Sort Sample .conf files

Samples/Universal/shorewall.conf

@@ -1,6 +1,6 @@
 ###############################################################################
 #
-#  Shorewall Version 4 -- /etc/shorewall/shorewall.conf
+#  Shorewall Version 4.4 -- /etc/shorewall/shorewall.conf
 #
 #  For information about the settings in this file, type "man shorewall.conf"
 #
@@ -18,15 +18,17 @@ STARTUP_ENABLED=Yes
 VERBOSITY=1
 
 ###############################################################################
-#			       L O G G I N G
+#		                L O G G I N G
 ###############################################################################
 
-LOGFILE=
+BLACKLIST_LOGLEVEL=
 
-STARTUP_LOG=/var/log/shorewall-init.log
+LOG_MARTIANS=Yes
 
 LOG_VERBOSITY=2
 
+LOGFILE=/var/log/messages
+
 LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
@@ -35,169 +37,163 @@ LOGLIMIT=
 
 LOGALLNEW=
 
-BLACKLIST_LOGLEVEL=
-
 MACLIST_LOG_LEVEL=info
 
-TCP_FLAGS_LOG_LEVEL=info
+SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
-LOG_MARTIANS=Yes
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
 
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
+
 IPTABLES=
 
 IP=
 
-TC=
-
 IPSET=
 
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=restore
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-IP_FORWARDING=On
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
 
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
 
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=Yes
+
+DISABLE_IPV6=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=Yes
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=On
+
+KEEP_RT_TABLES=No
+
+LOAD_HELPERS_ONLY=Yes
+
+LEGACY_FASTSTART=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=15
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=Yes
+
+RESTORE_DEFAULT_ROUTE=Yes
+
 RETAIN_ALIASES=No
 
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
 TC_ENABLED=Internal
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-ROUTE_FILTER=No
-
-DETECT_DNAT_IPADDRS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-DISABLE_IPV6=No
-
-DYNAMIC_ZONES=No
-
-NULL_ROUTE_RFC1918=No
-
-MACLIST_TABLE=filter
-
-MACLIST_TTL=
-
-SAVE_IPSETS=No
-
-MAPOLDACTIONS=No
-
-FASTACCEPT=Yes
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-USE_ACTIONS=Yes
-
-OPTIMIZE=15
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=No
-
-DELETE_THEN_ADD=Yes
-
-MULTICAST=No
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
 
 USE_DEFAULT_RT=No
 
-RESTORE_DEFAULT_ROUTE=Yes
-
-AUTOMAKE=No
-
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=Yes
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=Yes
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
@@ -206,10 +202,12 @@ BLACKLIST_DISPOSITION=DROP
 
 MACLIST_DISPOSITION=REJECT
 
-TCP_FLAGS_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
 ################################################################################
 #                            L E G A C Y  O P T I O N
 #                      D O  N O T  D E L E T E  O R  A L T E R

Samples/one-interface/shorewall.conf

@@ -29,15 +29,17 @@ STARTUP_ENABLED=No
 VERBOSITY=1
 
 ###############################################################################
-#			       L O G G I N G
+#		                L O G G I N G
 ###############################################################################
 
-LOGFILE=/var/log/messages
+BLACKLIST_LOGLEVEL=
 
-STARTUP_LOG=/var/log/shorewall-init.log
+LOG_MARTIANS=Yes
 
 LOG_VERBOSITY=2
 
+LOGFILE=/var/log/messages
+
 LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
@@ -46,167 +48,163 @@ LOGLIMIT=
 
 LOGALLNEW=
 
-BLACKLIST_LOGLEVEL=
-
 MACLIST_LOG_LEVEL=info
 
-TCP_FLAGS_LOG_LEVEL=info
+SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
-LOG_MARTIANS=Yes
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
 
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
+
 IPTABLES=
 
 IP=
 
-TC=
-
 IPSET=
 
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=restore
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-IP_FORWARDING=Off
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
 
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
 
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DISABLE_IPV6=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=Off
+
+KEEP_RT_TABLES=No
+
+LOAD_HELPERS_ONLY=Yes
+
+LEGACY_FASTSTART=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
 RETAIN_ALIASES=No
 
