diff --git a/docs/CompiledPrograms.xml b/docs/CompiledPrograms.xml
index a29e367bd..5159593d4 100644
--- a/docs/CompiledPrograms.xml
+++ b/docs/CompiledPrograms.xml
@@ -87,7 +87,7 @@
For example, if you have:
- EXT_IP=$(fiind_first_interface_address eth0)
+ EXT_IP=$(find_first_interface_address eth0)
in /etc/shorewall/params then all
occurrences of $EXT_IP in Shorewall configuration files will be
@@ -178,6 +178,13 @@
Shorewall Lite (Added in version 3.2.0 RC 1)
+
+ The following information applies to Shorewall 3.2.2 and later. Users running versions
+ of Shorewall and Shorewall Lite earlier than 3.2.2 are urged to
+ upgrade.
+
+
Shorewall Lite is a companion product to Shorewall and is designed
to allow you to maintain all Shorewall configuration information on a
single system within your network.
@@ -212,79 +219,11 @@
On each firewall system, you run:
- /usr/share/shorewall-lite/shorecap > capabilities
+ /sbin/shorewall-lite show -f capabilities > capabilities
scp capabilities <admin system>:<this system's config dir>
If you are running Debian or one of its derivatives like Ubuntu
then edit /etc/default/shorewall-lite and set startup=1.
-
- Shorewall Lite includes a very limited version of
- shorewall.conf
- (/etc/shorewall-lite/shorewall.conf).
- It includes the following options which have the same meaning as in a
- full Shorewall installation except as noted below:
-
-
-
- VERBOSITY
-
- LOGFILE
-
- LOGFORMAT — used by /sbin/shorewall
- for finding 'Shorewall' log messages. If LOGFORMAT was specified
- in the shorewall.conf file used at compile time on the
- administrative system, then the format of the messages themselves
- is defined by that value. If LOGFORMAT was not specified at
- compile time then the firewall script will use the value from
- /etc/shorewall-lite/shorewall.conf on the
- firewall system.
-
- IPTABLES — determines the iptables binary to be used by
- /sbin/shorewall. The compiled firewall script
- will use the IPTABLES specified in
- shorewall.conf at compile time on the
- administrative system, if any; if IPTABLES was not specified at
- compile time then the IPTABLES value from
- /etc/shorewall-lite/shorewall.conf on the
- firewall system will be used by the firewall script.
-
- PATH
-
- SHOREWALL_SHELL
-
- SUBSYSLOCK
-
- RESTOREFILE
-
-
-
- The handling of CONFIG_PATH was broken in Shorewall 3.2.0 —
- Users wishing to use Shorewall Lite are urged to run 3.2.1 or later
- (both Shorewall and Shorewall Lite). Beginning with version 3.2.1, the
- CONFIG_PATH variable is treated as follows:
-
-
-
- The value of CONFIG_PATH in
- /etc/shorewall/shorewall.conf is ignored when
- compiling for export (the -e option in given).
-
-
-
- The value of CONFIG_PATH in the
- shorewall.conf file in the export directory
- is used to search for configuration files during compilation of
- that configuration.
-
-
-
- The value of CONFIG_PATH used when the script is run on the
- firewall system is
- "/etc/shorewall-lite:/usr/share/shorewall-lite".
-
-
-
- Edit the shorewall.conf file as required.
@@ -307,6 +246,31 @@
class="directory">/etc/shorewall, when using Shorewall
Lite you make those changes in the firewall's export directory on
the administrative system.
+
+ The CONFIG_PATH variable is treated as follows:
+
+
+
+ The value of CONFIG_PATH in
+ /etc/shorewall/shorewall.conf is ignored
+ when compiling for export (the -e option in given) and when
+ the load or reload
+ command is being executed (see below).
+
+
+
+ The value of CONFIG_PATH in the
+ shorewall.conf file in the export
+ directory is used to search for configuration files during
+ compilation of that configuration.
+
+
+
+ The value of CONFIG_PATH used when the script is run on
+ the firewall system is
+ "/etc/shorewall-lite:/usr/share/shorewall-lite".
+
+
@@ -316,9 +280,9 @@
The load
command compiles a firewall script from the configuration files in
- the current working directory, copies that file to the remote
- system via scp and starts Shorewall Lite on the remote system via
- ssh.
+ the current working directory (using shorewall compile
+ -e), copies that file to the remote system via scp and
+ starts Shorewall Lite on the remote system via ssh.
