extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-04-01 11:26:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Duplicate Manpages

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8982 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-12-11 00:03:00 +00:00
parent ffa1530411
commit dfc46c69b4
36 changed files with 11919 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
manpages6-lite/shorewall-lite-vardir.xml Normal file
View File

@ -0,0 +1,64 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-lite-vardir</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>vardir</refname>
<refpurpose>Shorewall Lite file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall-lite/vardir</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file does not exist by default. You may create the file if you
want to change the directory used by Shorewall Lite to store state
information, including compiled firewall scripts. By default, the
directory used is <filename>/var/lib/shorewall-lite/</filename>.</para>
<para>The file contains a single variable assignment:</para>
<para><option>VARDIR=</option><replaceable>directory</replaceable></para>
<para>where <replaceable>directory</replaceable> is the name of a
directory. If you add this file, you should copy the files from
<filename>/var/lib/shorewall-lite</filename> to the new directory before
performing a <command>shorewall-lite restart</command>.</para>
</refsect1>
<refsect1>
<title>Example</title>
<para>VARDIR=/root/shorewall</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall-lite/vardir</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

192
manpages6-lite/shorewall-lite.conf.xml Normal file
View File

@ -0,0 +1,192 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-lite.conf</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>shorewall-lite.conf</refname>
<refpurpose>Shorewall Lite global configuration file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall-lite/shorewall-lite.conf</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file sets options that apply to Shorewall Lite as a
whole.</para>
<para>The file consists of Shell comments (lines beginning with '#'),
blank lines and assignment statements
(<emphasis>variable</emphasis>=<emphasis>value</emphasis>). Each
variable's setting is preceded by comments that describe the variable and
it's effect.</para>
<para>Any option not specified in this file gets its value from the
shorewall.conf file used during compilation of
/var/lib/shorewall-lite/firewall. Those settings may be found in the file
/var/lib/shorewall-lite/firewall.conf.</para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<para>The following options may be set in shorewall.conf.</para>
<variablelist>
<varlistentry>
<term><emphasis
role="bold">IPTABLES=</emphasis>[<emphasis>pathname</emphasis>]</term>
<listitem>
<para>This parameter names the iptables executable to be used by
Shorewall. If not specified or if specified as a null value, then
the iptables executable located using the PATH option is
used.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">LOGFILE=</emphasis>[<emphasis>pathname</emphasis>]</term>
<listitem>
<para>This parameter tells the /sbin/shorewall program where to look
for Shorewall messages when processing the <emphasis
role="bold">dump</emphasis>, <emphasis
role="bold">logwatch</emphasis>, <emphasis role="bold">show
log</emphasis>, and <emphasis role="bold">hits</emphasis> commands.
If not assigned or if assigned an empty value, /var/log/messages is
assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">LOGFORMAT=</emphasis>[<emphasis
role="bold">"</emphasis><emphasis>formattemplate</emphasis><emphasis
role="bold">"</emphasis>]</term>
<listitem>
<para>The value of this variable generate the --log-prefix setting
for Shorewall logging rules. It contains a “printf” formatting
template which accepts three arguments (the chain name, logging rule
number (optional) and the disposition). To use LOGFORMAT with
fireparse, set it as:</para>
<programlisting> LOGFORMAT="fp=%s:%d a=%s "</programlisting>
<para>If the LOGFORMAT value contains the substring “%d” then the
logging rule number is calculated and formatted in that position; if
that substring is not included then the rule number is not included.
If not supplied or supplied as empty (LOGFORMAT="") then
“Shorewall:%s:%s:” is assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>PATH=[<emphasis>pathname</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>pathname</emphasis>]...]</term>
<listitem>
<para>Determines the order in which Shorewall searches directories
for executable files.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">RESTOREFILE=</emphasis>[<emphasis>filename</emphasis>]</term>
<listitem>
<para>Specifies the simple name of a file in /var/lib/shorewall to
be used as the default restore script in the <emphasis
role="bold">shorewall save</emphasis>, <emphasis
role="bold">shorewall restore</emphasis>, <emphasis
role="bold">shorewall forget </emphasis>and <emphasis
role="bold">shorewall -f start</emphasis> commands.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">SHOREWALL_SHELL=</emphasis>[<emphasis>pathname</emphasis>]</term>
<listitem>
<para>This option is used to specify the shell program to be used to
run the Shorewall compiler and to interpret the compiled script. If
not specified or specified as a null value, /bin/sh is assumed.
Using a light-weight shell such as ash or dash can significantly
improve performance.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">SUBSYSLOCK=</emphasis>[<emphasis>pathname</emphasis>]</term>
<listitem>
<para>This parameter should be set to the name of a file that the
firewall should create if it starts successfully and remove when it
stops. Creating and removing this file allows Shorewall to work with
your distribution's initscripts. For RedHat, this should be set to
/var/lock/subsys/shorewall. For Debian, the value is
/var/state/shorewall and in LEAF it is /var/run/shorwall.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>VERBOSITY=[<emphasis role="bold">number</emphasis>]</term>
<listitem>
<para>Shorewall has traditionally been very noisy (produced lots of
output). You may set the default level of verbosity using the
VERBOSITY OPTION.</para>
<para>Values are:</para>
<simplelist>
<member>0 - Silent. You may make it more verbose using the -v
option</member>
<member>1 - Major progress messages displayed</member>
<member>2 - All progress messages displayed (old default
behavior)</member>
</simplelist>
<para>If not specified, then 2 is assumed.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall-lite/shorewall.conf</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://www.shorewall.net/Documentation_Index.html">http://www.shorewall.net/Documentation_Index.html</ulink></para>
<para>shorewall-lite(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

838
manpages6-lite/shorewall-lite.xml Normal file
View File

@ -0,0 +1,838 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-lite</refentrytitle>
<manvolnum>8</manvolnum>
</refmeta>
<refnamediv>
<refname>shorewall-lite</refname>
<refpurpose>Administration tool for Shoreline Firewall Lite
(Shorewall-lite)</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>allow</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>clear</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>drop</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>dump</option></arg>
<arg><option>-x</option></arg>
<arg><option>-m</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>forget</option></arg>
<arg><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>help</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>hits</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>ipcalc</option></arg>
<group choice="req">
<arg choice="plain"><replaceable>address</replaceable>
<replaceable>mask</replaceable></arg>
<arg
choice="plain"><replaceable>address</replaceable>/<replaceable>vlsm</replaceable></arg>
</group>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>iprange</option></arg>
<arg
choice="plain"><replaceable>address1</replaceable><option>-</option><replaceable>address2</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logdrop</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logwatch</option></arg>
<arg><option>-m</option></arg>
<arg><replaceable>refresh-interval</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logreject</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>reject</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg
choice="plain"><option>restart</option><arg><option>-n</option></arg><arg><option>-p</option></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>restore</option></arg>
<arg><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>save</option></arg>
<arg choice="opt"><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-x</option></arg>
<arg><option>-t</option>
{<option>filter</option>|<option>mangle</option>|<option>nat</option>|<option>raw</option>}</arg>
<arg><arg><option>chain</option></arg><arg choice="plain"
rep="repeat"><replaceable>chain</replaceable></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-f</option></arg>
<arg choice="plain"><option>capabilities</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg
choice="req"><option>actions|classifiers|connections|config|macros|zones</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-x</option></arg>
<arg choice="req"><option>mangle|nat</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg choice="plain"><option>tc</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-m</option></arg>
<arg choice="plain"><option>log</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>start</option></arg>
<arg><option>-n</option></arg>
<arg><option>-f</option><arg><option>-p</option></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>stop</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>status</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>version</option></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The shorewall-lite utility is used to control the Shoreline Firewall
(Shorewall) Lite.</para>
</refsect1>
<refsect1>
<title>Options</title>
<para>The <option>trace</option> and <option>debug</option> options are
used for debugging. See <ulink
url="http://www.shorewall.net/starting_and_stopping.htm#Trace">http://www.shorewall.net/starting_and_stopping.htm#Trace</ulink>.</para>
<para>The nolock <option>option</option> prevents the command from
attempting to acquire the Shorewall Lite lockfile. It is useful if you
need to include <command>shorewall-lite</command> commands in the
<filename>started</filename> extension script.</para>
<para>The <emphasis>options</emphasis> control the amount of output that
the command produces. They consist of a sequence of the letters <emphasis
role="bold">v</emphasis> and <emphasis role="bold">q</emphasis>. If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5). Each <emphasis
role="bold">v</emphasis> adds one to the effective verbosity and each
<emphasis role="bold">q</emphasis> subtracts one from the effective
VERBOSITY. Anternately, <emphasis role="bold">v</emphasis> may be followed
immediately with one of -1,0,1,2 to specify a specify VERBOSITY. There may
be no white space between <emphasis role="bold">v</emphasis> and the
VERBOSITY.</para>
<para>The <emphasis>options</emphasis> may also include the letter
<option>t</option> which causes all progress messages to be
timestamped.</para>
</refsect1>
<refsect1>
<title>Commands</title>
<para>The available commands are listed below.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">add</emphasis></term>
<listitem>
<para>Adds a list of hosts or subnets to a dynamic zone usually used
with VPN's.</para>
<para>The <emphasis>interface</emphasis> argument names an interface
defined in the <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
file. A <emphasis>host-list</emphasis> is comma-separated list whose
elements are a host or network address.<caution>
<para>The <command>add</command> command is not very robust. If
there are errors in the <replaceable>host-list</replaceable>,
you may see a large number of error messages yet a subsequent
<command>shorewall show zones</command> command will indicate
that all hosts were added. If this happens, replace
<command>add</command> by <command>delete</command> and run the
same command again. Then enter the correct command.</para>
</caution></para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">allow</emphasis></term>
<listitem>
<para>Re-enables receipt of packets from hosts previously
blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
role="bold">logdrop</emphasis>, <emphasis
role="bold">reject</emphasis>, or <emphasis
role="bold">logreject</emphasis> command.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">clear</emphasis></term>
<listitem>
<para>Clear will remove all rules and chains installed by Shorewall
Lite. The firewall is then wide open and unprotected. Existing
connections are untouched. Clear is often used to see if the
firewall is causing connection problems.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">delete</emphasis></term>
<listitem>
<para>The delete command reverses the effect of an earlier <emphasis
role="bold">add</emphasis> command.</para>
<para>The <emphasis>interface</emphasis> argument names an interface
defined in the <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
file. A <emphasis>host-list</emphasis> is comma-separated list whose
elements are a host or network address.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">drop</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be silently dropped.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">dump</emphasis></term>
<listitem>
<para>Produces a verbose report about the firewall configuration for
the purpose of problem analysis.</para>
<para>The <emphasis role="bold">-x</emphasis> option causes actual
packet and byte counts to be displayed. Without that option, these
counts are abbreviated. The <emphasis role="bold">-m</emphasis>
option causes any MAC addresses included in Shorewall Lite log
messages to be displayed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">forget</emphasis></term>
<listitem>
<para>Deletes /var/lib/shorewall-lite/<emphasis>filenam</emphasis>e
and /var/lib/shorewall-lite/save. If no
<emphasis>filename</emphasis> is given then the file specified by
RESTOREFILE in <ulink
url="shorewall-lite.conf.html">shorewall-lite.conf</ulink>(5) is
assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">help</emphasis></term>
<listitem>
<para>Displays a syntax summary.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">hits</emphasis></term>
<listitem>
<para>Generates several reports from Shorewall Lite log messages in
the current log file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ipcalc</emphasis></term>
<listitem>
<para>Ipcalc displays the network address, broadcast address,
network in CIDR notation and netmask corresponding to the
input[s].</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">iprange</emphasis></term>
<listitem>
<para>Iprange decomposes the specified range of IP addresses into
the equivalent list of network/host addresses.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logdrop</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be logged then discarded.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logwatch</emphasis></term>
<listitem>
<para>Monitors the log file specified by theLOGFILE option in <ulink
url="shorewall-lite.conf.html">shorewall-lite.conf</ulink>(5) and
produces an audible alarm when new Shorewall Lite messages are
logged. The <emphasis role="bold">-m</emphasis> option causes the
MAC address of each packet source to be displayed if that
information is available. The
<replaceable>refresh-interval</replaceable> specifies the time in
seconds between screen refreshes. You can enter a negative number by
preceding the number with "--" (e.g., <command>shorewall-lite
logwatch -- -30</command>). In this case, when a packet count
changes, you will be prompted to hit any key to resume screen
refreshes.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logreject</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be logged then rejected.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">reset</emphasis></term>
<listitem>
<para>All the packet and byte counters in the firewall are
reset.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">restart</emphasis></term>
<listitem>
<para>Restart is similar to <emphasis role="bold">shorewall-lite
stop</emphasis> followed by <emphasis role="bold">shorewall-lite
start</emphasis>. Existing connections are maintained.</para>
<para>The <option>-n</option> option causes Shorewall to avoid
updating the routing table(s).</para>
<para>The <option>-p</option> option causes the connection tracking
table to be flushed; the <command>conntrack</command> utility must
be installed to use this option.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">restore</emphasis></term>
<listitem>
<para>Restore Shorewall Lite to a state saved using the <emphasis
role="bold">shorewall-lite save</emphasis> command. Existing
connections are maintained. The <emphasis>filename</emphasis> names
a restore file in /var/lib/shorewall-lite created using <emphasis
role="bold">shorewall-lite save</emphasis>; if no
<emphasis>filename</emphasis> is given then Shorewall Lite will be
restored from the file specified by the RESTOREFILE option in <ulink
url="shorewall-lite.conf.html">shorewall-lite.conf</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">save</emphasis></term>
<listitem>
<para>The dynamic blacklist is stored in
/var/lib/shorewall-lite/save. The state of the firewall is stored in
/var/lib/shorewall-lite/<emphasis>filename</emphasis> for use by the
<emphasis role="bold">shorewall-lite restore</emphasis> and
<emphasis role="bold">shorewall-lite -f start</emphasis> commands.
If <emphasis>filename</emphasis> is not given then the state is
saved in the file specified by the RESTOREFILE option in <ulink
url="shorewall-lite.conf.html">shorewall-lite.conf</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">show</emphasis></term>
<listitem>
<para>The show command can have a number of different
arguments:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">actions</emphasis></term>
<listitem>
<para>Produces a report about the available actions (built-in,
standard and user-defined).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">capabilities</emphasis></term>
<listitem>
<para>Displays your kernel/iptables capabilities. The
<emphasis role="bold">-f</emphasis> option causes the display
to be formatted as a capabilities file for use with <emphasis
role="bold">compile -e</emphasis>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>[ [ <option>chain</option> ] <emphasis>chain</emphasis>
... ]</term>
<listitem>
<para>The rules in each <emphasis>chain</emphasis> are
displayed using the <emphasis role="bold">iptables
-L</emphasis> <emphasis>chain</emphasis> <emphasis
role="bold">-n -v</emphasis> command. If no
<emphasis>chain</emphasis> is given, all of the chains in the
filter table are displayed. The <emphasis
role="bold">-x</emphasis> option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are abbreviated.
The <emphasis role="bold">-t</emphasis> option specifies the
Netfilter table to display. The default is <emphasis
role="bold">filter</emphasis>.</para>
<para>If the <emphasis role="bold">t</emphasis> option and the
<option>chain</option> keyword are both omitted and any of the
listed <replaceable>chain</replaceable>s do not exist, a usage
message will be displayed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">classifiers</emphasis></term>
<listitem>
<para>Displays information about the packet classifiers
defined on the system 10-080213-8397as a result of traffic
shaping configuration.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">config</emphasis></term>
<listitem>
<para>Dispays distribution-specific defaults.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">connections</emphasis></term>
<listitem>
<para>Displays the IP connections currently being tracked by
the firewall.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">macros</emphasis></term>
<listitem>
<para>Displays information about each macro defined on the
firewall system.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mangle</emphasis></term>
<listitem>
<para>Displays the Netfilter mangle table using the command
<emphasis role="bold">iptables -t mangle -L -n
-v</emphasis>.The <emphasis role="bold">-x</emphasis> option
is passed directly through to iptables and causes actual
packet and byte counts to be displayed. Without this option,
those counts are abbreviated.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">nat</emphasis></term>
<listitem>
<para>Displays the Netfilter nat table using the command
<emphasis role="bold">iptables -t nat -L -n -v</emphasis>.The
<emphasis role="bold">-x</emphasis> option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">tc</emphasis></term>
<listitem>
<para>Displays information about queuing disciplines, classes
and filters.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">zones</emphasis></term>
<listitem>
<para>Displays the current composition of the Shorewall Lite
zones on the system.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">start</emphasis></term>
<listitem>
<para>Start shorewall Lite. Existing connections through
shorewall-lite managed interfaces are untouched. New connections
will be allowed only if they are allowed by the firewall rules or
policies. If <emphasis role="bold">-f</emphasis> is specified, the
saved configuration specified by the RESTOREFILE option in <ulink
url="shorewall-lite.conf.html">shorewall-lite.conf</ulink>(5) will
be restored if that saved configuration exists and has been modified
more recently than the files in /etc/shorewall. </para>
<para>The <option>-n</option> option causes Shorewall to avoid
updating the routing table(s).</para>
<para>The <option>-p</option> option causes the connection tracking
table to be flushed; the <command>conntrack</command> utility must
be installed to use this option.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">stop</emphasis></term>
<listitem>
<para>Stops the firewall. All existing connections, except those
listed in <ulink
url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
or permitted by the ADMINISABSENTMINDED option in shorewall.conf(5),
are taken down. The only new traffic permitted through the firewall
is from systems listed in <ulink
url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
or by ADMINISABSENTMINDED.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">status</emphasis></term>
<listitem>
<para>Produces a short report about the state of the
Shorewall-configured firewall.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">version</emphasis></term>
<listitem>
<para>Displays Shorewall-lite's version.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall-lite/</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://www.shorewall.net/starting_and_stopping_shorewall.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
<para>shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

