed. That fallback module was generated from
    the /etc/protocols and /etc/services shipped with Ubuntu Feisty
    Fawn.

    Even if the buildports.pl program runs successfully, the fallback
    module is also installed as
    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you
    encounter problems with the generated module, simply copy the
    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.

11) Tuomo Soini has contributed bi-directional macros for various
    tunnel types:

          IPsecah
          GRE
          IPsec
          IPIP
          IPsecnat
          L2TP

12) The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.

13) The implementation of LITEDIR has always been
    unsatisfactory. Furthermore, there have been other cases where
    people have asked to be able to designate the state directory
    (default /var/lib/shorewall[-lite]).

    To meet these objectives:

    a)  The LITEDIR variable has been eliminated in
        /usr/share/shorewall[-lite]/configpath.

    b)  A new file /etc/shorewall[-lite]/vardir has been added. This
        file is not created by default but may be added as needed. It
        is expected to contain a single variable assignment:

           VARDIR=<directory>

        Example:

           VARDIR=/root/shorewall
    
    To change VARDIR, copy the old directory to the new one before you
    restart Shorewall[-lite].

    To use this feature with Shorewall-lite, all packages involved
    (compiler, shorewall-common and shorewall-lite) must be version
    4.0.0-RC2 or later.
-
-

2007-07-15 Shorewall 3.4.5

-
Problems Corrected in 3.4.5.

1)  DYNAMIC_ZONES=Yes can now coexist with Shorewall-perl's 'bport'
    zones. Those zones themselves may not be dynamically modified but
    the presence of bport zones no longer causes the 'shorewall add'
    command to fail.

2)  Shorewall's internal traffic shaper once again works when the 'sed'
    utility is provided by the Busybox package.

3)  Version 3.4.4 erroneously accepted the values On, Off, on, off, ON
    and OFF for the IP_FORWARDING option. These values were treated
    like 'Keep'. The listed values are now once again flagged as an
    error.

4)  If 'routeback' and 'detectnets' were specified on an interface,
    limited broadcasts (to 255.255.255.255) and multicasts were dropped
    when forwarded through the interface. This could cause
    broadcast-based and multicast applications to fail when running
    through a bridge with 'detectnets'.

5)  The 'hits' command works once again.

6)  IPSECFILE=ipsec (either explicitly or defaulted) works
    now. Previously, processing of the ipsec file was bypassed; often
    with a confusing "missing file" message.

7)  If DETECT_DNAT_IPADDRS=Yes in shorewall.conf but you did't have conntrack
    match support, then the generated script was missing 'done's.

Other changes in 3.4.5.

1)  When a Shorewall release includes detection of an additional
    capability, existing capabilities files become out of
    date. Previously, this condition was not detected.

    Beginning with this release, each generated capabilities file
    contains a CAPVERSION specification which defines the capabilities
    version of the file. If the CAPVERSION in a capabilities file is
    less than the current CAPVERSION, then Shorewall will issue the
    following message:

    WARNING: <file> is out of date -- it does not contain all of
    the capabilities defined by Shorewall version <version>

    where

        <file>    is the name of the capabilities file.
        <version> is the current Shorewall version.

    Existing capabilities files contain no CAPVERSION. When such a file
    is read, Shorewall will issue this message:

    WARNING: <file> may be not contain all of the capabilities defined
    by Shorewall version <version>

2)  When a directory is specified in a command such as 'start' or
    'compile', Shorewall now reads the shorewall.conf file (if any) in
    that directory before deciding which compiler to use. So if
    SHOREWALL_COMPILER is not specified in
    /etc/shorewall/shorewall.conf and the -C option was not specified
    on the run-line, then if Shorewall-perl is installed, the additional
    shorewall.conf file is read to see if it specifies a
    SHOREWALL_COMPILER.

3)  The 'save' command now uses iptables-save from the same directory
    containing iptables. Previously, iptables-save was located via the
    PATH setting.
-
-

2007-06-17 Shorewall 3.4.4

-
Problems corrected in 3.4.4:

1)  The commands "shorewall add <interface> <zone>" and "shorewall
    delete <interface> <zone>" no longer produce spurious error
    messages.

2)  The command "shorewall delete <interface> <zone>" now actually deletes
    entries when it successfully completes.  Previously, it would appear
    to remove an entry, even when removing that entry should fail. 

3)  Setting HIGH_ROUTE_MARKS=No no longer causes TC_EXPERT flagging.

4)  When run as root, the 'shorewall load' and 'shorewall reload'
    commands would fail if the LOGFILE setting in
    /etc/shorewall/shorewall.conf specified a non-existant file.

5)  Entries in /etc/shorewall/tcrules that specify both a source and
    destination port fail with the following diagnostic:

    iptables v1.3.3: multiport can only have one option

6)  Previously, Shorewall-lite did not allow DHCP traffic through an
    interface when the interface was a bridge with 'dhcp' specified
    unless there was a bridge on the administrative system with the
    same name.

7)  SOURCE and DEST are now flagged as invalid zone name to avoid
    problems with macros that use those names as keywords.

8)  Previously, Shorewall could *increase* the MSS under some
    circumstances. This possibility is now eliminated, provided that
    the system has TCPMSS match support (be sure to update your
    capabilities files!).

9)  Firewall zone names other than 'fw' no longer cause a error when
    IPSECFILE is not set or is set to 'ipsec'.

10) The 'proxyarp' option on an interface was previously ignored when
    the /etc/shorewall/proxyarp file was empty.

11) Previously, if action 'a' was defined then the following 
    rule generated an error:

         a:        z1   z2      ...

    The trailing ":" is now ignored.

12) Previously, if a RATE/LIMIT was specified on a REJECT rule, the
    generated error messages referred to the rule as a DROP rule.

13) The 'nolock' keyword was previously ignored on several
    /sbin/shorewall[-lite] commands. 

Other changes in 3.4.4:

1)  The accounting, masq, rules and tos files now have a 'MARK' column
    similar to the column of the same name in the tcrules file. This
    column allows filtering by MARK value.

2)  The "shorewall show zones" command now flags zone members that have
    been added using "shorewall add" by preceding them with a plus sign
    ("+").

    Example:

    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007

    fw (firewall)
    net (ipv4)
        eth0:0.0.0.0/0
    loc (ipv4)
        br0:0.0.0.0/0
        eth4:0.0.0.0/0
        eth5:0.0.0.0/0
        +eth1:0.0.0.0/0
    dmz (ipv4)
        eth3:0.0.0.0/0
    vpn (ipv4)
        tun+:0.0.0.0/0

    In the above output, "eth1:0.0.0.0/0" was dynamically added to the
    'loc' zone. As part of this change, "shorewall delete" will only
    delete entries that have been added dynamically. In earlier
    versions, any entry could be deleted although the ruleset was only
    changed by deleting entries that had been added dynamically.

3)  Eariler generations of Shorewall Lite required that remote root
    login via ssh be enabled in order to use the 'load' and 'reload'
    commands.

    Beginning with this release, you may define an alternative means
    for accessing the remote firewall system.

    Two new options have been added to shorewall.conf:

        RSH_COMMAND
        RCP_COMMAND

    The default values for these are as follows:

        RSH_COMMAND: ssh ${root}@${system} ${command}
        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}

    Shell variables that will be set when the commands are envoked are
    as follows:

       root  - root user. Normally 'root' but may be overridden using
               the '-r' option.

       system - The name/IP address of the remote firewall system.

       command - For RSH_COMMAND, the command to be executed on the 
                 firewall system.

       files   - For RCP_COMMAND, a space-separated list of files to
                 be copied to the remote firewall system.

       destination - The directory on the remote system that the files 
                     are to be copied into. 

4)  You may now select the compiler to use on the command line using
    the '-C' option. This option is available on the following
    commands:

        check
        compile
        export
        load
        reload
        restart
        start
        try
        safe-start
        save-restart

     Example:

        shorewall try -C perl .
-
-

2007-06-12 New Host for www.shorewall.net and -ftp.shorewall.net

-
I'm pleased to announce that Ty Christiansen and the folks at Master Mind
Productions (http://mastermindpro.com) have volunteered to host
www.shorewall.net and ftp.shorewall.net.

The new site is up and running and I've just changed DNS to point to the new
server. Let me know if you experience any problems.

Please join me in thanking Ty and Master Mind for their support of the
Shorewall project.
-
-

2007-04-30 Shorewall 3.4.3

-

Problems corrected in Shorewall 3.4.3

-
1) The shorecap program was not loading modules correctly.
-
2) The CHAIN variable is now set correctly before the 'maclog' script
-
   is invoked.
-
-
3) The 'shorewall load' and 'shorewall reload' commands redundently
-
   re-generated the capabilities file when it resided in the export
-
   directory.
-
-
4) Setting LOGFILE to the value of a shell variable from the params
-
   file now works.
-
-
5) The 'shorewall-lite restore' command can fail with a 'startup not
-
   enabled' error.
-
-
6) When ROUTE_FILTER=Yes in shorewall.conf, Shorewall no longer clears
-
   the rp_filter flag for all interfaces.
-
-
7) When LOG_MARTIANS=Yes in shorewall.conf, Shorewall no longer clears
-
   the log_martians flag for all interfaces.
-
-
8) The 'shorewall add' and 'shorewall delete' commands no longer fail
-
   with the message 'ERROR: Only one firewall zone may be defined'.
-
-
9) It was previously impossible to disable martian logging.
-
-
10) IP addresses (aliases) added by ADD_IP_ALIASES and ADD_SNAT_ALIASES
-
    are now correctly deleted when Shorewall stops.
-
-
11) The 'shorewall add' and 'shorewall delete' commands no longer fail
-
    with the error 'Only one firewall zone may be defined'.
-
-
12) The special 'detect' value now works correctly in the ADDRESSES
-
    column of /etc/shorewall/masq.
-
-
Other changes in Shorewall 3.4.3
-
-
1) A LOCKFILE option has been added to shorewall.conf. This file is
-
   used to serialize updates to the active firewall configuration.
-
   If not specified, the defaults are:
-
-

Shorewall - /var/lib/shorewall/lock

-

Shorewall Lite - /var/lib/shorewall-lite/lock

-
- -
-

2007-04-08 Shorewall 3.2.10
-

-
Problems Corrected in 3.2.10

1)  Previously, if a 'start' or 'restart' command failed during the
    compilation step, /sbin/shorewall erroneously returned an exit
    status of zero.

2)  If IMPLICIT_CONTINUE=Yes was in effect, then sub-zones received the
    implicit CONTINUE policy for their intra-zone traffic (rather than
    the implicit ACCEPT policy for such traffic). This could cause
    intra-zone traffic to be rejected by rules in one of the parent
    zones.

3) The "shorewall-[lite] [re]start and stop" commands reset the
   proxy_arp flag on all interfaces on the system making it impossible
   to control proxy arp manually with Shorewall installed. With this
   change, shorewall will only clear proxy arp if there were entries in
   /etc/shorewall/proxyarp the last time that Shorewall was
   [re]started.
   
4)  The /usr/share/shorewall[-lite]/modules file has been updated for
    kernel 2.6.20.

5)  The /proc/net/ip_conntrack pseudo-file has been inexplicably
    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli
    library has been updated to look for both files.

6)  Tunnels of type 'ipsecnat' failed to work properly due to a missing
    rule.

7)  The 'shorecap' program was not loading modules correctly.
-
-2007-04-01 Shorewall 3.4.2
- -
Problems corrected in Shorewall 3.4.2

1)  The /usr/share/shorewall[-lite]/modules file has been updated for
    kernel 2.6.20.

2)  The /proc/net/ip_conntrack pseudo-file has been inexplicably
    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli
    library has been updated to look for both files.

3)  Shoreall 3.4 was not consistent with respect to its treatment of
    log level 'none' and 'none!' and built-in actions. In particular,
    specifying 'none' with the Limit action produced a run-time error.
    Shorewall now correctly suppresses generation of log messages when
    a log level of 'none' or 'none!' is given to a built-in action.

4)  Tunnels of type 'ipsecnat' would sometimes fail to work because of
    a missing rule.
- -
2007-03-15 -Shorewall 3.4.1
- -
Problems Corrected in 3.4.1

1)  The "shorewall-[lite] [re]start and stop" commands reset the
    proxy_arp flag on all interfaces on the system making it impossible
    to control proxy arp manually with Shorewall installed. There was a
     partial fix included in 3.4.0; unfortunately, it did not correct the
    problem completely. Shorewall 3.4.1 includes the rest of the change 
    necessarey to only clear proxy arp if there were entries in
    /etc/shorewall/proxyarp the last time that Shorewall was
    [re]started.

2)  If the log-prefix in a log message exceeded 29 characters, 
    'shorewall restart' fails with 'truncate: command not found' and a
    possible segmentation fault in iptables.

3)  Log messages specifying a log tag had two spaces appended to the
    log prefix. This could cause mysterious "log-prefix truncated"
    messages. 

4)  When nested zones were defined in the /etc/shorewall/zones file and
    IMPLICIT_CONTINUE=Yes was given in /etc/shorewall/shorewall.conf,
    shell error messages ( usually '<zone>: not found' ) during
    compilation resulted.

5)  Use of CONTINUE policies lead to startup errors with a message
    such as the following:

       Applying Policies...
       iptables v1.3.7: Couldn't load target
       `CONTINUE':/usr/local/lib/iptables/libipt_CONTINUE.so: cannot open
       shared object file: No such file or directory

       Try `iptables -h' or 'iptables --help' for more information.
       
          ERROR: Command "/sbin/iptables -A net2c148 -j CONTINUE"
          Failed

6)  If there were hosts defined as 'critical' in
    /etc/shorewall/routestopped then problems occured in two cases:

    i) On a Shorewall Lite system when 'shorewall stop' or 'shorewall
    clear' was issued.

    ii) On Shorewall or Shorewall lite system when 'start' or 'restart'
    failed during execution of the compiled script and there was no saved
    configuration ('shorewall[-lite] save' has not been issued).

    The symptoms were that the following shell messages were issued and
    the 'critical' hosts were not enabled:

      /var/lib/shorewall/.start: line nnn: source_ip_range: command not found
      /var/lib/shorewall/.start: line nnm: dest_ip_range: command not found

Other changes in 3.4.1

1)  Several changes are included which allow testing of experimental
    versions of Shorewall on systems with 3.4.1 and later 3.4 releases
    installed. Among these changes is the detection and reporting of
    "Address Type Match" which may be used in future 3.4 releases.
    These changes have no effect on normal Shorewall operation.
- -
2007-03-10 -Shorewall 3.4.0
- -
Shorewall 3.4.0

Release Highlights

1)  Shorewall can now be tailored to reduce its footprint on embedded
    systems. As part of this change, actions are now completely
    optional.

    See http://www.shorewall.net/Modularization.html for details.

2)  Exclusion is now possible in /etc/shorewall/hosts. This is required
    for bridge/firewalls under kernel 2.6.20 and later.

    See http://www.shorewall.net/NewBridge.html.

3)  Shorewall and Shorewall Lite now include man pages. There is a 
    man page for shorewall(8), one for shorewall-lite(8) and one for
    each configuration file. As part of this change, all documentation
    has been removed from Shorewall configuration files. This should
    make it easier from users to upgrade from one release to the next
    since the configuration files will only change when column is added
    or renamed.

    See http://www.shorewall.net/manpages/Manpages.html

4)  Shorewall now remembers the changes that it has made to routing as
    a result of entries in /etc/shorewall/providers and
    /etc/shorewall/route_rules and reverses those changes when
    appropriate.

Problems Corrected in 3.4.0 Final.

1)  In the rules file, following the action with "!" is supposed to
    exempt the rule from being suppressed by OPTIMIZE=1. That feature
    was not working.

2)  If both a macro body and a macro invocation contained an entry in the
    SOURCE or DEST column, then compilation failed with the error:

           merge_macro_source_dest: command not found

3)  An obscure bug in rule activation having to do with the new
    exclusion feature in /etc/shorewall/hosts has been corrected.

4) The "shorewall-[lite] [re]start and stop" commands reset the
   proxy_arp flag on all interfaces on the system making it impossible
   to control proxy arp manually with Shorewall installed. With this
   change, shorewall will only clear proxy arp if there were entries in
   /etc/shorewall/proxyarp the last time that Shorewall was
   [re]started.

New Features in Shorewall 3.4:

1)  In order to accomodate small embedded applications, Shorewall 3.4
    is now modularized. In addition to the base files, there are
    loadable "libraries" that may be included or omitted from an
    embedded system as required.

    Loadable Shorewall libraries reside in /usr/share/shorewall/ and
    have names that begin with "lib.". The following libraries are
    included in Shorewall 3.4:

    - lib.accounting. Must be available if you include entries in
      /etc/shorewall/accounting.

    - lib.actions. Must be available if you do not specify
      USE_ACTIONS=No in /etc/shorewall/shorewall.conf.

    - lib.base. The base Shorewall library required by all programs,
      including compiled firewall scripts. This library is also
      released as part of Shorewall Lite and is installed in
      /usr/share/shorewall-lite/.

    - lib.cli. Library containing the code common to /sbin/shorewall,
      /sbin/shorewall-lite. This library is also released as part of
      Shorewall Lite and is installed in /usr/share/shorewall-lite/.

    - lib.config. Library containing the code that is common to
      /usr/share/shorewall/compiler and /usr/share/shorewall/firewall. 

    - lib.dynamiczones. Must be available if you specify
      DYNAMIC_ZONES=Yes in shorewall.conf.

    - lib.maclist. Must be available if you specify the 'maclist'
      option in /etc/shorewall/interfaces or /etc/shorewall/hosts.

    - lib.nat. Must be available if you have entries in
      /etc/shorewall/masq, /etc/shorewall/nat or /etc/shorewall/netmap
      or if you use DNAT or REDIRECT rules.

    - lib.providers. Must be available if you have entries in
      /etc/shorewall/providers.

    - lib.proxyarp. Must be available if you have entries in
      /etc/shorewall/proxyarp or if you specify the 'proxyarp' option
      in /etc/shorewall/interfaces.

    - lib.tc. Must be available if you have entries in
      /etc/shorewall/tcdevices and /etc/shorewall/tcclasses.

    - lib.tcrules. Must be available if you have entries in
      /etc/shorewall/tcrules.

    - lib.tunnels. Must be available if you have entries in
      /etc/shorewall/tunnels.

    Embedded applications can further decrease the size of the Shorewall
    footprint by:

    - Omitting the macro files.
    - Omitting all unused extension scripts.

    See http://www.shorewall.net/Modularization.html for additional
    details.

2)  As hinted in the previous bullet, there is a new USE_ACTIONS option
    in /etc/shorewall/shorewall.conf. Shorewall actions can be very
    powerful but they also require a lot of code to implement. Embedded
    applications can omit that code by setting
    USE_ACTIONS=No. Shorewall will ignore all action-related files
    including /usr/share/shorewall/actions.std and
    /etc/shorewall/actions. Builtin actions will still be available for
    use in rules and macros.

    The 'Limit' action has been converted to a builtin so that Limit is
    available even when USE_ACTIONS=No.

    See the next item for more information.

3)  Prior to Shorewall 3.4, default actions were specified in
    /usr/share/shorewall/actions.std or in /etc/shorewall/actions.

    This approach has two drawbacks:

    a) All DROP policies must use the same default action and all
       REJECT policies must use the same default action.

    b) Now that we have modularized action processing (see the New
       Features section below), we need a way to define default rules
       for a policy that does not involve actions.

    The solution is two-fold:

    - Four new options have been added to the
      /etc/shorewall/shorewall.conf file that allow specifying the
       default action for DROP, REJECT, ACCEPT and QUEUE.

       The options are DROP_DEFAULT, REJECT_DEFAULT, ACCEPT_DEFAULT and
       QUEUE_DEFAULT.

       DROP_DEFAULT describes the rules to be applied before a
       connection request is dropped by a DROP policy; REJECT_DEFAULT
       describes the rules to be applied if a connection request is
       rejected by a REJECT policy. The other two are similar for
       ACCEPT and QUEUE policies.

       The value assigned to these may be:

        a) The name of an action.
        b) The name of a macro
        c) 'None' or 'none'

       The default values are:

        DROP_DEFAULT="Drop"
        REJECT_DEFAULT="Reject"
        ACCEPT_DEFAULT=none
        QUEUE_DEFAULT=none

       If USE_ACTIONS=Yes, then these values refer to action.Drop and
       action.Reject respectively. If USE_ACTIONS=No, then these values
       refer to macro.Drop and macro.Reject.

       If you set the value of either option to "None" then no default
       action will be used and the default action or macro (if any)
       must be specified in /etc/shorewall/policy

    - The POLICY column in /etc/shorewall/policy has been extended.

       In /etc/shorewall/policy, when the POLICY is DROP, REJECT,
       ACCEPT or QUEUE then the policy may be followed by ":" and one
       of the following:

        a) The word "None" or "none". This causes any default
           action defined in /etc/shorewall/shorewall.conf
           to be omitted for this policy.
        b) The name of an action (requires that USE_ACTIONS=Yes
           in shorewall.conf). That action will be invoked
           before the policy is enforced.
        c) The name of a macro. The rules in that macro will
           be applied before the policy is enforced. This
           does not require USE_ACTIONS=Yes.<
br>
    Example:

        #SOURCE         DEST            POLICY          LOG
        #                                               LEVEL
        loc             net             ACCEPT
        net             all             DROP:MyDrop     info
        #
        # THE FOLLOWING POLICY MUST BE LAST
        #
        all             all             REJECT:MyReject info

4)  For users whose kernel and iptables have Extended MARK Target
    support, it is now possible to logically AND or OR a value into the
    current packet mark by preceding the mark value (and optional mask)
    with an ampersand ("&") or vertical bar ("|") respectively.

    Example: To logically OR the value 4 into the mark value for
    packets from 192.168.1.1:

    #MARK   SOURCE
    |4      192.168.1.1

5)  Previously, zone names were restricted to five characters in
    length. That limit derives from the --log-prefix in Netfilter log
    messages which must be 29 bytes or less in length. With the
    standard Shorewall LOGFORMAT, that leaves 11 characters for the
    chain name; given that many chain names are of the form
    <zone1>2<zone2>, that gives a maximum zone name length of 5.

    Beginning with this release, the maximum length of a zone name is
    dependent on the LOGFORMAT (the maximum length may never be less
    than 5 but it may be greater than 5). For example, setting
    LOGFORMAT="FW:%s:%s:" will allow zone names of up to 8 characters.

6)  Netfilter provides support for attachment of comments to Netfilter
    rules. Comments can be up to 255 bytes in length and are visible
    using the "shorewall show <chain>", "shorewall show nat",
    "shorewall show mangle" and "shorewall dump" commands. Comments are
    delimited by '/* ... */" in the output.

    Beginning with Shorewall 3.4, you may place COMMENT lines in the
    /etc/shorewall/rules, /etc/shorewall/tcrules, /etc/shorewall/nat
    and /etc/shorewall/masq files and in action files. The remainder of
    the line is treated as a comment and it will be attached as a
    Netfilter comment to the rule(s) generated by succeding entries
    in the file.

    Note: Do not prefix the comment with "#". Shorewall's two-pass
    compiler strips off "#" comments in the first pass and processes
    COMMENT lines in the second pass. Hence, by the time that COMMENT
    is processed, the "#" and everything following it has been removed
    (see example below).

    To stop the current comment from being attached to further
    rules, simply include COMMENT on a line by itself (so that the
    following rules will have no comment) or specify a new COMMENT.

    If you do not have Comment support in your iptables/kernel (see the
    output of "shorewall[-lite] show capabilities") then COMMENTS are
    ignored with this warning:

     COMMENT ignored --  requires comment support in iptables/Netfilter

    Example from my rules file:

            #SOURCE      SOURCE     DEST       PROTO DEST PORT(S)

            COMMENT Stop Microsoft Noise

            REJECT       loc        net        tcp   137,445
            REJECT       loc        net        udp   137:139

            COMMENT  # Stop comment from being attached to rules below

    The output of "shorewall show loc2net" includes (folded):

    0     0 reject     tcp  --  *      *       0.0.0.0/0
          0.0.0.0/0    multiport dports 137,445 /* Stop Microsoft Noise */
    0     0 reject     udp  --  *      *       0.0.0.0/0
          0.0.0.0/0    udp dpts:137:139 /* Stop Microsoft Noise */

7)  A new macro (macro.RDP) has been added for Microsoft Remote
    Desktop. This macro was contributed by Tuomo Soini.

