diff --git a/Shorewall-docs/CorpNetwork.htm b/Shorewall-docs/CorpNetwork.htm index bc3e07e75..936116292 100644 --- a/Shorewall-docs/CorpNetwork.htm +++ b/Shorewall-docs/CorpNetwork.htm @@ -1,293 +1,281 @@ - + - + + Corporate Shorewall Configuration + - Corporate Shorewall Configuration - - - - - - - - - + + + + + + + + + - - - - -
- +//--> + + + + - - - +Internal Servers + + +

Multiple IPs with DMZ and - Internal Servers

-
- -
- + +
+

Corporate Network

- -

NotesNotes:

- -
+ +
    -
  • This configuration is used on a corporate network that - has a Linux (RedHat 8.0) server with three interfaces, running Shorewall - 1.4.5 release,
    • -
  • Make sure you know what public IP addresses are currently -being used and verify these before starting.
    • -
  • Verify you DNS settings before starting any -Shorewall configuration especially if you have split DNS.
    • -
  • System names and Internet IP addresses have been changed -to protect the innocent.
    • - +
  • This configuration is used on a corporate network that has a +Linux (RedHat 8.0) server with three interfaces, running Shorewall 1.4.5 + release,
    • +
  • Make sure you know what public IP addresses are currently being +used and verify these before starting.
    • +
  • Verify your DNS settings before starting any Shorewall + configuration especially if you have split DNS.
    • +
  • System names and Internet IP addresses have been changed to protect + the innocent.
- -

Warning: This configuration -uses a combination of Static NAT and Proxy ARP. This is generally not - relevant to a simple configuration with a single public IP address. - If you have just a single public IP address, most of what you see -here won't apply to your setup so beware of copying parts of this -configuration and expecting them to work for you. What you copy may -or may not work in your configuration.
-
-

- -

I have a T1 with 64 static IP addresses (63.123.106.65-127/26). The - internet is connected to eth0. The local network is connected via eth1 - (10.10.0.0/22) and the DMZ is connected to eth2 (192.168.21.0/24). I -have an IPSec tunnel connecting our offices in Germany to our offices -in the US. I host two Microsoft Exchange servers for two different companies + +

Warning: This +configuration uses a combination of Static NAT and Proxy ARP. This is +generally not relevant to a simple configuration with a single public IP + address. If you have just a single public +IP address, most of what you see here won't apply to your setup so beware +of copying parts of this configuration and expecting them to work for +you. What you copy may or may not work in your configuration.
+
+

+ +

I have a T1 with 64 static IP addresses (192.0.18.65-127/26). The + internet is connected to eth0. The local network is connected via eth1 + (10.10.0.0/22) and the DMZ is connected to eth2 (192.168.21.0/24). I have +an IPSec tunnel connecting our offices in Germany to our offices in the +US. I host two Microsoft Exchange servers for two different companies behind the firewall hence, the two Exchange servers in the diagram below.

- -

Summary:
-

- + +

Summary:
+

+
    -
  • SNAT for all systems connected to the LAN -- Internal addresses 10.10.x.x to external address 63.123.106.127.
    • -
  • Static NAT for Polaris (Exchange Server - #2). Internal address 10.10.1.8 and external address 63.123.106.70.
    • -
  • Static NAT for Sims (Inventory Management server). - Internal address 10.10.1.56 and external address 63.123.106.75.
    -
    • -
  • Static NAT for Project (Project Web - Server). Internal address 10.10.1.55 and external - address 63.123.106.84.
    • -
  • Static NAT for Fortress (Exchange -Server). Internal address 10.10.1.252 and external -address 63.123.106.93.
    • -
  • Static NAT for BBSRV (Blackberry Server). - Internal address 10.10.1.230 and external address - 63.123.106.97.
    • -
  • Static NAT for Intweb (Intranet Web - Server). Internal address 10.10.1.60 and external - address 63.123.106.115.
    • - +
  • SNAT for all systems connected to the LAN - Internal addresses 10.10.x.x + to external address 192.0.18.127.
    • +
  • Static NAT for Polaris (Exchange Server #2). Internal address + 10.10.1.8 and external address 192.0.18.70.
    • +
  • Static NAT for Sims (Inventory Management server). Internal + address 10.10.1.56 and external address 192.0.18.75.
    +
    • +
  • Static NAT for Project (Project Web Server). Internal address + 10.10.1.55 and external address 192.0.18.84.
    • +
  • Static NAT for Fortress (Exchange Server). Internal address + 10.10.1.252 and external address 192.0.18.93.
    • +
  • Static NAT for BBSRV (Blackberry Server). Internal address + 10.10.1.230 and external address 192.0.18.97.
    • +
  • Static NAT for Intweb (Intranet Web Server). Internal address + 10.10.1.60 and external address 192.0.18.115.
- -

The firewall runs on a 2Gb, Dual PIV/2.8GHz, Intel motherboard with - RH8.0.

- -

The Firewall is also a proxy server running Privoxy 3.0.

- -

The single system in the DMZ (address 63.123.106.80) runs sendmail, - imap, pop3, DNS, a Web server (Apache) and an FTP server (vsFTPd 1.1.0). - That server is managed through Proxy ARP.

- -

All administration and publishing is done using ssh/scp. I have X installed - on the firewall and the system in the DMZ. X applications tunnel - through SSH to Hummingbird Exceed running on a PC located in the LAN. - Access to the firewall using SSH is restricted to systems in the LAN, DMZ -or the system Kaos which is on the Internet and managed by me.

- -

(Corporate Network Diagram) -

- -

- -

The Ethernet 0 interface in the Server is configured with IP - address 63.123.106.68, netmask 255.255.255.192. The server's default - gateway is 63.123.106.65, the Router connected to my network and -the ISP. This is the same default gateway used by the firewall - itself. On the firewall, Shorewall automatically - adds a host route to 63.123.106.80 through Ethernet - 2 (192.168.21.1) because of the entry in -/etc/shorewall/proxyarp (see below). I modified the start, stop and -init scripts to include the fixes suggested when having an IPSec tunnel.

- + +

The firewall runs on a 2Gb, Dual PIV/2.8GHz, Intel motherboard with + RH8.0.

+ +

The Firewall is also a proxy server running Privoxy 3.0.

+ +

The single system in the DMZ (address 192.0.18.80) runs sendmail, imap, + pop3, DNS, a Web server (Apache) and an FTP server (vsFTPd 1.1.0). That +server is managed through Proxy ARP.

+ +

All administration and publishing is done using ssh/scp. I have X installed + on the firewall and the system in the DMZ. X applications tunnel through +SSH to Hummingbird Exceed running on a PC located in the LAN. Access to +the firewall using SSH is restricted to systems in the LAN, DMZ or the +system Kaos which is on the Internet and managed by me.

+ +

(Corporate Network Diagram) +

+ +

+ +

The Ethernet 0 interface in the Server is configured with IP address + 192.0.18.68, netmask 255.255.255.192. The server's default gateway is + 192.0.18.65, the Router connected to my network and the ISP. This is the + same default gateway used by the firewall itself. On the firewall, Shorewall + automatically adds a host route to 192.0.18.80 through Ethernet 2 (192.168.21.1) +because of the entry in /etc/shorewall/proxyarp (see below). I modified +the start, stop and init scripts to include the fixes suggested when having +an IPSec tunnel.

+

Some Mistakes I Made:

- +

Yes, believe it or not, I made some really basic mistakes when building - this firewall. Firstly, I had the new firewall setup in parallel with + this firewall. Firstly, I had the new firewall setup in parallel with the old firewall so that there was no interruption of service to my users. - During my out-bound testing, I set up systems on the LAN to utilize the - firewall which worked fine. When testing my NAT connections, from the -outside, these would fail and I could not understand why. Eventually, -I changed the default route on the internal system I was trying to access, -to point to the new firewall and "bingo", everything worked as expected. -This oversight delayed my deployment by a couple of days not to mention -level of frustration it produced.

- +During my out-bound testing, I set up systems on the LAN to utilize the +firewall which worked fine. When testing my NAT connections, from the +outside, these would fail and I could not understand why. Eventually, +I changed the default route on the internal system I was trying to access, +to point to the new firewall and "bingo", everything worked as expected. +This oversight delayed my deployment by a couple of days not to mention +level of frustration it produced.

+

Another problem that I encountered was in setting up the Proxyarp system - in the DMZ. Initially I forgot to remove the entry for the eth2 from -the /etc/shorewall/masq file. Once my file settings were correct, I started - verifying that the ARP caches on the firewall, as well as the outside -system "kaos", were showing the correct Ethernet MAC address. However, -in testing remote access, I could access the system in the DMZ only from -the firewall and LAN but not from the Internet. The message I received -was "connection denied" on all protocols. What I did not realize was that -a "helpful" administrator that had turned on an old system and assigned -the same address as the one I was using for Proxyarp without notifying -me. How did I work this out. I shutdown the system in the DMZ, rebooted -the router and flushed the ARP cache on the firewall and kaos. Then, from -kaos, I started pinging that IP address and checked the updated ARP cache -and lo-and-behold a different MAC address showed up. High levels of frustration -etc., etc. The administrator will not be doing that again! :-)

- +in the DMZ. Initially I forgot to remove the entry for the eth2 from the + /etc/shorewall/masq file. Once my file settings were correct, I started + verifying that the ARP caches on the firewall, as well as the outside +system "kaos", were showing the correct Ethernet MAC address. However, +in testing remote access, I could access the system in the DMZ only from +the firewall and LAN but not from the Internet. The message I received +was "connection denied" on all protocols. What I did not realize was that +a "helpful" administrator that had turned on an old system and assigned +the same address as the one I was using for Proxyarp without notifying +me. How did I work this out. I shutdown the system in the DMZ, rebooted +the router and flushed the ARP cache on the firewall and kaos. Then, from +kaos, I started pinging that IP address and checked the updated ARP cache +and lo-and-behold a different MAC address showed up. High levels of frustration +etc., etc. The administrator will not be doing that again! :-)

+

Lessons Learned:

- +
    -
  • Read the documentation.
    • -
  • Draw your network topology before starting.
    • -
  • Understand what services you are going to allow in and out of - the firewall, whether they are TCP or UDP packets and make a note -of these port numbers.
    • -
  • Try to get quiet time to build the firewall - you need to focus - on the job at hand.
    • -
  • When asking for assistance, be honest and include as much detail - as requested. Don't try and hide IP addresses etc., you will probably - screw up the logs and make receiving assistance harder.
    • -
  • Read the documentation.
    • - +
  • Read the documentation.
    • +
  • Draw your network topology before starting.
    • +
  • Understand what services you are going to allow in and out of the + firewall, whether they are TCP or UDP packets and make a note of these +port numbers.
    • +
  • Try to get quiet time to build the firewall - you need to focus on +the job at hand.
    • +
  • When asking for assistance, be honest and include as much detail +as requested. Don't try and hide IP addresses etc., you will probably +screw up the logs and make receiving assistance harder.
    • +
  • Read the documentation.
- +

Futures:

- +

This is by no means the final configuration. In the near future, I will - be moving more systems from the LAN to the DMZ. I will also be watching - the logs for port scan programs etc. but, this should be standard security - maintenance.

- +be moving more systems from the LAN to the DMZ. I will also be watching +the logs for port scan programs etc. but, this should be standard security + maintenance.

+

Here are copies of my files. I have removed most of the internal documentation for the purpose of this space however, my system still has the original files with all the comments and I highly recommend you do -the same.

- -
- +the same.

+
+

Shorewall.conf

- -
+ +
##############################################################################
# /etc/shorewall/shorewall.conf V1.4 - Change the following variables to
# match your setup
#
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
#
# This file should be placed in /etc/shorewall
#
# (c) 1999,2000,2001,2002,2003 - Tom Eastep (teastep@shorewall.net)
##############################################################################
# L O G G I N G
##############################################################################
LOGFILE=/var/log/messages
LOGFORMAT="Shorewall:%s:%s:"
LOGRATE=
LOGBURST=
LOGUNCLEAN=info
BLACKLIST_LOGLEVEL=
LOGNEWNOTSYN=
MACLIST_LOG_LEVEL=info
TCP_FLAGS_LOG_LEVEL=debug
RFC1918_LOG_LEVEL=debug
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
SUBSYSLOCK=/var/lock/subsys/shorewall
STATEDIR=/var/lib/shorewall
MODULESDIR=
FW=fw
NAT_ENABLED=Yes
MANGLE_ENABLED=Yes
IP_FORWARDING=On
ADD_IP_ALIASES=Yes
ADD_SNAT_ALIASES=Yes
TC_ENABLED=Yes
CLEAR_TC=No
MARK_IN_FORWARD_CHAIN=No
CLAMPMSS=No
ROUTE_FILTER=Yes
NAT_BEFORE_RULES=No
MULTIPORT=Yes
DETECT_DNAT_IPADDRS=Yes
MUTEX_TIMEOUT=60
NEWNOTSYN=Yes
BLACKLIST_DISPOSITION=DROP
MACLIST_DISPOSITION=REJECT
TCP_FLAGS_DISPOSITION=DROP
#LAST LINE -- DO NOT REMOVE

-
- +
+

Zones File

- -
+ +
#
# Shorewall 1.4 -- Sample Zone File For Two Interfaces
# /etc/shorewall/zones
#
# This file determines your network zones. Columns are:
#
# ZONE Short name of the zone
# DISPLAY Display name of the zone
# COMMENTS Comments about the zone
#
#ZONE DISPLAY COMMENTS
net Net Internet
loc Local Local Networks
dmz DMZ Demilitarized Zone
vpn1 VPN1 VPN to Germany
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-
- +
+

Interfaces File:

- -
-

##############################################################################
- #ZONE INTERFACE BROADCAST OPTIONS
- net eth0 62.123.106.127 routefilter,norfc1918,blacklist,tcpflags
- loc eth1 detect dhcp,routefilter
- dmz eth2 detect
- vpn1 ipsec0
- #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE -

-
- + +
+

##############################################################################
+#ZONE INTERFACE BROADCAST OPTIONS
+net eth0 62.123.106.127 routefilter,norfc1918,blacklist,tcpflags
+loc eth1 detect dhcp,routefilter
+dmz eth2 detect
+vpn1 ipsec0
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

+
+

Routestopped File:

- -
+ +
#INTERFACE HOST(S)
eth1 -
eth2 -
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
-
- +
+

Policy File:

- -
+ +
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
loc net ACCEPT
loc fw ACCEPT
loc dmz ACCEPT
# If you want open access to the Internet from your Firewall 
# remove the comment from the following line.
fw net ACCEPT
fw loc ACCEPT
fw dmz ACCEPT
dmz fw ACCEPT
dmz loc ACCEPT
dmz net ACCEPT
# 
# Adding VPN Access
loc vpn1 ACCEPT
dmz vpn1 ACCEPT
fw vpn1 ACCEPT
vpn1 loc ACCEPT
vpn1 dmz ACCEPT
vpn1 fw ACCEPT
#
net all DROP info
all all REJECT info
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-
- +
+

Masq File:

- -
- 
#INTERFACE SUBNET ADDRESS
eth0 eth1 163.123.106.126
#
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-
- + +
+ 
#INTERFACE SUBNET ADDRESS
eth0 eth1 1192.0.18.126
#
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
+
+

NAT File:

- -
- 
#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL
#
# Intranet Web Server
63.123.106.115 eth0:0 10.10.1.60 No No
#
# Project Web Server
63.123.106.84 eth0:1 10.10.1.55 No No
#
# Blackberry Server
63.123.106.97 eth0:2 10.10.1.55 No No
#
# Corporate Mail Server
63.123.106.93 eth0:3 10.10.1.252 No No
#
# Second Corp Mail Server
63.123.106.70 eth0:4 10.10.1.8 No No
#
# Sims Server
63.123.106.75 eth0:5 10.10.1.56 No No
#
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
-
- + +
+ 
#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL
#
# Intranet Web Server
192.0.18.115 eth0:0 10.10.1.60 No No
#
# Project Web Server
192.0.18.84 eth0:1 10.10.1.55 No No
#
# Blackberry Server
192.0.18.97 eth0:2 10.10.1.55 No No
#
# Corporate Mail Server
192.0.18.93 eth0:3 10.10.1.252 No No
#
# Second Corp Mail Server
192.0.18.70 eth0:4 10.10.1.8 No No
#
# Sims Server
192.0.18.75 eth0:5 10.10.1.56 No No
#
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
+
+

Proxy ARP File:

- -
- 
#ADDRESS INTERFACE EXTERNAL HAVEROUTE
#
# The Corporate email server in the DMZ
63.123.106.80 eth2 eth0 No
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
-
- + +
+ 
#ADDRESS INTERFACE EXTERNAL HAVEROUTE
#
# The Corporate email server in the DMZ
192.0.18.80 eth2 eth0 No
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
+
+

Tunnels File:

- -
+ +
# TYPE ZONE GATEWAY GATEWAY ZONE PORT
ipsec net 134.147.129.82
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
-
- -

Rules File (The shell variables are set in /etc/shorewall/params):

- -
- 
##############################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
#
# Accept DNS connections from the firewall to the network
#
ACCEPT fw net tcp 53
ACCEPT fw net udp 53
#
# Accept SSH from internet interface from kaos only
#
ACCEPT net:63.123.106.98 fw tcp 22
#
# Accept connections from the local network for administration 
#
ACCEPT loc fw tcp 20:22
ACCEPT loc net tcp 22
ACCEPT loc fw tcp 53
ACCEPT loc fw udp 53
ACCEPT loc net tcp 53
ACCEPT loc net udp 53
#
# Allow Ping To And From Firewall
#
ACCEPT loc fw icmp 8
ACCEPT loc dmz icmp 8
ACCEPT loc net icmp 8
ACCEPT dmz fw icmp 8
ACCEPT dmz loc icmp 8
ACCEPT dmz net icmp 8
DROP net fw icmp 8
DROP net loc icmp 8
DROP net dmz icmp 8
ACCEPT fw loc icmp 8
ACCEPT fw dmz icmp 8
DROP fw net icmp 8
#
# Accept proxy web connections from the inside
#
ACCEPT loc fw tcp 8118
#
# Forward PcAnywhere, Oracle and Web traffic from outside to the Demo systems
# From a specific IP Address on the Internet.
# 
# ACCEPT net:207.65.110.10 loc:10.10.3.151 tcp 1521,http
# ACCEPT net:207.65.110.10 loc:10.10.2.32 tcp 5631:5632
#
# Intranet web server
ACCEPT net loc:10.10.1.60 tcp 443
ACCEPT dmz loc:10.10.1.60 tcp 443
#
# Projects web server
ACCEPT net loc:10.10.1.55 tcp 80
ACCEPT dmz loc:10.10.1.55 tcp 80
# 
# Blackberry Server
ACCEPT net loc:10.10.1.230 tcp 3101
#
# Corporate Email Server
ACCEPT net loc:10.10.1.252 tcp 25,53,110,143,443
#
# Corporate #2 Email Server
ACCEPT net loc:10.10.1.8 tcp 25,80,110,443
#
# Sims Server
ACCEPT net loc:10.10.1.56 tcp 80,443
ACCEPT net loc:10.10.1.56 tcp 7001:7002
ACCEPT net:63.83.198.0/24 loc:10.10.1.56 tcp 5631:5632
#
# Access to DMZ
ACCEPT loc dmz udp 53,177
ACCEPT loc dmz tcp 80,25,53,22,143,443,993,20,110 -
ACCEPT net dmz udp 53
ACCEPT net dmz tcp 25,53,22,21,123
ACCEPT dmz net tcp 25,53,80,123,443,21,22
ACCEPT dmz net udp 53
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
-
- +
+ +

Rules File (The shell variables are set in /etc/shorewall/params):

+ +
+ 
##############################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
#
# Accept DNS connections from the firewall to the network
#
ACCEPT fw net tcp 53
ACCEPT fw net udp 53
#
# Accept SSH from internet interface from kaos only
#
ACCEPT net:192.0.18.98 fw tcp 22
#
# Accept connections from the local network for administration 
#
ACCEPT loc fw tcp 20:22
ACCEPT loc net tcp 22
ACCEPT loc fw tcp 53
ACCEPT loc fw udp 53
ACCEPT loc net tcp 53
ACCEPT loc net udp 53
#
# Allow Ping To And From Firewall
#
ACCEPT loc fw icmp 8
ACCEPT loc dmz icmp 8
ACCEPT loc net icmp 8
ACCEPT dmz fw icmp 8
ACCEPT dmz loc icmp 8
ACCEPT dmz net icmp 8
DROP net fw icmp 8
DROP net loc icmp 8
DROP net dmz icmp 8
ACCEPT fw loc icmp 8
ACCEPT fw dmz icmp 8
DROP fw net icmp 8
#
# Accept proxy web connections from the inside
#
ACCEPT loc fw tcp 8118
#
# Forward PcAnywhere, Oracle and Web traffic from outside to the Demo systems
# From a specific IP Address on the Internet.
# 
# ACCEPT net:207.65.110.10 loc:10.10.3.151 tcp 1521,http
# ACCEPT net:207.65.110.10 loc:10.10.2.32 tcp 5631:5632
#
# Intranet web server
ACCEPT net loc:10.10.1.60 tcp 443
ACCEPT dmz loc:10.10.1.60 tcp 443
#
# Projects web server
ACCEPT net loc:10.10.1.55 tcp 80
ACCEPT dmz loc:10.10.1.55 tcp 80
# 
# Blackberry Server
ACCEPT net loc:10.10.1.230 tcp 3101
#
# Corporate Email Server
ACCEPT net loc:10.10.1.252 tcp 25,53,110,143,443
#
# Corporate #2 Email Server
ACCEPT net loc:10.10.1.8 tcp 25,80,110,443
#
# Sims Server
ACCEPT net loc:10.10.1.56 tcp 80,443
ACCEPT net loc:10.10.1.56 tcp 7001:7002
ACCEPT net:63.83.198.0/24 loc:10.10.1.56 tcp 5631:5632
#
# Access to DMZ
ACCEPT loc dmz udp 53,177
ACCEPT loc dmz tcp 80,25,53,22,143,443,993,20,110 -
ACCEPT net dmz udp 53
ACCEPT net dmz tcp 25,53,22,21,123
ACCEPT dmz net tcp 25,53,80,123,443,21,22
ACCEPT dmz net udp 53
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
+
+

Start File:

- -
+ +
############################################################################
# Shorewall 1.4 -- /etc/shorewall/start
#
# Add commands below that you want to be executed after shorewall has
# been started or restarted.
#
qt service ipsec start
-
- +
+

Stop File:

- -
+ +
############################################################################
# Shorewall 1.4 -- /etc/shorewall/stop
#
# Add commands below that you want to be executed at the beginning of a
# "shorewall stop" command.
#
qt service ipsec stop
-
- +
+

Init File:

- -
+ +
############################################################################
# Shorewall 1.4 -- /etc/shorewall/init
#
# Add commands below that you want to be executed at the beginning of
# a "shorewall start" or "shorewall restart" command.
#
qt service ipsec stop
-
- -

Last updated 7/16/2003 +

+ +

Last updated 7/16/2003
-

- -

Copyright 2003 Thomas M. Eastep and -Graeme Boyle
-

-
+// +
+

+

Copyright + 2003 Thomas M. Eastep and Graeme Boyle
+

+
diff --git a/Shorewall-docs/News.htm b/Shorewall-docs/News.htm index be7a9cb30..2d61645c1 100644 --- a/Shorewall-docs/News.htm +++ b/Shorewall-docs/News.htm @@ -5,7 +5,7 @@ - + Shorewall News @@ -16,90 +16,483 @@ - + - + - + - + - + - + - + - - + +
+ - +

Shorewall News Archive

-
- -

7/15/2003 - New Mirror in Brazil
-

- Thanks to the folks at securityopensource.org.br, there is now a Shorewall -mirror in Brazil. -

7/15/2003 - Shorewall-1.4.6 RC 1
-

+

7/20/2003 - Shorewall-1.4.6
+

+ + +
+

Problems Corrected:
-

- +

+ +
    -
  1. A problem seen on RH7.3 systems where Shorewall encountered start - errors when started using the "service" mechanism has been worked around.
    -
    -
    2. -
  2. Where a list of IP addresses appears in the DEST column of a DNAT[-] - rule, Shorewall incorrectly created multiple DNAT rules in the nat table - (one for each element in the list). Shorewall now correctly creates a single +
  3. A problem seen on RH7.3 systems where Shorewall encountered start + errors when started using the "service" mechanism has been worked around.
    +
    +
    4. +
  4. Where a list of IP addresses appears in the DEST column of a DNAT[-] + rule, Shorewall incorrectly created multiple DNAT rules in the nat table +(one for each element in the list). Shorewall now correctly creates a +single DNAT rule with multiple "--to-destination" clauses.
    +
    +
    5. +
  5. Corrected a problem in Beta 1 where DNS names containing a "-" +were mis-handled when they appeared in the DEST column of a rule.
    +
    +
    6. +
  6. A number of problems with rule parsing have been corrected. Corrections +involve the handling of "z1!z2" in the SOURCE column as well as lists in +the ORIGINAL DESTINATION column.
    +
    +
    7. +
  7. The message "Adding rules for DHCP" is now suppressed if there are +no DHCP rules to add.
    +
    8. +
+ + +

Migration Issues:
+

+ +
    +
  1. In earlier versions, an undocumented feature allowed entries in +the host file as follows:
    +
    +     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
    +
    + This capability was never documented and has been removed in 1.4.6 + to allow entries of the following format:
    +
    +     z   eth1:192.168.1.0/24,192.168.2.0/24
    +
    +
    2. +
  2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been + removed from /etc/shorewall/shorewall.conf. These capabilities are now +automatically detected by Shorewall (see below).
    +
    3. +
+ +

New Features:
+

+ + +
    +
  1. A 'newnotsyn' interface option has been added. This option may +be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No + for packets arriving on the associated interface.
    +
    +
    2. +
  2. The means for specifying a range of IP addresses in /etc/shorewall/masq + to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for + address ranges.
    +
    +
    3. +
  3. Shorewall can now add IP addresses to subnets other than the first + one on an interface.
    +
    +
    4. +
  4. DNAT[-] rules may now be used to load balance (round-robin) over +a set of servers. Servers may be specified in a range of addresses given +as <first address>-<last address>.
    +
    + Example:
    +
    +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    +
    +
    5. +
  5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options + have been removed and have been replaced by code that detects whether + these capabilities are present in the current kernel. The output of the + start, restart and check commands have been enhanced to report the outcome:
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    + Verifying Configuration...
    +
    +
    6. +
  6. Support for the Connection Tracking Match Extension has been added. + This extension is available in recent kernel/iptables releases and allows + for rules which match against elements in netfilter's connection tracking + table. Shorewall automatically detects the availability of this extension + and reports its availability in the output of the start, restart and +check commands.
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    +    Connection Tracking Match: Available
    + Verifying Configuration...
    +
    + If this extension is available, the ruleset generated by Shorewall + is changed in the following ways:
    7. +
      +
    • To handle 'norfc1918' filtering, Shorewall will not create chains + in the mangle table but will rather do all 'norfc1918' filtering in the +filter table (rfc1918 chain).
      • +
    • Recall that Shorewall DNAT rules generate two netfilter rules; + one in the nat table and one in the filter table. If the Connection +Tracking Match Extension is available, the rule in the filter table is extended + to check that the original destination address was the same as specified + (or defaulted to) in the DNAT rule.
      +
      +
      • +
    +
  7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    +
    +
    8. +
  8. An 'ipcalc' command has been added to /sbin/shorewall.
    +
    +       ipcalc [ <address> <netmask> | <address>/<vlsm> + ]
    +
    + Examples:
    +
    +       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
    +          CIDR=192.168.1.0/24
    +          NETMASK=255.255.255.0
    +          NETWORK=192.168.1.0
    +          BROADCAST=192.168.1.255
    +       [root@wookie root]#
    +
    +       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
    +          CIDR=192.168.1.0/24
    +          NETMASK=255.255.255.0
    +          NETWORK=192.168.1.0
    +          BROADCAST=192.168.1.255
    +       [root@wookie root]#
    +
    + Warning:
    +
    + If your shell only supports 32-bit signed arithmatic (ash or dash), + then the ipcalc command produces incorrect information for IP addresses + 128.0.0.0-1 and for /1 networks. Bash should produce correct information + for all valid IP addresses.
    +
    +
    9. +
  9. An 'iprange' command has been added to /sbin/shorewall. +
    +
    +       iprange <address>-<address>
    +
    + This command decomposes a range of IP addressses into a list of +network and host addresses. The command can be useful if you need to construct + an efficient set of rules that accept connections from a range of network + addresses.
    +
    + Note: If your shell only supports 32-bit signed arithmetic (ash +or dash) then the range may not span 128.0.0.0.
    +
    + Example:
    +
    +       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
    +       192.168.1.4/30
    +       192.168.1.8/29
    +       192.168.1.16/28
    +       192.168.1.32/27
    +       192.168.1.64/26
    +       192.168.1.128/25
    +       192.168.2.0/23
    +       192.168.4.0/22
    +       192.168.8.0/22
    +       192.168.12.0/29
    +       192.168.12.8/31
    +       [root@gateway root]#
    +
    +
    10. +
  10. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.
    +
    + Example:
    +
    +     foo    eth1:192.168.1.0/24,192.168.2.0/24
    +
    +
    11. +
  11. The "shorewall check" command now includes the chain name when printing +the applicable policy for each pair of zones.
    +  
    +     Example:
    +  
    +         Policy for dmz to net is REJECT using chain all2all
    +  
    + This means that the policy for connections from the dmz to the internet +is REJECT and the applicable entry in the /etc/shorewall/policy was the all->all +policy.
    +
    +
    12. +
  12. Support for the 2.6 Kernel series has been added.
    +
    13. +
+

7/15/2003 - New Mirror in Brazil
+

+ Thanks to the folks at securityopensource.org.br, there is now a Shorewall + mirror in Brazil. +

7/15/2003 - Shorewall-1.4.6 RC 1
+

+ +

Problems Corrected:
+

+ +
    +
  1. A problem seen on RH7.3 systems where Shorewall encountered start + errors when started using the "service" mechanism has been worked around.
    +
    +
    2. +
  2. Where a list of IP addresses appears in the DEST column of a DNAT[-] + rule, Shorewall incorrectly created multiple DNAT rules in the nat table + (one for each element in the list). Shorewall now correctly creates a single DNAT rule with multiple "--to-destination" clauses.
    +
    +
    3. +
  3. Corrected a problem in Beta 1 where DNS names containing a "-" were + mis-handled when they appeared in the DEST column of a rule.