328
manpages6/shorewall-accounting.xml Normal file
View File

@ -0,0 +1,328 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-accounting</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>accounting</refname>
<refpurpose>Shorewall Accounting file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/accounting</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Accounting rules exist simply to count packets and bytes in
categories that you define in this file. You may display these rules and
their packet and byte counters using the <command>shorewall show
accounting</command> command.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ACTION</emphasis> - {<emphasis
role="bold">COUNT</emphasis>|<emphasis
role="bold">DONE</emphasis>|<emphasis>chain</emphasis>[:<emphasis
role="bold">COUNT</emphasis>]}</term>
<listitem>
<para>What to do when a matching packet is found.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">COUNT</emphasis></term>
<listitem>
<para>Simply count the match and continue with the next
rule</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DONE</emphasis></term>
<listitem>
<para>Count the match and don't attempt to match any other
accounting rules in the chain specified in the <emphasis
role="bold">CHAIN</emphasis> column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>chain</emphasis>[<emphasis
role="bold">:</emphasis><emphasis
role="bold">COUNT</emphasis>]</term>
<listitem>
<para>Where <emphasis>chain</emphasis> is the name of a chain;
Shorewall will create the chain automatically if it doesn't
already exist. Causes a jump to that chain to be added to the
chain specified in the CHAIN column. If <emphasis
role="bold">:COUNT</emphasis> is included, a counting rule
matching this entry will be added to
<emphasis>chain</emphasis></para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CHAIN</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>chain</emphasis>}</term>
<listitem>
<para>The name of a <emphasis>chain</emphasis>. If specified as
<emphasis role="bold">-</emphasis> the <emphasis
role="bold">accounting</emphasis> chain is assumed. This is the
chain where the accounting rule is added. The
<emphasis>chain</emphasis> will be created if it doesn't already
exist.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><emphasis
role="bold">:</emphasis><emphasis>address</emphasis>|<emphasis>address</emphasis>}</term>
<listitem>
<para>Packet Source.</para>
<para>The name of an <replaceable>interface</replaceable>, an
<replaceable>address</replaceable> (host or net) or an
<replaceable>interface</replaceable> name followed by ":" and a host
or net <replaceable>address</replaceable>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DESTINATION</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><emphasis
role="bold">:</emphasis><emphasis>address</emphasis>|<emphasis>address</emphasis>}</term>
<listitem>
<para>Packet Destination.</para>
<para>Format same as <emphasis role="bold">SOURCE</emphasis>
column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis
role="bold">ipp2p</emphasis>[<emphasis
role="bold">:</emphasis>{<emphasis
role="bold">udp</emphasis>|<emphasis
role="bold">all</emphasis>}]}</term>
<listitem>
<para>A <emphasis>protocol-name</emphasis> (from protocols(5)), a
<emphasis>protocol-number</emphasis>, <emphasis
role="bold">ipp2p</emphasis>, <emphasis
role="bold">ipp2p:udp</emphasis> or <emphasis
role="bold">ipp2p:all</emphasis></para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>ipp2p-option</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
<listitem>
<para>Destination Port number. Service name from services(5) or
<emphasis>port number</emphasis>. May only be specified if the
protocol is <emphasis role="bold">tcp</emphasis> or <emphasis
role="bold">udp</emphasis> (6 or 17).</para>
<para>You may place a comma-separated list of port names or numbers
in this column if your kernel and iptables include multiport match
support.</para>
<para>If the PROTOCOL is <emphasis role="bold">ipp2p</emphasis> then
this column must contain an <emphasis>ipp2p-option</emphasis>
("iptables -m ipp2p --help") without the leading "--". If no option
is given in this column, <emphasis role="bold">ipp2p</emphasis> is
assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
<listitem>
<para>Service name from services(5) or <emphasis>port
number</emphasis>. May only be specified if the protocol is TCP or
UDP (6 or 17).</para>
<para>You may place a comma-separated list of port numbers in this
column if your kernel and iptables include multiport match
support.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
<listitem>
<para>This column may only be non-empty if the <emphasis
role="bold">CHAIN</emphasis> is <emphasis
role="bold">OUTPUT</emphasis>.</para>
<para>When this column is non-empty, the rule applies only if the
program generating the output is running under the effective
<emphasis>user</emphasis> and/or <emphasis>group</emphasis>
specified (or is NOT running under that id if "!" is given).</para>
<para>Examples:</para>
<variablelist>
<varlistentry>
<term>joe</term>
<listitem>
<para>program must be run by joe</para>
</listitem>
</varlistentry>
<varlistentry>
<term>:kids</term>
<listitem>
<para>program must be run by a member of the 'kids'
group</para>
</listitem>
</varlistentry>
<varlistentry>
<term>!:kids</term>
<listitem>
<para>program must not be run by a member of the 'kids'
group</para>
</listitem>
</varlistentry>
<varlistentry>
<term>+upnpd</term>
<listitem>
<para>#program named upnpd</para>
<important>
<para>The ability to specify a program name was removed from
Netfilter in kernel version 2.6.14.</para>
</important>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> - [<emphasis
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
role="bold">:C</emphasis>]</term>
<listitem>
<para>Defines a test on the existing packet or connection mark. The
rule will match only if the test returns true.</para>
<para>If you don't want to define a test but need to specify
anything in the following columns, place a "-" in this field.</para>
<variablelist>
<varlistentry>
<term>!</term>
<listitem>
<para>Inverts the test (not equal)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>value</emphasis></term>
<listitem>
<para>Value of the packet or connection mark.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>mask</emphasis></term>
<listitem>
<para>A mask to be applied to the mark before testing.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">:C</emphasis></term>
<listitem>
<para>Designates a connection mark. If omitted, the packet
mark's value is tested. This option is only supported by
Shorewall-perl.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
<para>In all of the above columns except <emphasis
role="bold">ACTION</emphasis> and <emphasis role="bold">CHAIN</emphasis>,
the values <emphasis role="bold">-</emphasis>, <emphasis
role="bold">any</emphasis> and <emphasis role="bold">all</emphasis> may be
used as wildcards. Omitted trailing columns are also treated as
wildcards.</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/accounting</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/Accounting.html">http://shorewall.net/Accounting.html
</ulink></para>
<para>shorewall(8), shorewall-actions(5), shorewall-blacklist(5),
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

59
manpages6/shorewall-actions.xml Normal file
View File

@ -0,0 +1,59 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-actions</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>actions</refname>
<refpurpose>Shorewall action declaration file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/actions</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file allows you to define new ACTIONS for use in rules (see
<ulink url="shorewall-rules.html">shorewall-rules(5)</ulink>). You define
the iptables rules to be performed in an ACTION in
/etc/shorewall/action.<emphasis>action-name</emphasis>.</para>
<para>ACTION names should begin with an upper-case letter to distinguish
them from Shorewall-generated chain names and they must meet the
requirements of a Netfilter chain. If you intend to log from the action
then the name must be no longer than 11 characters in length. Names must
also meet the requirements for a Bourne Shell identifier (must begin with
a letter and be composed of letters, digits and underscore
characters).</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/actions</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/Actions.html">http://shorewall.net/Actions.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-blacklist(5),
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

139
manpages6/shorewall-blacklist.xml Normal file
View File

@ -0,0 +1,139 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-blacklist</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>blacklist</refname>
<refpurpose>Shorewall Blacklist file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/blacklist</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The blacklist file is used to perform static blacklisting. You can
blacklist by source address (IP or MAC), or by application.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ADDRESS/SUBNET</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">~</emphasis><emphasis>mac-address</emphasis>|<emphasis>ip-address</emphasis>|<emphasis>address-range</emphasis>|<emphasis
role="bold">+</emphasis><emphasis>ipset</emphasis>}</term>
<listitem>
<para>Host address, network address, MAC address, IP address range
(if your kernel and iptables contain iprange match support) or ipset
name prefaced by "+" (if your kernel supports ipset match).</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
<para>A dash ("-") in this column means that any source address will
match. This is useful if you want to blacklist a particular
application using entries in the PROTOCOL and PORTS columns.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> (Optional) -
{<emphasis
role="bold">-</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>}</term>
<listitem>
<para>If specified, must be a protocol number or a protocol name
from protocols(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORTS</emphasis> (Optional) - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
<listitem>
<para>May only be specified if the protocol is TCP (6) or UDP (17).
A comma-separated list of destination port numbers or service names
from services(5).</para>
</listitem>
</varlistentry>
</variablelist>
<para>When a packet arrives on an interface that has the <emphasis
role="bold">blacklist</emphasis> option specified in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5), its
source IP address and MAC address is checked against this file and
disposed of according to the <emphasis
role="bold">BLACKLIST_DISPOSITION</emphasis> and <emphasis
role="bold">BLACKLIST_LOGLEVEL</emphasis> variables in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5). If <emphasis
role="bold">PROTOCOL</emphasis> or <emphasis
role="bold">PROTOCOL</emphasis> and <emphasis role="bold">PORTS</emphasis>
are supplied, only packets matching the protocol (and one of the ports if
<emphasis role="bold">PORTS</emphasis> supplied) are blocked.</para>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>To block DNS queries from address 192.0.2.126:</para>
<programlisting> #ADDRESS/SUBNET PROTOCOL PORT
192.0.2.126 udp 53</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>To block some of the nuisance applications:</para>
<programlisting> #ADDRESS/SUBNET PROTOCOL PORT
- udp 1024:1033,1434
- tcp 57,1433,1434,2401,2745,3127,3306,3410,4899,5554,6101,8081,9898</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/blacklist</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/blacklisting_support.htm">http://shorewall.net/blacklisting_support.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

74
manpages6/shorewall-ecn.xml Normal file
View File

@ -0,0 +1,74 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-ecn</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>ecn</refname>
<refpurpose>Shorewall ECN file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/ecn</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Use this file to list the destinations for which you want to disable
ECN (Explicit Congestion Notification).</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>Interface through which host(s) communicate with the
firewall</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">HOST(S)</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis>address-or-address-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address-or-address-range</emphasis>]...]</term>
<listitem>
<para>Comma-separated list of host and/or network addresses. If left
empty or supplied as "-", 0.0.0.0/0 is assumed. If your kernel and
iptables include iprange match support then IP address ranges are
also permitted.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/ecn</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

108
manpages6/shorewall-exclusion.xml Normal file
View File

@ -0,0 +1,108 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-exclusion</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>exclusion</refname>
<refpurpose>Exclude a set of hosts from a definition in a shorewall
configuration file.</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<arg choice="plain"
rep="repeat"><option>!</option><replaceable>address-or-range</replaceable>[,<replaceable>address-or-range</replaceable>]</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Exclusion is used when you wish to exclude one or more addresses
from a definition. An exclaimation point is followed by a comma-separated
list of addresses. The addresses may be single host addresses (e.g.,
192.168.1.4) or they may be network addresses in CIDR format (e.g.,
192.168.1.0/24). If your kernel and iptables include iprange support, you
may also specify ranges of ip addresses of the form
<emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis></para>
<para>No embedded whitespace is allowed.</para>
<para>Exclusion can appear after a list of addresses and/or address
ranges. In that case, the final list of address is formed by taking the
first list and then removing the addresses defined in the
exclusion.</para>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1 - All IPv4 addresses except 192.168.3.4</term>
<listitem>
<para>!192.168.3.4</para>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2 - All IPv4 addresses except the network 192.168.1.0/24
and the host 10.2.3.4</term>
<listitem>
<para>!192.168.1.0/24,10.1.3.4</para>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 3 - All IPv4 addresses except the range
192.168.1.3-192.168.1.12 and the network 10.0.0.0/8</term>
<listitem>
<para>!192.168.1.3-192.168.1.12,10.0.0.0/8</para>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 4 - The network 192.168.1.0/24 except hosts 192.168.1.3
and 192.168.1.9</term>
<listitem>
<para>192.168.1.0/24!192.168.1.3,192.168.1.9</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/hosts</para>
<para>/etc/shorewall/masq</para>
<para>/etc/shorewall/rules</para>
<para>/etc/shorewall/tcrules</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

275
manpages6/shorewall-hosts.xml Normal file
View File

@ -0,0 +1,275 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-hosts</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>hosts</refname>
<refpurpose>Shorewall file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/hosts</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define zones in terms of subnets and/or
individual IP addresses. Most simple setups don't need to (should not)
place anything in this file.</para>
<para>The order of entries in this file is not significant in determining
zone composition. Rather, the order that the zones are declared in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5) determines the order
in which the records in this file are interpreted.</para>
<warning>
<para>The only time that you need this file is when you have more than
one zone connected through a single interface.</para>
</warning>
<warning>
<para>If you have an entry for a zone and interface in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5) then do
not include any entries in this file for that same (zone, interface)
pair.</para>
</warning>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ZONE</emphasis> -
<emphasis>zone-name</emphasis></term>
<listitem>
<para>The name of a zone declared in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5). You may not
list the firewall zone in this column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">HOST(S)</emphasis> -
<emphasis>interface</emphasis>:{[{<emphasis>address-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...|<emphasis
role="bold">+</emphasis><emphasis>ipset</emphasis>}[<emphasis>exclusion</emphasis>]</term>
<listitem>
<para>The name of an interface defined in the <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5) file
followed by a colon (":") and a comma-separated list whose elements
are either:</para>
<orderedlist numeration="loweralpha">
<listitem>
<para>The IP <replaceable>address</replaceable> of a
host.</para>
</listitem>
<listitem>
<para>A network in CIDR format.</para>
</listitem>
<listitem>
<para>An IP address range of the form
<emphasis>low.address</emphasis>-<emphasis>high.address</emphasis>.
Your kernel and iptables must have iprange match support.</para>
</listitem>
<listitem>
<para>The name of an <emphasis>ipset</emphasis>.</para>
</listitem>
</orderedlist>
<blockquote>
<para>You may also exclude certain hosts through use of an
<emphasis>exclusion</emphasis> (see <ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
</blockquote>
</listitem>
</varlistentry>
<varlistentry>
<term>OPTIONS (Optional) - [<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>A comma-separated list of options from the following list. The
order in which you list the options is not significant but the list
must have no embedded white space.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">maclist</emphasis></term>
<listitem>
<para>Connection requests from these hosts are compared
against the contents of <ulink
url="shorewall-maclist.html">shorewall-maclist</ulink>(5). If
this option is specified, the interface must be an ethernet
NIC or equivalent and must be up before Shorewall is
started.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">routeback</emphasis></term>
<listitem>
<para>Shorewall should set up the infrastructure to pass
packets from this/these address(es) back to themselves. This
is necessary if hosts in this group use the services of a
transparent proxy that is a member of the group or if DNAT is
used to send requests originating from this group to a server
in the group.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">blacklist</emphasis></term>
<listitem>
<para>This option only makes sense for ports on a
bridge.</para>
<para>Check packets arriving on this port against the <ulink
url="shorewall-blacklist.html">shorewall-blacklist</ulink>(5)
file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">tcpflags</emphasis></term>
<listitem>
<para>Packets arriving from these hosts are checked for
certain illegal combinations of TCP flags. Packets found to
have such a combination of flags are handled according to the
setting of TCP_FLAGS_DISPOSITION after having been logged
according to the setting of TCP_FLAGS_LOG_LEVEL.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">nosmurfs</emphasis></term>
<listitem>
<para>This option only makes sense for ports on a
bridge.</para>
<para>Filter packets for smurfs (packets with a broadcast
address as the source).</para>
<para>Smurfs will be optionally logged based on the setting of
SMURF_LOG_LEVEL in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5). After
logging, the packets are dropped.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ipsec</emphasis></term>
<listitem>
<para>The zone is accessed via a kernel 2.6 ipsec SA. Note
that if the zone named in the ZONE column is specified as an
IPSEC zone in the <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5) file
then you do NOT need to specify the 'ipsec' option
here.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>broadcast</term>
<listitem>
<para>Used when you want to include limited broadcasts
(destination IP address 255.255.255.255) from the firewall to
this zone. Only necessary when:</para>
<orderedlist>
<listitem>
<para>The network specified in the HOST(S) column does not
include 255.255.255.255.</para>
</listitem>
<listitem>
<para>The zone does not have an entry for this interface
in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).</para>
</listitem>
</orderedlist>
</listitem>
</varlistentry>
<varlistentry>
<term>destonly</term>
<listitem>
<para>Normally used with the Multi-cast IP address range
(224.0.0.0/4). Specifies that traffic will be sent to the
specified net(s) but that no traffic will be received from the
net(s).</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1</term>
<listitem>
<para>The firewall runs a PPTP server which creates a ppp interface
for each remote client. The clients are assigned IP addresses in the
network 192.168.3.0/24 and in a zone named 'vpn'.<programlisting>#ZONE HOST(S) OPTIONS
vpn ppp+:192.168.3.0/24</programlisting></para>
<para>If you are running a Shorewall version prior to 4.1.4, it is
especially recommended to define such a zone using this file rather
than <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(8) if
there is another zone that uses a fixed PPP interface (for example,
if the 'net' zone always interfaces through ppp0). See <ulink
url="shorewall-nesting.html">shorewall-nesting</ulink>(8) for
additional information.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/hosts</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-nesting(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