8)  A new 'maclog' extension file has been added. This file is
    processed just before logging based on the setting of
    MACLIST_LOG_LEVEL is done. When the extension is invoked, the CHAIN
    variable will contain the name of the chain where rules should be
    inserted. Remember that if you have specified MACLIST_TABLE=mangle,
    then your run_iptables commands should include "-t mangle".

9)  The SUBNET column in /etc/shorewall/masq has been renamed SOURCE to
    more accurately describe the contents of the column.

10) Previously, it was not possible to use exclusion in
    /etc/shorewall/hosts. Beginning with this release, you may now use
    exclusion lists in entries in this file. Exclusion lists are
    discussed at:

       http://www.shorewall.net/configuration_file_basics.htm#Exclusion.

    Example:

        loc     eth0:192.168.1.0/24!192.168.1.4,192.168.1.16/28

    In that example, the 'loc' zone is defined to be the subnet
    192.168.1.0/24 interfacing via eth0 *except* for host 192.168.1.4
    and hosts in the sub-network 192.168.1.16/28.

11) New "shorewall[-lite] show ip" and "shorewall[-lite] show routing"
    commands have been added. The first produces the same output as "ip
    addr ls". The second produces a report about your routing rules and
    tables.

12) Beginning with this release, Shorewall and Shorewall Lite will
    share common change logs and release notes.

13) In Shorewall versions prior to 3.4, multiple jumps to a '2all'
    chain could be generated in succession.

    Example from an earlier shorewall version:

    gateway:~ # shorewall-lite show eth2_fwd
    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 08:54:37 PDT 2006

    Counters reset Thu Oct 19 08:34:47 PDT 2006

    Chain eth2_fwd (1 references)
     pkts bytes target     prot opt in     out     source            destination
        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW
        0     0 wifi2all   all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      br0     0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      eth3    0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      tun+    0.0.0.0/0            0.0.0.0/0
    gateway:~ #

    This redundancy may be eliminated by setting OPTIMIZE=1 in shorewall.conf.

    gateway:~ # shorewall-lite show eth2_fwd
    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 09:15:24 PDT 2006

    Counters reset Thu Oct 19 09:15:19 PDT 2006

    Chain eth2_fwd (1 references)
     pkts bytes target     prot opt in     out     source               destination
        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW
        0     0 wifi2all   all  --  *      *       0.0.0.0/0            0.0.0.0/0
    gateway:~ #

    Note that with OPTIMIZE=1, traffic destined for an
    interface/Address that falls outside of all defined zones may now
    be logged out of a '2all' chain rather than out of the FORWARD
    chain.

    The OPTIMIZE setting also controls the suppression of redundant
    wildcard rules (those specifying "all" in the SOURCE or DEST
    column). A wildcard rule is considered to be redundant when it
    has the same ACTION and Log Level as the applicable policy.

    Example:

        /etc/shorewall/policy

        #SOURCE         DEST            POLICY          LEVEL
        loc             net             ACCEPT

        /etc/shorewall/rules

        #ACTION         SOURCE          DEST    PROTO   DEST
        #                                               PORT(S)
        ...
        ACCEPT          all             all     icmp    8

    OPTIMIZE=0

    gateway:~ # shorewall show loc2net
    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:55:03 PDT 2006

    Counters reset Thu Oct 26 07:54:58 PDT 2006<
br>
    Chain loc2net (1 references)
     pkts bytes target     prot opt in     out     source               destination
      ...
        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0
        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

    gateway:~

    OPTIMIZE=1

    gateway:~ # shorewall show loc2net
    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:57:12 PDT 2006

    Counters reset Thu Oct 26 07:56:38 PDT 2006

    Chain loc2net (1 references)
     pkts bytes target     prot opt in     out     source               destination
      ...
        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

    gateway:~

    If you really want a rule that duplicates the policy, follow the
    action with "!":

        #ACTION         SOURCE          DEST    PROTO   DEST
        #                                               PORT(S)
        ...
        ACCEPT!         all             all     icmp    8

14) IP Address ranges are now allowed in the drop, reject, allow and
    logdrop shorewall[-lite] commands.

15) Previously, Shorewall has not attempted to undo the changes it has
    made to the firewall's routing as a result of entries in
    /etc/shorewall/providers and /etc/shorewall/routes. Beginning with
    this release, Shorewall will attempt to undo these changes.

    When Shorewall starts or is restarted and there are entries in
    /etc/shorewall/providers, Shorewall will capture the contents
    of /etc/shorewall/rt_tables and will restore that database when
    Shorewall is stopped or restarted. Similarly, the default route
    will be captured the first time that you [re]start Shorewall using
    this version and will be restored under the following conditions:

    a) shorewall stop
    b) shorewall clear
    c) shorewall restart or restore and there are no entries in
       /etc/shorewall/providers.

    Once the default route has been restored, Shorewall will delete
    the saved copy so that it will once again be captured at the next
    shorewall start or shorewall restore.

16) Shorewall no longer includes policy matches in its generated
    ruleset when no IPSEC zones or IPSEC networks are defined (IPSEC
    networks are defined using the 'ipsec' option in
    /etc/shorewall/hosts).

17) The Makefile installed in /usr/share/shorewall/configfiles/ is now
    the same one mentioned at
    http://www.shorewall.net/CompiledPrograms.html.

    Once the file is copied into an export directory, you modify the
    setting of the HOST variable to match the name of the remote
    firewall.

    The default target is the "firewall" script so "make" compiles the
    firewall script if any of the configuration files have
    changed. "make install" builds "firewall" if necessary then
    installs it on the remote firewall. "make capabilities" will
    generate the "capabilities" file. "make save" will save the running
    configuration on the remote firewall.

18) Shorewall and Shorewall Lite now include the following manpages. 

              shorewall-accounting(5)
              shorewall-actions(5)
              shorewall-blacklist(5)
              shorewall.conf(5)
              shorewall-ecn(5)
              shorewall-exclusion(5)
              shorewall-hosts(5)
              shorewall-interfaces(5)
              shorewall-lite.conf(5)
              shorewall-lite(8)
              shorewall-maclist(5)
              shorewall-masq(5)
              shorewall-nat(5)
              shorewall-nesting(5)
              shorewall-netmap(5)
              shorewall-params(5)
              shorewall-policy(5)
              shorewall-providers(5)
              shorewall-proxyarp(5)
              shorewall-rfc1918(5)
              shorewall-route_rules(5)
              shorewall-routestopped(5)
              shorewall-rules(5)
              shorewall-tcclasses(5)
              shorewall-tcdevices(5)
              shorewall-tcrules(5)
              shorewall-template(5)
              shorewall-tos(5)
              shorewall-tunnels(5)
              shorewall(8)
              shorewall-zones(5)

    Now that the manpages are in place, command-specific help has been
    removed since it duplicates information in the man pages.

19) From the beginning, the Shorewall configuration files in
    /etc/shorewall/ have contained documentary comments. While these
    comments are useful, they present an upgrade problem. Beginning
    with this release, these comments are removed from the
    configuration files themselves and are replaced by the manpages
    described in the preceding release note entry.

20) Shorewall now uses tc fwmark filters to classify packets for
    traffic shaping when the DEVICE isn't an interface described in
    /etc/shorewall/interfaces. This is in preparation for the upcoming
    change to the way that --physdev-out works in iptables/Netfilter;
    that change is now scheduled for kernel 2.6.20.

21) If your kernel and iptables have extended multiport support, then
    Shorewall will use that support for the destination port when
    generating rules from entries in the /etc/shorewall/tcrules file.
22) The 'safe-start' and 'safe-restart' command have been
    improved. Both now accept an optional directory name; if supplied,
    Shorewall will look first in that directory for configuration
    files.

    The commands have also been enhanced to only restore the
    configuration once in the event of a failure. Previously, if there
    was a current 'save' command in effect, then that configuration
    would be restored on a failure and then the last-running
    configuration would be restored.

23) The 'try' command has been reimplemented with new semantics. 

    If Shorewall is started then the firewall state is saved to a
    temporary saved configuration (/var/lib/shorewall/.try). Next, if
    Shorewall is currently started then a restart command is issued;
    otherwise, a start command is performed. if an error occurs during
    the  compliation phase  of  the  restart or start, the command
    terminates without changing the Shorewall state. If an error occurs
    during the restart phase, then a 'shorewall restore' is performed
    using the saved configuration. If an error occurs during the start
    phase, then Shorewall is  cleared. If the start/restart succeeds
    and a timeout is specified then a 'clear' or 'restore' is performed
    after timeout seconds. 

24) The syntax of the 'export' command has been made slightly
    friendlier.

    The old syntax:

        export <directory1> [user@]system:[<directory2>]

    It is now:

        export <directory1> [user@]system[:<directory2>]

    In other words, if you don't need to specify <directory2>, you may
    omit the colon (":") following the system name.
    
    The old syntax is still accepted -- that is, you can still 
    type:

        export firewall2:

    which is equivalent to

        export firewall2

25) Shorewall commands may be speeded up slightly by using a
    'capabilities' file. The 'capabilities' file was originally
    designed for use with Shorewall Lite and records the
    iptables/Netfilter features available on the target system.

    To generate a capabilities file, execute the following command as
    root:

      shorewall show -f capabilities > /etc/shorewall/capabil
ities

    When you install a new kernel and/or iptables, be sure to generate
    a new capabilities file.
        
26) When syslogd is run with the -C option (which in some
    implementations causes syslogd to log to an in-memory circular
    buffer), /sbin/shorewall will now use the 'logread' command to read
    the log from that buffer. This is for combatibility with OpenWRT.

27) There is now a ":T" qualifier in /etc/shorewall/tcrules which
    causes the resulting rule to be inserted into the POSTROUTING
    chain.

28) The program /usr/share/shorewall/wait4ifup can be used to wait for
    a network device (such as a ppp device) to reach the UP state. 
    
        /usr/share/shorewall/wait4ifup <interface> [ <seconds> ]

    The program will wait for up to <seconds> seconds for the 
    named <interface> to reach the UP state. If <seconds> is not given,
    60 seconds is assumed.

    The exit status is zero if <interface> comes up within <seconds>
    seconds and non-zero otherwise.

29) Previously, 'ipsecnat' tunnels allowed AH traffic by default
    (unless 'isecnat:noah' was given). Given that AH is incompatible
    with nat-traversal, 'ipsecnat' now implies 'ipsecnat:noah'.

30) Shorewall now generates half as many rules as previously in the
    'blacklst' chain when BLACKLIST_LOGLEVEL is specified.

31) Beginning with Shorewall 3.4.0, if EXPORTPARAMS=No in
    shorewall.conf then Shorewall will not process
    /etc/shorewall/params when the compiled script is run. With
    EXPORTPARAMS=No, any shell variables needed at run-time must be set
    in /etc/shorewall/init.

    In a Shorewall/Shorewall Lite environment, this allows
    /etc/shorewall/params to be written to run exclusively
    on the administrative system while /etc/shorewall/init runs
    exclusively on the firewall system.

    So shell variables required at compile time may be set in
    /etc/shorewall/params and those required at run-time may be set in
    /etc/shorewall/init.

    Note 1: If you need shell variables values in your
    /etc/shorewall/stop or /etc/shorewall/stopped script, then you need
    to set their values in /etc/shorewall/stop. /etc/shorewall/init is
    not invoked during processing of the 'stop' and 'clear' commands.

    Note 2: EXPORTPARAMS was actually introduced in Shorewall version
    3.2.9. It is described here for the benefit of those who did not
    install that version.
- -
Old -News here
- - - + + + + + + Shorewall News + + +

Shorewall News and Announcements
+

+

+Copyright © 2001-2009 Thomas M. Eastep

+

Permission is granted to copy, distribute and/or modify this +document +under the terms of the GNU Free Documentation License, Version 1.2 or +any +later version published by the Free Software Foundation; with no +Invariant +Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of +the +license is included in the section entitled "GNU Free Documentation +License". +

+

August 14, 2009
+

+
+

2009-08-14 Shorewall 4.4.0

+
----------------------------------------------------------------------------
               R E L E A S E  4 . 4  H I G H L I G H T S
----------------------------------------------------------------------------

1)  Support for Shorewall-shell has been discontinued. Shorewall-perl
    has been combined with Shorewall-common to produce a single
    Shorewall package.

2)  Support for the "Hierarchical Fair Service Curve" (HFSC) queuing
    discipline has been added. HFSC is superior to the "Hierarchical
    Token Bucket" queuing discipline where realtime traffic such as
    VOIP is being used.

3)  Support for the "flow" traffic classifier has been added. This
    classifier can help prevent multi-connection applications such as
    BitTorrent from using an unfair amount of bandwidth.

4)  The Shorewall documentation and man pages have been purged of
    information about earlier Shorewall releases. The documentation
    describes only the behavior of Shorewall 4.4 and later versions.

5)  The interfaces file OPTIONs have been extended to largely remove the
    need for the hosts file.

6)  It is now possible to define PREROUTING and OUTPUT marking rules
    that cause new connections to use the same provider as an existing
    connection of the same kind.

7)  Dynamic Zone support is once again available for IPv4; ipset support is
    required in your kernel and in iptables.

8)  A new AUTOMAKE option has been added to shorewall.conf and
    shorewall6.conf. Setting this option will allow Shorewall to skip
    the compilation phase during start/restart if no configuration
    changes have occurred since the last start/restart.

9)  The LIMIT:BURST column in /etc/shorewall/policy
    (/etc/shorewall6/policy) and the RATE LIMIT column in
    /etc/shorewall/rules (/etc/shorewall6/rules) may now be used to
    limit on a per source IP or per destination IP basis.

10) Support for per-IP traffic shaping classes has been added.

11) Support for netfilter's TRACE facility has been added. TRACE allows
    you to trace selected packets through Netfilter, including marking
    by tcrules.

+

2009-08-02 Shorewall 4.4.0 RC 2
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt
+

2009-07-26 Shorewall 4.4.0 RC 1
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC1/releasenotes.txt
+

2009-07-12 Shorewall 4.4.0 Beta 4
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta4/releasenotes.txt
+ + +

2009-06-29 Shorewall 4.4.0 Beta 3
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta3/releasenotes.txt
+ +

2009-06-21 Shorewall 4.4.0 Beta 2
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta2/releasenotes.txt
+ +

2009-06-18 Shorewall 4.2.10
+

+
Problems corrected in Shorewall 4.2.10

1)  A 'large quantum' warning log message during restart has been
    eliminated. The log message occurred when an interface with a large
    OUT-BANDWIDTH was defined in /etc/shorewall/tcdevices.

2)  When a REJECT rule included a log entry, the disposition in the log
    message was incorrectly shown as 'reject' rather than 'REJECT'.

3)  When 'forward' was specified on one or more interfaces in
    /etc/shorewall6/interfaces, the progress message "Compiling
    Interface forwarding..." was issued multiple times. Now, only one
    instance of the message is generated.

4)  A typing error in the IPv6 two-interface sample shorewall6.conf
    file has been corrected. This error prevented the compiler from
    being able to find macros in /usr/share/shorewall/.

Known Problems Remaining:

1)  When exclusion is used in an entry in /etc/shorewall/hosts, then
    Shorewall-shell produces an invalid iptables rule if any of the 
    following OPTIONS are also specified in the entry:    

        blacklist
        maclist
        norfc1918
        tcpflags

2)  Shorewall-shell generates inversion rules which produce
    warnings with iptables 1.4.3.  

    Example:

        iptables -A  lan2fw  -p 6  --dport 999  -s ! 192.168.20.1  -j ACCEPT

    with iptables 1.4.3.1 the following information message is produced:

    Using intrapositioned negation (`--option ! this`) is deprecated in
    favor of extrapositioned (`! --option this`).

    We don't intend to fix this. It's time to migrate to Shorewall-perl
    anyway.

New Features in Shorewall 4.2.10

1)  Shorewall's suppport for dynamic gateways on interfaces managed by
    dhclient works on OpenSuSE systems but not on some other
    distributions.

    In order to generalize support for learning the gateway for dynamic
    interfaces, a new 'findgw' extension script (user exit) has been
    added.

    The exit will be invoked in a function that has a single argument:

        $1 = <name of an interface>

    If the function can determine the gateway for the passed interface,
    it should write the gateway to standard out. Here is a sample
    /etc/shorewall/findgw that works with dhclient (dhcp3) in Debian
    Lenny:

    if [ -f /var/lib/dhcp3/dhclient.${1}.leases ]; then
       grep 'option routers' /var/lib/dhcp3/dhclient.${1}.leases |\
          tail -n 1 |\
          while read j1 j2 gateway; do\
              echo $gateway | sed 's/;//';\
          done
    fi

    The same code works on Ubuntu Jaunty if you replace the first '.'
    with '-' and replace '.leases' with '.lease' (don't you just love
    the consistency between distributions?).

    That code also works on CentOS if you replace 'dhcp3' by
    'dhclient'.

    'findgw' files that have been customized for various distributions
    may be found at
    http://www.shorewall.net/pub/shorewall/contrib/findgw.
+

+

2009-06-13 Shorewall 4.4.0 Beta 1

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta1/releasenotes.txt
+

2009-05-14 Shorewall 4.2.9

+

+
Problems corrected in Shorewall 4.2.9

1)  The Shorweall-perl 4.2.8 compiler did not rename the output script
    file with the result that:

     a) Shorewall would not start for the first time after
        installation.
     b) Configuration changes were apparently ignored.

2)   Placing a broadcast address in the BROADCAST column of
    /etc/shorewall/interfaces caused Shorewall-perl to generate an
    error:

        ERROR: Invalid BROADCAST address : /etc/shorewall/interfaces\
                 (line 225)

3)  When Shorewall could not determine the MAC address of of a gateway
    router where multiple providers are configured through the same
    interface, invalid iptables-restore input was generated. This
    resulted in an error message similar to the following:

        iptables-restore v1.3.5: Bad mac address `-j'

4)  Shorewall-perl was not processing the tcrules file when
    TC_ENABLED=No.

5)  When 'all' appeared in the SOURCE column of a DNAT rule, no rule to
    redirect output from the firewall itself was generated.
    
6)  The 'shorewall iprange' command failed to produce a minimal list of
    networks.

New Features in Shorewall 4.2.9

1)  Shorewall6 has now been validated on Ubuntu Hardy running kernel
    2.6.24. Shorewall6 is now supported on that kernel version.
+

2009-04-16 Shorewall 4.2.8
+

+

+
Problems Corrected in Shorewall 4.2.8

1)  The 'start -f' command would previously skip the compilation step
    unconditionally when the 'make' utility was not installed. Now, the
    compilation step is run unconditionally in this case.

2)  When ADD_IP_ALIASES=Yes in shorewall.conf, entries in
    /etc/shorewall/nat produce this failure at compile time when
    using Shorewall-perl:

    ERROR: Internal Error in emit : /etc/shorewall/nat (line 12)

3)  When LOG_MARTIANS=Yes with Shorewall-perl, setting logmartians=0 in
    an entry in /etc/shorewall/interface failed to suppress martian
    logging on the interface.

4)  Shorewall-perl now generates rules with inversion that are
    compatible with iptables 1.4.3.

5) When a network address was specified in the SOURCE or DEST column of
   /etc/shorewall/tcfilters, Shorewall-perl was generating an incorrect
   netmask.

New Features in 4.2.8

1)  The /usr/share/shorewall/modules and /usr/share/shorewall6/modules
    files have been updated for iptables 1.4.3/kernel 2.6.29.
+

2009-03-19 Shorewall 4.2.7

+

+
Problems corrected in 4.2.7

1)  Previously, the 'start' command set the permission flags on
    /var/lib/shorewall*/state so that it could be read by
    non-root users while the 'stop' command set the permissions such
    that the file could not be read by those users.

    Beginning with 4.2.7, both commands will secure the file for
    root-only access. If you want the file to be world-readable, then
    add 

        chmod 744 <file name>

    To your /etc/shorewall/started, /etc/shorewall/stopped and
    /etc/shorewall/restored files.

2)  The 'shorewall6 dump' command now correctly displays the installed
    version of Shorewall-perl. It also displays the IPv6 neighbor table
    contents rather than the ARP table contents.

3)  Under some circumstances, interface options like nosmurfs and
    tcpflags would not be applied to forwarded traffic when using
    Shorewall-perl.

4)  The following rule was badly mis-handled:

       DNAT-    loc     net:1.2.3.4:2525        tcp     25

    The result:

     WARNING: Destination zone (1.2.3.4) ignored : /etc/shorewall/rules (line 459)
     Can't call method "inet_htoa" without a package or object reference at
       /usr/share/shorewall-perl/Shorewall/IPAddrs.pm line 150,
      <$currentfile> line 459.

5)  Previously, OPTIONS were not allowed with a bridge port in
    /etc/shorewall/interfaces. That oversight has been corrected and
    now the following OPTIONS are allowed:

        blacklist
        maclist
        norfc1918
        nosmurfs
        routeback
        tcpflags

6)  Tuomo Soini provided a workaround patch for a problem seen in some
    kernel's (see FAQ 82) that caused 'shorewall start' to fail when
    USE_DEFAULT_RT=Yes .

New Features in Shorewall 4.2.7

1)  Prior to Shorewall version 3.0.0, rules generated by
    /etc/shorewall/tunnels were traversed before those generated by
    /etc/shorewall/rules. When SECTIONs were added to the rules file in
    3.0.0, traversal of the tunnel rules was deferred until after those
    generated by the NEW section of the rules file. 

    Beginning with Shorewall-perl 4.2.7, the tunnel rules are back
    where they started -- right before the first rule generated by the
    NEW section of /etc/shorewall/rules.

2)  To allow bypassing of connection tracking for certain traffic,
    /etc/shorewall/notrack and /etc/shorewall6/notrack files have been
    added.

    Columns in the file are:

        SOURCE - <zone>[:<interface>][:<address list>]

        DEST - [<address list>]

        PROTO - <protocol name or number>

        DEST PORT(S) - <port number list>

        SOURCE PORT(S) - <port number list>

        USER/GROUP - [<user>][:<group>]

            May only be specified if the SOURCE <zone> is $FW.

    Traffic that matches all given criteria will not be subject to
    connection tracking. For such traffic, your policies and/or rules
    must deal with ALL of the packets involved, in both the original
    and the opposite directions. All untracked traffic is passed
    through the relevant rules in the NEW section of the rules
    file. Untracked encapsulated tunnel traffic can be handled by
    entries in /etc/shorewall/tunnels just like tracked traffic
    is. Because every packet of an untracked connection must pass
    through the NEW section rules, it is suggested that rules that deal
    with untracked traffic should appear at the top of the file.

    Example:

    /etc/shorewall/tunnels:

        #TYPE   ZONE    GATEWAY
        6to4    net

    /etc/shorewall/notrack

        #SOURCE          DEST           PROTO   DEST    SOURCE  USER/
        #                                       PORT(S) PORT(S) GROUP
        net:!192.88.99.1 -              41

    Given that 192.88.99.1 is an anycast address, many hosts can
    respond to outward traffic to that address. The entry in
    /etc/shorewall/tunnels allows protocol 41 net<->fw. The entry in
    /etc/shorewall/notrack prevents the inbound traffic from creating
    additional useless conntrack entries.

    As part of this change, the 'show' command is enhanced to support a 
    'show raw' command that is an alias for 'show -t raw'. The raw
    table is where NOTRACK rules are created. The dump command is also
    enhanced to display the contents of the raw table.

3)  Shorewall-perl supports three additional columns in the
    /etc/shorewall/routestopped file:

    PROTO          -- Protocol name or number

    DEST PORT(S)   -- comma-separated list of service names and/or port
                      numbers
 
    SOURCE PORT(S) -- comma-separated list of service names and/or port
                      numbers.

    These columns are only meaningful when the "-f" option to
    'shorewall stop' is used.

