diff --git a/Shorewall-docs2/whitelisting_under_shorewall.xml b/Shorewall-docs2/whitelisting_under_shorewall.xml
index cf39efabf..5de15a397 100644
--- a/Shorewall-docs2/whitelisting_under_shorewall.xml
+++ b/Shorewall-docs2/whitelisting_under_shorewall.xml
@@ -12,7 +12,7 @@
Eastep
- 2005-09-02
+ 2005-09-03
2002-2005
@@ -74,53 +74,12 @@
Zone File
-
-
-
-
- ZONE
-
- DISPLAY
-
- COMMENTS
-
-
-
-
-
- net
-
- Net
-
- Internet
-
-
-
- ops
-
- Operations
-
- Operations Staff's Class C
-
-
-
- loc
-
- Local
-
- Local Class B
-
-
-
- dmz
-
- DMZ
-
- Demilitarized zone
-
-
-
-
+ #ZONE TYPE OPTIONS
+fw firewall
+net plain
+ops plain
+loc plain
+dmz plain
The ops zone has been added to the standard 3-zone
zones file -- since ops is a sub-zone of
@@ -131,53 +90,10 @@
Interfaces File
-
-
-
-
- ZONE
-
- INTERFACE
-
- BROADCAST
-
- OPTIONS
-
-
-
-
-
- net
-
- eth0
-
- <whatever>
-
- <options>
-
-
-
- dmz
-
- eth1
-
- <whatever>
-
-
-
-
-
- -
-
- eth2
-
- 10.10.255.255
-
-
-
-
-
-
+ #ZONE INTERFACE BROACAST OPTIONS
+net eth0 <whatever> ...
+dmz eth1 <whatever> ...
+- eth2 10.10.255.255
Because eth2 interfaces to two zones
(ops and loc), we don't specify a zone
@@ -187,37 +103,9 @@
Hosts File
-
-
-
-
- ZONE
-
- HOST(S)
-
- OPTIONS
-
-
-
-
-
- ops
-
- eth2:10.10.10.0/24
-
-
-
-
-
- loc
-
- eth2:0.0.0.0/0
-
-
-
-
-
-
+ #ZONE HOST(S) OPTIONS
+ops eth2:10.10.10.0/24
+loc eth2:0.0.0.0/0
Here we define the ops and loc
zones. When Shorewall is stopped, only the hosts in the
@@ -232,93 +120,12 @@
Policy File
-
-
-
-
- SOURCE
-
- DEST
-
- POLICY
-
- LOG LEVEL
-
- LIMIT BURST
-
-
-
-
-
- ops
-
- all
-
-
- ACCEPT
-
-
-
-
-
-
-
-
- all
-
-
- ops
-
-
-
- CONTINUE
-
-
-
-
-
-
-
- loc
-
- net
-
- ACCEPT
-
-
-
-
-
-
-
- net
-
- all
-
- DROP
-
- info
-
-
-
-
-
- all
-
- all
-
- REJECT
-
- info
-
-
-
-
-
-
+ #SOURCE DEST POLICY LOG LEVEL
+ops all ACCEPT
+all ops CONTINUE
+loc net ACCEPT
+net all DROP info
+all all REJECT info
Two entries for ops (in bold) have been added to
the standard 3-zone policy file.
@@ -327,61 +134,8 @@
Rules File
-
-
-
-
- ACTION
-
- SOURCE
-
- DEST
-
- PROTO
-
- DEST PORT(S)
-
- SOURCE PORT(S)
-
- ORIGINAL DEST
-
-
-
-
-
- REDIRECT
-
- loc!ops
-
- 3128
-
- tcp
-
- http
-
-
-
-
-
-
-
- ...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ #ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE PORTS(S) ORIGINAL DEST
+REDIRECT loc!ops 3128 tcp http
This is the rule that transparently redirects web traffic to the
transparent proxy running on the firewall. The Routestopped File
-
-
-
-
- INTERFACE
-
- HOST(S))
-
-
-
-
-
- eth1
-
-
-
-
-
- eth2
-
- 10.10.10.0/24
-
-
-
-
+ #INTERFACE HOST(S) OPTIONS
+eth1
+eth2 10.10.10.0/24
\ No newline at end of file