mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-21 02:08:48 +02:00
Modify seattlefirewall_index.htm for HTML 4.01 Transitional Compatibility
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@837 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
30a1f79488
commit
c576b6ab74
@ -1,159 +1,204 @@
|
|||||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
<meta http-equiv="Content-Type"
|
<meta name="generator" content="HTML Tidy, see www.w3.org">
|
||||||
content="text/html; charset=UTF-8">
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||||
<base target="_self">
|
<base target="_self">
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
<div align="center">
|
<div align="center">
|
||||||
<div align="center"> </div>
|
|
||||||
<center>
|
<center>
|
||||||
<div align="center"> </div>
|
<table border="0" cellpadding="0" cellspacing="0" style=
|
||||||
<table border="0" cellpadding="0" cellspacing="0"
|
"border-collapse: collapse; width: 100%; height: 100%;" id=
|
||||||
style="border-collapse: collapse; width: 100%; height: 100%;"
|
"AutoNumber4">
|
||||||
id="AutoNumber4">
|
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td width="90%">
|
<td width="90%">
|
||||||
<h2>Site Problem</h2>
|
<h2>Site Problem</h2>
|
||||||
The server that normally hosts www.shorewall.net and ftp.shorewall.net
|
|
||||||
is currently down. Until it is back up, a small server with very
|
The server that normally hosts www.shorewall.net and
|
||||||
limited bandwidth is being used temporarly. You will likely experience
|
ftp.shorewall.net is currently down. Until it is back up, a small
|
||||||
better response time from the <a
|
server with very limited bandwidth is being used temporarly. You
|
||||||
href="http://shorewall.sourceforge.net" target="_top">Sourceforge site</a>
|
will likely experience better response time from the <a href=
|
||||||
or from one of the other <a href="shorewall_mirrors.htm">mirrors</a>.
|
"http://shorewall.sourceforge.net" target="_top">Sourceforge
|
||||||
Sorry for the inconvenience.<br>
|
site</a> or from one of the other <a href=
|
||||||
|
"shorewall_mirrors.htm">mirrors</a>. Sorry for the
|
||||||
|
inconvenience.<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
|
|
||||||
<h2>Introduction to Shorewall<br>
|
<h2>Introduction to Shorewall<br>
|
||||||
</h2>
|
</h2>
|
||||||
|
|
||||||
<h3>This is the Shorewall 1.4 Web Site</h3>
|
<h3>This is the Shorewall 1.4 Web Site</h3>
|
||||||
|
|
||||||
The information on this site applies only to 1.4.x releases of
|
The information on this site applies only to 1.4.x releases of
|
||||||
Shorewall. For older versions:<br>
|
Shorewall. For older versions:<br>
|
||||||
|
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li>The 1.3 site is <a href="http://www.shorewall.net/1.3"
|
<li>The 1.3 site is <a href="http://www.shorewall.net/1.3" target=
|
||||||
target="_top">here.</a></li>
|
"_top">here.</a></li>
|
||||||
<li>The 1.2 site is <a href="http://shorewall.net/1.2/"
|
|
||||||
target="_top">here</a>.</li>
|
<li>The 1.2 site is <a href="http://shorewall.net/1.2/" target=
|
||||||
|
"_top">here</a>.</li>
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>Glossary<br>
|
<h3>Glossary<br>
|
||||||
</h3>
|
</h3>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="http://www.netfilter.org">Netfilter</a> - the
|
<li><a href="http://www.netfilter.org">Netfilter</a> - the packet
|
||||||
packet filter facility built into the 2.4 and later Linux kernels.</li>
|
filter facility built into the 2.4 and later Linux kernels.</li>
|
||||||
<li>ipchains - the packet filter facility built into the 2.2
|
|
||||||
Linux kernels. Also the name of the utility program used to configure
|
<li>ipchains - the packet filter facility built into the 2.2 Linux
|
||||||
and control that facility. Netfilter can be used in ipchains
|
kernels. Also the name of the utility program used to configure and
|
||||||
|
control that facility. Netfilter can be used in ipchains
|
||||||
compatibility mode.<br>
|
compatibility mode.<br>
|
||||||
</li>
|
</li>
|
||||||
<li>iptables - the utility program used to configure and
|
|
||||||
control Netfilter. The term 'iptables' is often used to refer to the
|
<li>iptables - the utility program used to configure and control
|
||||||
|
Netfilter. The term 'iptables' is often used to refer to the
|
||||||
combination of iptables+Netfilter (with Netfilter not in ipchains
|
combination of iptables+Netfilter (with Netfilter not in ipchains
|
||||||
compatibility mode).</li>
|
compatibility mode).</li>
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<h3>What is Shorewall?<br>
|
<h3>What is Shorewall?<br>
|
||||||
</h3>
|
</h3>
|
||||||
|
|
||||||
The Shoreline Firewall, more commonly known as "Shorewall", is
|
The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||||
high-level tool for configuring Netfilter. You describe your
|
high-level tool for configuring Netfilter. You describe your