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
 TC_ENABLED=Internal
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-ROUTE_FILTER=No
-
-DETECT_DNAT_IPADDRS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-DISABLE_IPV6=No
-
-DYNAMIC_ZONES=No
-
-NULL_ROUTE_RFC1918=No
-
-MACLIST_TABLE=filter
-
-MACLIST_TTL=
-
-SAVE_IPSETS=No
-
-MAPOLDACTIONS=No
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=No
-
-DELETE_THEN_ADD=Yes
-
-MULTICAST=No
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
 
 USE_DEFAULT_RT=No
 
-RESTORE_DEFAULT_ROUTE=Yes
-
-AUTOMAKE=No
-
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
@@ -215,10 +213,12 @@ BLACKLIST_DISPOSITION=DROP
 
 MACLIST_DISPOSITION=REJECT
 
-TCP_FLAGS_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
 ################################################################################
 #                            L E G A C Y  O P T I O N
 #                      D O  N O T  D E L E T E  O R  A L T E R

Samples/three-interfaces/shorewall.conf

@@ -3,6 +3,7 @@
 # Shorewall version 4.0 - Sample shorewall.conf for three-interface
 #                         configuration.
 # Copyright (C) 2006 by the Shorewall Team
+#               2011 by Thomas M. Eastep
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -17,9 +18,6 @@
 # http://shorewall.net/manpages/shorewall.conf.html
 #
 ###############################################################################
-#		       S T A R T U P   E N A B L E D
-###############################################################################
-
 STARTUP_ENABLED=No
 
 ###############################################################################
@@ -29,15 +27,17 @@ STARTUP_ENABLED=No
 VERBOSITY=1
 
 ###############################################################################
-#			       L O G G I N G
+#		                L O G G I N G
 ###############################################################################
 
-LOGFILE=/var/log/messages
+BLACKLIST_LOGLEVEL=
 
-STARTUP_LOG=/var/log/shorewall-init.log
+LOG_MARTIANS=Yes
 
 LOG_VERBOSITY=2
 
+LOGFILE=/var/log/messages
+
 LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
@@ -46,167 +46,163 @@ LOGLIMIT=
 
 LOGALLNEW=
 
-BLACKLIST_LOGLEVEL=
-
 MACLIST_LOG_LEVEL=info
 
-TCP_FLAGS_LOG_LEVEL=info
+SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
-LOG_MARTIANS=Yes
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
 
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
+
 IPTABLES=
 
 IP=
 
-TC=
-
 IPSET=
 
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=restore
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-IP_FORWARDING=On
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
 
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
 
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=Yes
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DISABLE_IPV6=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=On
+
+KEEP_RT_TABLES=No
+
+LOAD_HELPERS_ONLY=Yes
+
+LEGACY_FASTSTART=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
 RETAIN_ALIASES=No
 
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
 TC_ENABLED=Internal
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=Yes
-
-ROUTE_FILTER=No
-
-DETECT_DNAT_IPADDRS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-DISABLE_IPV6=No
-
-DYNAMIC_ZONES=No
-
-NULL_ROUTE_RFC1918=No
-
-MACLIST_TABLE=filter
-
-MACLIST_TTL=
-
-SAVE_IPSETS=No
-
-MAPOLDACTIONS=No
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=No
-
-DELETE_THEN_ADD=Yes
-
-MULTICAST=No
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
 
 USE_DEFAULT_RT=No
 
-RESTORE_DEFAULT_ROUTE=Yes
-
-AUTOMAKE=No
-
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
@@ -215,10 +211,12 @@ BLACKLIST_DISPOSITION=DROP
 
 MACLIST_DISPOSITION=REJECT
 
-TCP_FLAGS_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
 ################################################################################
 #                            L E G A C Y  O P T I O N
 #                      D O  N O T  D E L E T E  O R  A L T E R

Samples/two-interfaces/shorewall.conf

@@ -3,6 +3,7 @@
 # Shorewall version 4.0 - Sample shorewall.conf for two-interface
 #                         configuration.
 # Copyright (C) 2006,2007 by the Shorewall Team
+#               2011 by Thomas M. Eastep            
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -29,22 +30,17 @@ STARTUP_ENABLED=No
 VERBOSITY=1
 
 ###############################################################################
-#                              C O M P I L E R
+#		                L O G G I N G
-#      (setting this to 'perl' requires installation of Shorewall-perl)
 ###############################################################################
 
