Decommision the WWW mirror at SourceForge

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2966 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall-Website/News.htm

@@ -20,14 +20,410 @@ Texts. A copy of the license is included in the section entitled “<span
  class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
 Documentation License</a></span>”.<br>
 </p>
-<p>2005-10-05<br>
+<p>2005-11-11<br>
 </p>
-<hr style="width: 100%; height: 2px;"> <span style="font-weight: bold;">10/05/2005
+<hr style="width: 100%; height: 2px;"> <span style="font-weight: bold;">11/11/2005
+Shorewall 3.0.0</span><br>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<meta name="Generator" content="Kate, the KDE Advanced Text Editor">
+<pre>New Features in Shorewall 3.0.0<br><br>1) Error and warning messages are made easier to spot by using
+   capitalization (e.g., ERROR: and WARNING:).<br><br>2) A new option 'critical' has been added to
+   /etc/shorewall/routestopped. This option can be used to enable
+   communication with a host or set of hosts during the entire
+   "shorewall [re]start/stop" process. Listing a host with this option
+   differs from listing it without the option in several ways:
+
+   a) The option only affect traffic between the listed host(s) and the
+   firewall itself.
+
+   b) If there are any entries with 'critical', the firewall
+   will be completely opened briefly during start, restart and stop but
+   there will be no chance of any packets to/from the listed host(s)
+   being dropped or rejected.
+
+   Possible uses for this option are:
+
+   a) Root file system is NFS mounted. You will want to list the NFS server
+   in the 'critical' option.
+
+   b) You are running Shorewall in a Crossbeam environment
+   (www.crossbeam.com). You will want to list the Crossbeam interface
+   in this option
+
+3) A new 'macro' feature has been added.
+
+   Macros are very similar to actions and can be used in similar
+   ways. The differences between actions and macros are as follows:
+
+   a) An action creates a separate chain with the same name as the
+      action (when logging is specified on the invocation of an action,
+      a chain beginning with "%" followed by the name of the action and
+      possibly followed by a number is created). When a macro is
+      invoked, it is expanded in-line and no new chain is created.
+
+   b) An action may be specified as the default action for a policy;
+      macros cannot be specified this way.
+
+   c) Actions must be listed in either /usr/share/shorewall/actions.std
+      or in /etc/shorewall/actions. Macros are defined simply by
+      placing their definition file in the CONFIG_PATH.
+
+   d) Actions are defined in a file with a name beginning with
+      "action." and followed by the name of the action. Macro files are
+      defined in a file with a name beginning with "macro.".
+
+   e) Actions may invoke other actions. Macros may not directly invoke
+      other macros although they may invoke other macros indirectly
+      through an action.
+
+   f) DNAT[-] and REDIRECT[-] rules may not appear in an action. They
+      are allowed in a macro with the restriction that the a macro
+      containing one of these rules may not be invoked from an action.
+
+   g) The values specified in the various columns when you invoke a
+      macro are substituted in the corresponding column in each rule in
+      the macro. The first three columns get special treatment:
+
+      ACTION	 If you code PARAM as the action in a macro then
+		 when you invoke the macro, you can include the
+		 name of the macro followed by a slash ("/") and
+		 an ACTION (either built-in or user-defined. All
+		 instances of PARAM in the body of the macro will be
+		 replaced with the ACTION.
+
+		 Any logging applied when the macro is invoked is
+		 applied following the same rules as for actions.
+
+      SOURCE and
+      DEST	 If the rule in the macro file specifies a value and
+		 the invocation of the rule also specifies a value then
+		 the value in the invocation is appended to the value
+		 in the rule using ":" as a separator.
+
+		 Example:
+
+		 /etc/shorewall/macro.SMTP
+
+		 PARAM		-	loc	tcp	25
+
+		 /etc/shorewall/rules:
+
+		 SMTP/DNAT:info		net	192.168.1.5
+
+		 Would be equivalent to the following in the rules file:
+
+		 DNAT:info	   net	loc:192.168.1.5	tcp	25
+
+      Rest	 Any value in the invocation replaces the value in the
+		 rule in the macro.
+
+    One additional restriction applies to the mixing of macros and
+    actions. Macros that are invoked from actions cannot themselves
+    invoke other actions.
+
+4)  If you have 'make' installed on your firewall, then when you use
+    the '-f' option to 'shorewall start' (as happens when you reboot),
+    if your /etc/shorewall/ directory contains files that were modified
+    after Shorewall was last restarted then Shorewall is started using
+    the config files rather than using the saved configuration.