|
||||||
firewall/gateway requirements using entries in a set of configuration
|
firewall/gateway requirements using entries in a set of
|
||||||
files. Shorewall reads those configuration files and with the help of
|
configuration files. Shorewall reads those configuration files and
|
||||||
the iptables utility, Shorewall configures Netfilter to match your
|
with the help of the iptables utility, Shorewall configures
|
||||||
requirements. Shorewall can be used on a dedicated firewall system, a
|
Netfilter to match your requirements. Shorewall can be used on a
|
||||||
multi-function gateway/router/server or on a standalone GNU/Linux
|
dedicated firewall system, a multi-function gateway/router/server
|
||||||
system. Shorewall does not use Netfilter's ipchains compatibility mode
|
or on a standalone GNU/Linux system. Shorewall does not use
|
||||||
and can thus take advantage of Netfilter's connection state tracking
|
Netfilter's ipchains compatibility mode and can thus take advantage
|
||||||
capabilities.<br>
|
of Netfilter's connection state tracking capabilities.<br>
|
||||||
<br>
|
<br>
|
||||||
Shorewall is <span style="text-decoration: underline;">not</span> a
|
Shorewall is <span style="text-decoration: underline;">not</span> a
|
||||||
daemon. Once Shorewall has configured Netfilter, it's job is complete
|
daemon. Once Shorewall has configured Netfilter, it's job is
|
||||||
although the <a href="starting_and_stopping_shorewall.htm">/sbin/shorewall
|
complete although the <a href=
|
||||||
program can be used at any time to monitor the Netfilter firewall</a>.<br>
|
"starting_and_stopping_shorewall.htm">/sbin/shorewall program can
|
||||||
|
be used at any time to monitor the Netfilter firewall</a>.<br>
|
||||||
|
|
||||||
|
|
||||||
<h3>Getting Started with Shorewall</h3>
|
<h3>Getting Started with Shorewall</h3>
|
||||||
New to Shorewall? Start by selecting the <a
|
|
||||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most
|
New to Shorewall? Start by selecting the <a href=
|
||||||
closely match your environment and follow the step by step instructions.<br>
|
"shorewall_quickstart_guide.htm">QuickStart Guide</a> that most
|
||||||
|
closely match your environment and follow the step by step
|
||||||
|
instructions.<br>
|
||||||
|
|
||||||
|
|
||||||
<h3>Looking for Information?</h3>
|
<h3>Looking for Information?</h3>
|
||||||
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
|
||||||
Index</a> is a good place to start as is the Quick Search in the frame
|
The <a href=
|
||||||
above.
|
"shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||||
|
Index</a> is a good place to start as is the Quick Search in the
|
||||||
|
frame above.
|
||||||
|
|
||||||
<h3>License<br>
|
<h3>License<br>
|
||||||
</h3>
|
</h3>
|
||||||
This program is free software; you can redistribute it and/or modify it
|
|
||||||
under the terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
This program is free software; you can redistribute it and/or
|
||||||
2 of the GNU General Public License</a> as published by the Free
|
modify it under the terms of <a href=
|
||||||
Software Foundation.<br>
|
"http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU General
|
||||||
<p> This program is distributed in the hope that it will be
|
Public License</a> as published by the Free Software
|
||||||
useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
|
Foundation.<br>
|
||||||
|
|
||||||
|
|
||||||
|
<p>This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
General
|
General Public License for more details.<br>
|
||||||
Public License for more details.<br>
|
|
||||||
<br>
|
<br>
|
||||||
You should have received a copy of the GNU General Public License along
|
You should have received a copy of the GNU General Public License
|
||||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
along with this program; if not, write to the Free Software
|
||||||
675 Mass Ave, Cambridge, MA 02139, USA</p>
|
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||||
|
|
||||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M.
|
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M.
|
||||||
Eastep</a><br>
|
Eastep</a><br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<h3>Running Shorewall on Mandrake with a two-interface setup?</h3>
|
<h3>Running Shorewall on Mandrake with a two-interface setup?</h3>
|
||||||
If so, the documentation<b> </b>on this site will not apply directly
|
|
||||||
to
|
If so, the documentation <b></b>on this site will not apply
|
||||||
your setup. If you want to use the documentation that you find here,
|
directly to your setup. If you want to use the documentation that
|
||||||
you will want to consider uninstalling what you have and installing a
|
you find here, you will want to consider uninstalling what you have
|
||||||
setup that matches the documentation on this site. See the <a
|
and installing a setup that matches the documentation on this site.