-SHOREWALL_COMPILER=
+BLACKLIST_LOGLEVEL=
 
-###############################################################################
+LOG_MARTIANS=Yes
-#			       L O G G I N G
-###############################################################################
-
-LOGFILE=/var/log/messages
-
-STARTUP_LOG=/var/log/shorewall-init.log
 
 LOG_VERBOSITY=2
 
+LOGFILE=/var/log/messages
+
 LOGFORMAT="Shorewall:%s:%s:"
 
 LOGTAGONLY=No
@@ -53,167 +49,163 @@ LOGLIMIT=
 
 LOGALLNEW=
 
-BLACKLIST_LOGLEVEL=
-
 MACLIST_LOG_LEVEL=info
 
-TCP_FLAGS_LOG_LEVEL=info
+SFILTER_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
-LOG_MARTIANS=Yes
+STARTUP_LOG=/var/log/shorewall-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
 
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
+
 IPTABLES=
 
 IP=
 
-TC=
-
 IPSET=
 
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=restore
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
-IP_FORWARDING=On
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
 
 ADD_IP_ALIASES=No
 
 ADD_SNAT_ALIASES=No
 
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=Yes
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DISABLE_IPV6=No
+
+DELETE_THEN_ADD=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+IP_FORWARDING=On
+
+KEEP_RT_TABLES=No
+
+LOAD_HELPERS_ONLY=Yes
+
+LEGACY_FASTSTART=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+MANGLE_ENABLED=Yes
+
+MAPOLDACTIONS=No
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MULTICAST=No
+
+MUTEX_TIMEOUT=60
+
+NULL_ROUTE_RFC1918=No
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
 RETAIN_ALIASES=No
 
+ROUTE_FILTER=No
+
+SAVE_IPSETS=No
+
 TC_ENABLED=Internal
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=Yes
-
-ROUTE_FILTER=No
-
-DETECT_DNAT_IPADDRS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-DISABLE_IPV6=No
-
-DYNAMIC_ZONES=No
-
-NULL_ROUTE_RFC1918=No
-
-MACLIST_TABLE=filter
-
-MACLIST_TTL=
-
-SAVE_IPSETS=No
-
-MAPOLDACTIONS=No
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=No
-
-DELETE_THEN_ADD=Yes
-
-MULTICAST=No
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
 
 USE_DEFAULT_RT=No
 
-RESTORE_DEFAULT_ROUTE=Yes
-
-AUTOMAKE=No
-
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
@@ -222,10 +214,12 @@ BLACKLIST_DISPOSITION=DROP
 
 MACLIST_DISPOSITION=REJECT
 
-TCP_FLAGS_DISPOSITION=DROP
-
 SMURF_DISPOSITION=DROP
 
+SFILTER_DISPOSITION=DROP
+
+TCP_FLAGS_DISPOSITION=DROP
+
 ################################################################################
 #                            L E G A C Y  O P T I O N
 #                      D O  N O T  D E L E T E  O R  A L T E R

Samples6/Universal/shorewall6.conf

@@ -22,155 +22,161 @@ VERBOSITY=1
 #			       L O G G I N G
 ###############################################################################
 
-LOGFILE=
+BLACKLIST_LOGLEVEL=
-
-STARTUP_LOG=/var/log/shorewall6-init.log
 
 LOG_VERBOSITY=2
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGALLNEW=
 
-LOGTAGONLY=No
+LOGFILE=
+
+LOGFORMAT="Shorewall:%s:%s:"
 
 LOGLIMIT=
 
-LOGALLNEW=
+LOGTAGONLY=No
 
-BLACKLIST_LOGLEVEL=
+SFILTER_LOG_LEVEL=info
-
-TCP_FLAGS_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
+
 IP6TABLES=
 
 IP=
 
-TC=
-
 IPSET=
 
+LOCKFILE=
+
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/usr/share/shorewall6:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=Yes
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=Yes
+
+FORWARD_CLEAR_MARK=
+
+HIGH_ROUTE_MARKS=No
+
+IMPLICIT_CONTINUE=No
+
 IP_FORWARDING=Off
 
