mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-19 17:28:35 +02:00
Convert User_defined_Actions.html to Docbook XML
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@987 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
f8561a9b79
commit
506e84d232
@ -1,117 +0,0 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<meta http-equiv="content-type"
|
|
||||||
content="text/html; charset=ISO-8859-1">
|
|
||||||
<title>User-defined Actions</title>
|
|
||||||
<meta name="author" content="Tom EAstep">
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<h1 style="text-align: center;">User-defined Actions</h1>
|
|
||||||
<br>
|
|
||||||
Prior to Shorewall version 1.4.9, rules in /etc/shorewall/rules were
|
|
||||||
limited to those defined by Netfilter (ACCEPT, DROP, REJECT, etc.).
|
|
||||||
Beginning with Shorewall version 1.4.9, users may use sequences of
|
|
||||||
these elementary operations to define more complex actions.<br>
|
|
||||||
<br>
|
|
||||||
To define a new action:<br>
|
|
||||||
<ol>
|
|
||||||
<li>Add a line to /etc/shorewall/actions that names your new action.
|
|
||||||
Action names must be valid shell variable names as well as valid
|
|
||||||
Netfilter chain names. It is recommended that the name you select for a
|
|
||||||
new action begins with with a capital letter; that way, the name won't
|
|
||||||
conflict with a Shorewall-defined chain name.<br>
|
|
||||||
</li>
|
|
||||||
<li>Once you have defined your new action name (ActionName), then
|
|
||||||
copy /etc/shorewall/action.template to /etc/shorewall/action.ActionName
|
|
||||||
(for example, if your new action name is "Foo" then copy
|
|
||||||
/etc/shorewall/action.template to /etc/shorewall/action.foo).</li>
|
|
||||||
<li>Now modify the new file to define the new action.</li>
|
|
||||||
</ol>
|
|
||||||
Columns in the action.template file are as follows.<br>
|
|
||||||
<br>
|
|
||||||
<ul>
|
|
||||||
<li>TARGET - Must be ACCEPT, DROP, REJECT, LOG, QUEUE or
|
|
||||||
<action> where <action> is a previously-defined action. The
|
|
||||||
TARGET may optionally be followed by a colon (":") and a syslog log
|
|
||||||
level (e.g, REJECT:info or ACCEPT:debugging). This causes the packet to
|
|
||||||
be logged at the specified level. You may also specify ULOG (must be in
|
|
||||||
upper case) as a log level.This will log to the ULOG target for routing
|
|
||||||
to a separate log through use of ulogd
|
|
||||||
(http://www.gnumonks.org/projects/ulogd).<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>SOURCE - Source hosts to which the rule applies. A
|
|
||||||
comma-separated list of subnets and/or hosts. Hosts may be specified by
|
|
||||||
IP or MAC address; mac addresses must begin with "~" and must use "-"
|
|
||||||
as a separator.<br>
|
|
||||||
<br>
|
|
||||||
Alternatively, clients may be specified by interface name. For example,
|
|
||||||
eth1 specifies a client that communicates with the firewall system
|
|
||||||
through eth1. This may be optionally followed by another colon (":")
|
|
||||||
and an IP/MAC/subnet address as described above (e.g.,
|
|
||||||
eth1:192.168.1.5).<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>DEST - Location of Server. Same as above with the exception that
|
|
||||||
MAC addresses are not allowed.<br>
|
|
||||||
<br>
|
|
||||||
Unlike in the SOURCE column, you may specify a range of up to 256 IP
|
|
||||||
addresses using the syntax <<span style="font-style: italic;">first
|
|
||||||
ip</span>>-<<span style="font-style: italic;">last ip</span>>.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>PROTO - Protocol - Must be "tcp", "udp", "icmp", a number, or
|
|
||||||
"all".<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>DEST PORT(S) - Destination Ports. A comma-separated list of Port
|
|
||||||
names (from /etc/services), port numbers or port ranges; if the
|
|
||||||
protocol is "icmp", this column is interpreted as the destination
|
|
||||||
icmp-type(s).<br>
|
|
||||||
<br>
|
|
||||||
A port range is expressed as <<span style="font-style: italic;">low
|
|
||||||
port</span>>:<<span style="font-style: italic;">high port</span>>.<br>
|
|
||||||
<br>
|
|
||||||
This column is ignored if PROTOCOL = all but must be entered if any of
|
|
||||||
the following ields are supplied. In that case, it is suggested that
|
|
||||||
this field contain "-".<br>
|
|
||||||
<br>
|
|
||||||