    4. -
  4. Corrected a problem in Beta 1 where DNS names containing a "-" were - mis-handled when they appeared in the DEST column of a rule.
    -
    -
    5. -
  5. A number of problems with rule parsing have been corrected. Corrections - involve the handling of "z1!z2" in the SOURCE column as well as lists in +
  6. A number of problems with rule parsing have been corrected. Corrections + involve the handling of "z1!z2" in the SOURCE column as well as lists in the ORIGINAL DESTINATION column.
    -
    7. - + +
- + +

Migration Issues:
+

+ +
    +
  1. In earlier versions, an undocumented feature allowed entries in +the host file as follows:
    +
    +     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
    +
    + This capability was never documented and has been removed in 1.4.6 to + allow entries of the following format:
    +
    +     z   eth1:192.168.1.0/24,192.168.2.0/24
    +
    +
    2. +
  2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been +removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically + detected by Shorewall (see below).
    +
    3. + +
+ +

New Features:
+

+ +
    +
  1. A 'newnotsyn' interface option has been added. This option may be + specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No + for packets arriving on the associated interface.
    +
    +
    2. +
  2. The means for specifying a range of IP addresses in /etc/shorewall/masq + to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for +address ranges.
    +
    +
    3. +
  3. Shorewall can now add IP addresses to subnets other than the first + one on an interface.
    +
    +
    4. +
  4. DNAT[-] rules may now be used to load balance (round-robin) over +a set of servers. Servers may be specified in a range of addresses given + as <first address>-<last address>.
    +
    + Example:
    +
    +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    +
    +
    5. +
  5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options + have been removed and have been replaced by code that detects whether +these capabilities are present in the current kernel. The output of the +start, restart and check commands have been enhanced to report the outcome:
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    + Verifying Configuration...
    +
    +
    6. +
  6. Support for the Connection Tracking Match Extension has been added. + This extension is available in recent kernel/iptables releases and allows + for rules which match against elements in netfilter's connection tracking + table. Shorewall automatically detects the availability of this extension + and reports its availability in the output of the start, restart and check + commands.
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    +    Connection Tracking Match: Available
    + Verifying Configuration...
    +
    + If this extension is available, the ruleset generated by Shorewall +is changed in the following ways:
    7. + +
      +
    • To handle 'norfc1918' filtering, Shorewall will not create chains + in the mangle table but will rather do all 'norfc1918' filtering in the +filter table (rfc1918 chain).
      • +
    • Recall that Shorewall DNAT rules generate two netfilter rules; +one in the nat table and one in the filter table. If the Connection Tracking + Match Extension is available, the rule in the filter table is extended +to check that the original destination address was the same as specified +(or defaulted to) in the DNAT rule.
      +
      +
      • + +
    +
  7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    +
    +
    8. +
  8. An 'ipcalc' command has been added to /sbin/shorewall.
    +
    +       ipcalc [ <address> <netmask> | <address>/<vlsm> + ]
    +
    + Examples:
    +
    +       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
    +          CIDR=192.168.1.0/24
    +          NETMASK=255.255.255.0
    +          NETWORK=192.168.1.0
    +          BROADCAST=192.168.1.255
    +       [root@wookie root]#
    +
    +       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
    +          CIDR=192.168.1.0/24
    +          NETMASK=255.255.255.0
    +          NETWORK=192.168.1.0
    +          BROADCAST=192.168.1.255
    +       [root@wookie root]#
    +
    + Warning:
    +
    + If your shell only supports 32-bit signed arithmatic (ash or dash), +then the ipcalc command produces incorrect information for IP addresses +128.0.0.0-1 and for /1 networks. Bash should produce correct information +for all valid IP addresses.
    +
    +
    9. +
  9. An 'iprange' command has been added to /sbin/shorewall.
    +
    +       iprange <address>-<address>
    +
    + This command decomposes a range of IP addressses into a list of network + and host addresses. The command can be useful if you need to construct +an efficient set of rules that accept connections from a range of network +addresses.
    +
    + Note: If your shell only supports 32-bit signed arithmetic (ash or dash) + then the range may not span 128.0.0.0.
    +
    + Example:
    +
    +       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
    +       192.168.1.4/30
    +       192.168.1.8/29
    +       192.168.1.16/28
    +       192.168.1.32/27
    +       192.168.1.64/26
    +       192.168.1.128/25
    +       192.168.2.0/23
    +       192.168.4.0/22
    +       192.168.8.0/22
    +       192.168.12.0/29
    +       192.168.12.8/31
    +       [root@gateway root]#
    +
    +
    10. +
  10. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.
    +
    + Example:
    +
    +     foo    eth1:192.168.1.0/24,192.168.2.0/24
    11. + +
+ +

7/7/2003 - Shorewall-1.4.6 Beta 2

+ +

Problems Corrected:
+

+ +
    +
  1. A problem seen on RH7.3 systems where Shorewall encountered start + errors when started using the "service" mechanism has been worked around.
    +
    +
    2. +
  2. Where a list of IP addresses appears in the DEST column of a DNAT[-] + rule, Shorewall incorrectly created multiple DNAT rules in the nat table + (one for each element in the list). Shorewall now correctly creates a single + DNAT rule with multiple "--to-destination" clauses.
    +
    +
    3. +
  3. Corrected a problem in Beta 1 where DNS names containing a "-" +were mis-handled when they appeared in the DEST column of a rule.
    +
    4. + +
+

Migration Issues:

- +
    -
  1. In earlier versions, an undocumented feature allowed entries in the - host file as follows:
    +
  2. In earlier versions, an undocumented feature allowed entries in +the host file as follows:

        z    eth1:192.168.1.0/24,eth2:192.168.2.0/24

    @@ -109,90 +502,90 @@ allow entries of the following format:
        z   eth1:192.168.1.0/24,192.168.2.0/24

    3. -
  3. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed - from /etc/shorewall/shorewall.conf. These capabilities are now automatically +
  4. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been +removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically detected by Shorewall (see below).
    5. - +
- +

New Features:
-

- +

+
    -
  1. A 'newnotsyn' interface option has been added. This option may be -specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No +
  2. A 'newnotsyn' interface option has been added. This option may +be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No for packets arriving on the associated interface.
    -
    -
    3. -
  3. The means for specifying a range of IP addresses in /etc/shorewall/masq - to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address - ranges.
    -
    -
    4. -
  4. Shorewall can now add IP addresses to subnets other than the first - one on an interface.
    -
    -
    5. -
  5. DNAT[-] rules may now be used to load balance (round-robin) over -a set of servers. Servers may be specified in a range of addresses given -as <first address>-<last address>.
    -
    - Example:
    -
    -     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    -
    -
    6. -
  6. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options - have been removed and have been replaced by code that detects whether these - capabilities are present in the current kernel. The output of the start, - restart and check commands have been enhanced to report the outcome:
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    - Verifying Configuration...
    -
    -
    7. -
  7. Support for the Connection Tracking Match Extension has been added. - This extension is available in recent kernel/iptables releases and allows - for rules which match against elements in netfilter's connection tracking - table. Shorewall automatically detects the availability of this extension - and reports its availability in the output of the start, restart and check - commands.
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    -    Connection Tracking Match: Available
    - Verifying Configuration...
    -
    - If this extension is available, the ruleset generated by Shorewall is - changed in the following ways:
    8. - +
    + +
  8. The means for specifying a range of IP addresses in /etc/shorewall/masq + to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for +address ranges.
    +
    +
    9. +
  9. Shorewall can now add IP addresses to subnets other than the first + one on an interface.
    +
    +
    10. +
  10. DNAT[-] rules may now be used to load balance (round-robin) over + a set of servers. Servers may be specified in a range of addresses given + as <first address>-<last address>.
    +
    + Example:
    +
    +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    +
    +
    11. +
  11. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options + have been removed and have been replaced by code that detects whether +these capabilities are present in the current kernel. The output of the +start, restart and check commands have been enhanced to report the outcome:
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    + Verifying Configuration...
    +
    +
    12. +
  12. Support for the Connection Tracking Match Extension has been added. + This extension is available in recent kernel/iptables releases and allows + for rules which match against elements in netfilter's connection tracking + table. Shorewall automatically detects the availability of this extension + and reports its availability in the output of the start, restart and check + commands.
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    +    Connection Tracking Match: Available
    + Verifying Configuration...
    +
    + If this extension is available, the ruleset generated by Shorewall +is changed in the following ways:
    13. +
      -
    • To handle 'norfc1918' filtering, Shorewall will not create chains - in the mangle table but will rather do all 'norfc1918' filtering in the -filter table (rfc1918 chain).
      • -
    • Recall that Shorewall DNAT rules generate two netfilter rules; -one in the nat table and one in the filter table. If the Connection Tracking - Match Extension is available, the rule in the filter table is extended to - check that the original destination address was the same as specified (or - defaulted to) in the DNAT rule.
      -
      -
      • - +
    • To handle 'norfc1918' filtering, Shorewall will not create chains + in the mangle table but will rather do all 'norfc1918' filtering in the + filter table (rfc1918 chain).
      • +
    • Recall that Shorewall DNAT rules generate two netfilter rules; + one in the nat table and one in the filter table. If the Connection Tracking + Match Extension is available, the rule in the filter table is extended +to check that the original destination address was the same as specified +(or defaulted to) in the DNAT rule.
      +
      +
      • +
    -
  13. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) - may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    +
  14. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.

    -
    15. -
  15. An 'ipcalc' command has been added to /sbin/shorewall.
    +
    16. +
  16. An 'ipcalc' command has been added to /sbin/shorewall.

    -       ipcalc [ <address> <netmask> | <address>/<vlsm> - ]
    +       ipcalc [ <address> <netmask> | <address>/<vlsm> + ]

    Examples:

    @@ -218,7 +611,7 @@ one in the nat table and one in the filter table. If the Connection Tracking IP addresses.

    17. -
  17. An 'iprange' command has been added to /sbin/shorewall.
    +
  18. An 'iprange' command has been added to /sbin/shorewall.

          iprange <address>-<address>

    @@ -226,8 +619,8 @@ one in the nat table and one in the filter table. If the Connection Tracking and host addresses. The command can be useful if you need to construct an efficient set of rules that accept connections from a range of network addresses.

    - Note: If your shell only supports 32-bit signed arithmetic (ash or dash) - then the range may not span 128.0.0.0.
    + Note: If your shell only supports 32-bit signed arithmetic (ash or dash) + then the range may not span 128.0.0.0.

    Example:

    @@ -246,576 +639,394 @@ one in the nat table and one in the filter table. If the Connection Tracking       [root@gateway root]#

    19. -
  19. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.
    +
  20. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.

    Example:

    -     foo    eth1:192.168.1.0/24,192.168.2.0/24
    21. - +     foo    eth1:192.168.1.0/24,192.168.2.0/24
    +
    + +
- -

7/7/2003 - Shorewall-1.4.6 Beta 2

- -

Problems Corrected:
-

- -
    -
  1. A problem seen on RH7.3 systems where Shorewall encountered start - errors when started using the "service" mechanism has been worked around.
    -
    -
    2. -
  2. Where a list of IP addresses appears in the DEST column of a DNAT[-] - rule, Shorewall incorrectly created multiple DNAT rules in the nat table - (one for each element in the list). Shorewall now correctly creates a single - DNAT rule with multiple "--to-destination" clauses.
    -
    -
    3. -
  3. Corrected a problem in Beta 1 where DNS names containing a "-" were - mis-handled when they appeared in the DEST column of a rule.
    -
    4. - -
- -

Migration Issues:
-

- -
    -
  1. In earlier versions, an undocumented feature allowed entries in -the host file as follows:
    -
    -     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
    -
    - This capability was never documented and has been removed in 1.4.6 to -allow entries of the following format:
    -
    -     z   eth1:192.168.1.0/24,192.168.2.0/24
    -
    -
    2. -
  2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been -removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically - detected by Shorewall (see below).
    -
    3. - -
- -

New Features:
-

- -
    -
  1. A 'newnotsyn' interface option has been added. This option may be - specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No - for packets arriving on the associated interface.
    -
    -
    2. -
  2. The means for specifying a range of IP addresses in /etc/shorewall/masq - to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address - ranges.
    -
    -
    3. -
  3. Shorewall can now add IP addresses to subnets other than the first - one on an interface.
    -
    -
    4. -
  4. DNAT[-] rules may now be used to load balance (round-robin) over -a set of servers. Servers may be specified in a range of addresses given -as <first address>-<last address>.
    -
    - Example:
    -
    -     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    -
    -
    5. -
  5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options - have been removed and have been replaced by code that detects whether these - capabilities are present in the current kernel. The output of the start, - restart and check commands have been enhanced to report the outcome:
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    - Verifying Configuration...
    -
    -
    6. -
  6. Support for the Connection Tracking Match Extension has been added. - This extension is available in recent kernel/iptables releases and allows - for rules which match against elements in netfilter's connection tracking - table. Shorewall automatically detects the availability of this extension - and reports its availability in the output of the start, restart and check - commands.
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    -    Connection Tracking Match: Available
    - Verifying Configuration...
    -
    - If this extension is available, the ruleset generated by Shorewall is - changed in the following ways:
    7. - -
      -
    • To handle 'norfc1918' filtering, Shorewall will not create chains - in the mangle table but will rather do all 'norfc1918' filtering in the -filter table (rfc1918 chain).
      • -
    • Recall that Shorewall DNAT rules generate two netfilter rules; -one in the nat table and one in the filter table. If the Connection Tracking - Match Extension is available, the rule in the filter table is extended to - check that the original destination address was the same as specified (or - defaulted to) in the DNAT rule.
      -
      -
      • - -
    -
  7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) - may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    -
    -
    8. -
  8. An 'ipcalc' command has been added to /sbin/shorewall.
    -
    -       ipcalc [ <address> <netmask> | <address>/<vlsm> - ]
    -
    - Examples:
    -
    -       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
    -          CIDR=192.168.1.0/24
    -          NETMASK=255.255.255.0
    -          NETWORK=192.168.1.0
    -          BROADCAST=192.168.1.255
    -       [root@wookie root]#
    -
    -       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
    -          CIDR=192.168.1.0/24
    -          NETMASK=255.255.255.0
    -          NETWORK=192.168.1.0
    -          BROADCAST=192.168.1.255
    -       [root@wookie root]#
    -
    - Warning:
    -
    - If your shell only supports 32-bit signed arithmatic (ash or dash), then - the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1 - and for /1 networks. Bash should produce correct information for all valid - IP addresses.
    -
    -
    9. -
  9. An 'iprange' command has been added to /sbin/shorewall.
    -
    -       iprange <address>-<address>
    -
    - This command decomposes a range of IP addressses into a list of network - and host addresses. The command can be useful if you need to construct an - efficient set of rules that accept connections from a range of network addresses.
    -
    - Note: If your shell only supports 32-bit signed arithmetic (ash or dash) - then the range may not span 128.0.0.0.
    -
    - Example:
    -
    -       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
    -       192.168.1.4/30
    -       192.168.1.8/29
    -       192.168.1.16/28
    -       192.168.1.32/27
    -       192.168.1.64/26
    -       192.168.1.128/25
    -       192.168.2.0/23
    -       192.168.4.0/22
    -       192.168.8.0/22
    -       192.168.12.0/29
    -       192.168.12.8/31
    -       [root@gateway root]#
    -
    -
    10. -
  10. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.
    -
    - Example:
    -
    -     foo    eth1:192.168.1.0/24,192.168.2.0/24
    -
    -
    11. - -
- +

7/4/2003 - Shorewall-1.4.6 Beta 1

- -

Problems Corrected:
-

- -
    -
  1. A problem seen on RH7.3 systems where Shorewall encountered start - errors when started using the "service" mechanism has been worked around.
    -
    -
    2. -
  2. Where a list of IP addresses appears in the DEST column of a DNAT[-] - rule, Shorewall incorrectly created multiple DNAT rules in the nat table - (one for each element in the list). Shorewall now correctly creates a single - DNAT rule with multiple "--to-destination" clauses.
    -
    3. - -
- -

New Features:
-

- -
    -
  1. A 'newnotsyn' interface option has been added. This option may -be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No - for packets arriving on the associated interface.
    -
    -
    2. -
  2. The means for specifying a range of IP addresses in /etc/shorewall/masq - to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address - ranges.
    -
    -
    3. -
  3. Shorewall can now add IP addresses to subnets other than the first - one on an interface.
    -
    -
    4. -
  4. DNAT[-] rules may now be used to load balance (round-robin) over - a set of servers. Up to 256 servers may be specified in a range of addresses - given as <first address>-<last address>.
    -
    - Example:
    -
    -     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    -
    - Note that this capability has previously been available using a combination - of a DNAT- rule and one or more ACCEPT rules. That technique is still preferable - for load-balancing over a large number of servers (> 16) since specifying - a range in the DNAT rule causes one filter table ACCEPT rule to be generated - for each IP address in the range.
    -
    -
    5. -
  5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options - have been removed and have been replaced by code that detects whether these - capabilities are present in the current kernel. The output of the start, - restart and check commands have been enhanced to report the outcome:
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    - Verifying Configuration...
    -
    -
    6. -
  6. Support for the Connection Tracking Match Extension has been added. - This extension is available in recent kernel/iptables releases and allows - for rules which match against elements in netfilter's connection tracking - table. Shorewall automatically detects the availability of this extension - and reports its availability in the output of the start, restart and check - commands.
    -
    - Shorewall has detected the following iptables/netfilter capabilities:
    -    NAT: Available
    -    Packet Mangling: Available
    -    Multi-port Match: Available
    -    Connection Tracking Match: Available
    - Verifying Configuration...
    -
    - If this extension is available, the ruleset generated by Shorewall is - changed in the following ways:
    7. - -
      - -
    - -
      -
    • To handle 'norfc1918' filtering, Shorewall will not create chains - in the mangle table but will rather do all 'norfc1918' filtering in the -filter table (rfc1918 chain).
      • -
    • Recall that Shorewall DNAT rules generate two netfilter rules; - one in the nat table and one in the filter table. If the Connection Tracking - Match Extension is available, the rule in the filter table is extended to - check that the original destination address was the same as specified (or - defaulted to) in the DNAT rule.
      -
      -
      • - -
    -
  7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) - may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    -
    8. - -
- -

6/17/2003 - Shorewall-1.4.5

-

Problems Corrected:
+

Problems Corrected:

    -
  1. The command "shorewall debug try <directory>" now correctly - traces the attempt.
    2. -
  2. The INCLUDE directive now works properly in the zones file; previously, - INCLUDE in that file was ignored.
    3. -
  3. /etc/shorewall/routestopped records with an empty second column - are no longer ignored.
    +
  4. A problem seen on RH7.3 systems where Shorewall encountered start + errors when started using the "service" mechanism has been worked around.
    +
    +
    5. +
  5. Where a list of IP addresses appears in the DEST column of a +DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the +nat table (one for each element in the list). Shorewall now correctly creates +a single DNAT rule with multiple "--to-destination" clauses.
-

New Features:
+

New Features:

    -
  1. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may -now contain a list of addresses. If the list begins with "!' then the rule -will take effect only if the original destination address in the connection -request does not match any of the addresses listed.
    2. +
  2. A 'newnotsyn' interface option has been added. This option may + be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No + for packets arriving on the associated interface.
    +
    +
    3. +
  3. The means for specifying a range of IP addresses in /etc/shorewall/masq + to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for +address ranges.
    +
    +
    4. +
  4. Shorewall can now add IP addresses to subnets other than the +first one on an interface.
    +
    +
    5. +
  5. DNAT[-] rules may now be used to load balance (round-robin) over + a set of servers. Up to 256 servers may be specified in a range of addresses + given as <first address>-<last address>.
    +
    + Example:
    +
    +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
    +
    + Note that this capability has previously been available using a combination + of a DNAT- rule and one or more ACCEPT rules. That technique is still +preferable for load-balancing over a large number of servers (> 16) +since specifying a range in the DNAT rule causes one filter table ACCEPT +rule to be generated for each IP address in the range.
    +
    +
    6. +
  6. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options + have been removed and have been replaced by code that detects whether +these capabilities are present in the current kernel. The output of the +start, restart and check commands have been enhanced to report the outcome:
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    + Verifying Configuration...
    +
    +
    7. +
  7. Support for the Connection Tracking Match Extension has been +added. This extension is available in recent kernel/iptables releases +and allows for rules which match against elements in netfilter's connection +tracking table. Shorewall automatically detects the availability of this +extension and reports its availability in the output of the start, restart +and check commands.
    +
    + Shorewall has detected the following iptables/netfilter capabilities:
    +    NAT: Available
    +    Packet Mangling: Available
    +    Multi-port Match: Available
    +    Connection Tracking Match: Available
    + Verifying Configuration...
    +
    + If this extension is available, the ruleset generated by Shorewall +is changed in the following ways:
    8. + +
      + +
    + +
      +
    • To handle 'norfc1918' filtering, Shorewall will not create +chains in the mangle table but will rather do all 'norfc1918' filtering +in the filter table (rfc1918 chain).
      • +
    • Recall that Shorewall DNAT rules generate two netfilter rules; + one in the nat table and one in the filter table. If the Connection Tracking + Match Extension is available, the rule in the filter table is extended +to check that the original destination address was the same as specified +(or defaulted to) in the DNAT rule.
      +
      +
      • + +
    +
  8. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
    +
-

6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8

+

6/17/2003 - Shorewall-1.4.5

-

The firewall at shorewall.net has been upgraded to the 2.4.21 kernel and - iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems - have been encountered with this set of software. The Shorewall version -is 1.4.4b plus the accumulated changes for 1.4.5.
+

Problems Corrected:

-

6/8/2003 - Updated Samples

- -

Thanks to Francesca Smith, the samples have been updated to Shorewall -version 1.4.4.

- -

5/29/2003 - Shorewall-1.4.4b

- -

Groan -- This version corrects a problem whereby the --log-level was not - being set when logging via syslog. The most commonly reported symptom -was that Shorewall messages were being written to the console even though -console logging was correctly configured per FAQ 16.
-

- -

5/27/2003 - Shorewall-1.4.4a

- The Fireparse --log-prefix fiasco continues. Tuomo Soini has -pointed out that the code in 1.4.4 restricts the length of short zone -names to 4 characters. I've produced version 1.4.4a that restores the -previous 5-character limit by conditionally omitting the log rule number -when the LOGFORMAT doesn't contain '%d'.
- -

5/23/2003 - Shorewall-1.4.4

- I apologize for the rapid-fire releases but since there is a -potential configuration change required to go from 1.4.3a to 1.4.4, -I decided to make it a full release rather than just a bug-fix release. -
-
-     Problems corrected:
- -
None.
-
-     New Features:
-
    -
  1. A REDIRECT- rule target has been added. This target behaves - for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter - nat table REDIRECT rule is added but not the companion filter table -ACCEPT rule.
    -
    -
    2. -
  2. The LOGMARKER variable has been renamed LOGFORMAT and -has been changed to a 'printf' formatting template which accepts three -arguments (the chain name, logging rule number and the disposition). -To use LOGFORMAT with fireparse (http://www.fireparse.com), set it - as:
    -  
    -        LOGFORMAT="fp=%s:%d a=%s "
    -  
    - CAUTION: /sbin/shorewall uses the leading part of -the LOGFORMAT string (up to but not including the first '%') to find -log messages in the 'show log', 'status' and 'hits' commands. This part -should not be omitted (the LOGFORMAT should not begin with "%") and the -leading part should be sufficiently unique for /sbin/shorewall to identify -Shorewall messages.
    -
    -
    3. -
  3. When logging is specified on a DNAT[-] or REDIRECT[-] -rule, the logging now takes place in the nat table rather than in the -filter table. This way, only those connections that actually undergo -DNAT or redirection will be logged.
    -
    4. - -
- -

5/20/2003 - Shorewall-1.4.3a
-

- This version primarily corrects the documentation included -in the .tgz and in the .rpm. In addition:
- -
    -
  1. (This change is in 1.4.3 but is not documented) If you - are running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return - reject replies as follows:
    -    a) tcp - RST
    -    b) udp - ICMP port unreachable
    -    c) icmp - ICMP host unreachable
    -    d) Otherwise - ICMP host prohibited
    - If you are running earlier software, Shorewall will follow - it's traditional convention:
    -    a) tcp - RST
    -    b) Otherwise - ICMP port unreachable
    2. -
  2. UDP port 135 is now silently dropped in the common.def - chain. Remember that this chain is traversed just before a DROP or -REJECT policy is enforced.
    -
    3. - -
- -

5/18/2003 - Shorewall 1.4.3
-

-     Problems Corrected:
- -
    -
  1. There were several cases where Shorewall would fail -to remove a temporary directory from /tmp. These cases have been corrected.
    2. -
  2. The rules for allowing all traffic via the loopback -interface have been moved to before the rule that drops status=INVALID -packets. This insures that all loopback traffic is allowed even if Netfilter -connection tracking is confused.
    3. - -
-     New Features:
- -
    -
  1.  IPV6-IPV4 (6to4) tunnels are now supported in the -/etc/shorewall/tunnels file.
    2. -
  2. You may now change the leading portion of -the --log-prefix used by Shorewall using the LOGMARKER variable in -shorewall.conf. By default, "Shorewall:" is used.
    -
    3. - -
- -

5/10/2003 - Shorewall Mirror in Asia
-

- -

Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
-

- -

5/8/2003 - Shorewall Mirror in Chile

- Thanks to Darcy Ganga, there is now an HTTP mirror - in Santiago Chile. -

4/21/2003 - Samples updated for Shorewall version 1.4.2

- -

Thanks to Francesca Smith, the sample configurations are now upgraded to -Shorewall version 1.4.2.

- -

4/9/2003 - Shorewall 1.4.2
-

- -

    Problems Corrected:

- -
+
  • The command "shorewall debug try <directory>" now correctly + traces the attempt.
    • +
  • The INCLUDE directive now works properly in the zones file; +previously, INCLUDE in that file was ignored.
    • +
  • /etc/shorewall/routestopped records with an empty second column + are no longer ignored.
    +
    • + + +

    New Features:
    +

    + +
      +
    1. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may + now contain a list of addresses. If the list begins with "!' then the +rule will take effect only if the original destination address in the +connection request does not match any of the addresses listed.
      2. + +
    + +

    6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8

    + +

    The firewall at shorewall.net has been upgraded to the 2.4.21 kernel and + iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems + have been encountered with this set of software. The Shorewall version + is 1.4.4b plus the accumulated changes for 1.4.5.
    +

    + +

    6/8/2003 - Updated Samples

    + +

    Thanks to Francesca Smith, the samples have been updated to Shorewall version +1.4.4.

