diff --git a/manpages/shorewall-modules.xml b/manpages/shorewall-modules.xml
index 410fbd136..051a421c0 100644
--- a/manpages/shorewall-modules.xml
+++ b/manpages/shorewall-modules.xml
@@ -43,7 +43,12 @@
The /usr/share/shorewall/modules file contains a large number of
modules. Users are encouraged to copy the file to /etc/shorewall/modules
- and modify the copy to load only the modules required.
+ and modify the copy to load only the modules required.
+ If you build monolithic kernels and have not installed
+ module-init-tools, then create an empty /etc/shorewall/modules file;
+ that will prevent Shorewall from trying to load modules at all.
+
+
diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml
index 09c1cab02..7a2d26a59 100644
--- a/manpages/shorewall-rules.xml
+++ b/manpages/shorewall-rules.xml
@@ -618,7 +618,7 @@
intra-zone traffic is affected.
If the DEST zone is a bport zone,
- then either:
+ then either:the SOURCE must be , or
@@ -632,73 +632,77 @@
the SOURCE zone must be an
ipv4 zone that is associated with only the same bridge.
- Except when all[+]|[-]
- is specified, the server may be further restricted to a particular
- network, host or interface by appending ":" and the network, host or
- interface. See SOURCE above.
-
- You may exclude certain hosts from the set already defined
- through use of an exclusion (see shorewall-exclusion(5)).
-
- Restrictions:
-
- 1. MAC addresses are not allowed (this is a Netfilter
- restriction).
-
- 2. In DNAT rules, only IP
- addresses are allowed; no FQDNs or subnet addresses are
- permitted.
-
- 3. You may not specify both an interface and an
- address.
-
- Like in the SOURCE column,
- you may specify a range of IP addresses using the syntax
- lowaddress-highaddress.
- When the ACTION is DNAT or DNAT-, the connections will be assigned to
- addresses in the range in a round-robin fashion.
-
- If you kernel and iptables have ipset match support then you
- may give the name of an ipset prefaced by "+". The ipset name may be
- optionally followed by a number from 1 to 6 enclosed in square
- brackets ([]) to indicate the number of levels of destination
- bindings to be matched. Only one of the SOURCE and DEST columns may specify an ipset
- name.
-
- The port that the server is
- listening on may be included and separated from the server's IP
- address by ":". If omitted, the firewall will not modifiy the
- destination port. A destination port may only be included if the
- ACTION is DNAT or REDIRECT. Example:
-
-
-
- Example:
-
-
- loc:192.168.1.3:3128
- specifies a local server at IP address 192.168.1.3 and
- listening on port 3128. The port number MUST be specified as
- an integer and not as a name from services(5).
-
-
-
+
- if the ACTION is REDIRECT or REDIRECT-, this column needs only to
- contain the port number on the firewall that the request should be
- redirected to. That is equivalent to specifying
- ::port.
+ Except when all[+]|[-] is specified, the server may be
+ further restricted to a particular network, host or interface by
+ appending ":" and the network, host or interface. See SOURCE above.
+
+ You may exclude certain hosts from the set already defined
+ through use of an exclusion (see shorewall-exclusion(5)).
+
+ Restrictions:
+
+ 1. MAC addresses are not allowed (this is a Netfilter
+ restriction).
+
+ 2. In DNAT rules, only IP
+ addresses are allowed; no FQDNs or subnet addresses are
+ permitted.
+
+ 3. You may not specify both an interface and an
+ address.
+
+ Like in the SOURCE column,
+ you may specify a range of IP addresses using the syntax
+ lowaddress-highaddress.
+ When the ACTION is DNAT or DNAT-, the connections will be assigned to
+ addresses in the range in a round-robin fashion.
+
+ If you kernel and iptables have ipset match support then you
+ may give the name of an ipset prefaced by "+". The ipset name may
+ be optionally followed by a number from 1 to 6 enclosed in square
+ brackets ([]) to indicate the number of levels of destination
+ bindings to be matched. Only one of the SOURCE and DEST columns may specify an ipset
+ name.
+
+ The port that the server is
+ listening on may be included and separated from the server's IP
+ address by ":". If omitted, the firewall will not modifiy the
+ destination port. A destination port may only be included if the
+ ACTION is DNAT or REDIRECT. Example:
+
+
+
+ Example:
+
+
+ loc:192.168.1.3:3128
+ specifies a local server at IP address 192.168.1.3 and
+ listening on port 3128. The port number MUST be specified as
+ an integer and not as a name from services(5).
+
+
+
+
+
+ if the ACTION is
+ REDIRECT or REDIRECT-, this column needs only to
+ contain the port number on the firewall that the request should
+ be redirected to. That is equivalent to specifying
+ ::port.
+