shorewall8Administrative CommandsshorewallAdministration tool for Shoreline Firewall
(Shorewall)shorewall|-optionsinterface[:host-list]zone zone host-listshorewall|-optionsaddressshorewall|-optionsdirectoryshorewall|-optionsshorewall|-optionsdirectorypathnameshorewall|-optionsinterface[:host-list]zone zone host-listshorewall|-options{ interface |
provider }shorewall|-optionsaddressshorewall|-optionsshorewall|-options{ interface |
provider }shorewall|-optionsdirectory1[user@]system[directory2]shorewall|-optionsfilenameshorewall|-optionsshorewall|-optionsshorewall|-optionsaddressmaskaddress/vlsmshorewall|-optionsaddress1address2shorewall|-optionsiptables match
expressionshorewall|-optionsroot-user-namedirectorysystemshorewall|-optionsaddressshorewall|-optionsrefresh-intervalshorewall|-optionsaddressshorewall|-optionsiptables match
expressionshorewall|-options-
directorychainshorewall|-optionsaddressshorewall|-optionsroot-user-namedirectorysystemshorewall|-optionsshorewall|-optionsdirectoryshorewall|-optionsfilenameshorewall|-optionstimeoutdirectoryshorewall|-optionstimeoutdirectoryshorewall|-optionsfilenameshorewall|-options
{|||}chainshorewall|-optionsshorewall|-optionsshorewall|-optionseventshorewall|-optionsmacroshorewall|-optionsshorewall|-optionsshorewall|-optionsshorewall|-optionsdirectoryshorewall|-optionsshorewall|-optionsshorewall|-optionsdirectorytimeoutshorewall|-optionsdirectoryshorewall|-optionsDescriptionThe shorewall utility is used to control the Shoreline Firewall
(Shorewall).OptionsThe and options are
used for debugging. See http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace.The nolock prevents the command from
attempting to acquire the Shorewall lockfile. It is useful if you need to
include shorewall commands in
/etc/shorewall/started.The options control the amount of output that
the command produces. They consist of a sequence of the letters v and q. If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in shorewall.conf(5). Each
v adds one to the effective verbosity and
each q subtracts one from the effective
VERBOSITY. Alternatively, v may be
followed immediately with one of -1,0,1,2 to specify a specify VERBOSITY.
There may be no white-space between v and
the VERBOSITY.The options may also include the letter
which causes all progress messages to be
timestamped.CommandsThe available commands are listed below.addAdds a list of hosts or subnets to a dynamic zone usually used
with VPN's.The interface argument names an interface
defined in the shorewall-interfaces(5)
file. A host-list is comma-separated list whose
elements are host or network addresses.The add command is not very robust. If
there are errors in the host-list,
you may see a large number of error messages yet a subsequent
shorewall show zones command will indicate
that all hosts were added. If this happens, replace
add by delete and run the
same command again. Then enter the correct command.Beginning with Shorewall 4.5.9, the dynamic_shared zone option (shorewall-zones(5))
allows a single ipset to handle entries for multiple interfaces.
When that option is specified for a zone, the add
command has the alternative syntax in which the
zone name precedes the
host-list.allowRe-enables receipt of packets from hosts previously
blacklisted by a drop, logdrop, reject, or logreject command.checkCompiles the configuration in the specified
directory and discards the compiled output
script. If no directory is given, then
/etc/shorewall is assumed.The -e option causes the
compiler to look for a file named capabilities. This file is
produced using the command shorewall-lite show
-f capabilities > capabilities on a system with
Shorewall Lite installed.The option causes the compiler to be run
under control of the Perl debugger.The option causes the compiler to be
profiled via the Perl command-line
option.The option was added in Shorewall 4.5.2
and causes the compiler to print the generated ruleset to standard
out.The option was added in Shorewall 4.4.20
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).clearClear will remove all rules and chains installed by Shorewall.