|
||||||
href="two-interface.htm">Two-interface QuickStart Guide</a> for
|
See the <a href="two-interface.htm">Two-interface QuickStart
|
||||||
details.<br>
|
Guide</a> for details.<br>
|
||||||
|
|
||||||
|
|
||||||
<h2>News</h2>
|
<h2>News</h2>
|
||||||
<p><b>12/07/2003 - Shorewall 1.4.9 Beta 1 </b><b> <img
|
|
||||||
style="border: 0px solid ; width: 28px; height: 12px;"
|
<p><b>12/07/2003 - Shorewall 1.4.9 Beta 1</b> <b><img style=
|
||||||
src="images/new10.gif" alt="(New)" title=""><br>
|
"border: 0px solid ; width: 28px; height: 12px;" src=
|
||||||
|
"images/new10.gif" alt="(New)" title=""><br>
|
||||||
</b></p>
|
</b></p>
|
||||||
<div style="margin-left: 40px;"><a
|
|
||||||
href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
|
<div style="margin-left: 40px;"><a href=
|
||||||
<a href="ftp://shorewall.net/pub/shorewall/Beta" target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
|
"http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
|
||||||
|
|
||||||
|
<a href="ftp://shorewall.net/pub/shorewall/Beta" target=
|
||||||
|
"_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p>Problems Corrected since version 1.4.8:<br>
|
<p>Problems Corrected since version 1.4.8:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>There has been a low continuing level of confusion over the
|
<li>There has been a low continuing level of confusion over the
|
||||||
terms "Source NAT" (SNAT) and "Static NAT". To avoid future confusion,
|
terms "Source NAT" (SNAT) and "Static NAT". To avoid future
|
||||||
all instances of "Static NAT" have been replaced with "One-to-one NAT"
|
confusion, all instances of "Static NAT" have been replaced with
|
||||||
in the documentation and configuration files.</li>
|
"One-to-one NAT" in the documentation and configuration files.</li>
|
||||||
|
|
||||||
<li>The description of NEWNOTSYN in shorewall.conf has been
|
<li>The description of NEWNOTSYN in shorewall.conf has been
|
||||||
reworded for clarity.</li>
|
reworded for clarity.</li>
|
||||||
<li>Wild-card rules (those involving "all" as SOURCE or DEST)
|
|
||||||
will no longer produce an error if they attempt to add a rule that would
|
<li>Wild-card rules (those involving "all" as SOURCE or DEST) will
|
||||||
override a NONE policy. The logic for expanding these wild-card rules
|
no longer produce an error if they attempt to add a rule that would
|
||||||
now simply skips those (SOURCE,DEST) pairs that have a NONE policy.<br>
|
override a NONE policy. The logic for expanding these wild-card
|
||||||
|
rules now simply skips those (SOURCE,DEST) pairs that have a NONE
|
||||||
|
policy.<br>
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p>Migration Issues:<br>
|
<p>Migration Issues:<br>
|
||||||
<br>
|
<br>
|
||||||
None.<br>
|
None.<br>
|
||||||
<br>
|
<br>
|
||||||
New Features:<br>
|
New Features:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>To cut down on the number of "Why are these ports closed
|
<li>To cut down on the number of "Why are these ports closed rather
|
||||||
rather than stealthed?" questions, the SMB-related rules in
|
than stealthed?" questions, the SMB-related rules in
|
||||||
/etc/shorewall/common.def have been changed from 'reject' to 'DROP'.</li>
|
/etc/shorewall/common.def have been changed from 'reject' to
|
||||||
<li>For easier identification, packets logged under the
|
'DROP'.</li>
|
||||||
'norfc1918' interface option are now logged out of chains named
|
|
||||||
'rfc1918'. Previously, such packets were logged under chains named
|
<li>For easier identification, packets logged under the 'norfc1918'
|
||||||
|
interface option are now logged out of chains named 'rfc1918'.
|
||||||
|
Previously, such packets were logged under chains named
|
||||||
'logdrop'.</li>
|
'logdrop'.</li>
|
||||||
<li>Distributors and developers seem to be regularly inventing
|
|
||||||
new naming conventions for kernel modules. To avoid the need to change
|
<li>Distributors and developers seem to be regularly inventing new
|
||||||
Shorewall code for each new convention, the MODULE_SUFFIX option has
|
naming conventions for kernel modules. To avoid the need to change
|
||||||
been added to shorewall.conf. MODULE_SUFFIX may be set to the suffix
|
Shorewall code for each new convention, the MODULE_SUFFIX option
|
||||||
for module names in your particular distribution. If MODULE_SUFFIX is
|
has been added to shorewall.conf. MODULE_SUFFIX may be set to the
|
||||||
not set in shorewall.conf, Shorewall will use the list "o gz ko o.gz".<br>
|
suffix for module names in your particular distribution. If
|
||||||
|
MODULE_SUFFIX is not set in shorewall.conf, Shorewall will use the
|
||||||
|
list "o gz ko o.gz".<br>
|
||||||
<br>
|
<br>
|
||||||
To see what suffix is used by your distribution:<br>
|
To see what suffix is used by your distribution:<br>
|
||||||
<br>
|
<br>
|
||||||
ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter<br>
|
ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter<br>
|
||||||
<br>
|
<br>
|
||||||
All of the files listed should have the same suffix (extension). Set
|
All of the files listed should have the same suffix (extension).