    + +

    5/29/2003 - Shorewall-1.4.4b

    + +

    Groan -- This version corrects a problem whereby the --log-level was not + being set when logging via syslog. The most commonly reported symptom + was that Shorewall messages were being written to the console even though + console logging was correctly configured per FAQ 16.
    +

    + +

    5/27/2003 - Shorewall-1.4.4a

    + The Fireparse --log-prefix fiasco continues. Tuomo Soini has +pointed out that the code in 1.4.4 restricts the length of short zone +names to 4 characters. I've produced version 1.4.4a that restores the +previous 5-character limit by conditionally omitting the log rule number +when the LOGFORMAT doesn't contain '%d'.
    + +

    5/23/2003 - Shorewall-1.4.4

    + I apologize for the rapid-fire releases but since there is +a potential configuration change required to go from 1.4.3a to 1.4.4, + I decided to make it a full release rather than just a bug-fix release. +
    +
    +     Problems corrected:
    + +
    None.
    +
    +     New Features:
    +     +
      +
    1. A REDIRECT- rule target has been added. This target behaves + for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter + nat table REDIRECT rule is added but not the companion filter table +ACCEPT rule.
      +
      +
      2. +
    2. The LOGMARKER variable has been renamed LOGFORMAT and +has been changed to a 'printf' formatting template which accepts three +arguments (the chain name, logging rule number and the disposition). +To use LOGFORMAT with fireparse (http://www.fireparse.com), set it + as:
      +  
      +        LOGFORMAT="fp=%s:%d a=%s "
      +  
      + CAUTION: /sbin/shorewall uses the leading part of + the LOGFORMAT string (up to but not including the first '%') to find + log messages in the 'show log', 'status' and 'hits' commands. This part + should not be omitted (the LOGFORMAT should not begin with "%") and +the leading part should be sufficiently unique for /sbin/shorewall to +identify Shorewall messages.
      +
      +
      3. +
    3. When logging is specified on a DNAT[-] or REDIRECT[-] +rule, the logging now takes place in the nat table rather than in the +filter table. This way, only those connections that actually undergo +DNAT or redirection will be logged.
      +
      4. + +
    + +

    5/20/2003 - Shorewall-1.4.3a
    +

    + This version primarily corrects the documentation included + in the .tgz and in the .rpm. In addition:
    + +
      +
    1. (This change is in 1.4.3 but is not documented) If +you are running iptables 1.2.7a and kernel 2.4.20, then Shorewall +will return reject replies as follows:
      +    a) tcp - RST
      +    b) udp - ICMP port unreachable
      +    c) icmp - ICMP host unreachable
      +    d) Otherwise - ICMP host prohibited
      + If you are running earlier software, Shorewall will follow + it's traditional convention:
      +    a) tcp - RST
      +    b) Otherwise - ICMP port unreachable
      2. +
    2. UDP port 135 is now silently dropped in the common.def + chain. Remember that this chain is traversed just before a DROP or + REJECT policy is enforced.
      +
      3. + +
    + +

    5/18/2003 - Shorewall 1.4.3
    +

    +     Problems Corrected:
    +     +
      +
    1. There were several cases where Shorewall would fail + to remove a temporary directory from /tmp. These cases have been corrected.
      2. +
    2. The rules for allowing all traffic via the loopback + interface have been moved to before the rule that drops status=INVALID + packets. This insures that all loopback traffic is allowed even if +Netfilter connection tracking is confused.
      3. + +
    +     New Features:
    +     +
      +
    1.  IPV6-IPV4 (6to4) tunnels are now supported in the +/etc/shorewall/tunnels file.
      2. +
    2. You may now change the leading portion of + the --log-prefix used by Shorewall using the LOGMARKER variable in + shorewall.conf. By default, "Shorewall:" is used.
      +
      3. + +
    + +

    5/10/2003 - Shorewall Mirror in Asia
    +

    + +

    Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
    +

    + +

    5/8/2003 - Shorewall Mirror in Chile

    + Thanks to Darcy Ganga, there is now an HTTP mirror + in Santiago Chile. +

    4/21/2003 - Samples updated for Shorewall version 1.4.2

    + +

    Thanks to Francesca Smith, the sample configurations are now upgraded +to Shorewall version 1.4.2.

    + +

    4/9/2003 - Shorewall 1.4.2
    +

    + +

        Problems Corrected:

    + +
    +
      -
    1. TCP connection requests rejected out of the - common chain are now properly rejected with TCP RST; -previously, some of these requests were rejected with an ICMP port-unreachable +
    2. TCP connection requests rejected out of the + common chain are now properly rejected with TCP RST; +previously, some of these requests were rejected with an ICMP port-unreachable response.
      3. -
    3. 'traceroute -I' from behind the firewall previously - timed out on the first hop (e.g., to the firewall). This has been +
    4. 'traceroute -I' from behind the firewall previously + timed out on the first hop (e.g., to the firewall). This has been worked around.
      5. - +
    -
    - +
    +

        New Features:

    - +
      -
    1. Where an entry in the/etc/shorewall/hosts file -specifies a particular host or network, Shorewall now creates an -intermediate chain for handling input from the related zone. This -can substantially reduce the number of rules traversed by connections -requests from such zones.
      -
      -
      2. -
    2. Any file may include an INCLUDE directive. An -INCLUDE directive consists of the word INCLUDE followed by a file -name and causes the contents of the named file to be logically included -into the file containing the INCLUDE. File names given in an INCLUDE -directive are assumed to reside in /etc/shorewall or in an alternate -configuration directory if one has been specified for the command. +
    3. Where an entry in the/etc/shorewall/hosts file + specifies a particular host or network, Shorewall now creates +an intermediate chain for handling input from the related zone. +This can substantially reduce the number of rules traversed by connections + requests from such zones.
      +
      +
      4. +
    4. Any file may include an INCLUDE directive. An +INCLUDE directive consists of the word INCLUDE followed by a file +name and causes the contents of the named file to be logically included +into the file containing the INCLUDE. File names given in an INCLUDE +directive are assumed to reside in /etc/shorewall or in an alternate +configuration directory if one has been specified for the command.
      -  
      -    Examples:
      -    shorewall/params.mgmt:
      -    MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3
      -    TIME_SERVERS=4.4.4.4
      -    BACKUP_SERVERS=5.5.5.5
      -    ----- end params.mgmt -----
      -  
      -  
      -    shorewall/params:
      -    # Shorewall 1.3 /etc/shorewall/params
      -    [..]
      -    #######################################
      -  
      -    INCLUDE params.mgmt   
      -  
      -    # params unique to this host here
      -    #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - +  
      +    Examples:
      +    shorewall/params.mgmt:
      +    MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3
      +    TIME_SERVERS=4.4.4.4
      +    BACKUP_SERVERS=5.5.5.5
      +    ----- end params.mgmt -----
      +  
      +  
      +    shorewall/params:
      +    # Shorewall 1.3 /etc/shorewall/params
      +    [..]
      +    #######################################
      +  
      +    INCLUDE params.mgmt   
      +  
      +    # params unique to this host here
      +    #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
      -    ----- end params -----
      -  
      -  
      -    shorewall/rules.mgmt:
      -    ACCEPT net:$MGMT_SERVERS          $FW    tcp    -22
      -    ACCEPT $FW          net:$TIME_SERVERS    udp    -123
      -    ACCEPT $FW          net:$BACKUP_SERVERS  tcp    -22
      -    ----- end rules.mgmt -----
      -  
      -    shorewall/rules:
      -    # Shorewall version 1.3 - Rules File
      -    [..]
      -    #######################################
      -  
      -    INCLUDE rules.mgmt    
      -  
      -    # rules unique to this host here
      -    #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE +    ----- end params -----
      +  
      +  
      +    shorewall/rules.mgmt:
      +    ACCEPT net:$MGMT_SERVERS          $FW    tcp    + 22
      +    ACCEPT $FW          net:$TIME_SERVERS    udp    + 123
      +    ACCEPT $FW          net:$BACKUP_SERVERS  tcp    + 22
      +    ----- end rules.mgmt -----
      +  
      +    shorewall/rules:
      +    # Shorewall version 1.3 - Rules File
      +    [..]
      +    #######################################
      +  
      +    INCLUDE rules.mgmt    
      +  
      +    # rules unique to this host here
      +    #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
      -    ----- end rules -----
      -  
      - INCLUDE's may be nested to a level of 3 -- further -nested INCLUDE directives are ignored with a warning message.
      -
      -
      5. -
    5. Routing traffic from an interface back out that - interface continues to be a problem. While I firmly believe that - this should never happen, people continue to want to do it. To limit - the damage that such nonsense produces, I have added a new 'routeback' - option in /etc/shorewall/interfaces and /etc/shorewall/hosts. When -used in /etc/shorewall/interfaces, the 'ZONE' column may not contain - '-'; in other words, 'routeback' can't be used as an option for a multi-zone - interface. The 'routeback' option CAN be specified however on individual +    ----- end rules -----
      +  
      + INCLUDE's may be nested to a level of 3 -- further + nested INCLUDE directives are ignored with a warning message.
      +
      +
      6. +
    6. Routing traffic from an interface back out that + interface continues to be a problem. While I firmly believe that + this should never happen, people continue to want to do it. To limit + the damage that such nonsense produces, I have added a new 'routeback' + option in /etc/shorewall/interfaces and /etc/shorewall/hosts. When +used in /etc/shorewall/interfaces, the 'ZONE' column may not contain + '-'; in other words, 'routeback' can't be used as an option for a multi-zone + interface. The 'routeback' option CAN be specified however on individual group entries in /etc/shorewall/hosts.
      -  
      - The 'routeback' option is similar to the old 'multi' - option with two exceptions:
      -  
      -    a) The option pertains to a particular zone,interface,address - tuple.
      -  
      -    b) The option only created infrastructure to pass - traffic from (zone,interface,address) tuples back to themselves -(the 'multi' option affected all (zone,interface,address) tuples -associated with the given 'interface').
      -  
      - See the 'Upgrade Issues' - for information about how this new option may affect your configuration.
      -
      7. - +  
      + The 'routeback' option is similar to the old 'multi' + option with two exceptions:
      +  
      +    a) The option pertains to a particular zone,interface,address + tuple.
      +  
      +    b) The option only created infrastructure to pass + traffic from (zone,interface,address) tuples back to themselves + (the 'multi' option affected all (zone,interface,address) tuples + associated with the given 'interface').
      +  
      + See the 'Upgrade Issues' + for information about how this new option may affect your configuration.
      + +
    - +

    3/24/2003 - Shorewall 1.4.1

    - + @@ -835,870 +1046,824 @@ associated with the given 'interface').
    - -

    This release follows up on 1.4.0. It corrects a problem introduced in -1.4.0 and removes additional warts.
    -
    - Problems Corrected:
    -

    - + +

    This release follows up on 1.4.0. It corrects a problem introduced in 1.4.0 +and removes additional warts.
    +
    + Problems Corrected:
    +

    +
      -
    1. When Shorewall 1.4.0 is run under the ash shell - (such as on Bering/LEAF), it can attempt to add ECN disabling rules - even if the /etc/shorewall/ecn file is empty. That problem has been - corrected so that ECN disabling rules are only added if there are -entries in /etc/shorewall/ecn.
      2. - +
    2. When Shorewall 1.4.0 is run under the ash shell + (such as on Bering/LEAF), it can attempt to add ECN disabling +rules even if the /etc/shorewall/ecn file is empty. That problem +has been corrected so that ECN disabling rules are only added if +there are entries in /etc/shorewall/ecn.
      3. +
    - New Features:
    - -
    Note: In the list that follows, the term group refers to -a particular network or subnetwork (which may be 0.0.0.0/0 or it may be a -host address) accessed through a particular interface. Examples:
    + New Features:
    + +
    Note: In the list that follows, the term group refers +to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be +a host address) accessed through a particular interface. Examples:
    - +
    eth0:0.0.0.0/0
    - eth2:192.168.1.0/24
    - eth3:192.0.2.123
    -
    - You can use the "shorewall check" command to see the - groups associated with each of your zones.
    -
    - + eth2:192.168.1.0/24
    + eth3:192.0.2.123
    +
    + You can use the "shorewall check" command to see +the groups associated with each of your zones.
    + +
      -
    1. Beginning with Shorewall 1.4.1, if a zone Z comprises - more than one group then if there is no explicit Z to Z policy - and there are no rules governing traffic from Z to Z then Shorewall - will permit all traffic between the groups in the zone.
      2. -
    2. Beginning with Shorewall 1.4.1, Shorewall will +
    3. Beginning with Shorewall 1.4.1, if a zone Z +comprises more than one group then if there is no explicit +Z to Z policy and there are no rules governing traffic from Z to +Z then Shorewall will permit all traffic between the groups in the +zone.
      4. +
    4. Beginning with Shorewall 1.4.1, Shorewall will never create rules to handle traffic from a group to itself.
      5. -
    5. A NONE policy is introduced in 1.4.1. When a +
    6. A NONE policy is introduced in 1.4.1. When a policy of NONE is specified from Z1 to Z2:
      7. - +
    - +
      -
    • There may be no rules created that govern connections - from Z1 to Z2.
      • -
    • Shorewall will not create any infrastructure +
    • There may be no rules created that govern connections + from Z1 to Z2.
      • +
    • Shorewall will not create any infrastructure to handle traffic from Z1 to Z2.
      • - +
    - See the upgrade issues - for a discussion of how these changes may affect your configuration. - + See the upgrade issues + for a discussion of how these changes may affect your configuration. +

    3/17/2003 - Shorewall 1.4.0

    - Shorewall - 1.4 represents the next step in the evolution of Shorewall. -The main thrust of the initial release is simply to remove the cruft - that has accumulated in Shorewall over time.
    -
    - IMPORTANT: Shorewall 1.4.0 requires the - iproute package ('ip' utility).
    -
    - Function from 1.3 that has been omitted from - this version include:
    - + +Shorewall 1.4 represents the next step in the evolution of +Shorewall. The main thrust of the initial release is simply to +remove the cruft that has accumulated in Shorewall over time.
    +
    + IMPORTANT: Shorewall 1.4.0 requires the + iproute package ('ip' utility).
    +
    + Function from 1.3 that has been omitted +from this version include:
    +
      -
    1. The MERGE_HOSTS variable in shorewall.conf - is no longer supported. Shorewall 1.4 behavior is the same as +
    2. The MERGE_HOSTS variable in shorewall.conf + is no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.
      -
      -
      3. -
    3. Interface names of the form <device>:<integer> - in /etc/shorewall/interfaces now generate an error.
      -
      -
      4. -
    4. Shorewall 1.4 implements behavior consistent - with OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate - an error at startup as will specification of the 'noping' or - 'filterping' interface options.
      -
      -
      5. -
    5. The 'routestopped' option in the /etc/shorewall/interfaces - and /etc/shorewall/hosts files is no longer supported and will - generate an error at startup if specified.
      -
      -
      6. -
    6. The Shorewall 1.2 syntax for DNAT and - REDIRECT rules is no longer accepted.
      -
      -
      7. -
    7. The ALLOWRELATED variable in shorewall.conf - is no longer supported. Shorewall 1.4 behavior is the same -as 1.3 with ALLOWRELATED=Yes.
      -
      -
      8. -
    8. The icmp.def file has been removed.
      -
      9. - -
    - Changes for 1.4 include:
    - -
      -
    1. The /etc/shorewall/shorewall.conf file - has been completely reorganized into logical sections.
      -
      -
      2. -
    2. LOG is now a valid action for a rule -(/etc/shorewall/rules).
      -
      -
      3. -
    3. The firewall script and version file -are now installed in /usr/share/shorewall.
      -
      -
      4. -
    4. Late arriving DNS replies are now silently - dropped in the common chain by default.
      -
      -
      5. -
    5. In addition to behaving like OLD_PING_HANDLING=No, - Shorewall 1.4 no longer unconditionally accepts outbound ICMP - packets. So if you want to 'ping' from the firewall, you will -need the appropriate rule or policy.
      -
      -
      6. -
    6. CONTINUE is now a valid action for a rule -(/etc/shorewall/rules).
      -
      -
      7. -
    7. 802.11b devices with names of the form wlan<n> - now support the 'maclist' option.
      -
      -
      8. -
    8. Explicit Congestion Notification (ECN - RFC - 3168) may now be turned off on a host or network basis using -the new /etc/shorewall/ecn file. To use this facility:
      -
      -    a) You must be running kernel 2.4.20
      -    b) You must have applied the patch in
      -    http://www.shorewall/net/pub/shorewall/ecn/patch.
      -    c) You must have iptables 1.2.7a installed.
      -
      -
      9. -
    9. The /etc/shorewall/params file is now processed - first so that variables may be used in the /etc/shorewall/shorewall.conf - file.
      -
      -
      10. -
    10. Shorewall now gives a more helpful - diagnostic when the 'ipchains' compatibility kernel module is loaded - and a 'shorewall start' command is issued.
      -
      -
      11. -
    11. The SHARED_DIR variable has been removed from - shorewall.conf. This variable was for use by package maintainers - and was not documented for general use.
      -
      -
      12. -
    12. Shorewall now ignores 'default' routes when -detecting masq'd networks.
      13. - -
    - -

    3/10/2003 - Shoreall 1.3.14a

    - -

    A roleup of the following bug fixes and other updates:

    - -
      -
    • There is an updated rfc1918 file that reflects - the resent allocation of 222.0.0.0/8 and 223.0.0.0/8.
      • - -
    - -
      -
    • The documentation for the routestopped file -claimed that a comma-separated list could appear in the second -column while the code only supported a single host or network address.
      • -
    • Log messages produced by 'logunclean' and 'dropunclean' - were not rate-limited.
      • -
    • 802.11b devices with names of the form wlan<n> - don't support the 'maclist' interface option.
      • -
    • Log messages generated by RFC 1918 filtering -are not rate limited.
      • -
    • The firewall fails to start in the case where - you have "eth0 eth1" in /etc/shorewall/masq and the default route - is through eth1
      • - -
    - -

    2/8/2003 - Shoreawall 1.3.14

    - -

    New features include

    - -
      -
    1. An OLD_PING_HANDLING option has -been added to shorewall.conf. When set to Yes, Shorewall -ping handling is as it has always been (see http://www.shorewall.net/ping.html).
      -
      - When OLD_PING_HANDLING=No, icmp echo - (ping) is handled via rules and policies just like any -other connection request. The FORWARDPING=Yes option in shorewall.conf - and the 'noping' and 'filterping' options in /etc/shorewall/interfaces - will all generate an error.
      -
      -
      2. -
    2. It is now possible to direct Shorewall - to create a "label" such as  "eth0:0" for IP addresses that - it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. - This is done by specifying the label instead of just the interface - name:
      -  
      -    a) In the INTERFACE column of -/etc/shorewall/masq
      -    b) In the INTERFACE column of -/etc/shorewall/nat
      -  
      3. -
    3. Support for OpenVPN Tunnels.
      -
      -
      4. -
    4. Support for VLAN devices with names - of the form $DEV.$VID (e.g., eth0.0)

      5. -
    5. In /etc/shorewall/tcrules, the MARK - value may be optionally followed by ":" and either 'F' or -'P' to designate that the marking will occur in the FORWARD -or PREROUTING chains respectively. If this additional specification - is omitted, the chain used to mark packets will be determined by -the setting of the MARK_IN_FORWARD_CHAIN option in Interface names of the form <device>:<integer> + in /etc/shorewall/interfaces now generate an error.
      +
      +
      6. +
    6. Shorewall 1.4 implements behavior consistent + with OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate + an error at startup as will specification of the 'noping' +or 'filterping' interface options.
      +
      +
      7. +
    7. The 'routestopped' option in the /etc/shorewall/interfaces + and /etc/shorewall/hosts files is no longer supported and +will generate an error at startup if specified.
      +
      +
      8. +
    8. The Shorewall 1.2 syntax for DNAT and + REDIRECT rules is no longer accepted.
      +
      +
      9. +
    9. The ALLOWRELATED variable in shorewall.conf + is no longer supported. Shorewall 1.4 behavior is the same as + 1.3 with ALLOWRELATED=Yes.
      +
      +
      10. +
    10. The icmp.def file has been removed.
      +
      11. + +
    + Changes for 1.4 include:
    + +
      +
    1. The /etc/shorewall/shorewall.conf file + has been completely reorganized into logical sections.
      +
      +
      2. +
    2. LOG is now a valid action for a rule + (/etc/shorewall/rules).
      +
      +
      3. +
    3. The firewall script and version file + are now installed in /usr/share/shorewall.
      +
      +
      4. +
    4. Late arriving DNS replies are now silently + dropped in the common chain by default.
      +
      +
      5. +
    5. In addition to behaving like OLD_PING_HANDLING=No, + Shorewall 1.4 no longer unconditionally accepts outbound +ICMP packets. So if you want to 'ping' from the firewall, you +will need the appropriate rule or policy.
      +
      +
      6. +
    6. CONTINUE is now a valid action for a rule +(/etc/shorewall/rules).
      +
      +
      7. +
    7. 802.11b devices with names of the form wlan<n> + now support the 'maclist' option.
      +
      +
      8. +
    8. Explicit Congestion Notification (ECN - RFC + 3168) may now be turned off on a host or network basis using the + new /etc/shorewall/ecn file. To use this facility:
      +
      +    a) You must be running kernel 2.4.20
      +    b) You must have applied the patch in
      +    http://www.shorewall/net/pub/shorewall/ecn/patch.
      +    c) You must have iptables 1.2.7a installed.
      +
      +
      9. +
    9. The /etc/shorewall/params file is now processed + first so that variables may be used in the /etc/shorewall/shorewall.conf + file.
      +
      +
      10. +
    10. Shorewall now gives a more helpful + diagnostic when the 'ipchains' compatibility kernel module is +loaded and a 'shorewall start' command is issued.
      +
      +
      11. +
    11. The SHARED_DIR variable has been removed from + shorewall.conf. This variable was for use by package maintainers + and was not documented for general use.
      +
      +
      12. +
    12. Shorewall now ignores 'default' routes when + detecting masq'd networks.
      13. + +
    + +

    3/10/2003 - Shoreall 1.3.14a

    + +

    A roleup of the following bug fixes and other updates:

    + +
      +
    • There is an updated rfc1918 file that reflects + the resent allocation of 222.0.0.0/8 and 223.0.0.0/8.
      • + +
    + +
      +
    • The documentation for the routestopped file +claimed that a comma-separated list could appear in the second +column while the code only supported a single host or network address.
      • +
    • Log messages produced by 'logunclean' and 'dropunclean' + were not rate-limited.
      • +
    • 802.11b devices with names of the form wlan<n> + don't support the 'maclist' interface option.
      • +
    • Log messages generated by RFC 1918 filtering + are not rate limited.
      • +
    • The firewall fails to start in the case where + you have "eth0 eth1" in /etc/shorewall/masq and the default route + is through eth1
      • + +
    + +

    2/8/2003 - Shoreawall 1.3.14

    + +

    New features include

    + +
      +
    1. An OLD_PING_HANDLING option has +been added to shorewall.conf. When set to Yes, Shorewall +ping handling is as it has always been (see http://www.shorewall.net/ping.html).
      +
      + When OLD_PING_HANDLING=No, icmp +echo (ping) is handled via rules and policies just like +any other connection request. The FORWARDPING=Yes option +in shorewall.conf and the 'noping' and 'filterping' options in + /etc/shorewall/interfaces will all generate an error.
      +
      +
      2. +
    2. It is now possible to direct Shorewall + to create a "label" such as  "eth0:0" for IP addresses +that it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. + This is done by specifying the label instead of just the interface + name:
      +  
      +    a) In the INTERFACE column of +/etc/shorewall/masq
      +    b) In the INTERFACE column of +/etc/shorewall/nat
      +  
      3. +
    3. Support for OpenVPN Tunnels.
      +
      +
      4. +
    4. Support for VLAN devices with names + of the form $DEV.$VID (e.g., eth0.0)
      +
      +
      5. +
    5. In /etc/shorewall/tcrules, the MARK + value may be optionally followed by ":" and either 'F' or 'P' + to designate that the marking will occur in the FORWARD or PREROUTING + chains respectively. If this additional specification is omitted, + the chain used to mark packets will be determined by the setting + of the MARK_IN_FORWARD_CHAIN option in shorewall.conf.
      -
      -
      6. -
    6. When an interface name is entered - in the SUBNET column of the /etc/shorewall/masq file, Shorewall - previously masqueraded traffic from only the first subnet -defined on that interface. It did not masquerade traffic from:
      -  
      -    a) The subnets associated with -other addresses on the interface.
      -    b) Subnets accessed through local +
      +
      7. +
    7. When an interface name is entered + in the SUBNET column of the /etc/shorewall/masq file, Shorewall + previously masqueraded traffic from only the first subnet + defined on that interface. It did not masquerade traffic from:
      +  
      +    a) The subnets associated with + other addresses on the interface.
      +    b) Subnets accessed through local routers.
      -  
      - Beginning with Shorewall 1.3.14, -if you enter an interface name in the SUBNET column, shorewall - will use the firewall's routing table to construct the masquerading/SNAT - rules.
      -  
      - Example 1 -- This is how it works -in 1.3.14.
      -   
      +  
      + Beginning with Shorewall 1.3.14, +if you enter an interface name in the SUBNET column, shorewall + will use the firewall's routing table to construct the masquerading/SNAT + rules.
      +  
      + Example 1 -- This is how it works + in 1.3.14.
      +   
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
      - + 
         [root@gateway test]# shorewall start
         ...
         Masqueraded Subnets and Hosts:
             To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
             To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
         Processing /etc/shorewall/tos...
      -  
      - When upgrading to Shorewall 1.3.14, - if you have multiple local subnets connected to an interface - that is specified in the SUBNET column of an /etc/shorewall/masq - entry, your /etc/shorewall/masq file will need changing. -In most cases, you will simply be able to remove redundant entries. - In some cases though, you might want to change from using the interface - name to listing specific subnetworks if the change described above - will cause masquerading to occur on subnetworks that you don't wish +  
      + When upgrading to Shorewall 1.3.14, + if you have multiple local subnets connected to an interface + that is specified in the SUBNET column of an /etc/shorewall/masq + entry, your /etc/shorewall/masq file will need changing. In + most cases, you will simply be able to remove redundant entries. + In some cases though, you might want to change from using the interface + name to listing specific subnetworks if the change described above + will cause masquerading to occur on subnetworks that you don't wish to masquerade.
      -  
      - Example 2 -- Suppose that your current +  
      + Example 2 -- Suppose that your current config is as follows:
      -   
      +   
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         eth0                    192.168.10.0/24         206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
         [root@gateway test]#
      -  
      -    In this case, the second entry -in /etc/shorewall/masq is no longer required.
      -  
      - Example 3 -- What if your current -configuration is like this?
      -  
      +  
      +    In this case, the second entry + in /etc/shorewall/masq is no longer required.
      +  
      + Example 3 -- What if your current + configuration is like this?
      +  
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
         [root@gateway test]#
      -  
      -    In this case, you would want to - change the entry in  /etc/shorewall/masq to:
      +  
      +    In this case, you would want +to change the entry in  /etc/shorewall/masq to:
      - + 
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    192.168.1.0/24          206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      -
      8. - -
    - -


    - 2/5/2003 - Shorewall Support included - in Webmin 1.060

    + -

    Webmin version 1.060 now has Shorewall support included as standard. See + + +


    + 2/5/2003 - Shorewall Support included + in Webmin 1.060

    + +

    Webmin version 1.060 now has Shorewall support included as standard. See http://www.webmin.com.
    -
    - 2/4/2003 - Shorewall 1.3.14-RC1

    - +
    + 2/4/2003 - Shorewall 1.3.14-RC1

    + +

    Includes the Beta 2 content plus support for OpenVPN tunnels.