+
+5)  The 'arp_ignore' option has been added to /etc/shorewall/interfaces
+    entries. This option sets
+    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_ignore. By default, the
+    option sets the value to 1. You can also write arp_ignore=&lt;value&gt;
+    where value is one of the following:
+
+        1 - reply only if the target IP address is local address
+        configured on the incoming interface
+
+	2 - reply only if the target IP address	is local address
+	configured on the incoming interface and both with the sender's
+	IP address are part from same subnet on this interface
+
+	3 - do not reply for local addresses configured with scope
+	host, only resolutions for global and link addresses are
+	replied
+
+	4-7 - reserved
+
+ 	8 - do not reply for all local addresses
+
+    WARNING -- DO NOT SPECIFY arp_ignore FOR ANY INTERFACE INVOLVED IN
+    PROXY ARP.
+
+6)  In /etc/shorewall/rules, "all+" in the SOURCE or DEST column works
+    like "all" but also includes intrazone traffic. So the rule:
+
+	 ACCEPT     loc		 all+	 tcp	   22
+
+    would allow SSH traffic from loc-&gt;loc whereas
+
+	 ACCEPT     loc		 all	 tcp	   22
+
+    does not.
+
+7)  A new FASTACCEPT option has been added to shorewall.conf.
+
+    Normally, Shorewall defers accepting ESTABLISHED/RELATED packets
+    until these packets reach the chain in which the original connection
+    was accepted. So for packets going from the 'loc' zone to the 'net'
+    zone, ESTABLISHED/RELATED packets are ACCEPTED in the 'loc2net'
+    chain.
+
+    If you set FASTACCEPT=Yes, then ESTABLISHED/RELEATED packets are
+    accepted early in the INPUT, FORWARD and OUTPUT chains. If you set
+    FASTACCEPT=Yes then you may not include rules in the ESTABLISHED or
+    RELATED sections of /etc/shorewall/rules.
+
+8)  Shorewall now generates an error if the 'norfc1918' option is
+    specified for an interface with an RFC 1918 address.
+
+9)  You may now specify "!" followed by a list of addresses in the
+    SOURCE and DEST columns of entries in /etc/shorewall/rules,
+    /etc/shorewall/tcrules and in action files and Shorewall will
+    generate the rule that you expect.
+
+    Example 1 (/etc/shorewall/rules):
+
+    #ACTION    SOURCE				DEST	PROTO     DEST PORT(S)
+    ACCEPT     loc:!192.168.1.0/24,10.0.0.0/8	net	tcp	  80
+
+    That rule would allow loc-&gt;net HTTP access except for the local
+    networks 192.168.1.0/24 and 10.0.0.0/8.
+
+    Example 2 (/etc/shorewall/rules):
+
+    #ACTION    SOURCE				DEST	PROTO     DEST PORT(S)
+    ACCEPT     loc:10.0.0.0/24!10.0.0.4,10.0.0.22 \
+						net	tcp	  80
+
+    That rule would allow loc-&gt;net HTTP access from the local
+    network 10.0.0.0/24 except for hosts 10.0.0.4 and 10.0.0.22.
+
+10) Tunnel types "openvpnserver" and "openvpnclient" have been added
+    to reflect the introduction of client and server OpenVPN
+    configurations in OpenVPN 2.0.
+
+11) The COMMAND variable is now set to 'restore' in restore
+    scripts. The value of this variable is sometimes of interest to
+    programmers providing custom /etc/shorewall/tcstart scripts.
+
+12) Previously, if you defined any intra-zone rule(s) then any traffic
+    not matching the rule(s) was subject to normal policies (which
+    usually turned out to involve the all-&gt;all REJECT policy). Now, the
+    intra-zone ACCEPT policy will still be in effect in the presence of
+    intra-zone rules. That policy can still be overridden by an
+    explicit policy in your /etc/shorewall/policy file.
+
+    Example:
+
+    /etc/shorewall/rules:
+
+    DNAT	loc:!192.168.1.4  loc:192.168.1.4:3128	tcp	80
+
+    Any other loc-&gt;loc traffic will still be accepted. If you want to
+    also log that other loc-&gt;loc traffic at the info log level then
+    insert this into /etc/shorewall/policy:
+
+    #SOURCE	DEST	POLICY	LOG LEVEL
+    loc		loc	ACCEPT	info
+
+13) Prior to Shorewall 2.5.3, the rules file only controlled packets in
+    the Netfilter states NEW and INVALID. Beginning with this release,
+    the rules file can also deal with packets in the ESTABLISHED and
+    RELATED states.
