extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-24 07:08:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '4.6.2'

Browse Source
This commit is contained in:
Tom Eastep 2014-07-25 09:02:48 -07:00
commit dbf78d7dd0
4 changed files with 30 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Shorewall/manpages/shorewall-tcfilters.xml
View File

@ -88,9 +88,11 @@
<replaceable>address</replaceable>. DNS names are not allowed. <replaceable>address</replaceable>. DNS names are not allowed.
Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+') Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
may be used if your kernel and ip6tables have the <firstterm>Basic may be used if your kernel and ip6tables have the <firstterm>Basic
Ematch</firstterm>capability. The ipset name may optionally be Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
followed by a number or a comma separated list of src and/or dst <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
enclosed in square brackets ([...]). See <ulink ipset name may optionally be followed by a number or a comma
separated list of src and/or dst enclosed in square brackets
([...]). See <ulink
url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
details.</para> details.</para>
</listitem> </listitem>
@ -105,9 +107,11 @@
<replaceable>address</replaceable>. DNS names are not allowed. <replaceable>address</replaceable>. DNS names are not allowed.
Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+') Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
may be used if your kernel and ip6tables have the <firstterm>Basic may be used if your kernel and ip6tables have the <firstterm>Basic
Ematch</firstterm>capability. The ipset name may optionally be Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
followed by a number or a comma separated list of src and/or dst <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
enclosed in square brackets ([...]). See <ulink ipset name may optionally be followed by a number or a comma
separated list of src and/or dst enclosed in square brackets
([...]). See <ulink
url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
details.</para> details.</para>

16
Shorewall6/manpages/shorewall6-tcfilters.xml
View File

@ -88,9 +88,11 @@
<replaceable>address</replaceable>. DNS names are not allowed. <replaceable>address</replaceable>. DNS names are not allowed.
Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+') Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
may be used if your kernel and ip6tables have the <firstterm>Basic may be used if your kernel and ip6tables have the <firstterm>Basic
Ematch </firstterm>capability. The ipset name may optionally be Ematch </firstterm>capability and you set BASIC_FILTERS=Yes in
followed by a number or a comma separated list of src and/or dst <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
enclosed in square brackets ([...]). See <ulink ipset name may optionally be followed by a number or a comma
separated list of src and/or dst enclosed in square brackets
([...]). See <ulink
url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
details.</para> details.</para>
</listitem> </listitem>
@ -105,9 +107,11 @@
<replaceable>address</replaceable>. DNS names are not allowed. <replaceable>address</replaceable>. DNS names are not allowed.
Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+') Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
may be used if your kernel and ip6tables have the <firstterm>Basic may be used if your kernel and ip6tables have the <firstterm>Basic
Ematch</firstterm>capability. The ipset name may optionally be Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
followed by a number or a comma separated list of src and/or dst <ulink url="shorewall6.conf.html">shorewall6.conf (5)</ulink>. The
enclosed in square brackets ([...]). See <ulink ipset name may optionally be followed by a number or a comma
separated list of src and/or dst enclosed in square brackets
([...]). See <ulink
url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for url="shorewall6-ipsets.html">shorewall6-ipsets(5)</ulink> for
details.</para> details.</para>
</listitem> </listitem>

6
docs/MultiISP.xml
View File

@ -820,9 +820,9 @@ DROP:info net:192.168.1.0/24 all</programlisting>
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink> url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
(5) will not disable route filtering on a given interface. You must (5) will not disable route filtering on a given interface. You must
set ROUTE_FILTER=No in <ulink set ROUTE_FILTER=No in <ulink
url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink> url="manpages/shorewall.conf.html">shorewall.conf</ulink> (5), then
(5), then set the <emphasis role="bold">routefilter</emphasis> option set the <emphasis role="bold">routefilter</emphasis> option on those
on those interfaces on which you want route filtering.</para> interfaces on which you want route filtering.</para>
</important> </important>
</section> </section>

7
docs/Shorewall_and_Aliased_Interfaces.xml
View File

@ -182,6 +182,13 @@ ACCEPT net $FW:206.124.146.178 tcp 22</programlisting></para>
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL <programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
# PORT(S) DEST # PORT(S) DEST
DNAT net loc:192.168.1.3 tcp 80 - 206.124.146.178 </programlisting> DNAT net loc:192.168.1.3 tcp 80 - 206.124.146.178 </programlisting>
<para>If I wished to forward tcp port 10000 on that virtual interface to
port 22 on local host 192.168.1.3, the rule would be:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL
# PORT(S) DEST
DNAT net loc:192.168.1.3:22 tcp 10000 - 206.124.146.178 </programlisting>
</section> </section>
<section id="SNAT"> <section id="SNAT">