diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index 02418913b..130246972 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -3745,8 +3745,8 @@ sub do_condition( $ ) { return '' if $condition eq '-'; - require_capability 'CONDITION_MATCH', 'A non-empty CONDITION column', 's'; - fatal_error "Invalid condition name ($condition)" unless $condition =~ /^[a-zA-Z]\w*$/; + require_capability 'CONDITION_MATCH', 'A non-empty SWITCH column', 's'; + fatal_error "Invalid switch name ($condition)" unless $condition =~ /^[a-zA-Z][-\w]*$/; "-m condition --condition $condition " } diff --git a/Shorewall/configfiles/rules b/Shorewall/configfiles/rules index 068b23ff9..ca0f874b5 100644 --- a/Shorewall/configfiles/rules +++ b/Shorewall/configfiles/rules @@ -7,7 +7,7 @@ # http://www.shorewall.net/manpages/shorewall-rules.html # ###################################################################################################################################################################################### -#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS CONDITION +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH # PORT PORT(S) DEST LIMIT GROUP #SECTION ALL #SECTION ESTABLISHED diff --git a/Shorewall6/configfiles/rules b/Shorewall6/configfiles/rules index ba9607de5..cdbb68620 100644 --- a/Shorewall6/configfiles/rules +++ b/Shorewall6/configfiles/rules @@ -6,8 +6,8 @@ # The manpage is also online at # http://www.shorewall.net/manpages6/shorewall6-rules.html # -####################################################################################################################################################################### -#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS +########################################################################################################################################################################### +#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH # PORT PORT(S) DEST LIMIT GROUP #SECTION ALL #SECTION ESTABLISHED diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml index fe1a60e30..91abb1967 100644 --- a/docs/configuration_file_basics.xml +++ b/docs/configuration_file_basics.xml @@ -1604,7 +1604,7 @@ DNAT net loc:192.168.1.3 tcp 4000:4100 LOGLIMIT. - Shorewall also supports per-IP rate limiting. + Shorewall also supports per-IP rate limiting. Another example from shorewall.conf (5): @@ -1624,6 +1624,52 @@ DNAT net loc:192.168.1.3 tcp 4000:4100 above. +
+ Switches + + There are times when you would like to enable or disable one or more + rules in the configuration without having to do a shorewall + restart. This may be accomplished using the SWITCH column in + shorewall-rules (5) or + shorewall6-rules (5). + Using this column requires that your kernel and iptables include + Condition Match Support and you must be running + Shorewall 4.4.24 or later. See the output of shorewall show + capabilities and shorewall version to + determine if you can use this feature. As of this writing, Condition Match + Support requires that you install xtables-addons. + + The SWITCH column contains the name of a + switch. Each switch that is normally initially in + the off position. You can turn on the switch condition named + switch1 by: + + + echo 1 > + /proc/net/nf_condition/switch1 + + + You can turn it off again by: + + + echo 0 > + /proc/net/nf_condition/switch1 + + + If you simply include the switch name in the SWITCH column, then the + rule is enabled only when the switch is on. If you precede the switch name + with ! (e.g., !switch1), then the rule is enabled only when the switch is + off. + + + The shorewall restart command resets all + switches to off. + + + Shorewall requires that switch names begin with a letter and be + composed of letters, digits, underscore ('_') or hyphen ('-'). +
+
Logical Interface Names diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml index 6009b4d4d..a0c9164ca 100644 --- a/manpages/shorewall-rules.xml +++ b/manpages/shorewall-rules.xml @@ -1279,16 +1279,33 @@ - CONDITION - - [!]condition-name + SWITCH - + [!]switch-name Added in Shorewall 4.4.24. Matches if the value stored in - /proc/net/nf_condition/condition-name + /proc/net/nf_condition/switch-name is 1. Does not match if that file contains 0 (the default). If '!' is supplied, the test is inverted such that there is a match if the - file contains 0. The condition-name must begin with a letter and be - composed of letters, decimal digits or underscores. + file contains 0. The switch-name must begin with a letter and be + composed of letters, decimal digits, underscores or hyphens. + + Switches are normally off. To turn on a switch: + + + echo 1 > + /proc/net/nf_condition/switch-name + + + To turn it off again: + + + echo 0 > + /proc/net/nf_condition/switch-name + + + The shorewall restart command turns all + switches off. @@ -1486,10 +1503,10 @@ Example 12: - Forward port 80 to dmz host $BACKUP if condition - 'primary_down' is set. + Forward port 80 to dmz host $BACKUP if switch 'primary_down' + is on. - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS CONDITION + #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH # PORT(S) PORT(S) DEST LIMIT GROUP DNAT net dmz:$BACKUP tcp 80 - - - - - - - - primary_down diff --git a/manpages6/shorewall6-rules.xml b/manpages6/shorewall6-rules.xml index ecebf06bf..33ca3784f 100644 --- a/manpages6/shorewall6-rules.xml +++ b/manpages6/shorewall6-rules.xml @@ -1104,16 +1104,33 @@ - CONDITION - - [!]condition-name + SWITCH - + [!]switch-name Added in Shorewall6 4.4.24. Matches if the value stored in - /proc/net/nf_condition/condition-name + /proc/net/nf_condition/switch-name is 1. Does not match if that file contains 0 (the default). If '!' is supplied, the test is inverted such that there is a match if the - file contains 0. The condition-name must begin with a letter and be - composed of letters, decimal digits or underscores. + file contains 0. The switch-name must begin with a letter and be + composed of letters, decimal digits, underscores or hyphens. + + Switches are normally off. To turn on a switch: + + + echo 1 > + /proc/net/nf_condition/switch-name + + + To turn it off again: + + + echo 0 > + /proc/net/nf_condition/switch-name + + + The shorewall6 restart command turns all + switches off.