The firewall is then wide open and unprotected. Existing connections
are untouched. Clear is often used to see if the firewall is causing
connection problems.If is given, the command will be processed
by the compiled script that executed the last successful start, restart or refresh command if that script exists.compileCompiles the current configuration into the executable file
pathname. If a
directory is supplied, Shorewall will
look in that directory first for configuration files. If the
pathname is omitted, the file
firewall in the VARDIR (normally /var/lib/shorewall/) is assumed. A
pathname of '-' causes the compiler to send the
generated script to it's standard output file. Note that '-v-1' is
usually specified in this case (e.g., shorewall -v-1
compile -- -) to suppress the 'Compiling...' message
normally generated by /sbin/shorewall.When -e is specified, the compilation is being performed on a
system other than where the compiled script will run. This option
disables certain configuration options that require the script to be
compiled where it is to be run. The use of -e requires the presence
of a configuration file named capabilities
which may be produced using the command shorewall-lite show -f capabilities >
capabilities on a system with Shorewall Lite
installedThe -c option was added in
Shorewall 4.5.17 and causes conditional compilation of a script. The
script specified by pathname (or implied
if pathname is omitted) is compiled
if it doesn't exist or if there is any file in the
directory or in a directory on the
CONFIG_PATH that has a modification time later than the file to be
compiled. When no compilation is needed, a message is issued and an
exit status of zero is returned.The option causes the compiler to be run
under control of the Perl debugger.The option causes the compiler to be
profiled via the Perl command-line
option.The option was added in Shorewall 4.4.20
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).deleteThe delete command reverses the effect of an earlier add command.The interface argument names an interface
defined in the shorewall-interfaces(5)
file. A host-list is comma-separated list whose
elements are a host or network address.Beginning with Shorewall 4.5.9, the dynamic_shared zone option (shorewall-zones(5))
allows a single ipset to handle entries for multiple interfaces.
When that option is specified for a zone, the
delete command has the alternative syntax in
which the zone name precedes the
host-list.disableAdded in Shorewall 4.4.26. Disables the optional provider
associated with the specified interface
or provider. Where more than one provider
share a single network interface, a
provider name must be given.Beginning with Shorewall 4.5.10, this command may be used with
any optional network interface. interface
may be either the logical or physical name of the interface. The
command removes any routes added from shorewall-routes(5)
and any traffic shaping configuration for the interface.dropCauses traffic from the listed addresses
to be silently dropped.dumpProduces a verbose report about the firewall configuration for
the purpose of problem analysis.The -x option causes actual
packet and byte counts to be displayed. Without that option, these
counts are abbreviated. The -m
option causes any MAC addresses included in Shorewall log messages
to be displayed.The -l option causes the rule
number for each Netfilter rule to be displayed.enableAdded in Shorewall 4.4.26. Enables the optional provider
associated with the specified interface
or provider. Where more than one provider
share a single network interface, a
provider name must be given.Beginning with Shorewall 4.5.10, this command may be used with
any optional network interface. interface
may be either the logical or physical name of the interface. The
command sets /proc entries for the interface,
adds any route specified in shorewall-routes(5)
and installs the interface's traffic shaping configuration, if
any.exportIf directory1 is omitted, the current
working directory is assumed.Allows a non-root user to compile a shorewall script and stage
it on a system (provided that the user has access to the system via
ssh). The command is equivalent to:/sbin/shorewall compile -edirectory1directory1/firewall &&\scp directory1/firewalldirectory1/firewall.conf [user@]system:[directory2]In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall and firewall.conf
are copied to system using scp.forgetDeletes /var/lib/shorewall/filename and
/var/lib/shorewall/save. If no filename is
given then the file specified by RESTOREFILE in shorewall.conf(5) is
assumed.helpDisplays a syntax summary.hitsGenerates several reports from Shorewall log messages in the
current log file. If the option is included, the
reports are restricted to log messages generated today.ipcalcIpcalc displays the network address, broadcast address,
network in CIDR notation and netmask corresponding to the
input[s].iprangeIprange decomposes the specified range of IP addresses into
the equivalent list of network/host addresses.iptraceThis is a low-level debugging command that causes iptables
TRACE log records to be created. See iptables(8) for details.The iptables match expression must
be one or more matches that may appear in both the raw table OUTPUT
and raw table PREROUTING chains.The trace records are written to the kernel's log buffer with
facility = kernel and priority = warning, and they are routed from
