diff --git a/Shorewall/manpages/shorewall-actions.xml b/Shorewall/manpages/shorewall-actions.xml
index 409a4f833..5b4f13317 100644
--- a/Shorewall/manpages/shorewall-actions.xml
+++ b/Shorewall/manpages/shorewall-actions.xml
@@ -154,6 +154,20 @@
+
+
+
+
+ Added in Shorewall 5.0.13. Specifies that this action is
+ to be used in shorewall-snat(5) rather
+ than shorewall-rules(5). The
+ and options are
+ mutually exclusive.
+
+
+
diff --git a/Shorewall/manpages/shorewall-snat.xml b/Shorewall/manpages/shorewall-snat.xml
index 762c11655..94edc136d 100644
--- a/Shorewall/manpages/shorewall-snat.xml
+++ b/Shorewall/manpages/shorewall-snat.xml
@@ -135,13 +135,27 @@
- CONTINUE[+]
+ CONTINUE[+]Causes matching packets to be exempted from any
following rules in the file.
+
+
+ action[(parameter,...)]
+
+
+ where action is an action
+ declared in shorewall-actions(5) with
+ the option. See www.shorewall.net/Actions.html for
+ further information.
+
+ Normally Masq/SNAT rules are evaluated after those for
diff --git a/Shorewall6/manpages/shorewall6-snat.xml b/Shorewall6/manpages/shorewall6-snat.xml
index e03c35e97..c11592d31 100644
--- a/Shorewall6/manpages/shorewall6-snat.xml
+++ b/Shorewall6/manpages/shorewall6-snat.xml
@@ -141,6 +141,20 @@
following rules in the file.
+
+
+ action[(parameter,...)]
+
+
+ where action is an action
+ declared in shorewall6-actions(5)
+ with the option. See www.shorewall.net/Actions.html for
+ further information.
+
+ Normally Masq/SNAT rules are evaluated after those for
diff --git a/docs/Actions.xml b/docs/Actions.xml
index 0a9c7eefb..0a6e55728 100644
--- a/docs/Actions.xml
+++ b/docs/Actions.xml
@@ -417,8 +417,8 @@ REDIRECT net - tcp 80 - 1.2.3.4
To create a mangle action, follow the steps in the preceding
section, but use the
- /usr/share/shorewall/action.mangletemplate file.
-
+ /usr/share/shorewall/action.mangletemplate
+ file.
@@ -1011,4 +1011,107 @@ add_rule $chainref, '-j ACCEPT';
1;
+
+
+ Mangle Actions
+
+ Beginning with Shorewall 5.0.7, actions are supported in shorewall-mangle(5). Like
+ actions used out of shorewall-rules(5), they must
+ be declared in shorewall-actions(5). These
+ mangle actions must have the
+ option specified on shorewall-actions(5). Like
+ the actions described in the preceding sections, mangle actions are
+ defined in a files with names of the form
+ action.action. Rules in those files have the
+ same format as those in shorewall-mangle(5) with the
+ restriction that chain designators (:P, :F, etc.) are not permitted in the
+ ACTION column. Both regular and inline actions are supported.
+
+ Inline Example
+
+ /etc/shorewall/actions:
+
+ #ACTION OPTIONS
+Divert inline,mangle # TProxy Rules
+
+
+ /etc/shorewall/action.Divert:
+
+ #ACTION SOURCE DEST PROTO DPORT SPORT
+DIVERT COMB_IF - tcp - 80
+DIVERT COMC_IF - tcp - 80
+DIVERT DMZ_IF 172.20.1.0/24 tcp - 80
+
+
+ /etc/shorewall/mangle:
+
+ #ACTION SOURCE DEST PROTO DPORT SPORT
+Divert
+
+ More efficient way to do this:
+
+ /etc/shorewall/actions:
+
+ #ACTION OPTIONS
+Divert inline # TProxy Rules
+
+
+ /etc/shorewall/action.Divert:
+
+ #ACTION SOURCE DEST PROTO DPORT SPORT
+DIVERT COMB_IF -
+DIVERT COMC_IF -
+DIVERT DMZ_IF 172.20.1.0/24
+
+
+ /etc/shorewall/mangle:
+
+ #ACTION SOURCE DEST PROTO DPORT SPORT
+Divert - - tcp - 80
+
+
+
+ SNAT Actions
+
+ Beginning with Shorewall 5.0.13, actions are supported in shorewall-snat(5); that file
+ supercedes shorewall-masq(5) which is
+ still supported. The shorewall update command will convert a
+ masq file into the equivalent
+ snat file. Like actions used out of shorewall-rules(5),
+ SNAT actions must be declared in shorewall-actions(5). These
+ mangle actions must have the
+ option specified on shorewall-actions(5). Like
+ the actions described in the preceding sections, SNAT actions are defined
+ in a files with names of the form
+ action.action. Rules in those files have the
+ same format as those in shorewall-snat(5) with two
+ restrictions:
+
+
+
+ The plus sign ("+") is not allowed in the ACTION column, so all
+ rules in the action will either be pre-nat or post-nat depending on
+ whether '+' was present in the action's invocation.
+
+
+
+ Interface names are not allowed in the DEST column, so all rules
+ in the action will apply to the interface specified in the action's
+ invocation.
+
+
+
+ Both regular and inline actions are supported.
+