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=15
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=Yes
+
+RESTOREFILE=restore
+
 TC_ENABLED=No
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-FASTACCEPT=Yes
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=15
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=Yes
-
-DELETE_THEN_ADD=Yes
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
-
-AUTOMAKE=No
 
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-DYNAMIC_BLACKLIST=Yes
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=Yes
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=Yes
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
 
 BLACKLIST_DISPOSITION=DROP
 
-TCP_FLAGS_DISPOSITION=DROP
+SFILTER_DISPOSITION=DROP
 
 SMURF_DISPOSITION=DROP
 
+TCP_FLAGS_DISPOSITION=DROP
+
 #LAST LINE -- DO NOT REMOVE

Samples6/one-interface/shorewall6.conf

@@ -1,19 +1,11 @@
 ###############################################################################
 #
-# Shorewall6 version 4 - Sample shorewall.conf for one-interface configuration.
+#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
-# Copyright (C) 2006,2008 by the Shorewall Team
 #
-# This library is free software; you can redistribute it and/or
+#  For information about the settings in this file, type "man shorewall6.conf"
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
 #
-# See the file README.txt for further details.
+#  Manpage also online at
-#
+#  http://www.shorewall.net/manpages6/shorewall6.conf.html
-# For information about the settings in this file, type "man shorewall6.conf"
-#
-# The manpage is also online at 
-# http://shorewall.net/manpages6/shorewall6.conf.html
 ###############################################################################
 #		       S T A R T U P   E N A B L E D
 ###############################################################################
@@ -30,149 +22,161 @@ VERBOSITY=1
 #			       L O G G I N G
 ###############################################################################
 
-LOGFILE=/var/log/messages
+BLACKLIST_LOGLEVEL=
-
-STARTUP_LOG=/var/log/shorewall6-init.log
 
 LOG_VERBOSITY=2
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGALLNEW=
 
-LOGTAGONLY=No
+LOGFILE=
+
+LOGFORMAT="Shorewall:%s:%s:"
 
 LOGLIMIT=
 
-LOGALLNEW=
+LOGTAGONLY=No
 
-BLACKLIST_LOGLEVEL=
+SFILTER_LOG_LEVEL=info
-
-TCP_FLAGS_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
+
 IP6TABLES=
 
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=No
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+HIGH_ROUTE_MARKS=No
+
+IMPLICIT_CONTINUE=No
+
 IP_FORWARDING=Off
 
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTOREFILE=restore
+
 TC_ENABLED=No
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=No
-
-KEEP_RT_TABLES=Yes
-
-DELETE_THEN_ADD=Yes
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
-
-AUTOMAKE=No
 
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
+###############################################################################
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_ACCOUNTING=No
-
-##############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
 
 BLACKLIST_DISPOSITION=DROP
 
-TCP_FLAGS_DISPOSITION=DROP
+SFILTER_DISPOSITION=DROP
 
 SMURF_DISPOSITION=DROP
 
+TCP_FLAGS_DISPOSITION=DROP
+
 #LAST LINE -- DO NOT REMOVE

Samples6/three-interfaces/shorewall6.conf

@@ -1,19 +1,11 @@
 ###############################################################################
 #
-# Shorewall6 version 4 - Sample shorewall.conf for one-interface configuration.
+#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
-# Copyright (C) 2006,2008 by the Shorewall Team
 #
-# This library is free software; you can redistribute it and/or
+#  For information about the settings in this file, type "man shorewall6.conf"
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
 #
-# See the file README.txt for further details.
+#  Manpage also online at
-#
+#  http://www.shorewall.net/manpages6/shorewall6.conf.html
-# For information about the settings in this file, type "man shorewall6.conf"
-#
-# The manpage is also online at 
-# http://shorewall.net/manpages6/shorewall6.conf.html
 ###############################################################################
 #		       S T A R T U P   E N A B L E D
 ###############################################################################
@@ -30,149 +22,161 @@ VERBOSITY=1
 #			       L O G G I N G
 ###############################################################################
 
-LOGFILE=/var/log/messages
+BLACKLIST_LOGLEVEL=
-
-STARTUP_LOG=/var/log/shorewall6-init.log
 
 LOG_VERBOSITY=2
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGALLNEW=
 
-LOGTAGONLY=No
+LOGFILE=/var/log/messages
+
+LOGFORMAT="Shorewall:%s:%s:"
 