    - + +

    1/28/2003 - Shorewall 1.3.14-Beta2

    - -

    Includes the Beta 1 content plus restores VLAN device names of the form - $dev.$vid (e.g., eth0.1)

    - - -

    1/25/2003 - Shorewall 1.3.14-Beta1
    -

    + +

    Includes the Beta 1 content plus restores VLAN device names of the form + $dev.$vid (e.g., eth0.1)

    -

    The Beta includes the following changes:
    +

    1/25/2003 - Shorewall 1.3.14-Beta1

    - + +

    The Beta includes the following changes:
    +

    + +
      -
    1. An OLD_PING_HANDLING option -has been added to shorewall.conf. When set to Yes, Shorewall - ping handling is as it has always been (see http://www.shorewall.net/ping.html).
      -
      - When OLD_PING_HANDLING=No, icmp echo - (ping) is handled via rules and policies just like any -other connection request. The FORWARDPING=Yes option in shorewall.conf - and the 'noping' and 'filterping' options in /etc/shorewall/interfaces - will all generate an error.
      -
      -
      2. -
    2. It is now possible to direct - Shorewall to create a "label" such as  "eth0:0" for IP -addresses that it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. - This is done by specifying the label instead of just the interface +
    3. An OLD_PING_HANDLING option + has been added to shorewall.conf. When set to Yes, Shorewall + ping handling is as it has always been (see http://www.shorewall.net/ping.html).
      +
      + When OLD_PING_HANDLING=No, icmp +echo (ping) is handled via rules and policies just like +any other connection request. The FORWARDPING=Yes option +in shorewall.conf and the 'noping' and 'filterping' options in + /etc/shorewall/interfaces will all generate an error.
      +
      +
      4. +
    4. It is now possible to direct + Shorewall to create a "label" such as  "eth0:0" for IP addresses + that it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. + This is done by specifying the label instead of just the interface name:
      -  
      -    a) In the INTERFACE column of +  
      +    a) In the INTERFACE column of /etc/shorewall/masq
      -    b) In the INTERFACE column of +    b) In the INTERFACE column of /etc/shorewall/nat
      -  
      5. -
    5. When an interface name is entered - in the SUBNET column of the /etc/shorewall/masq file, Shorewall - previously masqueraded traffic from only the first subnet - defined on that interface. It did not masquerade traffic from:
      -  
      -    a) The subnets associated with -other addresses on the interface.
      -    b) Subnets accessed through local +  
      6. +
    6. When an interface name is +entered in the SUBNET column of the /etc/shorewall/masq + file, Shorewall previously masqueraded traffic from only +the first subnet defined on that interface. It did not masquerade + traffic from:
      +  
      +    a) The subnets associated with + other addresses on the interface.
      +    b) Subnets accessed through local routers.
      -  
      - Beginning with Shorewall 1.3.14, -if you enter an interface name in the SUBNET column, shorewall - will use the firewall's routing table to construct the masquerading/SNAT - rules.
      -  
      - Example 1 -- This is how it works -in 1.3.14.
      -   
      +  
      + Beginning with Shorewall 1.3.14, +if you enter an interface name in the SUBNET column, shorewall + will use the firewall's routing table to construct the masquerading/SNAT + rules.
      +  
      + Example 1 -- This is how it works + in 1.3.14.
      +   
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
      - + 
         [root@gateway test]# shorewall start
         ...
         Masqueraded Subnets and Hosts:
             To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
             To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
         Processing /etc/shorewall/tos...
      -  
      - When upgrading to Shorewall 1.3.14, - if you have multiple local subnets connected to an interface - that is specified in the SUBNET column of an /etc/shorewall/masq - entry, your /etc/shorewall/masq file will need changing. -In most cases, you will simply be able to remove redundant entries. - In some cases though, you might want to change from using the interface - name to listing specific subnetworks if the change described above - will cause masquerading to occur on subnetworks that you don't wish +  
      + When upgrading to Shorewall 1.3.14, + if you have multiple local subnets connected to an interface + that is specified in the SUBNET column of an /etc/shorewall/masq + entry, your /etc/shorewall/masq file will need changing. In + most cases, you will simply be able to remove redundant entries. + In some cases though, you might want to change from using the interface + name to listing specific subnetworks if the change described above + will cause masquerading to occur on subnetworks that you don't wish to masquerade.
      -  
      - Example 2 -- Suppose that your current +  
      + Example 2 -- Suppose that your current config is as follows:
      -   
      +   
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         eth0                    192.168.10.0/24         206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
         [root@gateway test]#
      -  
      -    In this case, the second entry -in /etc/shorewall/masq is no longer required.
      -  
      - Example 3 -- What if your current -configuration is like this?
      -  
      +  
      +    In this case, the second entry + in /etc/shorewall/masq is no longer required.
      +  
      + Example 3 -- What if your current + configuration is like this?
      +  
      - + 
         [root@gateway test]# cat /etc/shorewall/masq
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    eth2                    206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      - + 
         [root@gateway test]# ip route show dev eth2
         192.168.1.0/24  scope link
         192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
         [root@gateway test]#
      -  
      -    In this case, you would want to - change the entry in  /etc/shorewall/masq to:
      +  
      +    In this case, you would want +to change the entry in  /etc/shorewall/masq to:
      - + 
         #INTERFACE              SUBNET                  ADDRESS
         eth0                    192.168.1.0/24          206.124.146.176
         #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
      -
      7. + - +
    - +

    1/18/2003 - Shorewall 1.3.13 Documentation in PDF Format

    - -

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation. + +

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation. the PDF may be downloaded from

    -     ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
    -     http://slovakia.shorewall.net/pub/shorewall/pdf/ - +     http://slovakia.shorewall.net/pub/shorewall/pdf/ +

    1/17/2003 - shorewall.net has MOVED 

    - +

    Thanks to the generosity of Alex Martin and Rett Consulting, www.shorewall.net and ftp.shorewall.net -are now hosted on a system in Bellevue, Washington. A big thanks to Alex -for making this happen.
    -

    + href="http://www.rettc.com">Rett Consulting, www.shorewall.net and +ftp.shorewall.net are now hosted on a system in Bellevue, Washington. A +big thanks to Alex for making this happen.
    +

    - +

    1/13/2003 - Shorewall 1.3.13
    -

    +

    - +

    Just includes a few things that I had on the burner:
    -

    +

    - +
      -
    1. A new 'DNAT-' action has - been added for entries in the /etc/shorewall/rules file. - DNAT- is intended for advanced users who wish to minimize the +
    2. A new 'DNAT-' action has + been added for entries in the /etc/shorewall/rules file. + DNAT- is intended for advanced users who wish to minimize the number of rules that connection requests must traverse.
      -
      - A Shorewall DNAT rule actually - generates two iptables rules: a header rewriting rule -in the 'nat' table and an ACCEPT rule in the 'filter' table. - A DNAT- rule only generates the first of these rules. This -is handy when you have several DNAT rules that would generate the +
      + A Shorewall DNAT rule actually + generates two iptables rules: a header rewriting rule +in the 'nat' table and an ACCEPT rule in the 'filter' table. + A DNAT- rule only generates the first of these rules. This +is handy when you have several DNAT rules that would generate the same ACCEPT rule.
      -
      -    Here are three rules from +
      +    Here are three rules from my previous rules file:
      -
      -         DNAT   net  dmz:206.124.146.177 - tcp smtp - 206.124.146.178
      -         DNAT   net  dmz:206.124.146.177 - tcp smtp - 206.124.146.179
      -         ACCEPT net  dmz:206.124.146.177 - tcp www,smtp,ftp,...
      -
      -    These three rules ended up -generating _three_ copies of
      -
      -          ACCEPT net  dmz:206.124.146.177 +
      +         DNAT   net  dmz:206.124.146.177 + tcp smtp - 206.124.146.178
      +         DNAT   net  dmz:206.124.146.177 + tcp smtp - 206.124.146.179
      +         ACCEPT net  dmz:206.124.146.177 + tcp www,smtp,ftp,...
      +
      +    These three rules ended up + generating _three_ copies of
      +
      +          ACCEPT net  dmz:206.124.146.177 tcp smtp
      -
      -    By writing the rules this +
      +    By writing the rules this way, I end up with only one copy of the ACCEPT rule.
      -
      -         DNAT-  net  dmz:206.124.146.177 - tcp smtp -  206.124.146.178
      -         DNAT-  net  dmz:206.124.146.177 - tcp smtp -  206.124.146.179
      -         ACCEPT net  dmz:206.124.146.177 - tcp www,smtp,ftp,....
      -
      -
      3. -
    3. The 'shorewall check' command - now prints out the applicable policy between each pair - of zones.
      -
      -
      4. -
    4. A new CLEAR_TC option has - been added to shorewall.conf. If this option is set to -'No' then Shorewall won't clear the current traffic control - rules during [re]start. This setting is intended for use by people - that prefer to configure traffic shaping when the network interfaces -come up rather than when the firewall is started. If that is what -you want to do, set TC_ENABLED=Yes and CLEAR_TC=No and do not supply - an /etc/shorewall/tcstart file. That way, your traffic shaping - rules can still use the 'fwmark' classifier based on packet marking - defined in /etc/shorewall/tcrules.
      -
      -
      5. -
    5. A new SHARED_DIR variable - has been added that allows distribution packagers to easily - move the shared directory (default /usr/lib/shorewall). Users - should never have a need to change the value of this shorewall.conf - setting.
      -
      6. +
      +         DNAT-  net  dmz:206.124.146.177 + tcp smtp -  206.124.146.178
      +         DNAT-  net  dmz:206.124.146.177 + tcp smtp -  206.124.146.179
      +         ACCEPT net  dmz:206.124.146.177 + tcp www,smtp,ftp,....
      +
      + +
    6. The 'shorewall check' +command now prints out the applicable policy between +each pair of zones.
      +
      +
      7. +
    7. A new CLEAR_TC option +has been added to shorewall.conf. If this option is set +to 'No' then Shorewall won't clear the current traffic control + rules during [re]start. This setting is intended for use by +people that prefer to configure traffic shaping when the network + interfaces come up rather than when the firewall is started. If +that is what you want to do, set TC_ENABLED=Yes and CLEAR_TC=No +and do not supply an /etc/shorewall/tcstart file. That way, your +traffic shaping rules can still use the 'fwmark' classifier based +on packet marking defined in /etc/shorewall/tcrules.
      +
      +
      8. +
    8. A new SHARED_DIR variable + has been added that allows distribution packagers to +easily move the shared directory (default /usr/lib/shorewall). + Users should never have a need to change the value of this +shorewall.conf setting.
      +
      9. - +
    - -

    1/6/2003 - BURNOUT -

    + +

    1/6/2003 - BURNOUT +

    - -

    Until further notice, I will not be involved in either Shorewall Development - or Shorewall Support

    + +

    Until further notice, I will not be involved in either Shorewall Development + or Shorewall Support

    - +

    -Tom Eastep
    -

    +

    - +

    12/30/2002 - Shorewall Documentation in PDF Format

    - -

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation. + +

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation. the PDF may be downloaded from

    - +

        ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
    -     http://slovakia.shorewall.net/pub/shorewall/pdf/
    -

    +

    - +

    12/27/2002 - Shorewall 1.3.12 Released

    - +

    Features include:
    -

    - - -
      -
    1. "shorewall refresh" -now reloads the traffic shaping rules (tcrules and -tcstart).
      2. -
    2. "shorewall debug [re]start" - now turns off debugging after an error occurs. This - places the point of the failure near the end of the trace - rather than up in the middle of it.
      3. -
    3. "shorewall [re]start" - has been speeded up by more than 40% with my configuration. - Your milage may vary.
      4. -
    4. A "shorewall show classifiers" - command has been added which shows the current packet - classification filters. The output from this command is - also added as a separate page in "shorewall monitor"
      5. -
    5. ULOG (must be all caps) - is now accepted as a valid syslog level and causes -the subject packets to be logged using the ULOG target rather - than the LOG target. This allows you to run ulogd (available - from http://www.gnumonks.org/projects/ulogd) - and log all Shorewall messages to a separate log file.
      6. -
    6. If you are running a -kernel that has a FORWARD chain in the mangle table -("shorewall show mangle" will show you the chains in the mangle - table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for - marking input packets based on their destination even when -you are using Masquerading or SNAT.
      7. -
    7. I have cluttered up -the /etc/shorewall directory with empty 'init', -'start', 'stop' and 'stopped' files. If you already have a - file with one of these names, don't worry -- the upgrade -process won't overwrite your file.
      8. -
    8. I have added a new RFC1918_LOG_LEVEL - variable to shorewall.conf. - This variable specifies the syslog level at which packets - are logged as a result of entries in the /etc/shorewall/rfc1918 - file. Previously, these packets were always logged at the -'info' level.
      -
      9. - - -
    - - -

    12/20/2002 - Shorewall 1.3.12 Beta 3
    -

    - This version corrects a problem - with Blacklist logging. In Beta 2, if BLACKLIST_LOG_LEVEL - was set to anything but ULOG, the firewall would fail to -start and "shorewall refresh" would also fail.
    +

    +
      +
    1. "shorewall refresh" +now reloads the traffic shaping rules (tcrules and +tcstart).
      2. +
    2. "shorewall debug [re]start" + now turns off debugging after an error occurs. This + places the point of the failure near the end of the trace + rather than up in the middle of it.
      3. +
    3. "shorewall [re]start" + has been speeded up by more than 40% with my configuration. + Your milage may vary.
      4. +
    4. A "shorewall show classifiers" + command has been added which shows the current packet + classification filters. The output from this command + is also added as a separate page in "shorewall monitor"
      5. +
    5. ULOG (must be all caps) + is now accepted as a valid syslog level and causes +the subject packets to be logged using the ULOG target rather + than the LOG target. This allows you to run ulogd (available + from http://www.gnumonks.org/projects/ulogd) + and log all Shorewall messages to a separate log file.
      6. +
    6. If you are running +a kernel that has a FORWARD chain in the mangle table + ("shorewall show mangle" will show you the chains in the + mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in + shorewall.conf. This allows +for marking input packets based on their destination even when + you are using Masquerading or SNAT.
      7. +
    7. I have cluttered up +the /etc/shorewall directory with empty 'init', 'start', + 'stop' and 'stopped' files. If you already have a file with + one of these names, don't worry -- the upgrade process won't + overwrite your file.
      8. +
    8. I have added a new +RFC1918_LOG_LEVEL variable to shorewall.conf. This variable + specifies the syslog level at which packets are logged +as a result of entries in the /etc/shorewall/rfc1918 file. + Previously, these packets were always logged at the 'info' + level.
      +
      9. + + +
    + + +

    12/20/2002 - Shorewall 1.3.12 Beta 3
    +

    + This version corrects a +problem with Blacklist logging. In Beta 2, if BLACKLIST_LOG_LEVEL + was set to anything but ULOG, the firewall would fail to + start and "shorewall refresh" would also fail.
    + +

    12/20/2002 - Shorewall 1.3.12 Beta 2

    - -

    The first public Beta version of Shorewall 1.3.12 is now available (Beta - 1 was made available only to a limited audience).
    -

    - Features include:
    + +

    The first public Beta version of Shorewall 1.3.12 is now available (Beta + 1 was made available only to a limited audience).
    +

    + Features include:
    - +
      -
    1. "shorewall refresh" - now reloads the traffic shaping rules (tcrules and - tcstart).
      2. -
    2. "shorewall debug - [re]start" now turns off debugging after an error - occurs. This places the point of the failure near the end -of the trace rather than up in the middle of it.
      3. -
    3. "shorewall [re]start" - has been speeded up by more than 40% with my configuration. - Your milage may vary.
      4. -
    4. A "shorewall show - classifiers" command has been added which shows the - current packet classification filters. The output from this - command is also added as a separate page in "shorewall monitor"
      5. -
    5. ULOG (must be all - caps) is now accepted as a valid syslog level and causes - the subject packets to be logged using the ULOG target rather - than the LOG target. This allows you to run ulogd (available -from http://www.gnumonks.org/projects/ulogd) +
    6. "shorewall refresh" + now reloads the traffic shaping rules (tcrules +and tcstart).
      7. +
    7. "shorewall debug + [re]start" now turns off debugging after an error + occurs. This places the point of the failure near the end of + the trace rather than up in the middle of it.
      8. +
    8. "shorewall [re]start" + has been speeded up by more than 40% with my configuration. + Your milage may vary.
      9. +
    9. A "shorewall show + classifiers" command has been added which shows +the current packet classification filters. The output from + this command is also added as a separate page in "shorewall + monitor"
      10. +
    10. ULOG (must be +all caps) is now accepted as a valid syslog level +and causes the subject packets to be logged using the ULOG target + rather than the LOG target. This allows you to run ulogd (available + from http://www.gnumonks.org/projects/ulogd) and log all Shorewall messages to a separate log file.
      11. -
    11. If you are running - a kernel that has a FORWARD chain in the mangle table - ("shorewall show mangle" will show you the chains in the - mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. - This allows for marking input packets based on their destination - even when you are using Masquerading or SNAT.
      12. -
    12. I have cluttered - up the /etc/shorewall directory with empty 'init', - 'start', 'stop' and 'stopped' files. If you already have a -file with one of these names, don't worry -- the upgrade process - won't overwrite your file.
      13. +
    13. If you are running + a kernel that has a FORWARD chain in the mangle table + ("shorewall show mangle" will show you the chains in the +mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. + This allows for marking input packets based on their destination + even when you are using Masquerading or SNAT.
      14. +
    14. I have cluttered + up the /etc/shorewall directory with empty 'init', + 'start', 'stop' and 'stopped' files. If you already have a file + with one of these names, don't worry -- the upgrade process + won't overwrite your file.
      15. - +
    - You may download the + You may download the Beta from:
    - +
    http://www.shorewall.net/pub/shorewall/Beta
    - ftp://ftp.shorewall.net/pub/shorewall/Beta
    -
    + - +

    12/12/2002 - Mandrake Multi Network Firewall Powered by Mandrake Linux -

    - Shorewall is at the +

    + Shorewall is at the center of MandrakeSoft's recently-announced Multi - Network Firewall (MNF) product. Here is the - press + href="http://www.mandrakestore.com/mdkinc/index.php?PAGE=tab_0/menu_0.php&id_art=250&LANG_=en#GOTO_250">Multi + Network Firewall (MNF) product. Here is the + press release.
    - +

    12/7/2002 - Shorewall Support for Mandrake 9.0

    - -

    Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered. - I have installed 9.0 on one of my systems and -I am now in a position to support Shorewall users who + +

    Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered. + I have installed 9.0 on one of my systems and +I am now in a position to support Shorewall users who run Mandrake 9.0.

    - +

    12/6/2002 - Debian 1.3.11a Packages Available
    -

    - - - -

    Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - - -

    12/3/2002 - Shorewall 1.3.11a

    - - -

    This is a bug-fix roll up which includes Roger Aich's fix for DNAT with - excluded subnets (e.g., "DNAT foo!bar ..."). -Current 1.3.11 users who don't need rules of this -type need not upgrade to 1.3.11.

    - - -

    11/24/2002 - Shorewall 1.3.11

    - - -

    In this version:

    - - -
      -
    • A 'tcpflags' - option has been added to entries in /etc/shorewall/interfaces. - This option causes Shorewall to make a set of sanity check on TCP - packet header flags.
      • -
    • It is now - allowed to use 'all' in the SOURCE or DEST column -in a rule. When used, - 'all' must appear by itself (in may not be qualified) and it does -not enable intra-zone traffic. For example, the rule
      -
      -     ACCEPT loc -all tcp 80
      -
      - does not enable - http traffic from 'loc' to 'loc'.
      • -
    • Shorewall's - use of the 'echo' command is now compatible with -bash clones such as ash and dash.
      • -
    • fw->fw - policies now generate a startup error. fw->fw -rules generate a warning and are ignored
      • - - -
    - - -

    11/14/2002 - Shorewall Documentation in PDF Format

    - - -

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation. - the PDF may be downloaded from

    - - -

        ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
    -     http://slovakia.shorewall.net/pub/shorewall/pdf/
    -

    - - -

    11/09/2002 - Shorewall is Back at SourceForge -

    - - - -

    The main Shorewall 1.3 web site is now back at SourceForge at http://shorewall.sf.net.
    -

    - - - -

    11/09/2002 - Shorewall 1.3.10

    - - -

    In this version:

    - - - - - -

    10/24/2002 - Shorewall is now in Gentoo Linux
    -

    - Alexandru -Hartmann reports that his Shorewall package is now - a part of the Gentoo Linux distribution. - Thanks Alex!
    - - -

    10/23/2002 - Shorewall 1.3.10 Beta 1

    - In this -version:
    +

    +

    Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

    + + +

    12/3/2002 - Shorewall 1.3.11a

    + + +

    This is a bug-fix roll up which includes Roger Aich's fix for DNAT with + excluded subnets (e.g., "DNAT foo!bar ..."). +Current 1.3.11 users who don't need rules of this +type need not upgrade to 1.3.11.

    + + +

    11/24/2002 - Shorewall 1.3.11

    + + +

    In this version:

    + + +
      +
    • A 'tcpflags' + option has been added to entries in /etc/shorewall/interfaces. + This option causes Shorewall to make a set of sanity check on TCP + packet header flags.
      • +
    • It is now + allowed to use 'all' in the SOURCE or DEST column in + a rule. When used, + 'all' must appear by itself (in may not be qualified) and it does +not enable intra-zone traffic. For example, the rule
      +
      +     ACCEPT loc + all tcp 80
      +
      + does not enable + http traffic from 'loc' to 'loc'.
      • +
    • Shorewall's + use of the 'echo' command is now compatible with bash + clones such as ash and dash.
      • +
    • fw->fw + policies now generate a startup error. fw->fw rules + generate a warning and are ignored
      • + + +
    + + +

    11/14/2002 - Shorewall Documentation in PDF Format

    + + +

    Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation. + the PDF may be downloaded from

    + + +

        ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
    +     http://slovakia.shorewall.net/pub/shorewall/pdf/
    +

    + + +

    11/09/2002 - Shorewall is Back at SourceForge +

    + + + +

    The main Shorewall 1.3 web site is now back at SourceForge at http://shorewall.sf.net.
    +

    + + + +

    11/09/2002 - Shorewall 1.3.10

    + + +

    In this version:

    + +
    • You may now define the contents - of a zone dynamically with the "shorewall add" and - "shorewall delete" commands. These commands are - expected to be used primarily within FreeS/Wan updown - scripts.
      • + of a zone dynamically with the "shorewall add" and + "shorewall delete" commands. These commands +are expected to be used primarily within + FreeS/Wan updown + scripts.
    • Shorewall can now do MAC verification - on ethernet segments. You can specify the set of - allowed MAC addresses on the segment and you can optionally - tie each MAC address to one or more IP addresses.
      • + on ethernet segments. You can specify the set of allowed MAC +addresses on the segment and you can optionally tie each MAC +address to one or more IP addresses.
    • PPTP Servers and Clients running on the firewall system may now be defined in the /etc/shorewall/tunnels @@ -1712,1210 +1877,1264 @@ PATH used by Shorewall may now be specified in /etc/shorewall/shorewall.conf.
    • The main firewall script is now /usr/lib/shorewall/firewall. - The script in /etc/init.d/shorewall is very small and -uses /sbin/shorewall to do the real work. This change -makes custom distributions such as for Debian and -for Gentoo easier to manage since it is /etc/init.d/shorewall - that tends to have distribution-dependent code.
      • + The script in /etc/init.d/shorewall is very small and +uses /sbin/shorewall to do the real work. This change +makes custom distributions such as for Debian and +for Gentoo easier to manage since it is /etc/init.d/shorewall + that tends to have distribution-dependent code
    - You may + + +

    10/24/2002 - Shorewall is now in Gentoo Linux
    +

    + Alexandru + Hartmann reports that his Shorewall package is now + a part of the Gentoo Linux +distribution. Thanks Alex!
    + + +

    10/23/2002 - Shorewall 1.3.10 Beta 1

    + In this + version:
    + + + + + You may download the Beta from:
    - + - +

    10/10/2002 -  Debian 1.3.9b Packages Available
    -

    +

    - +

    Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - -

    10/9/2002 - Shorewall 1.3.9b

    - This release - rolls up fixes to the installer and to the firewall - script.
    - -

    10/6/2002 - Shorewall.net now running on RH8.0
    -
    - The firewall - and server here at shorewall.net are now running - RedHat release 8.0.
    +

    10/9/2002 - Shorewall 1.3.9b

    + This release + rolls up fixes to the installer and to the firewall + script.
    -
    - 9/30/2002 - - Shorewall 1.3.9a

    - Roles + +

    10/6/2002 - Shorewall.net now running on RH8.0
    +
    + The firewall + and server here at shorewall.net are now running + RedHat release 8.0.
    + +
    + 9/30/2002 + - Shorewall 1.3.9a

    + Roles up the fix for broken tunnels.
    - +

    9/30/2002 - TUNNELS Broken in 1.3.9!!!

    - There + There is an updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall - -- copy that file to /usr/lib/shorewall/firewall.
    + target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall + -- copy that file to /usr/lib/shorewall/firewall.
    - +

    9/28/2002 - Shorewall 1.3.9

    - -

    In this version:
    -

    - +

    In this version:
    + +

    + +
      -
    • DNS Names - are now allowed in Shorewall config files (although I recommend against - using them).
      • +
    • DNS Names + are now allowed in Shorewall config files (although I recommend +against using them).
      • -
    • The connection SOURCE may now be qualified by - both interface and IP address in a The connection SOURCE may now be qualified +by both interface and IP address in a Shorewall rule.
      • -
    • Shorewall startup is now disabled after initial - installation until the file /etc/shorewall/startup_disabled - is removed. This avoids nasty surprises during -reboot for users who install Shorewall but don't configure -it.
      • -
    • The - 'functions' and 'version' files and the 'firewall' - symbolic link have been moved from /var/lib/shorewall - to /usr/lib/shorewall to appease the LFS police -at Debian.
      -
      • +
    • Shorewall startup is now disabled after initial + installation until the file /etc/shorewall/startup_disabled + is removed. This avoids nasty surprises during + reboot for users who install Shorewall but don't configure + it.
      • +
    • The + 'functions' and 'version' files and the 'firewall' + symbolic link have been moved from /var/lib/shorewall + to /usr/lib/shorewall to appease the LFS police at + Debian.
      +
      • + -
    - -

    9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
    -

    +

    9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored
    - Brown Paper Bag + + Brown Paper Bag - A couple of recent configuration changes at www.shorewall.net + A couple of recent configuration changes at www.shorewall.net broke the Search facility:
    - -

    + +
    - +
      -
    1. Mailing List Archive Search was not available.
      2. +
    2. Mailing List Archive Search was not available.
      3. -
    3. The Site Search index was incomplete
      4. +
    4. The Site Search index was incomplete
      5. -
    5. Only one page of matches was presented.
      6. +
    6. Only one page of matches was presented.
      7. - +
    -
    +
    - Hopefully these problems are now corrected. - -

    9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability - Restored
    - -

    - -A couple of recent configuration changes at www.shorewall.net - had the negative effect of breaking the Search - facility:
    - - -
      - -
    1. Mailing List Archive Search was not available.
      2. - -
    2. The Site Search index was incomplete
      3. - -
    3. Only one page of matches was presented.
      4. - - -
    - -Hopefully these problems are now corrected.
    - - -

    9/18/2002 -  Debian 1.3.8 Packages Available
    + Hopefully these problems are now corrected. + +

    9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability + Restored

    + A couple of recent configuration changes at www.shorewall.net + had the negative effect of breaking the Search + facility:
    + +
      + +
    1. Mailing List Archive Search was not available.
      2. + +
    2. The Site Search index was incomplete
      3. + +
    3. Only one page of matches was presented.
      4. + + + +
    + + Hopefully these problems are now corrected.
    + + + +

    9/18/2002 -  Debian 1.3.8 Packages Available
    + +

    + + +

    Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    9/16/2002 - Shorewall 1.3.8

    - +

    In this version:
    -

    +

    - +
      -
    • A NEWNOTSYN - option has been added to shorewall.conf. This option determines - whether Shorewall accepts TCP packets which -are not part of an established connection and that -are not 'SYN' packets (SYN flag on and ACK flag off).
      • +
    • A NEWNOTSYN + option has been added to shorewall.conf. This option determines + whether Shorewall accepts TCP packets + which are not part of an established connection and + that are not 'SYN' packets (SYN flag on and ACK flag off).
      • -
    • The need for the 'multi' option to communicate - between zones za and zb on the same interface - is removed in the case where the chain 'za2zb' and/or -'zb2za' exists. 'za2zb' will exist if:
      • +
    • The need for the 'multi' option to communicate + between zones za and zb on the same interface + is removed in the case where the chain 'za2zb' and/or + 'zb2za' exists. 'za2zb' will exist if:
      • + + + + + +
        + +
      • There is a policy for za to zb; or +
        • + +
      • There is at least one rule for za to + zb.
        • -
          - -
        • There is a policy for za to zb; or -
          • - -
        • There is at least one rule for za to -zb.
          • - - - - -
        - +
      - +
        -
      • The /etc/shorewall/blacklist file now contains - three columns. In addition to the SUBNET/ADDRESS - column, there are optional PROTOCOL and PORT columns to - block only certain applications from the blacklisted addresses.
        +
      • The /etc/shorewall/blacklist file now contains + three columns. In addition to the SUBNET/ADDRESS + column, there are optional PROTOCOL and PORT columns +to block only certain applications from the blacklisted + addresses.
        -
        • + - +
      - +

      9/11/2002 - Debian 1.3.7c Packages Available

      - +

      Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

      - +

      9/2/2002 - Shorewall 1.3.7c

      - -

      This is a role up of a fix for "DNAT" rules where the source zone is $FW + +

      This is a role up of a fix for "DNAT" rules where the source zone is $FW (fw).

      - +

      8/31/2002 - I'm not available

      - -

      I'm currently on vacation  -- please respect my need for a couple of -weeks free of Shorewall problem reports.

      + +

      I'm currently on vacation  -- please respect my need for a couple of + weeks free of Shorewall problem reports.

      - +

      -Tom

      - +

      8/26/2002 - Shorewall 1.3.7b

      - -

      This is a role up of the "shorewall refresh" bug fix and the change which - reverses the order of "dhcp" and -"norfc1918" checking.

      + +

      This is a role up of the "shorewall refresh" bug fix and the change which + reverses the order of "dhcp" and "norfc1918" + checking.

      - +

      8/26/2002 - French FTP Mirror is Operational

      - +

      ftp://france.shorewall.net/pub/mirrors/shorewall + href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall is now available.

      - +

      8/25/2002 - Shorewall Mirror in France

      - -

      Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored + +

      Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored at http://france.shorewall.net.

      - +

      8/25/2002 - Shorewall 1.3.7a Debian Packages Available

      - -

      Lorenzo Martignoni reports that the packages for version 1.3.7a are available + +

      Lorenzo Martignoni reports that the packages for version 1.3.7a are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

      - -

      8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author + +

      8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author -- Shorewall 1.3.7a released -

      +

      - -

      1.3.7a corrects problems occurring in rules file processing when starting + +

      1.3.7a corrects problems occurring in rules file processing when starting Shorewall 1.3.7.

      - +

      8/22/2002 - Shorewall 1.3.7 Released 8/13/2002

      - +

      Features in this release include:

      - +
        -
      • The 'icmp.def' file is now empty! The rules - in that file were required in ipchains firewalls - but are not required in Shorewall. Users who have - ALLOWRELATED=No in shorewall.conf - should see the Upgrade -Issues.
        • +
      • The 'icmp.def' file is now empty! The rules + in that file were required in ipchains firewalls + but are not required in Shorewall. Users who have + ALLOWRELATED=No in shorewall.conf + should see the Upgrade + Issues.
        • -
      • A 'FORWARDPING' option has been added to - shorewall.conf. - The effect of setting this variable to Yes is - the same as the effect of adding an ACCEPT rule - for ICMP echo-request in /etc/shorewall/icmpdef. - Users who have such a rule in icmpdef are - encouraged to switch to FORWARDPING=Yes.
        • +
      • A 'FORWARDPING' option has been added to + shorewall.conf. + The effect of setting this variable to Yes +is the same as the effect of adding an ACCEPT + rule for ICMP echo-request in /etc/shorewall/icmpdef. + Users who have such a rule in icmpdef are + encouraged to switch to FORWARDPING=Yes.
        • -
      • The loopback CLASS A Network (127.0.0.0/8) - has been added to the rfc1918 file.
        • +
      • The loopback CLASS A Network (127.0.0.0/8) + has been added to the rfc1918 file.
        • -
      • Shorewall now works with iptables 1.2.7
        • +
      • Shorewall now works with iptables 1.2.7
        • -
      • The documentation and web site no longer - uses FrontPage themes.
        • +
      • The documentation and web site no longer + uses FrontPage themes.
        • - +
      - -

      I would like to thank John Distler for his valuable input regarding TCP - SYN and ICMP treatment in Shorewall. - That input has led to marked improvement in + +

      I would like to thank John Distler for his valuable input regarding TCP + SYN and ICMP treatment in Shorewall. + That input has led to marked improvement in Shorewall in the last two releases.

