-+ - - - +-
++ Man - Pages + -+ Two-interface Linux System + acting as a firewall/router for a small local network (Version Française ) (Russian Version )- Using MAC - Addresses in Shorewall + + -+ Three-interface Linux + System acting as a firewall/router for a small local network and a DMZ.. + (Version Française ) (Russian Version )-
++ Comments in - configuration files - If you have more than one public IP + address: - Using - Shell Variables + -+ +The +Shorewall Setup + Guide (Version + Française ) outlines the steps necessary to set up a firewall + where there are multiple public IP addresses involved or if you want to + learn more about Shorewall than is explained in the single-address + guides above.-
++ Attach - Comment to Netfilter Rules The following articles are also recommended reading for + newcomers. -- Using DNS - Names + - ++ +- Configuration File + Basics +- + + + -+
+- Man + Pages -
-+ Line - Continuation + Using MAC + Addresses in Shorewall - Complementing - an IP address or Subnet +
+- Comments in + configuration files -
-+ INCLUDE - Directive + Using Shell + Variables - IP Address - Ranges +
+- Attach Comment + to Netfilter Rules -
-+ Port - Numbers/Service Names + Using DNS + Names - Shorewall - Configurations (making a test - configuration) +
- -- Line + Continuation -
-+ Port - Ranges + Complementing + an IP address or Subnet - +
- INCLUDE + Directive - -PPPPPPPS ( or, Paul's Principles for Practical Provision of - Packet Processing with Shorewall ) -http://linuxman.wikispaces.com/PPPPPPS + + + IP Address + Ranges +
+ ++ + Port + Numbers/Service Names + Shorewall + Configurations (making a test + configuration) +
+ ++ + Port + Ranges +
Shorewall, is high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and - with the help of the iptables utility, Shorewall configures Netfilter to - match your requirements. Shorewall can be used on a dedicated firewall - system, a multi-function gateway/router/server or on a standalone - GNU/Linux system. Shorewall does not use Netfilter's ipchains - compatibility mode and can thus take advantage of Netfilter's connection - state tracking capabilities. + with the help of the iptables and iptables-restore utilities, Shorewall + configures Netfilter to match your requirements. Shorewall can be used + on a dedicated firewall system, a multi-function gateway/router/server + or on a standalone GNU/Linux system. Shorewall does not use Netfilter's + ipchains compatibility mode and can thus take advantage of Netfilter's + connection state tracking capabilities.
Shorewall @@ -340,7 +347,8 @@ ACCEPT net $FW tcp 22 to Shorewall-shell written in the Perl language. This compiler is highly portable to those Unix-like platforms that support Perl (including Cygwin) and is the compiler of choice for new Shorewall - installations.
++ +- accounting - Define + IP accounting rules.+ actions - - Declare user-defined actions.- actions - + Declare user-defined actions.+ blacklist - - Static blacklisting.- blacklist - Static + blacklisting.+ ecn - Disabling - Explicit Congestion Notification- ecn - + Disabling Explicit Congestion Notification+ exclusion - - Excluding hosts from a network or zone- exclusion - Excluding + hosts from a network or zone+ hosts - - Define multiple zones accessed through a single interface- hosts - + Define multiple zones accessed through a single interface+ interfaces - Define the - interfaces on the system and optionally associate them with - zones.- interfaces - Define + the interfaces on the system and optionally associate them with + zones.+ maclist - - Define MAC verification.- maclist - + Define MAC verification.+ masq - Define - Masquerade/SNAT- masq - + Define Masquerade/SNAT+ modules - - Specify which kernel modules to load.- modules - + Specify which kernel modules to load.+ nat - Define - one-to-one NAT.- nat - Define + one-to-one NAT.+ nesting - - How to define nested zones.- nesting - + How to define nested zones.+ netmap - How - to map addresses from one net to another.- netmap - + How to map addresses from one net to another.+ params - - Assign values to shell variables used in other files.- params - + Assign values to shell variables used in other files.+ policy - - Define high-level policies for connections between zones.- policy - + Define high-level policies for connections between zones.+ providers - - Define routing tables, usually for mutliple internet links.- providers - Define + routing tables, usually for mutliple internet links.+ proxyarp - - Define Proxy ARP.- proxyarp + - Define Proxy ARP.+ rfc1918 - - Specify address ranges affected by the - interface option.- rfc1918 - + Specify address ranges affected by the + interface option.+ route_rules - Define - routing rules.- route_rules - Define + routing rules.+ routestopped - - Specify connections to be permitted when Shorewall is in the stopped - state.- routestopped - + Specify connections to be permitted when Shorewall is in the stopped + state.+ rules - - Specify exceptions to policies, including DNAT and REDIRECT.- rules - + Specify exceptions to policies, including DNAT and REDIRECT.+ tcclasses - - Define htb classes for traffic shaping.- tcclasses - Define htb + classes for traffic shaping.+ tcdevices - - Specify speed of devices for traffic shaping.- tcdevices - Specify + speed of devices for traffic shaping.+ tcrules - - Define packet marking rules, usually for traffic shaping.- tcrules - + Define packet marking rules, usually for traffic shaping.+ tos - Define - TOS field manipulation.- tos - Define + TOS field manipulation.+ tunnels - - Define VPN connections with endpoints on the firewall.- tunnels - + Define VPN connections with endpoints on the firewall.+ shorewall.conf - - Specify values for global Shorewall options.- shorewall.conf - Specify + values for global Shorewall options.+ shorewall-lite.conf - - Specify values for global Shorewall Lite options.- shorewall-lite.conf - + Specify values for global Shorewall Lite options.+ vardir - - Redefine the directory where Shorewall keeps its state - information.- vardir - + Redefine the directory where Shorewall keeps its state + information.+ vardir-lite - Redefine - the directory where Shorewall Lite keeps its state information.- vardir-lite - + Redefine the directory where Shorewall Lite keeps its state + information.- zones - - Declare Shorewall zones.l+ zones - + Declare Shorewall zones.
++ +- shorewall - + /sbin/shorewall command syntax and semantics.- shorewall-lite - - /sbin/shorewall-lite command syntax and semantics.+ shorewall-lite - + /sbin/shorewall-lite command syntax and semantics.
2007-07-13
+
2007-08-01