 LOGLIMIT=
 
-LOGALLNEW=
+LOGTAGONLY=No
 
-BLACKLIST_LOGLEVEL=
+SFILTER_LOG_LEVEL=info
-
-TCP_FLAGS_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
+
 IP6TABLES=
 
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall6/:/usr/share/shorewall6:/usr/share/shorewall
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=Yes
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+HIGH_ROUTE_MARKS=No
+
+IMPLICIT_CONTINUE=No
+
 IP_FORWARDING=On
 
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTOREFILE=restore
+
 TC_ENABLED=No
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=Yes
-
-KEEP_RT_TABLES=Yes
-
-DELETE_THEN_ADD=Yes
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
-
-AUTOMAKE=No
 
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
 
 BLACKLIST_DISPOSITION=DROP
 
+SFILTER_DISPOSITION=DROP
+
+SMURF_DISPOSITION=DROP
+
 TCP_FLAGS_DISPOSITION=DROP
 
-SMURF_DISPOSITION=No
-
 #LAST LINE -- DO NOT REMOVE

Samples6/two-interfaces/shorewall6.conf

@@ -1,19 +1,11 @@
 ###############################################################################
 #
-# Shorewall version 4.4 - Sample shorewall.conf for one-interface configuration.
+#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
-# Copyright (C) 2006 by the Shorewall Team
 #
-# This library is free software; you can redistribute it and/or
+#  For information about the settings in this file, type "man shorewall6.conf"
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
 #
-# See the file README.txt for further details.
+#  Manpage also online at
-#
+#  http://www.shorewall.net/manpages6/shorewall6.conf.html
-# For information about the settings in this file, type "man shorewall6.conf"
-#
-# The manpage is also online at 
-# http://shorewall.net/manpages6/shorewall6.conf.html
 ###############################################################################
 #		       S T A R T U P   E N A B L E D
 ###############################################################################
@@ -30,149 +22,161 @@ VERBOSITY=1
 #			       L O G G I N G
 ###############################################################################
 
-LOGFILE=/var/log/messages
+BLACKLIST_LOGLEVEL=
-
-STARTUP_LOG=/var/log/shorewall6-init.log
 
 LOG_VERBOSITY=2
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGALLNEW=
 
-LOGTAGONLY=No
+LOGFILE=/var/log/messages
+
+LOGFORMAT="Shorewall:%s:%s:"
 
 LOGLIMIT=
 
-LOGALLNEW=
+LOGTAGONLY=No
 
-BLACKLIST_LOGLEVEL=
+SFILTER_LOG_LEVEL=info
-
-TCP_FLAGS_LOG_LEVEL=info
 
 SMURF_LOG_LEVEL=info
 
+STARTUP_LOG=/var/log/shorewall6-init.log
+
+TCP_FLAGS_LOG_LEVEL=info
+
 ###############################################################################
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
+CONFIG_PATH=/etc/shorewall6:/usr/share/shorewall6:/usr/share/shorewall
+
 IP6TABLES=
 
+IP=
+
+IPSET=
+
+LOCKFILE=
+
+MODULESDIR=
+
 PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+RESTOREFILE=
+
 SHOREWALL_SHELL=/bin/sh
 
 SUBSYSLOCK=
 
-MODULESDIR=
+TC=
-
-CONFIG_PATH=/etc/shorewall6/:/usr/share/shorewall6:/usr/share/shorewall/
-
-RESTOREFILE=
-
-LOCKFILE=
 
 ###############################################################################
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-DROP_DEFAULT="Drop"
-REJECT_DEFAULT="Reject"
 ACCEPT_DEFAULT="none"
-QUEUE_DEFAULT="none"
+DROP_DEFAULT="Drop"
 NFQUEUE_DEFAULT="none"
+QUEUE_DEFAULT="none"
+REJECT_DEFAULT="Reject"
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
 ###############################################################################
 
-RSH_COMMAND='ssh ${root}@${system} ${command}'
 RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+RSH_COMMAND='ssh ${root}@${system} ${command}'
 
 ###############################################################################
 #			F I R E W A L L	  O P T I O N S
 ###############################################################################
 