      - +

      8/13/2002 - Documentation in the CVS Repository

      - -

      The Shorewall-docs project now contains just the HTML and image files -- the Frontpage files have been removed.

      + +

      The Shorewall-docs project now contains just the HTML and image files - +the Frontpage files have been removed.

      - +

      8/7/2002 - STABLE branch added to CVS Repository

      - -

      This branch will only be updated after I release a new version of Shorewall - so you can always update from this + +

      This branch will only be updated after I release a new version of Shorewall + so you can always update from this branch to get the latest stable tree.

      - -

      8/7/2002 - Upgrade Issues section -added to the Errata Page

      + +

      8/7/2002 - Upgrade Issues section added + to the Errata Page

      - -

      Now there is one place to go to look for issues involved with upgrading + +

      Now there is one place to go to look for issues involved with upgrading to recent versions of Shorewall.

      - +

      8/7/2002 - Shorewall 1.3.6

      - +

      This is primarily a bug-fix rollup with a couple of new features:

      - + - +

      7/30/2002 - Shorewall 1.3.5b Released

      - +

      This interim release:

      - + - +

      7/29/2002 - New Shorewall Setup Guide Available

      - +

      The first draft of this guide is available at http://www.shorewall.net/shorewall_setup_guide.htm. - The guide is intended for use by -people who are setting up Shorewall to manage -multiple public IP addresses and by people who want -to learn more about Shorewall than is described in the - single-address guides. Feedback on the new guide is -welcome.

      + href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm. + The guide is intended for use by people + who are setting up Shorewall to manage multiple + public IP addresses and by people who want to learn + more about Shorewall than is described in the single-address + guides. Feedback on the new guide is welcome.

      - +

      7/28/2002 - Shorewall 1.3.5 Debian Package Available

      - -

      Lorenzo Martignoni reports that the packages are version 1.3.5a and are + +

      Lorenzo Martignoni reports that the packages are version 1.3.5a and are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

      - +

      7/27/2002 - Shorewall 1.3.5a Released

      - +

      This interim release restores correct handling of REDIRECT rules.

      - +

      7/26/2002 - Shorewall 1.3.5 Released

      - -

      This will be the last Shorewall release for a while. I'm going to be -focusing on rewriting a lot of the documentation.

      + +

      This will be the last Shorewall release for a while. I'm going to be + focusing on rewriting a lot of the documentation.

      - +

       In this version:

      - +
        -
      • Empty and invalid source and destination - qualifiers are now detected in the rules file. - It is a good idea to use the 'shorewall check' command - before you issue a 'shorewall restart' command be be - sure that you don't have any configuration problems - that will prevent a successful restart.
        • +
      • Empty and invalid source and destination + qualifiers are now detected in the rules file. + It is a good idea to use the 'shorewall check' command + before you issue a 'shorewall restart' command be be + sure that you don't have any configuration problems + that will prevent a successful restart.
        • -
      • Added MERGE_HOSTS variable in - shorewall.conf -to provide saner behavior of the /etc/shorewall/hosts - file.
        • +
      • Added MERGE_HOSTS variable in + shorewall.conf + to provide saner behavior of the /etc/shorewall/hosts + file.
        • -
      • The time that the counters were last reset - is now displayed in the heading of the 'status' - and 'show' commands.
        • +
      • The time that the counters were last reset + is now displayed in the heading of the 'status' + and 'show' commands.
        • -
      • A proxyarp option has been -added for entries in /etc/shorewall/interfaces. - This option facilitates Proxy ARP sub-netting as described - in the Proxy ARP subnetting mini-HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/). - Specifying the proxyarp option -for an interface causes Shorewall to set - /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
        • +
      • A proxyarp option has been + added for entries in /etc/shorewall/interfaces. + This option facilitates Proxy ARP sub-netting as described + in the Proxy ARP subnetting mini-HOWTO (http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/). + Specifying the proxyarp option for + an interface causes Shorewall to set +/proc/sys/net/ipv4/conf/<interface>/proxy_arp.
        • -
      • The Samples have been updated to reflect - the new capabilities in this release.
        • - - - -
      +
    • The Samples have been updated to reflect + the new capabilities in this release.
      • +
    + + +

    7/16/2002 - New Mirror in Argentina

    - -

    Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in + +

    Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in Argentina. Thanks Buanzo!!!

    - +

    7/16/2002 - Shorewall 1.3.4 Released

    - +

    In this version:

    - +
      -
    • A new - /etc/shorewall/routestopped file -has been added. This file is intended to eventually - replace the routestopped option in the - /etc/shorewall/interface and /etc/shorewall/hosts - files. This new file makes remote firewall administration - easier by allowing any IP or subnet to be enabled - while Shorewall is stopped.
      • +
    • A new + /etc/shorewall/routestopped file +has been added. This file is intended to eventually +replace the routestopped option in the + /etc/shorewall/interface and /etc/shorewall/hosts + files. This new file makes remote firewall administration + easier by allowing any IP or subnet to be enabled + while Shorewall is stopped.
      • -
    • An /etc/shorewall/stopped extension script has been - added. This script is invoked after Shorewall - has stopped.
      • +
    • An /etc/shorewall/stopped extension script has been + added. This script is invoked after Shorewall + has stopped.
      • -
    • A DETECT_DNAT_ADDRS option -has been added to /etc/shoreall/shorewall.conf. - When this option is selected, DNAT rules only - apply when the destination address is the - external interface's primary IP address.
      • +
    • A DETECT_DNAT_ADDRS option + has been added to /etc/shoreall/shorewall.conf. + When this option is selected, DNAT rules +only apply when the destination address + is the external interface's primary IP address.
      • -
    • The QuickStart - Guide has been broken into three +
    • The QuickStart + Guide has been broken into three guides and has been almost entirely rewritten.
      • -
    • The Samples have been updated to reflect - the new capabilities in this release.
      • - - - -
    +
  • The Samples have been updated to reflect + the new capabilities in this release.
    • + + + +

    7/8/2002 - Shorewall 1.3.3 Debian Package Available

    - +

    Lorenzo Marignoni reports that the packages are available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    7/6/2002 - Shorewall 1.3.3 Released

    - +

    In this version:

    - +
      -
    • Entries in /etc/shorewall/interface that - use the wildcard character ("+") now have the "multi" +
    • Entries in /etc/shorewall/interface that + use the wildcard character ("+") now have the "multi" option assumed.
      • -
    • The 'rfc1918' chain in the mangle table - has been renamed 'man1918' to make log messages - generated from that chain distinguishable from those - generated by the 'rfc1918' chain in the filter table.
      • +
    • The 'rfc1918' chain in the mangle table + has been renamed 'man1918' to make log messages + generated from that chain distinguishable from those + generated by the 'rfc1918' chain in the filter table.
      • -
    • Interface names appearing in the hosts -file are now validated against the interfaces - file.
      • +
    • Interface names appearing in the hosts + file are now validated against the interfaces + file.
      • -
    • The TARGET column in the rfc1918 file is +
    • The TARGET column in the rfc1918 file is now checked for correctness.
      • -
    • The chain structure in the nat table has - been changed to reduce the number of rules that a - packet must traverse and to correct problems with - NAT_BEFORE_RULES=No
      • +
    • The chain structure in the nat table has + been changed to reduce the number of rules that + a packet must traverse and to correct problems with + NAT_BEFORE_RULES=No
      • -
    • The "hits" command has been enhanced.
      • - - - -
    +
  • The "hits" command has been enhanced.
    • + + + +

    6/25/2002 - Samples Updated for 1.3.2

    - -

    The comments in the sample configuration files have been updated to reflect - new features introduced in Shorewall + +

    The comments in the sample configuration files have been updated to reflect + new features introduced in Shorewall 1.3.2.

    - +

    6/25/2002 - Shorewall 1.3.1 Debian Package Available

    - +

    Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    6/19/2002 - Documentation Available in PDF Format

    - -

    Thanks to Mike Martinez, the Shorewall Documentation is now available -for download in Adobe PDF format.

    + +

    Thanks to Mike Martinez, the Shorewall Documentation is now available for + download in Adobe + PDF format.

    - +

    6/16/2002 - Shorewall 1.3.2 Released

    - +

    In this version:

    - + +
  • The files firewall, functions + and version have been moved + from /etc/shorewall to /var/lib/shorewall.
    • + + + +

    6/6/2002 - Why CVS Web access is Password Protected

    - -

    Last weekend, I installed the CVS Web package to provide brower-based -access to the Shorewall CVS repository. Since then, I have had several -instances where my server was almost unusable due to the high load generated -by website copying tools like HTTrack and WebStripper. These mindless tools:

    + +

    Last weekend, I installed the CVS Web package to provide brower-based access + to the Shorewall CVS repository. Since then, I have had several instances +where my server was almost unusable due to the high load generated by website +copying tools like HTTrack and WebStripper. These mindless tools:

    - +
      -
    • Ignore robot.txt files.
      • +
    • Ignore robot.txt files.
      • -
    • Recursively copy everything that they find.
      • +
    • Recursively copy everything that they find.
      • -
    • Should be classified as weapons rather than - tools.
      • - - - -
    +
  • Should be classified as weapons rather than + tools.
    • -

    These tools/weapons are particularly damaging when combined with CVS Web - because they doggedly follow every - link in the cgi-generated HTML resulting -in 1000s of executions of the cvsweb.cgi script. -Yesterday, I spend several hours implementing measures -to block these tools but unfortunately, these measures - resulted in my server OOM-ing under even moderate -load.

    + - -

    Until I have the time to understand the cause of the OOM (or until I buy - more RAM if that is what is required), - CVS Web access will remain Password Protected. + +

    These tools/weapons are particularly damaging when combined with CVS Web + because they doggedly follow every + link in the cgi-generated HTML resulting in + 1000s of executions of the cvsweb.cgi script. Yesterday, + I spend several hours implementing measures to block + these tools but unfortunately, these measures resulted + in my server OOM-ing under even moderate load.

    + + + +

    Until I have the time to understand the cause of the OOM (or until I buy + more RAM if that is what is required), + CVS Web access will remain Password Protected.

    - +

    6/5/2002 - Shorewall 1.3.1 Debian Package Available

    - +

    Lorenzo Marignoni reports that the package is available at http://security.dsi.unimi.it/~lorenzo/debian.html.

    - +

    6/2/2002 - Samples Corrected

    - -

    The 1.3.0 samples configurations had several serious problems that prevented - DNS and SSH from working properly. - These problems have been corrected in the + +

    The 1.3.0 samples configurations had several serious problems that prevented + DNS and SSH from working properly. + These problems have been corrected in the 1.3.1 samples.

    - +

    6/1/2002 - Shorewall 1.3.1 Released

    - +

    Hot on the heels of 1.3.0, this release:

    - +
      -
    • Corrects a serious problem with "all - <zone> CONTINUE" policies. This - problem is present in all versions of Shorewall that - support the CONTINUE policy. These previous versions - optimized away the "all2<zone>" -chain and replaced it with the "all2all" chain with the usual - result that a policy of REJECT was enforced rather than the -intended CONTINUE policy.
      • +
    • Corrects a serious problem with "all + <zone> CONTINUE" policies. This + problem is present in all versions of Shorewall that + support the CONTINUE policy. These previous versions + optimized away the "all2<zone>" chain +and replaced it with the "all2all" chain with the usual result +that a policy of REJECT was enforced rather than the intended + CONTINUE policy.
      • -
    • Adds an /etc/shorewall/rfc1918 +
    • Adds an /etc/shorewall/rfc1918 file for defining the exact behavior of the 'norfc1918' interface option.
      • - +
    - +

    5/29/2002 - Shorewall 1.3.0 Released

    - -

    In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 - includes:

    + +

    In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0 + includes:

    - +
      -
    • A 'filterping' interface option that allows - ICMP echo-request (ping) requests addressed - to the firewall to be handled by entries in /etc/shorewall/rules - and /etc/shorewall/policy.
      • - - - -
    +
  • A 'filterping' interface option that allows + ICMP echo-request (ping) requests addressed + to the firewall to be handled by entries in /etc/shorewall/rules + and /etc/shorewall/policy.
    • + + + +

    5/23/2002 - Shorewall 1.3 RC1 Available

    - -

    In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) - incorporates the following:

    + +

    In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92) + incorporates the following:

    - +
      -
    • Support for the /etc/shorewall/whitelist - file has been withdrawn. If you need whitelisting, - see these - instructions.
      • +
    • Support for the /etc/shorewall/whitelist + file has been withdrawn. If you need whitelisting, + see these + instructions.
      • - +
    - +

    5/19/2002 - Shorewall 1.3 Beta 2 Available

    - -

    In addition to the changes in Beta 1, this release which carries the -designation 1.2.91 adds:

    + +

    In addition to the changes in Beta 1, this release which carries the + designation 1.2.91 adds:

    - +
      -
    • The structure of the firewall is changed - markedly. There is now an INPUT and a FORWARD - chain for each interface; this reduces the number - of rules that a packet must traverse, especially in -complicated setups.
      • +
    • The structure of the firewall is changed + markedly. There is now an INPUT and a FORWARD + chain for each interface; this reduces the number + of rules that a packet must traverse, especially in + complicated setups.
      • -
    • Sub-zones may now - be excluded from DNAT and REDIRECT rules.
      • +
    • Sub-zones may now + be excluded from DNAT and REDIRECT rules.
      • -
    • The names of the columns in a number of -the configuration files have been changed to - be more consistent and self-explanatory and the documentation +
    • The names of the columns in a number of + the configuration files have been changed to + be more consistent and self-explanatory and the documentation has been updated accordingly.
      • -
    • The sample configurations have been updated +
    • The sample configurations have been updated for 1.3.
      • - +
    - +

    5/17/2002 - Shorewall 1.3 Beta 1 Available

    - -

    Beta 1 carries the version designation 1.2.90 and implements the following + +

    Beta 1 carries the version designation 1.2.90 and implements the following features:

    - +
      -
    • Simplified rule syntax which makes the intent - of each rule clearer and hopefully makes Shorewall - easier to learn.
      • +
    • Simplified rule syntax which makes the +intent of each rule clearer and hopefully makes + Shorewall easier to learn.
      • -
    • Upward compatibility with 1.2 configuration - files has been maintained so that current users - can migrate to the new syntax at their convenience.
      • +
    • Upward compatibility with 1.2 configuration + files has been maintained so that current users + can migrate to the new syntax at their convenience.
      • -
    • WARNING:  Compatibility - with the old parameterized sample configurations has NOT -been maintained. Users still running those configurations - should migrate to the new sample configurations - before upgrading to 1.3 Beta 1.
      • - - - -
    +
  • WARNING:  Compatibility + with the old parameterized sample configurations has NOT + been maintained. Users still running those configurations + should migrate to the new sample configurations + before upgrading to 1.3 Beta 1.
    • + + + +

    5/4/2002 - Shorewall 1.2.13 is Available

    - +

    In this version:

    - + +
  • The order in which port forwarding DNAT + and Static DNAT can + now be reversed so that port forwarding rules can + override the contents of +/etc/shorewall/nat.
    • + + + +

    4/30/2002 - Shorewall Debian News

    - -

    Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the -Debian - Testing Branch and the Debian - Unstable Branch.

    + +

    Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the Debian +Testing Branch and the Debian +Unstable Branch.

    - +

    4/20/2002 - Shorewall 1.2.12 is Available

    - +
      -
    • The 'try' command works again
      • +
    • The 'try' command works again
      • -
    • There is now a single RPM that also works +
    • There is now a single RPM that also works with SuSE.
      • - +
    - +

    4/17/2002 - Shorewall Debian News

    - +

    Lorenzo Marignoni reports that:

    - + +
  • Shorewall 1.2.11 is in the Debian + Unstable Branch
    • + + + +

    Thanks, Lorenzo!

    - +

    4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE

    - -

    Thanks to Stefan Mohr, there + +

    Thanks to Stefan Mohr, there is now a Shorewall 1.2.11 - SuSE RPM available.

    + href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm"> + SuSE RPM available.

    - +

    4/13/2002 - Shorewall 1.2.11 Available

    - +

    In this version:

    - +
      -
    • The 'try' command now accepts an optional - timeout. If the timeout is given in the command, - the standard configuration will automatically be - restarted after the new configuration has been running - for that length of time. This prevents a remote admin - from being locked out of the firewall in the case where +
    • The 'try' command now accepts an optional + timeout. If the timeout is given in the command, + the standard configuration will automatically be + restarted after the new configuration has been running + for that length of time. This prevents a remote admin + from being locked out of the firewall in the case where the new configuration starts but prevents access.
      • -
    • Kernel route filtering may now be enabled - globally using the new ROUTE_FILTER parameter - in /etc/shorewall/shorewall.conf.
      • +
    • Kernel route filtering may now be enabled + globally using the new ROUTE_FILTER parameter + in /etc/shorewall/shorewall.conf.
      • -
    • Individual IP source addresses and/or subnets - may now be excluded from masquerading/SNAT.
      • +
    • Individual IP source addresses and/or subnets + may now be excluded from masquerading/SNAT.
      • -
    • Simple "Yes/No" and "On/Off" values are -now case-insensitive in /etc/shorewall/shorewall.conf.
      • +
    • Simple "Yes/No" and "On/Off" values are + now case-insensitive in /etc/shorewall/shorewall.conf.
      • - +
    - +

    4/13/2002 - Hamburg Mirror now has FTP

    - +

    Stefan now has an FTP mirror at ftp://germany.shorewall.net/pub/shorewall.  + href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall.  Thanks Stefan!

    - +

    4/12/2002 - New Mirror in Hamburg

    - -

    Thanks to Stefan Mohr, there - is now a mirror of the Shorewall -website at http://germany.shorewall.net. + +

    Thanks to Stefan Mohr, there + is now a mirror of the Shorewall website + at http://germany.shorewall.net.

    - +

    4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available

    - -

    Version 1.1 of the QuickStart - Guide is now available. Thanks - to those who have read version 1.0 and offered - their suggestions. Corrections have also been made - to the sample scripts.

    + +

    Version 1.1 of the QuickStart + Guide is now available. Thanks + to those who have read version 1.0 and offered + their suggestions. Corrections have also been made + to the sample scripts.

    - +

    4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available

    - -

    Version 1.0 of the QuickStart - Guide is now available. This -Guide and its accompanying sample configurations - are expected to provide a replacement for the recently + +

    Version 1.0 of the QuickStart + Guide is now available. This Guide + and its accompanying sample configurations + are expected to provide a replacement for the recently withdrawn parameterized samples.

    - +

    4/8/2002 - Parameterized Samples Withdrawn

    - +

    Although the parameterized - samples have allowed people to - get a firewall up and running quickly, they - have unfortunately set the wrong level of expectation - among those who have used them. I am therefore - withdrawing support for the samples and I am recommending + href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized + samples have allowed people to + get a firewall up and running quickly, they + have unfortunately set the wrong level of expectation + among those who have used them. I am therefore + withdrawing support for the samples and I am recommending that they not be used in new Shorewall installations.

    - +

    4/2/2002 - Updated Log Parser

    - -

    John Lodge has provided an updated + +

    John Lodge has provided an updated version of his CGI-based log parser - with corrected date handling.

    + href="pub/shorewall/parsefw/">CGI-based log parser + with corrected date handling.

    - +

    3/30/2002 - Shorewall Website Search Improvements

    - -

    The quick search on the home page now excludes the mailing list archives. - The Extended - Search allows excluding the archives - or restricting the search to just the archives. An archive + +

    The quick search on the home page now excludes the mailing list archives. + The Extended + Search allows excluding the archives + or restricting the search to just the archives. An archive search form is also available on the mailing list information + href="http://lists.shorewall.net/mailing_list.htm">mailing list information page.

    - +

    3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)

    - + +
  • Shorewall 1.2.9 is now in the Debian + Unstable Distribution.
    • + + + +

    3/25/2002 - Log Parser Available

    - +

    John Lodge has provided a CGI-based log parser for Shorewall. Thanks + href="pub/shorewall/parsefw/">CGI-based log parser for Shorewall. Thanks John.

    - +

    3/20/2002 - Shorewall 1.2.10 Released

    - +

    In this version:

    - +
      -
    • A "shorewall try" command has been added - (syntax: shorewall try <configuration - directory>). This command attempts "shorewall - -c <configuration directory> start" - and if that results in the firewall being stopped due - to an error, a "shorewall start" command is executed. The - 'try' command allows you to create a new configuration and attempt - to start it; if there is an error that leaves your firewall - in the stopped state, it will automatically be restarted - using the default configuration (in /etc/shorewall).
      • +
    • A "shorewall try" command has been added + (syntax: shorewall try <configuration + directory>). This command attempts "shorewall + -c <configuration directory> start" + and if that results in the firewall being stopped due + to an error, a "shorewall start" command is executed. + The 'try' command allows you to create a new configuration and attempt + to start it; if there is an error that leaves your +firewall in the stopped state, it will automatically be restarted + using the default configuration (in /etc/shorewall).
      • -
    • A new variable ADD_SNAT_ALIASES has been - added to /etc/shorewall/shorewall.conf. - If this variable is set to "Yes", Shorewall - will automatically add IP addresses listed -in the third column of the - /etc/shorewall/masq file.
      • +
    • A new variable ADD_SNAT_ALIASES has been + added to /etc/shorewall/shorewall.conf. + If this variable is set to "Yes", Shorewall + will automatically add IP addresses listed + in the third column of the + /etc/shorewall/masq file.
      • -
    • Copyright notices have been added to the +
    • Copyright notices have been added to the documenation.
      • - +
    - +

    3/11/2002 - Shorewall 1.2.9 Released

    - +

    In this version:

    - + - +

    3/1/2002 - 1.2.8 Debian Package is Available

    - +

    See http://security.dsi.unimi.it/~lorenzo/debian.html

    - +

    2/25/2002 - New Two-interface Sample

    - -

    I've enhanced the two interface sample to allow access from the firewall - to servers in the local zone - - http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

    - - +

    I've enhanced the two interface sample to allow access from the firewall + to servers in the local zone - + http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz

    + + +

    2/23/2002 - Shorewall 1.2.8 Released

    - -

    Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects - problems associated with the lock file used to prevent multiple state-changing - operations from occuring simultaneously. - My apologies for any inconvenience my -carelessness may have caused.

    + +

    Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects + problems associated with the lock file used to prevent multiple state-changing + operations from occuring simultaneously. + My apologies for any inconvenience my carelessness + may have caused.

    - +

    2/22/2002 - Shorewall 1.2.7 Released

    - +

    In this version:

    - +
      -
    • UPnP probes (UDP destination port 1900) -are now silently dropped in the common - chain
      • +
    • UPnP probes (UDP destination port 1900) + are now silently dropped in the common + chain
      • -
    • RFC 1918 checking in the mangle table has - been streamlined to no longer require packet - marking. RFC 1918 checking in the filter table has - been changed to require half as many rules as previously.
      • +
    • RFC 1918 checking in the mangle table has + been streamlined to no longer require packet + marking. RFC 1918 checking in the filter table has + been changed to require half as many rules as previously.
      • -
    • A 'shorewall check' command has been added - that does a cursory validation of the zones, -interfaces, hosts, rules and policy files.
      • +
    • A 'shorewall check' command has been added + that does a cursory validation of the zones, interfaces, + hosts, rules and policy files.
      • - +
    - +

    2/18/2002 - 1.2.6 Debian Package is Available

    - +

    See http://security.dsi.unimi.it/~lorenzo/debian.html

    - +

    2/8/2002 - Shorewall 1.2.6 Released

    - +

    In this version:

    - +
      -
    • $-variables may now be used anywhere in -the configuration files except /etc/shorewall/zones.
      • +
    • $-variables may now be used anywhere in + the configuration files except /etc/shorewall/zones.
      • -
    • The interfaces and hosts files now have - their contents validated before any changes are -made to the existing Netfilter configuration. The appearance - of a zone name that isn't defined in /etc/shorewall/zones - causes "shorewall start" and "shorewall restart" - to abort without changing the Shorewall state. - Unknown options in either file cause a warning to be issued.
      • +
    • The interfaces and hosts files now have + their contents validated before any changes +are made to the existing Netfilter configuration. The +appearance of a zone name that isn't defined in /etc/shorewall/zones + causes "shorewall start" and "shorewall restart" + to abort without changing the Shorewall state. + Unknown options in either file cause a warning to be issued.
      • -
    • A problem occurring when BLACKLIST_LOGLEVEL - was not set has been corrected.
      • - - - -
    +
  • A problem occurring when BLACKLIST_LOGLEVEL + was not set has been corrected.
    • + + + +

    2/4/2002 - Shorewall 1.2.5 Debian Package Available

    - +

    see http://security.dsi.unimi.it/~lorenzo/debian.html

    - +

    2/1/2002 - Shorewall 1.2.5 Released

    - -

    Due to installation problems with Shorewall 1.2.4, I have released Shorewall - 1.2.5. Sorry for the rapid-fire development.

    + +

    Due to installation problems with Shorewall 1.2.4, I have released Shorewall + 1.2.5. Sorry for the rapid-fire development.

    - +

    In version 1.2.5:

    - +
      -
    • The installation problems have been corrected.
      • +
    • The installation problems have been corrected.
      • -
    • SNAT is now supported.
      • +
    • SNAT is now supported.
      • -
    • A "shorewall version" command has been added
      • +
    • A "shorewall version" command has been added
      • -
    • The default value of the STATEDIR variable - in /etc/shorewall/shorewall.conf has been changed - to /var/lib/shorewall in order to conform to the - GNU/Linux File Hierarchy Standard, Version 2.2.
      • - - - -
    +
  • The default value of the STATEDIR variable + in /etc/shorewall/shorewall.conf has been changed + to /var/lib/shorewall in order to conform to the + GNU/Linux File Hierarchy Standard, Version 2.2.
    • -

    1/28/2002 - Shorewall 1.2.4 Released

    - - - -
      - -
    • The "fw" zone may - now be given a different name.
      • - -
    • You may now place end-of-line comments (preceded - by '#') in any of the configuration files
      • - -
    • There is now protection against against -two state changing operations occuring concurrently. - This is implemented using the 'lockfile' utility - if it is available (lockfile is part of procmail); - otherwise, a less robust technique is used. The lockfile - is created in the STATEDIR defined in /etc/shorewall/shorewall.conf - and has the name "lock".
      • - -
    • "shorewall start" no longer fails if "detect" - is specified in /etc/shorewall/interfaces - for an interface with subnet mask 255.255.255.255.
      • - - -
    - + +

    1/28/2002 - Shorewall 1.2.4 Released

    + + + +
      + +
    • The "fw" zone may + now be given a different name.
      • + +
    • You may now place end-of-line comments +(preceded by '#') in any of the configuration + files
      • + +
    • There is now protection against against + two state changing operations occuring concurrently. + This is implemented using the 'lockfile' utility + if it is available (lockfile is part of procmail); + otherwise, a less robust technique is used. The lockfile + is created in the STATEDIR defined in /etc/shorewall/shorewall.conf + and has the name "lock".
      • + +
    • "shorewall start" no longer fails if "detect" + is specified in /etc/shorewall/interfaces + for an interface with subnet mask 255.255.255.255.
      • + + + +
    + + +

    1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html

    - +

    1/20/2002 - Corrected firewall script available 

    - -

    Corrects a problem with BLACKLIST_LOGLEVEL. See the - errata for details.

    + +

    Corrects a problem with BLACKLIST_LOGLEVEL. See the + errata for details.

    - +

    1/19/2002 - Shorewall 1.2.3 Released

    - +

    This is a minor feature and bugfix release. The single new feature is:

    - +
      -
    • Support for TCP MSS Clamp to PMTU -- This - support is usually required when the internet - connection is via PPPoE or PPTP and may be enabled - using the CLAMPMSS - option in /etc/shorewall/shorewall.conf.
      • +
    • Support for TCP MSS Clamp to PMTU -- This + support is usually required when the internet + connection is via PPPoE or PPTP and may be enabled + using the CLAMPMSS + option in /etc/shorewall/shorewall.conf.
      • - +
    - +

    The following problems were corrected:

    - +
      -
    • The "shorewall status" command no longer - hangs.
      • +
    • The "shorewall status" command no longer + hangs.
      • -
    • The "shorewall monitor" command now displays - the icmpdef chain
      • +
    • The "shorewall monitor" command now displays + the icmpdef chain
      • -
    • The CLIENT PORT(S) column in tcrules is no - longer ignored
      • +
    • The CLIENT PORT(S) column in tcrules is +no longer ignored
      • - +
    - +

    1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release

    - -

    Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution - that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo - for details.

    + +

    Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution + that includes Shorewall 1.2.2. See +http://leaf.sourceforge.net/devel/jnilo + for details.

    - +

    1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 - Shorewall Debian package is now available. - There is a link to Lorenzo's site from the + href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni, a 1.2.2 + Shorewall Debian package is now available. + There is a link to Lorenzo's site from the Shorewall download page.