622
manpages6/shorewall-interfaces.xml Normal file
View File

@ -0,0 +1,622 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall-interfaces</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>interfaces</refname>
<refpurpose>Shorewall interfaces file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/interfaces</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The interfaces file serves to define the firewall's network
interfaces to Shorewall. The order of entries in this file is not
significant in determining zone composition.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ZONE</emphasis> -
<emphasis>zone-name</emphasis></term>
<listitem>
<para>Zone for this interface. Must match the name of a zone
declared in /etc/shorewall/zones. You may not list the firewall zone
in this column.</para>
<para>If the interface serves multiple zones that will be defined in
the <ulink url="shorewall-hosts.html">shorewall-hosts</ulink>(5)
file, you should place "-" in this column.</para>
<para>If there are multiple interfaces to the same zone, you must
list them in separate entries.</para>
<para>Example:</para>
<blockquote>
<programlisting>#ZONE INTERFACE BROADCAST
loc eth1 -
loc eth2 -</programlisting>
</blockquote>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis><emphasis
role="bold">[:</emphasis><emphasis>port</emphasis><emphasis
role="bold">]</emphasis></term>
<listitem>
<para>Name of interface. Each interface may be listed only once in
this file. You may NOT specify the name of a "virtual" interface
(e.g., eth0:0) here; see <ulink
url="http://www.shorewall.net/FAQ.htm#faq18">http://www.shorewall.net/FAQ.htm#faq18</ulink></para>
<para>You may use wildcards here by specifying a prefix followed by
the plus sign ("+"). For example, if you want to make an entry that
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
ppp1, ppp2, …</para>
<para>When using Shorewall versions before 4.1.4, care must be
exercised when using wildcards where there is another zone that uses
a matching specific interface. See <ulink
url="shorewall-nesting.html">shorewall-nesting</ulink>(5) for a
discussion of this problem.</para>
<para>Beginning with Shorewall 4.2.3, Shorewall-perl allows '+' as
an interface name.</para>
<para>There is no need to define the loopback interface (lo) in this
file.</para>
<para>(Shorewall-perl only) If a <replaceable>port</replaceable> is
given, then the <replaceable>interface</replaceable> must have been
defined previously with the <option>bridge</option> option. The
OPTIONS column must be empty when a <replaceable>port</replaceable>
is given.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">BROADCAST</emphasis> (Optional) -
{<emphasis role="bold">-</emphasis>|<emphasis
role="bold">detect</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...}</term>
<listitem>
<para>The broadcast address(es) for the network(s) to which the
interface belongs. For P-T-P interfaces, this column is left blank.
If the interface has multiple addresses on multiple subnets then
list the broadcast addresses as a comma-separated list.</para>
<para>If you use the special value <emphasis
role="bold">detect</emphasis>, Shorewall will detect the broadcast
address(es) for you. If you select this option, the interface must
be up before the firewall is started.</para>
<para>If you don't want to give a value for this column but you want
to enter a value in the OPTIONS column, enter <emphasis
role="bold">-</emphasis> in this column.</para>
<para><emphasis role="bold">Note to Shorewall-perl users:</emphasis>
Shorewall-perl only supports <option>detect</option> or <emphasis
role="bold">-</emphasis> in this column. If you specify
<replaceable>address</replaceable>es, a compilation warning will be
issued.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS</emphasis> (Optional) -
[<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>A comma-separated list of options from the following list. The
order in which you list the options is not significant but the list
should have no embedded white space.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">arp_filter[={0|1}]</emphasis></term>
<listitem>
<para>If specified, this interface will only respond to ARP
who-has requests for IP addresses configured on the interface.
If not specified, the interface can respond to ARP who-has
requests for IP addresses on any of the firewall's interface.
The interface must be up when Shorewall is started.</para>
<para>The option value (0 or 1) may only be specified if you
are using Shorewall-perl. With Shorewall-perl, only those
interfaces with the <option>arp_filter</option> option will
have their setting changes; the value assigned to the setting
will be the value specified (if any) or 1 if no value is
given.</para>
<para></para>
<note>
<para>This option does not work with a wild-card
<replaceable>interface</replaceable> name (e.g., eth0.+) in
the INTERFACE column.</para>
</note>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">arp_ignore</emphasis>[=<emphasis>number</emphasis>]</term>
<listitem>
<para>If specified, this interface will respond to arp
requests based on the value of <emphasis>number</emphasis>
(defaults to 1).</para>
<para>1 - reply only if the target IP address is local address
configured on the incoming interface</para>
<para>2 - reply only if the target IP address is local address
configured on the incoming interface and the sender's IP
address is part from same subnet on this interface</para>
<para>3 - do not reply for local addresses configured with
scope host, only resolutions for global and link</para>
<para>4-7 - reserved</para>
<para>8 - do not reply for all local addresses</para>
<para></para>
<note>
<para>This option does not work with a wild-card
<replaceable>interface</replaceable> name (e.g., eth0.+) in
the INTERFACE column.</para>
</note>
<para></para>
<warning>
<para>Do not specify <emphasis
role="bold">arp_ignore</emphasis> for any interface involved
in <ulink url="../ProxyARP.htm">Proxy ARP</ulink>.</para>
</warning>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">blacklist</emphasis></term>
<listitem>
<para>Check packets arriving on this interface against the
<ulink
url="shorewall-blacklist.html">shorewall-blacklist</ulink>(5)
file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">bridge</emphasis></term>
<listitem>
<para>(Shorewall-perl only) Designates the interface as a
bridge.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">detectnets</emphasis>
(Deprecated)</term>
<listitem>
<para>Automatically tailors the zone named in the ZONE column
to include only those hosts routed through the
interface.</para>
<para></para>
<warning>
<para>Do not set the <emphasis
role="bold">detectnets</emphasis> option on your internet
interface.</para>
<para>Support for this option will be removed in a future
release of Shorewall-perl. Better to use the <emphasis
role="bold">routefilter</emphasis> option together with the
<emphasis role="bold">logmartians</emphasis> option.</para>
</warning>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">dhcp</emphasis></term>
<listitem>
<para>Specify this option when any of the following are
true:</para>
<orderedlist spacing="compact">
<listitem>
<para>the interface gets its IP address via DHCP</para>
</listitem>
<listitem>
<para>the interface is used by a DHCP server running on
the firewall</para>
</listitem>
<listitem>
<para>the interface has a static IP but is on a LAN
segment with lots of DHCP clients.</para>
</listitem>
<listitem>
<para>the interface is a bridge with a DHCP server on one
port and DHCP clients on another port.</para>
</listitem>
</orderedlist>
<para>This option allows DHCP datagrams to enter and leave the
interface.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">logmartians[={0|1}]</emphasis></term>
<listitem>
<para>Turn on kernel martian logging (logging of packets with
impossible source addresses. It is strongly suggested that if
you set <emphasis role="bold">routefilter</emphasis> on an
interface that you also set <emphasis
role="bold">logmartians</emphasis>. Even if you do not specify
the <option>routefilter</option> option, it is a good idea to
specify <option>logmartians</option> because your distribution
may be enabling route filtering without you knowing it.</para>
<para>The option value (0 or 1) may only be specified if you
are using Shorewall-perl. With Shorewall-perl, only those
interfaces with the <option>logmartians</option> option will
have their setting changes; the value assigned to the setting
will be the value specified (if any) or 1 if no value is
given.</para>
<para>To find out if route filtering is set on a given
<replaceable>interface</replaceable>, check the contents of
<filename>/proc/sys/net/ipv4/conf/<replaceable>interface</replaceable>/rp_filter</filename>
- a non-zero value indicates that route filtering is
enabled.</para>
<para>Example:</para>
<programlisting> teastep@lists:~$ <command>cat /proc/sys/net/ipv4/conf/eth0/rp_filter </command>
1
teastep@lists:~$ </programlisting>
<para></para>
<note>
<para>This option does not work with a wild-card
<replaceable>interface</replaceable> name (e.g., eth0.+) in
the INTERFACE column.</para>
</note>
<blockquote>
<para>This option may also be enabled globally in the <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5)
file.</para>
</blockquote>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">maclist</emphasis></term>
<listitem>
<para>Connection requests from this interface are compared
against the contents of <ulink
url="shorewall-maclist.html">shorewall-maclist</ulink>(5). If
this option is specified, the interface must be an ethernet
NIC and must be up before Shorewall is started.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">mss</emphasis>[=<emphasis>number</emphasis>]</term>
<listitem>
<para>Added in Shorewall 4.0.3. Causes forwarded TCP SYN
packets entering or leaving on this interface to have their
MSS field set to the specified
<replaceable>number</replaceable>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">norfc1918</emphasis></term>
<listitem>
<para>This interface should not receive any packets whose
source is in one of the ranges reserved by RFC 1918 (i.e.,
private or "non-routable" addresses). If packet mangling or
connection-tracking match is enabled in your kernel, packets
whose destination addresses are reserved by RFC 1918 are also
rejected.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">nosmurfs</emphasis></term>
<listitem>
<para>Filter packets for smurfs (packets with a broadcast
address as the source).</para>
<para>Smurfs will be optionally logged based on the setting of
SMURF_LOG_LEVEL in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5). After
logging, the packets are dropped.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">optional</emphasis></term>
<listitem>
<para>Only supported by Shorewall-perl. When
<option>optional</option> is specified for an interface,
Shorewall will be silent when:</para>
<itemizedlist>
<listitem>
<para>a <filename
class="directory">/proc/sys/net/ipv4/conf/</filename>
entry for the interface cannot be modified (including for
proxy ARP).</para>
</listitem>
<listitem>
<para>The first address of the interface cannot be
obtained.</para>
</listitem>
</itemizedlist>
<para></para>
<blockquote>
<para>I specify <option>optional</option> on interfaces to
Xen virtual machines that may or may not be running when
Shorewall is [re]started.</para>
<para></para>
<caution>
<para>Use <option>optional</option> at your own risk. If
you [re]start Shorewall when an 'optional' interface is
not available and then do a <command>shorewall
save</command>, subsequent <command>shorewall
restore</command> and <command>shorewall -f
start</command> operations will instantiate a ruleset that
does not support that interface, even if it is available
at the time of the restore/start.</para>
</caution>
</blockquote>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">proxyarp[={0|1}]</emphasis></term>
<listitem>
<para>Sets
/proc/sys/net/ipv4/conf/<emphasis>interface</emphasis>/proxy_arp.
Do NOT use this option if you are employing Proxy ARP through
entries in <ulink
url="shorewall-proxyarp.html">shorewall-proxyarp</ulink>(5).
This option is intended solely for use with Proxy ARP
sub-networking as described at: <ulink
url="http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html">http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.
</ulink></para>
<para><emphasis role="bold">Note</emphasis>: This option does
not work with a wild-card <replaceable>interface</replaceable>
name (e.g., eth0.+) in the INTERFACE column.</para>
<para>The option value (0 or 1) may only be specified if you
are using Shorewall-perl. With Shorewall-perl, only those
interfaces with the <option>proxyarp</option> option will have
their setting changes; the value assigned to the setting will
be the value specified (if any) or 1 if no value is
given.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">routeback</emphasis></term>
<listitem>
<para>If specified, indicates that Shorewall should include
rules that allow filtering traffic arriving on this interface
back out that same interface. This option is also required
when you have used a wildcard in the INTERFACE column if you
want to allow traffic between the interfaces that match the
wildcard.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">routefilter[={0|1}]</emphasis></term>
<listitem>
<para>Turn on kernel route filtering for this interface
(anti-spoofing measure).</para>
<para>The option value (0 or 1) may only be specified if you
are using Shorewall-perl. With Shorewall-perl, only those
interfaces with the <option>routefilter</option> option will
have their setting changes; the value assigned to the setting
will be the value specified (if any) or 1 if no value is
given.</para>
<para></para>
<note>
<para>This option does not work with a wild-card
<replaceable>interface</replaceable> name (e.g., eth0.+) in
the INTERFACE column.</para>
</note>
<blockquote>
<para>This option can also be enabled globally in the <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5)
file.</para>
</blockquote>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">sourceroute[={0|1}]</emphasis></term>
<listitem>
<para>If this option is not specified for an interface, then
source-routed packets will not be accepted from that interface
(sets
/proc/sys/net/ipv4/conf/<emphasis>interface</emphasis>/accept_source_route
to 1). Only set this option if you know what you are doing.
This might represent a security risk and is not usually
needed.</para>
<para>The option value (0 or 1) may only be specified if you
are using Shorewall-perl. With Shorewall-perl, only those
interfaces with the <option>sourceroute</option> option will
have their setting changes; the value assigned to the setting
will be the value specified (if any) or 1 if no value is
given.</para>
<para></para>
<note>
<para>This option does not work with a wild-card
<replaceable>interface</replaceable> name (e.g., eth0.+) in
the INTERFACE column.</para>
</note>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">tcpflags</emphasis></term>
<listitem>
<para>Packets arriving on this interface are checked for
certain illegal combinations of TCP flags. Packets found to
have such a combination of flags are handled according to the
setting of TCP_FLAGS_DISPOSITION after having been logged
according to the setting of TCP_FLAGS_LOG_LEVEL.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">upnp</emphasis></term>
<listitem>
<para>Incoming requests from this interface may be remapped
via UPNP (upnpd). See <ulink
url="../UPnP.html">http://www.shorewall.net/UPnP.html</ulink>.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Suppose you have eth0 connected to a DSL modem and eth1
connected to your local network and that your local subnet is
192.168.1.0/24. The interface gets it's IP address via DHCP from
subnet 206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24
using eth2.</para>
<para>Your entries for this setup would look like:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
net eth0 206.191.149.223 dhcp
loc eth1 192.168.1.255
dmz eth2 192.168.2.255</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>The same configuration without specifying broadcast addresses
is:</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect dhcp
loc eth1 detect
dmz eth2 detect</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 3:</term>
<listitem>
<para>You have a simple dial-in system with no ethernet
connections.</para>
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
net ppp0 -</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/interfaces</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

111
manpages6/shorewall-maclist.xml Normal file
View File

@ -0,0 +1,111 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-maclist</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>maclist</refname>
<refpurpose>Shorewall MAC Verification file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/maclist</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define the MAC addresses and optionally their
associated IP addresses to be allowed to use the specified interface. The
feature is enabled by using the <emphasis role="bold">maclist</emphasis>
option in the <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5) or <ulink
url="shorewall-hosts.html">shorewall-hosts</ulink>(5) configuration
file.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">DISPOSITION</emphasis> - {<emphasis
role="bold">ACCEPT</emphasis>|<emphasis
role="bold">DROP</emphasis>|<emphasis
role="bold">REJECT</emphasis>}[<option>:</option><replaceable>log-level</replaceable>]</term>
<listitem>
<para><emphasis role="bold">ACCEPT</emphasis> or <emphasis
role="bold">DROP</emphasis> (if MACLIST_TABLE=filter in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5), then REJECT is
also allowed). If specified, the
<replaceable>log-level</replaceable> causes packets matching the
rule to be logged at that level.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>Network <emphasis>interface</emphasis> to a host.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MAC</emphasis> -
<emphasis>address</emphasis></term>
<listitem>
<para>MAC <emphasis>address</emphasis> of the host -- you do not
need to use the Shorewall format for MAC addresses here. If
<emphasis role="bold">IP ADDRESSESES</emphasis> is supplied then
<emphasis role="bold">MAC</emphasis> can be supplied as a dash
(<emphasis role="bold">-</emphasis>)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">IP ADDRESSES</emphasis> (Optional) -
[<emphasis>address</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address</emphasis>]...]</term>
<listitem>
<para>If specified, both the MAC and IP address must match. This
column can contain a comma-separated list of host and/or subnet
addresses. If your kernel and iptables have iprange match support
then IP address ranges are also allowed. Similarly, if your kernel
and iptables include ipset support than set names (prefixed by "+")
are also allowed.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/maclist</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/MAC_Validation.html">http://shorewall.net/MAC_Validation.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