    As part of this change, the "-f" option to the 'stop' and 'clear'
    commands is now the default when FAST_STOP=Yes in shorewall.conf.
    To override this default, use the "-s" option:

        shorewall stop -s

    Note that if you have entries with one or more of the new columns,
    the -s option will result in warning messages.

        gateway:~ # shorewall stop -s
        Stopping Shorewall...
          WARNING: Unknown routestopped option ignored: notrack
          WARNING: Unknown routestopped option ignored: 41
          WARNING: Unknown routestopped option ignored: notrack
          WARNING: Unknown routestopped option ignored: 41
        done.
        gateway:~ #

4)  Shorewall-perl now handles SOURCE PORT lists of more than 15
    entries by breaking the containing rule into multiple rules.
+

2009-02-15 Shorewall 4.2.6

+
Problems corrected in 4.2.6

1)  The CONFIG_PATH in the two- and three-interface Shorewall6 sample
    configurations was incorrect with the result that this error
    occurred on 'shorewall6 check' or 'shorewall6 start'.

           ERROR: No IP zones defined

2)  Setting TCP_FLAGS_DISPOSITION=REJECT caused both Shorewall-shell
    and Shorewall-perl to create invalid iptables commands. This has
    been corrected but we still strongly recommend against that
    setting; TCP_FLAGS_DISPOSITION=DROP is preferred.

3)  Shorewall-perl was generating code that checked for state match
    before kernel modules were loaded. This caused start/restart to
    fail on systems without kernel module loading. 

4)  The Shorewall6 and Shorewall6-lite Makefiles were incorrect.

5)  If a service name is used in a port-mapping rule (a DNAT or
    REDIRECT rule that changes the destination port), and if the
    kernel and iptables include Extended Connection Match support, then
    invalid iptables-restore input is produced by Shorewall-perl.

6)  If iptables 1.4.1 or later was installed, Shorewall-perl generated
    incorrect iptables-restore input if exclusion was used in the
    ORIGINAL DEST field of a DNAT or REDIRECT rule.

7)  On kernels earlier than 2.6.20, the 'shorewall show connections'
    command fails.

New Feature in Shorewall 4.2.6

1)  A BitTorrent32 macro has been added. This macro matches the
    extended TCP port range used by BitTorrent 3.2 and later.

2)  A new COUNT action has been added to Shorewall-perl. This action
    creates an iptables (ip6tables) rule with no target. Connections
    matching such a rule are simply counted and the packet is passed on
    to the next rule.

    Shorewall-shell ignores COUNT in actions and macros, thus allowing
    the standard actions (action.Drop and action.Reject) to have a
    COUNT rule as their first entry.

3)  A new RESTORE_DEFAULT_ROUTE option has been added to
    shorewall.conf. It is used to determine whether to restore the
    default route saved when there are 'balance' providers defined but
    all of them are down.

    The default is RESTORE_DEFAULT_ROUTE=Yes which preserves the
    pre-4.2.6 behavior. 

    RESTORE_DEFAULT_ROUTE=No is appropriate when you don't want a
    default route in the main table (USE_DEFAULT_RT=No) or in the
    default table (USE_DEFAULT_RT=Yes) when there are no balance
    providers available. In that case, RESTORE_DEFAULT_ROUTE=No
    will cause any default route in the relevant table to be deleted.

4)  IPv4 firewall scripts produced by Shorewall-perl now use dhcpcd's
    database when trying to detect the gateway for an interface
    ("detect" in the GATEAWAY column in /etc/shorewall/interfaces).

    As part of this change, it is now permitted to specify 'detect'
    when USE_DEFAULT_RT=Yes; in that case, the script will only detect
    gateways for point-to-point devices and for devices configured by
    dhcpcd.

5)  Shorewall-perl now supports port inversion. A port number or list
    of port numbers may be preceded by '!" which will cause the rule to
    match all ports EXCEPT those listed:

    Example: To blacklist 206.124.146.176 for all tcp ports except 80:

             ADDRESS/SUBNET       PROTO           PORT(S)
             206.124.146.177      tcp             !80

6)  Shorewall-perl now supports protocol inversion. A protocol name or
    number may be preceded by '!' to specify all protocols except the
    one following '!'.

    Example: To blacklist 206.124.146.176 for all protocols except 
             UDP:

             ADDRESS/SUBNET       PROTO           PORT(S)
             206.124.146.177      !udp

    Note that ports may not be specified when protocol inversion
    is used.

7)  When using Shorewall-perl, neither the 'start' nor 'started'
    extension script is run during processing of the 'restore'
    command. To allow extension of that command, we have added a
    'restored' extension script that runs at the successful completion
    of 'restore'. This script is only available with Shorewall-perl.

    With Shorewall-shell, both scripts are run during 'restore' but in
    that case, the run_iptables() function does nothing. So any
    run_iptables() calls in the 'start' script are effectively ignored.

8)  Shorewall-perl now correctly handles 'here documents' quoting
    (<<EOF .... EOF) in run-time extension scripts.
+

2009-01-22 Shorewall 4.2.5
+

+

+
Problems corrected in 4.2.5

1)  If exclusion is used to define a zone in /etc/shorewall/hosts and
    that zone is used as the SOURCE zone in a DNAT or REDIRECT rule,
    then Shorewall-perl can generate invalid iptables-restore input.

2)  A bug in the Perl Cwd module (see
    http://rt.cpan.org/Public/Bug/Display.html?id=13851) causes the
    Shorewall-perl compiler to fail if it doesn't have at least read
    access to its current working directory. 4.2.5 contains a
    workaround.

3)  If 'critical' was specified on an entry in
    /etc/shorewall6/routestopped, Shorewall6 (Shorewall-perl) would
    generate an error.

4)  In certain cases where exclusion occurred in /etc/shorewall/hosts,
    Shorewall-perl would generate incorrect iptables-restore input.

5)  In certain cases where exclusion occurred in /etc/shorewall/hosts,
    Shorewall-perl would generate invalid iptables-restore input.

6)  The 'shorewall6 refresh' command runs iptables_restore rather than
    ip6tables_restore.

7)  The commands 'shorewall6 save-start', 'shorewall6-save-restart' and
    'shorewall6 restore' were previously broken.

8)  The Debian init script was checking $startup in
    /etc/default/shorewall rather than in /etc/default/shorweall6

9)  The Archlinux init scripts for Shorewall6 and Shorewall6 Lite were
    unconverted Shorewall scripts.

10) When 'detect' is used in the GATEWAY column of
    /etc/shorewall/providers, Shorewall-perl now ensures that the
    gateway was successfully detected. If the gateway cannot be
    detected, action is taken depending on whether the provider is
    'optional' or not. If the provider is optional, it's configuration
    is skipped; if the provider is not optional, the current operation
    is aborted.

11) The command 'shorewall6 debug start' would previously fail with
        ERROR: Command "/sbin/ip6tables -t nat -F" Failed

12) Both ipv4 and ipv6 compiled programs attempt to run the tcclear
    script itself at run time rather than running the copy of the
    file in the compiled script. This usually isn't noticable unless
    you are running Shorewall Lite or Shorewall6 Lite in which case,
    the script doesn't get run (since it is on the administrative
    system and not the firewall system).

13) If your iptables/kernel included "Extended Connection Tracking
    Match support" (see the output of "shorewall show capabilities"),
    then a REDIRECT rule that specified a port list or range would
    cause Shorewall-perl to create invalid iptables-restore input:

    Running /usr/sbin/iptables-restore...
    iptables-restore v1.4.2-rc1: conntrack: Bad value for
       "--ctorigdstport" option: "1025:65535"
       Error occurred at line: 191
       Try `iptables-restore -h' or 'iptables-restore --help' for more information.
      ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input

Known Problems Remaiining:

1)  When exclusion is used in an entry in /etc/shorewall/hosts, then
    Shorewall-shell produces an invalid iptables rule if any of the
    following OPTIONS are also specified in the entry:

        blacklist
        maclist
        norfc1918
        tcpflags

New Feature in Shorewall 4.2.5

1)  A new 'fallback' option is added in
    /etc/shorewall/providers. The option works similar to 'balance'
    except that the default route is added in the default routing table
    (253) rather than in the main table (254).

    The option can be used by itself or followed by =<number> (e.g,
    fallback=2).

    When the option is used by itself, a separate (not balanced)
    default route is added with a metric equal to the provider's NUMBER.

    When the option is used with a number, a balanced route is added
    with the weight set to the specified number.

    'fallback' is ignored if USE_DEFAULT_RT=Yes in shorewall.conf and
    is only available with Shorewall-perl.

    'fallback' is useful in situations where:

    - You want all traffic to be sent via one primary provider unless
      there is a compelling reason to use a different provider

    - If the primary provider is down, then you want to balance the
      outgoing traffic among a set of other providers or to a
      ordered list of providers.

    In this case:

    - Do not specify 'balance' on any of the providers.
    - Disable route filtering ('ROUTE_FILTER=No' in shorewall.conf).
    - Specify 'fallback' on those providers that you want to use if
      the primary is down.
    - Only the primary provider should have a default route in the main
      routing table.

    See http://www.shorewall.net/MultiISP.html#Complete for an example
    of this option's use.

2)  Shorewall-perl now transparently handles the xtables-addon version
    of ipp2p. Shorewall detects whether the installed ipp2p is from
    patch-o-matic-ng or from xtables-addon and proceeds accordingly.

    If the patch-o-matic-ng version is installed:

    a) If no DEST PORT is supplied, the default is "--ipp2p".
    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to
       iptables-restore as "--ipp2p".

    If the xtables-addons version is installed:

    a) If no DEST PORT is supplied, the default is "--edk --gnu --dc
       --kazaa".
    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to
       iptables-restore as "--edk --gnu --dc --kazaa".

    Shorewall-perl now also accepts a comma-separated list of options
    (e.g., "edk,gnu,dc,kazaa).

    Additionally, Shorewall now looks for modules in /lib/modules/$(uname
    -r)/extra and in /lib/modules/$(uname -r)/extra/ipset

    This change introduced a new capability ("Old IPP2P Match Syntax")
    so if you use a capabilities file, be sure to re-generate the
    file(s) after you have installed 4.2.5.

3)  There is now a macro.Git, which opens git-daemon's port (9418/tcp).

4)  There is also a macro.IRC which open's the Internet Relay Chat port
    (6667/tcp).
+

2009-01-06 Winner of the Shorewall Logo Design Competition +Announced

+The Shorewall developers are pleased to announce that after deliberating
+upon the matter, we have chosen Gareth Davies' #3 design.
+

See +http://trac.shorewall.net/wiki/LogoDesignCompetition for details.
+

+

2008-12-31 Shorewall 4.2.4

+

+
1) In 4.2.4, two new packages are included:

   a) Shorewall6 - analagous to Shorewall-common but handles IPv6
      rather than IPv4.

   b) Shorewall6-lite - analagous to Shorewall-lite but handles IPv6
      rather than IPv4.

   The packages store their configurations in /etc/shorewall6/ and
   /etc/shorewall6-lite/ respectively.  

   The fact that the packages are separate from their IPv4 counterparts
   means that you control IPv4 and IPv6 traffic separately (the same
   way that Netfilter does). Starting/Stopping the firewall for one
   address family has no effect on the other address family.

   For additional information, see
   http://www.shorewall.net/IPV6Support.html.

   Other features of Shorewall6 are:

   a) There is no NAT of any kind (most people see this as a giant step
      forward). When an ISP assigns you a public IPv6 address, you are
      actually assigned an IPv6 'prefix' which is like an IPv4
      subnet. A 64-bit prefix allows 4 billion squared individual hosts
      (the size of the current IPv4 address space squared).

   b) The default zone type is ipv6.

   c) The currently-supported interface options in Shorewall6 are:

        blacklist
        bridge
        dhcp
        nosmurfs (traps multicast and Subnet-router anycast addresses
        used as the packet source address).
        optional
        routeback
        sourceroute
        tcpflags
        mss
        forward (setting it to 0 makes the router behave like a host
                 on that interface rather than like a router).

   d)  The currently-supported host options in Shorewall6 are:

        blacklist
        routeback
        tcpflags

   e)  Traffic Shaping is disabled by default. The tcdevices and
       tcclasses files are address-family independent so
       to use the Shorewall builtin Traffic Shaper, TC_ENABLED=Internal
       should be specified in Shorewall or in Shorewall6 but not in
       both. In the configuration where the internal traffic shaper is
       not enabled, CLEAR_TC=No should be specified.

       tcfilters are not available in Shorewall6.

   f)  When both an interface and an address or address list need to
       be specified in a rule, the address or list must be enclosed in
       angle brackets. Example:

        #ACTION      SOURCE                                     DEST
        ACCEPT       net:eth0:<2001:19f0:feee::dead:beef:cafe>  dmz

       Note that this includes MAC addresses as well as IPv6 addresses.

       The HOSTS column in /etc/shorewall6/hosts also uses this
       convention:

           #ZONE      HOSTS                                     OPTIONS
           chat6      eth0:<2001:19f0:feee::dead:beef:cafe>

       Even when an interface is not specified, it is permitted to
       enclose addresses in <> to improve readability. Example:

           #ACTION      SOURCE          DEST
           ACCEPT       net:<2001:1::1> $FW

   g)  The options available in shorewall6.conf are a subset of those
       available in shorewall.conf.

   h)  The Socket6.pm Perl module is required if you include DNS names
       in your Shorewall6 configuration. Note that it is loaded the
       first time that a DNS name is encountered so if it is missing,
       you get a message similar to this one:

       ...
       Checking /etc/shorewall6/rules...
       Can't locate Socket6.pm in @INC (@INC contains: /root ...
       teastep@ursa:~/Configs/standalone6$
+

2008-12-16 Shorewall 4.2.3

+

+
Problems corrected in Shorewall 4.2.3

1)  Previously, Shorewall would allow compilation for export of a
    script named 'shorewall' with the unfortunate side effect that
    the 'shorewall.conf' file was overwritten. Scripts named
    'shorewall' now cause a fatal error to be raised.

2)  Previously, Shorewall-perl attempted to do Shell variable
    substitution on the first line in /etc/shorewall/compile.

3)  Following the Netfilter tradition, the IPP2P maintainer has made an
    incompatible syntax change (the --ipp2p option has been
    removed). Shorewall has always used "-m ipp2p --ipp2p" when
    detecting the presence of IPP2P support.

    Shorewall-common and Shorewall-perl have been modified to use
    "-m ipp2p --edk" instead.

4)  When Extended Conntrack Match support was available, Shorewall-perl
    would create invalid iptables-restore input for certain DNAT rules.

5)  An optimization in all Shorewall-perl 4.2 versions could  cause
    undesirable side effects. The optimization deleted the
    <interface>_in and <interface>_fwd chains and moved their rules
    to the appropriate rules chain (a <zone>2<xxx> chain).

    This worked badly in cases where a zone was associated with more
    than one interface. Rules could be duplicated or, worse, a rule
    that was intended for only input from one of the interfaces would
    be applied to input from all of the zone's interfaces.

    This problem has been corrected so that an interface-related
    chains is only deleted if:

    a) the chain has no rules in it; or
    b) the interface is associated with only one zone and that zone is
       associated with only that interface in which case it is safe to
       move the rules.

Other changes in Shorewall 4.2.3

1)  Except with the -e option is specified, the Shorewall-perl compiler
    now verifies user/group names appearing in the USER/GROUP column of
    the rules file.

2)  The output of 'shorewall dump' now includes the output from
    'netstat -tunap'.

3)  Shorewall-perl now accepts '+' as an interface name in
    /etc/shorewall/interfaces. That name matches any interface and is
    useful for defining a zone that will match any interface that might
    be added after Shorewall is started.

    A couple of words of caution are in order.

    a) Because '+' matches any interface name, Shorewall cannot
       verify interface names appearing in other files when '+' is
       defined in /etc/shorewall/interfaces.

    b) The zone assigned to '+' must be the last one defined in
       /etc/shorewall/zones.

4)  Shorewall-perl now uses the iptables --goto parameter in obvious
    cases.

5)  The 'reset' command now allows you to reset the packet and byte
    counter on individual chains:

            shorewall reset chain1 chain2 ...
            shorewall-lite reset chain1 chain2 ...
+

2008-11-20 Shorewall 4.2.2

+

+Problems corrected in Shorewall 4.2.2 +

1)  Shorewall-perl now insures that each line copied from a
    configuration file or user exit is terminated with a newline
    character.

2) When ipranges were used to define zones, Shorewall-perl could
   generate invalid iptables-restore input if 'Repeat Match' was not
   available. Repeat Match is not a true match -- it rather is a
   feature of recent iptables releases that allows a match to be
   repeated within a rule.

3)  With Shorewall-perl, if a destination port list had exactly 16
    ports, where a port-range counts as two ports, then Shorewall-perl
    would fail to split the rule into multiple rules and an
    iptables-restore error would result.

4)  The change to Shorewall-perl in 4.2.1 that promised iptables 1.4.1
    compatibility contained a typo that prevented it from working
    correctly.

5)  If a no-NAT rule (DNAT-, ACCEPT+, NONAT) included a destination IP
    address and no zone name in the DEST column, Shorewall-perl would
    reject the rule. If a zone name was specified, Shorewall-perl 
    would issue a Warning message.

6)  Previously, if Extended conntrack match support was available, a
    DNAT rule that specified a server port but no destination port 
    would generate invalid iptables-restore input.     

Other changes in Shorewall 4.2.2

1)  A macro supporting JAP (anonymization protocol) has been added.
    It can be used as any other macro (e.g., JAP/ACCEPT) in the rules
    file.

2)  A macro supporting DAAP (Digital Audio Access Protocol) has been added.
    It can be used as any other macro (e.g., DAAP/ACCEPT) in the rules
    file.

3)  A macro supporting DCC (Distributed Checksum Clearinghouse) has been
    added.  It can be used as any other macro (e.g., DCCP/ACCEPT) in the
    rules file.

4)  A macro supporting GNUnet (secure peer-to-peer networking) has been
    added.  It can be used as any other macro (e.g., GNUnet/ACCEPT) in the
    rules file.

5)  In 4.2.1, a single capability ("Extended conntrack match support")
    was used both to control the use of --ctorigport and to trigger use
    of the new syntax for inversion of --ctorigdst (e.g., "!
    --ctorigdst ..."). In 4.2.2, these are controlled by two separate
    capabilities. If you use a capabilities file when compiling your
    configuration, be sure to generate a new one after installing
    4.2.2.
+

2008-10-25 Shorewall 4.2.1
+

+
Problems corrected in Shorewall 4.2.1

1)  A description of the CONNBYTES column has been added to
    shorewall-tcrules(5).

2)  Previously, Shorewall-perl would accept zero as the <max> value in
    the CONNBYTES column of tcrules even when the <min> field was
    non-zero. A value of zero for <max> was equivalent to omitting
    <max>.

3)  iptables 1.4.1 discontinued support of syntax generated by
    shorewall in some cases. Shorewall now detects when the new syntax
    is required and uses it instead.

4)  The Shorewall-perl implementation of the LENGTH column in
    /etc/shorewall/tcrules was incomplete with the result that 
    all LENGTH rules matched. Thanks to Lennart Sorensen for the patch.

5)  The 'export' command no longer fails with the error:

    /sbin/shorewall: 1413: Syntax error: "(" unexpected (expecting "fi")

Other changes in Shorewall 4.2.1

1)  With the recent renewed interest in DOS attacks, it seems
    appropriate to have connection limiting support in Shorewall. To
    that end, a CONNLIMIT column has been added to both the policy and
    rules files.

    The content of these columns is of the format

        [!] <limit>[:<mask>]

    where

        <limit> is the limit on simultaneous TCP connections.

        <mask>  specifies the size of the network to which
                the limit applies and is specified as a
                CIDR mask length. The default value for
                <mask> is 32 which means that each remote
                IP address can have <limit> TCP connections
                active at once.

        !       Not allowed in the policy file. In the rules file, it
                causes connections to match when the number of
                current connections exceeds <limit>.
    
    When specified in the policy file, the limit is enforced on all
    connections that are subject to the given policy (just like
    LIMIT:BURST). The limit is checked on new connections before the
    connection is passed through the rules in the NEW section of the
    rules file.

    It is important to note that while the limit is only checked for
    those destinations specified in the DEST column, the number of
    current connections is calculated over all destinations and not
    just the destination specified in the DEST column.

    Use of this feature requires the connlimit match capability in your
    kernel and iptables. If you use a capabilities file when compiling
    your Shorewall configuration(s), then you need to regenerate the
    file using Shorewall or Shorewall-lite 4.2.1.

2)  Shorewall now supports time/date restrictions on entries in the 
    rules file via a new TIME column.

    The contents of this column is a series of one or more "time
    elements" separated by apersands ("&"). Possible time elements are:

    utc         Times are expressed in Greenwich Mean Time.
    localtz     Times are expressed in local civil time (default)
    timestart=hh:mm[:ss]
    timestop=hh:mm[:ss]   Start and stop time of day for rule
    weekdays=ddd[,ddd]... where ddd is Mon,Tue,Wed,Thu,Fri,Sat or
                          Sun
    monthdays=dd[,dd]...  where dd is an ordinal day of the month.
    datestart=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
    datestop=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
                          where       yyyy = Year
                                first mm   = Month
                                      dd   = Day
                                      hh   = Hour
                                  2nd mm   = Minute
                                      ss   = Second

    Examples:

    1)  utc&timestart=10:00&timestop=12:00

        Between 10am and 12 noon each day, GMT

    2)  datestart=2008-11-01T12:00

        Beginning November 1, 2008 at noon LCT.

    Use of this feature requires the time match capability in your
    kernel and iptables. If you use a capabilities file when compiling
    your Shorewall configuration(s), then you need to regenerate the
    file using Shorewall or Shorewall-lite 4.2.1.
+

2006-10-05 Shorewall 4.2.0

+
Release Highlights.

1) Support is included for multiple internet providers through the same
   ethernet interface.

2) Support for NFLOG has been added.

3) Enhanced operational logging.

4) The tarball installers now work under Cygwin.

5) Shorewall-perl now supports IFB devices which allow traffic shaping of
   incoming traffic.

6) Shorewall-perl supports definition of u32 traffic classification
   filters.
+

+
+

2008-03-29 Shorewall 4.0.10

+

+
Problems corrected in Shorewall-perl 4.0.10.

1)  Shorewall-perl 4.0.9 erroneously reported an error message when a
    bridge port was defined in /etc/shorewall/interfaces:

     ERROR: Your iptables is not recent enough to support bridge ports

2)  Under Shorewall-perl, if an empty action was invoked or was named
    in one of the DEFAULT_xxx options in shorewall.conf, an
    iptables-restore error occured.

3)  If $ADMIN was empty, then the rule:

        ACCEPT loc:$ADMIN all

     became

        ACCEPT loc   net

     It is now flagged as an error.

4)  Previously, Shorewall-perl would reject an IP address range in the
    ecn and routestopped files.

5)  A POLICY of ":" in /etc/shorewall/policy would produce Perl
    run-time errors.

6)  An INTERFACE of ":" in /etc/shorewall/interfaces would produce Perl
    run-time errors.

7)  A MARK of ":" in /etc/shorewall/tcrules would produce Perl
    run-time errors.

Problems corrected in Shorewall-shell 4.0.10.

1)  Specifying a value for ACCEPT_DEFAULT or QUEUE_DEFAULT resulted in
    a fatal error at compile time.

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.10.

1)  The Sample configurations have been updated to set
    LOG_MARTIANS=keep. In 4.2, this will be changed to
    LOG_MARTIANS=Yes.

2)  Shorewall-perl now generates a fatal error if a non-existant shell
    variable is used in any configuration file (except
    /etc/shorewall/params).

3)  Shorewall-perl now supports an 'l2tp' tunnel type. It opens UDP
    port 1701 in both directions and assumes that the source port will
    also be 1701. Some implementations (particularly OS X) use a
    different source port. In that case, you should use
    'generic:udp:1701' rather than 'l2tp'.
+

2008-03-01 Shorewall 3.4.8

+
1)  Shorewall now removes any default bindings of ipsets before
    attempting to reload them. Previously, default bindins were not
    removed with the result that the ipsets could not be destroyed.


2)  When HIGH_ROUTE_MARKS=Yes, unpredictable results could occur when
    marking in the PREROUTING or OUTPUT chains. When a rule specified a
    mark value > 255, the compiler was using the '--or-mark' operator
    rather than the '--set-mark' operator with the result that when a
    packet matched more than one rule, the resulting routing mark was
    the logical product of the mark values in the rules.


