shorewall68shorewall6Administration tool for Shoreline Firewall 6
(Shorewall6)shorewall6|-optionsinterface[:host-list]zoneshorewall6|-optionsaddressshorewall6|-optionsdirectoryshorewall6|-optionsshorewall6|-optionsdirectorypathnameshorewall6|-optionsaddressshorewall6|-optionsshorewall6|-optionsdirectory1[user@]system[directory2]shorewall6|-optionsfilenameshorewall6|-optionsshorewall6|-optionsiptables match
expressionshorewall6|-optionsroot-user-namedirectorysystemshorewall6|-optionsaddressshorewall6|-optionsrefresh-intervalshorewall6|-optionsaddressshorewall6|-optionsiptables match
expressionshorewall6|-optionschainshorewall6|-optionsaddressshorewall6|-optionsroot-user-namedirectorysystemshorewall6|-optionsshorewall6|-optionsdirectoryshorewall6|-optionsfilenameshorewall6|-optionsdirectoryshorewall6|-optionsdirectoryshorewall6|-optionsfilenameshorewall6|-options
{||}chainshorewall6|-optionsshorewall6|-optionsshorewall6|-optionsshorewall6|-optionsshorewall6|-optionsdirectoryshorewall6|-optionsshorewall6|-optionsshorewall6|-optionsdirectorytimeoutshorewall6|-optionsdirectoryshorewall6|-optionsDescriptionThe shorewall6 utility is used to control the Shoreline Firewall 6
(Shorewall6).OptionsThe and options are
used for debugging. See http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace.The nolock prevents the command from
attempting to acquire the Shorewall6 lockfile. It is useful if you need to
include shorewall6 commands in
/etc/shorewall6/started.The options control the amount of output that
the command produces. They consist of a sequence of the letters v and q. If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in shorewall6.conf(5). Each v adds one to the effective verbosity and each
q subtracts one from the effective
VERBOSITY. Anternately, v may be followed
immediately with one of -1,0,1,2 to specify a specify VERBOSITY. There may
be no white space between v and the
VERBOSITY.The options may also include the letter
which causes all progress messages to be
timestamped.CommandsThe available commands are listed below.addAdded in Shorewall 4.4.21. Adds a list of hosts or subnets to
a dynamic zone usually used with VPN's.The interface argument names an interface
defined in the shorewall6-interfaces(5)
file. A host-list is comma-separated list whose
elements are host or network addresses.The add command is not very robust. If
there are errors in the host-list,
you may see a large number of error messages yet a subsequent
shorewall show zones command will indicate
that all hosts were added. If this happens, replace
add by delete and run the
same command again. Then enter the correct command.allowRe-enables receipt of packets from hosts previously
blacklisted by a drop, logdrop, reject, or logreject command.checkCompiles the configuraton in the specified
directory and discards the compiled output
script. If no directory is given, then
/etc/shorewall6 is assumed.The -e option causes the
compiler to look for a file named capabilities. This file is
produced using the command shorewall6-lite
show -f capabilities > capabilities on a system with
Shorewall6 Lite installed.The option causes the compiler to be run
under control of the Perl debugger.The option causes the compiler to be
profiled via the Perl command-line
option.The option was added in Shorewall 4.5.2
and causes the compiler to print the generated ruleset to standard
out.The option was added in Shorewall 4.4.20
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.clearClear will remove all rules and chains installed by
Shorewall6. The firewall is then wide open and unprotected. Existing
connections are untouched. Clear is often used to see if the
firewall is causing connection problems.compileCompiles the current configuration into the executable file
pathname. If a directory is supplied,
Shorewall6 will look in that directory first for configuration
files. If the pathname is omitted, the file
firewall in the VARDIR (normally /var/lib/shorewall/) is assumed. A
pathname of '-' causes the compiler to send the
generated script to it's standard output file. Note that '-v-1' is
usually specified in this case (e.g., shorewall6 -v-1