there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
Shorewall has no control over where the messages go; consult your
logging daemon's documentation.loadIf directory is omitted, the current
working directory is assumed. Allows a non-root user to compile a
shorewall script and install it on a system (provided that the user
has root access to the system via ssh). The command is equivalent
to:/sbin/shorewall compile -edirectorydirectory/firewall &&\scpdirectory/firewalldirectory/firewall.confroot@system:/var/lib/shorewall-lite/ &&\ssh root@system'/sbin/shorewall-lite start'In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall is copied to
system using scp. If the copy succeeds,
Shorewall Lite on system is started via
ssh.If -s is specified and the
start command succeeds, then the
remote Shorewall-lite configuration is saved by executing shorewall-lite save via ssh.if -c is included, the
command shorewall-lite show capabilities -f
> /var/lib/shorewall-lite/capabilities is executed via
ssh then the generated file is copied to
directory using scp. This step is
performed before the configuration is compiled.If is included, it specifies that the root
user on system is named
root-user-name rather than "root".The option was added in Shorewall 4.5.3
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).logdropCauses traffic from the listed addresses
to be logged then discarded. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf
(5).logwatchMonitors the log file specified by the LOGFILE option in
shorewall.conf(5)
and produces an audible alarm when new Shorewall messages are
logged. The -m option causes the
MAC address of each packet source to be displayed if that
information is available. The
refresh-interval specifies the time in
seconds between screen refreshes. You can enter a negative number by
preceding the number with "--" (e.g., shorewall logwatch --
-30). In this case, when a packet count changes, you will
be prompted to hit any key to resume screen refreshes.logrejectCauses traffic from the listed addresses
to be logged then rejected. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf
(5).noiptraceThis is a low-level debugging command that cancels a trace
started by a preceding iptrace command.The iptables match expression must
be one given in the iptrace command being
canceled.refreshAll steps performed by restart are
performed by refresh with the exception that
refresh only recreates the chains specified in
the command while restart recreates the entire
Netfilter ruleset. If no chain is given,
the static blacklisting chain blacklst is assumed.The listed chains are assumed to be in the filter table. You
can refresh chains in other tables by prefixing the chain name with
the table name followed by ":" (e.g., nat:net_dnat). Chain names
which follow are assumed to be in that table until the end of the
list or until an entry in the list names another table. Built-in
chains such as FORWARD may not be refreshed.The option was added in Shorewall 4.5.3
causes Shorewall to avoid updating the routing table(s).The option was added in Shorewall 4.5.3
causes the compiler to run under the Perl debugger.The option was added in Shorewall 4.5.3
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).The - option was added in Shorewall 4.5.3
and causes Shorewall to look in the given
directory first for configuration files.Example:shorewall refresh net2fw nat:net_dnat #Refresh the 'net2loc' chain in the filter table and the 'net_dnat' chain in the nat tableThe refresh command has
slightly different behavior. When no chain name is given to the
refresh command, the mangle table
is refreshed along with the blacklist chain (if any). This allows
you to modify /etc/shorewall/tcrules and
install the changes using refresh.reloadIf directory is omitted, the current
working directory is assumed. Allows a non-root user to compile a
shorewall script and install it on a system (provided that the user
has root access to the system via ssh). The command is equivalent
to:/sbin/shorewall compile -edirectorydirectory/firewall &&\scpdirectory/firewalldirectory/firewall.confroot@system:/var/lib/shorewall-lite/ &&\ssh root@system'/sbin/shorewall-lite restart'In other words, the configuration in the specified (or
defaulted) directory is compiled to a file called firewall in that
directory. If compilation succeeds, then firewall is copied to
system using scp. If the copy succeeds,
Shorewall Lite on system is restarted via
ssh.If -s is specified and the
restart command succeeds, then the
remote Shorewall-lite configuration is saved by executing shorewall-lite save via ssh.if -c is included, the
command shorewall-lite show capabilities -f
> /var/lib/shorewall-lite/capabilities is executed via
ssh then the generated file is copied to
directory using scp. This step is performed
before the configuration is compiled.If is included, it specifies that the root
user on system is named
root-user-name rather than "root".The option was added in Shorewall 4.5.3
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).resetAll the packet and byte counters in the firewall are
reset.restartRestart is similar to shorewall
start except that it assumes that the firewall is already
started. Existing connections are maintained. If a
directory is included in the command, Shorewall
will look in that directory first for
configuration files.The option causes Shorewall to avoid