    Example:


        0x100   192.168.1.44    0.0.0.0/0
        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25


    A TCP packet from 192.168.1.44 with destination port 25 would end
    up with a mark value of 0x300.


3)  Shorewall now properly parses comma separated SOURCE (formerly
    SUBNET) values in the masq configuration file.  Previously, the comma
    separated list was not split up into its components, resulting in an
    invalid address being passed to the iptables command.


    Example:


        # /etc/shorewall/masq
        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC
        eth0        192.168.2.1,192.168.2.3


4)  Previously, specifying both an interface and a MAC address in the
    SOURCE column of the tcrules file caused a failure at runtime.
    Thanks to Justin Joseph for the patch.


5)  Previously, specifying both an interface and an address in the
    tcrules DEST column would cause an incomplete rule to be generated.


    Example:


    1   192.168.1.4     eth2:206.124.146.177    tcp     22


    The resulting tcrule would be as if this had been specified:


    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22


6)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match
    fwmarks to routing tables overflowed the designated range for such
    marks (10000 - 11000).
+
+

2008-02-23 Shorewall 4.0.9

+

+
Problems corrected in Shorewall-perl 4.0.9.1

1)  In 4.0.9, Shorewall-perl incorrectly generated the following error
    message:

    ERROR: Your iptables is not recent enough to support bridge ports

Problems corrected in Shorewall-perl 4.0.9

1)  If a zone was defined with exclusion in /etc/shorewall/hosts, then
    the rules generated for directing outgoing connections to the zone
    were incorrect.

    Example:

    /etc/shorewall/zones:

    z   ipv4

    /etc/shorewall/interfaces:

    -   eth2    

    /etc/shorewall/hosts:

    z   eth2:192.168.1.0/24!192.168.1.5

    Traffic from the firewall to 192.168.1.5 was incorrectly classified
    as $FW->z.

2)  Qualifying 'SOURCE' and 'DEST' with an IP address in a macro file
    caused 'SOURCE' or 'DEST' to be interpreted incorrectly as the name
    of an interface.

    Example:

        PARAM   DEST    SOURCE:224.0.0.22

3)  Specifying '!<user>' in the USER/GROUP column of the files that
    support it resulted in an invalid iptables rule under
    Shorewall-perl.

4)  Previously, Shorewall would accept both an interface and an IP
    address in tcrules POSTROUTING entries (such as CLASSIFY).

    Example:

    1:11      eth1:192.168.4.9  -       tcp     22

    It also allowed both a destination interface and address.

    Example:

    1:P       -         eth1:192.168.4.9        tcp     22

    Because Netfilter does not allow an input interface to be specified
    in POSTROUTING or an output interface to be specified in
    PREROUTING, Shorewall must use the routing table to generate a list
    of networks accessed through any interface specified in these
    cases. Given that a specific address (or set of addresses) has
    already been specified, it makes no sense qualify it (them) by
    another list of addresses.

5)  Shorewall-perl incorrectly generated a fatal error when ':C', 
    ':T' or ':CT' was used in a tcrules entry that gave $FW as the
    SOURCE.

6)  Users have been confused about this error message:

    ERROR: Bridge Ports require Repeat match in your kernel and iptables 

    The message has been replaced with:

    ERROR:  Your iptables is not recent enough to support bridge ports

    The minimum version required is 1.3.8.

Problems corrected in Shorewall-shell 4.0.9.

1)  An optimization added to Shorewall-shell in 4.0.0 has been backed
    out to work around a limitation of Busybox 'sed'.

2)  Previously, specifying both an interface and an address in the
    tcrules DEST column would cause an incomplete rule to be generated.

    Example:

    1   192.168.1.4     eth2:206.124.146.177    tcp     22

    The resulting tcrule would be as if this had been specified:

    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22

3)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match
    fwmarks to routing tables previously overflowed the designated
    range defined for such marks (10000 - 11000). 

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.9.

1)  The Shorewall-perl now flags unprintable garbage characters in
    configuration files with the message:

        ERROR: Non-ASCII gunk in file 

2)  The /usr/share/shorewall/modules file has been updated to reflect
    module renaming in kernel 2.6.25.

3)  The 'ip route replace' command is broken in kernel 2.6.24. To work
    around this problem, the undocumented option BROKEN_ROUTING has
    been added to shorewall.conf. The default is BROKEN_ROUTING=No.

    If you are experiencing 'File Exists' errors from 'ip route
    replace' commands, then add the following line to your
    shorewall.conf:

        BROKEN_ROUTING=Yes

    Note: This workaround is only available in Shorewall-perl.
+

2008-01-25 Shorewall 4.0.8

+

+
Problems corrected in Shorewall-perl 4.0.8.

1)  Mark tests (such as in the TEST column of tcrules or the MARK
    column of the rules file) were ignoring the value 0. As part of
    this fix, the default mask generated by entries in these columns
    has been changed from 0xFF to 0xFFFF for compatibility with
    Shorewall-shell.

2)  The compilation date recorded in the firewall.conf file produced by
    Shorewall-perl was previously mangled.

3)  The ability to specify a DEST IP range (round-robin) in a DNAT rule
    has been restored. In versions 4.0.5 - 4.0.7, an IP range was
    incorrectly flagged as an error.

Problems corrected in Shorewall-shell 4.0.8.

1)  Shorewall-shell now properly parses comma separated SOURCE (formerly
    SUBNET) values in the masq configuration file.  Previously, the comma
    separated list was not split up into its components, resulting in an
    invalid address being passed to the iptables command.

    Example:

        # /etc/shorewall/masq
        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC
        eth0        192.168.2.1,192.168.2.3

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in 4.0.8.

None.
+
2007-12-26 Shorewall 4.0.7 +
Problems corrected in Shorewall-perl 4.0.7
+
1)  If any of the following files was missing, a harmless Perl warning
    was issued:
+
       accounting
       maclist
       masq
       nat
       netmap
       rfc1918
       routestopped
       tunnels
+
    This problem was experienced mostly by Debian users and users of
    Debian derivatives such as Ubuntu.
+
2)  The iptables utility doesn't retry operations that fail due to
    resource shortage. Beginning with this release, Shorewall reruns
    iptables when such a failure occurs.
+
3)  Previously, Shorewall-perl did not accept log levels in upper case
    (e.g., INFO). Beginning with 4.0.7, log levels are treated in a
    case-insensitive manner by Shorewall-perl.
+
4)  The column headers in macro files were not aligned. This has been
    corrected, along with some inaccuracies in the macro.template file.
+
5)  The shorewall.conf files in the Samples did not contain some
    recently-defined options. They are now up to date.
+
6)  The names of the Jabber macros were shuffled. They are now named
    correctly.
+
7)  If ADD_IP_ALIASES=Yes, an alias was incorrectly added when the
    specified INTERFACE ended with ":" (e.g., eth0:).
+
8)  Shorewall-shell generated an incorrect iptables rule from the
    following:
+
    /etc/shorewall/rules:
+
    ACCEPT     loc:eth0:~00-02-02-02-02-02  ...
+
    /etc/shorewall/tcrules:
+
    xxxx        eth0:~00-02-02-02-02-02 ...
+
Known Problems Remaining.
+
1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.
+
Other changes in 4.0.7
+
1)  If the program named in SHOREWALL_SHELL doesn't exist or is not
    executable, Shorewall and Shorewall-lite now both fall back to
    /bin/sh after issuing a warning message. Previously, both
    terminated with a fatal error.
+
2)  The error message has been improved when a non-root user attempts
    "shorewall show capabilities".
+
3)  Shorewall-perl now generates fatal error conditions when there are
    no IPv4 zones defined and when there are no interfaces defined.
+

2007-12-26 Shorewall 4.1.3

+
Problems corrected in Shorewall 4.1.3.
+
1)  If NFLOG or ULOG was specified with parameters, the resulting
    iptables-restore input contained elements that were incorrectly
    up-cased.
+
2)  If STARTUP_LOG is specified without LOG_VERBOSITY, /sbin/shorewall
    produces an error.
+
3)  If LOG_VERBOSITY is specified without STARTUP_LOG, run-time error
    messages are produced.
+
4)  Shorewall-shell was mishandling the entries in /etc/shorewall/rules
    and in /etc/shorewall/tcrules where both a SOURCE interface and MAC
    address were specified.
+
    Example:
+
    ACCEPT      net:eth0:~01-02-03-04-05-06    $FW      tcp     22
+
Other changes in Shorewall 4.1.3.
+
1)  If the program named in SHOREWALL_SHELL doesn't exist or is not
    executable, Shorewall and Shorewall-lite now both fall back to
    /bin/sh after issuing a warning message. Previously, both
    terminated with a fatal error.
+
2)  The error message has been improved when a non-root user attempts
    "shorewall show capabilities".
+
3)  Shorewall-perl now generates fatal error conditions when there are
    no IPv4 zones defined and when there are no interfaces defined.
+
4)  Shorewall now unconditionally uses tc filter rules to classify
    traffic by MARK value. Previously, Shorewall used the CLASSIFY
    target in the POSTROUTING chain if it was available.
+
5)  The Shorewall-common installer (install.sh) now works on Windows
    under Cygwin.
+
    To install Shorewall-perl under Cygwin:
+
    $ tar -xf shorewall-perl-4.1.3.tar.bz2
    $ tar -xf shorewall-common-4.1.3.tar.bz2
    $ cd shorewall-perl-4.1.3
    $ ./install.sh
    $ cd ../shorewall-common-4.1.3
    $ USER=<your user id> GROUP=None ./install.sh
    
    The 'shorewall' program is installed in /bin/ (a.k.a, /usr/bin/).
+

2007-11-23 Shorewall 4.0.6

+
Problems corrected in Shorewall-perl 4.0.6.

1)  In a DNAT or REDIRECT rule, if no serverport was given and the DEST
    PORT(S) list contained a service name containing a hyphen ("-") then
    an ERROR was generated.

    Example -- Rules file:

        DNAT    net     loc:$WINDOWS_IP tcp     https,pptp,ms-wbt-server,4125

    Results in:

        ERROR: Invalid port range (ms:wbt:server) : rules (line 49)

    Problem was introduced in Shorewall 4.0.5 and does not occur in
    earlier releases.

2)  If a long destination port list needed to be broken at a port pair,
    the generated rule contained an extra comma which resulted in an
    iptables-restore failure.

3)  Several problems involving port ranges and port lists in REDIRECT
    rules have been corrected.

4)  Shorewall-perl no longer requires an address in the GATEWAY column
    of /etc/shorewall/tunnels. If the column is left empty (or contains
    '-') then 0.0.0.0/0 is assumed.

5)  Previously with Shorewall-perl, redirecting both STDOUT and STDERR
    to the same file descriptor resulted in scrambled output between
    the two. The error messages were often in the middle of the
    regular output far ahead of the point where the error occurred.

    This problem was possible in the Debian Shorewall init script
    (/etc/init.d/shorewall) which redirects output to the
    Debian-specific /var/log/shorewall-init.log file in this way:

        $SRWL $SRWL_OPTS start >> $INITLOG 2>&1 && ...

6)  With both compilers, when HIGH_ROUTE_MARKS=Yes, unpredictable
    results could occur when marking in the PREROUTING or OUTPUT
    chains. When a rule specified a mark value > 255, the compilers
    were using the '--or-mark' operator rather than the '--set-mark'
    operator. Consequently, when a packet matched more than one
    rule, the resulting routing mark was the logical product of the
    mark values in the matching rules rather than the mark value from
    the last matching rule.

    Example:

        0x100   192.168.1.44    0.0.0.0/0
        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25

    A TCP packet from 192.168.1.44 with destination port 25 would have
    a  mark value of 0x300 rather than the expected value of 0x200.

7)  Previously, a 'start -f' on Shorewall Lite would produce the
    following distressing output before starting the firewall:

    make: *** No rule to make target `/firewall', needed by
    `/var/lib/shorewall-lite/restore'.  Stop.

    Furthermore, the Makefile for both Shorewall and Shorewall Lite
    failed to take into account the /etc/shorewall/vardir file.

    This has been corrected. As part of the fix, both /sbin/shorewall
    and /sbin/shorewall-lite support a "show vardir" command that
    displays the VARDIR setting.

8)  Shorewall-perl was previously ignoring the USER/GROUP column of the
    tcrules file.

9)  Supplying the name of a built-in chain in the 'refresh' command
    caused entries in the chain to be duplicated. Since this is a
    feature of iptables-restore with the '-n' option, built-in chains
    in the 'refresh' list will now be rejected.

Known Problems Remaining.

1)  The 'refresh' command doesn't refresh the mangle table. So changes
    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may
    not be reflected in the running ruleset.

Other changes in Shorewall 4.0.6.

1)  Shorewall-perl now uses the '--physdev-is-bridged' option when it
    is available. This option will suppress messages like the following:

    kernel: physdev match: using --physdev-out in the OUTPUT, FORWARD and
    POSTROUTING chains for non-bridged traffic is not supported
    anymore.

    This change only affects users who use bport/bport4 zones in a
    briged configuration and requires that capabilities files be
    regenerated using Shorewall-common or Shorewall-lite 4.0.6.

2)  Shorewall-perl now allows you to embed Shell or Perl scripts in
    all configuration files except /etc/shorewall/params and
    /etc/shorewall/shorewall.conf (As always, you can continue to
    include arbitrary shell code in /etc/shorewall/params).

    To embed a one-line script, use one of the following:

        SHELL <shell script>
        PERL <perl script>

    For multi-line scripts, use:

        BEGIN SHELL
        <shell script>
        END SHELL

        BEGIN PERL
        <perl script>
        END PERL

    For SHELL scripts, the output from the script is processed as if it
    were part of the file.

    Example 1 (Shell): To generate SMTP/ACCEPT rules from zones a b c d
    and e to the firewall:

        Either:

            BEGIN SHELL 
            for z in a b c d e; do
                echo SMTP/ACCEPT $z fw tcp 25
            done
            END SHELL

        or

            SHELL for z in a b c d e; do echo SMTP/ACCEPT $z fw tcp 25; done

    Either is equivalent to:

        SMTP/ACCEPT a fw tcp 25
        SMTP/ACCEPT b fw tcp 25
        SMTP/ACCEPT c fw tcp 25
        SMTP/ACCEPT d fw tcp 25
        SMTP/ACCEPT e fw tcp 25

    With a Perl script, if you want to output text to be processed as
    if it were part of the file, then pass the text to the shorewall()
    function.

    Example 2 (Perl): To generate SMTP/ACCEPT rules from zones a b c d
    and e to the firewall:

          BEGIN PERL 
          for ( qw/a b c d e/ ) { 
              shorewall "SMTP/ACCEPT $_ fw tcp 25";
          }
          END PERL

    PERL scripts have access to any context accumulated in earlier PERL
    scripts. All such embedded Perl, as well as conventional Perl
    extension scripts are placed in the Shorewall::User package. That
    way, your global variables and functions won't conflict with any of
    Shorewall's.

    To allow you to load Perl modules and initialize any global state,
    a new 'compile' compile-time extension script has been added. It is
    called early in the compilation process.

    For additional information, see

    - http://www.shorewall.net/configuration_file_basics.html#Embedded

3)  To complement Embedded Perl scripts, Shorewall 4.0.6 allows Perl
    scripts to create filter chains using
    Shorewall::Chains::new_manual_chain() and then use the chain as a
    target in subsequent entries in /etc/shorewall/rules.

    See http://www.shorewall.net/ManualChains.html for information.

4)  The 'hits' command now accepts a -t option which limits the report
    to those log records generated today.

5)  A DONT_LOAD option has been added to shorewall.conf. If there are
    kernel modules that you don't wish to have loaded, you can list
    them in this entry as a comma-separated list.

    Example:

        DONT_LOAD=nf_conntrack_sip,nf_nat_sip

6)  Shorewall-perl now supports the --random option of the iptables
    SNAT, MASQUERADE, DNAT and REDIRECT targets. Please note that
    iptables support for this option is currently broken for the DNAT
    and REDIRECT targets; I've sent a patch to the Netfilter team.

    For MASQUERADE, simply place the word 'random' in the ADDRESS
    column. This causes Netfilter to randomize the source port seen by
    the remote host.

     Example:

        #INTERFACE      SOURCE  ADDRESS
        eth0            eth1    random    

    For SNAT, follow the port list by ":random".

    Example:

        #INTERFACE      SOURCE  ADDRESS
        eth0            eth1    206.124.146.179:10000-10999:random

    For DNAT, follow the port list by ":random".

    Example:

        #ACTION SOURCE  DEST                            PROTO   DEST
        #                                               PORT(S)
        DNAT    net     loc:192.168.1.4:40-50:random    tcp     22

    For REDIRECT, you must use the fully-qualified form of the DEST:

        #ACTION   SOURCE        DEST                    PROTO   DEST
        #                                               PORT(S)
        REDIRECT        net     $FW::40-50:random       tcp     22

    Note that ':random' is only effective with SNAT, DNAT and REDIRECT
    when a port range is specified in the ADDRESS/DEST column. It is
    ignored by iptables/iptables-restore otherwise.
+
+

2007-10-22 Shorewall 4.0.5

+
Problems corrected in Shorewall 4.0.5.

1)  Previously, Shorewall-perl misprocessed $FW::<port> in the DEST
    column of a REDIRECT rule, generating an error. '$FW::<port>' now
    produces the same effect as '<port>'.

2)  If the PROTOCOL (PROTO) column contained 'TCP' or 'UDP' and SOURCE
    PORT(S) or DEST PORT(S) were given, then Shorewall-perl rejected
    the entry with the error:

    ERROR: SOURCE/DEST PORT(S) not allowed with PROTO TCP : /etc/shorewall/rules 

    The rule was accepted if 'tcp' or 'udp' was used instead.

3)  Shorewall-shell now removes any default bindings of ipsets before
    attempting to reload them. Previously, default bindings were not
    removed with the result that the ipsets could not be destroyed.

Other changes in Shorewall 4.0.5.

1)  Two new options have been added to /etc/shorewall/hosts
    (Shorewall-perl only).

    broadcast: Permits limited broadcast (destination 255.255.255.255)
               to the zone.

    destonly: Normally used with the Multi-cast range. Specifies that
              traffic will be sent to the specified net(s) but that 
              no traffic will be received from the net(s).

    Example:

    wifi        eth1:192.168.3.0/24             broadcast
    wifi        eth1:224.0.0.0/4                destonly

    In that example, limited broadcasts from the firewall with a source
    IP in the 192.168.3.0/24 range will be acccepted as will multicasts
    (with any source address).

2)  A MULTICAST option has been added to shorewall.conf. This option
    will normally be set to 'No' (the default). It should be set to 
    'Yes' under the following circumstances:

    a) You have an interface that has parallel zones defined via
       /etc/shorewall/hosts.
    b) You want to forward multicast packets to two or more of those
       parallel zones.

    In such cases, you will configure a 'destonly' network on each 
    zone receiving multicasts.

    The MULTICAST option is only recognized by Shorewall-perl and is
    ignored by Shorewall-shell.

3)  As announced in the Shorewall 4.0.4 release notes, Shorewall-perl
    no longer supports the 'detectnets' option. Specifying that option
    now results in the following message:

    WARNING: Support for the 'detectnets' option has been removed

    It is suggested that 'detectnets' be replaced by
    'routefilter,logmartians'. That will produce the same filtering
    effect as 'detectnets' while eliminating 1-2 rules per connection.

    One user has asked how to retain the output of 'shorewall show
    zones' if the 'detectnets' option is removed. While I don't advise
    doing so, you can reproduce the current 'shorewall show' behavior
    as follows.

    Suppose that you have a zone named 'wifi' that produces the
    following output with 'detectnets':

    wifi (ipv4)
      eth1:192.168.3.0/24
 
    You can reproduce this behavior as follows:

    /etc/shorewall/interfaces:

    -   eth1    detect  ...

    /etc/shorewall/hosts:

    wifi        eth1:192.168.3.0/24     broadcast

    If you send multicast to the 'wifi' zone, you also need this entry
    in your hosts file:

    wifi        eth1:224.0.0.0/4                destonly

4)  (Shorewall-perl only) The server port in a DNAT or REDIRECT rule
    may now be specified as a service name from
    /etc/services. Additionally:

    a) A port-range may be specified as the service port expressed in
       the format <low port>-<high port>. Connections are assigned to
       server ports in round-robin fashion.

    b) The compiler only permits a server port to be specified if the
       protocol is tcp or udp.

    c) The compiler ensures that the server IP address is valid (note
       that it is still not permitted to specify the server address as a
       DNS name).

5)  (Shorewall-perl only) Users are complaining that when they migrate
    to Shorewall-perl, they have to restrict their port lists to 15
    ports. In this release, we relax that restriction on destination
    port lists. Since the SOURCE PORT(s) column in the configuration
    files is rarely used, we have no plans to relax the restriction in
    that column.

6)  There have been several cases where iptables-restore has failed
    while executing a COMMIT command in the .iptables_restore_input
    file. This gives neither the user nor Shorewall support much to go
    on when analyzing the problem. As a new debugging aid, the meaning
    of 'trace' and 'debug' have been changed.

    Traditionally, /sbin/shorewall and /sbin/shorewall-lite have
    allowed either 'trace' or 'debug' as the first run-line
    parameter. Prior to 4.0.5, the two words produced the same effect.

    Beginning with Shorewall 4.0.5, the two words have different
    effects when Shorewall-perl is used.

    trace - Like the previous behavior.

            In the Shorewall-perl compiler, generate a stack trace
            on WARNING and ERROR messages.

            In the generated script, sets the shell's -x option to
            trace execution of the script.

    debug - Ignored by the Shorewall-perl compiler.

            In the generated script, causes the commands in
            .iptables_restore_input to be executed as discrete iptables
            commands. The failing command can thus be identified and a
            diagnosis of the cause can be made.

    Users of Shorewall-lite will see the following change when using a
    script that was compiled with Shorewall-perl 4.0.5 or later.

    trace - In the generated script, sets the shell's -x option to
            trace execution of the script.

    debug - In the generated script, causes the commands in
            .iptables_restore_input to be executed as discrete iptables
            commands. The failing command can thus be identified and a
            diagnosis of the cause can be made.

    In all other cases, 'debug' and 'trace' remain synonymous. In
    particular, users of Shorewall-shell will see no change in
    behavior.

    WARNING: The 'debug' feature in Shorewall-perl is strictly for
    problem analysis. When 'debug' is used:

    a) The firewall is made 'wide open' before the rules are applied.
    b) The routestopped file is not consulted and the rules are applied
       in the canonical iptables-restore order (ASCIIbetical by chain).
       So if you need critical hosts to be always available during
       start/restart, you may not be able to use 'debug'.

7)  /usr/share/shorewall-perl/buildports.pl,
    /usr/share/shorewall-perl/FallbackPorts.pm and 
    /usr/share/shorewall-perl/Shorewall/Ports.pm have been removed.

    Shorewall now resolves protocol and port names as using Perl's
    interface to the the standard C library APIs getprotobyname() and
    getservbyname().

    Note 1: 

           The protocol names 'tcp', 'TCP', 'udp', 'UDP', 'all', 'ALL',
           'icmp' and 'ICMP' are still resolved by Shorewall-perl
           itself.

    Note 2:

           Those of you running Shorewall-perl under Cygwin may wish to
           install "real" /etc/protocols and /etc/services files
           in place of the symbolic links installed by Cygwin.

8)  The contents of the Shorewall::*::$VERSION variables are now a
    only of interest for Perl programs that are using the modules and
    specifying a minimum version (e.g., "use Shorewall::Config
    4.0.5;"). Each module continues to carry a separate version which
    indicates the release of Shorewall-perl when the module was last
    modified
+
+

2007-10-02 Shorewall 3.4.7

+
Problems Corrected in Shorewall 3.4.7

1)  A bug prevented proper handling of PREROUTING marks when
    HIGH_ROUTE_MARKS=No and the track option was specified in
    /etc/shorewall/providers.

2) Previously, if the following sequence of routing rules was
   specified, then the first rule would always be omitted.

   #SOURCE    DEST      PROVIDER     PRIORITY
   $SRC_A     $DESTIP1  ISP1         1000
   $SRC_A     $DESTIP2  SOMEISP      1000
   $SRC_A     -         ISP2         1000

   The reason for this omission was that Shorewall uses a
   delete-before-add approach and attempting to delete the third rule
   resulted in the deletion of the first one instead. 