compile -- -) to suppress the 'Compiling...' message
normally generated by /sbin/shorewall6.When -e is specified, the compilation is being performed on a
system other than where the compiled script will run. This option
disables certain configuration options that require the script to be
compiled where it is to be run. The use of -e requires the presense
of a configuration file named capabilities
which may be produced using the command shorewall6-lite show -f capabilities >
capabilities on a system with Shorewall6 Lite
installedThe option causes the compiler to be run
under control of the Perl debugger.The option causes the compiler to be
profiled via the Perl command-line
option.The option was added in Shorewall 4.4.20
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.deleteAdded in Shorewall 4.4.21. The delete command reverses the
effect of an earlier add
command.The interface argument names an interface
defined in the shorewall6-interfaces(5)
file. A host-list is comma-separated list whose
elements are a host or network address.dropCauses traffic from the listed addresses
to be silently dropped.dumpProduces a verbose report about the firewall configuration for
the purpose of problem analysis.The -x option causes actual
packet and byte counts to be displayed. Without that option, these
counts are abbreviated. The -m
option causes any MAC addresses included in Shorewall6 log messages
to be displayed.The -l option causes the rule
number for each Netfilter rule to be displayed.exportIf directory1 is omitted, the current
working directory is assumed.Allows a non-root user to compile a shorewall6 script and
stage it on a system (provided that the user has access to the
system via ssh). The command is equivalent to:/sbin/shorewall6 compile -edirectory1directory1/firewall &&\scp directory1/firewalldirectory1/firewall.conf [user@]system:[directory2]In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall and firewall.conf
are copied to system using scp.forgetDeletes /var/lib/shorewall6/filename and
/var/lib/shorewall6/save. If no filename is
given then the file specified by RESTOREFILE in shorewall6.conf(5) is
assumed.helpDisplays a syntax summary.iptraceThis is a low-level debugging command that causes iptables
TRACE log records to be created. See ip6tables(8) for
details.The ip6tables match expression must
be one or more matches that may appear in both the raw table OUTPUT
and raw table PREROUTING chains.The trace records are written to the kernel's log buffer with
faciility = kernel and priority = warning, and they are routed from
there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
Shorewall has no control over where the messages go; consult your
logging daemon's documentation.loadIf directory is omitted, the current
working directory is assumed. Allows a non-root user to compile a
shorewall6 script and install it on a system (provided that the user
has root access to the system via ssh). The command is equivalent
to:/sbin/shorewall6 compile -edirectorydirectory/firewall &&\scpdirectory/firewalldirectory/firewall.confroot@system:/var/lib/shorewall6-lite/ &&\ssh root@system'/sbin/shorewall6-lite start'In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall is copied to
system using scp. If the copy succeeds,
Shorewall6 Lite on system is started via
ssh.If -s is specified and the
start command succeeds, then the
remote Shorewall6-lite configuration is saved by executing shorewall6-lite save via ssh.if -c is included, the
command shorewall6-lite show capabilities -f
> /var/lib/shorewall6-lite/capabilities is executed
via ssh then the generated file is copied to
directory using scp. This step is
performed before the configuration is compiled.If is included, it specifies that the root
user on system is named
root-user-name rather than "root".logdropCauses traffic from the listed addresses
to be logged then discarded. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall6.conf (5).logwatchMonitors the log file specified by the LOGFILE option in
shorewall6.conf(5) and
produces an audible alarm when new Shorewall6 messages are logged.