|
||||||
MODULE_SUFFIX to that suffix.<br>
|
Set MODULE_SUFFIX to that suffix.<br>
|
||||||
<br>
|
<br>
|
||||||
Examples:<br>
|
Examples:<br>
|
||||||
<br>
|
<br>
|
||||||
@ -161,18 +206,20 @@ Examples:<br>
|
|||||||
MODULE_SUFFIX="kzo"<br>
|
MODULE_SUFFIX="kzo"<br>
|
||||||
If all files end in ".kz.o" then set
|
If all files end in ".kz.o" then set
|
||||||
MODULE_SUFFIX="kz.o"</li>
|
MODULE_SUFFIX="kz.o"</li>
|
||||||
|
|
||||||
<li>Support for user defined rule ACTIONS has been implemented
|
<li>Support for user defined rule ACTIONS has been implemented
|
||||||
through two new files:<br>
|
through two new files:<br>
|
||||||
<br>
|
<br>
|
||||||
/etc/shorewall/actions - used to list the user-defined ACTIONS.<br>
|
/etc/shorewall/actions - used to list the user-defined ACTIONS.<br>
|
||||||
/etc/shorewall/action.template - For each user defined <action>,
|
/etc/shorewall/action.template - For each user defined
|
||||||
copy this file to /etc/shorewall/action.<action> and add the
|
<action>, copy this file to
|
||||||
appropriate rules for that <action>. Once an <action> has
|
/etc/shorewall/action.<action> and add the appropriate rules
|
||||||
been defined, it may be used like any of the builtin ACTIONS (ACCEPT,
|
for that <action>. Once an <action> has been defined,
|
||||||
DROP, etc.) in /etc/shorewall/rules.<br>
|
it may be used like any of the builtin ACTIONS (ACCEPT, DROP, etc.)
|
||||||
|
in /etc/shorewall/rules.<br>
|
||||||
<br>
|
<br>
|
||||||
Example: You want an action that logs a packet at the 'info' level and
|
Example: You want an action that logs a packet at the 'info' level
|
||||||
accepts the connection.<br>
|
and accepts the connection.<br>
|
||||||
<br>
|
<br>
|
||||||
In /etc/shorewall/actions, you would add:<br>
|
In /etc/shorewall/actions, you would add:<br>
|
||||||
<br>
|
<br>
|
||||||
@ -186,105 +233,122 @@ rules:<br>
|
|||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
<p><b>12/03/2003 - Support Torch Passed</b><b> <img
|
|
||||||
style="border: 0px solid ; width: 28px; height: 12px;"
|
<p><b>12/03/2003 - Support Torch Passed</b> <b><img style=
|
||||||
src="images/new10.gif" alt="(New)" title=""></b></p>
|
"border: 0px solid ; width: 28px; height: 12px;" src=
|
||||||
Effective today, I am reducing my participation in the
|
"images/new10.gif" alt="(New)" title=""></b></p>
|
||||||
day-to-day support of Shorewall. As part of this shift to
|
|
||||||
community-based Shorewall support a new <a
|
Effective today, I am reducing my participation in the day-to-day
|
||||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-newbies">Shorewall
|
support of Shorewall. As part of this shift to community-based
|
||||||
Newbies mailing list</a> has been established to field questions and
|
Shorewall support a new <a href=
|
||||||
problems from new users. I will not monitor that list personally. I
|
"https://lists.shorewall.net/mailman/listinfo/shorewall-newbies">Shorewall
|
||||||
will continue my active development of Shorewall
|
Newbies mailing list</a> has been established to field questions
|
||||||
and will be available via the development list to handle development
|
and problems from new users. I will not monitor that list
|
||||||
|
personally. I will continue my active development of Shorewall and
|
||||||
|
will be available via the development list to handle development
|
||||||
issues -- Tom.
|
issues -- Tom.