   This problem occurred with both compilers.

3) When using Shorewall-shell, provider numbers were not recognized in
   the PROVIDER column of /etc/shorewall/route_rules.
+
+

2007-09-28 Shorewall 4.0.4

+
Problems Corrected in Shorewall 4.0.4

1)  If no interface had the 'blacklist' option, then when using
    Shorewall-perl, the 'start' and 'restart' command failed:

        ERROR: No filter chain found with name blacklst

    New Shorewall-perl 4.0.3 packages were released that corrected this
    problem; it is included here for completeness.

2)  If no interface had the 'blacklist' option, then when using
    Shorewall-perl, the generated script would issue this harmless
    message during 'shorewall refresh':

        chainlist_reload: Not found

3)  If /bin/sh was a light-weight shell such as ash or dash, then
    'shorewall refresh' failed.

4)  During start/restart, the script generated by Shorewall-perl was
    clearing the proxy_arp flag on all interfaces; that is not the
    documented behavior.

5)  If the module-init-tools package was not installed and
    /etc/shorewall/modules did not exist or was non-empty, then
    Shorewall-perl would fail with the message:

       ERROR: Can't run lsmod : /etc/shorewall/modules (line 0)

6)  Shorewall-perl now makes a compile-time check to insure that
    iptables-restore exists and is executable. This check is made when
    the compiler is being run by root and the -e option is not
    given.

    Note that iptables-restore must reside in the same directory as the
    iptables executable specified by IPTABLES in shorewall.conf or
    located by the PATH in the event that IPTABLES is not specified.

7)  When using Shorewall-perl, if an action was invoked with more than
    10 different combinations of log-levels/tags, some of those
    invocations would have incorrect logging.

8)  Previously, when 'shorewall restore' was executed, the
    iptables-restore utility was always located using the PATH setting
    rather than the IPTABLES setting.

    With Shorewall-perl, the IPTABLES setting is now used to locate
    this utility during 'restore' as it is during the processing of
    other commands.

9)  Although the shorewall.conf manpage indicates that the value
    'internal' is allowed for TC_ENABLED, that value was previously
    rejected ('Internal' was accepted).

10) The meaning of the 'loose' provider option was accidentally reversed
    in Shorewall-perl. Rather than causing certain routing rules to be
    omitted when specified, it actually caused them to be added (these
    rules were omitted when the option was NOT specified).

11) If the 'bridge' option was specified on an interface but there were
    no bport zones, then traffic originating on the firewall was not
    passed through the accounting chain.

12) In commands such as:

       shorewall compile <directory>
       shorewall restart <directory>
       shorewall check <directory>

    if the name of the <directory> contained a period ("."), then
    Shorewall-perl would incorrectly substitute the current working
    directory for the name.

13) Previously, if the following sequence of routing rules was
    specified, then the first rule would always be omitted.

    #SOURCE    DEST      PROVIDER     PRIORITY
    $SRC_A     $DESTIP1  ISP1         1000
    $SRC_A     $DESTIP2  SOMEISP      1000
    $SRC_A     -         ISP2         1000

    The reason for this omission was that Shorewall uses a
    delete-before-add approach and attempting to delete the third rule
    resulted in the deletion of the first one instead. 

    This problem occurred with both compilers.

14) When using Shorewall-shell, provider numbers were not recognized in
    the PROVIDER column of /etc/shorewall/route_rules.

15) An off-by-one problem in Shorewall-perl caused the value 255 to be
    rejected in the MARK column of /etc/shorewall/tcclasses.

16) When HIGH_ROUTE_MARKS=Yes, marks with values > 255 must be a
    multiple of 256. That restriction was being enforced by
    Shorewall-shell but not by Shorewall-perl. Shorewall-perl now also
    enforces this restriction.

17) Using REDIRECT with a parameterized macro (e.g., DNS/REDIRECT)
    failed with an "Unknown interface" error when using Shorewall-perl.

Other Changes in Shorewall 4.0.4

1)  The detection of 'Repeat Match' has been improved. 'Repeat Match'
    is not a match at all but rather is a feature of recent versions of
    iptables that allows a particular match to be used multiple times
    within a single rule.

    Example:

      -A foo -m physdev --physdev-in eth0 -m physdev --physdev-out ...

    When using Shorewall-shell, the availability of 'Repeat Match' can
    speed up compilation very slightly.

2)  Apparently recent Fedora releases are broken. The
    following sequence of commands demonstrates the problem:

    ip rule add from 1.1.1.1 to 10.0.0.0/8 priority 1000 table 5
    ip rule add from 1.1.1.1 to 0.0.0.0/0 priority 1000 table main
    ip rule del from 1.1.1.1 to 0.0.0.0/0 priority 1000

    The third command should fail but doesn't; instead, it incorrectly
    removes the rule added by the first command.
    To work around this issue, you can set DELETE_THEN_ADD=No in
    shorewall.conf which prevents Shorewall from deleting ip rules
    before attempting to add a similar rule.

3)  When using Shorewall-perl, the following message is now issued if
    the 'detectnets' option is specified in /etc/shorewall/interfaces:

    WARNING: Support for the 'detectnets' option will be removed from
    Shorewall-perl in version 4.0.5; better to use 'routefilter' and
    'logmartians

    The 'detect' options has always been rather silly. On input, it
    duplicates the function of 'routefilter'. On output, it is a no-op
    since traffic that doesn't match a route out of an interface won't
    be sent through that interface (duh!).

    Beginning with Shorewall 4.0.5, the warning message will read:

    WARNING: Support for the 'detectnets' option has been removed
+
+

2007-09-01 Shorewall 4.0.3

+
Problems Corrected in 4.0.3

1) Using the LOG target in the rules file could result in two LOG
   rules being generated by Shorewall-shell. Additionally, using an IP
   address range in a rule that performed logging could result in an
   invalid iptables command.

2)  Shorewall now loads the act_police kernel module needed by traffic
    shaping.

3)  Previously, "shorewall show -f capabilities" and "shorecap" omitted
    the "TCPMSS Match" capability. This made it appear to a compiler
    using a capabilities file that the TCPMSS Match capability was not
    available.

4)  Previously, Shorewall would truncate long log prefixes to 29
    characters. This resulted in there being no space between the log
    prefix and the IN= part of the message.

    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0

    Beginning with this release, Shorewall will truncate the prefix to
    28 bytes and add a trailing space.

    Example: fw2net:LOG:HTTPSou IN= OUT=eth0

5)  Previously, if:

    - FASTACCEPT=No
    - The policy from Z1 to Z2 was CONTINUE
    - Neither Z1 nor Z2 had parent zones
    - There were no Z1->Z2 rules

    then connections from Z2->Z1 would fail even if there were
    rules/policies allowing them. This has been
    corrected.

6)  The 'shorewall add' and 'shorewall delete' command would fail when:

    - The running configuration was compiled with Shorewall-perl.
    - The name of the interface specified in the command contained an
      embedded special character such as '.' or '-'.

    This problem was the result of the change in Shorewall 4.0.2 that
    removed the legacy mapping of interface names when embedding such
    names in a Netfilter chain name. To correct the problem, the
    pre-4.0.2 name mapping is restored when DYNAMIC_ZONES=Yes.

5)  A bug in Shorewall-shell prevented proper handling of PREROUTING
    marks when HIGH_ROUTE_MARKS=No and the track option was specified
    in /etc/shorewall/providers.

6)  With Shorewall-perl, if EXPORTPARAMS=Yes then INCLUDE directives in
    the params file would fail at script execution time with "INCLUDE:
    not found". This has been corrected.

7)  Shorewall-perl was mis-sorting the zone list when zones were nested
    more than one deep.

8)  Stale references to http://www.shorewall.net/Documentation.htm have
    been removed from the config files (including samples). That URL
    has been replaced by the online manpages.

Other Changes in 4.0.3

1)  A script generated by Shorewall-perl now tries to modify/restore
    /etc/iproute2/rt_tables only if the file is writable. This prevents
    run-time errors when /etc is mounted read-only.
  
    A new KEEP_RT_TABLES option has been added to shorewall.conf. When
    set to Yes, this option prevents Shorewall from altering the
    /etc/iproute2/rt_tables database. The KEEP_RT_TABLES option is only
    recognized by Shorewall-perl and is ignored by Shorewall-shell.

2)  Shorewall-perl now requires the FindBin Perl module.

3)  When an optional provider is not available, a script generated by
    Shorewall-perl will no longer add the corresponding
    routing rules.

4)  A new 'isusable' extension script has been added. This script
    allows you to extend the availability test that Shorewall performs
    on optional providers.

    Here's an example that uses ping to ensure that the default
    gateways through eth0 and eth1 are reachable:

    case $1 in
        eth0)
            ping -c 4 -I eth0 206.124.146.254 > /dev/null 2>&1
            return
           ;;
        eth1)
            ping -c 4 -I eth1 192.168.12.254 > /dev/null 2>&1
            return
            ;;
        *)
            # Assume we don't need to do any additional testing
            # for this interface beyond Shorewall's
            return 0
            ;;
    esac

    Additional information is available at
    http://www.shorewall.net/shorewall_extension_scripts.htm.

5)  Processing of the message log in the 'show log', 'logwatch' and
    'dump' commands has been speeded up thanks to a suggestion by
    Andrew Suffield.

6)  Beginning with Shorewall 4.0, the shorewall 'stop', and 'clear'
    commands were processed by the generated script from the
    last successful 'start', 'restart' or 'refresh' command. This had
    the side effect that updates to the /etc/shorewall/routestopped
    file did not take effect until one of those three commands was
    successfully processed.

    Beginning with Shorewall 4.0.3, the old 3.x behavior is restored as
    the default and the 4.0 behavior is enabled using the '-f' command
    option.

    Example: shorewall stop -f

    is only recognized by Shorewall-perl and causes Shorewall to set
    the MSS field in forwarded TCP SYN packets going in or out the
    interface to the value that you specify.

    Example:

    #ZONE       INTERFACE       BROADCAST       OPTIONS
    vpn         ppp0            -               mss=1400

    The mss option only affects incoming traffic that has not been
    decrypted by IPSEC and outgoing traffic that will not subsequently
    be encrypted by IPSEC. The MSS for IPSEC traffic is managed by the
    'mss' option in /etc/shorewall/zones.

8)  Shorewall now detects the presence of the 'hashlimit match'
    capability. There is no builtin support yet for hashlimit but
    detection allows extension scripts for user-supplied actions to
    determine if the capability exists.

    With Shorewall-shell, $HASHLIMIT_MATCH will be non-empty if the
    capability exists.

    With Shorewall-perl, $capabilities{HASHLIMIT_MATCH} will be true in
    a boolean context if the capability exists. Shorewall-perl users
    may also code the following in their extension script:

    use Shorewall::Config;

    require_capability( 'HASHLIMIT_MATCH',      #Capability
                        'My hashlimit action' , #Feature requiring 
                                                #capability
                        's' );                  #Feature is singular
                                                #(if plural, pass the
                                                  empty string)

    That call would procduce the following fatal error if the
    capability isn't available:

    ERROR: My hashlimit action requires the Hashlimit match capability
           in your kernel and iptables

9)  NFQUEUE support has been added to Shorewall-perl.

    NFQUEUE may appear in actions, macros, rules and as a policy.
    When NFQUEUE is used by itself, queue number zero is assumed. To
    specify a queue number, follow NFQUEUE by a slash ("/") and the
    queue number.

    Examples (/etc/shorewall/rules):

    NFQUEUE             loc     net     tcp #Queue number 0
    NFQUEUE/22          loc     net     udp #Queue number 22
    NFQUEUE/22:info     loc     net     gre #With logging

    An NFQUEUE_DEFAULT option has been added to shorewall.conf for
    specifying the default action to use with NFQUEUE policies.

    Use of NFQUEUE requires the NFQUEUE Target capability in your
    kernel/iptables. If you intend to use NFQUEUE with Shorewall-lite,
    then you must install Shorewall-lite 4.0.3 in order to build a
    capabilities file that includes NFQUEUE Target. If your
    capabilities file was generated by a Shorewall/Shorewall-lite
    version earlier that 4.0.3, you will receive a warning during
    compilation.

10) The 'refresh' command can now refresh chains other than 'blacklst'.

    The syntax of the command is now:

        shorewall refresh [ <chain> ... ]

    If no <chain> is given then 'blacklst' is assumed. Otherwise, the
    Shorewall-perl compiler compiles a script whose 'refresh' command
    refreshes the listed <chain>(s).

    The listed chains are assumed to be in the filter table. You can
    refresh chains in other tables by prefixing the chain name with the
    table name followed by ":" (e.g., nat:net_dnat). Chain names which
    follow are assumed to be in that table until the end of the list or
    until an entry in the list names another table.

    This feature requires Shorewall-perl 4.0.3 as well as
    Shorewall-common 4.0.3.
+
+

2007-08-19 Shorewall 3.4.6

+
Problems Corrected in 3.4.6.

1)  If the "Mangle FORWARD Chain" capability was supported, entries in
    the /etc/shorewall/ecn file would cause invalid iptables
    commands to be generated.

2)  Certain errors occurring during
    start/restart/safe-start/safe-restart/try processing could cause
    the lockfile to be left behind. This resulted in a 60-second delay
    the next time one of these commands was run.

3)  It was not previously possible to define traffic shaping on a
    bridge port; the generated script complained that the
    interface was not up and configured.

4)  Previously, using a port list in the DEST PORT(S) column of the
    rules file or in an action file caused an invalid iptables command
    to be generated.

5)  Using the LOG target in the rules file could result in two LOG
    rules being generated. Additionally, using an IP address range in a
    rule that performed logging could result in an invalid iptables
    command.

6)  Shorewall now loads the act_police kernel module needed by traffic
    shaping.

7)  Previously, "shorewall show -f capabilities" and "shorecap" omitted
    the "TCPMSS Match" capability. This made it appear to a compiler
    using a capabilities file that the TCPMSS Match capability was not
    available.

8)  Previously, Shorewall would truncate long log prefixes to 29
    characters. This resulted in there being no space between the log
    prefix and the IN= part of the message.

    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0

    Beginning with this release, Shorewall will truncate the prefix to
    28 bytes and add a trailing space.

    Example: fw2net:LOG:HTTPSou IN= OUT=eth0

9)  Previously, if:

    - FASTACCEPT=No
    - The policy from Z1 to Z2 was CONTINUE
    - Z1 and Z2 were orphans (neither had parent zones)
    - There were no Z1->Z2 rules

    then connections from Z2->Z1 would fail even if there were
    rules/policies allowing them. This has been
    corrected. 
    
Other changes in 3.4.6.

1)  Processing of the message log in the 'show log', 'logwatch' and
    'dump' commands has been speeded up thanks to a suggestion by
    Andrew Suffield.
+
+

2007-08-10 Shorewall 4.0.2

+
Problems corrected in 4.0.2

1)  The Shorewall-perl compiler was still generating invalid
    iptables-restore input from entries in /etc/shorewall/ecn.

2)  When using Shorewall-perl, unless an interface was specified as
    'optional' in the interfaces file, the 'restore' command would
    fail if the routes through the interface or the addresses on the
    interface could not be detected.

    Route detection occurs when the interface is named in the SOURCE
    column of the masq file. Address detection occurs when
    DETECT_DNAT_IPADDRS=Yes and the interface is the SOURCE for a DNAT
    or REDIRECT rule or when 'maclist' is specified for the interface.
   
    Since the 'restore' command doesn't use the detected information,
    detection is now skipped if the command is 'restore'.

3)  It was not previously possible to define traffic shaping on a
    bridge port; the generated script complained that the
    interface was not up and configured.

4)  When Shorewall-shell was not installed, certain options in
    /etc/shorewall/interfaces and /etc/shorewall/hosts would cause the
    'add' and 'delete' commands to fail with a missing library error.

          OPTION               FILE
          maclist              interfaces,hosts
          proxyarp             interfaces

5)  The /var/lib/shorewall/zones file was being overwritten during
    processing of the 'refresh' command by a script generated with
    Shorewall-perl. The result was that hosts previously added to
    dynamic zones could not be deleted after the 'refresh'.

6)  If the file named as the output file in a Shorewall-perl 'compile'
    command was a symbolic link, the generated error message
    erroneously stated that the file's parent directory was a symbolic
    link.

    As part of this change, cosmetic changes were made to a number of
    other error messages.

7)  Some intra-zone rules were missing when a zone involved multiple
    interfaces or when a zone included both IPSEC and non-IPSEC
    networks.

8)  Shorewall was not previously loading the xt_multiport kernel
    module.

9)  The Russian and French translations no longer have English headings
    on notes, cautions, etc..

10) Previously, using a port list in the DEST PORT(S) column of the
    rules file or in an action file could cause an invalid iptables
    command to be generated by Shorewall-shell.

11) If there were no bridges in a configuration, Shorewall-perl would
    ignore the CHAIN column in /etc/shorewall/accounting.

Other changes in 4.0.2

1)  Shorewall-perl now detects when a port range is included in a list
    of ports and iptables/kernel support for Extended Multi-port Match
    is not available. This avoids an iptables-restore failure at
    run-time.

2)  Most chains created by Shorewall-shell have names that can be
    embedded within shell variable names. This is a workaround for
    limitations in the shell programming language which has no
    equivalent to Perl hashes. Often chain names must have the name of
    a network interface encoded in them. Given that interface names can
    contain characters that are invalid in a shell variable name,
    Shorewall-shell performs a name mapping which was carried forward to
    Shorewall-perl:

    - Trailing '+' is dropped.
    - The characters ".", "-", "%' and "@" are translated to "_".

    This mapping has been elminated in the 4.0.2 release of Shorewall-
    perl. So where before you would see chain "eth0_0_in", you may now
    see the same chain named "eth0.0_in". Similarly, a chain previously
    named "ppp_fwd" may now be called "ppp+_fwd".

3)  Shorewall-perl now uses the contents of the BROADCAST column in
    /etc/shorewall/interfaces when the Address Type match capability is
    not available.
+
+

2007-07-30 Shorewall 4.0.1

+
Problems corrected in 4.0.1.

1)  The Shorewall Lite installer was producing an empty shorewall-lite
    manpage. Since the installer runs as part of creating the RPM, the
    RPM also suffered from this problem. The 4.0.0 Shorewall-lite 
    packages were re-uploaded with this problem corrected.

2)  The Shorewall Lite uninstaller incorrectly removed /sbin/shorewall
    rather than /sbin/shorewall-lite.

3)  Both the Shorewall and Shorewall Lite uninstallers did a "shorewall
    clear" if Shorewall [Lite] was running. Now, the Shorewall Lite
    uninstaller correctly does "shorewall-lite clear" and both
    uninstallers only perform the 'clear' operation if the other
    product is not installed. This prevents the removal of one of the
    two products from clearing the firewall configuration established
    by the other one.

4)  The 'ipsec' OPTION in /etc/shorewall/hosts was mis-handled by
    Shorewall-perl. If the zone type was changed to 'ipsec' or
    'ipsec4' and the 'ipsec' option removed from the hosts file entry,
    the configuration worked properly.

5)  If a CLASSID was specified in a tcrule and TC_ENABLED=No, then
    Shorewall-perl produced the following:

    Compiling...
    Use of uninitialized value in string ne at /usr/share/shorewall-perl/Shorewall/Tc.pm line 285, <$currentfile> line 18.
       ERROR: Class Id n:m is not associated with device eth0 : /etc/shorewall/tcrules (line 18)

6)  If IPTABLES was not specified in shorewall.conf, Shorewall-perl was
    locating the binary using the PATH environmental variable rather
    than the PATH setting in shorewall.conf.  If no PATH was available
    when Shorewall-perl was run and IPTABLES was not set in
    shorewall.conf, the following messages were issued:

    Use of uninitialized value in split at /usr/share/shorewall-perl/Shorewall/Config.pm line 1054.
       ERROR: Can't find iptables executable
       ERROR: Shorewall restart failed

7)  If the "Mangle FORWARD Chain" capability was supported, entries in
    the /etc/shorewall/ecn file would cause invalid iptables commands
    to be generated. This problem occurred with both compilers.

8)  Shorewall now starts at reboot after an upgrade from shorewall <
    4.0.0. Previously, Shorewall was not started automatically at
    reboot after an upgrade using the RPMs.

9)  Shorewall-perl was generating invalid iptables-restore input when a
    log level was specified with the dropBcast and allowBcast builtin
    actions and when a log level followed by '!' was used with any
    builtin actions.

10) Shorewall-perl was incorrectly rejecting 'min' as a valid unit of
    time in rate-limiting specifications.

11) Certain errors occurring during
    start/restart/safe-start/safe-restart/try processing could cause
    the lockfile to be left behind. This resulted in a 60-second delay
    the next time one of these commands was run.

Other changes in Shorewall 4.0.1.

1)  A new EXPAND_POLICIES option is added to shorewall.conf. The
    option is recognized by Shorewall-perl and is ignored by
    Shorewall-shell.

    Normally, when the SOURCE or DEST columns in shorewall-policy(5)
    contains 'all', a single policy chain is created and the policy is
    enforced in that chain. For example, if the policy entry is

             #SOURCE DEST POLICY LOG
             #                   LEVEL
             net     all  DROP   info

    then the chain name is 'net2all' which is also the chain named in
    Shorewall log messages generated as a result of the policy. If
    EXPAND_POLICIES=Yes, then Shorewall-perl will create a separate
    chain for each pair of zones covered by the policy. This makes the
    resulting log messages easier to interpret since the chain in the
    messages will have a name of the form 'a2b' where 'a' is the SOURCE
    zone and 'b' is the DEST zone. See
    http://linuxman.wikispaces.com/PPPPPPS for more information.

2)  The Shorewall-perl dependency on the "Address Type Match"
    capability has been relaxed. This allows Shorewall 4.0.1 to be used
    on releases like RHEL4 that don't support that capability.

3)  Shorewall-perl now detects dead policy file entries that result
    when an entry is masked by an earlier entry. Example:

         all     all      REJECT    info
         loc     net      ACCEPT

4)  Recent kernels are apparently hard to configure and we have been
    seeing a lot of problem reports where the root cause is the lack of
    state match support in the kernel. This problem is difficult to
    diagnose when using Shorewall-perl so the generated shell program
    now checks specifically for this problem and terminates with an
    error if the capability doesn't exist.
+
+

2007-07-20 Shorewall 4.0.0

+
----------------------------------------------------------------------------
                   R E L E A S E  H I G H L I G H T S
----------------------------------------------------------------------------
1) This is the first Shorewall release that fully integrates the new
   Shorewall-perl compiler. See the "New Features" section below.

2) You are now offered a choice as to which compiler(s) you install. In
   4.0.0, there are the following packages:

   - Shorewall-common ( common files )
   - Shorewall-shell ( the shell-based compiler )
   - Shorewall-perl (the Perl-based compiler )

   You must install at least one of the compiler packages (you may
   install them both) along with Shorewall-common.

   YOU DO NOT NEED TO UNINSTALL ANY OF YOUR CURRENT PACKAGES.

   See the Migration Considerations below for further information.

3) The facilities for supporting bridge/firewalls under earlier
   releases are deprecated and their documentation is omitted from the
   4.0 distribution. New bridge support is implemented in the
   Shorewall-perl compiler. This support utilizes the reduced-function
   physdev match support available in Linux kernel 2.6.20 and later.

Problems corrected in 4.0.0 Final.

1)  The shorewall-lite install.sh may now be run multiple times from
    the same directory. Previously, the manpages were gzipped in-place
    which made it impossible to rerun the script.

2)  If shorewall.conf contained SHOREWALL_COMPILER=shell (which it can
    on Shorewall 3.4.2-4 systems) and the shorewall-shell RPM was
    removed, subsequent "shorewall [re]start" operations failed. When
    shorewall-shell is removed, the shorewall.conf file is modified to
    specify SHOREWALL_COMPILER= and the original is saved in
    shorewall.conf.rpmsave.

3)  The contents of the LOG LEVEL column in /etc/shorewall/policy are
    now validated at compile time by Shorewall-perl.

Other changes in Shorewall 4.0.0 Final.

1)  The Perl modules in /usr/share/shorewall-perl/Shorewall/ have been
    consolidated somewhat, leading to slightly faster compilation.

