mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-08 08:44:05 +01:00
Almost finished with man pages
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4894 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
091b26acee
commit
6fae8edd28
65
manpages/shorewall-params.xml
Normal file
65
manpages/shorewall-params.xml
Normal file
@ -0,0 +1,65 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<refentry>
|
||||
<refmeta>
|
||||
<refentrytitle>shorewall-params</refentrytitle>
|
||||
|
||||
<manvolnum>5</manvolnum>
|
||||
</refmeta>
|
||||
|
||||
<refnamediv>
|
||||
<refname>params</refname>
|
||||
|
||||
<refpurpose>Shorewall parameters file</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis>
|
||||
<command>/etc/shorewall/params</command>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsect1>
|
||||
<title>Description</title>
|
||||
|
||||
<para>Assign any shell variables that you need in this file.</para>
|
||||
|
||||
<para> It is suggested that variable names begin with an upper case letter
|
||||
to distinguish them from variables used internally within the Shorewall
|
||||
programs</para>
|
||||
|
||||
<para>Example params file:</para>
|
||||
|
||||
<programlisting>NET_IF=eth0
|
||||
NET_BCAST=130.252.100.255
|
||||
NET_OPTIONS=routefilter,norfc1918</programlisting>
|
||||
|
||||
<para>Example shorewall-interfaces(5) file.</para>
|
||||
|
||||
<programlisting>ZONE INTERFACE BROADCAST OPTIONS
|
||||
net $NET_IF $NET_BCAST $NET_OPTIONS</programlisting>
|
||||
|
||||
<para>This is the same as if the interfaces file had contained:</para>
|
||||
|
||||
<programlisting>ZONE INTERFACE BROADCAST OPTIONS
|
||||
net eth0 130.252.100.255 routefilter,norfc1918</programlisting>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>FILES</title>
|
||||
|
||||
<para>/etc/shorewall/params</para>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>See ALSO</title>
|
||||
|
||||
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
|
||||
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
|
||||
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||||
shorewall-nat(5), shorewall-netmap(5), shorewall-policy(5),
|
||||
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_routes(5),
|
||||
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
|
||||
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
|
||||
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
|
||||
</refsect1>
|
||||
</refentry>
|
||||
128
manpages/shorewall-proxyarp.xml
Normal file
128
manpages/shorewall-proxyarp.xml
Normal file
@ -0,0 +1,128 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<refentry>
|
||||
<refmeta>
|
||||
<refentrytitle>shorewall-proxyarp</refentrytitle>
|
||||
|
||||
<manvolnum>5</manvolnum>
|
||||
</refmeta>
|
||||
|
||||
<refnamediv>
|
||||
<refname>proxyarp</refname>
|
||||
|
||||
<refpurpose>Shorewall Proxy ARP file</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis>
|
||||
<command>/etc/shorewall/proxyarp</command>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsect1>
|
||||
<title>Description</title>
|
||||
|
||||
<para>This file is used to define Proxy ARP.</para>
|
||||
|
||||
<para>The columns in the file are as follows.</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">ADDRESS</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>IP Address.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">INTERFACE</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>Local interface where system is connected.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">EXTERNAL</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>External Interface to be used to access this system.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">HAVEROUTE</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>If there is already a route from the firewall to the host
|
||||
whose address is given, enter <emphasis role="bold">Yes</emphasis>
|
||||
or <emphasis role="bold">yes</emphasis> in this column. Otherwise,
|
||||
enter <emphasis role="bold">no</emphasis> or <emphasis
|
||||
role="bold">No</emphasis> or leave the column empty and Shorewall
|
||||
will add the route for you. If Shorewall adds the route,the route
|
||||
will be persistent if the <emphasis
|
||||
role="bold">PERSISTENT</emphasis> column contains <emphasis
|
||||
role="bold">Yes</emphasis>; otherwise, <emphasis
|
||||
role="bold">shorewall stop</emphasis> or <emphasis
|
||||
role="bold">shorewall clear</emphasis> will delete the route.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">PERSISTENT</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>If HAVEROUTE is <emphasis role="bold">No</emphasis> or
|
||||
<emphasis role="bold">no</emphasis>, then the value of this column
|
||||
determines if the route added by Shorewall persists after a
|
||||
<emphasis role="bold">shorewall stop</emphasis> or a <emphasis
|
||||
role="bold">shorewall clear</emphasis>. If this column contains
|
||||
<emphasis role="bold">Yes</emphasis> or <emphasis
|
||||
role="bold">yes</emphasis> then the route persists; If the column is
|
||||
empty or contains <emphasis role="bold">No</emphasis> or <emphasis
|
||||
role="bold">no</emphasis> then the route is deleted at
|
||||
<command>shorewall stop</command> or <command>shorewall
|
||||
clear</command>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>Example</title>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>Example 1:</term>
|
||||
|
||||
<listitem>
|
||||
<para> Host with IP 155.186.235.6 is connected to interface eth1 and
|
||||
we want hosts attached via eth0 to be able to access it using that
|
||||
address.</para>
|
||||
|
||||
<programlisting> #ADDRESS INTERFACE EXTERNAL
|
||||
155.186.235.6 eth1 eth0</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>FILES</title>
|
||||
|
||||
<para>/etc/shorewall/proxyarp</para>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>See ALSO</title>
