mirror of
https://gitlab.com/shorewall/code.git
synced 2025-02-02 02:49:54 +01:00
More standards work
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1058 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
0b93425ad0
commit
5c9c9d97fd
@ -49,7 +49,7 @@
|
|||||||
|
|
||||||
<para>and at a root shell prompt:</para>
|
<para>and at a root shell prompt:</para>
|
||||||
|
|
||||||
<programlisting><emphasis role="bold">shorewall restart</emphasis></programlisting>
|
<programlisting><command>shorewall restart</command></programlisting>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -207,7 +207,7 @@ ftp></programlisting>
|
|||||||
command. The <<emphasis>kernel-version</emphasis>> may be obtained
|
command. The <<emphasis>kernel-version</emphasis>> may be obtained
|
||||||
by typing</para>
|
by typing</para>
|
||||||
|
|
||||||
<programlisting>uname -r</programlisting>
|
<programlisting><command>uname -r</command></programlisting>
|
||||||
|
|
||||||
<example>
|
<example>
|
||||||
<title></title>
|
<title></title>
|
||||||
@ -292,7 +292,7 @@ options ip_nat_ftp ports=21,49</programlisting>
|
|||||||
|
|
||||||
<para><important><para>Once you have made these changes to
|
<para><important><para>Once you have made these changes to
|
||||||
/etc/shorewall/modules and/or /etc/modules.conf, you must either:</para><orderedlist><listitem><para>Unload
|
/etc/shorewall/modules and/or /etc/modules.conf, you must either:</para><orderedlist><listitem><para>Unload
|
||||||
the modules and restart shorewall:</para><programlisting>rmmod ip_nat_ftp; rmmod ip_conntrack_ftp; shorewall restart</programlisting></listitem><listitem><para>Reboot</para></listitem></orderedlist></important></para>
|
the modules and restart shorewall:</para><programlisting><command>rmmod ip_nat_ftp; rmmod ip_conntrack_ftp; shorewall restart</command></programlisting></listitem><listitem><para>Reboot</para></listitem></orderedlist></important></para>
|
||||||
</example>
|
</example>
|
||||||
|
|
||||||
<para>One problem that I see occasionally involves active mode and the FTP
|
<para>One problem that I see occasionally involves active mode and the FTP
|
||||||
|
@ -15,10 +15,10 @@
|
|||||||
</author>
|
</author>
|
||||||
</authorgroup>
|
</authorgroup>
|
||||||
|
|
||||||
<pubdate>2003-12-29</pubdate>
|
<pubdate>2004-01-04</pubdate>
|
||||||
|
|
||||||
<copyright>
|
<copyright>
|
||||||
<year>2001-2003</year>
|
<year>2001-2004</year>
|
||||||
|
|
||||||
<holder>Thomas M. Eastep</holder>
|
<holder>Thomas M. Eastep</holder>
|
||||||
</copyright>
|
</copyright>
|
||||||
@ -48,8 +48,9 @@
|
|||||||
<listitem>
|
<listitem>
|
||||||
<para>Shorewall startup is disabled by default. Once you have
|
<para>Shorewall startup is disabled by default. Once you have
|
||||||
configured your firewall, you can enable startup by removing the
|
configured your firewall, you can enable startup by removing the
|
||||||
file /etc/shorewall/startup_disabled. Note: Users of the .deb
|
file <filename>/etc/shorewall/startup_disabled</filename>. Note:
|
||||||
package must edit /etc/default/shorewall and set <quote>startup=1</quote>.</para>
|
Users of the .deb package must edit <filename>/etc/default/shorewall</filename>
|
||||||
|
and set <quote>startup=1</quote>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -80,15 +81,16 @@
|
|||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall stop</command> - stops the firewall; the only
|
<para><command>shorewall stop</command> - stops the firewall; the only
|
||||||
traffic permitted through the firewall is from systems listed in
|
traffic permitted through the firewall is from systems listed in
|
||||||
/etc/shorewall/routestopped (Beginning with version 1.4.7, if
|
<filename>/etc/shorewall/routestopped</filename> (Beginning with
|
||||||
ADMINISABSENTMINDED=Yes in /etc/shorewall/shorewall.conf then in
|
version 1.4.7, if ADMINISABSENTMINDED=Yes in <filename>/etc/shorewall/shorewall.conf</filename>
|
||||||
addition, all existing connections are permitted and any new
|
then in addition, all existing connections are permitted and any new
|
||||||
connections originating from the firewall itself are allowed).</para>
|
connections originating from the firewall itself are allowed).</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall restart </command>- stops the firewall (if
|
<para><command>shorewall restart </command>- stops the firewall (if it
|
||||||
it's running) and then starts it again</para>
|
is in the <emphasis role="bold">Started</emphasis> state) and then
|
||||||
|
starts it again</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -127,20 +129,20 @@
|
|||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall show <chain1> [ <chain2> ...