Example (firewall's DNS name is 'gateway'):
@@ -337,11 +301,42 @@
The reload
command compiles a firewall script from the configuration files in the
- current working directory, copies that file to the remote system via
- scp and restarts Shorewall Lite on the remote system via ssh.
+ current working directory (using shorewall compile
+ -e), copies that file to the remote system via scp and
+ restarts Shorewall Lite on the remote system via ssh.
+ There is a shorewall.conf file installed as
+ part of Shorewall Lite
+ (/etc/shorewall-lite/shorewall.conf). You can use
+ that file on the firewall system to override some of the settings from the
+ shorewall.conf file in the export directory. Settings that you can
+ override are:
+
+
+
+ VERBOSITY
+
+ LOGFILE
+
+ LOGFORMAT
+
+ IPTABLES
+
+ PATH
+
+ SHOREWALL_SHELL
+
+ SUBSYSLOCK
+
+ RESTOREFILE
+
+
+
+ You will normally not need to touch
+ /etc/shorewall-lite/shorewall.conf.
+
The /sbin/shorewall-lite program included with
Shorewall Lite supports the same set of commands as the
/sbin/shorewall program in a full Shorewall
@@ -414,9 +409,6 @@
Install Shorewall Lite on the firewall system.
- Modify /etc/shorewall-lite/shorewall.conf
- as needed.
-
If you are running Debian or one of its derivatives like
Ubuntu then edit /etc/default/shorewall-lite and set
startup=1.
@@ -425,7 +417,7 @@
On the firewall system:
- /usr/share/shorewall-lite/shorecap > capabilities
+ /sbin/shorewall-lite show -f capabilities > capabilities
scp capabilities <admin system>:<this system's config dir>
@@ -473,9 +465,9 @@
The load
command compiles a firewall script from the configuration files in
- the current working directory, copies that file to the remote system
- via scp and starts Shorewall Lite on the remote system via
- ssh.
+ the current working directory (using shorewall compile
+ -e), copies that file to the remote system via scp and
+ starts Shorewall Lite on the remote system via ssh.
@@ -489,9 +481,9 @@
The reload
command compiles a firewall script from the configuration files in
- the current working directory, copies that file to the remote system
- via scp and restarts Shorewall Lite on the remote system via
- ssh.
+ the current working directory (using shorewall compile
+ -e), copies that file to the remote system via scp and
+ restarts Shorewall Lite on the remote system via ssh.
@@ -556,6 +548,13 @@ MANGLE_FORWARD # Mangle table has FORWARD chainThe capabilities file may then be copied to a
system with Shorewall installed and used when compiling firewall programs
to run on the remote system.
+
+ Beginning with Shorewall Lite version 3.2.2, the capabilities file
+ may also be creating using
+ /sbin/shorewall-lite:
+ shorewall-lite show -f capabilities >
+ capabilities
+
diff --git a/docs/Documentation_Index.xml b/docs/Documentation_Index.xml
index 408cdbbef..3781be063 100644
--- a/docs/Documentation_Index.xml
+++ b/docs/Documentation_Index.xml
@@ -23,8 +23,6 @@
Thomas M. Eastep
- 3.2.0 RC2
-
Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
@@ -36,726 +34,734 @@
-
- This article applies to Shorewall 3.0 and
- later. If you are running a version of Shorewall earlier than Shorewall
- 3.0.0 then please see the documentation for that
- release.
-
+
+ FAQs
-
- The complete Shorewall Documentation is available for download
- in both Docbook XML and HTML formats.
-
+
+
+ FAQs
+
+
+
- Frequently asked questions:
+
+ Getting Started
-
-
- FAQs
-
-
+ If you are new to Shorewall, please read these two articles
+ first.
- If you are new to Shorewall, please read these two articles
- first.
+
+
+ Introduction to
+ Shorewall
+
-
-
- Introduction to
- Shorewall
-
+
+ QuickStart Guides
+ (HOWTOs)
+
+
-
- QuickStart Guides
- (HOWTOs)
-
-
+ The following article is also recommended reading for
+ newcomers.
- The following article is also recommended reading for
- newcomers.