|
||||||
|
|
||||||
<p><b>11/07/2003 - Shorewall 1.4.8</b><b><br>
|
<p><b>11/07/2003 - Shorewall 1.4.8</b><b><br>
|
||||||
<br>
|
<br>
|
||||||
</b> Problems Corrected since version 1.4.7:<br>
|
</b> Problems Corrected since version 1.4.7:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Tuomo Soini has supplied a correction to a problem that
|
<li>Tuomo Soini has supplied a correction to a problem that occurs
|
||||||
occurs
|
|
||||||
using some versions of 'ash'. The symptom is that "shorewall start"
|
using some versions of 'ash'. The symptom is that "shorewall start"
|
||||||
fails with:<br>
|
fails with:<br>
|
||||||
<br>
|
<br>
|
||||||
local: --limit: bad variable name<br>
|
local: --limit: bad variable name<br>
|
||||||
iptables v1.2.8: Couldn't load match
|
iptables v1.2.8: Couldn't load match
|
||||||
`-j':/lib/iptables/libipt_-j.so:<br>
|
`-j':/lib/iptables/libipt_-j.so:<br>
|
||||||
cannot open shared object file: No such file or directory<br>
|
cannot open shared object file: No such file or
|
||||||
|
directory<br>
|
||||||
Try `iptables -h' or 'iptables --help' for more
|
Try `iptables -h' or 'iptables --help' for more
|
||||||
information.</li>
|
information.</li>
|
||||||
<li>Andres Zhoglo has supplied a correction that avoids trying
|
|
||||||
to use the multiport match iptables facility on ICMP rules.<br>
|
<li>Andres Zhoglo has supplied a correction that avoids trying to
|
||||||
|
use the multiport match iptables facility on ICMP rules.<br>
|
||||||
<br>
|
<br>
|
||||||
Example of rule that previously caused "shorewall start"
|
Example of rule that previously caused "shorewall
|
||||||
to fail:<br>
|
start" to fail:<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
ACCEPT loc $FW
|
ACCEPT loc $FW
|
||||||
icmp 0,8,11,12<br>
|
icmp 0,8,11,12<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
<li>Previously, if the following error message was issued,
|
<li>Previously, if the following error message was issued,
|
||||||
Shorewall was left in an inconsistent state.<br>
|
Shorewall was left in an inconsistent state.<br>
|
||||||
<br>
|
<br>
|
||||||
Error: Unable to determine the routes through interface xxx<br>
|
Error: Unable to determine the routes through
|
||||||
|
interface xxx<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Handling of the LOGUNCLEAN option in shorewall.conf has
|
|
||||||
been corrected.</li>
|
<li>Handling of the LOGUNCLEAN option in shorewall.conf has been
|
||||||
|
corrected.</li>
|
||||||
|
|
||||||
<li>In Shorewall 1.4.2, an optimization was added. This
|
<li>In Shorewall 1.4.2, an optimization was added. This
|
||||||
optimization
|
optimization involved creating a chain named "<zone>_frwd"
|
||||||
involved creating a chain named "<zone>_frwd" for most zones
|
for most zones defined using the /etc/shorewall/hosts file. It has
|
||||||
defined using the /etc/shorewall/hosts file. It has since been
|
since been discovered that in many cases these new chains contain
|
||||||
discovered that in many cases these new chains contain redundant rules
|
redundant rules and that the "optimization" turns out to be less
|
||||||
and that the "optimization" turns out to be less than optimal. The
|
than optimal. The implementation has now been corrected.</li>
|
||||||
implementation has now been corrected.</li>
|
|
||||||
<li>When the MARK value in a tcrules entry is followed by ":F"
|
<li>When the MARK value in a tcrules entry is followed by ":F" or
|
||||||
or
|
|
||||||
":P", the ":F" or ":P" was previously only applied to the first
|
":P", the ":F" or ":P" was previously only applied to the first
|
||||||
Netfilter rule generated by the entry. It is now applied to all entries.</li>
|
Netfilter rule generated by the entry. It is now applied to all
|
||||||
<li>An incorrect comment concerning Debian's use of the
|
entries.</li>
|
||||||
SUBSYSLOCK option has been removed from shorewall.conf.</li>
|
|
||||||
<li>Previously, neither the 'routefilter' interface option nor
|
<li>An incorrect comment concerning Debian's use of the SUBSYSLOCK
|
||||||
the
|
option has been removed from shorewall.conf.</li>
|
||||||
ROUTE_FILTER parameter were working properly. This has been corrected
|
|
||||||
(thanks to Eric Bowles for his analysis and patch). The definition of
|
<li>Previously, neither the 'routefilter' interface option nor the
|
||||||
the ROUTE_FILTER option has changed however. Previously,
|
ROUTE_FILTER parameter were working properly. This has been
|
||||||
ROUTE_FILTER=Yes was documented as enabling route filtering on all
|
corrected (thanks to Eric Bowles for his analysis and patch). The
|
||||||
interfaces (which didn't work). Beginning with this release, setting
|
definition of the ROUTE_FILTER option has changed however.
