From 97b3dd244adb6157ca626d7ff436b0fc91abf0b3 Mon Sep 17 00:00:00 2001 From: Tuomo Soini Date: Mon, 15 Feb 2016 14:31:00 +0200 Subject: [PATCH] Macros: update headers Signed-off-by: Tuomo Soini --- docs/Macros.xml | 128 +++++++++++++++++++++++++----------------------- 1 file changed, 67 insertions(+), 61 deletions(-) diff --git a/docs/Macros.xml b/docs/Macros.xml index 852cc0aa7..ce88c055e 100644 --- a/docs/Macros.xml +++ b/docs/Macros.xml @@ -78,19 +78,20 @@ macro. # -# Shorewall 3.0 /usr/share/shorewall/macro.SMB +# Shorewall -- /usr/share/shorewall/macro.SMB # -# Handle Microsoft SMB traffic. You need to invoke this macro in -# both directions. +# This macro handles Microsoft SMB traffic. You need to invoke +# this macro in both directions. Beware! This rule opens a lot +# of ports, and could possibly be used to compromise your firewall +# if not used with care. You should only allow SMB traffic +# between hosts you fully trust. # ###################################################################################### -#TARGET SOURCE DEST PROTO DEST SOURCE RATE USER/ -# PORT PORT(S) LIMIT GROUP -PARAM - - udp 135,445 -PARAM - - udp 137:139 -PARAM - - udp 1024: 137 -PARAM - - tcp 135,139,445 -#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE +#TARGET SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER +PARAM - - udp 135,445 +PARAM - - udp 137:139 +PARAM - - udp 1024: 137 +PARAM - - tcp 135,139,445 If you wish to modify one of the standard macros, do not modify the definition in /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST PORT(S) -SMB(ACCEPT) loc fw + #ACTION SOURCE DEST PROTO DPORT + +SMB(ACCEPT) loc $FW The above is equivalent to coding the following series of rules: - #TARGET SOURCE DEST PROTO DEST PORT(s) -ACCEPT loc fw udp 135,445 -ACCEPT loc fw udp 137:139 -ACCEPT loc fw udp 1024: 137 -ACCEPT loc fw tcp 135,139,445 + #ACTION SOURCE DEST PROTO DPORT SPORT + +ACCEPT loc $FW udp 135,445 +ACCEPT loc $FW udp 137:139 +ACCEPT loc $FW udp 1024: 137 +ACCEPT loc $FW tcp 135,139,445 Logging is covered in a following @@ -154,24 +157,24 @@ ACCEPT loc fw tcp 135,139,445
/etc/shorewall/macro.SMTP - #TARGET SOURCE DEST PROTO DEST PORT(S) -PARAM - loc tcp 25 + #ACTION SOURCE DEST PROTO DPORT +PARAM - loc tcp 25 /etc/shorewall/rules (Shorewall 4.0): - #ACTION SOURCE DEST PROTO DEST PORT(S) -SMTP(DNAT):info net 192.168.1.5 + #ACTION SOURCE DEST PROTO DPORT +SMTP(DNAT):info net 192.168.1.5 /etc/shorewall/rules (Shorewall 4.2.0 and later): - #ACTION SOURCE DEST PROTO DEST PORT(S) -SMTP(DNAT):info net 192.168.1.5 + #ACTION SOURCE DEST PROTO DPORT +SMTP(DNAT):info net 192.168.1.5 This would be equivalent to coding the following directly in /etc/shorewall/rules - #ACTION SOURCE DEST PROTO DEST PORT(S) -DNAT:info net loc:192.168.1.5 tcp 25 + #ACTION SOURCE DEST PROTO DPORT +DNAT:info net loc:192.168.1.5 tcp 25
Example 2: @@ -179,19 +182,20 @@ DNAT:info net loc:192.168.1.5 tcp 25
