diff --git a/manpages/shorewall-accounting.xml b/manpages/shorewall-accounting.xml index 2ef159db5..22dd13612 100644 --- a/manpages/shorewall-accounting.xml +++ b/manpages/shorewall-accounting.xml @@ -94,9 +94,7 @@ SOURCE — {-|any|all|$FW[:address]|interface|interfaceall|interface|interface:address|address} @@ -152,7 +150,7 @@ role="bold">ipp2p then this column must contain an ipp2p-option ("iptables -m ipp2p --help") without the leading "--". If no option is given in this column, - "ipp2p" is assumed. + ipp2p is assumed. Service name from services(5) or port number. May only be specified if the protocol is @@ -190,8 +188,8 @@ This column may only be non-empty if the SOURCE is the firewall itself ($FW). + role="bold">CHAIN is OUTPUT. When this column is non-empty, the rule applies only if the program generating the output is running under the effective diff --git a/manpages/shorewall-exclusion.xml b/manpages/shorewall-exclusion.xml new file mode 100644 index 000000000..2c2f1e1fb --- /dev/null +++ b/manpages/shorewall-exclusion.xml @@ -0,0 +1,95 @@ + + + + shorewall-exclusion + + 5 + + + + exclusion + + Exclude a set of hosts from a definition in a shorewall + configuration file. + + + + + ! + + address-or-range + + ,address-or-range + + + + + Description + + Exclusion is used when you wish to exclude one or more addresses + from a definition. An exclaimation point is followed by a comma-separated + list of addresses. The addresses may be single host addresses (e.g., + 192.168.1.4) or they may be network addresses in CIDR format (e.g., + 192.168.1.0/24). If your kernel and iptables include iprange support, you + may also specify ranges of ip addresses of the form + lowaddress-highaddress + + No embedded whitespace is allowed. + + + + Example + + + + Example 1 + + + !192.168.3.4 + + + + + Example 2 + + + !192.168.1.0/24,10.1.3.4 + + + + + Example 3 + + + !192.168.1.3-192.168.1.12,10.0.0.0/8 + + + + + + + FILES + + /etc/shorewall/hosts + + /etc/shorewall/masq + + /etc/shorewall/rules + + /etc/shorewall/tcrules + + + + See ALSO + + shorewall(8), shorewall-accounting(5), shorewall-actions(5), + shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), + shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5), + shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), + shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), + shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5), + shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5), + shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), + shorewall-zones(5) + + \ No newline at end of file diff --git a/manpages/shorewall-hosts.xml b/manpages/shorewall-hosts.xml index 52593acc8..b59f2d11a 100644 --- a/manpages/shorewall-hosts.xml +++ b/manpages/shorewall-hosts.xml @@ -56,9 +56,9 @@ HOST(S) — - interface:{[port:]{address-or-range[interface:{[bridge-port:]{address-or-range[,address-or-range]...|+ipset} + role="bold">+ipset}[exclusion] The name of an interface defined in the @@ -81,8 +81,8 @@ - A physical port name; only allowed - when the interface names a bridge created by the + A physical bridge-port name; only + allowed when the interface names a bridge created by the brctl(8) addbr command. This port must not be defined in shorewall-interfaces(5) and may be optionally followed by a colon (":") and a host or network IP or a range. @@ -96,11 +96,16 @@ The name of an ipset. + +
+ You may also exclude certain hosts through use of an + exclusion (see shorewall-exclusion(5). +
- OPTIONS — [option[OPTIONS (Optional) — [option[,option]...] diff --git a/manpages/shorewall-masq.xml b/manpages/shorewall-masq.xml index 9ca99bc04..acc9b8d83 100644 --- a/manpages/shorewall-masq.xml +++ b/manpages/shorewall-masq.xml @@ -43,7 +43,7 @@ role="bold">+]interface[:[digit]][:[address[,address]...] + role="bold">,address]...][exclusion] Outgoing interface. This is usually your @@ -58,8 +58,8 @@ The interface may be qualified by adding the character ":" followed by a comma-separated list of destination host or subnet addresses to indicate that you only want to change the source IP - address for packets being sent to those particular - destinations. + address for packets being sent to those particular destinations. + Exclusion is allowed (see shorewall-exclusion(5)). If you wish to inhibit the action of ADD_SNAT_ALIASES for this entry then include the ":" but omit the digit: @@ -85,9 +85,7 @@ SOURCE (Formerly called SUBNET) — {interface|address[,address]}[!exclude-address[,exclude-address]...] + role="bold">,address]}[exclusion] Set of hosts that you wish to masquerade. You can specify this @@ -98,8 +96,9 @@ appropriate addresses to masquerade). In order to exclude a address of the specified SOURCE, you may - append "!" and a comma-separated list of IP addresses (host or net) - that you wish to exclude. + append an exclusion ("!" and a comma-separated + list of IP addresses (host or net) that you wish to exclude (see + shorewall-exclusion(5))). Example: eth1!192.168.1.4,192.168.32.0/27 @@ -402,12 +401,13 @@ url="http://www.shorewall.net/Documentation.htm#Masq">http://www.shorewall.net/Documentation.htm#Masq shorewall(8), shorewall-accounting(5), shorewall-actions(5), - shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), - shorewall-ipsec(5), shorewall-maclist(5), shorewall-nat(5), - shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), - shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_routes(5), - shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), - shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), - shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5) + shorewall-blacklist(5), shorewall-exclusion(5), shorewall-hosts(5), + shorewall-interfaces(5), shorewall-ipsec(5), shorewall-maclist(5), + shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), + shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), + shorewall-route_routes(5), shorewall-routestopped(5), shorewall-rules(5), + shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5), + shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), + shorewall-zones(5) \ No newline at end of file diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml index 0a3b9413f..3b4c13782 100644 --- a/manpages/shorewall-rules.xml +++ b/manpages/shorewall-rules.xml @@ -375,7 +375,7 @@ role="bold">-]}[:interface][:{address-or-range[,address-or-range]...|+ipset} + role="bold">+ipset}[exclusion] Source hosts to which the rule applies. May be a zone defined @@ -416,6 +416,10 @@ square brackets ([]) to indicate the number of levels of source bindings to be matched. + You may exclude certain hosts from the set already defined + through use of an exclusion (see + shorewall-exclusion(5)). + Examples: @@ -460,6 +464,15 @@ Hosts 192.0.2.11-192.0.2.17 in the net zone. + + + net:155.186.235.0/24!155.186.235.16/28 + + + Subnet 155.186.235.0/24 on the Internet except for + 155.186.235.16/28 + +
@@ -481,7 +494,7 @@ role="bold">-]}[:interface][:{address-or-range[,address-or-range]...|+ipset}} + role="bold">+ipset}}[exclusion] Location of Server. May be a zone defined in @@ -505,6 +518,10 @@ restricted to a particular subnet, host or interface by appending ":" and the subnet, host or interface. See above. + You may exclude certain hosts from the set already defined + through use of an exclusion (see + shorewall-exclusion(5)). + Restrictions: 1. MAC addresses are not allowed. @@ -703,7 +720,7 @@ [-|rate/{sec|min}[:burst] + role="bold">min}[:burst] You may rate-limit the rule by placing a value in this diff --git a/manpages/shorewall-tcrules.xml b/manpages/shorewall-tcrules.xml index 24a89890a..bf2b103b3 100644 --- a/manpages/shorewall-tcrules.xml +++ b/manpages/shorewall-tcrules.xml @@ -195,7 +195,7 @@ role="bold">-|{interface|$FW|[{interface|$FW}:]address-or-range[,address-or-range]...} + role="bold">,address-or-range]...}[exclusion] Source of the packet. A comma-separated list of interface @@ -219,13 +219,17 @@ separator. Example: ~00-A0-C9-15-39-78 + + You may exclude certain hosts from the set already defined + through use of an exclusion (see + shorewall-exclusion(5)). DEST — {-|{interface|[interface:]address-or-range[,address-or-range]...} + role="bold">,address-or-range]...}[exclusion] Destination of the packet. Comma separated list of IP @@ -236,6 +240,10 @@ role="bold">MARK column specificies a classification of the form major:minor then this column may also contain an interface name. + + You may exclude certain hosts from the set already defined + through use of an exclusion (see + shorewall-exclusion(5)). @@ -460,9 +468,9 @@ 1 0.0.0.0/0 0.0.0.0/0 icmp echo-request 1 0.0.0.0/0 0.0.0.0/0 icmp echo-reply RESTORE 0.0.0.0/0 0.0.0.0/0 all - - - 0 - CONTINUE 0.0.0.0/0 0.0.0.0/0 all - - - !0 - 4 0.0.0.0/0 0.0.0.0/0 ipp2p:all - SAVE 0.0.0.0/0 0.0.0.0/0 all - - - !0 + CONTINUE 0.0.0.0/0 0.0.0.0/0 all - - - !0 + 4 0.0.0.0/0 0.0.0.0/0 ipp2p:all + SAVE 0.0.0.0/0 0.0.0.0/0 all - - - !0 If a packet hasn't been classifed (packet mark is 0), copy the connection mark to the packet mark. If the packet mark is set, we're @@ -492,12 +500,13 @@ url="http://shorewall.net/PacketMarking.html">http://shorewall.net/PacketMarking.html shorewall(8), shorewall-accounting(5), shorewall-actions(5), - shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), - shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5), - shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), - shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), - shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5), - shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5), - shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5) + shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5), + shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5), + shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), + shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), + shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5), + shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), + shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tos(5), + shorewall-tunnels(5), shorewall-zones(5) \ No newline at end of file