|
||||||
ROUTE_FILTER=Yes will enable route filtering of all interfaces brought
|
Previously, ROUTE_FILTER=Yes was documented as enabling route
|
||||||
up while Shorewall is started. As a consequence, ROUTE_FILTER=Yes can
|
filtering on all interfaces (which didn't work). Beginning with
|
||||||
coexist with the use of the 'routefilter' option in the interfaces file.</li>
|
this release, setting ROUTE_FILTER=Yes will enable route filtering
|
||||||
|
of all interfaces brought up while Shorewall is started. As a
|
||||||
|
consequence, ROUTE_FILTER=Yes can coexist with the use of the
|
||||||
|
'routefilter' option in the interfaces file.</li>
|
||||||
|
|
||||||
<li>If MAC verification was enabled on an interface with a /32
|
<li>If MAC verification was enabled on an interface with a /32
|
||||||
address and
|
address and a broadcast address then an error would occur during
|
||||||
a broadcast address then an error would occur during startup.</li>
|
startup.</li>
|
||||||
<li>he NONE policy's intended use is to suppress the generating
|
|
||||||
of
|
<li>he NONE policy's intended use is to suppress the generating of
|
||||||
rules that can't possibly be traversed. This means that a policy of
|
rules that can't possibly be traversed. This means that a policy of
|
||||||
NONE is inappropriate where the source or destination zone is $FW or
|
NONE is inappropriate where the source or destination zone is $FW
|
||||||
"all". Shorewall now generates an error message if such a policy is
|
or "all". Shorewall now generates an error message if such a policy
|
||||||
given in /etc/shorewall/policy. Previously such a policy caused
|
is given in /etc/shorewall/policy. Previously such a policy caused
|
||||||
"shorewall start" to fail.</li>
|
"shorewall start" to fail.</li>
|
||||||
|
|
||||||
<li>The 'routeback' option was broken for wildcard interfaces
|
<li>The 'routeback' option was broken for wildcard interfaces
|
||||||
(e.g.,
|
(e.g., "tun+"). This has been corrected so that 'routeback' now
|
||||||
"tun+"). This has been corrected so that 'routeback' now works as
|
works as expected in this case.<br>
|
||||||
expected in this case.<br>
|
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
Migration Issues:<br>
|
Migration Issues:<br>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The definition of the ROUTE_FILTER option in shorewall.conf
|
<li>The definition of the ROUTE_FILTER option in shorewall.conf has
|
||||||
has changed as described in item 8) above.<br>
|
changed as described in item 8) above.<br>
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
New Features:<br>
|
New Features:<br>
|
||||||
|
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>A new QUEUE action has been introduced for rules. QUEUE
|
<li>A new QUEUE action has been introduced for rules. QUEUE allows
|
||||||
allows
|
you to pass connection requests to a user-space filter such as
|
||||||
you to pass connection requests to a user-space filter such as ftwall
|
ftwall (http://p2pwall.sourceforge.net). The ftwall program allows
|
||||||
(http://p2pwall.sourceforge.net). The ftwall program
|
for effective filtering of p2p applications such as Kazaa. For
|
||||||
allows for effective filtering of p2p applications such as Kazaa. For
|
|
||||||
example, to use ftwall to filter P2P clients in the 'loc' zone, you
|
example, to use ftwall to filter P2P clients in the 'loc' zone, you
|
||||||
would add the following rules:<br>
|
would add the following rules:<br>
|
||||||
<br>
|
<br>
|
||||||
@ -295,76 +359,87 @@ would add the following rules:<br>
|
|||||||
QUEUE loc
|
QUEUE loc
|
||||||
fw udp<br>
|
fw udp<br>
|
||||||
<br>
|
<br>
|
||||||
You would normally want to place those three rules BEFORE any ACCEPT
|
You would normally want to place those three rules BEFORE any
|
||||||
rules for loc->net udp or tcp.<br>
|
ACCEPT rules for loc->net udp or tcp.<br>
|
||||||
<br>
|
<br>
|
||||||
Note: When the protocol specified is TCP ("tcp", "TCP" or "6"),
|
Note: When the protocol specified is TCP ("tcp", "TCP" or "6"),
|
||||||
Shorewall will only pass connection requests (SYN packets) to user
|
Shorewall will only pass connection requests (SYN packets) to user
|
||||||
space. This is for compatibility with ftwall.</li>
|
space. This is for compatibility with ftwall.</li>
|
||||||
<li>A BLACKLISTNEWNONLY option has been added to
|
|
||||||
shorewall.conf. When this option is set to "Yes", the blacklists
|
<li>A BLACKLISTNEWNONLY option has been added to shorewall.conf.
|
||||||
(dynamic and static) are only consulted for new connection requests.
|
When this option is set to "Yes", the blacklists (dynamic and
|
||||||
When set to "No" (the default if the variable is not set), the
|
static) are only consulted for new connection requests. When set to
|
||||||
blacklists are consulted on every packet.<br>
|
"No" (the default if the variable is not set), the blacklists are
|
||||||
|
consulted on every packet.<br>
|
||||||
<br>
|
<br>
|
||||||
Setting this option to "No" allows blacklisting to stop existing
