From 5b5f91f75f7d8ca0ac476d266b361b38fccfc806 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Tue, 18 Oct 2016 15:32:22 -0700 Subject: [PATCH] SNAT option documentation Signed-off-by: Tom Eastep --- Shorewall/manpages/shorewall-actions.xml | 14 +++ Shorewall/manpages/shorewall-snat.xml | 16 +++- Shorewall6/manpages/shorewall6-snat.xml | 14 +++ docs/Actions.xml | 107 ++++++++++++++++++++++- 4 files changed, 148 insertions(+), 3 deletions(-) diff --git a/Shorewall/manpages/shorewall-actions.xml b/Shorewall/manpages/shorewall-actions.xml index 409a4f833..5b4f13317 100644 --- a/Shorewall/manpages/shorewall-actions.xml +++ b/Shorewall/manpages/shorewall-actions.xml @@ -154,6 +154,20 @@ + + + + + Added in Shorewall 5.0.13. Specifies that this action is + to be used in shorewall-snat(5) rather + than shorewall-rules(5). The + and options are + mutually exclusive. + + + diff --git a/Shorewall/manpages/shorewall-snat.xml b/Shorewall/manpages/shorewall-snat.xml index 762c11655..94edc136d 100644 --- a/Shorewall/manpages/shorewall-snat.xml +++ b/Shorewall/manpages/shorewall-snat.xml @@ -135,13 +135,27 @@ - CONTINUE[+] + CONTINUE[+] Causes matching packets to be exempted from any following rules in the file. + + + action[(parameter,...)] + + + where action is an action + declared in shorewall-actions(5) with + the option. See www.shorewall.net/Actions.html for + further information. + + Normally Masq/SNAT rules are evaluated after those for diff --git a/Shorewall6/manpages/shorewall6-snat.xml b/Shorewall6/manpages/shorewall6-snat.xml index e03c35e97..c11592d31 100644 --- a/Shorewall6/manpages/shorewall6-snat.xml +++ b/Shorewall6/manpages/shorewall6-snat.xml @@ -141,6 +141,20 @@ following rules in the file. + + + action[(parameter,...)] + + + where action is an action + declared in shorewall6-actions(5) + with the option. See www.shorewall.net/Actions.html for + further information. + + Normally Masq/SNAT rules are evaluated after those for diff --git a/docs/Actions.xml b/docs/Actions.xml index 0a9c7eefb..0a6e55728 100644 --- a/docs/Actions.xml +++ b/docs/Actions.xml @@ -417,8 +417,8 @@ REDIRECT net - tcp 80 - 1.2.3.4 To create a mangle action, follow the steps in the preceding section, but use the - /usr/share/shorewall/action.mangletemplate file. - + /usr/share/shorewall/action.mangletemplate + file. @@ -1011,4 +1011,107 @@ add_rule $chainref, '-j ACCEPT'; 1; + +
+ Mangle Actions + + Beginning with Shorewall 5.0.7, actions are supported in shorewall-mangle(5). Like + actions used out of shorewall-rules(5), they must + be declared in shorewall-actions(5). These + mangle actions must have the + option specified on shorewall-actions(5). Like + the actions described in the preceding sections, mangle actions are + defined in a files with names of the form + action.action. Rules in those files have the + same format as those in shorewall-mangle(5) with the + restriction that chain designators (:P, :F, etc.) are not permitted in the + ACTION column. Both regular and inline actions are supported. + + Inline Example + + /etc/shorewall/actions: + + #ACTION OPTIONS +Divert inline,mangle # TProxy Rules + + + /etc/shorewall/action.Divert: + + #ACTION SOURCE DEST PROTO DPORT SPORT +DIVERT COMB_IF - tcp - 80 +DIVERT COMC_IF - tcp - 80 +DIVERT DMZ_IF 172.20.1.0/24 tcp - 80 + + + /etc/shorewall/mangle: + + #ACTION SOURCE DEST PROTO DPORT SPORT +Divert + + More efficient way to do this: + + /etc/shorewall/actions: + + #ACTION OPTIONS +Divert inline # TProxy Rules + + + /etc/shorewall/action.Divert: + + #ACTION SOURCE DEST PROTO DPORT SPORT +DIVERT COMB_IF - +DIVERT COMC_IF - +DIVERT DMZ_IF 172.20.1.0/24 + + + /etc/shorewall/mangle: + + #ACTION SOURCE DEST PROTO DPORT SPORT +Divert - - tcp - 80 +
+ +
+ SNAT Actions + + Beginning with Shorewall 5.0.13, actions are supported in shorewall-snat(5); that file + supercedes shorewall-masq(5) which is + still supported. The shorewall update command will convert a + masq file into the equivalent + snat file. Like actions used out of shorewall-rules(5), + SNAT actions must be declared in shorewall-actions(5). These + mangle actions must have the + option specified on shorewall-actions(5). Like + the actions described in the preceding sections, SNAT actions are defined + in a files with names of the form + action.action. Rules in those files have the + same format as those in shorewall-snat(5) with two + restrictions: + + + + The plus sign ("+") is not allowed in the ACTION column, so all + rules in the action will either be pre-nat or post-nat depending on + whether '+' was present in the action's invocation. + + + + Interface names are not allowed in the DEST column, so all rules + in the action will apply to the interface specified in the action's + invocation. + + + + Both regular and inline actions are supported. +