If your kernel contains multi-port match support, then only a single
|
|
||||||
Netfilter rule will be generated if in this list and the CLIENT PORT(S)
|
|
||||||
list below:<br>
|
|
||||||
1. There are 15 or less ports listed.<br>
|
|
||||||
2. No port ranges are included.<br>
|
|
||||||
Otherwise, a separate rule will be generated for each port.<br>
|
|
||||||
<br>
|
|
||||||
</li>
|
|
||||||
<li>RATE LIMIT - You may rate-limit the rule by placing a value in
|
|
||||||
this columN:<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
<rate>/<interval>[:<burst>]<br>
|
|
||||||
<br>
|
|
||||||
where <rate> is the number of connections per <interval>
|
|
||||||
("sec" or "min") and <burst> is the largest burst permitted. If
|
|
||||||
no <burst> is given, a value of 5 is assumed. There may be no
|
|
||||||
whitespace embedded in the specification.<br>
|
|
||||||
<br>
|
|
||||||
|
|
||||||
Example: 10/sec:20</li>
|
|
||||||
</ul>
|
|
||||||
Example:<br>
|
|
||||||
<br>
|
|
||||||
/etc/shorewall/actions:<br>
|
|
||||||
<br>
|
|
||||||
LogAndAccept<br>
|
|
||||||
<br>
|
|
||||||
/etc/shorewall/action.LogAndAccept<br>
|
|
||||||
<br>
|
|
||||||
LOG:info<br>
|
|
||||||
ACCEPT<br>
|
|
||||||
<p align="left"><font size="2">Last Updated 12/09/2003 - <a
|
|
||||||
href="file:///Z:/Shorewall-docs/support.htm">Tom Eastep</a></font></p>
|
|
||||||
<a href="file:///Z:/Shorewall-docs/copyright.htm"><font size="2">Copyright</font>
|
|
||||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
162
Shorewall-docs/User_defined_Actions.xml
Executable file
162
Shorewall-docs/User_defined_Actions.xml
Executable file
@ -0,0 +1,162 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
|
<article>
|
||||||
|
<!---->
|
||||||
|
|
||||||
|
<articleinfo>
|
||||||
|
<title>User-defined Actions</title>
|
||||||
|
|
||||||
|
<authorgroup>
|
||||||
|
<author>
|
||||||
|
<firstname>Tom</firstname>
|
||||||
|
|
||||||
|
<surname>Eastep</surname>
|
||||||
|
</author>
|
||||||
|
</authorgroup>
|
||||||
|
|
||||||
|
<pubdate>2003-12-09</pubdate>
|
||||||
|
|
||||||
|
<copyright>
|
||||||
|
<year>2001</year>
|
||||||
|
|
||||||
|
<year>2002</year>
|
||||||
|
|
||||||
|
<year>2003</year>
|
||||||
|
|
||||||
|
<holder>Thomas M. Eastep</holder>
|
||||||
|
</copyright>
|
||||||
|
|
||||||
|
<legalnotice>
|
||||||
|
<para>Permission is granted to copy, distribute and/or modify this
|
||||||
|
document under the terms of the GNU Free Documentation License, Version
|
||||||
|
1.2 or any later version published by the Free Software Foundation; with
|
||||||
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||||
|
Texts. A copy of the license is included in the section entitled
|
||||||
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||||||
|
</legalnotice>
|
||||||
|
</articleinfo>
|
||||||
|
|
||||||
|
<para>Prior to Shorewall version 1.4.9, rules in /etc/shorewall/rules were
|
||||||
|
limited to those defined by Netfilter (ACCEPT, DROP, REJECT, etc.).
|
||||||
|
Beginning with Shorewall version 1.4.9, users may use sequences of these
|
||||||
|
elementary operations to define more complex actions.</para>
|
||||||
|
|
||||||
|
<para>To define a new action:</para>
|
||||||
|
|
||||||
|
<orderedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>Add a line to /etc/shorewall/actions that names your new action.
|
||||||
|
Action names must be valid shell variable names as well as valid
|
||||||
|
Netfilter chain names. It is recommended that the name you select for a
|
||||||
|
new action begins with with a capital letter; that way, the name
|
||||||
|
won't conflict with a Shorewall-defined chain name.</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Once you have defined your new action name (ActionName), then copy
|
||||||
|
/etc/shorewall/action.template to /etc/shorewall/action.ActionName (for
|
||||||
|
example, if your new action name is "Foo" then copy
|
||||||
|
/etc/shorewall/action.template to /etc/shorewall/action.foo). </para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Now modify the new file to define the new action.</para>
|
||||||
|
</listitem>
|
||||||
|
</orderedlist>
|
||||||
|
|
||||||
|
<para>Columns in the action.template file are as follows:</para>
|
||||||
|
|
||||||
|
<itemizedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>TARGET - Must be ACCEPT, DROP, REJECT, LOG, QUEUE or
|
||||||
|
<action> where <action> is a previously-defined action.
