extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-24 19:51:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Formatting changes in the config file basics doc

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2757 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-09-30 14:15:51 +00:00
parent 9b293f5ed6
commit 9c956521d8
1 changed files with 45 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
Shorewall-docs2/configuration_file_basics.xml
View File

@ -551,9 +551,9 @@ DNAT net loc:192.168.1.3 tcp 4000:4100</programlisting>
to distinguish them from variables used internally within the Shorewall to distinguish them from variables used internally within the Shorewall
programs</para> programs</para>
<example> <para>Example:</para>
<title>Using Shell Variables</title>
<blockquote>
<programlisting>&nbsp;&nbsp;&nbsp; /etc/shorewall/params <programlisting>&nbsp;&nbsp;&nbsp; /etc/shorewall/params
NET_IF=eth0 NET_IF=eth0
@ -568,51 +568,51 @@ DNAT net loc:192.168.1.3 tcp 4000:4100</programlisting>
net eth0 130.252.100.255 routefilter,norfc1918 net eth0 130.252.100.255 routefilter,norfc1918
</programlisting> </programlisting>
</blockquote>
<para>Variables may be used anywhere in the other configuration <para>Variables may be used anywhere in the other configuration
files.</para> files.</para>
<para>Because the <filename>/etc/shorewall/params</filename> file is <para>Because the <filename>/etc/shorewall/params</filename> file is
simply sourced into the shell, you can place arbitrary shell code in the simply sourced into the shell, you can place arbitrary shell code in the
file and it will be executed each time that the file is read. Any code file and it will be executed each time that the file is read. Any code
included should follow these guidelines:</para> included should follow these guidelines:</para>
<orderedlist> <orderedlist>
<listitem> <listitem>
<para>The code should not have side effects, especially on other <para>The code should not have side effects, especially on other
shorewall configuration files.</para> shorewall configuration files.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>The code should be safe to execute multiple times without <para>The code should be safe to execute multiple times without
producing different results.</para> producing different results.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>Should not depend on where the code is called from (the params <para>Should not depend on where the code is called from (the params
file is sourced by both /sbin/shorewall and file is sourced by both /sbin/shorewall and
/usr/lib/shorewall/firewall).</para> /usr/lib/shorewall/firewall).</para>
</listitem> </listitem>
<listitem> <listitem>
<para>Should not assume anything about the state of <para>Should not assume anything about the state of Shorewall.</para>
Shorewall.</para> </listitem>
</listitem>
<listitem> <listitem>
<para>The names of any functions or variables declared should begin <para>The names of any functions or variables declared should begin
with an upper case letter.</para> with an upper case letter.</para>
</listitem> </listitem>
</orderedlist> </orderedlist>
<para>One possible use of this feature is to compensate for recent Linux <para>One possible use of this feature is to compensate for recent Linux
behavior in which the identity of network interfaces varies from boot to behavior in which the identity of network interfaces varies from boot to
boot (what is <filename class="devicefile">eth0</filename> after one boot (what is <filename class="devicefile">eth0</filename> after one boot
boot may be <filename class="devicefile">eth1</filename> after the may be <filename class="devicefile">eth1</filename> after the next).
next). <trademark>SuSE</trademark> users, for example, can take the <trademark>SuSE</trademark> users, for example, can take the following
following approach:</para> approach:</para>
<programlisting>wookie:~ # lspci <programlisting>wookie:~ # lspci
0000:00:00.0 Host bridge: VIA Technologies, Inc. VT82C598 [Apollo MVP3] (rev 04) 0000:00:00.0 Host bridge: VIA Technologies, Inc. VT82C598 [Apollo MVP3] (rev 04)
0000:00:01.0 PCI bridge: VIA Technologies, Inc. VT82C598/694x [Apollo MVP3/Pro133x AGP] 0000:00:01.0 PCI bridge: VIA Technologies, Inc. VT82C598/694x [Apollo MVP3/Pro133x AGP]
0000:00:03.0 Ethernet controller: Intel Corporation 82557/8/9 [Ethernet Pro 100] (rev 01) 0000:00:03.0 Ethernet controller: Intel Corporation 82557/8/9 [Ethernet Pro 100] (rev 01)
@ -625,15 +625,14 @@ DNAT net loc:192.168.1.3 tcp 4000:4100</programlisting>
0000:01:00.0 VGA compatible controller: ATI Technologies Inc 3D Rage LT Pro AGP-133 (rev dc) 0000:01:00.0 VGA compatible controller: ATI Technologies Inc 3D Rage LT Pro AGP-133 (rev dc)
wookie:~ #</programlisting> wookie:~ #</programlisting>
<para>If the firewall's external interface is the DECchip controllor at <para>If the firewall's external interface is the DECchip controllor at
0000:00:05.0 and the internal interface is the Ethernet Pro 100 at 0000:00:05.0 and the internal interface is the Ethernet Pro 100 at
0000:00:03.0, then the following entries in 0000:00:03.0, then the following entries in
<filename>/etc/shorewall/params</filename> will set EXT_IF and INT_IF to <filename>/etc/shorewall/params</filename> will set EXT_IF and INT_IF to
the names of these two controllers respectively:</para> the names of these two controllers respectively:</para>
<programlisting>EXT_IF=$(getcfg-interface bus-pci-0000:00:05.0) <programlisting>EXT_IF=$(getcfg-interface bus-pci-0000:00:05.0)
INT_IF=$(getcfg-interface bus-pci-0000:00:03.0)</programlisting> INT_IF=$(getcfg-interface bus-pci-0000:00:03.0)</programlisting>
</example>
<caution> <caution>
<para>The <command>shorewall save</command> and <command>shorewall <para>The <command>shorewall save</command> and <command>shorewall
@ -641,7 +640,7 @@ INT_IF=$(getcfg-interface bus-pci-0000:00:03.0)</programlisting>
workaround for unstable interface names. In particular, you should set workaround for unstable interface names. In particular, you should set
OPTIONS="" in <filename>/etc/default/shorewall</filename> or OPTIONS="" in <filename>/etc/default/shorewall</filename> or
<filename>/etc/sysconfig/shorewall</filename> so that the "-f" option <filename>/etc/sysconfig/shorewall</filename> so that the "-f" option
will not be specified on startup at boot time. </para> will not be specified on startup at boot time.</para>
</caution> </caution>
</section> </section>