Migration Considerations:

1)  Beginning with Shorewall 4.0.0, there is no single 'shorewall'
    package. Rather there are two compiler packages (shorewall-shell
    and shorewall-perl) and a set of base files (shorewall-common)
    which are required by either compiler package.

    Although the names of the packages are changing, you can upgrade
    without having to uninstall/reinstall.

    To repeat: YOU DO NOT NEED TO UNINSTALL ANY EXISTING PACKAGE.

    If you attempt to upgrade using the shorewall-common RPM, you get
    this result:
    gateway:~ # rpm -Uvh shorewall-common-4.0.0.noarch.rpm 
    error: Failed dependencies:
        shorewall_compiler is needed by shorewall-common-4.0.0-1.noarch
    gateway:~ #

    You must either:

        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \
            shorewall-common-4.0.0.noarch.rpm

    or

        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \
            shorewall-perl-4.0.0.noarch.rpm \
            shorewall-common-4.0.0.noarch.rpm

    If you don't want to use shorewall-perl exclusively then use the
    second command above then

        rpm -e shorewall-shell
 
    If you are upgrading using the tarball, you must install 
    shorewall-shell and/or shorewall-perl before you upgrade
    using shorewall-common. Otherwise, the install.sh script fails with:

         ERROR: No Shorewall compiler is installed

    The shorewall-shell and shorewall-perl packages are installed from
    the tarball in the expected way; untar the package, and run the
    install.sh script.

    Example 1: You have 'shorewall' installed and you want to continue
    to use the shorewall-shell compiler.

        tar -jxf shorewall-common-4.0.0.tar.bz2
        tar -jxf shorewall-shell-4.0.0.tar.bz2

        cd shorewall-shell-4.0.0
        ./install.sh
        cd ../shorewall-common-4.0.0
        ./install.sh
        shorewall check
        shorewall restart

    Example 2: You have shorewall 3.4.4 and shorewall-perl 4.0.0-Beta7
    installed and you want to upgrade to 4.0. You do not need the
    shell-based compiler.

        tar -jxf shorewall-common-4.0.0.tar.bz2
        tar -jxf shorewall-perl-4.0.0.tar.bz2

        cd shorewall-perl-4.0.0
        ./install.sh
        cd ../shorewall-common-4.0.0
        ./install.sh
        shorewall check
        shorewall restart

        Be sure to modify shorewall.conf if it still has
        SHOREWALL_COMPILER=shell.

2)  The ROUTE_FILTER and LOG_MARTIANS options in shorewall.conf work
    slightly differently in Shorewall 4.0.0. In prior releases, leaving
    these options empty was equivalent to setting them to 'No' which
    caused the corresponding flag in /proc to be reset for all
    interfaces. Beginning in Shorewall 4.0.0, leaving these options
    empty causes Shorewall to leave the flags in /proc as they are. You
    must set the option to 'No' in order to obtain the old behavior.

3)  The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.

    If you plan on continuing to use Shorewall-shell and you want to
    use the "-f" option at boot time, then you must add the following
    to /etc/sysconfig/shorewall or /etc/default/shorewall:

       OPTIONS="-f"

    If you currently have neither of those files, you will need to
    create one of them. 

4)  This issue will only affect you if you use Shorewall Lite and have
    modified /usr/share/configpath to specify a different LITEDIR.

    The implementation of LITEDIR has always been
    unsatisfactory. Furthermore, there have been other cases where
    people have asked to be able to designate the state directory
    (default /var/lib/shorewall[-lite]).

    To meet these objectives:

    a)  The LITEDIR variable has been eliminated in
        /usr/share/shorewall[-lite]/configpath.

    b)  A new file /etc/shorewall[-lite]/vardir has been added. This
        file is not created by default but may be added as needed. It
        is expected to contain a single variable assignment:

           VARDIR=<directory>

        Example:

           VARDIR=/root/shorewall
    
    To change VARDIR, copy the old directory to the new one before you
    restart Shorewall[-lite].

    To use this feature with Shorewall-lite, all packages involved
    (compiler, shorewall-common and shorewall-lite) must be version
    4.0.0-RC2 or later.

----------------------------------------------------------------------------
                         N E W  F E A T U R E S
----------------------------------------------------------------------------
1)  Shorewall-perl

    This Shorewall package includes a complete rewrite of the compiler
    in Perl.

    I decided to make Shorewall-perl a separate package for several reasons:

    a) Embedded applications are unlikely to adopt Shorewall-perl; even
       Mini-Perl has a substantial disk and RAM footprint.

    b) Because of the gross incompatibilities between the new compiler and the
       old (see below), migration to the new compiler must be voluntary.
    ------------------------------------------------------------------------
                      T H E   G O O D   N E W S:
    ------------------------------------------------------------------------
    a) The compiler has a small disk footprint.
    b) The compiler is very fast.
    c) The compiler generates a firewall script that uses iptables-restore;
       so the script is very fast.
    d) The new compiler does a much better job of validating the
       configuration and catches many errors that resulted in run-time
       failures with the old compiler.
    e) Use of the Shorewall-perl is optional! The old slow clunky
       Bourne-shell compiler is still available.
    ------------------------------------------------------------------------
                      T H E   B A D   N E W S:
    ------------------------------------------------------------------------
    There are a number of incompatibilities between the Perl-based compiler
    and the Bourne-shell one.

    a) The Perl-based compiler requires the following capabilities in your
       kernel and iptables.

       - addrtype match
       - multiport match

       These capabilities are in current distributions.

    b) Now that Netfilter has features to deal reasonably with port lists,
       I see no reason to duplicate those features in Shorewall. The
       Bourne-shell compiler goes to great pain (in some cases) to
       break very long port lists ( > 15 where port ranges in lists
       count as two ports) into individual rules. In the new compiler, I'm
       avoiding the ugliness required to do that. The new compiler just
       generates an error if your list is too long. It will also produce
       an error if you insert a port range into a port list and you don't
       have extended multiport support.

    c) The old BRIDGING=Yes support has been replaced by new bridge
       support that uses the reduced 'physdev match' capabilities found
       in kernel 2.6.20 and later. This new implementation may be used
       where it is desired to control traffic through a bridge.

       The new implementation includes the following features:

       a)  A new "Bridge Port" zone type is defined. Specify 'bport' or
           'bport4' in the TYPE column of /etc/shorewall/zones.

           Bridge Port zones should be a sub-zone of a regular ipv4 zone
           that represents all hosts attached to the bridge.

       b)  A new 'bridge' option is defined for entries in      
           /etc/shorewall/interfaces. Bridges should have this option
           specified, even if you don't want to filter traffic going
           through the bridge.

       c)  Bridge ports must now be defined in
           /etc/shorewall/interfaces. The INTERFACE column contains
           both the bridge name and the port name separated by a colon
           (e.g., "br0:eth1"). No OPTIONS are allowed for bridge
           ports. The bridge must be defined before its ports and must
           have the 'bridge' option.

       Bridge Port (BP) zones have a number of limitations:

       a)  Each BP zone may only be associated with ports on a single
           bridge.

       b)  BP zones may not be associated with interfaces that are not
           bridge ports.

       c)  You may not have policies or rules where the DEST is a BP
           zone but the source is not a BP zone. If you need such
           rules, you must use the BP zone's parent zone as the DEST
           zone.

       Example (Bridge br0 with ports eth1 and tap0):

       /etc/shorewall/zones:

        fw      firewall
        net     ipv4
        loc     ipv4
        lan:loc bport
        vpn:loc bport

       /etc/shorewall/interfaces:

        net     eth0    -       ...
        loc     br0     -       ...
        lan     eth1
        vpn     tap0

       When using the /etc/shorewall/hosts file to define a bport4
       zone, you specify only the port name:

       Example:

       /etc/shorewall/zones:

        fw      firewall
        net     ipv4
        loc     ipv4
        lan:loc bport
        vpn:loc bport

       /etc/shorewall/hosts

        lan     eth1:192.168.2.0/24     ...

       The structure of the accounting rules changes slightly when
       there are bridges defined in the Shorewall
       configuration. Because of the restrictions imposed by Netfilter
       in kernel 2.6.21 and later, output accounting rules must be
       segregated from forwarding and input rules.

       To accomplish this separation, Shorewall-perl creates two
       accounting chains:

       - accounting - for input and forwarded traffic.
       - accountout - for output traffic.

       If the CHAIN column contains '-', then:

       - If the SOURCE column in a rule includes the name of the
         firewall zone (e.g., $FW), then the rule is add only
         to the accountout chain.

       - Otherwise, if the DEST in the rule is any or all or 0.0.0.0/0,
         then the rule is added to both accounting and accountout.

       - Otherwise, the rule is added to accounting only.

       See http://www.shorewall.net/bridge-Shorewall-perl.html for
       additional information about the new bridge support.     

    d) The BROADCAST column in the interfaces file is essentially unused;
       if you enter anything in this column but '-' or 'detect', you will
       receive a warning.

    e) Because the compiler is written in Perl, some of your extension
       scripts from earlier versions will no longer work because
       Shorewall-perl runs those extension scripts at compile-time rather
       than at run-time. 

       Compile-time scripts are:

           initdone
           maclog
           All per-chain scripts including those associated with actions.

       Compile-time extension scripts are executed using the Perl 'eval
       `cat <file>`' mechanism. Be sure that each script returns a
       'true' value; otherwise, the compiler will assume that the
       script failed and will abort the compilation.

       All scripts will need to begin with the following line:

           use Shorewall::Chains;

       For more complex scripts, you may need to 'use' other Shorewall
       Perl modules -- browse /usr/share/shorewall-perl/Shorewall/ to
       see what's available.

       When a script is invoked, the $chainref scalar variable will hold a
       reference to a chain table entry. 

           $chainref->{name}  contains the name of the chain
           $chainref->{table} holds the table name
       
           To add a rule to the chain:

              add_rule( $chainref, <the rule> );

           Where

              <the rule> is a scalar argument holding the rule text. Do
              not include "-A <chain name>"

           Example:

              add_rule( $chainref, '-j ACCEPT' );

           To insert a rule into the chain:

              insert_rule( $chainref, <rulenum>, <the rule> );

           The log_rule_limit function works like it does in the shell
           compiler with two exceptions:

              - You pass the chain reference rather than the name of
                the chain.
              - The commands are 'add' and 'insert' rather than '-A'
                and '-I'.
              - There is only a single "pass as-is to iptables"
                argument (so you must quote that part).

           Example:

              log_rule_limit(
                             'info' , 
                              $chainref ,            
                              $chainref->{name},
                              'DROP' , 
                              '',      #Limit
                              '' ,     #Log tag
                              'add',   #Command
                              '-p tcp' #Pass as-is
                             );

       Note that in the 'initdone' script, there is no default chain
       ($chainref). You can objtain a reference to a standard chain by:

           my $chainref = $chain_table{<table>}{<chain name>};

       Example:

           my $chainref = $chain_table{'filter'}{'INPUT'};

       The continue script is eliminated. That script was designed to
       allow you to add special rules during [re]start. Shorewall-perl
       doesn't need such rules.

       See http://www.shorewall.net/shorewall_extension_scripts.htm
       for further information about extension scripts under
       Shorewall-perl.

    f) The 'refresh' command now works like 'restart' with the
       following exceptions:

       - The refresh command is rejected if Shorewall is not running.
       - The refresh command only rebuilds the 'blacklst' chain.
       - A directory name may not be specified in the refresh command.

    g) The /etc/shorewall/tos file now has zone-independent SOURCE and
       DEST columns as do all other files except the rules and policy
       files.

       The SOURCE column may be one of the following:

           [all:]<address>[,...]
           [all:]<interface>[:<address>[,...]]
           $FW[:<address>[,...]]

       The DEST column may be one of the following:
       
           [all:]<address>[,...]
           [all:]<interface>[:<address>[,...]]

       This is a permanent change. The old zone-based rules have never
       worked right and this is a good time to replace them. I've tried
       to make the new syntax cover the most common cases without
       requiring change to existing files. In particular, it will
       handle the tos file released with Shorewall 1.4 and earlier.

    h) Shorewall is now out of the ipset load/reload business. With
       scripts generated by the Perl-based Compiler, the Netfilter
       ruleset is never cleared. That means that there is no
       opportunity for Shorewall to load/reload your ipsets since that
       cannot be done while there are any current rules using ipsets.

       So:

        i)   Your ipsets must be loaded before Shorewall starts. You
             are free to try to do that with the following code in
             /etc/shorewall/start:

             if [ "$COMMAND" = start ]; then
                ipset -U :all: :all:
                ipset -F
                ipset -X
                ipset -R < /my/ipset/contents
             fi

             The file '/my/ipset/contents' (not its real name of
             course) will normally be produced using the ipset -S
             command.

             The above will work most of the time but will fail in a
             'shorewall stop' - 'shorewall start' sequence if you
             use ipsets in your routestopped file (see below).

        ii)  Your ipsets may not be reloaded until Shorewall is stopped
             or cleared.

        iii) If you specify ipsets in your routestopped file then
             Shorewall must be cleared in order to reload your ipsets.

       As a consequence, scripts generated by the Perl-based compiler
       will ignore /etc/shorewall/ipsets and will issue a warning if
       you set SAVE_IPSETS=Yes in shorewall.conf.

    i) Because the configuration files (with the exception of
       /etc/shorewall/params) are now processed by the Perl-based
       compiler rather than by the shell, only the basic forms of Shell
       expansion ($variable and ${variable}) are supported. The more
       exotic forms such as ${variable:=default} are not
       supported. Both variables defined in /etc/shorewall/params and
       environmental variables (exported by the shell) can be used in
       configuration files.

    j) USE_ACTIONS=No is not supported. That option is intended to
       minimize Shorewall's footprint in embedded applications. As a
       consequence, Default Macros are not supported.

    k) DELAYBLACKLISTLOAD=Yes is not supported. The entire ruleset is
       atomically loaded with one execution of iptables-restore.

    l) MAPOLDACTIONS=Yes is not supported. People should have converted
       to using macros by now.

    m) The pre Shorewall-3.0 format of the zones file is not supported;
       neither is the /etc/shorewall/ipsec file.

    n) BLACKLISTNEWONLY=No is not permitted with FASTACCEPT=Yes. This
       combination doesn't work in previous versions of Shorewall so
       the Perl-based compiler simply rejects it.

    o) Shorewall-perl has a single rule generator that is used for all
       rule-oriented files. So it is important that the syntax is
       consistent between files.
       
       With shorewall-shell, there is a special syntax in the SOURCE
       column of /etc/shorewall/masq to designate "all traffic entering
       the firewall on this interface except...".

       Example:

       #INTERFACE       SOURCE                  ADDRESSES
       eth0             eth1!192.168.4.9        ...

       Shorewall-perl uses syntax that is consistent with the rest of
       Shorewall:

       #INTERFACE       SOURCE                  ADDRESSES
       eth0             eth1:!192.168.4.9       ...

    p) The 'allowoutUPnP' built-in action is no longer supported. The
       Netfilter team have removed support for '-m owner --owner-cmd'
       which that action depended on. 

    q) The treatment of the following interface options has changed under
       Shorewall-perl.

       - arp_filter
       - routefilter
       - logmartians
       - proxy_arp
       - sourceroute

       With the Shorewall-shell compiler, Shorewall resets these options
       on all interfaces then sets the option on those interfaces
       for which the option is defined in /etc/shorewall/interfaces.

       Under Shorewall-perl, these options can be specified with the value
       0 or 1 (e.g., proxy_arp=0). If no value is specified, the value 1
       is assumed. Shorewall will modify only the setting of those
       interfaces for which the option is specified and will set the
       option to the given value.

       A fatal compilation error is also generated if you specify one of
       these options with a wildcard interface (one ending with '+').

    r) The LOG_MARTIANS and ROUTE_FILTER options are now tri-valued in
       Shorewall-perl.

        Yes -  Same as before
        No  -  Same as before except that it applies regardless of
               whether any interfaces have the logmartians/routefilter
               option
        Keep - Shorewall ignores the option entirely (which is the
        default).

    s)  Shorewall-perl support nn 'optional' option has been added to
        /etc/shorewall/interfaces. This option is recognized by
        Shorewall-perl but not by Shorewall-shell. When 'optional' is
        specified for an interface, Shorewall will be silent when:

        - a /proc/sys/net/ipv4/conf/ entry for the interface cannot be
          modified (including for proxy ARP).

        - The first address of the interface cannot be obtained.

        I specify 'optional' on interfaces to Xen virtual machines that
        may or may not be running when Shorewall is [re]started.

        CAUTION: Use 'optional' at your own risk. If you [re]start
        Shorewall when an 'optional' interface is not available and then
        do a 'shorewall save', subsequent 'shorewall restore' and
        'shorewall -f start' operations will instantiate a ruleset that
        does not support that interface, even if it is available at the
        time of the restore/start.

     t) Shorewall-perl validates all IP addresses and addresses ranges
        in rules. DNS names are resolved and an error is issued for any
        name that cannot be resolved.
     u) Shorewall-perl checks configuration files for the presense of
        characters that can cause problems if they are allowed into the
        generated firewall script:

        - Double Quotes. These are prohibited except in the
          shorewall.conf and params files.

        - Single Quotes. These are prohibited except in the
          shorewall.conf and params files and in COMMENT lines.

        - Single back quotes. These are prohibited except in the 
          shorewall.conf and params files.

        - Backslash. Probibited except as the last character on a line
          to denote line continuation.

     v) Under Shorewall-perl, macros may invoke other macros with the
        restriction that such macros may not be invoked within an action
        body.

        When marcros are invoked recursively, the parameter passed to an
        invocation are automatically propagated to lower level macros.

         Macro invocations may be nested to a maximum level of 5.
    ------------------------------------------------------------------------
                      P R E R E Q U I S I T E S
    ------------------------------------------------------------------------
    - Perl (I use Perl 5.8.8 but other versions should work fine)
    - Perl Cwd Module
    - Perl File::Basename Module
    - Perl File::Temp Module
    - Perl Getopt::Long Module
    ------------------------------------------------------------------------
               U S I N G   T H E   N E W   C O M P I L E R
    If you only install one compiler, then that compiler will be used.

    If you install both compilers, then the compiler actually used depends
    on the SHOREWALL_COMPILER setting in shorewall.conf.

    The value of this new option can be either 'perl' or 'shell'.

    If you add 'SHOREWALL_COMPILER=perl' to /etc/shorewall/shorewall.conf
    then by default, the new compiler will be used on the system. If you
    add it to shorewall.conf in a separate directory (such as a
    Shorewall-lite export directory) then the new compiler will only be
    used when you compile from that directory.

    If you only install one compiler, it is suggested that you do not set
    SHOREWALL_COMPILER.

    You can also select the compiler to use on the command line using the
    'C option:

       '-C shell' means use the shell compiler
       '-C perl' means use the perl compiler

    The -C option overrides the setting in shorewall.conf. 

    Example:

        shorewall restart -C perl

2)  Thanks to Paul Gear, an IPPServer macro has been added. Be sure to
    read the comments in the macro file before trying to use this
    macro.

3)  Eariler generations of Shorewall Lite required that remote root
    login via ssh be enabled in order to use the 'load' and 'reload'
    commands.

    Beginning with this release, you may define an alternative means
    for accessing the remote firewall system.

    Two new options have been added to shorewall.conf:

        RSH_COMMAND
        RCP_COMMAND

    The default values for these are as follows:

        RSH_COMMAND: ssh ${root}@${system} ${command}
        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}

    Shell variables that will be set when the commands are envoked are
    as follows:

       root  - root user. Normally 'root' but may be overridden using
               the '-r' option.

       system - The name/IP address of the remote firewall system.

       command - For RSH_COMMAND, the command to be executed on the 
                 firewall system.

       files   - For RCP_COMMAND, a space-separated list of files to
                 be copied to the remote firewall system.

       destination - The directory on the remote system that the files 
                     are to be copied into. 

4)  The accounting, masq, rules and tos files now have a 'MARK' column
    similar to the column of the same name in the tcrules file. This
    column allows filtering by MARK and CONNMARK value (CONNMARK is
    only accepted under Shorewall Perl).

5)  SOURCE and DEST are now reserved zone names to avoid problems with
    bi-directional macro definitions which use these as names as key
    words.

6)  The "shorewall show zones" command now flags zone members that have
    been added using "shorewall add" by preceding them with a plus sign
    ("+").

    Example:

    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007

    fw (firewall)
    net (ipv4)
        eth0:0.0.0.0/0
    loc (ipv4)
        br0:0.0.0.0/0
        eth4:0.0.0.0/0
        eth5:0.0.0.0/0
        +eth1:0.0.0.0/0
    dmz (ipv4)
        eth3:0.0.0.0/0
    vpn (ipv4)
        tun+:0.0.0.0/0

    In the above output, "eth1:0.0.0.0/0" was dynamically added to the
    'loc' zone. As part of this change, "shorewall delete" will only
    delete entries that have been added dynamically. In earlier
    versions, any entry could be deleted although the ruleset was only
    changed by deleting entries that had been added dynamically.

7)  The 'shorewall version' command now lists the version of the
    installed compiler(s) if the -a option is used:

    gateway:/bulk/backup # shorewall version -a
    4.0.0-Beta1
    Shorewall-shell 4.0.0-Beta1
    Shorewall-perl 4.0.0-Beta1
    gateway:/bulk/backup #

8)  The Perl compiler is externalized. Both the compiler.pl program
    and the Perl Module interface are documented.

    The compiler program is /usr/share/shorewall-perl/compiler.pl:

        compiler.pl [ <option> ... ] [ <filename> ]

    If a <filename> is given, then the configuration will be compiled
    output placed in the named file. If <filename> is not given, then
    the configuration will simply be syntax checked.

    Options are:

    -v <verbosity>
    --verbosity=<verbosity>
    
        The <verbosity> is a number between 0 and 2 and corresponds to
        the VERBOSITY setting in shorewall.conf. This setting controls
        the verbosity of the compiler itself.

    -e
    --export

        If given, the configuration will be compiled for export to
        another system.

    -d <directory>
    --directory=<directory>

        If this option is omitted, the configuration in /etc/shorewall
        is compiled/checked. Otherwise, the configuration in the named
        directory will be compiled/checked.

    -t
    --timestamp

        If given, each progress message issued by the compiler and by
        the compiled program will be timestamped.

    --debug

        If given, when a warning or error message is issued, it is 
        supplimented with a stack trace. Requires the Carp Perl
        module.

    Example (compiles the configuration in the current directory 
             generating a script named 'firewall' and using VERBOSITY
             2).

       /usr/share/shorewall-perl/compiler.pl -v 2 -d . firewall

    Note: For compatibility with the Shorewall 3.4.2 and 3.4.3
    releases, options not passed on the run-line get their values from
    environmental variables:

           Option                 Variable

           --verbosity            VERBOSE
           --export               EXPORT
           --directory            SHOREWALL_DIR
           --timestamp            TIMESTAMP

    The Perl Module is externalized as follows:

        use lib '/usr/share/shorewall-perl';
        use Shorewall::Compiler;
        
            compiler $filename, $directory, $verbose, $options

    The arguments to the compiler function are as follows:

        $filename -   Name of the compiled script to be created.
                      If the arguments evaluates to false, the
                      configuration is syntax checked
                      
        $directory -  The directory containing the configuration.
                      If passed as '', then /etc/shorewall/ is assumed.

        $verbose -    The verbosity level (0-2).

        $options -    A bitmap of options. Shorewall::Compiler
                      exports two constants to help building this
                      argument:

                        EXPORT    = 0x01
                        TIMESTAMP = 0x02

    The compiler raises an exception with 'die' if it encounters an
    error; $@ contains the 'ERROR' messages describing the problem.
    
    The compiler function can be called repeatedly with different
    inputs.

9)  When TC_ENABLED=Internal, Shorewall-perl now validates classids in
    the MARK/CLASSIFY column of /etc/shorewall/tcrules against the
    classes generated by /etc/shorewall/tcclasses.

10) During installation, Shorewall generates the Perl module
    /usr/share/shorewall-perl/Shorewall/Ports.pm, using your
    /etc/protocols and /etc/services as input.