|
Setting this option to "No" allows blacklisting to stop existing
|
||||||
connections from a newly blacklisted host but is more expensive in
|
connections from a newly blacklisted host but is more expensive in
|
||||||
terms of packet processing time. This is especially true if the
|
terms of packet processing time. This is especially true if the
|
||||||
blacklists contain a large number of entries.</li>
|
blacklists contain a large number of entries.</li>
|
||||||
<li>Chain names used in the /etc/shorewall/accounting file may
|
|
||||||
now begin with a digit ([0-9]) and may contain embedded dashes ("-").</li>
|
<li>Chain names used in the /etc/shorewall/accounting file may now
|
||||||
|
begin with a digit ([0-9]) and may contain embedded dashes
|
||||||
|
("-").</li>
|
||||||
</ol>
|
</ol>
|
||||||
<p><b>10/26/2003 - Shorewall 1.4.7a and 1.4.7b win brown paper
|
|
||||||
bag awards </b><b><img
|
<p><b>10/26/2003 - Shorewall 1.4.7a and 1.4.7b win brown paper bag
|
||||||
style="border: 0px solid ; width: 50px; height: 80px;"
|
awards</b> <b><img style=
|
||||||
src="images/j0233056.gif" align="middle" title="" alt="">Shorewall
|
"border: 0px solid ; width: 50px; height: 80px;" src=
|
||||||
|
"images/j0233056.gif" align="middle" title="" alt="">Shorewall
|
||||||
1.4.7c released.</b></p>
|
1.4.7c released.</b></p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The saga with "<zone>_frwd" chains continues. The
|
<li>The saga with "<zone>_frwd" chains continues. The 1.4.7c
|
||||||
1.4.7c
|
script produces a ruleset that should work for everyone even if it
|
||||||
script produces a ruleset that should work for everyone even if it is
|
is not quite optimal. My apologies for this ongoing mess.<br>
|
||||||
not
|
|
||||||
quite optimal. My apologies for this ongoing mess.<br>
|
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p><b>10/24/2003 - Shorewall 1.4.7b</b></p>
|
<p><b>10/24/2003 - Shorewall 1.4.7b</b></p>
|
||||||
|
|
||||||
<p>This is a bugfx rollup of the 1.4.7a fixes plus:<br>
|
<p>This is a bugfx rollup of the 1.4.7a fixes plus:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>The fix for problem 5 in 1.4.7a was wrong with the result
|
<li>The fix for problem 5 in 1.4.7a was wrong with the result that
|
||||||
that
|
"<zone>_frwd" chains might contain too few rules. That wrong
|
||||||
"<zone>_frwd" chains might contain too few rules. That wrong code
|
code is corrected in this release.<br>
|
||||||
is corrected in this release.<br>
|
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<p><b>10/21/2003 - Shorewall 1.4.7a</b></p>
|
<p><b>10/21/2003 - Shorewall 1.4.7a</b></p>
|
||||||
<p>This is a bugfix rollup of the following problem corrections:<br>
|
|
||||||
|
<p>This is a bugfix rollup of the following problem
|
||||||
|
corrections:<br>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<ol>
|
<ol>
|
||||||
<li>Tuomo Soini has supplied a correction to a problem that
|
<li>Tuomo Soini has supplied a correction to a problem that occurs
|
||||||
occurs
|
|
||||||
using some versions of 'ash'. The symptom is that "shorewall start"
|
using some versions of 'ash'. The symptom is that "shorewall start"
|
||||||
fails with:<br>
|
fails with:<br>
|
||||||
<br>
|
<br>
|
||||||
local: --limit: bad variable name<br>
|
local: --limit: bad variable name<br>
|
||||||
iptables v1.2.8: Couldn't load match
|
iptables v1.2.8: Couldn't load match
|
||||||
`-j':/lib/iptables/libipt_-j.so:<br>
|
`-j':/lib/iptables/libipt_-j.so:<br>
|
||||||
cannot open shared object file: No such file or directory<br>
|
cannot open shared object file: No such file or
|
||||||
|
directory<br>
|
||||||
Try `iptables -h' or 'iptables --help' for more
|
Try `iptables -h' or 'iptables --help' for more
|
||||||
information.<br>
|
information.<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Andres Zhoglo has supplied a correction that avoids trying
|
|
||||||
to use the multiport match iptables facility on ICMP rules.<br>
|
<li>Andres Zhoglo has supplied a correction that avoids trying to
|
||||||
|
use the multiport match iptables facility on ICMP rules.<br>
|
||||||
<br>
|
<br>
|
||||||
Example of rule that previously caused "shorewall start"
|
Example of rule that previously caused "shorewall
|
||||||
to fail:<br>
|
start" to fail:<br>
|
||||||
<br>
|
<br>
|
||||||
|
|
||||||
ACCEPT loc $FW
|
ACCEPT loc $FW
|
||||||
icmp 0,8,11,12<br>
|
icmp 0,8,11,12<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
<li>Previously, if the following error message was issued,
|
<li>Previously, if the following error message was issued,
|
||||||
Shorewall was left in an inconsistent state.<br>
|
Shorewall was left in an inconsistent state.<br>
|
||||||
<br>
|
<br>
|
||||||
@ -372,54 +447,59 @@ Shorewall was left in an inconsistent state.<br>
|
|||||||
interface xxx<br>
|
interface xxx<br>
|
||||||
<br>
|
<br>
|
||||||
</li>
|
</li>
|
||||||
<li>Handling of the LOGUNCLEAN option in shorewall.conf has
|
|
||||||
been corrected.</li>
|
