Update Config File Basics document

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2020-03-10 14:18:26 -07:00
parent a2e56492df
commit c80462c283
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10

View File

@ -18,7 +18,7 @@
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate> <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright> <copyright>
<year>2001-2019</year> <year>2001-2020</year>
<holder>Thomas M. Eastep</holder> <holder>Thomas M. Eastep</holder>
</copyright> </copyright>
@ -56,7 +56,7 @@
Shorewall</ulink> is required reading for being able to use this article Shorewall</ulink> is required reading for being able to use this article
effectively. For information about setting up your first Shorewall-based effectively. For information about setting up your first Shorewall-based
firewall, see the <ulink url="GettingStarted.html">Quickstart firewall, see the <ulink url="GettingStarted.html">Quickstart
Guides</ulink>.in</para> Guides</ulink>.</para>
</section> </section>
<section id="Files"> <section id="Files">
@ -327,6 +327,39 @@
page for that file is 'shorewall.conf':</para> page for that file is 'shorewall.conf':</para>
<programlisting>man shorewall.conf</programlisting> <programlisting>man shorewall.conf</programlisting>
<para>Parts of this and other articles are also available as
manpages:</para>
<itemizedlist>
<listitem>
<para>shorewall-addresses(5)</para>
</listitem>
<listitem>
<para>shorewall-exclusion(5)</para>
</listitem>
<listitem>
<para>shorewall-files(5)</para>
</listitem>
<listitem>
<para>shorewall-ipsets(5)</para>
</listitem>
<listitem>
<para>shorewall-logging(5)</para>
</listitem>
<listitem>
<para>shorewall-names(5)</para>
</listitem>
<listitem>
<para>shorewall-nesting(5)</para>
</listitem>
</itemizedlist>
</section> </section>
<section id="Comments"> <section id="Comments">
@ -534,7 +567,7 @@ ACCEPT net:\
readability as in:</para> readability as in:</para>
<simplelist> <simplelist>
<member><emphasis role="bold">{ proto=&gt;udp, port=1024 <member><emphasis role="bold">{ proto=&gt;udp, dport=1024
}</emphasis></member> }</emphasis></member>
</simplelist> </simplelist>
</listitem> </listitem>
@ -545,13 +578,14 @@ ACCEPT net:\
<simplelist> <simplelist>
<member><emphasis role="bold">; proto:udp, <member><emphasis role="bold">; proto:udp,
port:1024</emphasis></member> dport:1024</emphasis></member>
</simplelist> </simplelist>
<important> <important>
<para>This form is incompatible with INLINE_MATCHES=Yes. See the <para>This form is incompatible with INLINE_MATCHES=Yes. See the
INLINE_MATCHES option in <ulink INLINE_MATCHES option in <ulink
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para> url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>, if you
are running a version of Shorewall earlier than 5.0..</para>
</important> </important>
</listitem> </listitem>
</itemizedlist> </itemizedlist>
@ -1509,16 +1543,15 @@ SSH(ACCEPT) net:$MYIP $FW
<programlisting>    /etc/shorewall/params <programlisting>    /etc/shorewall/params
NET_IF=eth0 NET_IF=eth0
NET_BCAST=130.252.100.255
NET_OPTIONS=routefilter,routefilter NET_OPTIONS=routefilter,routefilter
    /etc/shorewall/interfaces record:     /etc/shorewall/interfaces record:
net $NET_IF $NET_BCAST $NET_OPTIONS net $NET_IF $NET_OPTIONS
    The result will be the same as if the record had been written     The result will be the same as if the record had been written
net eth0 130.252.100.255 routefilter,routefilter net eth0 routefilter,routefilter
</programlisting> </programlisting>
</blockquote> </blockquote>
@ -2193,7 +2226,7 @@ SSH(ACCEPT) net:$MYIP $FW
<important> <important>
<para>Beginning with Shorewall 4.5.11, the compiler's environmental <para>Beginning with Shorewall 4.5.11, the compiler's environmental
variables are search last rather than first.</para> variables are searched last rather than first.</para>
</important> </important>
<para>If the <replaceable>variable</replaceable> is still not <para>If the <replaceable>variable</replaceable> is still not
@ -2704,9 +2737,10 @@ POP(ACCEPT) loc net:pop.gmail.com</programlisting>
<section id="IPRanges"> <section id="IPRanges">
<title>IP Address Ranges</title> <title>IP Address Ranges</title>
<para>If you kernel and iptables have iprange match support, you may use <para>If you kernel and iptables have <emphasis>iprange</emphasis>
IP address ranges in Shorewall configuration file entries; IP address <emphasis>match</emphasis> <emphasis>support</emphasis>, you may use IP
ranges have the syntax &lt;<emphasis>low IP address ranges in Shorewall configuration file entries; IP address ranges
have the syntax &lt;<emphasis>low IP
address</emphasis>&gt;-&lt;<emphasis>high IP address</emphasis>&gt;. address</emphasis>&gt;-&lt;<emphasis>high IP address</emphasis>&gt;.
Example: 192.168.1.5-192.168.1.12.</para> Example: 192.168.1.5-192.168.1.12.</para>
@ -2714,16 +2748,15 @@ POP(ACCEPT) loc net:pop.gmail.com</programlisting>
the <command>shorewall show capabilities</command> command:</para> the <command>shorewall show capabilities</command> command:</para>
<programlisting>&gt;~ <command>shorewall show capabilities</command> <programlisting>&gt;~ <command>shorewall show capabilities</command>
...
Shorewall has detected the following iptables/netfilter capabilities: Shorewall has detected the following iptables/netfilter capabilities:
NAT: Available ACCOUNT Target (ACCOUNT_TARGET): Not available
Packet Mangling: Available Address Type Match (ADDRTYPE): Available
Multi-port Match: Available Amanda Helper: Available
Connection Tracking Match: Available ...
Packet Type Match: Not available IPMARK Target (IPMARK_TARGET): Not available
Policy Match: Available IPP2P Match (IPP2P_MATCH): Not available
Physdev Match: Available <emphasis role="bold">IP range Match(IPRANGE_MATCH): Available</emphasis> <emphasis
<emphasis role="bold">IP range Match: Available &lt;--------------</emphasis></programlisting> role="bold">&lt;================</emphasis></programlisting>
</section> </section>
<section id="Ports"> <section id="Ports">
@ -2860,7 +2893,7 @@ neighbour-solicitation =&gt; 135
neighbour-advertisement =&gt; 136 neighbour-advertisement =&gt; 136
redirect =&gt; 137</programlisting> redirect =&gt; 137</programlisting>
<para>Shorewall 4.4 does not accept lists if ICMP (ICMP6) types prior to <para>Shorewall 4.4 does not accept lists of ICMP (ICMP6) types prior to
Shorewall 4.4.19.</para> Shorewall 4.4.19.</para>
</section> </section>