+
+    The /etc/shorewall/rules file may now be divided into
+    "sections". Each section is introduced by a line that begins with
+    the keyword SECTION followed by the section name. Sections
+    are as listed below and must appear in the order shown.
+
+    ESTABLISHED
+
+	Rules in this section apply to packets in the ESTABLISHED
+	state.
+
+    RELATED
+
+	Rules in this section apply to packets in the RELATED state.
+
+    NEW
+
+	Rules in this section apply to packets in the NEW and INVALID
+	states.
+
+    Rules in the ESTABLISHED and RELATED sections are limited to the
+    following ACTIONs:
+
+	ACCEPT, DROP, REJECT, QUEUE, LOG and User-defined actions.
+
+    Macros may be used in these sections provided that they expand to
+    only these ACTIONs.
+
+    At the end of the ESTABLISHED and RELATED sections, there is an
+    implicit "ALLOW   all	  all all" rule.
+
+    RESTRICTION: If you specify FASTACCEPT=Yes in
+    /etc/shorewall.shorewall.conf then the ESTABLISHED and RELATED
+    sections must be empty.
+
+14) The value 'ipp2p' is once again allowed in the PROTO column of
+    the rules file. It is recommended that rules specifying 'ipp2p'
+    only be included in the ESTABLISHED section of the file.
+
+
+15) Shorewall actions lack a generalized way to pass parameters to an
+    extension script associated with an action. To work around this
+    lack, some users have used the log tag as a parameter. This works
+    but requires that a log level other than 'none' be specified when
+    the action is invoked. Beginning with this release, you can invoke
+    an action with 'none'.
+
+    Example:
+
+	#ACTION				SOURCE          DEST
+	A:none:these,are,parameters     $FW		net
+
+    When /etc/shorewall/A is invoked, the LEVEL variable will be empty
+    but the TAG variable will contain "these,are,parameters" which
+    can be easily parsed to isolate "these", "are" and "parameters":
+
+	ifs=$IFS
+	IFS=,
+	set -- $TAG
+	IFS=$ifs
+
+    Now, $1 = these, $2 = are and $3 = parameters
+
+16) The "shorewall check" command now checks the /etc/shorewall/masq,
+    /etc/shorewall/blacklist, /etc/shorewall/proxyarp,
+    /etc/shorewall/nat and /etc/shorewall/providers files.
+
+17) Arne Bernin's "tc4shorewall" package has been integrated into
+    Shorewall.
+
+    See: http://www.shorewall.net/3.0/traffic_shaping.htm for details.
+
+    Thanks, Arne!
+
+18) When /usr/share/shorewall/functions is loaded it now sets
+
+	 SHOREWALL_LIBRARY=Loaded
+
+    Application code such as /etc/shorewall/tcstart may test that
+    variable to determine if the library has been loaded into the
+    current shell process.
+
+19) The install.sh script now does a much cleaner job of backing up the
+    current installation. It copies the directories /etc/shorewall,
+    /usr/share/shorewall and /var/lib/shorewall to a directory of the
+    same name with "-$VERSION.bkout" appended. The init script and
+    /sbin/shorewall are backed up to the /usr/share/shorewall and
+    /var/lib/shorewall directories respectively. This makes it very
+    simple to remove the backups:
+
+	   rm -rf /etc/shorewall-*.bkout
+	   rm -rf /usr/share/shorewall-*.bkout
+	   rm -rf /var/lib/shorewall-*.bkout
+
+20) A new '-n' option has been added to the "start", "restart",
+    "restore",  "stop" and "try" commands. This option instructs
+    Shorewall to not alter the routing in any way.
+
+    This option is useful when you have a multi-ISP environment because
+    it prevents the route cache from being flushed which preserves the
+    mapping of end-point address pairs to routes.
+
+21) The output of "shorewall dump" now includes a capabilities report
+    such as the one produced by "shorewall show capabilities".
+
+22) The "plain" zone type has been replaced by "ipv4". The types
+    "IPv4" and "IPV4" are synonyms for "ipv4". In addition, "IPSEC",
+    "ipsec4" and "IPSEC4" are recognized synonyms for "ipsec".
