extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-03 03:59:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add some info about mis-using Vserver zones

Browse Source
This commit is contained in:
Tom Eastep 2011-01-23 09:43:35 -08:00
parent 82913abeca
commit a7dd95d394
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
docs/Shorewall_and_Aliased_Interfaces.xml
View File

@ -338,5 +338,15 @@ loc2 eth1:192.168.20.0/24</programlisting>
Interface</emphasis></ulink>.</para> Interface</emphasis></ulink>.</para>
</example> </example>
</section> </section>
<section>
<title>Defining a Zone-per-Address</title>
<para><ulink url="Vserver.html">Shorewall's support for Linux
Vservers</ulink> can (miss-)used to create a separate zone per alias.
Note that this results in a <emphasis>partitioning of the firewall
zone</emphasis>. Be sure that you define an ACCEPT policy between your
vserver zones and $FW.</para>
</section>
</section> </section>
</article> </article>

5
docs/Vserver.xml
View File

@ -65,6 +65,11 @@
</listitem> </listitem>
</itemizedlist> </itemizedlist>
<para>Note that you don't need to run Vservers to use vserver zones; they
may also be used to create a firewall sub-zone for each <ulink
url="Shorewall_and_Aliased_Interfaces.html">aliased
interface</ulink>.</para>
<para>If you use these zones, keep in mind that Linux-vserver implements a <para>If you use these zones, keep in mind that Linux-vserver implements a
very weak form of network virtualization:</para> very weak form of network virtualization:</para>