502
manpages6/shorewall-masq.xml Normal file
View File

@ -0,0 +1,502 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall-masq</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>masq</refname>
<refpurpose>Shorewall Masquerade/SNAT definition file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/masq</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Use this file to define dynamic NAT (Masquerading) and to define
Source NAT (SNAT).</para>
<warning>
<para>The entries in this file are order-sensitive. The first entry that
matches a particular connection will be the one that is used.</para>
</warning>
<warning>
<para>If you have more than one ISP, adding entries to this file will
*not* force connections to go out through a particular ISP. You must use
PREROUTING entries in <ulink
url="shorewall-tcrules.html">shorewall-tcrules</ulink>(5) to do
that.</para>
</warning>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> - [<emphasis
role="bold">+</emphasis>]<emphasis>interfacelist</emphasis>[<emphasis
role="bold">:</emphasis>[<emphasis>digit</emphasis>]][<emphasis
role="bold">:</emphasis>[<emphasis>address</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]]</term>
<listitem>
<para>Outgoing <emphasis>interfacelist</emphasis>. Prior to
Shorewall 4.1.4, this must be a single interface name; in 4.1.4 and
later, this may be a comma-separated list of interface names. This
is usually your internet interface. If ADD_SNAT_ALIASES=Yes in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5), you may
add ":" and a <emphasis>digit</emphasis> to indicate that you want
the alias added with that name (e.g., eth0:0). This will allow the
alias to be displayed with ifconfig. <emphasis role="bold">That is
the only use for the alias name; it may not appear in any other
place in your Shorewall configuratio</emphasis>n.</para>
<para>Each interface must match an entry in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
Prior to Shorewall 4.1.4, this must be an exact match.
Shorewall-perl 4.1.4 and later allow loose matches to wildcard
entries in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). For
example, <filename class="devicefile">ppp0</filename> in this file
will match a <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
entry that defines <filename
class="devicefile">ppp+</filename>.</para>
<para>The interface may be qualified by adding the character ":"
followed by a comma-separated list of destination host or subnet
addresses to indicate that you only want to change the source IP
address for packets being sent to those particular destinations.
Exclusion is allowed (see <ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
<para>If you wish to inhibit the action of ADD_SNAT_ALIASES for this
entry then include the ":" but omit the digit:</para>
<programlisting> eth0:
eth2::192.0.2.32/27</programlisting>
<para>Normally Masq/SNAT rules are evaluated after those for
one-to-one NAT (defined in <ulink
url="shorewall-nat.html">shorewall-nat</ulink>(5)). If you want the
rule to be applied before one-to-one NAT rules, prefix the interface
name with "+":</para>
<programlisting> +eth0
+eth0:192.0.2.32/27
+eth0:2</programlisting>
<para>This feature should only be required if you need to insert
rules in this file that preempt entries in <ulink
url="shorewall-nat.html">shorewall-nat</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> (Formerly called SUBNET)
-
{<emphasis>interface</emphasis>[[:]<emphasis>exclusion</emphasis>]|<emphasis>address</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address</emphasis>][<emphasis>exclusion</emphasis>]}</term>
<listitem>
<para>Set of hosts that you wish to masquerade. You can specify this
as an <emphasis>address</emphasis> (net or host) or as an
<emphasis>interface</emphasis>. If you give the name of an
interface, the interface must be up before you start the firewall
(Shorewall will use your main routing table to determine the
appropriate addresses to masquerade).</para>
<para>In order to exclude a address of the specified SOURCE, you may
append an <emphasis>exclusion</emphasis> ("!" and a comma-separated
list of IP addresses (host or net) that you wish to exclude (see
<ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5))).
Note that with Shorewall-perl, a colon (":") must appear between an
<replaceable>interface</replaceable> name and the
<replaceable>exclusion</replaceable>;</para>
<para>Example (shorewall-shell):
eth1!192.168.1.4,192.168.32.0/27</para>
<para>Example (shorewall-perl):
eth1:!192.168.1.4,192.168.32.0/27</para>
<para>In that example traffic from eth1 would be masqueraded unless
it came from 192.168.1.4 or 196.168.32.0/27</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ADDRESS</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">NONAT</emphasis>|[<emphasis
role="bold">SAME:</emphasis>[<emphasis
role="bold">nodst:</emphasis>]][<emphasis>address-or-address-range</emphasis>[,<emphasis>address-or-address-range</emphasis>]...][:<emphasis>lowport</emphasis><emphasis
role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
role="bold">:random</emphasis>]|<emphasis
role="bold">detect</emphasis>|<emphasis
role="bold">random</emphasis>]</term>
<listitem>
<para>If you specify an address here, SNAT will be used and this
will be the source address. If ADD_SNAT_ALIASES is set to Yes or yes
in <ulink url="shorewall.conf.html">shorewall.conf</ulink>(5) then
Shorewall will automatically add this address to the INTERFACE named
in the first column.</para>
<para>You may also specify a range of up to 256 IP addresses if you
want the SNAT address to be assigned from that range in a
round-robin fashion by connection. The range is specified by
<emphasis>first.ip.in.range</emphasis>-<emphasis>last.ip.in.range</emphasis>.
Beginning with Shorewall 4.0.6, you may follow the port range
with<emphasis role="bold"> :random</emphasis> in which case
assignment of ports from the list will be random. <emphasis
role="bold">random</emphasis> may also be specified by itself in
this column in which case random local port assignments are made for
the outgoing connections.</para>
<para>Example: 206.124.146.177-206.124.146.180</para>
<para>You may also use the special value "detect" which causes
Shorewall to determine the IP addresses configured on the interface
named in the INTERFACES column and substitute them in this
column.</para>
<para>Finally, you may also specify a comma-separated list of ranges
and/or addresses in this column.</para>
<para>This column may not contain DNS Names.</para>
<para>Normally, Netfilter will attempt to retain the source port
number. You may cause netfilter to remap the source port by
following an address or range (if any) by ":" and a port range with
the format
<emphasis>lowport</emphasis>-<emphasis>highport</emphasis>. If this
is done, you must specify "tcp" or "udp" in the PROTO column.</para>
<para>Examples:</para>
<programlisting> 192.0.2.4:5000-6000
:4000-5000</programlisting>
<para>You can invoke the SAME target rather than the SNAT target by
prefixing the column contents with <option>SAME:</option>.</para>
<para>SAME works like SNAT with the exception that the same local IP
address is assigned to each connection from a local address to a
given remote address.</para>
<para>If the <option>nodst:</option> option is included, then the
same source address is used for a given internal system regardless
of which remote system is involved.<warning>
<para>Support for the SAME target is scheduled for removal from
the Linux kernel in 2008.</para>
</warning></para>
<para>If you simply place <emphasis role="bold">NONAT</emphasis> in
this column, no rewriting of the source IP address or port number
will be performed. This is useful if you want particular traffic to
be exempt from the entries that follow in the file.</para>
<para>If you want to leave this column empty but you need to specify
the next column then place a hyphen ("-") here.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTO</emphasis> (Optional) - {<emphasis
role="bold">-</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>}</term>
<listitem>
<para>If you wish to restrict this entry to a particular protocol
then enter the protocol name (from protocols(5)) or number
here.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (Optional) -
[<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...]</term>
<listitem>
<para>If the PROTO column specifies TCP (protocol 6) or UDP
(protocol 17) then you may list one or more port numbers (or names
from services(5)) separated by commas or you may list a single port
range
(<emphasis>lowport</emphasis>:<emphasis>highport</emphasis>).</para>
<para>Where a comma-separated list is given, your kernel and
iptables must have multiport match support and a maximum of 15 ports
may be listed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">IPSEC</emphasis> (Optional) -
[<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>If you specify a value other than "-" in this column, you must
be running kernel 2.6 and your kernel and iptables must include
policy match support.</para>
<para>Comma-separated list of options from the following. Only
packets that will be encrypted via an SA that matches these options
will have their source address changed.</para>
<variablelist>
<varlistentry>
<term><emphasis
role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
<listitem>
<para>where <emphasis>number</emphasis> is specified using
setkey(8) using the 'unique:<emphasis>number</emphasis> option
for the SPD level.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
<listitem>
<para>where <emphasis>number</emphasis> is the SPI of the SA
used to encrypt/decrypt packets.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">proto=</emphasis><emphasis
role="bold">ah</emphasis>|<emphasis
role="bold">esp</emphasis>|<emphasis
role="bold">ipcomp</emphasis></term>
<listitem>
<para>IPSEC Encapsulation Protocol</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">mss=</emphasis><emphasis>number</emphasis></term>
<listitem>
<para>sets the MSS field in TCP packets</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mode=</emphasis><emphasis
role="bold">transport</emphasis>|<emphasis
role="bold">tunnel</emphasis></term>
<listitem>
<para>IPSEC mode</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
<listitem>
<para>only available with mode=tunnel</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
<listitem>
<para>only available with mode=tunnel</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">strict</emphasis></term>
<listitem>
<para>Means that packets must match all rules.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">next</emphasis></term>
<listitem>
<para>Separates rules; can only be used with strict</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> - [<emphasis
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
role="bold">:C</emphasis>]</term>
<listitem>
<para>Defines a test on the existing packet or connection mark. The
rule will match only if the test returns true.</para>
<para>If you don't want to define a test but need to specify
anything in the following columns, place a "-" in this field.</para>
<variablelist>
<varlistentry>
<term>!</term>
<listitem>
<para>Inverts the test (not equal)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>value</emphasis></term>
<listitem>
<para>Value of the packet or connection mark.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>mask</emphasis></term>
<listitem>
<para>A mask to be applied to the mark before testing.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">:C</emphasis></term>
<listitem>
<para>Designates a connection mark. If omitted, the packet
mark's value is tested. This option is only supported by
Shorewall-perl.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>You have a simple masquerading setup where eth0 connects to a
DSL or cable modem and eth1 connects to your local network with
subnet 192.168.0.0/24.</para>
<para>Your entry in the file can be either:</para>
<programlisting> #INTERFACE SOURCE
eth0 eth1</programlisting>
<para>or</para>
<programlisting> #INTERFACE SOURCE
eth0 192.168.0.0/24</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>You add a router to your local network to connect subnet
192.168.1.0/24 which you also want to masquerade. You then add a
second entry for eth0 to this file:</para>
<programlisting> #INTERFACE SOURCE
eth0 192.168.1.0/24</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 3:</term>
<listitem>
<para>You have an IPSEC tunnel through ipsec0 and you want to
masquerade packets coming from 192.168.1.0/24 but only if these
packets are destined for hosts in 10.1.1.0/24:</para>
<programlisting> #INTERFACE SOURCE
ipsec0:10.1.1.0/24 196.168.1.0/24</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 4:</term>
<listitem>
<para>You want all outgoing traffic from 192.168.1.0/24 through eth0
to use source address 206.124.146.176 which is NOT the primary
address of eth0. You want 206.124.146.176 to be added to eth0 with
name eth0:0.</para>
<programlisting> #INTERFACE SOURCE ADDRESS
eth0:0 192.168.1.0/24 206.124.146.176</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 5:</term>
<listitem>
<para>You want all outgoing SMTP traffic entering the firewall on
eth1 to be sent from eth0 with source IP address 206.124.146.177.
You want all other outgoing traffic from eth1 to be sent from eth0
with source IP address 206.124.146.176.</para>
<programlisting> #INTERFACE SOURCE ADDRESS PROTO PORT(S)
eth0 eth1 206.124.146.177 tcp smtp
eth0 eth1 206.124.146.176</programlisting>
<warning>
<para>The order of the above two rules is significant!</para>
</warning>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/masq</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-exclusion(5), shorewall-hosts(5),
shorewall-interfaces(5), shorewall-ipsec(5), shorewall-maclist(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

81
manpages6/shorewall-modules.xml Normal file
View File

@ -0,0 +1,81 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-modules</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>modules</refname>
<refpurpose>Shorewall file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/usr/share/shorewall/modules</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file specifies which kernel modules Shorewall will load before
trying to determine your iptables/kernel's capabilities. Each record in
the file has the following format:</para>
<cmdsynopsis>
<command>loadmodule</command>
<arg choice="plain"><replaceable
class="parameter">modulename</replaceable></arg>
<arg rep="repeat"><replaceable>moduleoption</replaceable></arg>
</cmdsynopsis>
<para>The <replaceable>modulename</replaceable> names a kernel module
(without suffix). Shorewall will search for modules based on your
MODULESDIR and MODULE_SUFFIX settings in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(8). The
<replaceable>moduleoption</replaceable>s are passed to modprobe (if
installed) or to insmod.</para>
<para>The /usr/share/shorewall/modules file contains a large number of
modules. Users are encouraged to copy the file to /etc/shorewall/modules
and modify the copy to load only the modules required.<note>
<para>If you build monolithic kernels and have not installed
module-init-tools, then create an empty /etc/shorewall/modules file;
that will prevent Shorewall from trying to load modules at all.
</para>
</note></para>
</refsect1>
<refsect1>
<title>Example</title>
<para>loadmodule ip_conntrack_ftp ports=21,221</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/usr/share/shorewall/modules</para>
<para>/etc/shorewall/modules</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

154
manpages6/shorewall-nat.xml Normal file
View File

@ -0,0 +1,154 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-nat</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>nat</refname>
<refpurpose>Shorewall one-to-one NAT file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/nat</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define one-to-one Network Address Translation
(NAT).</para>
<warning>
<para>If all you want to do is simple port forwarding, do NOT use this
file. See <ulink
url="../FAQ.htm#faq1">http://www.shorewall.net/FAQ.htm#faq1</ulink>.
Also, in many cases, Proxy ARP (<ulink
url="shorewall-proxyarp.html">shorewall-proxyarp</ulink>(5)) is a better
solution that one-to-one NAT.</para>
</warning>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">EXTERNAL</emphasis> -
<emphasis>address</emphasis></term>
<listitem>
<para>External IP Address - this should NOT be the primary IP
address of the interface named in the next column and must not be a
DNS Name.</para>
<para>If you put COMMENT in this column, the rest of the line will
be attached as a comment to the Netfilter rule(s) generated by the
following entries in the file. The comment will appear delimited by
"/* ... */" in the output of "shorewall show nat"</para>
<para>To stop the comment from being attached to further rules,
simply include COMMENT on a line by itself.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interfacelist</emphasis>[<emphasis
role="bold">:</emphasis>[<emphasis>digit</emphasis>]]</term>
<listitem>
<para>Interfacees that have the <emphasis
role="bold">EXTERNAL</emphasis> address. If ADD_IP_ALIASES=Yes in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5),
Shorewall will automatically add the EXTERNAL address to this
interface. Also if ADD_IP_ALIASES=Yes, you may follow the interface
name with ":" and a <emphasis>digit</emphasis> to indicate that you
want Shorewall to add the alias with this name (e.g., "eth0:0").
That allows you to see the alias with ifconfig. <emphasis
role="bold">That is the only thing that this name is good for -- you
cannot use it anwhere else in your Shorewall configuration.
</emphasis></para>
<para>Each interface must match an entry in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
Prior to Shorewall 4.1.4, this must be an exact match.
Shorewall-perl 4.1.4 and later allow loose matches to wildcard
entries in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). For
example, <filename class="devicefile">ppp0</filename> in this file
will match a <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
entry that defines <filename
class="devicefile">ppp+</filename>.</para>
<para>Prior to Shorewall 4.1.4,
<replaceable>interfacelist</replaceable> must be a single interface
name. Beginning with Shorewall-perl 4.1.4, Shorewall-perl users may
specify a comma-separated list of interfaces.</para>
<para>If you want to override ADD_IP_ALIASES=Yes for a particular
entry, follow the interface name with ":" and no digit (e.g.,
"eth0:").</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERNAL</emphasis> -
<emphasis>address</emphasis></term>
<listitem>
<para>Internal Address (must not be a DNS Name).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ALL INTERFACES</emphasis> - [<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If Yes or yes, NAT will be effective from all hosts. If No or
no (or left empty) then NAT will be effective only through the
interface named in the <emphasis role="bold">INTERFACE</emphasis>
column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">LOCAL</emphasis> - [<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If <emphasis role="bold">Yes</emphasis> or <emphasis
role="bold">yes</emphasis>, NAT will be effective from the firewall
system</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/nat</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/NAT.htm">http://shorewall.net/NAT.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-netmap(5),
shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

211
manpages6/shorewall-nesting.xml Normal file
View File

@ -0,0 +1,211 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-nesting</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>nesting</refname>
<refpurpose>Shorewall Nested Zones</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<arg choice="plain"
rep="norepeat"><replaceable>child-zone</replaceable>[:<replaceable>parent-zone</replaceable>[,<replaceable>parent-zone</replaceable>]...]</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>In <ulink url="shorewall-zones.html">shorewall-zones</ulink>(5), a
zone may be declared to be a sub-zone of one or more other zones using the
above syntax.</para>
<para>Where zones are nested, the CONTINUE policy in <ulink
url="shorewall-policy.html">shorewall-policy</ulink>(5) allows hosts that
are within multiple zones to be managed under the rules of all of these
zones.</para>
</refsect1>
<refsect1>
<title>Example</title>
<para><filename>/etc/shorewall/zones</filename>:</para>
<programlisting> #ZONE TYPE OPTION
fw firewall
net ipv4
sam:net ipv4
loc ipv4</programlisting>
<para><filename>/etc/shorewall/interfaces</filename>:</para>
<programlisting> #ZONE INTERFACE BROADCAST OPTIONS
- eth0 detect dhcp,norfc1918
loc eth1 detect</programlisting>
<para><filename>/etc/shorewall/hosts</filename>:</para>
<programlisting> #ZONE HOST(S) OPTIONS
net eth0:0.0.0.0/0
sam eth0:206.191.149.197</programlisting>
<para><filename>/etc/shorewall/policy</filename>:</para>
<programlisting> #SOURCE DEST POLICY LOG LEVEL
loc net ACCEPT
sam all CONTINUE
net all DROP info
all all REJECT info</programlisting>
<para>The second entry above says that when Sam is the client, connection
requests should first be processed under rules where the source zone is
sam and if there is no match then the connection request should be treated
under rules where the source zone is net. It is important that this policy
be listed BEFORE the next policy (net to all). You can have this policy
generated for you automatically by using the IMPLICIT_CONTINUE option in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
<para>Partial <filename>/etc/shorewall/rules</filename>:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST PORT(S)
...
DNAT sam loc:192.168.1.3 tcp ssh
DNAT net loc:192.168.1.5 tcp www
...</programlisting>
<para>Given these two rules, Sam can connect to the firewall's internet
interface with ssh and the connection request will be forwarded to
192.168.1.3. Like all hosts in the net zone, Sam can connect to the
firewall's internet interface on TCP port 80 and the connection request
will be forwarded to 192.168.1.5. The order of the rules is not
significant. Sometimes it is necessary to suppress port forwarding for a
sub-zone. For example, suppose that all hosts can SSH to the firewall and
be forwarded to 192.168.1.5 EXCEPT Sam. When Sam connects to the
firewall's external IP, he should be connected to the firewall itself.
Because of the way that Netfilter is constructed, this requires two rules
as follows:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST PORT(S)
...
ACCEPT+ sam $FW tcp ssh
DNAT net loc:192.168.1.3 tcp ssh
...</programlisting>
<para>The first rule allows Sam SSH access to the firewall. The second
rule says that any clients from the net zone with the exception of those
in the “sam” zone should have their connection port forwarded to
192.168.1.3. If you need to exclude more than one zone, simply use
multiple ACCEPT+ rules. This technique also may be used when the ACTION is
REDIRECT.</para>
<para>Care must be taken when nesting occurs as a result of the use of
wildcard interfaces (interface names ends in '+').</para>
<para>Here's an example. <filename>/etc/shorewall/zones</filename>:</para>
<para><filename>/etc/shorewall/interfaces</filename>:<programlisting> #ZONE INTERFACE BROADCAST OPTIONS
net ppp0
loc eth1
loc ppp+
dmz eth2</programlisting></para>
<para>Because the net zone is declared before the loc zone, net is an
implicit sub-zone of loc and in the absence of a net-&gt;... CONTINUE
policy, traffic from the net zone will not be passed through loc-&gt;...
rules. But DNAT and REDIRECT rules are an exception!</para>
<itemizedlist>
<listitem>
<para>DNAT and REDIRECT rules generate two Netfilter rules: a 'nat'
table rule that rewrites the destination IP address and/or port
number, and a 'filter' table rule that ACCEPTs the rewritten
connection.</para>
</listitem>
<listitem>
<para>Policies only affect the 'filter' table.</para>
</listitem>
</itemizedlist>
<para>As a consequence, the following rules will have unexpected
behavior:<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
ACCEPT net dmz tcp 80
REDIRECT loc 3128 tcp 80</programlisting></para>
<para>The second rule is intended to redirect local web requests to a
proxy running on the firewall and listening on TCP port 3128. But the
'nat' part of that rule will cause all connection requests for TCP port 80
arriving on interface ppp+ (including ppp0!) to have their destination
port rewritten to 3128. Hence, the web server running in the DMZ will be
inaccessible from the web.</para>
<para>The above problem can be corrected in several ways.</para>
<para>The preferred way is to use the <option>ifname</option> pppd option
to change the 'net' interface to something other than ppp0. That way, it
won't match ppp+.</para>
<para>If you are running Shorewall version 4.1.4 or later, a second way is
to simply make the nested zones explicit:<programlisting> #ZONE TYPE OPTION
fw firewall
loc ipv4
net:loc ipv4
dmz ipv4</programlisting></para>
<para>If you take this approach, be sure to set IMPLICIT_CONTINUE=No in
<filename>shorewall.conf</filename>.</para>
<para>When using other Shorewall versions, another way is to rewrite the
DNAT rule (assume that the local zone is entirely within
192.168.2.0/23):<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
ACCEPT net dmz tcp 80
REDIRECT loc:192.168.2.0/23 3128 tcp 80</programlisting></para>
<para>Another way is to restrict the definition of the loc zone:</para>
<para><filename>/etc/shorewall/interfaces</filename>:<programlisting> #ZONE INTERFACE BROADCAST OPTIONS
net ppp0
loc eth1
- ppp+
dmz eth2</programlisting></para>
<para><filename>/etc/shorewall/hosts</filename>:<programlisting> #ZONE HOST(S) OPTIONS
loc ppp+:192.168.2.0/23</programlisting></para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/zones</para>
<para>/etc/shorewall/interfaces</para>
<para>/etc/shorewall/hosts</para>
<para>/etc/shorewall/policy</para>
<para>/etc/shorewall/rules</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

114
manpages6/shorewall-netmap.xml Normal file
View File

@ -0,0 +1,114 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-netmap</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>netmap</refname>
<refpurpose>Shorewall NETMAP definition file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/netmap</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to map addresses in one network to corresponding
addresses in a second network.</para>
<warning>
<para>To use this file, your kernel and iptables must have NETMAP
support included.</para>
</warning>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">TYPE</emphasis> - <emphasis
role="bold">DNAT</emphasis>|<emphasis
role="bold">SNAT</emphasis></term>
<listitem>
<para>Must be DNAT or SNAT.</para>
<para>If DNAT, traffic entering INTERFACE and addressed to NET1 has
it's destination address rewritten to the corresponding address in
NET2.</para>
<para>If SNAT, traffic leaving INTERFACE with a source address in
NET1 has it's source address rewritten to the corresponding address
in NET2.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">NET1</emphasis> -
<emphasis>network-address</emphasis></term>
<listitem>
<para>Network in CIDR format (e.g., 192.168.1.0/24).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>The name of a network interface. The interface must be defined
in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
Prior to Shorewall 4.1.4, this must be an exact match.
Shorewall-perl 4.1.4 and later allow loose matches to wildcard
entries in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). For
example, <filename class="devicefile">ppp0</filename> in this file
will match a <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(8)
entry that defines <filename
class="devicefile">ppp+</filename>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">NET2</emphasis> -
<emphasis>network-address</emphasis></term>
<listitem>
<para>Network in CIDR format</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/netmap</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/netmap.html">http://shorewall.net/netmap.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