|
||||||
|
The TARGET may optionally be followed by a colon (":") and a
|
||||||
|
syslog log level (e.g, REJECT:info or ACCEPT:debugging). This causes the
|
||||||
|
packet to be logged at the specified level. You may also specify ULOG
|
||||||
|
(must be in upper case) as a log level.This will log to the ULOG target
|
||||||
|
for routing to a separate log through use of ulogd
|
||||||
|
(http://www.gnumonks.org/projects/ulogd).</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>SOURCE - Source hosts to which the rule applies. A comma-separated
|
||||||
|
list of subnets and/or hosts. Hosts may be specified by IP or MAC
|
||||||
|
address; mac addresses must begin with "~" and must use
|
||||||
|
"-" as a separator.</para>
|
||||||
|
|
||||||
|
<para>Alternatively, clients may be specified by interface name. For
|
||||||
|
example, eth1 specifies a client that communicates with the firewall
|
||||||
|
system through eth1. This may be optionally followed by another colon
|
||||||
|
(":") and an IP/MAC/subnet address as described above (e.g.,
|
||||||
|
eth1:192.168.1.5).</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>DEST - Location of Server. Same as above with the exception that
|
||||||
|
MAC addresses are not allowed.</para>
|
||||||
|
|
||||||
|
<para>Unlike in the SOURCE column, you may specify a range of up to 256
|
||||||
|
IP addresses using the syntax <first ip>-<last ip>.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>PROTO - Protocol - Must be "tcp", "udp",
|
||||||
|
"icmp", a number, or "all".</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>DEST PORT(S) - Destination Ports. A comma-separated list of Port
|
||||||
|
names (from /etc/services), port numbers or port ranges; if the protocol
|
||||||
|
is "icmp", this column is interpreted as the destination
|
||||||
|
icmp-type(s).</para>
|
||||||
|
|
||||||
|
<para>A port range is expressed as <low port>:<high
|
||||||
|
port>.</para>
|
||||||
|
|
||||||
|
<para>This column is ignored if PROTOCOL = all but must be entered if
|
||||||
|
any of the following ields are supplied. In that case, it is suggested
|
||||||
|
that this field contain "-".</para>
|
||||||
|
|
||||||
|
<para>If your kernel contains multi-port match support, then only a
|
||||||
|
single Netfilter rule will be generated if in this list and the CLIENT
|
||||||
|
PORT(S) list below:</para>
|
||||||
|
|
||||||
|
<orderedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>There are 15 or less ports listed.</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>No port ranges are included.</para>
|
||||||
|
</listitem>
|
||||||
|
</orderedlist>
|
||||||
|
|
||||||
|
<para>Otherwise, a separate rule will be generated for each port.</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>RATE LIMIT - You may rate-limit the rule by placing a value in
|
||||||
|
this column:</para>
|
||||||
|
|
||||||
|
<para><programlisting> <rate>/<interval>[:<burst>]</programlisting>where
|
||||||
|
<rate> is the number of connections per <interval>
|
||||||
|
("sec" or "min") and <burst> is the largest
|
||||||
|
burst permitted. If no <burst> is given, a value of 5 is
|
||||||
|
assumed. There may be no whitespace embedded in the specification.</para>
|
||||||
|
|
||||||
|
<para><programlisting> Example: 10/sec:20</programlisting></para>
|
||||||
|
</listitem>
|
||||||
|
</itemizedlist>
|
||||||
|
|
||||||
|
<para>Example:</para>
|
||||||
|
|
||||||
|
<para><emphasis role="bold">/etc/shorewall/actions:</emphasis></para>
|
||||||
|
|
||||||
|
<para><programlisting> LogAndAccept</programlisting><emphasis
|
||||||
|
role="bold">/etc/shorewall/action.LogAndAccept</emphasis><programlisting> LOG:info
|
||||||
|
ACCEPT</programlisting></para>
|
||||||
|
|
||||||
|
<para> </para>
|
||||||
|
</article>
|
||||||
Loading…
x
Reference in New Issue
Block a user