diff --git a/Shorewall-lite/manpages/shorewall-lite.xml b/Shorewall-lite/manpages/shorewall-lite.xml index ae3b19b25..969d17f6b 100644 --- a/Shorewall-lite/manpages/shorewall-lite.xml +++ b/Shorewall-lite/manpages/shorewall-lite.xml @@ -533,8 +533,9 @@ The nolock prevents the command from attempting to acquire the Shorewall-lite lockfile. It is useful if you - need to include shorewall commands in - /etc/shorewall/started. + need to include shorewall commands in the + started extension script. The options control the amount of output that the command produces. They consist of a sequence of the letters v adds one to the effective verbosity and each q subtracts one from the effective VERBOSITY. Alternately, v may be followed - immediately with one of -1,0,1,2 to specify a specify VERBOSITY. There may - be no white-space between v and the + immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no + white-space between v and the VERBOSITY. The options may also include the letter diff --git a/Shorewall6-lite/manpages/shorewall6-lite.xml b/Shorewall6-lite/manpages/shorewall6-lite.xml index 6939334ab..ed6fc3f59 100644 --- a/Shorewall6-lite/manpages/shorewall6-lite.xml +++ b/Shorewall6-lite/manpages/shorewall6-lite.xml @@ -536,8 +536,9 @@ The option prevents the command from attempting to acquire the shorewall6-lite lockfile. It is useful if you - need to include shorewall commands in - /etc/shorewall/started. + need to include shorewall commands in the + started extension script. The options control the amount of output that the command produces. They consist of a sequence of the letters v adds one to the effective verbosity and each q subtracts one from the effective VERBOSITY. Alternately, v may be followed - immediately with one of -1,0,1,2 to specify a specify VERBOSITY. There may - be no white-space between v and the + immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no + white-space between v and the VERBOSITY. The options may also include the letter @@ -570,16 +571,16 @@ Adds a list of hosts or subnets to a dynamic zone usually used with VPN's. - The interface argument names an interface - defined in the The interface argument names an + interface defined in the shorewall-interfaces(5) - file. A host-list is comma-separated list whose - elements are host or network addresses. + file. A host-list is comma-separated list + whose elements are host or network addresses. The add command is not very robust. If - there are errors in the host-list, - you may see a large number of error messages yet a subsequent + there are errors in the host-list, you + may see a large number of error messages yet a subsequent shorewall6-lite show zones command will indicate that all hosts were added. If this happens, replace add by delete and run the @@ -593,9 +594,9 @@ Re-enables receipt of packets from hosts previously - blacklisted by a drop, logdrop, - reject, or logreject - command. + blacklisted by a drop, + logdrop, reject, or + logreject command. @@ -625,8 +626,8 @@ The interface argument names an interface defined in the shorewall-interfaces(5) - file. A host-list is comma-separated - list whose elements are a host or network address. + file. A host-list is comma-separated list + whose elements are a host or network address. @@ -646,8 +647,8 @@ drop - Causes traffic from the listed addresses - to be silently dropped. + Causes traffic from the listed + addresses to be silently dropped. @@ -658,15 +659,15 @@ Produces a verbose report about the firewall configuration for the purpose of problem analysis. - The option causes actual - packet and byte counts to be displayed. Without that option, these - counts are abbreviated. - + The option causes actual packet and byte + counts to be displayed. Without that option, these counts are + abbreviated. + The option causes any MAC addresses included in shorewall6-lite log messages to be displayed. - The option causes the rule - number for each Netfilter rule to be displayed. + The option causes the rule number for each + Netfilter rule to be displayed. @@ -686,10 +687,11 @@ forget - Deletes /var/lib/shorewall6-lite/filename + Deletes + /var/lib/shorewall6-lite/filename and /var/lib/shorewall6-lite/save. If no - filename is given then the file specified by - RESTOREFILE in filename is given then the file specified + by RESTOREFILE in shorewall6.conf(5) is assumed. @@ -755,10 +757,11 @@ logdrop - Causes traffic from the listed addresses - to be logged then discarded. Logging occurs at the log level - specified by the BLACKLIST_LOGLEVEL setting in shorewall6.conf (5). + Causes traffic from the listed + addresses to be logged then discarded. + Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL + setting in shorewall6.conf + (5). @@ -771,16 +774,16 @@ produces an audible alarm when new shorewall6-lite messages are logged. - The option causes the - MAC address of each packet source to be displayed if that - information is available. - - The refresh-interval specifies - the time in seconds between screen refreshes. You can enter a - negative number by preceding the number with "--" (e.g., - shorewall6-lite logwatch -- -30). In this - case, when a packet count changes, you will be prompted to hit - any key to resume screen refreshes. + The option causes the MAC address of each + packet source to be displayed if that information is + available. + + The refresh-interval specifies the + time in seconds between screen refreshes. You can enter a negative + number by preceding the number with "--" (e.g., + shorewall6-lite logwatch -- -30). In this case, + when a packet