    - +

    1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores + href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version restores the "shorewall status" command to health.

    - +

    1/8/2002 - Shorewall 1.2.2 Released

    - +

    In version 1.2.2

    - +
      -
    • Support for IP blacklisting has been added - +
    • Support for IP blacklisting has been added - + +
        -
      • You specify whether you want packets - from blacklisted hosts dropped or rejected - using the BLACKLIST_DISPOSITION +
      • You specify whether you want packets + from blacklisted hosts dropped or rejected + using the BLACKLIST_DISPOSITION setting in /etc/shorewall/shorewall.conf
        • -
      • You specify whether you want packets - from blacklisted hosts logged and at what -syslog level using the BLACKLIST_LOGLEVEL - setting in /etc/shorewall/shorewall.conf
        • +
      • You specify whether you want packets + from blacklisted hosts logged and at what + syslog level using the BLACKLIST_LOGLEVEL + setting in /etc/shorewall/shorewall.conf
        • -
      • You list the IP addresses/subnets that +
      • You list the IP addresses/subnets that you wish to blacklist in /etc/shorewall/blacklist
        • -
      • You specify the interfaces you want -checked against the blacklist using the - new "blacklist" - option in /etc/shorewall/interfaces.
        • +
      • You specify the interfaces you want + checked against the blacklist using the + new "blacklist" + option in /etc/shorewall/interfaces.
        • -
      • The black list is refreshed from /etc/shorewall/blacklist +
      • The black list is refreshed from /etc/shorewall/blacklist by the "shorewall refresh" command.
        • @@ -3239,877 +3459,869 @@ checked against the blacklist using the - +
      -
      • + -
    • Use of TCP RST replies has been expanded  +
    • Use of TCP RST replies has been expanded  - +
        -
      • TCP connection requests rejected because - of a REJECT policy are now replied with a TCP - RST packet.
        • +
      • TCP connection requests rejected because + of a REJECT policy are now replied with a + TCP RST packet.
        • -
      • TCP connection requests rejected because - of a protocol=all rule in /etc/shorewall/rules - are now replied with a TCP RST packet.
        • +
      • TCP connection requests rejected because + of a protocol=all rule in /etc/shorewall/rules + are now replied with a TCP RST packet.
        • - +
      -
      • + -
    • A LOGFILE - specification has been added to /etc/shorewall/shorewall.conf. - LOGFILE is used to tell the /sbin/shorewall program +
    • A LOGFILE + specification has been added to /etc/shorewall/shorewall.conf. + LOGFILE is used to tell the /sbin/shorewall program where to look for Shorewall messages.
      • - +
    - +

    1/5/2002 - New Parameterized Samples (version 1.2.0) released. These are minor updates - to the previously-released samples. + target="_blank">version 1.2.0) released. These are minor updates + to the previously-released samples. There are two new rules added:

    - +
      -
    • Unless you have explicitly enabled Auth connections - (tcp port 113) to your firewall, these connections - will be REJECTED rather than DROPPED. This speeds - up connection establishment to some servers.
      • +
    • Unless you have explicitly enabled Auth +connections (tcp port 113) to your firewall, these + connections will be REJECTED rather than DROPPED. + This speeds up connection establishment to some servers.
      • -
    • Orphan DNS replies are now silently dropped.
      • - - - -
    - - - -

    See the README file for upgrade instructions.

    +
  • Orphan DNS replies are now silently dropped.
    • + + + + +

    See the README file for upgrade instructions.

    + + +

    1/1/2002 - Shorewall Mailing List Moving

    - -

    The Shorewall mailing list hosted at - Sourceforge is moving to Shorewall.net. - If you are a current subscriber to the list + +

    The Shorewall mailing list hosted at + Sourceforge is moving to Shorewall.net. + If you are a current subscriber to the list at Sourceforge, please see these instructions. - If you would like to subscribe to the + href="shorewall_mailing_list_migration.htm">see these instructions. + If you would like to subscribe to the new list, visit http://www.shorewall.net/mailman/listinfo/shorewall-users.

    - +

    12/31/2001 - Shorewall 1.2.1 Released

    - +

    In version 1.2.1:

    - + +
  • 'shorewall show tc' now correctly handles + tunnels.
    • -

    12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist -releasing 1.2 on 12/21/2001

    - - - -

    Version 1.2 contains the following new features:

    - - - - - -

    For the next month or so, I will continue to provide corrections to version - 1.1.18 as necessary so that current - version 1.1.x users will not be forced into -a quick upgrade to 1.2.0 just to have access to bug fixes.

    - - - -

    For those of you who have installed one of the Beta RPMS, you will need - to use the "--oldpackage" option when - upgrading to 1.2.0:

    - - - -
    - - - -

    rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

    - -
    - - - -

    12/19/2001 - Thanks to Steve - Cowles, there is now a Shorewall - mirror in Texas. This web site is mirrored - at http://www.infohiiway.com/shorewall - and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

    - - - -

    11/30/2001 - A new set of the parameterized Sample - Configurations has been released. In this version:

    - - - -
      - -
    • Ping is now allowed between the zones.
      • - -
    • In the three-interface configuration, it - is now possible to configure the internet services - that are to be available to servers in the DMZ. 
      • - - - -
    - - - -

    11/20/2001 - The current version of Shorewall is 1.1.18. 

    - - - -

    In this version:

    - - - -
      - -
    • The spelling of ADD_IP_ALIASES has been corrected - in the shorewall.conf file
      • - -
    • The logic for deleting user-defined chains - has been simplified so that it avoids a bug in the - LRP version of the 'cut' utility.
      • - -
    • The /var/lib/lrpkg/shorwall.conf file has - been corrected to properly display the NAT entry - in that file.
      • - - - -
    - - - -

    11/19/2001 - Thanks to Juraj - Ontkanin, there is now a Shorewall - mirror in the Slovak Republic. The website - is now mirrored at http://www.nrg.sk/mirror/shorewall - and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

    - - - -

    11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. - There are three sample configurations:

    - - - -
      - -
    • One Interface -- for a standalone system.
      • - -
    • Two Interfaces -- A masquerading firewall.
      • - -
    • Three Interfaces -- A masquerading firewall - with DMZ.
      • - - - -
    + +

    12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist releasing +1.2 on 12/21/2001

    +

    Version 1.2 contains the following new features:

    + + + + + + + +

    For the next month or so, I will continue to provide corrections to version + 1.1.18 as necessary so that current + version 1.1.x users will not be forced into + a quick upgrade to 1.2.0 just to have access to bug +fixes.

    + + + +

    For those of you who have installed one of the Beta RPMS, you will need + to use the "--oldpackage" option when + upgrading to 1.2.0:

    + + + +
    + + + +

    rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm

    + +
    + + + +

    12/19/2001 - Thanks to Steve + Cowles, there is now a Shorewall + mirror in Texas. This web site is mirrored + at http://www.infohiiway.com/shorewall + and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall. 

    + + + +

    11/30/2001 - A new set of the parameterized Sample +Configurations has been released. In this version:

    + + + +
      + +
    • Ping is now allowed between the zones.
      • + +
    • In the three-interface configuration, it + is now possible to configure the internet services + that are to be available to servers in the DMZ. 
      • + + + +
    + + + +

    11/20/2001 - The current version of Shorewall is 1.1.18. 

    + + + +

    In this version:

    + + + +
      + +
    • The spelling of ADD_IP_ALIASES has been +corrected in the shorewall.conf file
      • + +
    • The logic for deleting user-defined chains + has been simplified so that it avoids a bug in + the LRP version of the 'cut' utility.
      • + +
    • The /var/lib/lrpkg/shorwall.conf file has + been corrected to properly display the NAT + entry in that file.
      • + + + +
    + + + +

    11/19/2001 - Thanks to Juraj + Ontkanin, there is now a +Shorewall mirror in the Slovak Republic. + The website is now mirrored at http://www.nrg.sk/mirror/shorewall + and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.

    + + + +

    11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. + There are three sample configurations:

    + + + +
      + +
    • One Interface -- for a standalone system.
      • + +
    • Two Interfaces -- A masquerading firewall.
      • + +
    • Three Interfaces -- A masquerading firewall + with DMZ.
      • + + + +
    + + +

    Samples may be downloaded from ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 - . See the README file for instructions.

    + href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 + . See the README file for instructions.

    - -

    11/1/2001 - The current version of Shorewall is 1.1.17.  I intend - this to be the last of the 1.1 - Shorewall releases.

    + +

    11/1/2001 - The current version of Shorewall is 1.1.17.  I intend + this to be the last of the +1.1 Shorewall releases.

    - +

    In this version:

    - + - -

    10/22/2001 - The current version of Shorewall is 1.1.16. In this - version:

    + +

    10/22/2001 - The current version of Shorewall is 1.1.16. In this + version:

    - +
      -
    • A new "shorewall show connections" command +
    • A new "shorewall show connections" command has been added.
      • -
    • In the "shorewall monitor" output, the currently - tracked connections are now shown on a separate +
    • In the "shorewall monitor" output, the currently + tracked connections are now shown on a separate page.
      • -
    • Prior to this release, Shorewall unconditionally - added the external IP adddress(es) specified -in /etc/shorewall/nat. Beginning with version - 1.1.16, a new parameter (ADD_IP_ALIASES) - may be set to "no" (or "No") to inhibit - this behavior. This allows IP aliases created -using your distribution's network configuration - tools to be used in static NAT. 
      • +
    • Prior to this release, Shorewall unconditionally + added the external IP adddress(es) specified + in /etc/shorewall/nat. Beginning with version + 1.1.16, a new parameter (ADD_IP_ALIASES) + may be set to "no" (or "No") to inhibit + this behavior. This allows IP aliases created +using your distribution's network configuration + tools to be used in static NAT. 
      • - +
    - -

    10/15/2001 - The current version of Shorewall is 1.1.15. In this - version:

    + +

    10/15/2001 - The current version of Shorewall is 1.1.15. In this + version:

    + + + +
      + +
    • Support for nested zones has been improved. + See the documentation + for details
      • + +
    • Shorewall now correctly checks the alternate + configuration directory for the 'zones' file.
      • + + + +
    + + + +

    10/4/2001 - The current version of Shorewall is 1.1.14. In this + version

      -
    • Support for nested zones has been improved. - See the documentation - for details
      • +
    • Shorewall now supports alternate configuration + directories. When an alternate directory is + specified when starting or restarting Shorewall + (e.g., "shorewall -c /etc/testconf restart"), Shorewall + will first look for configuration files in the alternate + directory then in /etc/shorewall. To create an +alternate configuration simply:
      -
    • Shorewall now correctly checks the alternate - configuration directory for the 'zones' file.
      • + 1. Create a New Directory
      + 2. Copy to that directory any of your configuration + files that you want to change.
      - -
    + 3. Modify the copied files as needed.
    + 4. Restart Shorewall specifying the new directory. - -

    10/4/2001 - The current version of Shorewall is 1.1.14. In this - version

    - - - -
      - -
    • Shorewall now supports alternate configuration - directories. When an alternate directory -is specified when starting or restarting Shorewall - (e.g., "shorewall -c /etc/testconf restart"), Shorewall - will first look for configuration files in the alternate - directory then in /etc/shorewall. To create an alternate - configuration simply:
      - - 1. Create a New Directory
      - - 2. Copy to that directory any of your configuration - files that you want to change.
      - - 3. Modify the copied files as needed.
      - - 4. Restart Shorewall specifying the new directory.
      • - -
    • The rules for allowing/disallowing icmp -echo-requests (pings) are now moved after rules - created when processing the rules file. This allows - you to add rules that selectively allow/deny ping based +
    • The rules for allowing/disallowing icmp + echo-requests (pings) are now moved after rules + created when processing the rules file. This allows + you to add rules that selectively allow/deny ping based on source or destination address.
      • -
    • Rules that specify multiple client ip addresses +
    • Rules that specify multiple client ip addresses or subnets no longer cause startup failures.
      • -
    • Zone names in the policy file are now validated +
    • Zone names in the policy file are now validated against the zones file.
      • -
    • If you have packet mangling - support enabled, the "norfc1918" -interface option now logs and drops any incoming packets on -the interface that have an RFC 1918 destination address.
      • +
    • If you have packet mangling + support enabled, the "norfc1918" interface +option now logs and drops any incoming packets on the interface + that have an RFC 1918 destination address.
      • - +
    - -

    9/12/2001 - The current version of Shorewall is 1.1.13. In this + +

    9/12/2001 - The current version of Shorewall is 1.1.13. In this version

    - +
      -
    • Shell variables can now be used to parameterize - Shorewall rules.
      • +
    • Shell variables can now be used to parameterize + Shorewall rules.
      • -
    • The second column in the hosts file may now - contain a comma-separated list.
      +
    • The second column in the hosts file may +now contain a comma-separated list.
      -
      +
      - Example:
      + Example:
      -     sea    eth0:130.252.100.0/24,206.191.149.0/24
      • +     sea    eth0:130.252.100.0/24,206.191.149.0/24 -
    • Handling of multi-zone interfaces has been - improved. See the documentation for the /etc/shorewall/interfaces - file.
      • +
    • Handling of multi-zone interfaces has been + improved. See the documentation for the /etc/shorewall/interfaces + file.
      • - +
    - -

    8/28/2001 - The current version of Shorewall is 1.1.12. In this + +

    8/28/2001 - The current version of Shorewall is 1.1.12. In this version

    - +
      -
    • Several columns in the rules file may now - contain comma-separated lists.
      • +
    • Several columns in the rules file may now + contain comma-separated lists.
      • -
    • Shorewall is now more rigorous in parsing - the options in /etc/shorewall/interfaces.
      • +
    • Shorewall is now more rigorous in parsing + the options in /etc/shorewall/interfaces.
      • -
    • Complementation using "!" is now supported +
    • Complementation using "!" is now supported in rules.
      • - +
    - -

    7/28/2001 - The current version of Shorewall is 1.1.11. In this + +

    7/28/2001 - The current version of Shorewall is 1.1.11. In this version

    - +
      -
    • A "shorewall refresh" command has been added - to allow for refreshing the rules associated - with the broadcast address on a dynamic interface. - This command should be used in place of "shorewall - restart" when the internet interface's IP address changes.
      • +
    • A "shorewall refresh" command has been added + to allow for refreshing the rules associated + with the broadcast address on a dynamic interface. + This command should be used in place of "shorewall + restart" when the internet interface's IP address changes.
      • -
    • The /etc/shorewall/start file (if any) is - now processed after all temporary rules have -been deleted. This change prevents the accidental - removal of rules added during the processing of that - file.
      • +
    • The /etc/shorewall/start file (if any) is + now processed after all temporary rules have + been deleted. This change prevents the accidental + removal of rules added during the processing of that + file.
      • -
    • The "dhcp" interface option is now applicable - to firewall interfaces used by a DHCP server -running on the firewall.
      • +
    • The "dhcp" interface option is now applicable + to firewall interfaces used by a DHCP server + running on the firewall.
      • -
    • The RPM can now be built from the .tgz file - using "rpm -tb" 
      • +
    • The RPM can now be built from the .tgz file + using "rpm -tb" 
      • - +
    - -

    7/6/2001 - The current version of Shorewall is 1.1.10. In this -version

    + +

    7/6/2001 - The current version of Shorewall is 1.1.10. In this version

    - +
      -
    • Shorewall now enables Ipv4 Packet Forwarding - by default. Packet forwarding may be disabled - by specifying IP_FORWARD=Off in /etc/shorewall/shorewall.conf. - If you don't want Shorewall to enable or - disable packet forwarding, add IP_FORWARDING=Keep - to your /etc/shorewall/shorewall.conf file.
      • +
    • Shorewall now enables Ipv4 Packet Forwarding + by default. Packet forwarding may be disabled + by specifying IP_FORWARD=Off in /etc/shorewall/shorewall.conf. + If you don't want Shorewall to enable or + disable packet forwarding, add IP_FORWARDING=Keep +to your /etc/shorewall/shorewall.conf file.
      • -
    • The "shorewall hits" command no longer lists +
    • The "shorewall hits" command no longer lists extraneous service names in its last report.
      • -
    • Erroneous instructions in the comments at - the head of the firewall script have been corrected.
      • +
    • Erroneous instructions in the comments at + the head of the firewall script have been corrected.
      • - +
    - -

    6/23/2001 - The current version of Shorewall is 1.1.9. In this -version

    + +

    6/23/2001 - The current version of Shorewall is 1.1.9. In this version

    - +
      -
    • The "tunnels" file really is in - the RPM now.
      • +
    • The "tunnels" file really is in + the RPM now.
      • -
    • SNAT can now be applied to port-forwarded - connections.
      • +
    • SNAT can now be applied to port-forwarded + connections.
      • -
    • A bug which would cause firewall start failures - in some dhcp configurations has been fixed.
      • +
    • A bug which would cause firewall start +failures in some dhcp configurations has been fixed.
      • -
    • The firewall script now issues a message - if you have the name of an interface in the second - column in an entry in /etc/shorewall/masq and that +
    • The firewall script now issues a message + if you have the name of an interface in the second + column in an entry in /etc/shorewall/masq and that interface is not up.
      • -
    • You can now configure Shorewall so that -it doesn't require the NAT +
    • You can now configure Shorewall so that + it doesn't require the NAT and/or mangle netfilter modules.
      • -
    • Thanks to Alex  Polishchuk, the "hits" command +
    • Thanks to Alex  Polishchuk, the "hits" command from seawall is now in shorewall.
      • -
    • Support for IPIP tunnels +
    • Support for IPIP tunnels has been added.
      • - +
    - -

    6/18/2001 - The current version of Shorewall is 1.1.8. In this -version

    + +

    6/18/2001 - The current version of Shorewall is 1.1.8. In this version

    - + - +

    6/2/2001 - The current version of Shorewall is 1.1.7. In this version

    - +
      -
    • The TOS rules are now deleted when the firewall - is stopped.
      • +
    • The TOS rules are now deleted when the +firewall is stopped.
      • -
    • The .rpm will now install regardless of which - version of iptables is installed.
      • +
    • The .rpm will now install regardless of +which version of iptables is installed.
      • -
    • The .rpm will now install without iproute2 +
    • The .rpm will now install without iproute2 being installed.
      • -
    • The documentation has been cleaned up.
      • +
    • The documentation has been cleaned up.
      • -
    • The sample configuration files included -in Shorewall have been formatted to 80 columns - for ease of editing on a VGA console.
      • +
    • The sample configuration files included + in Shorewall have been formatted to 80 columns + for ease of editing on a VGA console.
      • - +
    - -

    5/25/2001 - The current version of Shorewall is 1.1.6. In this -version

    + +

    5/25/2001 - The current version of Shorewall is 1.1.6. In this version

    - +
      -
    • You may now rate-limit +
    • You may now rate-limit the packet log.
      • -
    • Previous versions of Shorewall have - an implementation of Static NAT which violates the - principle of least surprise.  NAT only occurs for -packets arriving at (DNAT) or send from (SNAT) the -interface named in the INTERFACE column of /etc/shorewall/nat. -Beginning with version 1.1.6, NAT effective regardless - of which interface packets come from or are destined to. -To get compatibility with prior versions, I have added -a new "ALL "ALL INTERFACES"  - column to /etc/shorewall/nat. By placing "no" or - "No" in the new column, the NAT behavior of prior -versions may be retained. 
      • +
    • Previous versions of Shorewall have + an implementation of Static NAT which violates the + principle of least surprise.  NAT only occurs for packets + arriving at (DNAT) or send from (SNAT) the interface + named in the INTERFACE column of /etc/shorewall/nat. + Beginning with version 1.1.6, NAT effective regardless + of which interface packets come from or are destined to. + To get compatibility with prior versions, I have added + a new "ALL "ALL INTERFACES"  + column to /etc/shorewall/nat. By placing "no" +or "No" in the new column, the NAT behavior of prior + versions may be retained. 
      • -
    • The treatment of IPSEC Tunnels where the remote - gateway is a standalone system has been improved. Previously, - it was necessary to include an additional rule allowing - UDP port 500 traffic to pass through the tunnel. Shorewall - will now create this rule automatically when you place the -name of the remote peer's zone in a new GATEWAY ZONE column in -/etc/shorewall/tunnels. 
      • +
    • The treatment of IPSEC Tunnels where the remote + gateway is a standalone system has been improved. Previously, + it was necessary to include an additional rule allowing + UDP port 500 traffic to pass through the tunnel. Shorewall + will now create this rule automatically when you place +the name of the remote peer's zone in a new GATEWAY ZONE column +in /etc/shorewall/tunnels. 
      • - +
    - -

    5/20/2001 - The current version of Shorewall is 1.1.5. In this -version

    + +

    5/20/2001 - The current version of Shorewall is 1.1.5. In this version

    - + - -

    5/10/2001 - The current version of Shorewall is 1.1.4. In this -version

    + +

    5/10/2001 - The current version of Shorewall is 1.1.4. In this version

    - +
      -
    • Accepting RELATED +
    • Accepting RELATED connections is now optional.
      • -
    • Corrected problem where if "shorewall start" - aborted early (due to kernel configuration errors - for example), superfluous 'sed' error messages +
    • Corrected problem where if "shorewall start" + aborted early (due to kernel configuration errors + for example), superfluous 'sed' error messages were reported.
      • -
    • Corrected rules generated for port redirection.
      • +
    • Corrected rules generated for port redirection.
      • -
    • The order in which iptables kernel modules - are loaded has been corrected (Thanks to Mark - Pavlidis). 
      • +
    • The order in which iptables kernel modules + are loaded has been corrected (Thanks to Mark + Pavlidis). 
      • - +
    - -

    4/28/2001 - The current version of Shorewall is 1.1.3. In this -version

    + +

    4/28/2001 - The current version of Shorewall is 1.1.3. In this version

    - +
      -
    • Correct message issued when Proxy ARP address - added (Thanks to Jason Kirtland).
      • +
    • Correct message issued when Proxy ARP address + added (Thanks to Jason Kirtland).
      • -
    • /tmp/shorewallpolicy-$$ is now removed if - there is an error while starting the firewall.
      • +
    • /tmp/shorewallpolicy-$$ is now removed +if there is an error while starting the firewall.
      • -
    • /etc/shorewall/icmp.def and /etc/shorewall/common.def - are now used to define the icmpdef and -common chains unless overridden by the presence - of /etc/shorewall/icmpdef or /etc/shorewall/common.
      • +
    • /etc/shorewall/icmp.def and /etc/shorewall/common.def + are now used to define the icmpdef and common + chains unless overridden by the presence of /etc/shorewall/icmpdef + or /etc/shorewall/common.
      • -
    • In the .lrp, the file /var/lib/lrpkg/shorwall.conf - has been corrected. An extra space after -"/etc/shorwall/policy" has been removed and "/etc/shorwall/rules" +
    • In the .lrp, the file /var/lib/lrpkg/shorwall.conf + has been corrected. An extra space after +"/etc/shorwall/policy" has been removed and "/etc/shorwall/rules" has been added.
      • -
    • When a sub-shell encounters a fatal error - and has stopped the firewall, it now kills -the main shell so that the main shell will not continue.
      • +
    • When a sub-shell encounters a fatal error + and has stopped the firewall, it now kills the + main shell so that the main shell will not continue.
      • -
    • A problem has been corrected where a sub-shell - stopped the firewall and main shell continued - resulting in a perplexing error message referring +
    • A problem has been corrected where a sub-shell + stopped the firewall and main shell continued + resulting in a perplexing error message referring to "common.so" resulted.
      • -
    • Previously, placing "-" in the PORT(S) column - in /etc/shorewall/rules resulted in an error - message during start. This has been corrected.
      • +
    • Previously, placing "-" in the PORT(S) +column in /etc/shorewall/rules resulted in an +error message during start. This has been corrected.
      • -
    • The first line of "install.sh" has been corrected - -- I had inadvertently deleted the initial "#".
      • - - - -
    +
  • The first line of "install.sh" has been +corrected -- I had inadvertently deleted the initial + "#".
    • -

    4/12/2001 - The current version of Shorewall is 1.1.2. In this -version

    + - + +

    4/12/2001 - The current version of Shorewall is 1.1.2. In this version

    + + +
      -
    • Port redirection now works again.
      • +
    • Port redirection now works again.
      • -
    • The icmpdef and common chains The icmpdef and common chains may now be user-defined.
      • -
    • The firewall no longer fails to start if -"routefilter" is specified for an interface that - isn't started. A warning message is now issued - in this case.
      • +
    • The firewall no longer fails to start if + "routefilter" is specified for an interface that + isn't started. A warning message is now issued + in this case.
      • -
    • The LRP Version is renamed "shorwall" for - 8,3 MSDOS file system compatibility.
      • +
    • The LRP Version is renamed "shorwall" for + 8,3 MSDOS file system compatibility.
      • -
    • A couple of LRP-specific problems were corrected.
      • - - - -
    +
  • A couple of LRP-specific problems were corrected.
    • + + + +

    4/8/2001 - Shorewall is now affiliated with the Leaf Project -

    +

    - +

    4/5/2001 - The current version of Shorewall is 1.1.1. In this version:

    - +
      -
    • The common chain is traversed from INPUT, - OUTPUT and FORWARD before logging occurs
      • +
    • The common chain is traversed from INPUT, + OUTPUT and FORWARD before logging occurs
      • -
    • The source has been cleaned up dramatically
      • +
    • The source has been cleaned up dramatically
      • -
    • DHCP DISCOVER packets with RFC1918 source - addresses no longer generate log messages. Linux - DHCP clients generate such packets and it's - annoying to see them logged. 
      • - - - -
    +
  • DHCP DISCOVER packets with RFC1918 source + addresses no longer generate log messages. Linux + DHCP clients generate such packets and it's + annoying to see them logged. 
    • + + + +

    3/25/2001 - The current version of Shorewall is 1.1.0. In this version:

    - +
      -
    • Log messages now indicate the packet disposition.
      • +
    • Log messages now indicate the packet disposition.
      • -
    • Error messages have been improved.
      • +
    • Error messages have been improved.
      • -
    • The ability to define zones consisting of - an enumerated set of hosts and/or subnetworks has +
    • The ability to define zones consisting of + an enumerated set of hosts and/or subnetworks has been added.
      • -
    • The zone-to-zone chain matrix is now sparse - so that only those chains that contain meaningful +
    • The zone-to-zone chain matrix is now sparse + so that only those chains that contain meaningful rules are defined.
      • -
    • 240.0.0.0/4 and 169.254.0.0/16 have been - added to the source subnetworks whose packets - are dropped under the norfc1918 interface +
    • 240.0.0.0/4 and 169.254.0.0/16 have been + added to the source subnetworks whose packets + are dropped under the norfc1918 interface option.
      • -
    • Exits are now provided for executing an -user-defined script when a chain is defined, -when the firewall is initialized, when the firewall - is started, when the firewall is stopped and -when the firewall is cleared.
      • +
    • Exits are now provided for executing an + user-defined script when a chain is defined, +when the firewall is initialized, when the firewall + is started, when the firewall is stopped and when +the firewall is cleared.
      • -
    • The Linux kernel's route filtering facility - can now be specified selectively on network - interfaces.
      • - - - -
    +
  • The Linux kernel's route filtering facility + can now be specified selectively on network + interfaces.
    • + + + +

    3/19/2001 - The current version of Shorewall is 1.0.4. This version:

    - +
      -
    • Allows user-defined zones. Shorewall now - has only one pre-defined zone (fw) with the remaining - zones being defined in the new configuration - file /etc/shorewall/zones. The /etc/shorewall/zones file - released in this version provides behavior that - is compatible with Shorewall 1.0.3. 
      • +
    • Allows user-defined zones. Shorewall now + has only one pre-defined zone (fw) with the remaining + zones being defined in the new configuration + file /etc/shorewall/zones. The /etc/shorewall/zones file + released in this version provides behavior that + is compatible with Shorewall 1.0.3. 
      • -
    • Adds the ability to specify logging in entries +
    • Adds the ability to specify logging in entries in the /etc/shorewall/rules file.
      • -
    • Correct handling of the icmp-def chain so - that only ICMP packets are sent through the - chain.
      • +
    • Correct handling of the icmp-def chain so + that only ICMP packets are sent through the + chain.
      • -
    • Compresses the output of "shorewall monitor" - if awk is installed. Allows the command to work - if awk isn't installed (although it's not pretty).
      • - - - -
    +
  • Compresses the output of "shorewall monitor" + if awk is installed. Allows the command to work + if awk isn't installed (although it's not pretty).
    • -

    3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix - release with no new features.

    + - + +

    3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix + release with no new features.

    + + +
      -
    • The PATH variable in the firewall script -now includes /usr/local/bin and /usr/local/sbin.
      • +
    • The PATH variable in the firewall script + now includes /usr/local/bin and /usr/local/sbin.
      • -
    • DMZ-related chains are now correctly deleted +
    • DMZ-related chains are now correctly deleted if the DMZ is deleted.
      • -
    • The interface OPTIONS for "gw" interfaces - are no longer ignored.
      • - - - -
    +
  • The interface OPTIONS for "gw" interfaces + are no longer ignored.
    • -

    3/8/2001 - The current version of Shorewall is 1.0.2. It supports an - additional "gw" (gateway) zone for - tunnels and it supports IPSEC tunnels with -end-points on the firewall. There is also a .lrp available - now.

    + - -

    Updated 7/15/2003 - Tom Eastep + +

    3/8/2001 - The current version of Shorewall is 1.0.2. It supports an + additional "gw" (gateway) zone for + tunnels and it supports IPSEC tunnels with + end-points on the firewall. There is also a .lrp available + now.