|
<para><command>shorewall show <chain1> [ <chain2> ...
|
||||||
]</command> - produce a verbose report about the listed chains
|
]</command> - produce a verbose report about the listed chains (<command>iptables
|
||||||
(iptables -L chain -n -v) Note: You may only list one chain in the
|
-L chain -n -v</command>) Note: You may only list one chain in the
|
||||||
show command when running Shorewall version 1.4.6 and earlier. Version
|
show command when running Shorewall version 1.4.6 and earlier. Version
|
||||||
1.4.7 and later allow you to list multiple chains in one command.</para>
|
1.4.7 and later allow you to list multiple chains in one command.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall show nat</command> - produce a verbose report
|
<para><command>shorewall show nat</command> - produce a verbose report
|
||||||
about the nat table (iptables -t nat -L -n -v)</para>
|
about the nat table (<command>iptables -t nat -L -n -v</command>)</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall show tos</command> - produce a verbose report
|
<para><command>shorewall show tos</command> - produce a verbose report
|
||||||
about the mangle table (iptables -t mangle -L -n -v)</para>
|
about the mangle table (<command>iptables -t mangle -L -n -v</command>)</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -168,8 +170,8 @@
|
|||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para><command>shorewall hits</command> - Produces several reports
|
<para><command>shorewall hits</command> - Produces several reports
|
||||||
about the Shorewall packet log messages in the current
|
about the Shorewall packet log messages in the current log file named
|
||||||
/var/log/messages file.</para>
|
in the LOGFILE variable in <filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -289,12 +291,13 @@
|
|||||||
<command>shorewall try <configuration-directory></command></programlisting>
|
<command>shorewall try <configuration-directory></command></programlisting>
|
||||||
|
|
||||||
<para>If a <emphasis><configuration-directory</emphasis>> is
|
<para>If a <emphasis><configuration-directory</emphasis>> is
|
||||||
specified, each time that Shorewall is going to use a file in
|
specified, each time that Shorewall is going to use a file in <filename
|
||||||
/etc/shorewall it will first look in the<emphasis>
|
class="directory">/etc/shorewall</filename> it will first look in the<emphasis>
|
||||||
<configuration-directory></emphasis> . If the file is present in
|
<configuration-directory></emphasis> . If the file is present in
|
||||||
the <emphasis><configuration-directory>,</emphasis> that file will
|
the <emphasis><configuration-directory>,</emphasis> that file will
|
||||||
be used; otherwise, the file in /etc/shorewall will be used. When changing
|
be used; otherwise, the file in <filename class="directory">/etc/shorewall</filename>
|
||||||
the configuration of a production firewall, I recommend the following:</para>
|
will be used. When changing the configuration of a production firewall, I
|
||||||
|
recommend the following:</para>
|
||||||
|
|
||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -461,7 +464,8 @@
|
|||||||
<appendix>
|
<appendix>
|
||||||
<title>Revision History</title>
|
<title>Revision History</title>
|
||||||
|
|
||||||
<para><revhistory><revision><revnumber>1.2</revnumber><date>2003-12-31</date><authorinitials>TE</authorinitials><revremark>Added
|
<para><revhistory><revision><revnumber>1.3-1.8</revnumber><date>2004-01-04</date><authorinitials>TE</authorinitials><revremark>Docbook
|
||||||
|
standards</revremark></revision><revision><revnumber>1.2</revnumber><date>2003-12-31</date><authorinitials>TE</authorinitials><revremark>Added
|
||||||
clarification about "Started State"</revremark></revision><revision><revnumber>1.1</revnumber><date>2003-12-29</date><authorinitials>TE</authorinitials><revremark>Initial
|
clarification about "Started State"</revremark></revision><revision><revnumber>1.1</revnumber><date>2003-12-29</date><authorinitials>TE</authorinitials><revremark>Initial
|
||||||
Docbook conversion</revremark></revision></revhistory></para>
|
Docbook conversion</revremark></revision></revhistory></para>
|
||||||
</appendix>
|
</appendix>
|
||||||
|
Loading…
Reference in New Issue
Block a user