mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-08 08:44:05 +01:00
SNAT option documentation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
ab496987e0
commit
5b5f91f75f
@ -154,6 +154,20 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><option>nat</option></term>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.0.13. Specifies that this action is
|
||||
to be used in <ulink
|
||||
url="shorewall-snat.html">shorewall-snat(5)</ulink> rather
|
||||
than <ulink
|
||||
url="shorewall-rules.html">shorewall-rules(5)</ulink>. The
|
||||
<option>mangle</option> and <option>nat</option> options are
|
||||
mutually exclusive.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><option>noinline</option></term>
|
||||
|
||||
|
||||
@ -135,13 +135,27 @@
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>CONTINUE[+]</term>
|
||||
<term><emphasis role="bold">CONTINUE</emphasis>[+]</term>
|
||||
|
||||
<listitem>
|
||||
<para>Causes matching packets to be exempted from any
|
||||
following rules in the file.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis
|
||||
role="bold"><replaceable>action</replaceable></emphasis>[(<replaceable>parameter</replaceable>,...)]</term>
|
||||
|
||||
<listitem>
|
||||
<para>where <replaceable>action</replaceable> is an action
|
||||
declared in <ulink
|
||||
url="shorewall-actions.html">shorewall-actions(5)</ulink> with
|
||||
the <option>nat</option> option. See <ulink
|
||||
url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
|
||||
further information.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>Normally Masq/SNAT rules are evaluated after those for
|
||||
|
||||
@ -141,6 +141,20 @@
|
||||
following rules in the file.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis
|
||||
role="bold"><replaceable>action</replaceable></emphasis>[(<replaceable>parameter</replaceable>,...)]</term>
|
||||
|
||||
<listitem>
|
||||
<para>where <replaceable>action</replaceable> is an action
|
||||
declared in <ulink
|
||||
url="shorewall6-actions.html">shorewall6-actions(5)</ulink>
|
||||
with the <option>nat</option> option. See <ulink
|
||||
url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
|
||||
further information.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>Normally Masq/SNAT rules are evaluated after those for
|
||||
|
||||
107
docs/Actions.xml
107
docs/Actions.xml
@ -417,8 +417,8 @@ REDIRECT net - tcp 80 - 1.2.3.4</programlisting>
|
||||
|
||||
<para>To create a mangle action, follow the steps in the preceding
|
||||
section, but use the
|
||||
<filename>/usr/share/shorewall/action.mangletemplate</filename> file.
|
||||
</para>
|
||||
<filename>/usr/share/shorewall/action.mangletemplate</filename>
|
||||
file.</para>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
@ -1011,4 +1011,107 @@ add_rule $chainref, '-j ACCEPT';
|
||||
1; </programlisting>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Mangle Actions</title>
|
||||
|
||||
<para>Beginning with Shorewall 5.0.7, actions are supported in <ulink
|
||||
url="manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink>. Like
|
||||
actions used out of <ulink
|
||||
url="manpages/shorewall-rules.html">shorewall-rules(5)</ulink>, they must
|
||||
be declared in <ulink
|
||||
url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. These
|
||||
<firstterm>mangle actions</firstterm> must have the
|
||||
<option>mangle</option> option specified on <ulink
|
||||
url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. Like
|
||||
the actions described in the preceding sections, mangle actions are
|
||||
defined in a files with names of the form
|
||||
action.<replaceable>action</replaceable>. Rules in those files have the
|
||||
same format as those in <ulink
|
||||
url="manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink> with the
|
||||
restriction that chain designators (:P, :F, etc.) are not permitted in the
|
||||
ACTION column. Both regular and inline actions are supported.</para>
|
||||
|
||||
<para>Inline Example</para>
|
||||
|
||||
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION OPTIONS
|
||||
Divert inline,mangle # TProxy Rules
|
||||
</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/action.Divert</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT
|
||||
DIVERT COMB_IF - tcp - 80
|
||||
DIVERT COMC_IF - tcp - 80
|
||||
DIVERT DMZ_IF 172.20.1.0/24 tcp - 80
|
||||
</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/mangle</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT
|
||||
Divert</programlisting>
|
||||
|
||||
<para>More efficient way to do this:</para>
|
||||
|
||||
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION OPTIONS
|
||||
Divert inline # TProxy Rules
|
||||
</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/action.Divert</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT
|
||||
DIVERT COMB_IF -
|
||||
DIVERT COMC_IF -
|
||||
DIVERT DMZ_IF 172.20.1.0/24
|
||||
</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/mangle</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT
|
||||
Divert - - tcp - 80</programlisting>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>SNAT Actions</title>
|
||||
|
||||
<para>Beginning with Shorewall 5.0.13, actions are supported in <ulink
|
||||
url="manpages/shorewall-snat.html">shorewall-snat(5</ulink>); that file
|
||||
supercedes <ulink
|
||||
url="manpages/shorewall-masq.html">shorewall-masq(5)</ulink> which is
|
||||
still supported. The shorewall update command will convert a
|
||||
<filename>masq</filename> file into the equivalent
|
||||
<filename>snat</filename> file. Like actions used out of <ulink
|
||||
url="manpages/shorewall-rules.html">shorewall-rules(5)</ulink>,
|
||||
<firstterm>SNAT actions</firstterm> must be declared in <ulink
|
||||
url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. These
|
||||
<firstterm>mangle actions</firstterm> must have the <option>nat</option>
|
||||
option specified on <ulink
|
||||
url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. Like
|
||||
the actions described in the preceding sections, SNAT actions are defined
|
||||
in a files with names of the form
|
||||
action.<replaceable>action</replaceable>. Rules in those files have the
|
||||
same format as those in <ulink
|
||||
url="manpages/shorewall-snat.html">shorewall-snat(5)</ulink> with two
|
||||
restrictions:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>The plus sign ("+") is not allowed in the ACTION column, so all
|
||||
rules in the action will either be pre-nat or post-nat depending on
|
||||
whether '+' was present in the action's invocation.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Interface names are not allowed in the DEST column, so all rules
|
||||
in the action will apply to the interface specified in the action's
|
||||
invocation.</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>Both regular and inline actions are supported.</para>
|
||||
</section>
|
||||
</article>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user