70
manpages6/shorewall-params.xml Normal file
View File

@ -0,0 +1,70 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-params</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>params</refname>
<refpurpose>Shorewall parameters file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/params</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Assign any shell variables that you need in this file.</para>
<para>It is suggested that variable names begin with an upper case letter
to distinguish them from variables used internally within the Shorewall
programs</para>
<para>Example params file:</para>
<programlisting>NET_IF=eth0
NET_BCAST=130.252.100.255
NET_OPTIONS=routefilter,norfc1918</programlisting>
<para>Example <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
file.</para>
<programlisting>ZONE INTERFACE BROADCAST OPTIONS
net $NET_IF $NET_BCAST $NET_OPTIONS</programlisting>
<para>This is the same as if the interfaces file had contained:</para>
<programlisting>ZONE INTERFACE BROADCAST OPTIONS
net eth0 130.252.100.255 routefilter,norfc1918</programlisting>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/params</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://www.shorewall.net/configuration_file_basics.htm#Variables?">http://www.shorewall.net/configuration_file_basics.htm#Variables</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

312
manpages6/shorewall-policy.xml Normal file
View File

@ -0,0 +1,312 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall-policy</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>policy</refname>
<refpurpose>Shorewall policy file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/policy</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file defines the high-level policy for connections between
zones defined in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5).</para>
<important>
<para>The order of entries in this file is important</para>
<para>This file determines what to do with a new connection request if
we don't get a match from the /etc/shorewall/rules file . For each
source/destination pair, the file is processed in order until a match is
found ("all" will match any client or server).</para>
</important>
<important>
<para>Intra-zone policies are pre-defined</para>
<para>For $FW and for all of the zones defined in /etc/shorewall/zones,
the POLICY for connections from the zone to itself is ACCEPT (with no
logging or TCP connection rate limiting but may be overridden by an
entry in this file. The overriding entry must be explicit (cannot use
"all" in the SOURCE or DEST).</para>
<para>Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall.conf,
then the implicit policy to/from any sub-zone is CONTINUE. These
implicit CONTINUE policies may also be overridden by an explicit entry
in this file.</para>
</important>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> -
<emphasis>zone</emphasis>|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">all</emphasis></term>
<listitem>
<para>Source zone. Must be the name of a zone defined in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5), $FW or
"all".</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> -
<emphasis>zone</emphasis>|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">all</emphasis></term>
<listitem>
<para>Destination zone. Must be the name of a zone defined in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5), $FW or "all".
If the DEST is a bport zone, then the SOURCE must be "all", another
bport zone associated with the same bridge, or it must be an ipv4
zone that is associated with only the same bridge.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">POLICY</emphasis> - {<emphasis
role="bold">ACCEPT</emphasis>|<emphasis
role="bold">DROP</emphasis>|<emphasis
role="bold">REJECT</emphasis>|<emphasis
role="bold">CONTINUE</emphasis>|<emphasis
role="bold">QUEUE</emphasis>|<emphasis
role="bold">NFQUEUE</emphasis>[(<emphasis>queuenumber</emphasis>)]|<emphasis
role="bold">NONE</emphasis>}[<emphasis
role="bold">:</emphasis>{<emphasis>default-action-or-macro</emphasis>|<emphasis
role="bold">None</emphasis>}]</term>
<listitem>
<para>Policy if no match from the rules file is found.</para>
<para>If the policy is other than CONTINUE or NONE then the policy
may be followed by ":" and one of the following:</para>
<orderedlist numeration="loweralpha">
<listitem>
<para>The word "None" or "none". This causes any default action
defined in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5) to be
omitted for this policy.</para>
</listitem>
<listitem>
<para>The name of an action (requires that USE_ACTIONS=Yes in
<ulink url="shorewall.conf.html">shorewall.conf</ulink>(5)).
That action will be invoked before the policy is
enforced.</para>
</listitem>
<listitem>
<para>The name of a macro. The rules in that macro will be
applied before the policy is enforced. This does not require
USE_ACTIONS=Yes.</para>
</listitem>
</orderedlist>
<blockquote>
<programlisting></programlisting>
<para>Possible policies are:</para>
</blockquote>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ACCEPT</emphasis></term>
<listitem>
<para>Accept the connection.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DROP</emphasis></term>
<listitem>
<para>Ignore the connection request.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">REJECT</emphasis></term>
<listitem>
<para>For TCP, send RST. For all other, send an "unreachable"
ICMP.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">QUEUE</emphasis></term>
<listitem>
<para>Queue the request for a user-space application such as
Snort-inline.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">NFQUEUE</emphasis></term>
<listitem>
<para>Added in Shorewall-perl 4.0.3. Queue the request for a
user-space application using the nfnetlink_queue mechanism. If
a <replaceable>queuenumber</replaceable> is not given, queue
zero (0) is assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONTINUE</emphasis></term>
<listitem>
<para>Pass the connection request past any other rules that it
might also match (where the source or destination zone in
those rules is a superset of the SOURCE or DEST in this
policy). See <ulink
url="shorewall-nesting.html">shorewall-nesting</ulink>(5) for
additional information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">NONE</emphasis></term>
<listitem>
<para>Assume that there will never be any packets from this
SOURCE to this DEST. Shorewall will not create any
infrastructure to handle such packets and you may not have any
rules with this SOURCE and DEST in the /etc/shorewall/rules
file. If such a packet <emphasis role="bold">is</emphasis>
received, the result is undefined. NONE may not be used if the
SOURCE or DEST columns contain the firewall zone ($FW) or
"all".</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">LOG LEVEL</emphasis> (Optional) -
[<emphasis>log-level</emphasis>|<emphasis
role="bold">ULOG</emphasis>]</term>
<listitem>
<para>If supplied, each connection handled under the default POLICY
is logged at that level. If not supplied, no log message is
generated. See syslog.conf(5) for a description of log
levels.</para>
<para>You may also specify ULOG (must be in upper case). This will
log to the ULOG target and will send to a separate log through use
of ulogd (<ulink
url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>).</para>
<para>If you don't want to log but need to specify the following
column, place "-" here.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">BURST:LIMIT</emphasis> -
<emphasis>rate</emphasis><emphasis role="bold">/</emphasis>{<emphasis
role="bold">second</emphasis>|<emphasis
role="bold">minute</emphasis>}:<emphasis>burst</emphasis></term>
<listitem>
<para>If passed, specifies the maximum TCP connection
<emphasis>rate</emphasis> and the size of an acceptable
<emphasis>burst</emphasis>. If not specified, TCP connections are
not limited.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONNLIMIT</emphasis> -
<emphasis>limit</emphasis>[:<emphasis>mask</emphasis>]</term>
<listitem>
<para>Added in Shorewall-perl 4.2.1. May be used to limit the number
of simultaneous connections from each individual host to
<replaceable>limit</replaceable> connections. While the limit is
only checked on connections to which this policy could apply, the
number of current connections is calculated over all current
connections from the SOURCE host. By default, the limit is applied
to each host individually but can be made to apply to networks of
hosts by specifying a <replaceable>mask</replaceable>. The
<replaceable>mask</replaceable> specifies the width of a VLSM mask
to be applied to the source address; the number of current
connections is then taken over all hosts in the subnet
<replaceable>source-address</replaceable>/<replaceable>mask</replaceable>.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<orderedlist numeration="loweralpha">
<listitem>
<para>All connections from the local network to the internet are
allowed</para>
</listitem>
<listitem>
<para>All connections from the internet are ignored but logged at
syslog level KERNEL.INFO.</para>
</listitem>
<listitem>
<para>All other connection requests are rejected and logged at level
KERNEL.INFO.</para>
</listitem>
</orderedlist>
<programlisting> #SOURCE DEST POLICY LOG BURST:LIMIT
# LEVEL
loc net ACCEPT
net all DROP info
#
# THE FOLLOWING POLICY MUST BE LAST
#
all all REJECT info</programlisting>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/policy</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

304
manpages6/shorewall-providers.xml Normal file
View File

@ -0,0 +1,304 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-providers</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>providers</refname>
<refpurpose>Shorewall Providers file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/providers</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define additional routing tables. You will want
to define an additional table if:</para>
<itemizedlist>
<listitem>
<para>You have connections to more than one ISP or multiple
connections to the same ISP</para>
</listitem>
<listitem>
<para>You run Squid as a transparent proxy on a host other than the
firewall.</para>
</listitem>
<listitem>
<para>You have other requirements for policy routing.</para>
</listitem>
</itemizedlist>
<para>Each entry in the file defines a single routing table.</para>
<para>If you wish to omit a column entry but want to include an entry in
the next column, use "-" for the omitted entry.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">NAME</emphasis> -
<emphasis>name</emphasis></term>
<listitem>
<para>The provider <emphasis>name</emphasis>. Must be a valid shell
variable name. The names 'local', 'main', 'default' and 'unspec' are
reserved and may not be used as provider names.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">NUMBER</emphasis> -
<emphasis>number</emphasis></term>
<listitem>
<para>The provider number -- a number between 1 and 15. Each
provider must be assigned a unique value.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> -
<emphasis>value</emphasis></term>
<listitem>
<para>A FWMARK <emphasis>value</emphasis> used in your <ulink
url="shorewall-tcrules.html">shorewall-tcrules(5)</ulink> file to
direct packets to this provider.</para>
<para>If HIGH_ROUTE_MARKS=Yes in <ulink
url="shorewall.conf.html">shorewall.conf(5)</ulink>, then the value
must be a multiple of 256 between 256 and 65280 or their hexadecimal
equivalents (0x0100 and 0xff00 with the low-order byte of the value
being zero). Otherwise, the value must be between 1 and 255. Each
provider must be assigned a unique mark value.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DUPLICATE</emphasis> -
<emphasis>routing-table-name</emphasis></term>
<listitem>
<para>The name of an existing table to duplicate to create this
routing table. May be <option>main</option> or the name of a
previously listed provider. You may select only certain entries from
the table to copy by using the COPY column below. This column should
contain a dash ("-') when USE_DEFAULT_RT=Yes in <ulink
url="shorewall.conf.html">shorewall.conf(5)</ulink>. </para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis>[:<emphasis>address</emphasis>]</term>
<listitem>
<para>The name of the network interface to the provider. Must be
listed in <ulink
url="shorewall-interfaces.html">shorewall-interfaces(5)</ulink>.</para>
<para>Where more than one provider is serviced through a single
interface, the <emphasis>interface</emphasis> must be followed by a
colon and the IP <emphasis>address</emphasis> of the interface that
is supplied by the associated provider.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">GATEWAY</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>|<emphasis
role="bold">detect</emphasis>}</term>
<listitem>
<para>The IP address of the provider's gateway router.</para>
<para>You can enter "detect" here and Shorewall will attempt to
detect the gateway automatically.</para>
<para>For PPP devices, you may omit this column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>A comma-separated list selected from the following. The order
of the options is not significant but the list may contain no
embedded whitespace.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">track</emphasis></term>
<listitem>
<para>If specified, inbound connections on this interface are
to be tracked so that responses may be routed back out this
same interface.</para>
<para>You want to specify <option>track</option> if internet
hosts will be connecting to local servers through this
provider.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">balance[=<replaceable>weight</replaceable>]</emphasis></term>
<listitem>
<para>The providers that have <option>balance</option>
specified will get outbound traffic load-balanced among them.
By default, all interfaces with <option>balance</option>
specified will have the same weight (1). You can change the
weight of an interface by specifiying
<option>balance=</option><replaceable>weight</replaceable>
where <replaceable>weight</replaceable> is the weight of the
route out of this interface.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">loose</emphasis></term>
<listitem>
<para>Shorewall normally adds a routing rule for each IP
address on an interface which forces traffic whose source is
that IP address to be sent using the routing table for that
interface. Setting <option>loose</option> prevents creation of
such rules on this interface.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">optional</emphasis></term>
<listitem>
<para>If the interface named in the INTERFACE column is not up
and configured with an IPv4 address then ignore this provider.
If not specified, the value of the <option>optional</option>
option for the INTERFACE in <ulink
url="shorewall-interfaces.html">shorewall-interfaces(5)</ulink>
is assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>src=<replaceable>source-address</replaceable></term>
<listitem>
<para>Added in Shorewall-perl 4.1.5. Specifies the source
address to use when routing to this provider and none is known
(the local client has bound to the 0 address). May not be
specified when an <replaceable>address</replaceable> is given
in the INTERFACE column. If this option is not used, Shorewall
substitutes the primary IP address on the interface named in
the INTERFACE column.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>mtu=<replaceable>number</replaceable></term>
<listitem>
<para>Added in Shorewall-perl 4.1.5. Specifies the MTU when
forwarding through this provider. If not given, the MTU of the
interface named in the INTERFACE column is assumed.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">COPY</emphasis> -
[{<option>none</option>|<emphasis>interface</emphasis><emphasis
role="bold">[,</emphasis><emphasis>interface</emphasis>]...}]</term>
<listitem>
<para>A comma-separated list of other interfaces on your firewall.
Wildcards specified using an asterisk ("*") are permitted (e.g.,
tun* ). Usually used only when DUPLICATE is <option>main</option>.
Only copy routes through INTERFACE and through interfaces listed
here. If you only wish to copy routes through INTERFACE, enter
<option>none</option> in this column.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>You run squid in your DMZ on IP address 192.168.2.99. Your DMZ
interface is eth2</para>
<programlisting> #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS
Squid 1 1 - eth2 192.168.2.99 -</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>eth0 connects to ISP 1. The IP address of eth0 is
206.124.146.176 and the ISP's gateway router has IP address
206.124.146.254.</para>
<para>eth1 connects to ISP 2. The IP address of eth1 is
130.252.99.27 and the ISP's gateway router has IP address
130.252.99.254.</para>
<para>eth2 connects to a local network.</para>
<programlisting> #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY
ISP1 1 1 main eth0 206.124.146.254 track,balance eth2
ISP2 2 2 main eth1 130.252.99.254 track,balance eth2</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/providers</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

141
manpages6/shorewall-proxyarp.xml Normal file
View File

@ -0,0 +1,141 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-proxyarp</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>proxyarp</refname>
<refpurpose>Shorewall Proxy ARP file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/proxyarp</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define Proxy ARP. There is one entry in this
file for each IP address to be proxied.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ADDRESS</emphasis> -
<emphasis>address</emphasis></term>
<listitem>
<para>IP Address.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>Local interface where system with the ip address in ADDRESS is
connected.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">EXTERNAL</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>External Interface to be used to access this system from the
Internet.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">HAVEROUTE</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If there is already a route from the firewall to the host
whose address is given, enter <emphasis role="bold">Yes</emphasis>
or <emphasis role="bold">yes</emphasis> in this column. Otherwise,
enter <emphasis role="bold">no</emphasis> or <emphasis
role="bold">No</emphasis> or leave the column empty and Shorewall
will add the route for you. If Shorewall adds the route,the route
will be persistent if the <emphasis
role="bold">PERSISTENT</emphasis> column contains <emphasis
role="bold">Yes</emphasis>; otherwise, <emphasis
role="bold">shorewall stop</emphasis> or <emphasis
role="bold">shorewall clear</emphasis> will delete the route.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PERSISTENT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If HAVEROUTE is <emphasis role="bold">No</emphasis> or
<emphasis role="bold">no</emphasis>, then the value of this column
determines if the route added by Shorewall persists after a
<emphasis role="bold">shorewall stop</emphasis> or a <emphasis
role="bold">shorewall clear</emphasis>. If this column contains
<emphasis role="bold">Yes</emphasis> or <emphasis
role="bold">yes</emphasis> then the route persists; If the column is
empty or contains <emphasis role="bold">No</emphasis> or <emphasis
role="bold">no</emphasis> then the route is deleted by
<command>shorewall stop</command> or <command>shorewall
clear</command>.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Host with IP 155.186.235.6 is connected to interface eth1 and
we want hosts attached via eth0 to be able to access it using that
address.</para>
<programlisting> #ADDRESS INTERFACE EXTERNAL
155.186.235.6 eth1 eth0</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/proxyarp</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/ProxyARP.htm">http://shorewall.net/ProxyARP.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

100
manpages6/shorewall-rfc1918.xml Normal file
View File

@ -0,0 +1,100 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-rfc1918</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>rfc1918</refname>
<refpurpose>Shorewall file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/usr/share/shorewall/rfc1918</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The rfc1918 file determines the handling of connections under the
norfc1918 option in <ulink
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). Do not
modify <filename>/usr/share/shorewall/rfc1918</filename>; if you need to
change norfc1918 handling, then copy
<filename>/usr/share/shorewall/rfc1918</filename> to
<filename>/etc/shorewall/rfc1918</filename> and modify the copy.</para>
<para>The released version of this file logs and drops packets from the
three address ranges reserved by RFC 1918:</para>
<blockquote>
<programlisting>10.0.0.0/8
172.16.0.0/12
192.168.0.0/16</programlisting>
</blockquote>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">SUBNET -
<replaceable>address</replaceable></emphasis></term>
<listitem>
<para>Subnet address in CIDR format.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TARGET</emphasis> - {<emphasis
role="bold">RETURN</emphasis>|<emphasis
role="bold">DROP</emphasis>|<emphasis
role="bold">logdrop</emphasis>}</term>
<listitem>
<para><emphasis role="bold">RETURN</emphasis> causes packets to/from
the specified subnet to be processed normally by the applicable
rules and policies.</para>
<para><emphasis role="bold">DROP</emphasis> causes packets from the
specified subnet to be silently dropped.</para>
<para><emphasis role="bold">logdrop</emphasis> causes packets from
the specified subnet to be logged at the level specified by the
RFC1918_LOG_LEVEL option in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
</listitem>
</varlistentry>
</variablelist>
<para>Also, please see the RFC1918_STRICT option in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/usr/share/shorewall/rfc1918</para>
<para>/etc/shorewall/rfc1918</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