+
+
+ Configuration File
+ Basics
+
+ Comments in
+ configuration files
+
-
-
- Configuration File
- Basics
+
+ Line
+ Continuation
+
+
+
+ INCLUDE
+ Directive
+
+
+
+ Port
+ Numbers/Service Names
+
+
+
+ Port
+ Ranges
+
+
+
+ Using
+ Shell Variables
+
+
+
+ Using
+ DNS Names
+
+
+
+ Complementing an
+ IP address or Subnet
+
+
+
+ IP
+ Address Ranges
+
+
+
+ Shorewall
+ Configurations (making a test configuration)
+
+
+
+ Using MAC
+ Addresses in Shorewall
+
+
+
+
+
+
+
+ Index to the Articles
+
+ The remainder of the Documentation supplements the QuickStart
+ Guides. Please review the appropriate guide before trying to use this
+ documentation directly.
+
+
+ This index is in alphabetical
+ order.
+
+
+
+
+ 2.6 Kernel
+
+
+
+ Accounting
+
+
+
+ Actions
+
+
+
+ Aliased
+ (virtual) Interfaces (e.g., eth0:0)
+
+
+
+ Bandwidth
+ Control
+
+
+
+ Blacklisting
+
+
- Comments
- in configuration files
+ Static Blacklisting using /etc/shorewall/blacklist
- Line
- Continuation
+ Dynamic Blacklisting using /sbin/shorewall
+
+
+
+
+
+ Bridging
+
+
+
+ Bridge/Firewall (control traffic
+ through the bridge)
- INCLUDE
- Directive
+ Simple Bridge (don't need to
+ control traffic through the bridge)
+
+
+
+
+
+ Commands
+ (Description of all /sbin/shorewall commands)
+
+
+
+ Compiled Firewall
+ Programs (Shorewall 3.1 and later)
+
+
+
+ Configuration File Reference
+ Manual
+
+ accounting
+
+
+
+ actions and
+ action.template
+
+
+
+ blacklist
+
+
+
+ hosts
+
+
+
+ interfaces
+
+
+
+ ipsec
+
+
+
+ maclist
+
+
+
+ macros and
+ macro.template
+
+
+
+ masq
+
+
+
+ modules
+
+
+
+ nat
+
+
+
+ netmap
+
+
+
+ params
+
+
+
+ policy
+
+
+
+ providers
+
+
+
+ proxyarp
+
+
+
+ rfc1918
+
+
+
+ routestopped
+
+
+
+ rules
+
+
+
+ shorewall.conf
+
+
+
+ tcclasses
+
+
+
+ tcdevices
+
+
+
+ tcrules
+
+
+
+ tos
+
+
+
+ tunnels
+
+
+
+ usersets and
+ users
+
+
+
+ zones
+
+
+
+
+
+ Corporate Network Example
+ (Contributed by a Graeme Boyle)
+
+
+
+ DHCP
+
+
+
+ ECN Disabling by host or
+ subnet
+
+
+
+ Error Messages
+
+
+
+ Extension
+ Scripts (How to extend Shorewall without modifying Shorewall
+ code through the use of files in /etc/shorewall --
+ /etc/shorewall/start, /etc/shorewall/stopped, etc.)
+
+
+
+ Fallback/Uninstall
+
+
+
+ FAQs
+
+
+
+ Features
+
+
+
+ Forwarding Traffic on the Same
+ Interface
+
+
+
+ FTP and Shorewall
+
+
+
+ Getting help or answers to
+ questions
+
+
+
+ Installation/Upgrade
+
+
+
+ IPP2P
+
+
+
+ IPSEC
+
+
+
+ IPSEC using Kernel 2.6 and Shorewall
+ 2.1 or Later.