    To re-generate the module from those two files:

        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm
           file.
        2. /usr/share/shorewall-perl/buildports.pl > \
           /usr/share/shorewall-perl/Shorewall/Ports.pm

    Note: If the buildports.pl program fails to run to a successful
    completion during installation, a fallback version of
    module will be installed. That fallback module was generated from
    the /etc/protocols and /etc/services shipped with Ubuntu Feisty
    Fawn.

    Even if the buildports.pl program runs successfully, the fallback
    module is also installed as
    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you
    encounter problems with the generated module, simply copy the
    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.

11) Tuomo Soini has contributed bi-directional macros for various
    tunnel types:

          IPsecah
          GRE
          IPsec
          IPIP
          IPsecnat
          L2TP

12) The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.


    To re-generate the module from those two files:

        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm
           file.
        2. /usr/share/shorewall-perl/buildports.pl > \
           /usr/share/shorewall-perl/Shorewall/Ports.pm

    Note: If the buildports.pl program fails to run to a successful
    completion during installation, a fallback version of
    module will be installed. That fallback module was generated from
    the /etc/protocols and /etc/services shipped with Ubuntu Feisty
    Fawn.

    Even if the buildports.pl program runs successfully, the fallback
    module is also installed as
    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you
    encounter problems with the generated module, simply copy the
    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.

11) Tuomo Soini has contributed bi-directional macros for various
    tunnel types:

          IPsecah
          GRE
          IPsec
          IPIP
          IPsecnat
          L2TP

12) The -f option is no longer the default when Shorewall is started at
    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,
    "shorewall start" is nearly as fast as "shorewall restore" and
    "shorewall start" uses the current configuration which avoids
    confusion.

13) The implementation of LITEDIR has always been
    unsatisfactory. Furthermore, there have been other cases where
    people have asked to be able to designate the state directory
    (default /var/lib/shorewall[-lite]).

    To meet these objectives:

    a)  The LITEDIR variable has been eliminated in
        /usr/share/shorewall[-lite]/configpath.

    b)  A new file /etc/shorewall[-lite]/vardir has been added. This
        file is not created by default but may be added as needed. It
        is expected to contain a single variable assignment:

           VARDIR=<directory>

        Example:

           VARDIR=/root/shorewall
    
    To change VARDIR, copy the old directory to the new one before you
    restart Shorewall[-lite].

    To use this feature with Shorewall-lite, all packages involved
    (compiler, shorewall-common and shorewall-lite) must be version
    4.0.0-RC2 or later.
+
+

2007-07-15 Shorewall 3.4.5

+
Problems Corrected in 3.4.5.

1)  DYNAMIC_ZONES=Yes can now coexist with Shorewall-perl's 'bport'
    zones. Those zones themselves may not be dynamically modified but
    the presence of bport zones no longer causes the 'shorewall add'
    command to fail.

2)  Shorewall's internal traffic shaper once again works when the 'sed'
    utility is provided by the Busybox package.

3)  Version 3.4.4 erroneously accepted the values On, Off, on, off, ON
    and OFF for the IP_FORWARDING option. These values were treated
    like 'Keep'. The listed values are now once again flagged as an
    error.

4)  If 'routeback' and 'detectnets' were specified on an interface,
    limited broadcasts (to 255.255.255.255) and multicasts were dropped
    when forwarded through the interface. This could cause
    broadcast-based and multicast applications to fail when running
    through a bridge with 'detectnets'.

5)  The 'hits' command works once again.

6)  IPSECFILE=ipsec (either explicitly or defaulted) works
    now. Previously, processing of the ipsec file was bypassed; often
    with a confusing "missing file" message.

7)  If DETECT_DNAT_IPADDRS=Yes in shorewall.conf but you did't have conntrack
    match support, then the generated script was missing 'done's.

Other changes in 3.4.5.

1)  When a Shorewall release includes detection of an additional
    capability, existing capabilities files become out of
    date. Previously, this condition was not detected.

    Beginning with this release, each generated capabilities file
    contains a CAPVERSION specification which defines the capabilities
    version of the file. If the CAPVERSION in a capabilities file is
    less than the current CAPVERSION, then Shorewall will issue the
    following message:

    WARNING: <file> is out of date -- it does not contain all of
    the capabilities defined by Shorewall version <version>

    where

        <file>    is the name of the capabilities file.
        <version> is the current Shorewall version.

    Existing capabilities files contain no CAPVERSION. When such a file
    is read, Shorewall will issue this message:

    WARNING: <file> may be not contain all of the capabilities defined
    by Shorewall version <version>

2)  When a directory is specified in a command such as 'start' or
    'compile', Shorewall now reads the shorewall.conf file (if any) in
    that directory before deciding which compiler to use. So if
    SHOREWALL_COMPILER is not specified in
    /etc/shorewall/shorewall.conf and the -C option was not specified
    on the run-line, then if Shorewall-perl is installed, the additional
    shorewall.conf file is read to see if it specifies a
    SHOREWALL_COMPILER.

3)  The 'save' command now uses iptables-save from the same directory
    containing iptables. Previously, iptables-save was located via the
    PATH setting.
+
+

2007-06-17 Shorewall 3.4.4

+
Problems corrected in 3.4.4:

1)  The commands "shorewall add <interface> <zone>" and "shorewall
    delete <interface> <zone>" no longer produce spurious error
    messages.

2)  The command "shorewall delete <interface> <zone>" now actually deletes
    entries when it successfully completes.  Previously, it would appear
    to remove an entry, even when removing that entry should fail. 

3)  Setting HIGH_ROUTE_MARKS=No no longer causes TC_EXPERT flagging.

4)  When run as root, the 'shorewall load' and 'shorewall reload'
    commands would fail if the LOGFILE setting in
    /etc/shorewall/shorewall.conf specified a non-existant file.

5)  Entries in /etc/shorewall/tcrules that specify both a source and
    destination port fail with the following diagnostic:

    iptables v1.3.3: multiport can only have one option

6)  Previously, Shorewall-lite did not allow DHCP traffic through an
    interface when the interface was a bridge with 'dhcp' specified
    unless there was a bridge on the administrative system with the
    same name.

7)  SOURCE and DEST are now flagged as invalid zone name to avoid
    problems with macros that use those names as keywords.

8)  Previously, Shorewall could *increase* the MSS under some
    circumstances. This possibility is now eliminated, provided that
    the system has TCPMSS match support (be sure to update your
    capabilities files!).

9)  Firewall zone names other than 'fw' no longer cause a error when
    IPSECFILE is not set or is set to 'ipsec'.

10) The 'proxyarp' option on an interface was previously ignored when
    the /etc/shorewall/proxyarp file was empty.

11) Previously, if action 'a' was defined then the following 
    rule generated an error:

         a:        z1   z2      ...

    The trailing ":" is now ignored.

12) Previously, if a RATE/LIMIT was specified on a REJECT rule, the
    generated error messages referred to the rule as a DROP rule.

13) The 'nolock' keyword was previously ignored on several
    /sbin/shorewall[-lite] commands. 

Other changes in 3.4.4:

1)  The accounting, masq, rules and tos files now have a 'MARK' column
    similar to the column of the same name in the tcrules file. This
    column allows filtering by MARK value.

2)  The "shorewall show zones" command now flags zone members that have
    been added using "shorewall add" by preceding them with a plus sign
    ("+").

    Example:

    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007

    fw (firewall)
    net (ipv4)
        eth0:0.0.0.0/0
    loc (ipv4)
        br0:0.0.0.0/0
        eth4:0.0.0.0/0
        eth5:0.0.0.0/0
        +eth1:0.0.0.0/0
    dmz (ipv4)
        eth3:0.0.0.0/0
    vpn (ipv4)
        tun+:0.0.0.0/0

    In the above output, "eth1:0.0.0.0/0" was dynamically added to the
    'loc' zone. As part of this change, "shorewall delete" will only
    delete entries that have been added dynamically. In earlier
    versions, any entry could be deleted although the ruleset was only
    changed by deleting entries that had been added dynamically.

3)  Eariler generations of Shorewall Lite required that remote root
    login via ssh be enabled in order to use the 'load' and 'reload'
    commands.

    Beginning with this release, you may define an alternative means
    for accessing the remote firewall system.

    Two new options have been added to shorewall.conf:

        RSH_COMMAND
        RCP_COMMAND

    The default values for these are as follows:

        RSH_COMMAND: ssh ${root}@${system} ${command}
        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}

    Shell variables that will be set when the commands are envoked are
    as follows:

       root  - root user. Normally 'root' but may be overridden using
               the '-r' option.

       system - The name/IP address of the remote firewall system.

       command - For RSH_COMMAND, the command to be executed on the 
                 firewall system.

       files   - For RCP_COMMAND, a space-separated list of files to
                 be copied to the remote firewall system.

       destination - The directory on the remote system that the files 
                     are to be copied into. 

4)  You may now select the compiler to use on the command line using
    the '-C' option. This option is available on the following
    commands:

        check
        compile
        export
        load
        reload
        restart
        start
        try
        safe-start
        save-restart

     Example:

        shorewall try -C perl .
+
+

2007-06-12 New Host for www.shorewall.net and +ftp.shorewall.net

+
I'm pleased to announce that Ty Christiansen and the folks at Master Mind
Productions (http://mastermindpro.com) have volunteered to host
www.shorewall.net and ftp.shorewall.net.

The new site is up and running and I've just changed DNS to point to the new
server. Let me know if you experience any problems.

Please join me in thanking Ty and Master Mind for their support of the
Shorewall project.
+
+

2007-04-30 Shorewall 3.4.3

+

Problems corrected in Shorewall 3.4.3

+
1) The shorecap program was not loading modules correctly.
+
2) The CHAIN variable is now set correctly before the 'maclog' script
+
   is invoked.
+
+
3) The 'shorewall load' and 'shorewall reload' commands redundently
+
   re-generated the capabilities file when it resided in the export
+
   directory.
+
+
4) Setting LOGFILE to the value of a shell variable from the params
+
   file now works.
+
+
5) The 'shorewall-lite restore' command can fail with a 'startup not
+
   enabled' error.
+
+
6) When ROUTE_FILTER=Yes in shorewall.conf, Shorewall no longer clears
+
   the rp_filter flag for all interfaces.
+
+
7) When LOG_MARTIANS=Yes in shorewall.conf, Shorewall no longer clears
+
   the log_martians flag for all interfaces.
+
+
8) The 'shorewall add' and 'shorewall delete' commands no longer fail
+
   with the message 'ERROR: Only one firewall zone may be defined'.
+
+
9) It was previously impossible to disable martian logging.
+
+
10) IP addresses (aliases) added by ADD_IP_ALIASES and ADD_SNAT_ALIASES
+
    are now correctly deleted when Shorewall stops.
+
+
11) The 'shorewall add' and 'shorewall delete' commands no longer fail
+
    with the error 'Only one firewall zone may be defined'.
+
+
12) The special 'detect' value now works correctly in the ADDRESSES
+
    column of /etc/shorewall/masq.
+
+
Other changes in Shorewall 3.4.3
+
+
1) A LOCKFILE option has been added to shorewall.conf. This file is
+
   used to serialize updates to the active firewall configuration.
+
   If not specified, the defaults are:
+
+

Shorewall - /var/lib/shorewall/lock

+

Shorewall Lite - /var/lib/shorewall-lite/lock

+
+ +
+

2007-04-08 Shorewall 3.2.10
+

+
Problems Corrected in 3.2.10

1)  Previously, if a 'start' or 'restart' command failed during the
    compilation step, /sbin/shorewall erroneously returned an exit
    status of zero.

2)  If IMPLICIT_CONTINUE=Yes was in effect, then sub-zones received the
    implicit CONTINUE policy for their intra-zone traffic (rather than
    the implicit ACCEPT policy for such traffic). This could cause
    intra-zone traffic to be rejected by rules in one of the parent
    zones.

3) The "shorewall-[lite] [re]start and stop" commands reset the
   proxy_arp flag on all interfaces on the system making it impossible
   to control proxy arp manually with Shorewall installed. With this
   change, shorewall will only clear proxy arp if there were entries in
   /etc/shorewall/proxyarp the last time that Shorewall was
   [re]started.
   
4)  The /usr/share/shorewall[-lite]/modules file has been updated for
    kernel 2.6.20.

5)  The /proc/net/ip_conntrack pseudo-file has been inexplicably
    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli
    library has been updated to look for both files.

6)  Tunnels of type 'ipsecnat' failed to work properly due to a missing
    rule.

7)  The 'shorecap' program was not loading modules correctly.
+
+2007-04-01 Shorewall 3.4.2
+ +
Problems corrected in Shorewall 3.4.2

1)  The /usr/share/shorewall[-lite]/modules file has been updated for
    kernel 2.6.20.

2)  The /proc/net/ip_conntrack pseudo-file has been inexplicably
    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli
    library has been updated to look for both files.

3)  Shoreall 3.4 was not consistent with respect to its treatment of
    log level 'none' and 'none!' and built-in actions. In particular,
    specifying 'none' with the Limit action produced a run-time error.
    Shorewall now correctly suppresses generation of log messages when
    a log level of 'none' or 'none!' is given to a built-in action.

4)  Tunnels of type 'ipsecnat' would sometimes fail to work because of
    a missing rule.
+ +
2007-03-15 +Shorewall 3.4.1
+ +
Problems Corrected in 3.4.1

1)  The "shorewall-[lite] [re]start and stop" commands reset the
    proxy_arp flag on all interfaces on the system making it impossible
    to control proxy arp manually with Shorewall installed. There was a
     partial fix included in 3.4.0; unfortunately, it did not correct the
    problem completely. Shorewall 3.4.1 includes the rest of the change 
    necessarey to only clear proxy arp if there were entries in
    /etc/shorewall/proxyarp the last time that Shorewall was
    [re]started.

2)  If the log-prefix in a log message exceeded 29 characters, 
    'shorewall restart' fails with 'truncate: command not found' and a
    possible segmentation fault in iptables.

3)  Log messages specifying a log tag had two spaces appended to the
    log prefix. This could cause mysterious "log-prefix truncated"
    messages. 

4)  When nested zones were defined in the /etc/shorewall/zones file and
    IMPLICIT_CONTINUE=Yes was given in /etc/shorewall/shorewall.conf,
    shell error messages ( usually '<zone>: not found' ) during
    compilation resulted.

5)  Use of CONTINUE policies lead to startup errors with a message
    such as the following:

       Applying Policies...
       iptables v1.3.7: Couldn't load target
       `CONTINUE':/usr/local/lib/iptables/libipt_CONTINUE.so: cannot open
       shared object file: No such file or directory

       Try `iptables -h' or 'iptables --help' for more information.
       
          ERROR: Command "/sbin/iptables -A net2c148 -j CONTINUE"
          Failed

6)  If there were hosts defined as 'critical' in
    /etc/shorewall/routestopped then problems occured in two cases:

    i) On a Shorewall Lite system when 'shorewall stop' or 'shorewall
    clear' was issued.

    ii) On Shorewall or Shorewall lite system when 'start' or 'restart'
    failed during execution of the compiled script and there was no saved
    configuration ('shorewall[-lite] save' has not been issued).

    The symptoms were that the following shell messages were issued and
    the 'critical' hosts were not enabled:

      /var/lib/shorewall/.start: line nnn: source_ip_range: command not found
      /var/lib/shorewall/.start: line nnm: dest_ip_range: command not found

Other changes in 3.4.1

1)  Several changes are included which allow testing of experimental
    versions of Shorewall on systems with 3.4.1 and later 3.4 releases
    installed. Among these changes is the detection and reporting of
    "Address Type Match" which may be used in future 3.4 releases.
    These changes have no effect on normal Shorewall operation.
+ +
2007-03-10 +Shorewall 3.4.0
+ +
Shorewall 3.4.0

Release Highlights

1)  Shorewall can now be tailored to reduce its footprint on embedded
    systems. As part of this change, actions are now completely
    optional.

    See http://www.shorewall.net/Modularization.html for details.

2)  Exclusion is now possible in /etc/shorewall/hosts. This is required
    for bridge/firewalls under kernel 2.6.20 and later.

    See http://www.shorewall.net/NewBridge.html.

3)  Shorewall and Shorewall Lite now include man pages. There is a 
    man page for shorewall(8), one for shorewall-lite(8) and one for
    each configuration file. As part of this change, all documentation
    has been removed from Shorewall configuration files. This should
    make it easier from users to upgrade from one release to the next
    since the configuration files will only change when column is added
    or renamed.

    See http://www.shorewall.net/manpages/Manpages.html

4)  Shorewall now remembers the changes that it has made to routing as
    a result of entries in /etc/shorewall/providers and
    /etc/shorewall/route_rules and reverses those changes when
    appropriate.

Problems Corrected in 3.4.0 Final.

1)  In the rules file, following the action with "!" is supposed to
    exempt the rule from being suppressed by OPTIMIZE=1. That feature
    was not working.

2)  If both a macro body and a macro invocation contained an entry in the
    SOURCE or DEST column, then compilation failed with the error:

           merge_macro_source_dest: command not found

3)  An obscure bug in rule activation having to do with the new
    exclusion feature in /etc/shorewall/hosts has been corrected.

4) The "shorewall-[lite] [re]start and stop" commands reset the
   proxy_arp flag on all interfaces on the system making it impossible
   to control proxy arp manually with Shorewall installed. With this
   change, shorewall will only clear proxy arp if there were entries in
   /etc/shorewall/proxyarp the last time that Shorewall was
   [re]started.

New Features in Shorewall 3.4:

1)  In order to accomodate small embedded applications, Shorewall 3.4
    is now modularized. In addition to the base files, there are
    loadable "libraries" that may be included or omitted from an
    embedded system as required.

    Loadable Shorewall libraries reside in /usr/share/shorewall/ and
    have names that begin with "lib.". The following libraries are
    included in Shorewall 3.4:

    - lib.accounting. Must be available if you include entries in
      /etc/shorewall/accounting.

    - lib.actions. Must be available if you do not specify
      USE_ACTIONS=No in /etc/shorewall/shorewall.conf.

    - lib.base. The base Shorewall library required by all programs,
      including compiled firewall scripts. This library is also
      released as part of Shorewall Lite and is installed in
      /usr/share/shorewall-lite/.

    - lib.cli. Library containing the code common to /sbin/shorewall,
      /sbin/shorewall-lite. This library is also released as part of
      Shorewall Lite and is installed in /usr/share/shorewall-lite/.

    - lib.config. Library containing the code that is common to
      /usr/share/shorewall/compiler and /usr/share/shorewall/firewall. 

    - lib.dynamiczones. Must be available if you specify
      DYNAMIC_ZONES=Yes in shorewall.conf.

    - lib.maclist. Must be available if you specify the 'maclist'
      option in /etc/shorewall/interfaces or /etc/shorewall/hosts.

    - lib.nat. Must be available if you have entries in
      /etc/shorewall/masq, /etc/shorewall/nat or /etc/shorewall/netmap
      or if you use DNAT or REDIRECT rules.

    - lib.providers. Must be available if you have entries in
      /etc/shorewall/providers.

    - lib.proxyarp. Must be available if you have entries in
      /etc/shorewall/proxyarp or if you specify the 'proxyarp' option
      in /etc/shorewall/interfaces.

    - lib.tc. Must be available if you have entries in
      /etc/shorewall/tcdevices and /etc/shorewall/tcclasses.

    - lib.tcrules. Must be available if you have entries in
      /etc/shorewall/tcrules.

    - lib.tunnels. Must be available if you have entries in
      /etc/shorewall/tunnels.

    Embedded applications can further decrease the size of the Shorewall
    footprint by:

    - Omitting the macro files.
    - Omitting all unused extension scripts.

    See http://www.shorewall.net/Modularization.html for additional
    details.

2)  As hinted in the previous bullet, there is a new USE_ACTIONS option
    in /etc/shorewall/shorewall.conf. Shorewall actions can be very
    powerful but they also require a lot of code to implement. Embedded
    applications can omit that code by setting
    USE_ACTIONS=No. Shorewall will ignore all action-related files
    including /usr/share/shorewall/actions.std and
    /etc/shorewall/actions. Builtin actions will still be available for
    use in rules and macros.

    The 'Limit' action has been converted to a builtin so that Limit is
    available even when USE_ACTIONS=No.

    See the next item for more information.

3)  Prior to Shorewall 3.4, default actions were specified in
    /usr/share/shorewall/actions.std or in /etc/shorewall/actions.

    This approach has two drawbacks:

    a) All DROP policies must use the same default action and all
       REJECT policies must use the same default action.

    b) Now that we have modularized action processing (see the New
       Features section below), we need a way to define default rules
       for a policy that does not involve actions.

    The solution is two-fold:

    - Four new options have been added to the
      /etc/shorewall/shorewall.conf file that allow specifying the
       default action for DROP, REJECT, ACCEPT and QUEUE.

       The options are DROP_DEFAULT, REJECT_DEFAULT, ACCEPT_DEFAULT and
       QUEUE_DEFAULT.

       DROP_DEFAULT describes the rules to be applied before a
       connection request is dropped by a DROP policy; REJECT_DEFAULT
       describes the rules to be applied if a connection request is
       rejected by a REJECT policy. The other two are similar for
       ACCEPT and QUEUE policies.

       The value assigned to these may be:

        a) The name of an action.
        b) The name of a macro
        c) 'None' or 'none'

       The default values are:

        DROP_DEFAULT="Drop"
        REJECT_DEFAULT="Reject"
        ACCEPT_DEFAULT=none
        QUEUE_DEFAULT=none

       If USE_ACTIONS=Yes, then these values refer to action.Drop and
       action.Reject respectively. If USE_ACTIONS=No, then these values
       refer to macro.Drop and macro.Reject.

       If you set the value of either option to "None" then no default
       action will be used and the default action or macro (if any)
       must be specified in /etc/shorewall/policy

    - The POLICY column in /etc/shorewall/policy has been extended.

       In /etc/shorewall/policy, when the POLICY is DROP, REJECT,
       ACCEPT or QUEUE then the policy may be followed by ":" and one
       of the following:

        a) The word "None" or "none". This causes any default
           action defined in /etc/shorewall/shorewall.conf
           to be omitted for this policy.
        b) The name of an action (requires that USE_ACTIONS=Yes
           in shorewall.conf). That action will be invoked
           before the policy is enforced.
        c) The name of a macro. The rules in that macro will
           be applied before the policy is enforced. This
           does not require USE_ACTIONS=Yes.<
br>
    Example:

        #SOURCE         DEST            POLICY          LOG
        #                                               LEVEL
        loc             net             ACCEPT
        net             all             DROP:MyDrop     info
        #
        # THE FOLLOWING POLICY MUST BE LAST
        #
        all             all             REJECT:MyReject info

4)  For users whose kernel and iptables have Extended MARK Target
    support, it is now possible to logically AND or OR a value into the
    current packet mark by preceding the mark value (and optional mask)
    with an ampersand ("&") or vertical bar ("|") respectively.

    Example: To logically OR the value 4 into the mark value for
    packets from 192.168.1.1:

    #MARK   SOURCE
    |4      192.168.1.1

5)  Previously, zone names were restricted to five characters in
    length. That limit derives from the --log-prefix in Netfilter log
    messages which must be 29 bytes or less in length. With the
    standard Shorewall LOGFORMAT, that leaves 11 characters for the
    chain name; given that many chain names are of the form
    <zone1>2<zone2>, that gives a maximum zone name length of 5.

    Beginning with this release, the maximum length of a zone name is
    dependent on the LOGFORMAT (the maximum length may never be less
    than 5 but it may be greater than 5). For example, setting
    LOGFORMAT="FW:%s:%s:" will allow zone names of up to 8 characters.

6)  Netfilter provides support for attachment of comments to Netfilter
    rules. Comments can be up to 255 bytes in length and are visible
    using the "shorewall show <chain>", "shorewall show nat",
    "shorewall show mangle" and "shorewall dump" commands. Comments are
    delimited by '/* ... */" in the output.

    Beginning with Shorewall 3.4, you may place COMMENT lines in the
    /etc/shorewall/rules, /etc/shorewall/tcrules, /etc/shorewall/nat
    and /etc/shorewall/masq files and in action files. The remainder of
    the line is treated as a comment and it will be attached as a
    Netfilter comment to the rule(s) generated by succeding entries
    in the file.

    Note: Do not prefix the comment with "#". Shorewall's two-pass
    compiler strips off "#" comments in the first pass and processes
    COMMENT lines in the second pass. Hence, by the time that COMMENT
    is processed, the "#" and everything following it has been removed
    (see example below).