The -m option causes the MAC
address of each packet source to be displayed if that information is
available. The refresh-interval specifies
the time in seconds between screen refreshes. You can enter a
negative number by preceding the number with "--" (e.g.,
shorewall6 logwatch -- -30). In this case, when a
packet count changes, you will be prompted to hit any key to resume
screen refreshes.logrejectCauses traffic from the listed addresses
to be logged then rejected. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall6.conf (5).noiptraceThis is a low-level debugging command that cancels a trace
started by a preceding iptrace command.The iptables match expression must
be one given in the iptrace command being
cancelled.refreshAll steps performed by restart are
performed by refresh with the exception that
refresh only recreates the chains specified in
the command while restart recreates the entire
Netfilter ruleset.When no chain name is given to the refresh command, the mangle table is
refreshed along with the blacklist chain (if any). This allows you
to modify /etc/shorewall6/tcrulesand install
the changes using refresh.The listed chains are assumed to be in the filter table. You
can refresh chains in other tables by prefixing the chain name with
the table name followed by ":" (e.g., nat:net_dnat). Chain names
which follow are assumed to be in that table until the end of the
list or until an entry in the list names another table. Built-in
chains such as FORWARD may not be refreshed.Example:shorewall6 refresh net2fw nat:net_dnat #Refresh the 'net2loc' chain in the filter table and the 'net_dnat' chain in the nat tablereloadIf directory is omitted, the current
working directory is assumed. Allows a non-root user to compile a
shorewall6 script and install it on a system (provided that the user
has root access to the system via ssh). The command is equivalent
to:/sbin/shorewall6 compile -edirectorydirectory/firewall &&\scpdirectory/firewalldirectory/firewall.confroot@system:/var/lib/shorewall6-lite/ &&\ssh root@system'/sbin/shorewall6-lite restart'In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall is copied to
system using scp. If the copy succeeds,
Shorewall6 Lite on system is restarted via
ssh.If -s is specified and the
restart command succeeds, then the
remote Shorewall6-lite configuration is saved by executing shorewall6-lite save via ssh.if -c is included, the
command shorewall6-lite show capabilities -f
> /var/lib/shorewall6-lite/capabilities is executed
via ssh then the generated file is copied to
directory using scp. This step is performed
before the configuration is compiled.If is included, it specifies that the root
user on system is named
root-user-name rather than "root".reset [chain,
...]Resets the packet and byte counters in the specified
chain(s). If no
chain is specified, all the packet and
byte counters in the firewall are reset.restartRestart is similar to shorewall6
start except that it assumes that the firewall is already
started. Existing connections are maintained. If a
directory is included in the command,
Shorewall6 will look in that directory first
for configuration files.The option causes Shorewall6 to avoid
updating the routing table(s).The option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.The option causes the compiler to run
under the Perl debugger.The option suppresses the compilation step
and simply reused the compiled script which last started/restarted
Shorewall, provided that /etc/shorewall6 and its contents have not
been modified since the last start/restart.The option was added in Shorewall 4.4.20
and performs the compilation step unconditionally, overriding the
AUTOMAKE setting in shorewall6.conf(5). When both
and are present, the result
is determined by the option that appears last.restoreRestore Shorewall6 to a state saved using the shorewall6 save command. Existing connections
are maintained. The filename names a restore
file in /var/lib/shorewall6 created using shorewall6 save; if no
filename is given then Shorewall6 will be
restored from the file specified by the RESTOREFILE option in shorewall6.conf(5).safe-restartOnly allowed if Shorewall6 is running. The current
configuration is saved in /var/lib/shorewall6/safe-restart (see the
save command below) then a shorewall6
restart is done. You will then be prompted asking if you
want to accept the new configuration or not. If you answer "n" or if
you fail to answer within 60 seconds (such as when your new
configuration has disabled communication with your terminal), the
configuration is restored from the saved configuration. If a
directory is given, then Shorewall6 will look in that directory
first when opening configuration files.safe-startShorewall6 is started normally. You will then be prompted
asking if everything went all right. If you answer "n" or if you
fail to answer within 60 seconds (such as when your new
configuration has disabled communication with your terminal), a
shorewall6 clear is performed for you. If a directory is given, then
Shorewall6 will look in that directory first when opening
configuration files.saveThe dynamic blacklist is stored in /var/lib/shorewall6/save.
The state of the firewall is stored in
/var/lib/shorewall6/filename for use by the
shorewall6 restore and shorewall6 -f start commands. If
filename is not given then the state is saved
in the file specified by the RESTOREFILE option in shorewall6.conf(5).showThe show command can have a number of different
arguments:actionsProduces a report about the available actions (built-in,
standard and user-defined).capabilitiesDisplays your kernel/ip6tables capabilities. The
-f option causes the display
to be formatted as a capabilities file for use with compile -e.[ [ ] chain...
]The rules in each chain are
displayed using the ip6tables
-Lchain-n -v command. If no
chain is given, all of the chains in the
filter table are displayed. The -x option is passed directly through to
ip6tables and causes actual packet and byte counts to be
displayed. Without this option, those counts are abbreviated.