+
+23) The NEWNOTSYN and LOGNEWNOTSYN options in shorewall.conf have been
+    removed as have the 'newnotsyn' options in /etc/shorewall/interfaces
+    and /etc/shorewall/hosts. See the Migration Considerations for
+    instructions if you wish to block "new-not-syn" TCP packets.
+
+24) The "shorewall show zones" command now displays the zone type. You
+    must have restarted Shorewall using this release before this feature
+    will work correctly.
+
+25) The multi-ISP code now requires that that you set MARK_IN_FORWARD_CHAIN=Yes
+    in shorewall.conf. This is done to ensure that "shorewall refresh" will
+    work correctly.
+
+26) Shorewall now supports UDP IPP2P matching. In addition to the "ipp2p"
+    keyword in the PROTOCOL column of the relevant files, the following
+    values may be specified:
+
+	ipp2p:tcp           Equivalent to ipp2p and matches TCP traffic
+			    only.
+	ipp2p:udp           Matches UDP traffic.
+	ipp2p:all           Matches both UDP and TCP traffic. You may
+			    not specify a SOURCE PORT with this PROTOCOL.
+
+27) Normally MAC verification triggered by the 'maclist' interface and host
+    options is done out of the INPUT and FORWARD chains of the filter table.
+    Users have reported that under some circumstances, MAC verification is
+    failing for forwarded packets when the packets are being forwarded out
+    of a bridge.
+
+    To work around this problem, a MACLIST_TABLE option has been added to
+    shorewall.conf. The default value is MACLIST_TABLE=filter which results
+    in the current behavior. If MACLIST_TABLE=mangle then filtering will
+    take place out of the PREROUTING chain of the mangle table. Because
+    the REJECT target may not be used in the PREROUTING chain, the settings
+    MACLIST_DISPOSITION=REJECT and MACLIST_TABLE=mangle are incompatible.
+
+28) The sample configurations are now packaged with the product. They are
+    in the Samples directory on the tarball and are in the RPM they are
+    in the Samples sub-directory of the Shorewall documentation
+    directory.
+</pre>
+<span style="font-weight: bold;">10/31/2005
+Shorewall 2.4.6<br>
+<br>
+</span>Problems Corrected in 2.4.6<br>
+<ol>
+  <li>"shorewall refresh" would fail if there were entries in
+/etc/shorewall/tcrules with non-empty USER/GROUP or TEST columns.</li>
+  <li>An unprintable character in a comment caused /sbin/shorewall to
+fail when used with a light-weight shell like 'dash'.</li>
+  <li>When using some flavors of 'ash', certain /sbin/shorewall
+commands produced 'ipset: not found' messages.</li>
+  <li>Support for OpenVPN TCP tunnels was released in Shorewall 2.2.0
+but the implementation was incomplete. It has now been completed and is
+documented in the /etc/shorewall/tunnels file.</li>
+  <li>The test that Shorewall uses to detect the availability of the
+owner match capability has been changed to avoid the generation of
+ipt_owner messages under kernel 2.6.14.</li>
+</ol>
+New Features in 2.4.6<br>
+<ol>
+  <li>Normally MAC verification triggered by the 'maclist' interface
+and host options is done out of the INPUT and FORWARD chains of the
+filter table. Users have reported that under some circulstances, MAC
+verification is failing for forwarded packets when the packets are
+being forwarded out of a bridge.<br>
+    <br>
+To work around this problem, a MACLIST_TABLE option has been added to
+shorewall.conf. The default value is MACLIST_TABLE=filter which results
+in the current behavior. If MACLIST_TABLE=mangle then filtering will
+take place out of the PREROUTING chain of the mangle table. Because the
+REJECT target may not be used in the PREROUTING chain, the settings
+MACLIST_DISPOSITION=REJECT and MACLIST_TABLE=mangle are incompatible.</li>
+  <li>A "dump" command has been added to /sbin/shorewall for
+compatibility with Shorewall 3.0. In 2.4.6, the "dump" command provides
+the same output as the "status".<br>
+  </li>
+</ol>
+<span style="font-weight: bold;">10/05/2005
 Shorewall 2.4.5<br>
 </span>