174
manpages6/shorewall-route_rules.xml Normal file
View File

@ -0,0 +1,174 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-route_rules</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>route_rules</refname>
<refpurpose>Shorewall Routing Rules file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/route_rules</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Entries in this file cause traffic to be routed to one of the
providers listed in <ulink
url="shorewall-providers.html">shorewall-providers</ulink>(5).</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> (Optional) - {<emphasis
role="bold">-</emphasis>|<emphasis>interface</emphasis>|<emphasis>address</emphasis>|<emphasis>interface</emphasis><firstterm>:</firstterm><emphasis>address</emphasis>}</term>
<listitem>
<para>An ip <emphasis>address</emphasis> (network or host) that
matches the source IP address in a packet. May also be specified as
an <emphasis>interface</emphasis> name optionally followed by ":"
and an address. If the device <emphasis role="bold">lo</emphasis> is
specified, the packet must originate from the firewall
itself.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> (Optional) - {<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>}</term>
<listitem>
<para>An ip address (network or host) that matches the destination
IP address in a packet.</para>
<para>If you choose to omit either <emphasis
role="bold">SOURCE</emphasis> or <emphasis
role="bold">DEST</emphasis>, place "-" in that column. Note that you
may not omit both <emphasis role="bold">SOURCE</emphasis> and
<emphasis role="bold">DEST</emphasis>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROVIDER</emphasis> -
{<emphasis>provider-name</emphasis>|<emphasis>provider-number</emphasis>|<emphasis
role="bold">main</emphasis>}</term>
<listitem>
<para>The provider to route the traffic through. May be expressed
either as the provider name or the provider number. May also be
<emphasis role="bold">main</emphasis> or 254 for the main routing
table. This can be used in combination with VPN tunnels, see example
2 below.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PRIORITY</emphasis> -
<emphasis>priority</emphasis></term>
<listitem>
<para>The rule's numeric <emphasis>priority</emphasis> which
determines the order in which the rules are processed. Rules with
equal priority are applied in the order in which they appear in the
file.</para>
<variablelist>
<varlistentry>
<term>1000-1999</term>
<listitem>
<para>Before Shorewall-generated 'MARK' rules</para>
</listitem>
</varlistentry>
<varlistentry>
<term>11000-11999</term>
<listitem>
<para>After 'MARK' rules but before Shorewall-generated rules
for ISP interfaces.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>26000-26999</term>
<listitem>
<para>After ISP interface rules but before 'default'
rule.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>You want all traffic coming in on eth1 to be routed to the
ISP1 provider.</para>
<programlisting> #SOURCE DEST PROVIDER PRIORITY
eth1 - ISP1 1000
</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>You use OpenVPN (routed setup /tunX) in combination with
multiple providers. In this case you have to set up a rule to ensure
that the OpenVPN traffic is routed back through the tunX
interface(s) rather than through any of the providers. 10.8.0.0/24
is the subnet chosen in your OpenVPN configuration (server 10.8.0.0
255.255.255.0).</para>
<programlisting> #SOURCE DEST PROVIDER PRIORITY
- 10.8.0.0/24 main 1000
</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/route_rules</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

182
manpages6/shorewall-routestopped.xml Normal file
View File

@ -0,0 +1,182 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-routestopped</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>routestopped</refname>
<refpurpose>The Shorewall file that governs what traffic flows through the
firewall while it is in 'stopped' state.</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/routestopped</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file is used to define the hosts that are accessible when the
firewall is stopped or is being stopped. When shorewall-shell is being
used, the file also determines those hosts that are accessible when the
firewall is in the process of being [re]started.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis></term>
<listitem>
<para>Interface through which host(s) communicate with the
firewall</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">HOST(S)</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...]</term>
<listitem>
<para>Comma-separated list of IP/subnet addresses. If your kernel
and iptables include iprange match support, IP address ranges are
also allowed.</para>
<para>If left empty or supplied as "-", 0.0.0.0/0 is assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>A comma-separated list of options. The order of the options is
not important but the list can contain no embedded whitespace. The
currently-supported options are:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">routeback</emphasis></term>
<listitem>
<para>Set up a rule to ACCEPT traffic from these hosts back to
themselves.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">source</emphasis></term>
<listitem>
<para>Allow traffic from these hosts to ANY destination.
Without this option or the <emphasis
role="bold">dest</emphasis> option, only traffic from this
host to other listed hosts (and the firewall) is allowed. If
<emphasis role="bold">source</emphasis> is specified then
<emphasis role="bold">routeback</emphasis> is
redundant.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">dest</emphasis></term>
<listitem>
<para>Allow traffic to these hosts from ANY source. Without
this option or the <emphasis role="bold">source</emphasis>
option, only traffic from this host to other listed hosts (and
the firewall) is allowed. If <emphasis
role="bold">dest</emphasis> is specified then <emphasis
role="bold">routeback</emphasis> is redundant.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">critical</emphasis></term>
<listitem>
<para>Allow traffic between the firewall and these hosts
throughout '[re]start', 'stop' and 'clear'. Specifying
<emphasis role="bold">critical</emphasis> on one or more
entries will cause your firewall to be "totally open" for a
brief window during each of those operations. Examples of
where you might want to use this are:</para>
<itemizedlist>
<listitem>
<para>'Ping' nodes with heartbeat.</para>
</listitem>
<listitem>
<para>LDAP server(s) if you use LDAP Authentication</para>
</listitem>
<listitem>
<para>NFS Server if you have an NFS-mounted root
filesystem.</para>
</listitem>
</itemizedlist>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
<note>
<para>The <emphasis role="bold">source</emphasis> and <emphasis
role="bold">dest</emphasis> options work best when used in conjunction
with ADMINISABSENTMINDED=Yes in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
</note>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<programlisting> #INTERFACE HOST(S) OPTIONS
eth2 192.168.1.0/24
eth0 192.0.2.44
br0 - routeback
eth3 - source</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/routestopped</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/starting_and_stopping_shorewall.htm">http://shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

1382
manpages6/shorewall-rules.xml Normal file
View File

File diff suppressed because it is too large Load Diff

368
manpages6/shorewall-tcclasses.xml Normal file
View File

@ -0,0 +1,368 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-tcclasses</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tcclasses</refname>
<refpurpose>Shorewall file to define HTB classes</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/tcclasses</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>A note on the <emphasis>rate</emphasis>/bandwidth definitions used
in this file:</para>
<itemizedlist>
<listitem>
<para>don't use a space between the integer value and the unit: 30kbit
is valid while 30 kbit is NOT.</para>
</listitem>
<listitem>
<para>you can use one of the following units:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">kpbs</emphasis></term>
<listitem>
<para>Kilobytes per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mbps</emphasis></term>
<listitem>
<para>Megabytes per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">kbit</emphasis></term>
<listitem>
<para>Kilobits per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mbit</emphasis></term>
<listitem>
<para>Megabits per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">bps</emphasis> or <emphasis
role="bold">number</emphasis></term>
<listitem>
<para>Bytes per second.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
<listitem>
<para>if you want the values to be calculated for you depending on the
output bandwidth setting defined for an interface in tcdevices, you
can use expressions like the following:</para>
<variablelist>
<varlistentry>
<term>full/3</term>
<listitem>
<para>causes the bandwidth to be calculated as 1/3 of the full
outgoing speed that is defined.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>full*9/10</term>
<listitem>
<para>will set this bandwidth to 9/10 of the full
bandwidth</para>
</listitem>
</varlistentry>
</variablelist>
<para>DO NOT add a unit to the rate if it is calculated !</para>
</listitem>
</itemizedlist>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
<emphasis>interface</emphasis>[:<emphasis>class</emphasis>]</term>
<listitem>
<para>Name of <emphasis>interface</emphasis>. Each interface may be
listed only once in this file. You may NOT specify the name of an
alias (e.g., eth0:0) here; see <ulink
url="http://www.shorewall.net/FAQ.htm#faq18">http://www.shorewall.net/FAQ.htm#faq18</ulink></para>
<para>If you are running Shorewall-perl 4.1.6 or later, you may
specify the interface number rather than the interface name. If the
<emphasis role="bold">classify</emphasis> option is given for the
interface in <ulink
url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5), then
you must also specify an interface class (an integer that must be
unique within classes associated with this interface).</para>
<para>You may NOT specify wildcards here, e.g. if you have multiple
ppp interfaces, you need to put them all in here!</para>
<para>Please note that you can only use interface names in here that
have a bandwidth defined in the <ulink
url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5)
file</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> -
{-|<emphasis>value</emphasis>}</term>
<listitem>
<para>The mark <emphasis>value</emphasis> which is an integer in the
range 1-255. You set mark values in the <ulink
url="shorewall-tcrules.html">shorewall-tcrules</ulink>(5) file,
marking the traffic you want to fit in the classes defined in here.
Must be specified as '-' if the <emphasis
role="bold">classify</emphasis> option is given for the interface in
<ulink
url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5)</para>
<para>You can use the same marks for different interfaces.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">RATE</emphasis> -
<emphasis>rate</emphasis></term>
<listitem>
<para>The minimum bandwidth this class should get, when the traffic
load rises. If the sum of the rates in this column exceeds the
INTERFACE's OUT-BANDWIDTH, then the OUT-BANDWIDTH limit may not be
honored.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CEIL</emphasis> -
<emphasis>rate</emphasis></term>
<listitem>
<para>The maximum bandwidth this class is allowed to use when the
link is idle. Useful if you have traffic which can get full speed
when more needed services (e.g. ssh) are not used.</para>
<para>You can use the value <emphasis role="bold">full</emphasis> in
here for setting the maximum bandwidth to the defined output
bandwidth of that interface.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PRIORITY</emphasis> -
<emphasis>priority</emphasis></term>
<listitem>
<para>The <emphasis>priority</emphasis> in which classes will be
serviced by the packet shaping scheduler and also the priority in
which bandwidth in excess of the rate will be given to each
class.</para>
<para>Higher priority classes will experience less delay since they
are serviced first. Priority values are serviced in ascending order
(e.g. 0 is higher priority than 1).</para>
<para>Classes may be set to the same priority, in which case they
will be serviced as equals.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS</emphasis> (Optional) -
[<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>Added in Shorewall-perl 4.1. A comma-separated list of options
including the following:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">default</emphasis></term>
<listitem>
<para>This is the default class for that interface where all
traffic should go, that is not classified otherwise.</para>
<para></para>
<note>
<para>You must define <emphasis
role="bold">default</emphasis> for exactly one class per
interface.</para>
</note>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tos=0x</emphasis><emphasis>value</emphasis>[/0x<emphasis>mask</emphasis>]
(mask defaults to 0xff)</term>
<listitem>
<para>This lets you define a classifier for the given
<emphasis>value</emphasis>/<emphasis>mask</emphasis>
combination of the IP packet's TOS/Precedence/DiffSrv octet
(aka the TOS byte). Please note that classifiers override all
mark settings, so if you define a classifer for a class, all
traffic having that mark will go in it regardless of any mark
set on the packet by a firewall/mangle filter.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tos-</emphasis><emphasis>tosname</emphasis></term>
<listitem>
<para>Aliases for the following TOS octet value and mask
encodings. TOS encodings of the "TOS byte" have been
deprecated in favor of diffserve classes, but programs like
ssh, rlogin, and ftp still use them.</para>
<programlisting> <emphasis role="bold">tos-minimize-delay</emphasis> 0x10/0x10
<emphasis role="bold">tos-maximize-throughput</emphasis> 0x08/0x08
<emphasis role="bold">tos-maximize-reliability</emphasis> 0x04/0x04
<emphasis role="bold">tos-minimize-cost</emphasis> 0x02/0x02
<emphasis role="bold">tos-normal-service</emphasis> 0x00/0x1e</programlisting>
<note>
<para>Each of these options is only valid for ONE class per
interface.</para>
</note>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">tcp-ack</emphasis></term>
<listitem>
<para>If defined, causes a tc filter to be created that puts
all tcp ack packets on that interface that have a size of
&lt;=64 Bytes to go in this class. This is useful for speeding
up downloads. Please note that the size of the ack packets is
limited to 64 bytes because we want only packets WITHOUT
payload to match.</para>
<para></para>
<note>
<para>This option is only valid for ONE class per
interface.</para>
</note>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Suppose you are using PPP over Ethernet (DSL) and ppp0 is the
interface for this. You have 4 classes here, the first you can use
for voice over IP traffic, the second interactive traffic (e.g.
ssh/telnet but not scp), the third will be for all unclassified
traffic, and the forth is for low priority traffic (e.g.
peer-to-peer).</para>
<para>The voice traffic in the first class will be guaranteed a
minimum of 100kbps and always be serviced first (because of the low
priority number, giving less delay) and will be granted excess
bandwidth (up to 180kbps, the class ceiling) first, before any other
traffic. A single VOIP stream, depending upon codecs, after
encapsulation, can take up to 80kbps on a PPOE/DSL link, so we pad a
little bit just in case. (TOS byte values 0xb8 and 0x68 are DiffServ
classes EF and AFF3-1 respectively and are often used by VOIP
devices).</para>
<para>Interactive traffic (tos-minimum-delay) and TCP acks (and ICMP
echo traffic if you use the example in tcrules) and any packet with
a mark of 2 will be guaranteed 1/4 of the link bandwidth, and may
extend up to full speed of the link.</para>
<para>Unclassified traffic and packets marked as 3 will be
guaranteed 1/4th of the link bandwidth, and may extend to the full
speed of the link.</para>
<para>Packets marked with 4 will be treated as low priority packets.
(The tcrules example marks p2p traffic as such.) If the link is
congested, they're only guaranteed 1/8th of the speed, and even if
the link is empty, can only expand to 80% of link bandwidth just as
a precaution in case there are upstream queues we didn't account
for. This is the last class to get additional bandwidth and the last
to get serviced by the scheduler because of the low priority.</para>
<programlisting> #INTERFACE MARK RATE CEIL PRIORITY OPTIONS
ppp0 1 100kbit 180kbit 1 tos=0x68/0xfc,tos=0xb8/0xfc
ppp0 2 full/4 full 2 tcp-ack,tos-minimize-delay
ppp0 3 full/4 full 3 default
ppp0 4 full/8 full*8/10 4</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tcclasses</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/traffic_shaping.htm">http://shorewall.net/traffic_shaping.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

225
manpages6/shorewall-tcdevices.xml Normal file
View File

@ -0,0 +1,225 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-tcdevices</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tcdevices</refname>
<refpurpose>Shorewall Traffic Shaping Devices file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/tcdevices</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Entries in this file define the bandwidth for interfaces on which
you want traffic shaping to be enabled.</para>
<para>If you do not plan to use traffic shaping for a device, don't put it
in here as it limits the troughput of that device to the limits you set
here.</para>
<para>A note on the <emphasis>bandwidth</emphasis> definitions used in
this file:</para>
<itemizedlist>
<listitem>
<para>don't use a space between the integer value and the unit: 30kbit
is valid while 30 kbit is not.</para>
</listitem>
<listitem>
<para>you can use one of the following units:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">kpbs</emphasis></term>
<listitem>
<para>Kilobytes per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mbps</emphasis></term>
<listitem>
<para>Megabytes per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">kbit</emphasis></term>
<listitem>
<para>Kilobits per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mbit</emphasis></term>
<listitem>
<para>Megabits per second.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">bps</emphasis> or <emphasis
role="bold">number</emphasis></term>
<listitem>
<para>Bytes per second.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
<listitem>
<para>Only whole integers are allowed.</para>
</listitem>
</itemizedlist>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">INTERFACE</emphasis> -
[<emphasis>number</emphasis>:]<emphasis>interface</emphasis></term>
<listitem>
<para>Name of <emphasis>interface</emphasis>. Each interface may be
listed only once in this file. You may NOT specify the name of an
alias (e.g., eth0:0) here; see <ulink
url="http://www.shorewall.net/FAQ.htm#faq18">http://www.shorewall.net/FAQ.htm#faq18</ulink></para>
<para>You may NOT specify wildcards here, e.g. if you have multiple
ppp interfaces, you need to put them all in here!</para>
<para>If the device doesn't exist, a warning message will be issued
during "shorewall [re]start" and "shorewall refresh" and traffic
shaping configuration will be skipped for that device.</para>
<para>Shorewall assigns a sequential <firstterm>interface
number</firstterm> to each interface (the first entry in the file is
interface 1, the second is interface 2 and so on) Beginning with
Shorewall-perl 4.1.6, you can explicitly specify the interface
number by prefixing the interface name with the number and a colon
(":"). Example: 1:eth0.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">IN-BANDWIDTH</emphasis> -
<emphasis>bandwidth</emphasis></term>
<listitem>
<para>The incoming <emphasis>bandwidth</emphasis> of that interface.
Please note that you are not able to do traffic shaping on incoming
traffic, as the traffic is already received before you could do so.
But this allows you to define the maximum traffic allowed for this
interface in total, if the rate is exceeded, the packets are
dropped. You want this mainly if you have a DSL or Cable connection
to avoid queuing at your providers side.</para>
<para>If you don't want any traffic to be dropped, set this to a
value to zero in which case Shorewall will not create an ingress
qdisc.Must be set to zero if the REDIRECTED INTERFACES column is
non-empty.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OUT-BANDWIDTH</emphasis> -
<emphasis>bandwidth</emphasis></term>
<listitem>
<para>The outgoing <emphasis>bandwidth</emphasis> of that interface.
This is the maximum speed your connection can handle. It is also the
speed you can refer as "full" if you define the tc classes in <ulink
url="shorewall-tcclasses.html">shorewall-tcclasses</ulink>(5).
Outgoing traffic above this rate will be dropped.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">classify</emphasis>}</term>
<listitem>
<para>classify ― When specified, Shorewall will not generate tc or
Netfilter rules to classify traffic based on packet marks. You must
do all classification using CLASSIFY rules in <ulink
url="shorewall-tcrules.html">shorewall-tcrules</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">REDIRECTED INTERFACES</emphasis> -
[<emphasis>interface</emphasis>[,<emphasis>interface</emphasis>]...]</term>
<listitem>
<para>Added in Shorewall-perl 4.1.6. May only be specified if the
interface in the INTERFACE column is an Intermediate Frame Block
(IFB) device. Causes packets that enter each listed interface to be
passed through the egress filters defined for this device, thus
providing a form of incoming traffic shaping. When this column is
non-empty, the <emphasis role="bold">classify</emphasis> option is
assumed.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Examples</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Suppose you are using PPP over Ethernet (DSL) and ppp0 is the
interface for this. The device has an outgoing bandwidth of 500kbit
and an incoming bandwidth of 6000kbit</para>
<programlisting> #INTERFACE IN-BANDWIDTH OUT-BANDWIDTH OPTIONS REDIRECTED
# INTERFACES
1:ppp0 6000kbit 500kbit</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tcdevices</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/traffic_shaping.htm">http://shorewall.net/traffic_shaping.htm</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

158
manpages6/shorewall-tcfilters.xml Normal file
View File

@ -0,0 +1,158 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-tcfilters</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tcfilters</refname>
<refpurpose>Shorewall u32 classifier rules file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/tcfilters</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Entries in this file cause packets to be classified for traffic
shaping.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">CLASS</emphasis> -
<emphasis>interface</emphasis><emphasis
role="bold">:</emphasis><emphasis>class</emphasis></term>
<listitem>
<para>The name or number of an <returnvalue>interface</returnvalue>
defined in <ulink
url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5)
followed by a <replaceable>class</replaceable> number defined for
that interface in <ulink
url="shorewall-tcclasses.html">shorewall-tcclasses</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>}</term>
<listitem>
<para>Source of the packet. May be a host or network
<replaceable>address</replaceable>. DNS names are not
allowed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>}}</term>
<listitem>
<para>Destination of the packet. Comma separated list of IP
addresses and/or subnets. If your kernel and iptables include
iprange match support, IP address ranges are also allowed. List
elements may also consist of an interface name followed by ":" and
an address (e.g., eth1:192.168.1.0/24). If the <emphasis
role="bold">MARK</emphasis> column specificies a classification of
the form <emphasis>major</emphasis>:<emphasis>minor</emphasis> then
this column may also contain an interface name.</para>
<para>You may exclude certain hosts from the set already defined
through use of an <emphasis>exclusion</emphasis> (see <ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTO</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
role="bold">all}</emphasis></term>
<listitem>
<para>Protocol.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT</emphasis> (Optional) -
[<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
<para>Destination Ports. A Port name (from services(5)) or a
<emphasis>port number</emphasis>; if the protocol is <emphasis
role="bold">icmp</emphasis>, this column is interpreted as the
destination icmp-type(s).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT</emphasis> (Optional) -
[<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
<para>Source port.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Place all ICMP echo traffic on interface 1 in class 10.</para>
<programlisting> #CLASS SOURCE DEST PROTO DEST
# PORT
1:10 0.0.0.0/0 0.0.0.0/0 icmp echo-request
1:10 0.0.0.0/0 0.0.0.0/0 icmp echo-reply</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tcfilters</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/traffic_shaping.htm">http://shorewall.net/traffic_shaping.htm</ulink></para>
<para><ulink
url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink></para>
<para><ulink
url="http://shorewall.net/PacketMarking.html">http://shorewall.net/PacketMarking.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5),
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tos(5),
shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