|
||||
|
||||
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
|
||||
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
|
||||
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||||
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
|
||||
shorewall-policy(5), shorewall-providers(5), shorewall-route_routes(5),
|
||||
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
|
||||
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
|
||||
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
|
||||
</refsect1>
|
||||
</refentry>
|
||||
165
manpages/shorewall-route_rules.xml
Normal file
165
manpages/shorewall-route_rules.xml
Normal file
@ -0,0 +1,165 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<refentry>
|
||||
<refmeta>
|
||||
<refentrytitle>shorewall-route_rules</refentrytitle>
|
||||
|
||||
<manvolnum>5</manvolnum>
|
||||
</refmeta>
|
||||
|
||||
<refnamediv>
|
||||
<refname>route_rules</refname>
|
||||
|
||||
<refpurpose>Shorewall Routing Rules file</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis>
|
||||
<command>/etc/shorewall/route_rules</command>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsect1>
|
||||
<title>Description</title>
|
||||
|
||||
<para> Entries in this file cause traffic to be routed to one of the
|
||||
providers listed in shorewall-providers(5).</para>
|
||||
|
||||
<para>The columns in the file are as follows.</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">SOURCE</emphasis> (Optional)</term>
|
||||
|
||||
<listitem>
|
||||
<para>An ip address (network or host) that matches the source IP
|
||||
address in a packet. May also be specified as an interface name
|
||||
optionally followed by ":" and an address. If the device <emphasis
|
||||
role="bold">lo</emphasis> is specified, the packet must originate
|
||||
from the firewall itself.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term> <emphasis role="bold">DEST</emphasis> (Optional)</term>
|
||||
|
||||
<listitem>
|
||||
<para>An ip address (network or host) that matches the destination
|
||||
IP address in a packet.</para>
|
||||
|
||||
<para>If you choose to omit either <emphasis
|
||||
role="bold">SOURCE</emphasis> or <emphasis
|
||||
role="bold">DEST</emphasis>, place "-" in that column. Note that you
|
||||
may not omit both <emphasis role="bold">SOURCE</emphasis> and
|
||||
<emphasis role="bold">DEST</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">PROVIDER</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>The provider to route the traffic through. May be expressed
|
||||
either as the provider name or the provider number. May also be
|
||||
<emphasis role="bold">main</emphasis> or 254 for the main routing
|
||||
table. This can be used in combination with VPN tunnels, see example
|
||||
2 below.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">PRIORITY</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para> The rule's priority which determines the order in which the
|
||||
rules are processed.</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>1000-1999</term>
|
||||
|
||||
<listitem>
|
||||
<para>Before Shorewall-generated 'MARK' rules</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>11000-11999</term>
|
||||
|
||||
<listitem>
|
||||
<para>After 'MARK' rules but before Shorewall-generated rules
|
||||
for ISP interfaces.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>26000-26999</term>
|
||||
|
||||
<listitem>
|
||||
<para>After ISP interface rules but before 'default'
|
||||
rule.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>Rules with equal priority are applied in the order in which
|
||||
they appear in the file.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>Examples</title>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>Example 1:</term>
|
||||
|
||||
<listitem>
|
||||
<para>You want all traffic coming in on eth1 to be routed to the
|
||||
ISP1 provider.</para>
|
||||
|
||||
<programlisting> #SOURCE DEST PROVIDER PRIORITY
|
||||
eth1 - ISP1 1000
|
||||
</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>Example 2:</term>
|
||||
|
||||
<listitem>
|
||||
<para>You use OpenVPN (routed setup /tunX) in combination with
|
||||
multiple providers. In this case you have to set up a rule to ensure
|
||||
that the OpenVPN traffic is routed back through the tunX
|
||||
interface(s) rather than through any of the providers. 10.8.0.0/24
|
||||
is the subnet choosen in your OpenVPN configuration (server 10.8.0.0
|
||||
255.255.255.0).</para>
|
||||
|
||||
<programlisting> #SOURCE DEST PROVIDER PRIORITY
|
||||
- 10.8.0.0/24 main 1000
|
||||
</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>FILES</title>
|
||||
|
||||
<para>/etc/shorewall/route_rules</para>
|
||||
</refsect1>
|
||||
|
||||
<refsect1>
|
||||
<title>See ALSO</title>
|
||||
|
||||
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
|
||||
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
|
||||
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||||
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
|
||||
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
|
||||
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
|
||||
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
|
||||
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
|
||||
</refsect1>
|
||||
</refentry>
|
||||
@ -54,7 +54,7 @@
|
||||
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||||
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
|
||||
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
|
||||
shorewall-route_routes(5), shorewall-routestopped(5), shorewall-rules(5),
|
||||
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
|
||||
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
|
||||
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
|
||||
shorewall-zones(5)</para>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user