The -t option specifies the
Netfilter table to display. The default is filter.The -l option causes
the rule number for each Netfilter rule to be
displayed.If the -t option and
the keyword are both omitted and any of
the listed chains do not exist, a
usage message is displayed.classifiers|filtersDisplays information about the packet classifiers
defined on the system as a result of traffic shaping
configuration.configDispays distribution-specific defaults.connectionsDisplays the IP connections currently being tracked by
the firewall.ipDisplays the system's IPv6 configuration.logDisplays the last 20 Shorewall6 messages from the log
file specified by the LOGFILE option in shorewall6.conf(5). The
-m option causes the MAC
address of each packet source to be displayed if that
information is available.macrosDisplays information about each macro defined on the
firewall system.mangleDisplays the Netfilter mangle table using the command
ip6tables -t mangle -L -n
-v.The -x option
is passed directly through to ip6tables and causes actual
packet and byte counts to be displayed. Without this option,
those counts are abbreviated.marksAdded in Shorewall 4.4.26. Displays the various fields
in packet marks giving the min and max value (in both decimal
and hex) and the applicable mask (in hex).policiesAdded in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones. Note that implicit intrazone
ACCEPT policies are not displayed for zones associated with a
single network where that network doesn't specify
.RoutingDisplays the system's IPv6 routing configuration.tcDisplays information about queuing disciplines, classes
and filters.zonesDisplays the current composition of the Shorewall6 zones
on the system.startStart shorewall6. Existing connections through shorewall6
managed interfaces are untouched. New connections will be allowed
only if they are allowed by the firewall rules or policies. If a
directory is included in the command,
Shorewall6 will look in that directory first
for configuration files. If -f is
specified, the saved configuration specified by the RESTOREFILE
option in shorewall6.conf(5) will be
restored if that saved configuration exists and has been modified
more recently than the files in /etc/shorewall6. When -f is given, a
directory may not be specified.Update: In Shorewall6 4.4.20, a new LEGACY_FASTSTART option
was added to shorewall6.conf(5). When
LEGACY_FASTSTART=No, the modificaiotn times of files in
/etc/shorewall6 are compared with that of
/var/lib/shorewall6/firewall (the compiled script that last
started/restarted the firewall).The option causes Shorewall6 to avoid
updating the routing table(s).The option was added in Shorewall 4.4.20
and performs the compilation step unconditionally, overriding the
AUTOMAKE setting in shorewall6.conf(5). When both
and are present, the result
is determined by the option that appears last.stopStops the firewall. All existing connections, except those
listed in shorewall6-routestopped(5)
or permitted by the ADMINISABSENTMINDED option in shorewall6.conf(5), are taken
down. The only new traffic permitted through the firewall is from
systems listed in shorewall6-routestopped(5)
or by ADMINISABSENTMINDED.statusProduces a short report about the state of the
Shorewall6-configured firewall.tryIf Shorewall6 is started then the firewall state is saved to a
temporary saved configuration
(/var/lib/shorewall6/.try). Next, if Shorewall6
is currently started then a restart
command is issued; otherwise, a start command is performed. if an error
occurs during the compliation phase of the restart or start, the command terminates without
changing the Shorewall6 state. If an error occurs during the
restart phase, then a shorewall6 restore is performed using the
saved configuration. If an error occurs during the start phase, then Shorewall6 is cleared. If
the start/restart succeeds and a
timeout is specified then a clear or restore is performed after
timeout seconds.updateAdded in Shorewall 4.4.21 and causes the compiler to update
/etc/shorewall6/shorewall6.conf then validate
the configuration. The update will add options not present in the
existing file with their default values, and will move deprecated
options with non-defaults to a deprecated options section at the
bottom of the file. Your existing
shorewall6.conf file is renamed
shorewall6.conf.bak.The option causes the updated
shorewall6.conf file to be annotated with
documentation.The option was added in Shorewall 4.4.26
and causes legacy blacklisting rules (shorewall6-blacklist (5) )
to be converted to entries in the blrules file (shorewall6-blrules (5) ). The
blacklist keyword is removed from shorewall6-zones (5), shorewall-interfaces (5)
and shorewall6-hosts (5).
The unmodified files are saved with a .bak suffix.For a description of the other options, see the check command above.versionDisplays Shorewall6's version. If the
option is included, the version of Shorewall will also be
displayed.FILES/etc/shorewall6/See ALSOhttp://www.shorewall.net/starting_and_stopping_shorewall.htmshorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-maclist(5), shoewall6-netmap(5),shorewall6-params(5),
shorewall6-policy(5), shorewall6-providers(5), shorewall6-route_rules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),
shorewall6-zones(5)