<li>Handling of the LOGUNCLEAN option in shorewall.conf has been
|
||||||
|
corrected.</li>
|
||||||
|
|
||||||
<li>In Shorewall 1.4.2, an optimization was added. This
|
<li>In Shorewall 1.4.2, an optimization was added. This
|
||||||
optimization
|
optimization involved creating a chain named "<zone>_frwd"
|
||||||
involved creating a chain named "<zone>_frwd" for most zones
|
for most zones defined using the /etc/shorewall/hosts file. It has
|
||||||
defined using the /etc/shorewall/hosts file. It has since been
|
since been discovered that in many cases these new chains contain
|
||||||
discovered that in many cases these new chains contain redundant rules
|
redundant rules and that the "optimization" turns out to be less
|
||||||
and that the "optimization" turns out to be less than optimal. The
|
than optimal. The implementation has now been corrected.</li>
|
||||||
implementation has now been corrected.</li>
|
|
||||||
<li>When the MARK value in a tcrules entry is followed by ":F"
|
<li>When the MARK value in a tcrules entry is followed by ":F" or
|
||||||
or
|
|
||||||
":P", the ":F" or ":P" was previously only applied to the first
|
":P", the ":F" or ":P" was previously only applied to the first
|
||||||
Netfilter rule generated by the entry. It is now applied to all entries.<br>
|
Netfilter rule generated by the entry. It is now applied to all
|
||||||
|
entries.<br>
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
<ol>
|
|
||||||
</ol>
|
|
||||||
<p><b></b></p>
|
|
||||||
<ol>
|
|
||||||
</ol>
|
|
||||||
<p><a href="News.htm">More News</a></p>
|
<p><a href="News.htm">More News</a></p>
|
||||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
|
||||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
<p><a href="http://leaf.sourceforge.net" target="_top"><img border=
|
||||||
alt="(Leaf Logo)"> </a>Jacques Nilo and Eric Wolzak have a LEAF
|
"0" src="images/leaflogo.gif" width="49" height="36" alt=
|
||||||
(router/firewall/gateway on a floppy, CD or compact flash) distribution
|
"(Leaf Logo)"></a> Jacques Nilo and Eric Wolzak have a LEAF
|
||||||
called <i>Bering</i> that features Shorewall-1.4.2 and Kernel-2.4.20.
|
(router/firewall/gateway on a floppy, CD or compact flash)
|
||||||
You can find their work at: <a
|
distribution called <i>Bering</i> that features Shorewall-1.4.2 and
|
||||||
href="http://leaf.sourceforge.net/devel/jnilo">
|
Kernel-2.4.20. You can find their work at: <a href=
|
||||||
http://leaf.sourceforge.net/devel/jnilo<br>
|
"http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo<br>
|
||||||
|
|
||||||
</a></p>
|
</a></p>
|
||||||
|
|
||||||
<b>Congratulations to Jacques and Eric on the recent release of
|
<b>Congratulations to Jacques and Eric on the recent release of
|
||||||
Bering 1.2!!!<br>
|
Bering 1.2!!!<br>
|
||||||
<br>
|
<br>
|
||||||
</b>
|
</b>
|
||||||
|
|
||||||
<div style="text-align: center;">
|
<div style="text-align: center;">
|
||||||
<div style="text-align: center;"><a
|
<div style="text-align: center;"><a href="http://www.shorewall.net"
|
||||||
href="http://www.shorewall.net" target="_top"><img
|
target="_top"><img src="images/ProtectedBy.png" title="" alt=
|
||||||
src="images/ProtectedBy.png" title="" alt="(Protected by Shorewall)"
|
"(Protected by Shorewall)" style=
|
||||||
style="border: 0px solid ; width: 216px; height: 45px;"></a></div>
|
"border: 0px solid ; width: 216px; height: 45px;"></a></div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<h2><a name="Donations"></a>Donations</h2>
|
<h2><a name="Donations"></a>Donations</h2>
|
||||||
<p style="text-align: left;"><a href="http://www.starlight.org"> <img
|
|
||||||
style="border: 4px solid ; width: 57px; height: 100px;"
|
<p style="text-align: left;"><a href=
|
||||||
src="images/newlog.gif" align="left" hspace="10" alt="(Starlight Logo)"
|
"http://www.starlight.org"><img style=
|
||||||
|
"border: 4px solid ; width: 57px; height: 100px;" src=
|
||||||
|
"images/newlog.gif" align="left" hspace="10" alt="(Starlight Logo)"
|
||||||
title=""></a><br>
|
title=""></a><br>
|
||||||
<big>Shorewall is free but if you try it and find it useful,
|
<big>Shorewall is free but if you try it and find it useful,
|
||||||
please consider making a donation to <a href="http://www.starlight.org">Starlight
|
please consider making a donation to <a href=
|
||||||
Children's Foundation</a>. Thanks!</big><br>
|
"http://www.starlight.org">Starlight Children's Foundation</a>.
|
||||||
|
Thanks!</big><br>
|
||||||
<a href="http://www.starlight.org"></a></p>
|
<a href="http://www.starlight.org"></a></p>
|
||||||
</td>
|
</td>
|
||||||
</tr>
|
</tr>
|
||||||
@ -427,8 +507,10 @@ Children's Foundation</a>. Thanks!</big><br>
|
|||||||
</table>
|
</table>
|
||||||
</center>
|
</center>
|
||||||
</div>
|
</div>
|
||||||
<p><font size="2">Updated 12/07/2003 - <a href="support.htm">Tom Eastep</a></font>
|
|
||||||
<br>
|
<p><font size="2">Updated 12/07/2003 - <a href="support.htm">Tom
|
||||||
|
Eastep</a></font><br>
|
||||||
</p>
|
</p>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user