mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-23 19:21:21 +02:00
fixed quotes, add CVS Id
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@998 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
458a6e3ad0
commit
b20ca3e8a4
@ -2,6 +2,8 @@
|
|||||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
<article>
|
<article>
|
||||||
|
<!--$Id$-->
|
||||||
|
|
||||||
<title>Shorewall 1.4.9</title>
|
<title>Shorewall 1.4.9</title>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
@ -12,10 +14,10 @@
|
|||||||
<orderedlist>
|
<orderedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>There has been a low continuing level of confusion over the
|
<para>There has been a low continuing level of confusion over the
|
||||||
terms "Source NAT" (SNAT) and "Static NAT". To avoid
|
terms <quote>Source NAT</quote> (SNAT) and <quote>Static NAT</quote>.
|
||||||
future confusion, all instances of "Static NAT" have been
|
To avoid future confusion, all instances of <quote>Static NAT</quote>
|
||||||
replaced with "One-to-one NAT" in the documentation and
|
have been replaced with <quote>One-to-one NAT</quote> in the
|
||||||
configuration files.</para>
|
documentation and configuration files.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -24,7 +26,7 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Wild-card rules (those involving "all" as SOURCE or
|
<para>Wild-card rules (those involving <quote>all</quote> as SOURCE or
|
||||||
DEST) will no longer produce an error if they attempt to add a rule
|
DEST) will no longer produce an error if they attempt to add a rule
|
||||||
that would override a NONE policy. The logic for expanding these
|
that would override a NONE policy. The logic for expanding these
|
||||||
wild-card rules now simply skips those (SOURCE,DEST) pairs that have a
|
wild-card rules now simply skips those (SOURCE,DEST) pairs that have a
|
||||||
@ -46,17 +48,17 @@
|
|||||||
|
|
||||||
<orderedlist>
|
<orderedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>To cut down on the number of "Why are these ports closed
|
<para>To cut down on the number of <quote>Why are these ports closed
|
||||||
rather than stealthed?" questions, the SMB-related rules in
|
rather than stealthed?</quote> questions, the SMB-related rules in
|
||||||
/etc/shorewall/common.def have been changed from 'reject' to
|
/etc/shorewall/common.def have been changed from <quote>reject</quote>
|
||||||
'DROP'.</para>
|
to <quote>DROP</quote>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>For easier identification, packets logged under the
|
<para>For easier identification, packets logged under the
|
||||||
'norfc1918' interface option are now logged out of chains
|
<quote>norfc1918</quote> interface option are now logged out of chains
|
||||||
named 'rfc1918'. Previously, such packets were logged under
|
named <quote>rfc1918</quote>. Previously, such packets were logged
|
||||||
chains named 'logdrop'.</para>
|
under chains named <quote>logdrop</quote>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -65,8 +67,8 @@
|
|||||||
Shorewall code for each new convention, the MODULE_SUFFIX option has
|
Shorewall code for each new convention, the MODULE_SUFFIX option has
|
||||||
been added to shorewall.conf. MODULE_SUFFIX may be set to the suffix
|
been added to shorewall.conf. MODULE_SUFFIX may be set to the suffix
|
||||||
for module names in your particular distribution. If MODULE_SUFFIX is
|
for module names in your particular distribution. If MODULE_SUFFIX is
|
||||||
not set in shorewall.conf, Shorewall will use the list "o gz ko
|
not set in shorewall.conf, Shorewall will use the list <quote>o gz ko
|
||||||
o.gz". To see what suffix is used by your distribution:</para>
|
o.gz</quote>. To see what suffix is used by your distribution:</para>
|
||||||
|
|
||||||
<programlisting>ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter</programlisting>
|
<programlisting>ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter</programlisting>
|
||||||
|
|
||||||
@ -75,12 +77,12 @@
|
|||||||
|
|
||||||
<orderedlist>
|
<orderedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>If all files end in ".kzo" then set
|
<para>If all files end in <quote>.kzo</quote> then set
|
||||||
MODULE_SUFFIX="kzo"</para>
|
MODULE_SUFFIX="kzo"</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>If all files end in ".kz.o" then set
|
<para>If all files end in <quote>.kz.o</quote> then set
|
||||||
MODULE_SUFFIX="kz.o"</para>
|
MODULE_SUFFIX="kz.o"</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
@ -94,12 +96,12 @@
|
|||||||
this file to /etc/shorewall/action.<action></para></listitem><listitem><para>Add
|
this file to /etc/shorewall/action.<action></para></listitem><listitem><para>Add
|
||||||
the appropriate rules in that file for the <action>.</para></listitem></orderedlist></listitem></itemizedlist>Once
|
the appropriate rules in that file for the <action>.</para></listitem></orderedlist></listitem></itemizedlist>Once
|
||||||
an <action> has been defined, it may be used like any of the
|
an <action> has been defined, it may be used like any of the
|
||||||
builtin ACTIONS (ACCEPT, DROP, etc.) in /etc/shorewall/rules. </para>
|
builtin ACTIONS (ACCEPT, DROP, etc.) in /etc/shorewall/rules.</para>
|
||||||
|
|
||||||
<para>Example: You want an action that logs a packet at the
|
<para>Example: You want an action that logs a packet at the
|
||||||
'info' level and accepts the connection. </para>
|
<quote>info</quote> level and accepts the connection.</para>
|
||||||
|
|
||||||
<para>In /etc/shorewall/actions, you would add: </para>
|
<para>In /etc/shorewall/actions, you would add:</para>
|
||||||
|
|
||||||
<simplelist>
|
<simplelist>
|
||||||
<member>LogAndAccept</member>
|
<member>LogAndAccept</member>
|
||||||
@ -107,7 +109,7 @@
|
|||||||
|
|
||||||
<para>You would then copy /etc/shorewall/action.template to
|
<para>You would then copy /etc/shorewall/action.template to
|
||||||
/etc/shorewall/action.LogAndAccept and in that file, you would add the
|
/etc/shorewall/action.LogAndAccept and in that file, you would add the
|
||||||
two rules: </para>
|
two rules:</para>
|
||||||
|
|
||||||
<simplelist>
|
<simplelist>
|
||||||
<member>LOG:info</member>
|
<member>LOG:info</member>
|
||||||
@ -117,4 +119,4 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
</section>
|
</section>
|
||||||
</article>
|
</article>
|
Loading…
x
Reference in New Issue
Block a user