diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt
index 14afba313..5771cbdf8 100644
--- a/Shorewall/releasenotes.txt
+++ b/Shorewall/releasenotes.txt
@@ -76,6 +76,12 @@ None.
SOURCE DEST POLICY
net all DROP:Drop(-,DROP) #DROP rather than REJECT Auth
+ The parameters can also be specified in shorewall.conf:
+
+ Example:
+
+ DROP_DEFAULT=Drop(-,DROP)
+
----------------------------------------------------------------------------
I V. R E L E A S E 4 . 4 H I G H L I G H T S
----------------------------------------------------------------------------
diff --git a/docs/Actions.xml b/docs/Actions.xml
index 9b89574df..207db8b60 100644
--- a/docs/Actions.xml
+++ b/docs/Actions.xml
@@ -172,6 +172,97 @@ ACCEPT - - tcp 135,139,445
Remember — default actions are only invoked immediately before the
packet is going to be dropped or rejected anyway!!!
+
+ Beginning with Shorewall 4.4.21, the standard Drop and Reject
+ options are parameterized. Each has three parameters as follows:
+
+
+
+
+
+ ACTION
+
+ PARAMETER
+
+ VALUE
+
+ DEFAULT
+
+
+
+ Drop
+
+ 1
+
+ Either '-' or 'audit'. 'audit' causes auditing by the
+ builtin actions invoked by Drop
+
+ -
+
+
+
+ Drop
+
+ 2
+
+ Determines what to do with Auth requests
+
+ REJECT or A_REJECT depending on the setting of parameter
+ 1
+
+
+
+ Drop
+
+ 3
+
+ Determines what to do with SMB
+
+ DROP or A_DROP depending on the setting of parameter
+ 1
+
+
+
+ Reject
+
+ 1
+
+ Either '-' or 'audit'. 'audit' causes auditing by the
+ builtin actions invoked by Drop
+
+ -
+
+
+
+ Reject
+
+ 2
+
+ Determines what to do with Auth requests
+
+ REJECT or A_REJECT depending on the setting of parameter
+ 1
+
+
+
+ Reject
+
+ 3
+
+ Determines what to do with SMB
+
+ REJECT or A_REJECT depending on the setting of parameter
+ 1
+
+
+
+
+
+ The parameters may be specified in either shorewall.conf (e.g.,
+ DROP_DEFAULT=Drop(-,DROP) or in the
+ POLICY column of shorewall-policy(5) (e.g.,
+ DROP:Drop(audit):audit).