637
manpages6/shorewall-tcrules.xml Normal file
View File

@ -0,0 +1,637 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall-tcrules</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tcrules</refname>
<refpurpose>Shorewall Packet Marking rules file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/rules</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>Entries in this file cause packets to be marked as a means of
classifying them for traffic control or policy routing.</para>
<important>
<para>Unlike rules in the <ulink
url="shorewall-rules.html">shorewall-rules</ulink>(5) file, evaluation
of rules in this file will continue after a match. So the final mark for
each packet will be the one assigned by the LAST tcrule that
matches.</para>
<para>If you use multiple internet providers with the 'track' option, in
/etc/shorewall/providers be sure to read the restrictions at <ulink
url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink>.</para>
</important>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">MARK/CLASSIFY</emphasis> -
{<emphasis>value</emphasis>|<emphasis>major</emphasis><emphasis
role="bold">:</emphasis><emphasis>minor</emphasis>|<emphasis
role="bold">RESTORE</emphasis>[<emphasis
role="bold">/</emphasis><emphasis>mask</emphasis>]|<emphasis
role="bold">SAVE</emphasis>[<emphasis
role="bold">/</emphasis><emphasis>mask</emphasis>]|<emphasis
role="bold">CONTINUE</emphasis>|<emphasis
role="bold">COMMENT</emphasis>}[<emphasis
role="bold">:</emphasis>{<emphasis role="bold">C</emphasis>|<emphasis
role="bold">F</emphasis>|<emphasis role="bold">P</emphasis>|<emphasis
role="bold">T</emphasis>|<emphasis role="bold">CF</emphasis>|<emphasis
role="bold">CP</emphasis>|<emphasis role="bold">CT</emphasis>}]</term>
<listitem>
<para>May assume one of the following values.</para>
<orderedlist numeration="arabic">
<listitem>
<para>A mark <emphasis>value</emphasis> which is an integer in
the range 1-255.</para>
<para>Normally will set the mark value. If preceded by a
vertical bar ("|"), the mark value will be logically ORed with
the current mark value to produce a new mark value. If preceded
by an ampersand ("&amp;"), will be logically ANDed with the
current mark value to produce a new mark value.</para>
<para>Both "|" and "&amp;" require Extended MARK Target support
in your kernel and iptables; neither may be used with connection
marks (see below).</para>
<para>May optionally be followed by <emphasis
role="bold">:P</emphasis>, <emphasis role="bold">:F</emphasis>
or <emphasis role="bold">:T</emphasis> where<emphasis
role="bold"> :P</emphasis> indicates that marking should occur
in the PREROUTING chain, <emphasis role="bold">:F</emphasis>
indicates that marking should occur in the FORWARD chain and
<emphasis role="bold">:T</emphasis> indicates that marking
should occur in the POSTROUTING chain. If neither <emphasis
role="bold">:P</emphasis>, <emphasis role="bold">:F</emphasis>
nor <emphasis role="bold">:T</emphasis> follow the mark value
then the chain is determined as follows:</para>
<para>- If the SOURCE is <emphasis
role="bold">$FW</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...],
then the rule is inserted into the OUTPUT chain. The behavior
changed in Shorewall-perl 4.1. Previously, when
HIGH_ROUTE_MARKS=Yes, Shorewall allowed non-zero mark values
&lt; 256 to be assigned in the OUTPUT chain. This has been
changed so that only high mark values may be assigned there.
Packet marking rules for traffic shaping of packets originating
on the firewall must be coded in the POSTROUTING chain (see
below).</para>
<para>- Otherwise, the chain is determined by the setting of
MARK_IN_FORWARD_CHAIN in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5).</para>
<para>If your kernel and iptables include CONNMARK support then
you can also mark the connection rather than the packet.</para>
<para>The mark value may be optionally followed by "/" and a
mask value (used to determine those bits of the connection mark
to actually be set). The mark and optional mask are then
followed by one of:+</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">C</emphasis></term>
<listitem>
<para>Mark the connection in the chain determined by the
setting of MARK_IN_FORWARD_CHAIN</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CF</emphasis></term>
<listitem>
<para>Mark the connection in the FORWARD chain</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CP</emphasis></term>
<listitem>
<para>Mark the connection in the PREROUTING chain.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>CT</term>
<listitem>
<para>Mark the connecdtion in the POSTROUTING chain</para>
</listitem>
</varlistentry>
</variablelist>
<para><emphasis role="bold">Special considerations for If
HIGH_ROUTE_MARKS=Yes in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5</emphasis>).</para>
<para>If HIGH_ROUTE_MARKS=Yes, then you may also specify a value
in the range 0x0100-0xFF00 with the low-order byte being zero.
Such values may only be used in the PREROUTING chain (value
followed by <emphasis role="bold">:P</emphasis> or you have set
MARK_IN_FORWARD_CHAIN=No in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5) and have not
followed the value with <option>:F</option>) or the OUTPUT chain
(SOURCE is <emphasis role="bold">$FW</emphasis>). With
HIGH_ROUTE_MARKS=Yes, non-zero mark values less that 256 are not
permitted. Shorewall 4.1 and later versions prohibit non-zero
mark values less that 256 in the OUTPUT chain when
HIGH_ROUTE_MARKS=Yes. While earlier versions allow such values
in the OUTPUT chain, it is strongly recommended that with
HIGH_ROUTE_MARKS=Yes, you use the POSTROUTING chain to apply
traffic shaping marks/classification.</para>
</listitem>
<listitem>
<para>A classification Id (classid) of the form
<emphasis>major</emphasis>:<emphasis>minor</emphasis> where
<emphasis>major</emphasis> and <emphasis>minor</emphasis> are
integers. Corresponds to the 'class' specification in these
traffic shaping modules:</para>
<programlisting> atm
cbq
dsmark
pfifo_fast
htb
prio</programlisting>
<para>Classification occurs in the POSTROUTING chain except when
the <emphasis role="bold">SOURCE</emphasis> is <emphasis
role="bold">$FW</emphasis>[:<emphasis>address</emphasis>] in
which case classification occurs in the OUTPUT chain.</para>
<para>When using Shorewall's built-in traffic shaping tool, the
<emphasis>major</emphasis> class is the device number (the first
device in <ulink
url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5) is
major class 1, the second device is major class 2, and so on)
and the <emphasis>minor</emphasis> class is the class's MARK
value in <ulink
url="shorewall-tcclasses.html">shorewall-tcclasses</ulink>(5)
preceded by the number 1 (MARK 1 corresponds to minor class 11,
MARK 5 corresponds to minor class 15, MARK 22 corresponds to
minor class 122, etc.).</para>
</listitem>
<listitem>
<para><emphasis
role="bold">RESTORE</emphasis>[/<emphasis>mask</emphasis>] --
restore the packet's mark from the connection's mark using the
supplied mask if any. Your kernel and iptables must include
CONNMARK support.</para>
<para>As in 1) above, may be followed by <emphasis
role="bold">:P</emphasis> or <emphasis
role="bold">:F</emphasis></para>
</listitem>
<listitem>
<para><emphasis
role="bold">SAVE</emphasis>[/<emphasis>mask</emphasis>] -- save
the packet's mark to the connection's mark using the supplied
mask if any. Your kernel and iptables must include CONNMARK
support.</para>
<para>As in 1) above, may be followed by <emphasis
role="bold">:P</emphasis> or <emphasis
role="bold">:F</emphasis></para>
</listitem>
<listitem>
<para><emphasis role="bold">CONTINUE</emphasis> Don't process
any more marking rules in the table.</para>
<para>As in 1) above, may be followed by <emphasis
role="bold">:P</emphasis> or <emphasis
role="bold">:F</emphasis>. Currently, CONTINUE may not be used
with <emphasis>exclusion</emphasis> (see the SOURCE and DEST
columns below); that restriction will be removed when
iptables/Netfilter provides the necessary support.</para>
</listitem>
<listitem>
<para><emphasis role="bold">COMMENT</emphasis> -- the rest of
the line will be attached as a comment to the Netfilter rule(s)
generated by the following entries. The comment will appear
delimited by "/* ... */" in the output of <command>shorewall
show mangle</command></para>
<para>To stop the comment from being attached to further rules,
simply include COMMENT on a line by itself.</para>
</listitem>
</orderedlist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
role="bold">-</emphasis>|{<emphasis>interface</emphasis>|<emphasis
role="bold">$FW</emphasis>}|[{<emphasis>interface</emphasis>|<emphasis
role="bold">$FW</emphasis>}:]<emphasis>address-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
<listitem>
<para>Source of the packet. A comma-separated list of interface
names, IP addresses, MAC addresses and/or subnets for packets being
routed through a common path. List elements may also consist of an
interface name followed by ":" and an address (e.g.,
eth1:192.168.1.0/24). For example, all packets for connections
masqueraded to eth0 from other interfaces can be matched in a single
rule with several alternative SOURCE criteria. However, a connection
whose packets gets to eth0 in a different way, e.g., direct from the
firewall itself, needs a different rule.</para>
<para>Accordingly, use $<emphasis role="bold">FW</emphasis> in its
own separate rule for packets originating on the firewall. In such a
rule, the MARK column may NOT specify either <emphasis
role="bold">:P</emphasis> or <emphasis role="bold">:F</emphasis>
because marking for firewall-originated packets always occurs in the
OUTPUT chain.</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
<para>You may exclude certain hosts from the set already defined
through use of an <emphasis>exclusion</emphasis> (see <ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">-</emphasis>|{<emphasis>interface</emphasis>|[<emphasis>interface</emphasis>:]<emphasis>address-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
<listitem>
<para>Destination of the packet. Comma separated list of IP
addresses and/or subnets. If your kernel and iptables include
iprange match support, IP address ranges are also allowed. List
elements may also consist of an interface name followed by ":" and
an address (e.g., eth1:192.168.1.0/24). If the <emphasis
role="bold">MARK</emphasis> column specificies a classification of
the form <emphasis>major</emphasis>:<emphasis>minor</emphasis> then
this column may also contain an interface name.</para>
<para>You may exclude certain hosts from the set already defined
through use of an <emphasis>exclusion</emphasis> (see <ulink
url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTO</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">tcp:syn</emphasis>|<emphasis
role="bold">ipp2p</emphasis>|<emphasis
role="bold">ipp2p:udp</emphasis>|<emphasis
role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis
role="bold">all}</emphasis></term>
<listitem>
<para>Protocol - <emphasis role="bold">ipp2p</emphasis> requires
ipp2p match support in your kernel and iptables.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
<listitem>
<para>Destination Ports. A comma-separated list of Port names (from
services(5)), <emphasis>port number</emphasis>s or <emphasis>port
range</emphasis>s; if the protocol is <emphasis
role="bold">icmp</emphasis>, this column is interpreted as the
destination icmp-type(s).</para>
<para>If the protocol is <emphasis role="bold">ipp2p</emphasis>,
this column is interpreted as an ipp2p option without the leading
"--" (example <emphasis role="bold">bit</emphasis> for bit-torrent).
If no PORT is given, <emphasis role="bold">ipp2p</emphasis> is
assumed.</para>
<para>This column is ignored if PROTOCOL = all but must be entered
if any of the following field is supplied. In that case, it is
suggested that this field contain "-"</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (Optional) -
[<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
<listitem>
<para>Source port(s). If omitted, any source port is acceptable.
Specified as a comma-separated list of port names, port numbers or
port ranges.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
<listitem>
<para>This column may only be non-empty if the SOURCE is the
firewall itself.</para>
<para>When this column is non-empty, the rule applies only if the
program generating the output is running under the effective
<emphasis>user</emphasis> and/or <emphasis>group</emphasis>
specified (or is NOT running under that id if "!" is given).</para>
<para>Examples:</para>
<variablelist>
<varlistentry>
<term>joe</term>
<listitem>
<para>program must be run by joe</para>
</listitem>
</varlistentry>
<varlistentry>
<term>:kids</term>
<listitem>
<para>program must be run by a member of the 'kids'
group</para>
</listitem>
</varlistentry>
<varlistentry>
<term>!:kids</term>
<listitem>
<para>program must not be run by a member of the 'kids'
group</para>
</listitem>
</varlistentry>
<varlistentry>
<term>+upnpd</term>
<listitem>
<para>#program named upnpd</para>
<important>
<para>The ability to specify a program name was removed from
Netfilter in kernel version 2.6.14.</para>
</important>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TEST</emphasis> - [<emphasis
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
role="bold">:C</emphasis>]</term>
<listitem>
<para>Defines a test on the existing packet or connection mark. The
rule will match only if the test returns true.</para>
<para>If you don't want to define a test but need to specify
anything in the following columns, place a "-" in this field.</para>
<variablelist>
<varlistentry>
<term>!</term>
<listitem>
<para>Inverts the test (not equal)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>value</emphasis></term>
<listitem>
<para>Value of the packet or connection mark.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>mask</emphasis></term>
<listitem>
<para>A mask to be applied to the mark before testing.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">:C</emphasis></term>
<listitem>
<para>Designates a connection mark. If omitted, the packet
mark's value is tested.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">LENGTH</emphasis> (Optional) -
[<emphasis>length</emphasis>|[<emphasis>min</emphasis>]<emphasis
role="bold">:</emphasis>[<emphasis>max</emphasis>]]</term>
<listitem>
<para>Packet Length. This field, if present allow you to match the
length of a packet against a specific value or range of values. You
must have iptables length support for this to work. A range is
specified in the form
<emphasis>min</emphasis>:<emphasis>max</emphasis> where either
<emphasis>min</emphasis> or <emphasis>max</emphasis> (but not both)
may be omitted. If <emphasis>min</emphasis> is omitted, then 0 is
assumed; if <emphasis>max</emphasis> is omitted, than any packet
that is <emphasis>min</emphasis> or longer will match.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TOS</emphasis> -
<emphasis>tos</emphasis></term>
<listitem>
<para>Type of service. Either a standard name, or a numeric value to
match.</para>
<programlisting> <emphasis role="bold">Minimize-Delay</emphasis> (16)
<emphasis role="bold">Maximize-Throughput</emphasis> (8)
<emphasis role="bold">Maximize-Reliability</emphasis> (4)
<emphasis role="bold">Minimize-Cost</emphasis> (2)
<emphasis role="bold">Normal-Service</emphasis> (0)</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONNBYTES</emphasis> -
[!]<emphasis>min</emphasis>:[<emphasis>max</emphasis>[:{<emphasis
role="bold">O</emphasis>|<emphasis role="bold">R</emphasis>|<emphasis
role="bold">B</emphasis>}[:{<emphasis
role="bold">B</emphasis>|<emphasis role="bold">P</emphasis>|<emphasis
role="bold">A</emphasis>}]]] </term>
<listitem>
<para>Connection Bytes; defines a byte or packet range that the
connection must fall within in order for the rule to match. Added in
Shorewall-perl 4.2.0.</para>
<para>A packet matches if the the packet/byte count is within the
range defined by <emphasis>min</emphasis> and
<emphasis>max</emphasis> (unless ! is given in which case, a packet
matches if the packet/byte count is not within the range).
<emphasis>min</emphasis> is an integer which defines the beginning
of the byte/packet range. <emphasis>max</emphasis> is an integer
which defines the end of the byte/packet range; if omitted, only the
beginning of the range is checked. The first letter gives the
direction which the range refers to:<blockquote>
<para><emphasis role="bold">O</emphasis> - The original
direction of the connection.</para>
<para><emphasis role="bold">R</emphasis> - The opposite
direction from the original connection.</para>
<para><emphasis role="bold">B</emphasis> - The total of both
directions.</para>
</blockquote></para>
<para>If omitted, <emphasis role="bold">B</emphasis> is assumed.
</para>
<para>The second letter determines what the range refers
to.<blockquote>
<para><emphasis role="bold">B</emphasis> - Bytes</para>
<para><emphasis role="bold">P</emphasis> - Packets</para>
<para><emphasis role="bold">A</emphasis> - Average packet
size.</para>
</blockquote>If omitted, <emphasis role="bold">B</emphasis> is
assumed. </para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">HELPER -
</emphasis><emphasis>helper</emphasis></term>
<listitem>
<para>Added in Shorewall-perl 4.2.0. Names a Netfiler protocol
<firstterm>helper</firstterm> module such as <option>ftp</option>,
<option>sip</option>, <option>amanda</option>, etc. A packet will
match if it was accepted by the named helper module. You can also
append "-" and a port number to the helper module name (e.g.,
<emphasis role="bold">ftp-21</emphasis>) to specify the port number
that the original connection was made on.</para>
<para>Example: Mark all FTP data connections with mark
4:<programlisting>#MARK/ SOURCE DEST PROTO PORT(S) SOURCE USER TEST LENGTH TOS CONNBYTES HELPER
#CLASSIFY PORT(S)
4 0.0.0.0/0 0.0.0.0/0 TCP - - - - - - - ftp</programlisting></para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>Mark all ICMP echo traffic with packet mark 1. Mark all peer
to peer traffic with packet mark 4.</para>
<para>This is a little more complex than otherwise expected. Since
the ipp2p module is unable to determine all packets in a connection
are P2P packets, we mark the entire connection as P2P if any of the
packets are determined to match.</para>
<para>We assume packet/connection mark 0 means unclassified.</para>
<programlisting> #MARK/ SOURCE DEST PROTO PORT(S) SOURCE USER TEST
#CLASSIFY PORT(S)
1 0.0.0.0/0 0.0.0.0/0 icmp echo-request
1 0.0.0.0/0 0.0.0.0/0 icmp echo-reply
RESTORE 0.0.0.0/0 0.0.0.0/0 all - - - 0
CONTINUE 0.0.0.0/0 0.0.0.0/0 all - - - !0
4 0.0.0.0/0 0.0.0.0/0 ipp2p:all
SAVE 0.0.0.0/0 0.0.0.0/0 all - - - !0</programlisting>
<para>If a packet hasn't been classifed (packet mark is 0), copy the
connection mark to the packet mark. If the packet mark is set, we're
done. If the packet is P2P, set the packet mark to 4. If the packet
mark has been set, save it to the connection mark.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tcrules</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://shorewall.net/traffic_shaping.htm">http://shorewall.net/traffic_shaping.htm</ulink></para>
<para><ulink
url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink></para>
<para><ulink
url="http://shorewall.net/PacketMarking.html">http://shorewall.net/PacketMarking.html</ulink></para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5),
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tos(5),
shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