/etc/shorewall/macro.SMTP - #TARGET SOURCE DEST PROTO DEST PORT(S) -PARAM - 192.168.1.5 tcp 25 + +#ACTION SOURCE DEST PROTO DPORT +PARAM - 192.168.1.5 tcp 25 /etc/shorewall/rules - #ACTION SOURCE DEST PROTO DEST PORT(S) -SMTP(DNAT):info net loc + #ACTION SOURCE DEST PROTO DPORT +SMTP(DNAT):info net loc This would be equivalent to coding the following directly in /etc/shorewall/rules - #ACTION SOURCE DEST PROTO DEST PORT(S) -DNAT:info net loc:192.168.1.5 tcp 25 + #ACTION SOURCE DEST PROTO DPORT +DNAT:info net loc:192.168.1.5 tcp 25
You may also specify SOURCE or DEST in the SOURCE and DEST @@ -205,8 +209,7 @@ DNAT:info net loc:192.168.1.5 tcp 25 is already a standard macro like this released as part of Shorewall): - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ -# PORT PORT(S) DEST LIMIT GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER PARAM - - udp 135,445 PARAM - - udp 137:139 PARAM - - udp 1024: 137 @@ -214,26 +217,28 @@ PARAM - - tcp 135,139,445 PARAM DEST SOURCE udp 135,445 PARAM DEST SOURCE udp 137:139 PARAM DEST SOURCE udp 1024: 137 -PARAM DEST SOURCE tcp 135,139,445 -#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE +PARAM DEST SOURCE tcp 135,139,445 /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST PORT(S) -SMBBI(ACCEPT) loc fw + #ACTION SOURCE DEST PROTO DPORT + +SMBBI(ACCEPT) loc $FW This would be equivalent to coding the following directly in /etc/shorewall/rules - #ACTION SOURCE DEST PROTO DEST PORT(S) -ACCEPT loc fw udp 135,445 -ACCEPT loc fw udp 137:139 -ACCEPT loc fw udp 1024: 137 -ACCEPT loc fw tcp 135,139,445 -ACCEPT fw loc udp 135,445 -ACCEPT fw loc udp 137:139 -ACCEPT fw loc udp 1024: 137 -ACCEPT fw loc tcp 135,139,445 + #ACTION SOURCE DEST PROTO DPORT SPORT + +ACCEPT loc $FW udp 135,445 +ACCEPT loc $FW udp 137:139 +ACCEPT loc $FW udp 1024: 137 +ACCEPT loc $FW tcp 135,139,445 + +ACCEPT $FW loc udp 135,445 +ACCEPT $FW loc udp 137:139 +ACCEPT $FW loc udp 1024: 137 +ACCEPT $FW loc tcp 135,139,445 @@ -696,7 +701,7 @@ ACCEPT fw loc tcp 135,139,445 Omitted column entries should be entered using a dash - ("-:). + ("-"). Example: @@ -706,8 +711,9 @@ ACCEPT fw loc tcp 135,139,445 To use your macro, in /etc/shorewall/rules you might do something like: - #ACTION SOURCE DEST PROTO DEST PORT(S) -LogAndAccept loc $FW tcp 22 + #ACTION SOURCE DEST PROTO DPORT + +LogAndAccept loc $FW tcp 22 @@ -731,20 +737,20 @@ LogAndAccept loc $FW tcp 22 /etc/shorewall/macro.foo - #ACTION SOURCE DEST PROTO DEST PORT(S) -ACCEPT - - tcp 22 + #ACTION SOURCE DEST PROTO DPORT +ACCEPT - - tcp 22 bar:info /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST PORT(S) -foo:debug $FW net + #ACTION SOURCE DEST PROTO DPORT +foo:debug $FW net Logging in the invoked 'foo' macro will be as if foo had been defined as: - #ACTION SOURCE DEST PROTO DEST PORT(S) -ACCEPT:debug - - tcp 22 + #ACTION SOURCE DEST PROTO DPORT +ACCEPT:debug - - tcp 22 bar:info @@ -756,20 +762,20 @@ bar:info /etc/shorewall/macro.foo - #ACTION SOURCE DEST PROTO DEST PORT(S) -ACCEPT - - tcp 22 + #ACTION SOURCE DEST PROTO DPORT +ACCEPT - - tcp 22 bar:info /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST PORT(S) -foo:debug! $FW net + #ACTION SOURCE DEST PROTO DPORT +foo:debug! $FW net Logging in the invoked 'foo' macro will be as if foo had been defined as: - #ACTION SOURCE DEST PROTO DEST PORT(S) -ACCEPT:debug - - tcp 22 + #ACTION SOURCE DEST PROTO DPORT +ACCEPT:debug - - tcp 22 bar:debug