count changes, you will be prompted to hit any key to + resume screen refreshes. @@ -788,10 +791,11 @@ logreject - Causes traffic from the listed addresses - to be logged then rejected. Logging occurs at the log level - specified by the BLACKLIST_LOGLEVEL setting in shorewall6.conf (5). + Causes traffic from the listed + addresses to be logged then rejected. + Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL + setting in shorewall6.conf + (5). @@ -822,8 +826,8 @@ Restart is similar to shorewall6-lite start - except that it assumes that the firewall is already - started. Existing connections are maintained. + except that it assumes that the firewall is already started. + Existing connections are maintained. If your ip6tables ruleset depends on variables that are @@ -854,17 +858,19 @@ Restore shorewall6-lite to a state saved using the shorewall6-lite save command. Existing - connections are maintained. The filename names - a restore file in /var/lib/shorewall6-lite - created using shorewall6-lite save; if no - filename is given then shorewall6-lite will be - restored from the file specified by the RESTOREFILE option in filename + names a restore file in /var/lib/shorewall6-lite created using + shorewall6-lite save; if no + filename is given then shorewall6-lite + will be restored from the file specified by the RESTOREFILE option + in shorewall6.conf(5). The option was added in Shorewall 4.6.5. If the option was specified during - shorewall7-lite save, then the counters saved - by that operation will be restored. + shorewall7-lite save, then the counters saved by + that operation will be restored. @@ -890,12 +896,12 @@ The dynamic blacklist is stored in - /var/lib/shorewall6-lite/save. The state of - the firewall is stored in + /var/lib/shorewall6-lite/save. The state of the + firewall is stored in /var/lib/shorewall6-lite/filename for use by the shorewall6-lite restore command. - If filename is not given then the state is saved - in the file specified by the RESTOREFILE option in filename is not given then the state + is saved in the file specified by the RESTOREFILE option in shorewall6.conf(5). The option, added in Shorewall 4.6.5, @@ -918,10 +924,10 @@ Added in Shorewall 4.6.2. Displays the dynamic chain along with any chains produced by entries in - shorewall6-blrules(5).The - option is passed directly through to ip6tables and causes - actual packet and byte counts to be displayed. Without this - option, those counts are abbreviated. + shorewall6-blrules(5).The option is passed + directly through to ip6tables and causes actual packet and + byte counts to be displayed. Without this option, those counts + are abbreviated. @@ -930,9 +936,9 @@ Displays your kernel/iptables capabilities. The - option causes the display - to be formatted as a capabilities file for use with - compile -e. + option causes the display to be formatted + as a capabilities file for use with compile + -e. @@ -948,24 +954,22 @@ chain is given, all of the chains in the filter table are displayed. - The option - is passed directly through to iptables and causes actual - packet and byte counts to be displayed. Without this option, - those counts are abbreviated. + The option is passed directly + through to iptables and causes actual packet and byte counts + to be displayed. Without this option, those counts are + abbreviated. - The option specifies the - Netfilter table to display. The default is The option specifies the Netfilter + table to display. The default is filter. - The ('brief') option - causes rules which have not been used (i.e. which have zero - packet and byte counts) to be omitted from the output. Chains - with no rules displayed are also omitted from the - output. + The ('brief') option causes rules + which have not been used (i.e. which have zero packet and byte + counts) to be omitted from the output. Chains with no rules + displayed are also omitted from the output. - The option causes - the rule number for each Netfilter rule to be - displayed. + The option causes the rule number + for each Netfilter rule to be displayed. If the option and the keyword are both omitted and any of the @@ -1047,9 +1051,9 @@ log file specified by the LOGFILE option in shorewall6.conf(5). - The option causes the MAC - address of each packet source to be displayed if that - information is available. + The option causes the MAC address of + each packet source to be displayed if that information is + available. @@ -1069,9 +1073,9 @@ Displays the Netfilter nat table using the command iptables -t nat -L -n -v.The - option is passed directly - through to iptables and causes actual packet and byte counts - to be displayed. Without this option, those counts are + option is passed directly through to + iptables and causes actual packet and byte counts to be + displayed. Without this option, those counts are abbreviated. @@ -1102,9 +1106,9 @@ Displays the Netfilter raw table using the command iptables -t raw -L -n -v.The - option is passed directly - through to iptables and causes actual packet and byte counts - to be displayed. Without this option, those counts are + option is passed directly through to + iptables and causes actual packet and byte counts to be + displayed. Without this option, those counts are abbreviated. @@ -1156,8 +1160,8 @@ and is only meaningful when the option is also specified. If the previously-saved configuration is restored, and if the option was also specified in the - save command, then the packet and byte - counters will be restored. + save command, then the packet and byte counters + will be restored.