+
+
+
+ Ipsets
+
+
+
+ Kazaa
+ Filtering
+
+
+
+ Kernel Configuration
+
+
+
+ Logging
+
+
+
+ Macros
+
+
+
+ MAC Verification
+
+
+
+ Multiple Internet Connections from a
+ Single Firewall
+
+
+
+ Multiple Zones Through One
+ Interface
+
+
+
+ My Shorewall Configuration
+ (How I personally use Shorewall)
+
+
+
+ Netfilter
+ Overview
+
+
+
+ Network Mapping
+
+
+
+ One-to-one NAT (Static NAT)
+
+
+
+ OpenVPN
+
+
+
+ Operating
+ Shorewall
+
+
+
+ Packet Processing in a
+ Shorewall-based Firewall
+
+
+
+ 'Ping' Management
+
+
+
+ Port Information
+
+
+
+ Which applications use which ports
- Port
- Numbers/Service Names
+ Ports used by Trojans
+
+
+
+
+
+ Port Knocking and Other Uses of
+ the 'Recent Match'
+
+
+
+ PPTP
+
+
+
+ Proxy ARP
+
+
+
+ Release Model
+
+
+
+ Requirements
+
+
+
+ Routing and
+ Shorewall
+
+
+
+ Routing on One
+ Interface
+
+
+
+ Samba
+
+
+
+ Shorewall
+ Lite
+
+
+
+ Shorewall Setup
+ Guide
+
+ Introduction
+
+
+
+ Shorewall
+ Concepts
+
+
+
+ Network
+ Interfaces
+
+
+
+ Addressing, Subnets
+ and Routing
+
+
+
+ IP
+ Addresses
+
+
+
+ Subnets
+
+
+
+ Routing
+
+
+
+ Address
+ Resolution Protocol (ARP)
+
+
+
+ RFC
+ 1918
+
+
+
+
+
+ Setting up
+ your Network
+
+
+
+ Routed
+
+
+
+ Non-routed
+
+
+
+ SNAT
+
+
+
+ DNAT
+
+
+
+ Proxy
+ ARP
+
+
+
+ One-to-one
+ NAT
+
+
+
+
+
+ Rules
+
+
+
+ Odds and
+ Ends
+
+
+
+
+
+ DNS
+
+
+
+ Starting
+ and Stopping the Firewall
+
+
+
+
+
+ SMB
+
+
+
+ Squid with
+ Shorewall
+
+
+
+ Starting/stopping the
+ Firewall
+
+ Description of all /sbin/shorewall commands
+
+
+
+ How to safely test a Shorewall configuration change
+
+
+
+
+
+ Static (one-to-one) NAT
+
+
+
+ Support
+
+
+
+ Traffic Accounting
+
+
+
+ Traffic
+ Shaping/QOS
+
+
+
+ Troubleshooting (Things to
+ try if it doesn't work)
+
+
+
+ UPnP
+
+
+
+ Upgrade Issues
+
+
+
+ VPN
+
+
+
+ 6to4
- Port
- Ranges
+ Basics
- Using
- Shell Variables
+ GRE and IPIP
- Using
- DNS Names
+ IPSEC
- Complementing an IP
- address or Subnet
+ IPSEC/PPTP passthrough from a system
+ behind your firewall to a remote network
- IP
- Address Ranges
+ OpenVPN (My personal
+ choice)
- Shorewall
- Configurations (making a test configuration)
+ Other VPN
+ types
- Using MAC
- Addresses in Shorewall
+ PPTP
-
-
-
+
+
- The remainder of the Documentation supplements the QuickStart Guides.
- Please review the appropriate guide before trying to use this documentation
- directly.
+
+ White List
+ Creation
+
-
- This index is in alphabetical
- order.
-
+
+ Xen
-
-
- 2.6 Kernel
-
-
-
- Accounting
-
-
-
- Actions
-
-
-
- Aliased
- (virtual) Interfaces (e.g., eth0:0)
-
-
-
- Bandwidth Control
-
-
-
- Blacklisting
-
-
-
- Static Blacklisting using /etc/shorewall/blacklist
-
-
-
- Dynamic Blacklisting using /sbin/shorewall
-
-
-
-
-
- Bridging
-
-
-
- Bridge/Firewall (control traffic
- through the bridge)
-
-
-
- Simple Bridge (don't need to
- control traffic through the bridge)
-
-
-
-
-
- Commands
- (Description of all /sbin/shorewall commands)
-
-
-
- Compiled Firewall
- Programs (Shorewall 3.1 and later)
-
-
-
- Configuration File Reference Manual
-
+
- accounting
+ Xen the way that I use
+ it
- actions and
- action.template
+ Tight Firewall in Xen
+ Dom0
-
-
- blacklist
-
-
-
- hosts
-
-
-
- interfaces
-
-
-
- ipsec
-
-
-
- maclist
-
-
-
- macros and
- macro.template
-
-
-
- masq
-
-
-
- modules
-
-
-
- nat
-
-
-
- netmap
-
-
-
- params
-
-
-
- policy
-
-
-
- providers
-
-
-
- proxyarp
-
-
-
- rfc1918
-
-
-
- routestopped
-
-
-
- rules
-
-
-
- shorewall.conf
-
-
-
- tcclasses
-
-
-
- tcdevices
-
-
-
- tcrules
-
-
-
- tos
-
-
-
- tunnels
-
-
-
- usersets and users
-
-
-
- zones
-
-
-
-
-
- Corporate Network Example
- (Contributed by a Graeme Boyle)
-
-
-
- DHCP
-
-
-
- ECN Disabling by host or
- subnet
-
-
-
- Error Messages
-
-
-
- Extension
- Scripts (How to extend Shorewall without modifying Shorewall
- code through the use of files in /etc/shorewall -- /etc/shorewall/start,
- /etc/shorewall/stopped, etc.)