 <br>
 Problems Corrected in 2.4.5<br>
-<br>
 <ol>
   <li>In previous versions, when the command is 'start', 'restart' or
 'stop' then OUTPUT traffic to hosts listed in

Shorewall-Website/shorewall_index.htm

@@ -11,8 +11,8 @@
   <meta name="CHANGED" content="20040920;15183300">
 </head>
 <body dir="ltr" lang="en-US">
-<h1>Shorewall 2.x</h1>
+<h1>Shorewall 3.x</h1>
-<p>The information on this site applies only to 2.x releases of
+<p>The information on this site applies only to 3.x releases of
 Shorewall. For other versions:</p>
 <ul>
   <li>
@@ -27,23 +27,16 @@ Shorewall. For other versions:</p>
     <p>The 1.2 site is <a href="http://shorewall.net/1.2/"
  target="_top">here</a>.</p>
   </li>
-  <li>The 3.0 documentation (preliminary) is <a
+  <li>The 2.* Documentation is <a href="2.0/index.html">here.</a><br>
- href="http://www1.shorewall.net/3.0/">here</a>.</li>
+  </li>
 </ul>
-<p>The current 2.4 Stable Release is 2.4.5 -- Here are the <a
+<p>
- href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.5/releasenotes.txt">
+The current Stable Release is&nbsp; 3.0.0 -- Here are the <a
+ href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0/releasenotes.txt">
 release notes</a> and here are the <a
- href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.5/known_problems.txt">
+ href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0/known_problems.txt">
 known problems</a> and <a
- href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.5/errata/">
+ href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0/errata/">
-updates</a>.<br>
-<br>
-The current Development Release is&nbsp; 3.0.0 RC 2 -- Here are the <a
- href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0-RC2/releasenotes.txt">
-release notes</a> and here are the <a
- href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0-RC2/known_problems.txt">
-known problems</a> and <a
- href="http://shorewall.net/pub/shorewall/3.0/shorewall-3.0.0-RC2/errata/">
 updates</a>..<br>
 <br>
 Copyright © 2001-2005 Thomas M. Eastep</p>
@@ -53,7 +46,7 @@ document under the terms of the GNU Free Documentation License, Version
 with no Invariant Sections, with no Front-Cover, and with no Back-Cover
 Texts. A copy of the license is included in the section entitled “<a
  href="GnuCopyright.htm" target="_self">GNU Free Documentation License</a>”.</p>
-<p>2005-10-22</p>
+<p>2005-11-11</p>
 <hr style="width: 100%; height: 2px;">
 <h3>Table of Contents</h3>
 <p style="margin-left: 0.42in; margin-bottom: 0in;"><a href="#Intro">Introduction
@@ -116,7 +109,7 @@ point-and-click set-and-forget Linux firewall solution that requires a
 minimum of networking knowledge, I would encourage you to check out the
 following alternatives:</p>
 <ul style="margin-left: 40px;">
-  <li><a href="http://www.m0n0.ch/wall">http://www.m0n0.ch/wall</a> (FreeBSD based)</li>
+  <li><a href="http://www.m0n0.ch/wall">http://www.m0n0.ch/wall</a></li>
   <li><a href="http://www.fs-security.com/">http://www.fs-security.com/</a><br>
   </li>
 </ul>

Shorewall-Website/shorewall_mirrors.htm

@@ -1,139 +1,89 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-
 <html>
-  <head>
+<head>
-    <meta name="generator" content=
+  <meta name="generator"
-    "HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
+ content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-    <meta http-equiv="Content-Language" content="en-us">
+  <meta http-equiv="Content-Language" content="en-us">
-    <meta http-equiv="Content-Type" content=
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
-    "text/html; charset=utf-8">
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-    <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+  <meta name="ProgId" content="FrontPage.Editor.Document">
-    <meta name="ProgId" content="FrontPage.Editor.Document">
+  <title>Shorewall Mirrors</title>
-
+</head>
-    <title>Shorewall Mirrors</title>
+<body>
-  </head>
+<h1 style="text-align: left;">Shorewall Mirrors</h1>
-