    + + + +

    Updated 7/19/2003 - Tom Eastep

    - +

    Copyright © 2001, 2002 Thomas M. Eastep.
    -

    -
    -
    +

    diff --git a/Shorewall-docs/Shorewall_Squid_Usage.html b/Shorewall-docs/Shorewall_Squid_Usage.html index 790e26040..687edb8a9 100644 --- a/Shorewall-docs/Shorewall_Squid_Usage.html +++ b/Shorewall-docs/Shorewall_Squid_Usage.html @@ -2,411 +2,372 @@ Shorewall Squid Usage - + - + - + - - - - - - - - -
    -
    -     		-

    Using Shorewall with Squid

    - -

    -     		-
    -
    -
    - This page covers Shorewall configuration to use with Squid running as a Transparent - Proxy. If you are running Shorewall 1.3, please see this documentation.
    -
    - Caution -     Please observe the following general requirements:
    -
    - -     In all cases, Squid should be configured - to run as a transparent proxy as described at http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html.
    -
    -     -     The following instructions mention the - files /etc/shorewall/start and /etc/shorewall/init -- if you don't have - those files, siimply create them.
    -
    - -     When the Squid server is in the DMZ -zone or in the local zone, that zone must be defined ONLY by its interface - -- no /etc/shorewall/hosts file entries. That is because the packets being - routed to the Squid server still have their original destination IP -addresses.
    -
    - -     You must have iptables installed on -your Squid server.
    -
    - -     If you run a Shorewall version earlier - than 1.4.6, you must have NAT and MANGLE enabled in your /etc/shorewall/conf - file
    -
    -         - NAT_ENABLED=Yes
    -             MANGLE_ENABLED=Yes
    -
    - Three different configurations are covered:
    - -
      -
    1. Squid running - on the Firewall.
      2. -
    2. Squid running - in the local network
      3. -
    3. Squid running -in the DMZ
      4. - -
    - -

    Squid Running on the Firewall

    - You want to redirect all local www connection requests EXCEPT - those to your own - http server (206.124.146.177) - to a Squid - transparent proxy running on the firewall and listening on port - 3128. Squid will of course require access to remote web servers.
    -
    - In /etc/shorewall/rules:
    -
    - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ACTIONSOURCEDEST PROTODEST
    - PORT(S)    		SOURCE
    - PORT(S)    		ORIGINAL
    - DEST
    REDIRECTloc3128tcpwww -
    -     		!206.124.146.177
    ACCEPTfwnettcpwww
    -
    -
    -
    -
    - There may be a requirement to exclude additional destination hosts - or networks from being redirected. For example, you might also want requests - destined for 130.252.100.0/24 to not be routed to Squid. In that case, -you must add a manual rule in /etc/shorewall/start:
    - -
    - 
    run_iptables -t nat -I loc_dnat -p tcp --dport www -d 130.252.100.0/24 -j RETURN
    -
    -  To exclude additional hosts or networks, just add additional similar - rules.
    - -

    Squid Running in the local network

    - You want to redirect all local www connection requests to - a Squid transparent - proxy running in your local zone at 192.168.1.3 and listening on -port 3128. Your local interface is eth1. There may also be a web server -running on 192.168.1.3. It is assumed that web access is already enabled -from the local zone to the internet.
    - -

    WARNING: This setup may conflict with - other aspects of your gateway including but not limited to traffic -shaping and route redirection. For that reason, I don't recommend -it.
    -

    - -
      -
    • On your firewall system, issue the following command
      -
      • - -
    - -
    - 
    echo 202 www.out >> /etc/iproute2/rt_tables
    -
    - -
      -
    • In /etc/shorewall/init, put:
      -
      • - -
    - -
    - 
    if [ -z "`ip rule list | grep www.out`" ] ; then
    	ip rule add fwmark 202 table www.out
    	ip route add default via 192.168.1.3 dev eth1 table www.out
    	ip route flush cache
    	echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects
    fi
    -
    - -
      -
    • If you are running Shorewall 1.4.1 or Shorewall 1.4.1a, - please upgrade to Shorewall 1.4.2 or later.
      -
      -
      • -
    • If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:
      -
      - - - - - - + - - - - - - - - + + +
      ZONE
      +       		+
      		INTERFACE
      -       		BROADCAST
      -       		OPTIONS
      +       		+

      Using Shorewall with Squid

      + +

      +       		+
      loc
      -       		eth1
      -       		detect
      -       		routeback
      -
      +
      + This page covers Shorewall configuration to use with Squid running as a Transparent + Proxy. If you are running Shorewall 1.3, please see this documentation.
      +
      + Caution +     Please observe the following general requirements:
      +
      + +     In all cases, Squid should be configured + to run as a transparent proxy as described at http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html.
      +
      +       +     The following instructions mention the + files /etc/shorewall/start and /etc/shorewall/init -- if you don't have + those files, siimply create them.
      +
      + +     When the Squid server is in the DMZ +zone or in the local zone, that zone must be defined ONLY by its interface + -- no /etc/shorewall/hosts file entries. That is because the packets +being routed to the Squid server still have their original destination +IP addresses.
      +
      + +     You must have iptables installed on +your Squid server.
      +
      + +     If you run a Shorewall version earlier + than 1.4.6, you must have NAT and MANGLE enabled in your /etc/shorewall/conf + file
      +
      +         + NAT_ENABLED=Yes
      +               MANGLE_ENABLED=Yes
      +
      + Three different configurations are covered:
      + +
        +
      1. Squid running + on the Firewall.
        2. +
      2. Squid running + in the local network
        3. +
      3. Squid running + in the DMZ
        4. + +
      + +

      Squid Running on the Firewall

      + You want to redirect all local www connection requests EXCEPT + those to your +own http server (206.124.146.177) + to a Squid + transparent proxy running on the firewall and listening on +port 3128. Squid will of course require access to remote web servers.
      +
      + In /etc/shorewall/rules:
      +
      + +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ACTIONSOURCEDEST PROTODEST
      + PORT(S)      		SOURCE
      + PORT(S)      		ORIGINAL
      + DEST
      REDIRECTloc3128tcpwww -
      +       		!206.124.146.177
      ACCEPTfwnettcpwww
      +
      +
      +
      +
      + There may be a requirement to exclude additional destination hosts + or networks from being redirected. For example, you might also want requests + destined for 130.252.100.0/24 to not be routed to Squid. In that case, you + must add a manual rule in /etc/shorewall/start:
      + +
      + 
      run_iptables -t nat -I loc_dnat -p tcp --dport www -d 130.252.100.0/24 -j RETURN
      +
      +  To exclude additional hosts or networks, just add additional similar + rules.
      + +

      Squid Running in the local network

      + You want to redirect all local www connection requests +to a Squid transparent + proxy running in your local zone at 192.168.1.3 and listening on +port 3128. Your local interface is eth1. There may also be a web server +running on 192.168.1.3. It is assumed that web access is already enabled +from the local zone to the internet.
      + +

      WARNING: This setup may conflict with + other aspects of your gateway including but not limited to traffic + shaping and route redirection. For that reason, I don't recommend + it.
      +

      + +
        +
      • On your firewall system, issue the following command
        +
        • + +
      + +
      + 
      echo 202 www.out >> /etc/iproute2/rt_tables
      +
      + +
        +
      • In /etc/shorewall/init, put:
        +
        • + +
      + +
      + 
      if [ -z "`ip rule list | grep www.out`" ] ; then
      	ip rule add fwmark 202 table www.out
      	ip route add default via 192.168.1.3 dev eth1 table www.out
      	ip route flush cache
      	echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects
      fi
      +
      + +
        +
      • If you are running Shorewall 1.4.1 or Shorewall 1.4.1a, + please upgrade to Shorewall 1.4.2 or later.
        +
        +
        • +
      • If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:
        +
        + + + + + + + + + + + + + + + + +
        ZONE
        +         		INTERFACE
        +         		BROADCAST
        +         		OPTIONS
        +
        loc
        +         		eth1
        +         		detect
        +         		routeback
        +
        -
        -
        • -
      • In /etc/shorewall/rules:
        -
        - +
        +
        • +
      • In /etc/shorewall/rules:
        +
        + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + +
        ACTIONSOURCEDEST PROTODEST
        - PORT(S)        		SOURCE
        - PORT(S)        		ORIGINAL
        - DEST
        ACCEPT
        -         		locloc
        -         		tcpwww
        -
        -
        ACTIONSOURCEDEST PROTODEST
        + PORT(S)        		SOURCE
        + PORT(S)        		ORIGINAL
        + DEST
        ACCEPT
        +         		locloc
        +         		tcpwww
        +
        +
        +
        • +
        +
      • Alternativfely, if you are running Shorewall 1.4.0 you can have + the following policy in place of the above rule:
        + + + + + + + + + + + + + + + + + +
        SOURCE
        +         		DESTINATION
        +         		POLICY
        +         		LOG LEVEL
        +         		BURST PARAMETERS
        +
        loc
        +         		loc
        +         		ACCEPT
        +
        +
        +
        -
        • -
        -
      • Alternativfely, if you are running Shorewall 1.4.0 you can have - the following policy in place of the above rule:
        - - - - - - - - - - - - - - - - - - - -
        SOURCE
        -         		DESTINATION
        -         		POLICY
        -         		LOG LEVEL
        -         		BURST PARAMETERS
        -
        loc
        -         		loc
        -         		ACCEPT
        -
        -
        -
        -
        -
        • -
      • In /etc/shorewall/start add:
        -
        • - +
        + +
      • In /etc/shorewall/start add:
        +
        • +
      - -
      + +
      iptables -t mangle -A PREROUTING -i eth1 -s ! 192.168.1.3 -p tcp --dport 80 -j MARK --set-mark 202
      -
      - +
      +
        -
      • On 192.168.1.3, arrange for the following command to +
      • On 192.168.1.3, arrange for the following command to be executed after networking has come up
        - + 
        iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-ports 3128
        -
        • - + +
      - -
      If you are running RedHat on the server, you can simply execute - the following commands after you have typed the iptables command above:
      -
      - -
      + +
      If you are running RedHat on the server, you can simply execute + the following commands after you have typed the iptables command +above:
      +
      + +
      - + 
      iptables-save > /etc/sysconfig/iptables
      chkconfig --level 35 iptables start
      -
      - + color="#009900">
      chkconfig --level 35 iptables on
       +
      +
      - +

      Squid Running in the DMZ (This is what I do)

      - You have a single Linux system in your DMZ with IP address -192.0.2.177. You want to run both a web server and Squid on that system. -Your DMZ interface is eth1 and your local interface is eth2.
      - + You have a single Linux system in your DMZ with IP address + 192.0.2.177. You want to run both a web server and Squid on that system. + Your DMZ interface is eth1 and your local interface is eth2.
      +
        -
      • On your firewall system, issue the following command
        -
        • - +
      • On your firewall system, issue the following command
        +
        • +
      - -
      + +
      echo 202 www.out >> /etc/iproute2/rt_tables
      -
      - +
      +
        -
      • In /etc/shorewall/init, put:
        -
        • - +
      • In /etc/shorewall/init, put:
        +
        • +
      - -
      + +
      if [ -z "`ip rule list | grep www.out`" ] ; then
      	ip rule add fwmark 202 table www.out
      	ip route add default via 192.0.2.177 dev eth1 table www.out
      	ip route flush cache
      fi
      -
      - +
      +
        -
      •  Do one of the following:
        -
        - A) In /etc/shorewall/start add
        -
        • - +
      •  Do one of the following:
        +
        + A) In /etc/shorewall/start add
        +
        • +
      - -
      + +
      	iptables -t mangle -A PREROUTING -i eth2 -p tcp --dport 80 -j MARK --set-mark 202
      -
      - -
      B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf - and add the following entry in /etc/shorewall/tcrules:
      -
      - -
      -
      - - - - - - - - - - - - - - - - - - - - -
      MARK
      -       		SOURCE
      -       		DESTINATION
      -       		PROTOCOL
      -       		PORT
      -       		CLIENT PORT
      -
      202
      -       		eth2
      -       		0.0.0.0/0
      -       		tcp
      -       		80
      -       		-
      -
      -
      - C) Run Shorewall 1.3.14 or later and add the following entry in -/etc/shorewall/tcrules:
      -
      - -
      -
      +
      + +
      B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf + and add the following entry in /etc/shorewall/tcrules:
      +
      + +
      +
      @@ -424,7 +385,7 @@ Your DMZ interface is eth1 and your local interface is eth2.
      - @@ -437,106 +398,147 @@ Your DMZ interface is eth1 and your local interface is eth2.
      - - + +
      202:P
      +       		202
      		 eth2
      		 -
      -
      - + C) Run Shorewall 1.3.14 or later and add the following entry in + /etc/shorewall/tcrules:
      +
      + +
      +
      + + + + + + + + + + + + + + + + + + + + +
      MARK
      +       		SOURCE
      +       		DESTINATION
      +       		PROTOCOL
      +       		PORT
      +       		CLIENT PORT
      +
      202:P
      +       		eth2
      +       		0.0.0.0/0
      +       		tcp
      +       		80
      +       		-
      +
      +
      +
      +
        -
      • In /etc/shorewall/rules, you will need:
        • - +
      • In /etc/shorewall/rules, you will need:
        • +
      - -
      + +
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ACTION
      -       		SOURCE
      -       		DEST
      -       		PROTO
      -       		DEST
      - PORT(S)
      -       		CLIENT
      - PORT(2)
      -       		ORIGINAL
      - DEST
      -
      ACCEPT
      -       		loc
      -       		dmz
      -       		tcp
      -       		80
      -
      -
      -
      ACCEPT
      -       		dmz
      -       		net
      -       		tcp
      -       		80
      -
      -
      -
      ACTION
      +       		SOURCE
      +       		DEST
      +       		PROTO
      +       		DEST
      + PORT(S)
      +       		CLIENT
      + PORT(2)
      +       		ORIGINAL
      + DEST
      +
      ACCEPT
      +       		loc
      +       		dmz
      +       		tcp
      +       		80
      +
      +
      +
      ACCEPT
      +       		dmz
      +       		net
      +       		tcp
      +       		80
      +
      +
      +
      -
      -
      - -
        -
      • On 192.0.2.177 (your Web/Squid server), arrange for -the following command to be executed after networking has come up
        - - 
        iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128
        -
        • - -
      - -
      If you are running RedHat on the server, you can simply execute - the following commands after you have typed the iptables command above:
      +
      - -
      + +
        +
      • On 192.0.2.177 (your Web/Squid server), arrange for +the following command to be executed after networking has come up
        + + 
        iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128
        +
        • + +
      + +
      If you are running RedHat on the server, you can simply execute + the following commands after you have typed the iptables command +above:
      +
      + +
      - + 
      iptables-save > /etc/sysconfig/iptables
      chkconfig --level 35 iptables start
      -
      - + color="#009900">
      chkconfig --level 35 iptables on
       +
      +
      - -

      Updated 6/27/2003 - Tom Eastep -

      + +

      Updated 7/18/2003 - Tom Eastep +

      - Copyright -© 2003 Thomas M. Eastep.
      + Copyright + © 2003 Thomas M. Eastep.
      +
      +

      -
      - diff --git a/Shorewall-docs/Shorewall_index_frame.htm b/Shorewall-docs/Shorewall_index_frame.htm index d559e6018..397a2515f 100644 --- a/Shorewall-docs/Shorewall_index_frame.htm +++ b/Shorewall-docs/Shorewall_index_frame.htm @@ -1,153 +1,147 @@ - + - + - + - + Shorewall Index - + - + - - - + + - - - + + + - - - + + + +
      +
      - +

      Shorewall

      -
      +
      - + - + + -
      - +

      Copyright © 2001-2003 Thomas M. Eastep.
      -

      -
      -
      -
      +

      diff --git a/Shorewall-docs/Shorewall_sfindex_frame.htm b/Shorewall-docs/Shorewall_sfindex_frame.htm index d97073d2c..11f6fbfe3 100644 --- a/Shorewall-docs/Shorewall_sfindex_frame.htm +++ b/Shorewall-docs/Shorewall_sfindex_frame.htm @@ -1,151 +1,144 @@ - + - + - + - + Shorewall Index - + - + - - - - - - + + + + + - - - + + + +
      - -

      Shorewall

      -
      - -
      -
    • Shorewall +
      • + + + - + -
      - +

      Copyright © 2001-2003 Thomas M. Eastep.
      -

      -
      -
      -
      +

      diff --git a/Shorewall-docs/images/CorpNetwork.gif b/Shorewall-docs/images/CorpNetwork.gif index c6fa35242..e67ac92cd 100644 Binary files a/Shorewall-docs/images/CorpNetwork.gif and b/Shorewall-docs/images/CorpNetwork.gif differ diff --git a/Shorewall-docs/images/Logo1.png b/Shorewall-docs/images/Logo1.png index d6a857e9a..60f545b6d 100755 Binary files a/Shorewall-docs/images/Logo1.png and b/Shorewall-docs/images/Logo1.png differ diff --git a/Shorewall-docs/images/Thumbs.db b/Shorewall-docs/images/Thumbs.db index 13e6fd46f..4d065308c 100644 Binary files a/Shorewall-docs/images/Thumbs.db and b/Shorewall-docs/images/Thumbs.db differ diff --git a/Shorewall-docs/seattlefirewall_index.htm b/Shorewall-docs/seattlefirewall_index.htm index b5d5c32a2..2c49a54b4 100644 --- a/Shorewall-docs/seattlefirewall_index.htm +++ b/Shorewall-docs/seattlefirewall_index.htm @@ -3,91 +3,93 @@ - + Shoreline Firewall (Shorewall) 1.4 - + + - + - + - + - - + - + - + +
      + + - - + +
      - + - + +
      (Shorewall Logo) -
      -       		+ src="images/Logo1.png" alt="(Shorewall Logo)" width="430" height="90"> + + - +

      (Shorewall Logo) -

      -
      -
      - -
      + +
      - -
      + +
      - + - + - + - - +
      + - + - - + +
      + +

      -
      - + +

      What is it?

      - - + +

      The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function @@ -96,37 +98,39 @@ - - + +

      This program is free software; you can redistribute it and/or modify - it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.
      -
      +
      - This program is distributed - in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even - the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details.
      + This program is distributed + in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without + even the implied warranty of MERCHANTABILITY + or FITNESS FOR A PARTICULAR PURPOSE. + See the GNU General Public License for more +details.
      -
      +
      - You should have received a copy - of the GNU General Public License - along with this program; if not, write - to the Free Software Foundation, - Inc., 675 Mass Ave, Cambridge, MA 02139, USA

      + You should have received a + copy of the GNU General Public License + along with this program; if not, + write to the Free Software Foundation, + Inc., 675 Mass Ave, Cambridge, MA 02139, + USA

      - - + +

      Copyright 2001, 2002, 2003 Thomas M. Eastep

      @@ -137,449 +141,479 @@ General Public License as published by the Free Software - +

      This is the Shorewall 1.4 Web Site

      -The information on this site applies only to 1.4.x releases of Shorewall. -For older versions:
      - + The information on this site applies only to 1.4.x releases of Shorewall. + For older versions:
      + - +

      Getting Started with Shorewall

      - New to Shorewall? Start by selecting -the QuickStart Guide -that most closely match your environment and follow the step -by step instructions.
      - + New to Shorewall? Start by selecting + the QuickStart Guide + that most closely match your environment and follow the +step by step instructions.
      + +

      Looking for Information?

      - The Documentation - Index is a good place to start as is the Quick Search to your right. - + The Documentation + Index is a good place to start as is the Quick Search to your right. +

      Running Shorewall on Mandrake with a two-interface setup?

      - If so, the documentation on this site will - not apply directly to your setup. If you want to use the documentation - that you find here, you will want to consider uninstalling what you have - and installing a setup that matches the documentation on this site. - See the Two-interface QuickStart Guide - for details.
      - + If so, the documentation on this site + will not apply directly to your setup. If you want to use the + documentation that you find here, you will want to consider uninstalling + what you have and installing a setup that matches the documentation + on this site. See the Two-interface + QuickStart Guide for details.
      + +

      News

      - +
        - - + +
      - -

      7/15/2003 - New Mirror in Brazil (New) -
      -

      - Thanks to the folks at securityopensource.org.br, there is now a Shorewall - mirror in Brazil.
      + -

      7/15/2003 - Shorewall-1.4.6 RC 1 7/20/2003 - Shorewall-1.4.6 (New) -
      -

      - -
      http://shorewall.net/pub/shorewall/testing
      - ftp://shorewall.net/pub/shorewall/testing
      -
      - +
      +

      + +
      - +

      Problems Corrected:
      -

      - +

      + +
        -
      1. A problem seen on RH7.3 systems where Shorewall encountered - start errors when started using the "service" mechanism has been worked - around.
        -
        -
        2. -
      2. Where a list of IP addresses appears in the DEST column -of a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in -the nat table (one for each element in the list). Shorewall now correctly -creates a single DNAT rule with multiple "--to-destination" clauses.
        +
      3. A problem seen on RH7.3 systems where Shorewall encountered + start errors when started using the "service" mechanism has been worked + around.
        +
        +
        4. +
      4. Where a list of IP addresses appears in the DEST column + of a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules +in the nat table (one for each element in the list). Shorewall now correctly + creates a single DNAT rule with multiple "--to-destination" clauses.
        +
        +
        5. +
      5. Corrected a problem in Beta 1 where DNS names containing + a "-" were mis-handled when they appeared in the DEST column of a rule.
        +
        +
        6. +
      6. A number of problems with rule parsing have been corrected. + Corrections involve the handling of "z1!z2" in the SOURCE column as well + as lists in the ORIGINAL DESTINATION column.

        -
        7. -
      7. Corrected a problem in Beta 1 where DNS names containing -a "-" were mis-handled when they appeared in the DEST column of a rule.
        +
        8. +
      8. The message "Adding rules for DHCP" is now suppressed if there +are no DHCP rules to add.
        +
        9. + +
      + + +

      Migration Issues:
      +

      + +
        +
      1. In earlier versions, an undocumented feature allowed +entries in the host file as follows:
        +
        +     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
        +
        + This capability was never documented and has been removed in 1.4.6 + to allow entries of the following format:
        +
        +     z   eth1:192.168.1.0/24,192.168.2.0/24

        2. -
      2. A number of problems with rule parsing have been corrected. - Corrections involve the handling of "z1!z2" in the SOURCE column as well -as lists in the ORIGINAL DESTINATION column.
        +
      3. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options + have been removed from /etc/shorewall/shorewall.conf. These capabilities + are now automatically detected by Shorewall (see below).
        4. - +
      - -

      Migration Issues:
      -

      - -
        -
      1. In earlier versions, an undocumented feature allowed entries - in the host file as follows:
        -
        -     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
        -
        - This capability was never documented and has been removed in 1.4.6 -to allow entries of the following format:
        -
        -     z   eth1:192.168.1.0/24,192.168.2.0/24
        -
        -
        2. -
      2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have - been removed from /etc/shorewall/shorewall.conf. These capabilities are -now automatically detected by Shorewall (see below).
        -
        3. - -
      - +

      New Features:
      -

      - +

      + +
        -
      1. A 'newnotsyn' interface option has been added. This option - may be specified in /etc/shorewall/interfaces and overrides the setting -NEWNOTSYN=No for packets arriving on the associated interface.
        -
        -
        2. -
      2. The means for specifying a range of IP addresses in /etc/shorewall/masq - to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for -address ranges.
        -
        -
        3. -
      3. Shorewall can now add IP addresses to subnets other than -the first one on an interface.
        -
        -
        4. -
      4. DNAT[-] rules may now be used to load balance (round-robin) - over a set of servers. Servers may be specified in a range of addresses - given as <first address>-<last address>.
        -
        - Example:
        -
        -     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
        -
        -
        5. -
      5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration - options have been removed and have been replaced by code that detects -whether these capabilities are present in the current kernel. The output -of the start, restart and check commands have been enhanced to report the -outcome:
        -
        - Shorewall has detected the following iptables/netfilter capabilities:
        -    NAT: Available
        -    Packet Mangling: Available
        -    Multi-port Match: Available
        - Verifying Configuration...
        -
        -
        6. -
      6. Support for the Connection Tracking Match Extension has -been added. This extension is available in recent kernel/iptables releases -and allows for rules which match against elements in netfilter's connection - tracking table. Shorewall automatically detects the availability of this - extension and reports its availability in the output of the start, restart - and check commands.
        -
        - Shorewall has detected the following iptables/netfilter capabilities:
        -    NAT: Available
        -    Packet Mangling: Available
        -    Multi-port Match: Available
        -    Connection Tracking Match: Available
        - Verifying Configuration...
        -
        - If this extension is available, the ruleset generated by Shorewall -is changed in the following ways:
        7. - +
      7. A 'newnotsyn' interface option has been added. This +option may be specified in /etc/shorewall/interfaces and overrides the +setting NEWNOTSYN=No for packets arriving on the associated interface.
        +
        +
        8. +
      8. The means for specifying a range of IP addresses in +/etc/shorewall/masq to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes +is enabled for address ranges.
        +
        +
        9. +
      9. Shorewall can now add IP addresses to subnets other +than the first one on an interface.
        +
        +
        10. +
      10. DNAT[-] rules may now be used to load balance (round-robin) + over a set of servers. Servers may be specified in a range of addresses + given as <first address>-<last address>.
        +
        + Example:
        +
        +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
        +
        +
        11. +
      11. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration + options have been removed and have been replaced by code that detects + whether these capabilities are present in the current kernel. The output + of the start, restart and check commands have been enhanced to report the + outcome:
        +
        + Shorewall has detected the following iptables/netfilter capabilities:
        +    NAT: Available
        +    Packet Mangling: Available
        +    Multi-port Match: Available
        + Verifying Configuration...
        +
        +
        12. +
      12. Support for the Connection Tracking Match Extension +has been added. This extension is available in recent kernel/iptables +releases and allows for rules which match against elements in netfilter's +connection tracking table. Shorewall automatically detects the availability +of this extension and reports its availability in the output of the start, +restart and check commands.
        +
        + Shorewall has detected the following iptables/netfilter capabilities:
        +    NAT: Available
        +    Packet Mangling: Available
        +    Multi-port Match: Available
        +    Connection Tracking Match: Available
        + Verifying Configuration...
        +
        + If this extension is available, the ruleset generated by Shorewall + is changed in the following ways:
        13. + +
          -
        • To handle 'norfc1918' filtering, Shorewall will not create - chains in the mangle table but will rather do all 'norfc1918' filtering - in the filter table (rfc1918 chain).
          • -
        • Recall that Shorewall DNAT rules generate two netfilter - rules; one in the nat table and one in the filter table. If the Connection - Tracking Match Extension is available, the rule in the filter table is -extended to check that the original destination address was the same as -specified (or defaulted to) in the DNAT rule.
          -
          -
          • - -
        -
      13. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) - may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
        -
        -
        14. -
      14. An 'ipcalc' command has been added to /sbin/shorewall.
        -
        -       ipcalc [ <address> <netmask> | <address>/<vlsm> - ]
        -
        - Examples:
        -
        -       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
        -          CIDR=192.168.1.0/24
        -          NETMASK=255.255.255.0
        -          NETWORK=192.168.1.0
        -          BROADCAST=192.168.1.255
        -       [root@wookie root]#
        -
        -       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
        -          CIDR=192.168.1.0/24
        -          NETMASK=255.255.255.0
        -          NETWORK=192.168.1.0
        -          BROADCAST=192.168.1.255
        -       [root@wookie root]#
        -
        - Warning:
        -
        - If your shell only supports 32-bit signed arithmatic (ash or dash), -then the ipcalc command produces incorrect information for IP addresses -128.0.0.0-1 and for /1 networks. Bash should produce correct information -for all valid IP addresses.
        -
        -
        15. -
      15. An 'iprange' command has been added to /sbin/shorewall. -
        -
        -       iprange <address>-<address>
        -
        - This command decomposes a range of IP addressses into a list of network - and host addresses. The command can be useful if you need to construct an - efficient set of rules that accept connections from a range of network addresses.
        -
        - Note: If your shell only supports 32-bit signed arithmetic (ash or -dash) then the range may not span 128.0.0.0.
        -
        - Example:
        -
        -       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
        -       192.168.1.4/30
        -       192.168.1.8/29
        -       192.168.1.16/28
        -       192.168.1.32/27
        -       192.168.1.64/26
        -       192.168.1.128/25
        -       192.168.2.0/23
        -       192.168.4.0/22
        -       192.168.8.0/22
        -       192.168.12.0/29
        -       192.168.12.8/31
        -       [root@gateway root]#
        -
        -
        16. -
      16. A list of host/net addresses is now allowed in an entry -in /etc/shorewall/hosts.
        -
        - Example:
        -
        -     foo    eth1:192.168.1.0/24,192.168.2.0/24
        -
        17. - -
      - -

