diff --git a/docs/traffic_shaping.xml b/docs/traffic_shaping.xml index 119023860..8c87e0da1 100644 --- a/docs/traffic_shaping.xml +++ b/docs/traffic_shaping.xml @@ -1278,6 +1278,58 @@ SAVE 0.0.0.0/0 0.0.0.0/0 all - - - /sbin/shorewall refresh +
+ Sharing a TC configuration between Shorewall and + Shorewall6 + + Beginning with Shorewall 4.4.15, the traffic-shaping configuration + in the tcdevices, tcclasses and tcfilters files can be shared between + Shorewall and Shorewall6. Only one of the products can control the + configuration but the other can configure CLASSIFY rules in its own + tcrules file that refer to the shared classes. + + To defined the configuration in Shorewall and shared it with + Shorewall6: + + + + Set TC_ENABLED=Internal in shorewall.conf + (5). + + + + Set TC_ENABLED=SHARED in shorewall6.conf + (5). + + + + Create symbolic links from /etc/shorewall6 to + /etc/shorewall/tcdevices and /etc/shorewall/tcclasses: + + ln -s ../shorewall/tcdevices /etc/shorewall6/tcdevices +ln -s ../shorewall/tcclasses /etc/shorewall6/tcclasses + + + + If you need to define IPv6 tcfilter entries, do so in + /etc/shorewall/tcfilters. That file now allows entries that apply to + IPv6. + + + + Shorewall6 compilations to have access to the tcdevices and + tcclasses files although it will create no output. That access allows + CLASSIFY rules in /etc/shorewall6/tcrules to be validated against the TC + configuration. + + In this configuration, it is Shorewall that controls TC + configuration (except for IPv6 tcrules). You can reverse the settings in + the files if you want to control the configuration using + Shorewall6. +
+
Per-IP Traffic Shaping diff --git a/manpages/shorewall.conf.xml b/manpages/shorewall.conf.xml index 395da4453..4c08bbe3e 100644 --- a/manpages/shorewall.conf.xml +++ b/manpages/shorewall.conf.xml @@ -1645,7 +1645,7 @@ net all DROP infothen the chain name is 'net2all' role="bold">Yes|No|Internal|Simple] + role="bold">Simple|Shared] If you say Yes or then the chain name is 'net2all' If you set TC_ENABLED=Internal or internal or leave the option empty then Shorewall will use its builtin traffic shaper (tc4shorewall written by Arne Bernin. + + Beginning with Shorewall 4.4.15, you can set + TC_ENABLED=Shared. This allows you to configure the tcdevices and + tcclasses in your Shorewall6 configuration yet make them available + to the compiler when compiling your Shorewall configuration. In + addition to setting TC_ENABLED=Shared, you need to create symbolic + links from your Shorewall configuration directory (normally + /etc/shorewall/) to the tcdevices and tcclasses files in your + Shorewall6 configuration directory (normally + /etc/shorewall6/). diff --git a/manpages6/shorewall6.conf.xml b/manpages6/shorewall6.conf.xml index fbc6c228e..e4055df16 100644 --- a/manpages6/shorewall6.conf.xml +++ b/manpages6/shorewall6.conf.xml @@ -1351,7 +1351,7 @@ net all DROP infothen the chain name is 'net2all' TC_ENABLED=[Yes|No|Internal] + role="bold">Internal|Shared] If you say Yes or then the chain name is 'net2all' empty then Shorewall6 will use its builtin traffic shaper (tc4shorewall6 written by Arne Bernin. + Beginning with Shorewall 4.4.15, if you set TC_ENABLED=Shared + or shared, then you should create symbolic links from your + Shorewall6 configuration directory (normally + /etc/shorewall6/) to your Shorewall + tcdevices and tcclasses + files. This allows the compiler to have access to your Shorewall + traffic shaping configuration so that it can validate CLASSIFY rules + in shorewall6-tcrules + (5). + If you also run Shorewall and if you have TC_ENABLED=Internal in your shorewall-conf(5), - then you will want TC_ENABLED=No in this file. + then you will want TC_ENABLED=No or TC_ENABLED=Shared in this + file.