+<span style="font-weight: bold;">Tom Eastep</span><br>
-  <body>
+<br>
-    <h1 style="text-align: left;">Shorewall Mirrors</h1>
+Copyright © 2001-2005 Thomas M . Eastep<br>
-    <span style="font-weight: bold;">Tom Eastep</span><br>
+<p>Permission is granted to copy, distribute and/or modify this
+document under the terms of the GNU Free Documentation License, Version
+1.2 or any later version published by the Free Software Foundation;
+with no Invariant Sections, with no Front-Cover, and with no Back-Cover
+Texts. A copy of the license is included in the section entitled “<span
+ class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
+Documentation License</a></span>”.<br>
+</p>
+<p>2005-11-05<br>
+</p>
+<hr style="width: 100%; height: 2px;">
+<p align="left"><b>Remember that updates to the mirrors are often
+delayed for 6-12 hours after an update to the primary site. <br>
+</b></p>
+<p align="left"><b>The primary site has a very low bandwidth so I
+encourage you to use a mirror site whenever possible.<br>
+</b></p>
+<p align="left">The primary web site is <a href="http://shorewall.net/"
+ target="_top">http://www1.shorewall.net</a> (Shoreline, Washington,
+USA). It is mirrored via rsync at:<br>
+</p>
+<ul>
+  <li><a href="http://www.shorewall.net/" target="_top">http://[www.]shorewall.net</a>
+(Vienna, Virginia, USA)</li>
+  <li><a target="_top" href="http://slovakia.shorewall.net">http://slovakia.shorewall.net</a>
+(Slovak Republic).</li>
+  <li><a target="_top" href="http://utexas.shorewall.net">http://utexas.shorewall.net</a>
+(Austin, Texas, USA)<br>
+  </li>
+  <li><a target="_top" href="http://france.shorewall.net">http://france.shorewall.net</a>
+(Paris, France) <b>Currently offline</b></li>
+  <li><a href="http://shorewall.syachile.cl" target="_top">http://shorewall.syachile.cl</a>
+(Santiago Chile)</li>
+  <li><a href="http://argentina.shorewall.net" target="_top">http://argentina.shorewall.net</a>
+(Argentina)</li>
+  <li><a href="http://www.shorewall.com.au" target="_top">http://www.shorewall.com.au</a>
+(Australia)</li>
+  <li><a href="http://shorewall.viisage.com" target="_top">http://shorewall.viisage.com</a>
+(Boston Mass., USA)</li>
+  <li><a href="http://www.infohiiway.com/shorewall" target="_top">http://shorewall.infohiiway.com</a>
+(Plano, Texas, USA).</li>
+  <li><a target="_top" href="http://italy.shorewall.net/index.html">http://italy.shorewall.net</a>
+(<font size="3">Univesita` degli Studi di Milano -</font> Milan, Italy)<br>
+  </li>
+</ul>
+<p align="left">The primary FTP site is <a
+ href="ftp://shorewall.net/pub/shorewall/" target="_top">ftp://shorewall.net/pub/shorewall/</a>&nbsp;
+(Shoreline, Washington, USA). It is mirrored via rsync at:<br>
+</p>
+<ul>
+  <li><a href="ftp://ftp.shorewall.net/pub/shorewall" target="_blank">ftp://[ftp.]shorewall.net</a>
+(Vienna, Virginia, USA)</li>
+  <li><a target="_blank"
+ href="ftp://slovakia.shorewall.net/mirror/shorewall/">ftp://slovakia.shorewall.net/mirror/shorewall</a>
+(Slovak Republic).</li>
+  <li><a target="_top" href="ftp://utexas.shorewall.net/shorewall/">ftp://utexas.shorewall.net/shorewall/</a><br>
+  </li>
+  <li><a target="_blank"
+ href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
+(Paris, France) <b>Currently offline</b></li>
+  <li><a href="ftp://ftp.syachile.cl/pub/shorewall" target="_top">ftp://ftp.syachile.cl/pub/shorewall</a>
+(Santiago Chile)</li>
+  <li><a target="_top" href="ftp://ftp.shorewall.de/pub/shorewall/">ftp://ftp.shorewall.de/pub/shorewall/</a>
+(Frankfurt/Main, Germany)<br>
+  </li>
+  <li><a href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall/">Search
+results and the mailing list archives are always fetched from the
+primary web site.<br>
     <br>
-    Copyright © 2001-2005 Thomas M . Eastep<br>
+    </a></li>
-
+</ul>
-    <p>Permission is granted to copy, distribute and/or modify this
+</body>
-    document under the terms of the GNU Free Documentation License,
-    Version 1.2 or any later version published by the Free Software