      6/17/2003 - Shorewall-1.4.5

      - - -

      Problems Corrected:
      -

      - - -
        -
      1. The command "shorewall debug try <directory>" - now correctly traces the attempt.
        2. -
      2. The INCLUDE directive now works properly in the zones - file; previously, INCLUDE in that file was ignored.
        3. -
      3. /etc/shorewall/routestopped records with an empty -second column are no longer ignored.
        +
      4. To handle 'norfc1918' filtering, Shorewall will not + create chains in the mangle table but will rather do all 'norfc1918' +filtering in the filter table (rfc1918 chain).
        5. +
      5. Recall that Shorewall DNAT rules generate two netfilter + rules; one in the nat table and one in the filter table. If the Connection + Tracking Match Extension is available, the rule in the filter table is + extended to check that the original destination address was the same as + specified (or defaulted to) in the DNAT rule.
        +
        6. - + + +
      6. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
        +
        +
        7. +
      7. An 'ipcalc' command has been added to /sbin/shorewall.
        +
        +       ipcalc [ <address> <netmask> | <address>/<vlsm> + ]
        +
        + Examples:
        +
        +       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
        +          CIDR=192.168.1.0/24
        +          NETMASK=255.255.255.0
        +          NETWORK=192.168.1.0
        +          BROADCAST=192.168.1.255
        +       [root@wookie root]#
        +
        +       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
        +          CIDR=192.168.1.0/24
        +          NETMASK=255.255.255.0
        +          NETWORK=192.168.1.0
        +          BROADCAST=192.168.1.255
        +       [root@wookie root]#
        +
        + Warning:
        +
        + If your shell only supports 32-bit signed arithmatic (ash or dash), + then the ipcalc command produces incorrect information for IP addresses + 128.0.0.0-1 and for /1 networks. Bash should produce correct information + for all valid IP addresses.
        +
        +
        8. +
      8. An 'iprange' command has been added to /sbin/shorewall. +
        +
        +       iprange <address>-<address>
        +
        + This command decomposes a range of IP addressses into a list of +network and host addresses. The command can be useful if you need to construct + an efficient set of rules that accept connections from a range of network + addresses.
        +
        + Note: If your shell only supports 32-bit signed arithmetic (ash +or dash) then the range may not span 128.0.0.0.
        +
        + Example:
        +
        +       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
        +       192.168.1.4/30
        +       192.168.1.8/29
        +       192.168.1.16/28
        +       192.168.1.32/27
        +       192.168.1.64/26
        +       192.168.1.128/25
        +       192.168.2.0/23
        +       192.168.4.0/22
        +       192.168.8.0/22
        +       192.168.12.0/29
        +       192.168.12.8/31
        +       [root@gateway root]#
        +
        +
        9. +
      9. A list of host/net addresses is now allowed in an entry + in /etc/shorewall/hosts.
        +
        + Example:
        +
        +     foo    eth1:192.168.1.0/24,192.168.2.0/24
        +
        +
        10. +
      10. The "shorewall check" command now includes the chain name when +printing the applicable policy for each pair of zones.
        + 
        +    Example:
        + 
        +        Policy for dmz to net is REJECT using chain all2all
        + 
        +This means that the policy for connections from the dmz to the internet is +REJECT and the applicable entry in the /etc/shorewall/policy was the all->all +policy.
        +
        +
        11. +
      11. Support for the 2.6 Kernel series has been added.
        +
        12. +
      + +

      7/15/2003 - New Mirror in Brazil (New) +
      +

      + Thanks to the folks at securityopensource.org.br, there is now a Shorewall + mirror in Brazil. +

      6/17/2003 - Shorewall-1.4.5

      - -

      New Features:
      -

      + +

      Problems Corrected:
      +

      - +
        -
      1. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] - rule may now contain a list of addresses. If the list begins with "!' - then the rule will take effect only if the original destination address - in the connection request does not match any of the addresses listed.
        2. +
      2. The command "shorewall debug try <directory>" + now correctly traces the attempt.
        3. +
      3. The INCLUDE directive now works properly in the + zones file; previously, INCLUDE in that file was ignored.
        4. +
      4. /etc/shorewall/routestopped records with an empty + second column are no longer ignored.
        +
        5. - +
      - + +

      New Features:
      +

      + + +
        +
      1. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] + rule may now contain a list of addresses. If the list begins with +"!' then the rule will take effect only if the original destination +address in the connection request does not match any of the addresses +listed.
        2. + + +
      + +

      6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8 -

      +

      - +

      The firewall at shorewall.net has been upgraded to the 2.4.21 kernel - and iptables 1.2.8 (using the "official" RPM from netfilter.org). No - problems have been encountered with this set of software. The Shorewall - version is 1.4.4b plus the accumulated changes for 1.4.5.
      -

      + and iptables 1.2.8 (using the "official" RPM from netfilter.org). +No problems have been encountered with this set of software. The Shorewall + version is 1.4.4b plus the accumulated changes for 1.4.5.
      +

      - +

      6/8/2003 - Updated Samples

      - +

      Thanks to Francesca Smith, the samples have been updated to Shorewall - version 1.4.4.

      + version 1.4.4.

      - +

      - - + +
        - +
      - +

      More News

      - + +

      (Leaf Logo) - Jacques Nilo and Eric - Wolzak have a LEAF (router/firewall/gateway - on a floppy, CD or compact flash) distribution - called Bering that - features Shorewall-1.4.2 and Kernel-2.4.20. - You can find their work at: - http://leaf.sourceforge.net/devel/jnilo
      +       Jacques Nilo and Eric + Wolzak have a LEAF (router/firewall/gateway + on a floppy, CD or compact flash) distribution + called Bering that + features Shorewall-1.4.2 and Kernel-2.4.20. + You can find their work at: + http://leaf.sourceforge.net/devel/jnilo
      -

      +

      - Congratulations to Jacques and Eric on -the recent release of Bering 1.2!!!
      + Congratulations to Jacques and Eric +on the recent release of Bering 1.2!!!
      - + +

      Donations

      -       		+ + - + +

      - Note:       Search is unavailable Daily 0200-0330 GMT.
      - + - +

      Quick Search
      -

      - -
      + - + +

      Extended Search

      -
      -
      -
      +
      -
      +
      - + - + - + - + - + - - + +
      + - + +

      (Starlight Logo) -

      +

      - - + +


      - Shorewall is free but if you -try it and find it useful, please consider making a donation - to - Starlight - Children's Foundation. Thanks!

      + Shorewall is free but if +you try it and find it useful, please consider making a donation + to + Starlight Children's Foundation. +Thanks!

      -
      - -

      Updated 7/16/2003 - Tom Eastep -
      + +

      Updated 7/19/2003 - Tom Eastep +

      diff --git a/Shorewall-docs/shorewall_quickstart_guide.htm b/Shorewall-docs/shorewall_quickstart_guide.htm index 3b2482885..b9c4fd546 100644 --- a/Shorewall-docs/shorewall_quickstart_guide.htm +++ b/Shorewall-docs/shorewall_quickstart_guide.htm @@ -1,332 +1,357 @@ - + - + - + - + Shorewall QuickStart Guide + - + - - - + + - - - + (HOWTO's)
      + + + + +
      - +
      +

      Shorewall QuickStart Guides - (HOWTO's)
      -

      -
      - +

      With thanks to Richard who reminded me once again that we must all first walk before we can run.
      - The French Translations are courtesy of Patrice Vetsel
      -

      - + The French Translations are courtesy of Patrice Vetsel
      +

      +

      The Guides

      - +

      These guides provide step-by-step instructions for configuring Shorewall - in common firewall setups.

      - -

      The following guides are for users who have a single public IP address:

      - + in common firewall setups.

      + +

      If you have a single public IP address:

      + +
      + +

      The above guides are designed to get your first firewall up and running + quickly in the three most common Shorewall configurations. +If you want to learn more about Shorewall than is explained in the above +simple guides,  the Shorewall Setup Guide +(See Index Below) is for you.

      +
      + +

      If you have more than one public IP +address:
      +

      +
      The Shorewall Setup Guide +(See Index Below) outlines the steps necessary to set up +a firewall where there are multiple +public IP addresses involved or if you +want to learn more about Shorewall than is explained in the +single-address guides above.
      + - -

      The above guides are designed to get your first firewall up and running - quickly in the three most common Shorewall configurations.

      - -

      The Shorewall Setup Guide (See - Index Below) outlines the steps necessary to set up a firewall - where there are multiple public IP addresses involved -or if you want to learn more about Shorewall than is explained -in the single-address guides above.

      - -
        - -
      - -

      Documentation Index

      - + +

      Documentation Index

      +

      The following documentation covers a variety of topics and supplements - the QuickStart + the QuickStart Guides described above. Please review the appropriate guide before trying to use this documentation directly.

      - + - +

      If you use one of these guides and have a suggestion for improvement please let me know.

      - -

      Last modified 7/16/2003 - Tom Eastep

      - + +

      Last modified 7/18/2003 - Tom Eastep

      +

      Copyright 2002, 2003 Thomas M. - Eastep
      -

      -
      + Eastep
      +


      diff --git a/Shorewall-docs/sourceforge_index.htm b/Shorewall-docs/sourceforge_index.htm index c031f9008..2d4f02945 100644 --- a/Shorewall-docs/sourceforge_index.htm +++ b/Shorewall-docs/sourceforge_index.htm @@ -3,617 +3,645 @@ - + Shoreline Firewall (Shorewall) 1.4 - + + - + - + - + - - - - + + + + - - + +
      - - (Shorewall Logo) -
      -
      + (Shorewall Logo) +
      +
      - -
      -
      + +
      +
      - + - + - + + - - - - - - - -
      + - +

      What is it?

      - -

      The Shoreline Firewall, more commonly known as "Shorewall", is - a Netfilter (iptables) - based firewall that can be used on a dedicated - firewall system, a multi-function gateway/router/server - or on a standalone GNU/Linux system.

      + + +

      The Shoreline Firewall, more commonly known as "Shorewall", is + a Netfilter (iptables) + based firewall that can be used on a dedicated + firewall system, a multi-function gateway/router/server + or on a standalone GNU/Linux system.

      - -

      This program is free software; you can redistribute it and/or modify - - it under the terms of Version 2 of the GNU -General Public License as published by the Free Software - Foundation.
      -
      + +

      This program is free software; you can redistribute it and/or modify - This program is distributed - in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even - the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details.
      + it under the terms of Version 2 of the +GNU General Public License as published by the Free Software + Foundation.
      -
      +
      - You should have received a copy - of the GNU General Public License - along with this program; if not, write - to the Free Software Foundation, - Inc., 675 Mass Ave, Cambridge, MA 02139, USA

      + This program is distributed + in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without + even the implied warranty of MERCHANTABILITY + or FITNESS FOR A PARTICULAR PURPOSE. + See the GNU General Public License for more details.
      + +
      + + You should have received a + copy of the GNU General Public License + along with this program; if not, + write to the Free Software Foundation, + Inc., 675 Mass Ave, Cambridge, MA 02139, + USA

      - + +

      Copyright 2001, 2002, 2003 Thomas M. Eastep

      - +

      This is the Shorewall 1.4 Web Site

      -The information on this site applies only to 1.4.x releases of Shorewall. -For older versions:
      - + The information on this site applies only to 1.4.x releases of Shorewall. + For older versions:
      + - +

      Getting Started with Shorewall

      - New to Shorewall? Start by selecting the - QuickStart - Guide that most closely match your environment and follow - the step by step instructions.
      - + New to Shorewall? Start by selecting + the QuickStart + Guide that most closely match your environment and +follow the step by step instructions.
      +

      Looking for Information?

      - The Documentation - Index is a good place to start as is the Quick Search to your right. - + The Documentation + Index is a good place to start as is the Quick Search to your right. +

      Running Shorewall on Mandrake with a two-interface setup?

      - If so, the documentation on this site will - not apply directly to your setup. If you want to use the documentation - that you find here, you will want to consider uninstalling what you have - and installing a setup that matches the documentation on this site. - See the Two-interface QuickStart Guide - for details. + If so, the documentation on this site +will not apply directly to your setup. If you want to use the documentation + that you find here, you will want to consider uninstalling what you +have and installing a setup that matches the documentation on +this site. See the Two-interface QuickStart + Guide for details. +

      - +

      News

      + + +

      7/20/2003 - Shorewall-1.4.6 (New) +
      +

      + -

      7/15/2003 - New Mirror in Brazil (New) -
      -

      - Thanks to the folks at securityopensource.org.br, there is now a Shorewall - mirror in Brazil. -

      7/15/2003 - Shorewall-1.4.6 RC 1 (New) -
      -

      - -
      http://shorewall.net/pub/shorewall/testing
      - ftp://shorewall.net/pub/shorewall/testing
      -

      Problems Corrected:
      -

      - +

      +
        -
      1. A problem seen on RH7.3 systems where Shorewall encountered - start errors when started using the "service" mechanism has been worked -around.
        +
      2. A problem seen on RH7.3 systems where Shorewall encountered + start errors when started using the "service" mechanism has been worked + around.

        3. -
      3. Where a list of IP addresses appears in the DEST column of - a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the - nat table (one for each element in the list). Shorewall now correctly creates +
      4. Where a list of IP addresses appears in the DEST column of +a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the + nat table (one for each element in the list). Shorewall now correctly creates a single DNAT rule with multiple "--to-destination" clauses.
        -
        -
        5. -
      5. Corrected a problem in Beta 1 where DNS names containing -a "-" were mis-handled when they appeared in the DEST column of a rule.
        -
        -
        6. -
      6. A number of problems with rule parsing have been -corrected. Corrections involve the handling of "z1!z2" in the SOURCE column -as well as lists in the ORIGINAL DESTINATION column.
        -
        7. - +
        + +
      7. Corrected a problem in Beta 1 where DNS names containing a +"-" were mis-handled when they appeared in the DEST column of a rule.
        +
        +
        8. +
      8. A number of problems with rule parsing have been corrected. + Corrections involve the handling of "z1!z2" in the SOURCE column as well +as lists in the ORIGINAL DESTINATION column.
        +
        +
        9. +
      9. The message "Adding rules for DHCP" is now suppressed if there +are no DHCP rules to add.
      - +

      Migration Issues:
      -

      - +

      +
        -
      1. In earlier versions, an undocumented feature allowed entries - in the host file as follows:
        -
        -     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
        -
        - This capability was never documented and has been removed in 1.4.6 to - allow entries of the following format:
        -
        -     z   eth1:192.168.1.0/24,192.168.2.0/24
        -
        -
        2. -
      2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have - been removed from /etc/shorewall/shorewall.conf. These capabilities are -now automatically detected by Shorewall (see below).
        -
        3. - -
      - -

      New Features:
      -

      - -
        -
      1. A 'newnotsyn' interface option has been added. This option - may be specified in /etc/shorewall/interfaces and overrides the setting -NEWNOTSYN=No for packets arriving on the associated interface.
        -
        -
        2. -
      2. The means for specifying a range of IP addresses in /etc/shorewall/masq - to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for -address ranges.
        -
        -
        3. -
      3. Shorewall can now add IP addresses to subnets other than -the first one on an interface.
        -
        -
        4. -
      4. DNAT[-] rules may now be used to load balance (round-robin) - over a set of servers. Servers may be specified in a range of addresses - given as <first address>-<last address>.
        -
        - Example:
        -
        -     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
        -
        -
        5. -
      5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration - options have been removed and have been replaced by code that detects whether - these capabilities are present in the current kernel. The output of the -start, restart and check commands have been enhanced to report the outcome:
        -
        - Shorewall has detected the following iptables/netfilter capabilities:
        -    NAT: Available
        -    Packet Mangling: Available
        -    Multi-port Match: Available
        - Verifying Configuration...
        -
        -
        6. -
      6. Support for the Connection Tracking Match Extension has been - added. This extension is available in recent kernel/iptables releases -and allows for rules which match against elements in netfilter's connection - tracking table. Shorewall automatically detects the availability of this - extension and reports its availability in the output of the start, restart - and check commands.
        -
        - Shorewall has detected the following iptables/netfilter capabilities:
        -    NAT: Available
        -    Packet Mangling: Available
        -    Multi-port Match: Available
        -    Connection Tracking Match: Available
        - Verifying Configuration...
        -
        - If this extension is available, the ruleset generated by Shorewall -is changed in the following ways:
        7. - -
          -
        • To handle 'norfc1918' filtering, Shorewall will not create - chains in the mangle table but will rather do all 'norfc1918' filtering - in the filter table (rfc1918 chain).
          • -
        • Recall that Shorewall DNAT rules generate two netfilter -rules; one in the nat table and one in the filter table. If the Connection -Tracking Match Extension is available, the rule in the filter table is extended -to check that the original destination address was the same as specified -(or defaulted to) in the DNAT rule.
          +
        • In earlier versions, an undocumented feature allowed entries + in the host file as follows:
          +
          +     z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
          +
          + This capability was never documented and has been removed in 1.4.6 + to allow entries of the following format:
          +
          +     z   eth1:192.168.1.0/24,192.168.2.0/24

          • - -
        -
      7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) - may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
        -
        -
        8. -
      8. An 'ipcalc' command has been added to /sbin/shorewall.
        -
        -       ipcalc [ <address> <netmask> | <address>/<vlsm> - ]
        -
        - Examples:
        -
        -       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
        -          CIDR=192.168.1.0/24
        -          NETMASK=255.255.255.0
        -          NETWORK=192.168.1.0
        -          BROADCAST=192.168.1.255
        -       [root@wookie root]#
        -
        -       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
        -          CIDR=192.168.1.0/24
        -          NETMASK=255.255.255.0
        -          NETWORK=192.168.1.0
        -          BROADCAST=192.168.1.255
        -       [root@wookie root]#
        -
        - Warning:
        -
        - If your shell only supports 32-bit signed arithmatic (ash or dash), -then the ipcalc command produces incorrect information for IP addresses -128.0.0.0-1 and for /1 networks. Bash should produce correct information -for all valid IP addresses.
        -
        -
        9. -
      9. An 'iprange' command has been added to /sbin/shorewall.
        -
        -       iprange <address>-<address>
        -
        - This command decomposes a range of IP addressses into a list of network - and host addresses. The command can be useful if you need to construct -an efficient set of rules that accept connections from a range of network -addresses.
        -
        - Note: If your shell only supports 32-bit signed arithmetic (ash or dash) - then the range may not span 128.0.0.0.
        -
        - Example:
        -
        -       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
        -       192.168.1.4/30
        -       192.168.1.8/29
        -       192.168.1.16/28
        -       192.168.1.32/27
        -       192.168.1.64/26
        -       192.168.1.128/25
        -       192.168.2.0/23
        -       192.168.4.0/22
        -       192.168.8.0/22
        -       192.168.12.0/29
        -       192.168.12.8/31
        -       [root@gateway root]#
        -
        -
        10. -
      10. A list of host/net addresses is now allowed in an entry in - /etc/shorewall/hosts.
        -
        - Example:
        -
        -     foo    eth1:192.168.1.0/24,192.168.2.0/24
        11. - +
      11. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options +have been removed from /etc/shorewall/shorewall.conf. These capabilities +are now automatically detected by Shorewall (see below).
        +
        12. +
      - + +

      New Features:
      +

      +
        - +
      1. A 'newnotsyn' interface option has been added. This option + may be specified in /etc/shorewall/interfaces and overrides the setting + NEWNOTSYN=No for packets arriving on the associated interface.
        +
        +
        2. +
      2. The means for specifying a range of IP addresses in /etc/shorewall/masq + to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for + address ranges.
        +
        +
        3. +
      3. Shorewall can now add IP addresses to subnets other than + the first one on an interface.
        +
        +
        4. +
      4. DNAT[-] rules may now be used to load balance (round-robin) + over a set of servers. Servers may be specified in a range of addresses + given as <first address>-<last address>.
        +
        + Example:
        +
        +     DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
        +
        +
        5. +
      5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration + options have been removed and have been replaced by code that detects +whether these capabilities are present in the current kernel. The output +of the start, restart and check commands have been enhanced to report the +outcome:
        +
        + Shorewall has detected the following iptables/netfilter capabilities:
        +    NAT: Available
        +    Packet Mangling: Available
        +    Multi-port Match: Available
        + Verifying Configuration...
        +
        +
        6. +
      6. Support for the Connection Tracking Match Extension has + been added. This extension is available in recent kernel/iptables releases + and allows for rules which match against elements in netfilter's connection + tracking table. Shorewall automatically detects the availability of this + extension and reports its availability in the output of the start, restart + and check commands.
        +
        + Shorewall has detected the following iptables/netfilter capabilities:
        +    NAT: Available
        +    Packet Mangling: Available
        +    Multi-port Match: Available
        +    Connection Tracking Match: Available
        + Verifying Configuration...
        +
        + If this extension is available, the ruleset generated by Shorewall + is changed in the following ways:
        7. + +
          +
        • To handle 'norfc1918' filtering, Shorewall will not +create chains in the mangle table but will rather do all 'norfc1918' +filtering in the filter table (rfc1918 chain).
          • +
        • Recall that Shorewall DNAT rules generate two netfilter + rules; one in the nat table and one in the filter table. If the Connection + Tracking Match Extension is available, the rule in the filter table is +extended to check that the original destination address was the same as +specified (or defaulted to) in the DNAT rule.
          +
          +
          • + +
        +
      7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) + may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
        +
        +
        8. +
      8. An 'ipcalc' command has been added to /sbin/shorewall.
        +
        +       ipcalc [ <address> <netmask> | <address>/<vlsm> + ]
        +
        + Examples:
        +
        +       [root@wookie root]# shorewall ipcalc 192.168.1.0/24
        +          CIDR=192.168.1.0/24
        +          NETMASK=255.255.255.0
        +          NETWORK=192.168.1.0
        +          BROADCAST=192.168.1.255
        +       [root@wookie root]#
        +
        +       [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
        +          CIDR=192.168.1.0/24
        +          NETMASK=255.255.255.0
        +          NETWORK=192.168.1.0
        +          BROADCAST=192.168.1.255
        +       [root@wookie root]#
        +
        + Warning:
        +
        + If your shell only supports 32-bit signed arithmatic (ash or dash), + then the ipcalc command produces incorrect information for IP addresses + 128.0.0.0-1 and for /1 networks. Bash should produce correct information + for all valid IP addresses.
        +
        +
        9. +
      9. An 'iprange' command has been added to /sbin/shorewall. +
        +
        +       iprange <address>-<address>
        +
        + This command decomposes a range of IP addressses into a list of network + and host addresses. The command can be useful if you need to construct +an efficient set of rules that accept connections from a range of network +addresses.
        +
        + Note: If your shell only supports 32-bit signed arithmetic (ash or + dash) then the range may not span 128.0.0.0.
        +
        + Example:
        +
        +       [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
        +       192.168.1.4/30
        +       192.168.1.8/29
        +       192.168.1.16/28
        +       192.168.1.32/27
        +       192.168.1.64/26
        +       192.168.1.128/25
        +       192.168.2.0/23
        +       192.168.4.0/22
        +       192.168.8.0/22
        +       192.168.12.0/29
        +       192.168.12.8/31
        +       [root@gateway root]#
        +
        +
        10. +
      10. A list of host/net addresses is now allowed in an entry + in /etc/shorewall/hosts.
        +
        + Example:
        +
        +     foo    eth1:192.168.1.0/24,192.168.2.0/24
        +
        +
        11. +
      11. The "shorewall check" command now includes the chain +name when printing the applicable policy for each pair of zones.
        +  
        +     Example:
        +  
        +         Policy for dmz to net is REJECT using chain all2all
        +  
        + This means that the policy for connections from the dmz to the internet +is REJECT and the applicable entry in the /etc/shorewall/policy was the all->all +policy.
        +
        +
        12. +
      12. Support for the 2.6 Kernel series has been added.
        +
        13. +
      - + + +
        + + +
      + + +

      7/15/2003 - New Mirror in Brazil (New) +
      +

      + Thanks to the folks at securityopensource.org.br, there is now a Shorewall + mirror in Brazil

      6/17/2003 - Shorewall-1.4.5

      - +

      Problems Corrected:
      -

      +

      - +
        -
      1. The command "shorewall debug try <directory>" - now correctly traces the attempt.
        2. -
      2. The INCLUDE directive now works properly in the zones - file; previously, INCLUDE in that file was ignored.
        3. -
      3. /etc/shorewall/routestopped records with an empty -second column are no longer ignored.
        -
        4. +
      4. The command "shorewall debug try <directory>" + now correctly traces the attempt.
        5. +
      5. The INCLUDE directive now works properly in the +zones file; previously, INCLUDE in that file was ignored.
        6. +
      6. /etc/shorewall/routestopped records with an empty + second column are no longer ignored.
        +
        7. - +
      - +

      New Features:
      -

      +

      - +
        -
      1. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] - rule may now contain a list of addresses. If the list begins with "!' -then the rule will take effect only if the original destination address -in the connection request does not match any of the addresses listed.
        2. +
      2. The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] + rule may now contain a list of addresses. If the list begins with "!' + then the rule will take effect only if the original destination address + in the connection request does not match any of the addresses listed.
        3. - +
      - -

      6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8 -

      - The firewall at shorewall.net has been upgraded to the 2.4.21 - kernel and iptables 1.2.8 (using the "official" RPM from netfilter.org). - No problems have been encountered with this set of software. The Shorewall - version is 1.4.4b plus the accumulated changes for 1.4.5. + +

      6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8 +

      + The firewall at shorewall.net has been upgraded to the 2.4.21 + kernel and iptables 1.2.8 (using the "official" RPM from netfilter.org). + No problems have been encountered with this set of software. The Shorewall + version is 1.4.4b plus the accumulated changes for 1.4.5. +

      6/8/2003 - Updated Samples

      - -

      Thanks to Francesca Smith, the samples have been updated to Shorewall - version 1.4.4.

      + +

      Thanks to Francesca Smith, the samples have been updated to Shorewall + version 1.4.4.

      - +

      - + +
        - +
      - +

      - +

      - -
      + +
      - +
        - +
      -
      +
      - +

      - + - +

      More News

      - + - +

      - + - +

      (Leaf Logo) - Jacques Nilo and Eric - Wolzak have a LEAF (router/firewall/gateway - on a floppy, CD or compact flash) distribution - called Bering that - features Shorewall-1.4.2 and Kernel-2.4.20. - You can find their work at: + Jacques Nilo and Eric + Wolzak have a LEAF (router/firewall/gateway + on a floppy, CD or compact flash) distribution + called Bering that + features Shorewall-1.4.2 and Kernel-2.4.20. + You can find their work at: http://leaf.sourceforge.net/devel/jnilo

      - Congratulations to Jacques - and Eric on the recent release of Bering + Congratulations to Jacques + and Eric on the recent release of Bering 1.2!!!
      - + +

      SourceForge Logo -

      - +       + - +

      - + - +

      This site is hosted by the generous folks at SourceForge.net

      - + - +

      Donations

      - -       		+ - +
      + action="http://lists.shorewall.net/cgi-bin/htsearch"> - +


      - Note:       - Search is unavailable Daily - 0200-0330 GMT.
      -  

      - - - - -

      Quick Search
      - -

      - -
      - - - - -

      Extended Search

      - -
      -
      - -
      - -
      - - - - - - - - - + + + + + + +
      + Note: + Search is unavailable Daily 0200-0330 GMT.
      +  

      +

      Quick Search
      + +

      + + + + + + +

      Extended Search

      + +
      +
      + +
      + +
      + + + + + + + + + + - + - - + +
      + + + + +

      -

      +

      - - + +


      - Shorewall is free but if you try - it and find it useful, please consider making a donation - to - Starlight - Children's Foundation. Thanks!

      + Shorewall is free but if you +try it and find it useful, please consider making a donation + to + Starlight + Children's Foundation. Thanks!

      -
      - -

      Updated 7/15/2003 - Tom Eastep -
      -

      -
      + +

      Updated 7/19/2003 - Tom Eastep +
      +

      diff --git a/Shorewall/fallback.sh b/Shorewall/fallback.sh index 57f79d550..bae84ca68 100755 --- a/Shorewall/fallback.sh +++ b/Shorewall/fallback.sh @@ -28,7 +28,7 @@ # shown below. Simply run this script to revert to your prior version of # Shoreline Firewall. -VERSION=1.4.6RC1 +VERSION=1.4.6 usage() # $1 = exit status { diff --git a/Shorewall/install.sh b/Shorewall/install.sh index 7b034d70a..8cc393dff 100755 --- a/Shorewall/install.sh +++ b/Shorewall/install.sh @@ -54,7 +54,7 @@ # /etc/rc.d/rc.local file is modified to start the firewall. # -VERSION=1.4.6RC1 +VERSION=1.4.6 usage() # $1 = exit status { diff --git a/Shorewall/shorewall.spec b/Shorewall/shorewall.spec index 2d27b5060..4f22e88b5 100644 --- a/Shorewall/shorewall.spec +++ b/Shorewall/shorewall.spec @@ -1,6 +1,6 @@ %define name shorewall %define version 1.4.6 -%define release 0RC1 +%define release 1 %define prefix /usr Summary: Shoreline Firewall is an iptables-based firewall for Linux systems. @@ -105,6 +105,8 @@ fi %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel %changelog +* Sat Jul 19 2003 Tom Eastep +- Changed version to 1.4.6-1 * Mon Jul 14 2003 Tom Eastep - Changed version to 1.4.6-0RC1 * Mon Jul 07 2003 Tom Eastep diff --git a/Shorewall/uninstall.sh b/Shorewall/uninstall.sh index 2c626790f..16e4cb057 100755 --- a/Shorewall/uninstall.sh +++ b/Shorewall/uninstall.sh @@ -26,7 +26,7 @@ # You may only use this script to uninstall the version # shown below. Simply run this script to remove Seattle Firewall -VERSION=1.4.6RC1 +VERSION=1.4.6 usage() # $1 = exit status {