    To stop the current comment from being attached to further
    rules, simply include COMMENT on a line by itself (so that the
    following rules will have no comment) or specify a new COMMENT.

    If you do not have Comment support in your iptables/kernel (see the
    output of "shorewall[-lite] show capabilities") then COMMENTS are
    ignored with this warning:

     COMMENT ignored --  requires comment support in iptables/Netfilter

    Example from my rules file:

            #SOURCE      SOURCE     DEST       PROTO DEST PORT(S)

            COMMENT Stop Microsoft Noise

            REJECT       loc        net        tcp   137,445
            REJECT       loc        net        udp   137:139

            COMMENT  # Stop comment from being attached to rules below

    The output of "shorewall show loc2net" includes (folded):

    0     0 reject     tcp  --  *      *       0.0.0.0/0
          0.0.0.0/0    multiport dports 137,445 /* Stop Microsoft Noise */
    0     0 reject     udp  --  *      *       0.0.0.0/0
          0.0.0.0/0    udp dpts:137:139 /* Stop Microsoft Noise */

7)  A new macro (macro.RDP) has been added for Microsoft Remote
    Desktop. This macro was contributed by Tuomo Soini.

8)  A new 'maclog' extension file has been added. This file is
    processed just before logging based on the setting of
    MACLIST_LOG_LEVEL is done. When the extension is invoked, the CHAIN
    variable will contain the name of the chain where rules should be
    inserted. Remember that if you have specified MACLIST_TABLE=mangle,
    then your run_iptables commands should include "-t mangle".

9)  The SUBNET column in /etc/shorewall/masq has been renamed SOURCE to
    more accurately describe the contents of the column.

10) Previously, it was not possible to use exclusion in
    /etc/shorewall/hosts. Beginning with this release, you may now use
    exclusion lists in entries in this file. Exclusion lists are
    discussed at:

       http://www.shorewall.net/configuration_file_basics.htm#Exclusion.

    Example:

        loc     eth0:192.168.1.0/24!192.168.1.4,192.168.1.16/28

    In that example, the 'loc' zone is defined to be the subnet
    192.168.1.0/24 interfacing via eth0 *except* for host 192.168.1.4
    and hosts in the sub-network 192.168.1.16/28.

11) New "shorewall[-lite] show ip" and "shorewall[-lite] show routing"
    commands have been added. The first produces the same output as "ip
    addr ls". The second produces a report about your routing rules and
    tables.

12) Beginning with this release, Shorewall and Shorewall Lite will
    share common change logs and release notes.

13) In Shorewall versions prior to 3.4, multiple jumps to a '2all'
    chain could be generated in succession.

    Example from an earlier shorewall version:

    gateway:~ # shorewall-lite show eth2_fwd
    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 08:54:37 PDT 2006

    Counters reset Thu Oct 19 08:34:47 PDT 2006

    Chain eth2_fwd (1 references)
     pkts bytes target     prot opt in     out     source            destination
        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW
        0     0 wifi2all   all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      br0     0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      eth3    0.0.0.0/0            0.0.0.0/0
        0     0 wifi2all   all  --  *      tun+    0.0.0.0/0            0.0.0.0/0
    gateway:~ #

    This redundancy may be eliminated by setting OPTIMIZE=1 in shorewall.conf.

    gateway:~ # shorewall-lite show eth2_fwd
    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 09:15:24 PDT 2006

    Counters reset Thu Oct 19 09:15:19 PDT 2006

    Chain eth2_fwd (1 references)
     pkts bytes target     prot opt in     out     source               destination
        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW
        0     0 wifi2all   all  --  *      *       0.0.0.0/0            0.0.0.0/0
    gateway:~ #

    Note that with OPTIMIZE=1, traffic destined for an
    interface/Address that falls outside of all defined zones may now
    be logged out of a '2all' chain rather than out of the FORWARD
    chain.

    The OPTIMIZE setting also controls the suppression of redundant
    wildcard rules (those specifying "all" in the SOURCE or DEST
    column). A wildcard rule is considered to be redundant when it
    has the same ACTION and Log Level as the applicable policy.

    Example:

        /etc/shorewall/policy

        #SOURCE         DEST            POLICY          LEVEL
        loc             net             ACCEPT

        /etc/shorewall/rules

        #ACTION         SOURCE          DEST    PROTO   DEST
        #                                               PORT(S)
        ...
        ACCEPT          all             all     icmp    8

    OPTIMIZE=0

    gateway:~ # shorewall show loc2net
    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:55:03 PDT 2006

    Counters reset Thu Oct 26 07:54:58 PDT 2006<
br>
    Chain loc2net (1 references)
     pkts bytes target     prot opt in     out     source               destination
      ...
        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0
        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

    gateway:~

    OPTIMIZE=1

    gateway:~ # shorewall show loc2net
    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:57:12 PDT 2006

    Counters reset Thu Oct 26 07:56:38 PDT 2006

    Chain loc2net (1 references)
     pkts bytes target     prot opt in     out     source               destination
      ...
        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

    gateway:~

    If you really want a rule that duplicates the policy, follow the
    action with "!":

        #ACTION         SOURCE          DEST    PROTO   DEST
        #                                               PORT(S)
        ...
        ACCEPT!         all             all     icmp    8

14) IP Address ranges are now allowed in the drop, reject, allow and
    logdrop shorewall[-lite] commands.

15) Previously, Shorewall has not attempted to undo the changes it has
    made to the firewall's routing as a result of entries in
    /etc/shorewall/providers and /etc/shorewall/routes. Beginning with
    this release, Shorewall will attempt to undo these changes.

    When Shorewall starts or is restarted and there are entries in
    /etc/shorewall/providers, Shorewall will capture the contents
    of /etc/shorewall/rt_tables and will restore that database when
    Shorewall is stopped or restarted. Similarly, the default route
    will be captured the first time that you [re]start Shorewall using
    this version and will be restored under the following conditions:

    a) shorewall stop
    b) shorewall clear
    c) shorewall restart or restore and there are no entries in
       /etc/shorewall/providers.

    Once the default route has been restored, Shorewall will delete
    the saved copy so that it will once again be captured at the next
    shorewall start or shorewall restore.

16) Shorewall no longer includes policy matches in its generated
    ruleset when no IPSEC zones or IPSEC networks are defined (IPSEC
    networks are defined using the 'ipsec' option in
    /etc/shorewall/hosts).

17) The Makefile installed in /usr/share/shorewall/configfiles/ is now
    the same one mentioned at
    http://www.shorewall.net/CompiledPrograms.html.

    Once the file is copied into an export directory, you modify the
    setting of the HOST variable to match the name of the remote
    firewall.

    The default target is the "firewall" script so "make" compiles the
    firewall script if any of the configuration files have
    changed. "make install" builds "firewall" if necessary then
    installs it on the remote firewall. "make capabilities" will
    generate the "capabilities" file. "make save" will save the running
    configuration on the remote firewall.

18) Shorewall and Shorewall Lite now include the following manpages. 

              shorewall-accounting(5)
              shorewall-actions(5)
              shorewall-blacklist(5)
              shorewall.conf(5)
              shorewall-ecn(5)
              shorewall-exclusion(5)
              shorewall-hosts(5)
              shorewall-interfaces(5)
              shorewall-lite.conf(5)
              shorewall-lite(8)
              shorewall-maclist(5)
              shorewall-masq(5)
              shorewall-nat(5)
              shorewall-nesting(5)
              shorewall-netmap(5)
              shorewall-params(5)
              shorewall-policy(5)
              shorewall-providers(5)
              shorewall-proxyarp(5)
              shorewall-rfc1918(5)
              shorewall-route_rules(5)
              shorewall-routestopped(5)
              shorewall-rules(5)
              shorewall-tcclasses(5)
              shorewall-tcdevices(5)
              shorewall-tcrules(5)
              shorewall-template(5)
              shorewall-tos(5)
              shorewall-tunnels(5)
              shorewall(8)
              shorewall-zones(5)

    Now that the manpages are in place, command-specific help has been
    removed since it duplicates information in the man pages.

19) From the beginning, the Shorewall configuration files in
    /etc/shorewall/ have contained documentary comments. While these
    comments are useful, they present an upgrade problem. Beginning
    with this release, these comments are removed from the
    configuration files themselves and are replaced by the manpages
    described in the preceding release note entry.

20) Shorewall now uses tc fwmark filters to classify packets for
    traffic shaping when the DEVICE isn't an interface described in
    /etc/shorewall/interfaces. This is in preparation for the upcoming
    change to the way that --physdev-out works in iptables/Netfilter;
    that change is now scheduled for kernel 2.6.20.

21) If your kernel and iptables have extended multiport support, then
    Shorewall will use that support for the destination port when
    generating rules from entries in the /etc/shorewall/tcrules file.
22) The 'safe-start' and 'safe-restart' command have been
    improved. Both now accept an optional directory name; if supplied,
    Shorewall will look first in that directory for configuration
    files.

    The commands have also been enhanced to only restore the
    configuration once in the event of a failure. Previously, if there
    was a current 'save' command in effect, then that configuration
    would be restored on a failure and then the last-running
    configuration would be restored.

23) The 'try' command has been reimplemented with new semantics. 

    If Shorewall is started then the firewall state is saved to a
    temporary saved configuration (/var/lib/shorewall/.try). Next, if
    Shorewall is currently started then a restart command is issued;
    otherwise, a start command is performed. if an error occurs during
    the  compliation phase  of  the  restart or start, the command
    terminates without changing the Shorewall state. If an error occurs
    during the restart phase, then a 'shorewall restore' is performed
    using the saved configuration. If an error occurs during the start
    phase, then Shorewall is  cleared. If the start/restart succeeds
    and a timeout is specified then a 'clear' or 'restore' is performed
    after timeout seconds. 

24) The syntax of the 'export' command has been made slightly
    friendlier.

    The old syntax:

        export <directory1> [user@]system:[<directory2>]

    It is now:

        export <directory1> [user@]system[:<directory2>]

    In other words, if you don't need to specify <directory2>, you may
    omit the colon (":") following the system name.
    
    The old syntax is still accepted -- that is, you can still 
    type:

        export firewall2:

    which is equivalent to

        export firewall2

25) Shorewall commands may be speeded up slightly by using a
    'capabilities' file. The 'capabilities' file was originally
    designed for use with Shorewall Lite and records the
    iptables/Netfilter features available on the target system.

    To generate a capabilities file, execute the following command as
    root:

      shorewall show -f capabilities > /etc/shorewall/capabil
ities

    When you install a new kernel and/or iptables, be sure to generate
    a new capabilities file.
        
26) When syslogd is run with the -C option (which in some
    implementations causes syslogd to log to an in-memory circular
    buffer), /sbin/shorewall will now use the 'logread' command to read
    the log from that buffer. This is for combatibility with OpenWRT.

27) There is now a ":T" qualifier in /etc/shorewall/tcrules which
    causes the resulting rule to be inserted into the POSTROUTING
    chain.

28) The program /usr/share/shorewall/wait4ifup can be used to wait for
    a network device (such as a ppp device) to reach the UP state. 
    
        /usr/share/shorewall/wait4ifup <interface> [ <seconds> ]

    The program will wait for up to <seconds> seconds for the 
    named <interface> to reach the UP state. If <seconds> is not given,
    60 seconds is assumed.

    The exit status is zero if <interface> comes up within <seconds>
    seconds and non-zero otherwise.

29) Previously, 'ipsecnat' tunnels allowed AH traffic by default
    (unless 'isecnat:noah' was given). Given that AH is incompatible
    with nat-traversal, 'ipsecnat' now implies 'ipsecnat:noah'.

30) Shorewall now generates half as many rules as previously in the
    'blacklst' chain when BLACKLIST_LOGLEVEL is specified.

31) Beginning with Shorewall 3.4.0, if EXPORTPARAMS=No in
    shorewall.conf then Shorewall will not process
    /etc/shorewall/params when the compiled script is run. With
    EXPORTPARAMS=No, any shell variables needed at run-time must be set
    in /etc/shorewall/init.

    In a Shorewall/Shorewall Lite environment, this allows
    /etc/shorewall/params to be written to run exclusively
    on the administrative system while /etc/shorewall/init runs
    exclusively on the firewall system.

    So shell variables required at compile time may be set in
    /etc/shorewall/params and those required at run-time may be set in
    /etc/shorewall/init.

    Note 1: If you need shell variables values in your
    /etc/shorewall/stop or /etc/shorewall/stopped script, then you need
    to set their values in /etc/shorewall/stop. /etc/shorewall/init is
    not invoked during processing of the 'stop' and 'clear' commands.

    Note 2: EXPORTPARAMS was actually introduced in Shorewall version
    3.2.9. It is described here for the benefit of those who did not
    install that version.
+ +
Old +News here
+ + + diff --git a/web/Notices.html b/web/Notices.html index f8d290385..1561c31ca 100644 --- a/web/Notices.html +++ b/web/Notices.html @@ -33,12 +33,12 @@ Users of Shorewall's Multi-ISP Feature
-
2009-08-03
+
2009-08-14

End-of-life for Shorewall-shell in Shorewall 4.4

-The Shorewall 4.4 release in the fall of 2009 will not include +Shorewall 4.4, release in August 2009, does not include Shorewall-shell. Because Shorewall 4.0 is included in Debian Lenny, the 4.0 release of Shorewall-shell will continue to be supported until Debian Squeeze is released. The 4.2 release of Shorewall-shell will diff --git a/web/download.htm b/web/download.htm index 8a20bc12c..7c98f3697 100644 --- a/web/download.htm +++ b/web/download.htm @@ -1,592 +1,590 @@ - - - - - Download - - - - - - -

Shorewall Download
-

-
- - - - - - - - - - - -
Package Information
- 		Distribution-specific Download Sites
- 		Standard Download Sites
- 		Finding Updates that Correct Known Problems
- 		SVN
- 		Git
-
-

-
2009-06-28 -

Package Information

-

Before trying to install, we strongly urge you to read and print -a -copy -of the Shorewall QuickStart -Guide for the configuration that most closely matches your own. -

-

The documentation in both XML and HTML formats is available for -download -from the Download Sites listed in the table below.

-

NOTICE: There are three current Shorewall -Release -Series:

- -For additional information, see this article about the Shorewall Release Model. -

In Shorewall version 4.0.*, -there are four related -packages:

- -In Shorewall version 4.2.*, -there are two additional -packages that provide IPv6 support:
- -In Shorewall version 4.4.*, -the Shorewall-common, Shorewall-shell and -Shorewall-perl packages are discontinued and replaced with a single Shorewall package which combines the -functions of Shorewall-common and Shorewall-perl. The shell-based -compiler is retired. So with Shorewall 4.4 onward, there are four -packages:
- -To summarize: - -

Here are the installation instructions.

-

Distribution-specific Download Sites

-

Once you've printed the appropriate QuickStart Guide, download the -appropriate Packages:

- +

You will probably also want to download the HTML version of the +documentation for easy reference.

+

Standard Download Sites

+

Use the sites below to download the +tarball, the documentation and the standard RPM +for +(SUSE, Power PPC, Trustix and TurboLinux).
+
+Packages are GPG signed, please verify the integrity of the files +using our public key https://lists.shorewall.net/shorewall.gpg.key +

+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

SERVER LOCATION

+ 		+

DOMAIN

+ 		+

HTTP

+ 		+

FTP

+
+

Slovak Republic

+ 		+

Shorewall.net

+ 		+

Browse

+ 		+

Browse

+
+

Seattle, Washington, USA
+

+ 		+

Shorewall.net

+ 		+

Browse

+ 		+

Browse

+
+

Frankfurt/Main, Germany

+ 		+

Shorewall.de

+ 		+

Browse

+ 		+

N/A

+
Moscow, Russia
+ 		Shorewall.ru
+ 		Browse
+ 		Browse
+
+

Shoreline, Wa, USA

+ 		+

Shorewall.net

+ 		+

Browse

+ 		+

Browse

+
+

Australia
+

+ 		+

Shorewall.com.au

+ 		+

Browse

+ 		+

N/A

+
+

Argentina

+ 		+

Shorewall.net

+ 		+

Browse

+ 		+

N/A
+

+
Chicago, Illinois, USA +(Incomplete)
+ 		Sourceforge.net
+ 		BrowseN/A
+
+
+

Finding Updates that Correct Known Problems

+

Beginning with Shorewall 4.0.6, updated packages that include fixes +to +known problems are made available.

+

Example:

+
+ 
ftp> cd pub/shorewall/4.0/shorewall-4.0.6
250 OK. Current directory is /pub/shorewall/4.0/shorewall-4.0.6
ftp> ls
200 PORT command successful
150 Connecting to port 36018
drwxr-sr-x    4 1006     8            4096 Dec  1 08:16 .
drwxr-sr-x    9 1006     8            4096 Nov 23 08:22 ..
-rw-r--r--    1 1006     8             194 Nov 24 07:38 4.0.6-2.md5sums
-rw-r--r--    1 1006     8             218 Nov 24 07:38 4.0.6-2.sha1sums
-rw-r--r--    1 1006     8             841 Nov 26 13:26 4.0.6.md5sums
-rw-r--r--    1 1006     8             945 Nov 26 13:26 4.0.6.sha1sums
-rw-r--r--    1 1006     8             322 Nov 26 08:35 README.txt
drwxr-xr-x    4 1006     8            4096 Nov 23 08:21 base
-rw-r--r--    1 1006     8            1570 Dec  1 08:16 known_problems.txt
-rw-r--r--    1 1006     8          148363 Nov 23 08:22 patch-4.0.6
-rw-r--r--    1 1006     8            4238 Nov 24 16:49 patch-perl-4.0.6.1
-rw-r--r--    1 1006     8            5249 Nov 29 07:38 patch-perl-4.0.6.2
...

-rw-r--r--    1 1006     8          102295 Nov 24 07:38 shorewall-perl-4.0.6-2.noarch.rpm   <=========
-rw-r--r--    1 1006     8           99884 Nov 24 07:38 shorewall-perl-4.0.6.2.tar.bz2      <=========  
-rw-r--r--    1 1006     8             300 Nov 24 07:38 shorewall-perl-4.0.6.2.tar.bz2.asc  <=========
-rw-r--r--    1 1006     8          124814 Nov 24 07:38 shorewall-perl-4.0.6.2.tgz          <=========
-rw-r--r--    1 1006     8             300 Nov 24 07:38 shorewall-perl-4.0.6.2.tgz.asc      <=========
-rw-r--r--    1 1006     8           59124 Nov 23 08:22 shorewall-shell-4.0.6-0base.noarch.rpm
-rw-r--r--    1 1006     8           76500 Nov 23 08:22 shorewall-shell-4.0.6.tar.bz2
-rw-r--r--    1 1006     8             300 Nov 23 08:22 shorewall-shell-4.0.6.tar.bz2.asc
-rw-r--r--    1 1006     8           95193 Nov 23 08:22 shorewall-shell-4.0.6.tgz
-rw-r--r--    1 1006     8             300 Nov 23 08:22 shorewall-shell-4.0.6.tgz.asc
drwxr-sr-x    2 1006     8            4096 Nov 26 08:33 superseded
226-Options: -a -l 
226 41 matches total
ftp
+
+
+

The lines flagged with <====== show that the Shorewall-perl +package has been updated to include two bug fixes (note the "-2" and +".2" in the file names). The base tarballs for the release are found in +the base +directory. The unified diff files patch-4.0.6.* +may be applied sequentially to the base (4.0.6) Shorewall-perl release +(from the base directory) to +produce +4.0.6.2. The obsoleted 4.0.6 Shorewall-perl packages may be found in +the superseded +directory. The known_problems.txt file indicates +which problems are fixed in each updated package.

+
+

SVN

+
The SVN Repository at Sourceforge is used as a +safe-store for Shorewall releases.
+
+You should download and use the latest SVN version only at your own +risk -- please do not attempt to install Shorewall from +the SVN components; you will end up with an incomplete and non-working +installation. +

If you want to build your own packages from the SVN images, use +the build script found in tools/build/buildshorewall.

+

If you are looking for bug fixes for the current release, see above.
+
+The following SVN projects are currently active:
+

+
+
    +
  1. +
    +

    branches

    +

    This project contains sub-projects for each of the stable +releases.

    +

    The current stable version is branch named +x.y where x.y is the major version. Example: 3.4.
    +

    +

    You can download it using the following commands:
    +
    +    svn co +https://shorewall.svn.sourceforge.net/svnroot/shorewall/branches/x.y/Shorewall

    +
    +
    2. +
  2. +
    Shorewall
    +
    +     This project contains the Shorewall code.
    +
    +
    +You can download it using the following commands:
    +
    +    svn co +https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/Shorewall
    +
    +
    3. +
  3. +
    manpages
    +
    +Beginning with Shorewall 3,4,0, this project contains the man pages for +Shorewall. 'trunk' is the current development version.
    +
    +You can download it using the following commands:
    +
    +    svn co +https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/manpages
    +
    4. +
  4. +
    manpages-lite
    +
    +Beginning with Shorewall 3.4.0, this project contains the man pages for +Shorewall Lite. 'trunk'  is the current development version.
    +
    +You can download it using the following commands:
    +
    +    svn co +https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/manpages-lite
    +
    5. +
  5. +
    docs
    +
    +     This project contains the Shorewall documenation.
    +trunk is the current development version.
    +
    +
    +You can always get the current documentation in XML Docbook format +using the following command:
    +
    +    svn co +https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/docs
    +
    6. +
  6. +
    web
    +
    +     The project contains the part of this Web site not included +in the "docs" project.
    +
    7. +
  7. +
    tools
    +
    +     This project includes the tools used by the Shorewall +developers to build Shorewall releases and to publish content to the +web sites.
    +
    8. +
  8. +
    Samples
    +
    +     This project contains the sample configurations.
    +
    9. +
  9. +
    Shorewall-lite
    +
    +     This project contains Shorewall Lite -- introduced in +Shorewall version 3.2.0 RC1.
    +
    +
    10. +
  10. +
    Shorewall6
    +
    +     This project contains Shorewall6 -- introduced in Shorewall +version +4.2.4.
    +
    11. +
  11. +
    Shorewall6-lite
    +
    +     This project contains Shorewall6 Lite -- introduced in +Shorewall +version 4.2.4.
    +
    12. +
+

Git

+Beginning with Shorewall 4.3, the Shorewall project is migrating from +SVN to Git. You may browse the Shorewall +Git repository at Sourceforge.
+
+To create your own copy of the repository, use this command:
+
+
git clone git://shorewall.git.sourceforge.net/gitroot/shorewall
+
+
+
Copyright ©  2001-2009 +Thomas M. Eastep +

Permission is granted to copy, distribute and/or modify this +document +under the terms of the GNU Free Documentation License, Version 1.2 or +any +later version published by the Free Software Foundation; with no +Invariant +Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of +the +license is included in the section entitled “GNU Free Documentation License”.

+ + diff --git a/web/shorewall_index.htm b/web/shorewall_index.htm index 1978d7161..e2b2bc06d 100644 --- a/web/shorewall_index.htm +++ b/web/shorewall_index.htm @@ -47,7 +47,7 @@ -
2009-08-03
+
2009-08-14

No Shorewall-shell in Shorewall 4.4 -- read the details

@@ -61,13 +61,13 @@ Shorewall-shell in Shorewall 4.4 -- read the details
Stable Release
- 4.2.10 + 4.4.0 (includes IPv6 support.) Release + href="http://www1.shorewall.net/pub/shorewall/4.4/shorewall-4.4.0/releasenotes.txt">Release notes Known + href="http://www1.shorewall.net/pub/shorewall/4.4/shorewall-4.4.0/known_problems.txt">Known Problems @@ -76,14 +76,14 @@ Problems Stable Release
- 4.0.15
+ 4.2.10
Release + href="http://www1.shorewall.net/pub/shorewall/4.2/shorewall-4.2.10/releasenotes.txt">Release Notes
Known + href="http://www1.shorewall.net/pub/shorewall/4.2/shorewall-4.2.10/known_problems.txt">Known Problems
@@ -93,16 +93,15 @@ Problems
Release
- 4.4.0 -RC 2
+ No +current development release
Release -Notes
+ href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt">
 Known -Problems + href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/known_problems.txt">
+