-    Foundation; with no Invariant Sections, with no Front-Cover,
-    and with no Back-Cover Texts. A copy of the license is included
-    in the section entitled “<span class="quote"><a href=
-    "GnuCopyright.htm" target="_self">GNU Free Documentation
-    License</a></span>”.<br>
-    </p>
-
-    <p>2005-08-14<br>
-    </p>
-    <hr style="width: 100%; height: 2px;">
-     
-
-    <p align="left"><b>Remember that updates to the mirrors are
-    often delayed for 6-12 hours after an update to the primary
-    site. For HTML content, the Sourceforge web site (<a href=
-    "http://shorewall.sf.net" target=
-    "_top">http://shorewall.sf.net</a>) is updated at the same time
-    as the primary site.<br>
-    </b></p>
-
-    <p align="left"><b>The primary site has a very low bandwidth so
-    I encourage you to use a mirror site whenever possible.<br>
-    </b></p>
-
-    <p align="left">The primary web site is <a href=
-    "http://shorewall.net/" target=
-    "_top">http://www1.shorewall.net</a> (Shoreline, Washington,
-    USA). It is mirrored via rsync at:<br>
-    </p>
-
-    <ul>
-      <li><a href="http://www.shorewall.net/" target=
-      "_top">http://[www.]shorewall.net</a> (Vienna, Virginia,
-      USA)</li>
-
-      <li><a target="_top" href=
-      "http://slovakia.shorewall.net">http://slovakia.shorewall.net</a>
-      (Slovak Republic).</li>
-
-      <li><a target="_top" href=
-      "http://utexas.shorewall.net">http://utexas.shorewall.net</a>
-      (Austin, Texas, USA)<br>
-      </li>
-
-      <li><a target="_top" href=
-      "http://france.shorewall.net">http://france.shorewall.net</a>
-      (Paris, France) <b>Currently offline</b></li>
-
-      <li><a href="http://shorewall.syachile.cl" target=
-      "_top">http://shorewall.syachile.cl</a> (Santiago Chile)</li>
-
-      <li><a href="http://argentina.shorewall.net" target=
-      "_top">http://argentina.shorewall.net</a> (Argentina)</li>
-
-      <li><a href="http://www.shorewall.com.au" target=
-      "_top">http://www.shorewall.com.au</a> (Australia)</li>
-
-      <li><a href="http://shorewall.viisage.com" target=
-      "_top">http://shorewall.viisage.com</a> (Boston Mass.,
-      USA)</li>
-
-      <li><a href="http://www.infohiiway.com/shorewall" target=
-      "_top">http://shorewall.infohiiway.com</a> (Plano, Texas,
-      USA).</li>
-
-      <li><a target="_top" href=
-      "http://italy.shorewall.net/index.html">http://italy.shorewall.net</a>
-      (<font size="3">Univesita` degli Studi di Milano -</font>
-      Milan, Italy)<br>
-      </li>
-    </ul>
-
-    <p align="left">The primary FTP site is <a href=
-    "ftp://shorewall.net/pub/shorewall/" target=
-    "_top">ftp://shorewall.net/pub/shorewall/</a>&nbsp; (Shoreline,
-    Washington, USA). It is mirrored via rsync at:<br>
-    </p>
-
-    <ul>
-      <li><a href="ftp://ftp.shorewall.net/pub/shorewall" target=
-      "_blank">ftp://[ftp.]shorewall.net</a> (Vienna, Virginia,
-      USA)</li>
-
-      <li><a target="_blank" href=
-      "ftp://slovakia.shorewall.net/mirror/shorewall/">ftp://slovakia.shorewall.net/mirror/shorewall</a>
-      (Slovak Republic).</li>
-
-      <li><a target="_top" href=
-      "ftp://utexas.shorewall.net/shorewall/">ftp://utexas.shorewall.net/shorewall/</a><br>
-
-      </li>
-
-      <li><a target="_blank" href=
-      "ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
-      (Paris, France) <b>Currently offline</b></li>
-
-      <li><a href="ftp://ftp.syachile.cl/pub/shorewall" target=
-      "_top">ftp://ftp.syachile.cl/pub/shorewall</a> (Santiago
-      Chile)</li>
-
-      <li><a target="_top" href=
-      "ftp://ftp.shorewall.de/pub/shorewall/">ftp://ftp.shorewall.de/pub/shorewall/</a>
-      (Frankfurt/Main, Germany)<br>
-      </li>
-
-      <li><a href=
-      "ftp://ftp.infohiiway.com/pub/mirrors/shorewall/">Search
-      results and the mailing list archives are always fetched from
-      the primary web site.<br>
-      <br>
-      </a></li>
-    </ul>
-  </body>
 </html>
-