+ACCOUNTING=Yes
+
+ACCOUNTING_TABLE=filter
+
+ADMINISABSENTMINDED=Yes
+
+AUTO_COMMENT=Yes
+
+AUTOMAKE=No
+
+BLACKLISTNEWONLY=Yes
+
+CLAMPMSS=No
+
+CLEAR_TC=Yes
+
+COMPLETE=No
+
+DELETE_THEN_ADD=Yes
+
+DONT_LOAD=
+
+DYNAMIC_BLACKLIST=Yes
+
+EXPAND_POLICIES=No
+
+EXPORTMODULES=Yes
+
+EXPORTPARAMS=No
+
+FASTACCEPT=No
+
+FORWARD_CLEAR_MARK=
+
+HIGH_ROUTE_MARKS=No
+
+IMPLICIT_CONTINUE=No
+
 IP_FORWARDING=On
 
+KEEP_RT_TABLES=Yes
+
+LEGACY_FASTSTART=No
+
+LOAD_HELPERS_ONLY=Yes
+
+MANGLE_ENABLED=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+MODULE_SUFFIX=ko
+
+MUTEX_TIMEOUT=60
+
+OPTIMIZE=1
+
+OPTIMIZE_ACCOUNTING=No
+
+REQUIRE_INTERFACE=No
+
+RESTOREFILE=restore
+
 TC_ENABLED=No
 
 TC_EXPERT=No
 
 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
 
-CLEAR_TC=Yes
+TRACK_PROVIDERS=Yes
-
-MARK_IN_FORWARD_CHAIN=No
-
-CLAMPMSS=No
-
-MUTEX_TIMEOUT=60
-
-ADMINISABSENTMINDED=Yes
-
-BLACKLISTNEWONLY=Yes
-
-MODULE_SUFFIX=ko
-
-FASTACCEPT=No
-
-IMPLICIT_CONTINUE=No
-
-HIGH_ROUTE_MARKS=No
-
-OPTIMIZE=1
-
-EXPORTPARAMS=No
-
-EXPAND_POLICIES=No
-
-KEEP_RT_TABLES=Yes
-
-DELETE_THEN_ADD=Yes
-
-DONT_LOAD=
-
-AUTO_COMMENT=Yes
-
-MANGLE_ENABLED=Yes
-
-AUTOMAKE=No
 
 WIDE_TC_MARKS=Yes
 
-TRACK_PROVIDERS=Yes
-
 ZONE2ZONE=2
 
-ACCOUNTING=Yes
-
-DYNAMIC_BLACKLIST=Yes
-
-OPTIMIZE_ACCOUNTING=No
-
-LOAD_HELPERS_ONLY=Yes
-
-REQUIRE_INTERFACE=No
-
-FORWARD_CLEAR_MARK=
-
-COMPLETE=No
-
-EXPORTMODULES=Yes
-
-ACCOUNTING_TABLE=filter
-
-LEGACY_FASTSTART=No
-
 ###############################################################################
 #			P A C K E T   D I S P O S I T I O N
 ###############################################################################
 
 BLACKLIST_DISPOSITION=DROP
 
-TCP_FLAGS_DISPOSITION=DROP
+SFILTER_DISPOSITION=DROP
 
 SMURF_DISPOSITION=DROP
 
+TCP_FLAGS_DISPOSITION=DROP
+
 #LAST LINE -- DO NOT REMOVE

Shorewall/configfiles/shorewall.conf

@@ -61,10 +61,10 @@ IPSET=
 
 MODULESDIR=
 
-PERL=/usr/bin/perl
-
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+PERL=/usr/bin/perl
+
 RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
@@ -116,12 +116,12 @@ CLEAR_TC=Yes
 
 COMPLETE=No
 
-DISABLE_IPV6=No
-
 DELETE_THEN_ADD=Yes
 
 DETECT_DNAT_IPADDRS=No
 
+DISABLE_IPV6=No
+
 DONT_LOAD=
 
 DYNAMIC_BLACKLIST=Yes
@@ -144,10 +144,10 @@ IP_FORWARDING=On
 
 KEEP_RT_TABLES=No
 
-LOAD_HELPERS_ONLY=No
-
 LEGACY_FASTSTART=Yes
 
+LOAD_HELPERS_ONLY=No
+
 MACLIST_TABLE=filter
 
 MACLIST_TTL=