62
manpages6/shorewall-template.xml Normal file
View File

@ -0,0 +1,62 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>file</refname>
<refpurpose>Shorewall file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term>COLUMN 1</term>
<listitem>
<para></para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<para></para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

216
manpages6/shorewall-tos.xml Normal file
View File

@ -0,0 +1,216 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-tos</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tos</refname>
<refpurpose>Shorewall Type of Service rules file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/tos</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file defines rules for setting Type Of Service (TOS)</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> -
{<emphasis>zone</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>|<emphasis role="bold">$FW</emphasis>}
(Shorewall-shell)</term>
<listitem>
<para>Name of a <replaceable>zone</replaceable> declared in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5), <emphasis
role="bold">all</emphasis> or <emphasis
role="bold">$FW</emphasis>.</para>
<para>If not <emphasis role="bold">all</emphasis> or <emphasis
role="bold">$FW</emphasis>, may optionally be followed by ":" and an
IP address, a MAC address, a subnet specification or the name of an
interface.</para>
<para>Example: loc:192.168.2.3</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
role="bold">all</emphasis>|<emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>:<emphasis>address</emphasis>|<emphasis
role="bold">$FW</emphasis>} (Shorewall-perl)</term>
<listitem>
<para>If <emphasis role="bold">all</emphasis>, may optionally be
followed by ":" and an IP address, a MAC address, a subnet
specification or the name of an interface.</para>
<para>Example: all:192.168.2.3</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> -
{<emphasis>zone</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>} (Shorewall-shell)</term>
<listitem>
<para>Name of a zone declared in <ulink
url="shorewall-zones.html">shorewall-zones</ulink>(5) or <emphasis
role="bold">all</emphasis>.</para>
<para>If not <emphasis role="bold">all</emphasis>, may optionally be
followed by ":" and an IP address or a subnet specification</para>
<para>Example: loc:192.168.2.3</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">all</emphasis>|<emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>:<emphasis>address</emphasis>}
(Shorewall-perl)</term>
<listitem>
<para>Example: 192.168.2.3</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> -
<emphasis>proto-name-or-number</emphasis></term>
<listitem>
<para>Protocol name or number.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> -
{-|<emphasis>port</emphasis>|<emphasis>lowport</emphasis><emphasis
role="bold">:</emphasis><emphasis>highport</emphasis>}</term>
<listitem>
<para>Source port or port range. If all ports, use "-".</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> -
{-|<emphasis>port</emphasis>|<emphasis>lowport</emphasis><emphasis
role="bold">:</emphasis><emphasis>highport</emphasis>}</term>
<listitem>
<para>Destination port or port range. If all ports, use "-"</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TOS</emphasis> -
<emphasis>tos</emphasis></term>
<listitem>
<para>Must be one of the following;</para>
<programlisting> <emphasis role="bold">tos-minimize-delay</emphasis> (16)
<emphasis role="bold">tos-maximize-throughput</emphasis> (8)
<emphasis role="bold">tos-maximize-reliability</emphasis> (4)
<emphasis role="bold">tos-minimize-cost</emphasis> (2)
<emphasis role="bold">tos-normal-service</emphasis> (0)</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> - [<emphasis
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
role="bold">:C</emphasis>]</term>
<listitem>
<para>If you don't want to define a test but need to specify
anything in the following columns, place a "-" in this field.</para>
<variablelist>
<varlistentry>
<term>!</term>
<listitem>
<para>Inverts the test (not equal)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>value</emphasis></term>
<listitem>
<para>Value of the packet or connection mark.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>mask</emphasis></term>
<listitem>
<para>A mask to be applied to the mark before testing.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">:C</emphasis></term>
<listitem>
<para>Designates a connection mark. If omitted, the packet
mark's value is tested. This option is only supported by
Shorewall-perl.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tos</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tunnels(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

275
manpages6/shorewall-tunnels.xml Normal file
View File

@ -0,0 +1,275 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-tunnels</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>tunnels</refname>
<refpurpose>Shorewall VPN definition file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/tunnels</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The tunnels file is used to define rules for encapsulated (usually
encrypted) traffic to pass between the Shorewall system and a remote
gateway. Traffic flowing through the tunnel is handled using the normal
zone/policy/rule mechanism. See <ulink
url="http://www.shorewall.net/VPNBasics.html">http://www.shorewall.net/VPNBasics.html</ulink>
for details.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">TYPE</emphasis> - {<emphasis
role="bold">ipsec</emphasis>[<emphasis
role="bold">:{noah</emphasis>|ah}]|<emphasis
role="bold">ipsecnat</emphasis>|<emphasis
role="bold">ipip</emphasis>|<emphasis
role="bold">gre</emphasis>|l2tp|<emphasis
role="bold">pptpclient</emphasis>|<emphasis
role="bold">pptpserver</emphasis>|{<emphasis
role="bold">openvpn</emphasis>|<emphasis
role="bold">openvpnclient</emphasis>|<emphasis
role="bold">openvpnserver</emphasis>}[:{<emphasis
role="bold">tcp</emphasis>|<emphasis
role="bold">udp</emphasis>}]<emphasis
role="bold">[</emphasis>:<emphasis>port</emphasis>]|<emphasis
role="bold">generic</emphasis><emphasis
role="bold">:</emphasis><emphasis>protocol</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>port</emphasis>]}</term>
<listitem>
<para>Types are as follows:</para>
<programlisting> <emphasis role="bold">ipsec</emphasis> - IPv4 IPSEC
<emphasis role="bold">ipsecnat</emphasis> - IPv4 IPSEC with NAT Traversal (UDP port 4500 encapsulation)
<emphasis role="bold">ipip</emphasis> - IPv4 encapsulated in IPv4 (Protocol 4)
<emphasis role="bold">gre</emphasis> - Generalized Routing Encapsulation (Protocol 47)
<emphasis role="bold">l2tp</emphasis> - Layer 2 Tunneling Protocol (UDP port 1701)
<emphasis role="bold">pptpclient</emphasis> - PPTP Client runs on the firewall
<emphasis role="bold">pptpserver</emphasis> - PPTP Server runs on the firewall
<emphasis role="bold">openvpn</emphasis> - OpenVPN in point-to-point mode
<emphasis role="bold">openvpnclient</emphasis> - OpenVPN client runs on the firewall
<emphasis role="bold">openvpnserver</emphasis> - OpenVPN server runs on the firewall
<emphasis role="bold">generic</emphasis> - Other tunnel type</programlisting>
<para>If the type is <emphasis role="bold">ipsec</emphasis>, it may
be followed by <emphasis role="bold">:ah</emphasis> to indicate that
the Authentication Headers protocol (51) is used by the tunnel (the
default is <option>:noah</option> which means that protocol 51 is
not used). NAT traversal is only supported with ESP (protocol 50) so
<emphasis role="bold">ipsecnat</emphasis> tunnels don't allow the
<emphasis role="bold">ah</emphasis> option (<emphasis
role="bold">ipsecnat:noah</emphasis> may be specified but is
redundant).</para>
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
role="bold">openvpnclient</emphasis> or <emphasis
role="bold">openvpnserver</emphasis> it may optionally be followed
by ":" and <emphasis role="bold">tcp</emphasis> or <emphasis
role="bold">udp</emphasis> to specify the protocol to be used. If
not specified, <emphasis role="bold">udp</emphasis> is
assumed.</para>
<para>If type is <emphasis role="bold">openvpn</emphasis>, <emphasis
role="bold">openvpnclient</emphasis> or <emphasis
role="bold">openvpnserver</emphasis> it may optionally be followed
by ":" and the port number used by the tunnel. if no ":" and port
number are included, then the default port of 1194 will be used. .
Where both the protocol and port are specified, the protocol must be
given first (e.g., openvpn:tcp:4444).</para>
<para>If type is <emphasis role="bold">generic</emphasis>, it must
be followed by ":" and a protocol name (from /etc/protocols) or a
protocol number. If the protocol is <emphasis
role="bold">tcp</emphasis> or <emphasis role="bold">udp</emphasis>
(6 or 17), then it may optionally be followed by ":" and a port
number.</para>
</listitem>
</varlistentry>
<varlistentry>
<term></term>
<listitem>
<para></para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ZONE</emphasis> -
<emphasis>zone</emphasis></term>
<listitem>
<para>The <emphasis>zone</emphasis> of the physical interface
through which tunnel traffic passes. This is normally your internet
zone.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">GATEWAY</emphasis> -
<emphasis>address-or-range</emphasis></term>
<listitem>
<para>The IP address of the remote tunnel gateway. If the remote
gateway has no fixed address (Road Warrior) then specify the gateway
as <emphasis role="bold">0.0.0.0/0</emphasis>. May be specified as a
network address and if your kernel and iptables include iprange
match support then IP address ranges are also allowed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">GATEWAY ZONES</emphasis> (Optional) -
[<emphasis>zone</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>zone</emphasis>]...]</term>
<listitem>
<para>If the gateway system specified in the third column is a
standalone host then this column should contain a comma-separated
list of the names of the zones that the host might be in. This
column only applies to IPSEC tunnels where it enables ISAKMP traffic
to flow through the tunnel to the remote gateway.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>IPSec tunnel.</para>
<para>The remote gateway is 4.33.99.124 and the remote subnet is
192.168.9.0/24. The tunnel does not use the AH protocol</para>
<programlisting> #TYPE ZONE GATEWAY
ipsec:noah net 4.33.99.124</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>Road Warrior (LapTop that may connect from anywhere) where the
"gw" zone is used to represent the remote LapTop</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 0.0.0.0/0 gw</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 3:</term>
<listitem>
<para>Host 4.33.99.124 is a standalone system connected via an ipsec
tunnel to the firewall system. The host is in zone gw.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 4.33.99.124 gw</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 4:</term>
<listitem>
<para>Road Warriors that may belong to zones vpn1, vpn2 or vpn3. The
FreeS/Wan _updown script will add the host to the appropriate zone
using the <command>shorewall add</command> command on connect and
will remove the host from the zone at disconnect time.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
ipsec net 0.0.0.0/0 vpn1,vpn2,vpn3</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 5:</term>
<listitem>
<para>You run the Linux PPTP client on your firewall and connect to
server 192.0.2.221.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
pptpclient net 192.0.2.221</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 6:</term>
<listitem>
<para>You run a PPTP server on your firewall.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
pptpserver net 0.0.0.0/0</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 7:</term>
<listitem>
<para>OPENVPN tunnel. The remote gateway is 4.33.99.124 and openvpn
uses port 7777.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
openvpn:7777 net 4.33.99.124</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 8:</term>
<listitem>
<para>You have a tunnel that is not one of the supported types. Your
tunnel uses UDP port 4444. The other end of the tunnel is
4.3.99.124.</para>
<programlisting> #TYPE ZONE GATEWAY GATEWAY ZONES
generic:udp:4444 net 4.3.99.124</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/tunnels</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-zones(5)</para>
</refsect1>
</refentry>

64
manpages6/shorewall-vardir.xml Normal file
View File

@ -0,0 +1,64 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-vardir</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>vardir</refname>
<refpurpose>Shorewall file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/vardir</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file does not exist by default. You may create the file if you
want to change the directory used by Shorewall to store state information,
including compiled firewall scripts. By default, the directory used is
<filename>/var/lib/shorewall/</filename>.</para>
<para>The file contains a single variable assignment:</para>
<para><option>VARDIR=</option><replaceable>directory</replaceable></para>
<para>where <replaceable>directory</replaceable> is the name of a
directory. If you add this file, you should copy the files from
<filename>/var/lib/shorewall</filename> to the new directory before
performing a <command>shorewall restart</command>.</para>
</refsect1>
<refsect1>
<title>Example</title>
<para>VARDIR=/root/shorewall</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/vardir</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</para>
</refsect1>
</refentry>

261
manpages6/shorewall-zones.xml Normal file
View File

@ -0,0 +1,261 @@
<?xml version="1.0" encoding="UTF-8"?>
<refentry>
<refmeta>
<refentrytitle>shorewall-zones</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>zones</refname>
<refpurpose>Shorewall zone declaration file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall/zones</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The /etc/shorewall/zones file declares your network zones. You
specify the hosts in each zone through entries in
<filename>/etc/shorewall/interfaces</filename> or
<filename>/etc/shorewall/hosts</filename>.</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ZONE</emphasis> -
<emphasis>zone</emphasis>[<emphasis
role="bold">:</emphasis><emphasis>parent-zone</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>parent-zone</emphasis>]...]</term>
<listitem>
<para>Name of the <emphasis>zone</emphasis>. The names "all",
"none", "SOURCE" and "DEST" are reserved and may not be used as zone
names. The maximum length of a zone name is determined by the
setting of the LOGFORMAT option in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5). With the
default LOGFORMAT, zone names can be at most 5 characters
long.</para>
<para>The order in which Shorewall matches addresses from packets to
zones is determined by the order of zone declarations. Where a zone
is nested in one or more other zones, you may either ensure that the
nested zone precedes its parents in this file, or you may follow the
(sub)zone name by ":" and a comma-separated list of the parent
zones. The parent zones must have been declared in earlier records
in this file. See <ulink
url="shorewall-nesting.html">shorewall-nesting</ulink>(5) for
additional information.</para>
<para>Example:</para>
<programlisting>#ZONE TYPE OPTIONS IN OPTIONS OUT OPTIONS
a ipv4
b ipv4
c:a,b ipv4</programlisting>
<para>Currently, Shorewall uses this information to reorder the zone
list so that parent zones appear after their subzones in the list.
The IMPLICIT_CONTINUE option in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5) can also create
implicit CONTINUE policies to/from the subzone.</para>
<para>In the future, Shorewall may make additional use of nesting
information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TYPE</emphasis></term>
<listitem>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ipv4</emphasis></term>
<listitem>
<para>This is the standard Shorewall zone type and is the
default if you leave this column empty or if you enter "-" in
the column. Communication with some zone hosts may be
encrypted. Encrypted hosts are designated using the
'ipsec'option in <ulink
url="shorewall-hosts.html">shorewall-hosts</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ipsec</emphasis></term>
<listitem>
<para>Communication with all zone hosts is encrypted. Your
kernel and iptables must include policy match support.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">firewall</emphasis></term>
<listitem>
<para>Designates the firewall itself. You must have exactly
one 'firewall' zone. No options are permitted with a
'firewall' zone. The name that you enter in the ZONE column
will be stored in the shell variable $FW which you may use in
other configuration files to designate the firewall
zone.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>bport (or bport4)</term>
<listitem>
<para>(Shorewall-perl only) The zone is associated with one or
more ports on a single bridge.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">OPTIONS, IN OPTIONS and OUT
OPTIONS</emphasis> - [<emphasis>option</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
<listitem>
<para>A comma-separated list of options. With the exception of the
<option>mss</option> option, these only apply to TYPE
<option>ipsec</option> zones.</para>
<variablelist>
<varlistentry>
<term><emphasis
role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
<listitem>
<para>where <emphasis>number</emphasis> is specified using
setkey(8) using the 'unique:<emphasis>number</emphasis> option
for the SPD level.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
<listitem>
<para>where <emphasis>number</emphasis> is the SPI of the SA
used to encrypt/decrypt packets.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">proto=</emphasis><emphasis
role="bold">ah</emphasis>|<emphasis
role="bold">esp</emphasis>|<emphasis
role="bold">ipcomp</emphasis></term>
<listitem>
<para>IPSEC Encapsulation Protocol</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">mss=</emphasis><emphasis>number</emphasis></term>
<listitem>
<para>sets the MSS field in TCP packets. If you supply this
option, you should also set FASTACCEPT=No in <ulink
url="shorewall.conf.html">shorewall.conf</ulink>(5) to insure
that both the SYN and SYN,ACK packets have their MSS field
adjusted.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mode=</emphasis><emphasis
role="bold">transport</emphasis>|<emphasis
role="bold">tunnel</emphasis></term>
<listitem>
<para>IPSEC mode</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
<listitem>
<para>only available with mode=tunnel</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
<listitem>
<para>only available with mode=tunnel</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">strict</emphasis></term>
<listitem>
<para>Means that packets must match all rules.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">next</emphasis></term>
<listitem>
<para>Separates rules; can only be used with strict</para>
</listitem>
</varlistentry>
</variablelist>
<para>The options in the OPTIONS column are applied to both incoming
and outgoing traffic. The IN OPTIONS are applied to incoming traffic
(in addition to OPTIONS) and the OUT OPTIONS are applied to outgoing
traffic.</para>
<para>If you wish to leave a column empty but need to make an entry
in a following column, use "-".</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall/zones</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://www.shorewall.net/Multiple_Zones.html">http://www.shorewall.net/Multiple_Zones.html</ulink>.</para>
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-nesting(8), shorewall-netmap(5),
shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
shorewall-proxyarp(5), shorewall-route_rules(5),
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5)</para>
</refsect1>
</refentry>

1657
manpages6/shorewall.conf.xml Normal file
View File

File diff suppressed because it is too large Load Diff

1457
manpages6/shorewall.xml Normal file
View File

File diff suppressed because it is too large Load Diff

2
tools/build/upload
View File

@ -236,10 +236,12 @@ fi
files="errata known_problems.txt releasenotes.txt patch-*-$1 ${1}.*"
base=
[ -n "$UPLOAD6" ] && base="shorewall6-${1}.tar.*" && files="$files shorewall6-${1}.* $rpm6"
[ -n "$UPLOADPERL" ] && base="shorewall-perl-${1}.tar.*" && files="$files shorewall-perl-${1}.* $perlrpm"
[ -n "$UPLOADCOMMON" ] && base="$base shorewall-common-${1}.tar.*" && files="$files shorewall-common-${1}.* $rpm"
[ -n "$UPLOADSHELL" ] && base="$base shorewall-shell-${1}.tar.*" && files="$files shorewall-shell-${1}.* $shellrpm"
[ -n "$UPLOADLITE" ] && base="$base shorewall-lite-${1}.tar.*" && files="$files shorewall-lite-${1}.* $literpm"
[ -n "$UPLOAD6LITE" ] && base="$base shorewall6-lite-${1}.tar.*" && files="$files shorewall6-lite-${1}.* $lite6rpm"
[ -n "$UPLOADXML" ] && base="$base shorewall-docs-xml-${1}.tar.*" && files="$files shorewall-docs-xml-${1}.* $literpm"
[ -n "$UPLOADHTML" ] && base="$base shorewall-docs-html-${1}.tar.*" && files="$files shorewall-docs-html-${1}.* $literpm"