-
-
-
- Fallback/Uninstall
-
-
-
- FAQs
-
-
-
- Features
-
-
-
- Forwarding Traffic on the Same
- Interface
-
-
-
- FTP and Shorewall
-
-
-
- Getting help or answers to
- questions
-
-
-
- Installation/Upgrade
-
-
-
- IPP2P
-
-
-
- IPSEC
-
-
-
- IPSEC using Kernel 2.6 and Shorewall
- 2.1 or Later.
-
-
-
- Ipsets
-
-
-
- Kazaa
- Filtering
-
-
-
- Kernel Configuration
-
-
-
- Logging
-
-
-
- Macros
-
-
-
- MAC Verification
-
-
-
- Multiple Internet Connections from a
- Single Firewall
-
-
-
- Multiple Zones Through One
- Interface
-
-
-
- My Shorewall Configuration (How
- I personally use Shorewall)
-
-
-
- Netfilter
- Overview
-
-
-
- Network Mapping
-
-
-
- One-to-one NAT (Static NAT)
-
-
-
- OpenVPN
-
-
-
- Operating
- Shorewall
-
-
-
- Packet Processing in a
- Shorewall-based Firewall
-
-
-
- 'Ping' Management
-
-
-
- Port Information
-
-
-
- Which applications use which ports
-
-
-
- Ports used by Trojans
-
-
-
-
-
- Port Knocking and Other Uses of the
- 'Recent Match'
-
-
-
- PPTP
-
-
-
- Proxy ARP
-
-
-
- Release Model
-
-
-
- Requirements
-
-
-
- Routing and
- Shorewall
-
-
-
- Routing on One
- Interface
-
-
-
- Samba
-
-
-
- Shorewall
- Lite
-
-
-
- Shorewall Setup
- Guide
-
- Introduction
-
-
-
- Shorewall
- Concepts
-
-
-
- Network
- Interfaces
-
-
-
- Addressing, Subnets and
- Routing
-
-
-
- IP
- Addresses
-
-
-
- Subnets
-
-
-
- Routing
-
-
-
- Address
- Resolution Protocol (ARP)
-
-
-
- RFC
- 1918
-
-
-
-
-
- Setting up
- your Network
-
-
-
- Routed
-
-
-
- Non-routed
-
-
-
- SNAT
-
-
-
- DNAT
-
-
-
- Proxy
- ARP
-
-
-
- One-to-one
- NAT
-
-
-
-
-
- Rules
-
-
-
- Odds
- and Ends
-
-
-
-
-
- DNS
-
-
-
- Starting
- and Stopping the Firewall
-
-
-
-
-
- SMB
-
-
-
- Squid with
- Shorewall
-
-
-
- Starting/stopping
- the Firewall
-
- Description of all /sbin/shorewall commands
-
-
-
- How to safely test a Shorewall configuration change
-
-
-
-
-
- Static (one-to-one) NAT
-
-
-
- Support
-
-
-
- Traffic Accounting
-
-
-
- Traffic
- Shaping/QOS
-
-
-
- Troubleshooting (Things to
- try if it doesn't work)
-
-
-
- UPnP
-
-
-
- Upgrade Issues
-
-
-
- VPN
-
-
-
- 6to4
-
-
-
- Basics
-
-
-
- GRE and IPIP
-
-
-
- IPSEC
-
-
-
- IPSEC/PPTP passthrough from a system
- behind your firewall to a remote network
-
-
-
- OpenVPN (My personal
- choice)
-
-
-
- Other VPN
- types
-
-
-
- PPTP
-
-
-
-
-
- White List
- Creation
-
-
-
- Xen
-
-
-
- Xen the way that I use
- it
-
-
-
- Tight Firewall in Xen
- Dom0
-
-
-
-
+
+
+
+
\ No newline at end of file
diff --git a/docs/starting_and_stopping_shorewall.xml b/docs/starting_and_stopping_shorewall.xml
index 744004229..419f8cbb5 100644
--- a/docs/starting_and_stopping_shorewall.xml
+++ b/docs/starting_and_stopping_shorewall.xml
@@ -1441,4 +1441,4 @@ gateway:~ #
on the command.
-
+
\ No newline at end of file