From cb729487399affaf9028ce9c5afa9f573478141c Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Fri, 18 May 2012 07:27:33 -0700 Subject: [PATCH] Add Geoip match to config basics doc. Clarify variable search algorithm. Signed-off-by: Tom Eastep --- docs/configuration_file_basics.xml | 33 ++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml index 8269cfefa..a7b5d2b60 100644 --- a/docs/configuration_file_basics.xml +++ b/docs/configuration_file_basics.xml @@ -834,7 +834,7 @@ DNAT { source=net dest=loc:10.0.0.1 proto=tcp dport=80 mark=88 } ADDRESS LIST — A list of one or more addresses (host or network) or address ranges, separated by commas. In an IPv6 configuration, this - list must be includef in square or angled brackets ("[...]" or + list must be included in square or angled brackets ("[...]" or "<...>"). The list may have exclusion. @@ -875,7 +875,7 @@ DNAT { source=net dest=loc:10.0.0.1 proto=tcp dport=80 mark=88 } Host 2002:ce7c:92b4:1:a00:27ff:feb1:46a9 in the loc zone — loc:[2002:ce7c:92b4:1:a00:27ff:feb1:46a9] + role="bold">loc::[2002:ce7c:92b4:1:a00:27ff:feb1:46a9] @@ -883,6 +883,12 @@ DNAT { source=net dest=loc:10.0.0.1 proto=tcp dport=80 mark=88 }$FW:&eth0 (see Run-time Address Variables below) + + + All hosts in Vatican City - net:^VA (Shorwall 4.5.4 and later - See this article). + @@ -1517,12 +1523,23 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2> /dev/null || true - If the variable is still not found and it - begins with '__', then those leading characters are stripped off and the - result is searched for in the defined capabilities. - The current set of capabilities may be obtained by the command - shorewall show capabilities (the capability names are - in parentheses). + If the variable is still not + found: + + + + it begins with '__', then those leading characters are stripped + off. + + + + the variable is then searched for in the defined + capabilities. The current set of capabilities + may be obtained by the command shorewall show + capabilities (the capability names are in + parentheses). + + If it is not found in any of those places, the variable is assumed to have a value of 0