updating the routing table(s).The option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.The option causes the compiler to run
under the Perl debugger.The option suppresses the compilation step
and simply reused the compiled script which last started/restarted
Shorewall, provided that /etc/shorewall and its contents have not
been modified since the last start/restart.The option was added in Shorewall 4.4.20
and performs the compilation step unconditionally, overriding the
AUTOMAKE setting in shorewall.conf(5). When
both and are present, the
result is determined by the option that appears last.The option was added in Shorewall 4.5.3
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).restoreRestore Shorewall to a state saved using the shorewall save command. Existing connections
are maintained. The filename names a restore
file in /var/lib/shorewall created using shorewall save; if no
filename is given then Shorewall will be
restored from the file specified by the RESTOREFILE option in shorewall.conf(5).safe-restartOnly allowed if Shorewall is running. The current
configuration is saved in /var/lib/shorewall/safe-restart (see the
save command below) then a shorewall
restart is done. You will then be prompted asking if you
want to accept the new configuration or not. If you answer "n" or if
you fail to answer within 60 seconds (such as when your new
configuration has disabled communication with your terminal), the
configuration is restored from the saved configuration. If a
directory is given, then Shorewall will look in that directory first
when opening configuration files.Beginning with Shorewall 4.5.0, you may specify a different
timeout value using the
option. The numeric
timeout may optionally be followed by an
, or suffix
(e.g., 5m) to specify seconds, minutes or hours respectively. If the
suffix is omitted, seconds is assumed.safe-startShorewall is started normally. You will then be prompted
asking if everything went all right. If you answer "n" or if you
fail to answer within 60 seconds (such as when your new
configuration has disabled communication with your terminal), a
shorewall clear is performed for you. If a directory is given, then
Shorewall will look in that directory first when opening
configuration files.Beginning with Shorewall 4.5.0, you may specify a different
timeout value using the
option. The numeric
timeout may optionally be followed by an
, or suffix
(e.g., 5m) to specify seconds, minutes or hours respectively. If the
suffix is omitted, seconds is assumed.saveThe dynamic blacklist is stored in /var/lib/shorewall/save.
The state of the firewall is stored in
/var/lib/shorewall/filename for use by the
shorewall restore and shorewall -f start commands. If
filename is not given then the state is saved
in the file specified by the RESTOREFILE option in shorewall.conf(5).showThe show command can have a number of different
arguments:actionsProduces a report about the available actions (built-in,
standard and user-defined).capabilitiesDisplays your kernel/iptables capabilities. The
-f option causes the display
to be formatted as a capabilities file for use with compile -e.[ [ ] chain...
]The rules in each chain are
displayed using the iptables
-Lchain-n -v command. If no
chain is given, all of the chains in the
filter table are displayed. The -x option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are abbreviated.
The -t option specifies the
Netfilter table to display. The default is filter.The -b ('brief') option
causes rules which have not been used (i.e. which have zero
packet and byte counts) to be omitted from the output. Chains
with no rules displayed are also omitted from the
output.The -l option causes
the rule number for each Netfilter rule to be
displayed.If the -t option and
the keyword are both omitted and any of
the listed chains do not exist, a
usage message is displayed.classifiers|filtersDisplays information about the packet classifiers
defined on the system as a result of traffic shaping
configuration.configDisplays distribution-specific defaults.connectionsDisplays the IP connections currently being tracked by
the firewall.event
eventAdded in Shorewall 4.5.19. Displays the named
event.eventsAdded in Shorewall 4.5.19. Displays all events.ipDisplays the system's IPv4 configuration.ipaAdded in Shorewall 4.4.17. Displays the per-IP
accounting counters (shorewall-accounting
(5)).logDisplays the last 20 Shorewall messages from the log
file specified by the LOGFILE option in shorewall.conf(5).
The -m option causes the MAC
address of each packet source to be displayed if that
information is available.macrosDisplays information about each macro defined on the
firewall system.macroAdded in Shorewall 4.4.6. Displays the file that
implements the specified macro
(usually
/usr/share/shorewall/macro.macro).marksAdded in Shorewall 4.4.26. Displays the various fields
in packet marks giving the min and max value (in both decimal
and hex) and the applicable mask (in hex).natDisplays the Netfilter nat table using the command
iptables -t nat -L -n -v.The
-x option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.policiesAdded in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones. Note that implicit intrazone
ACCEPT policies are not displayed for zones associated with a
single network where that network doesn't specify
.routingDisplays the system's IPv4 routing configuration.rawDisplays the Netfilter raw table using the command
iptables -t raw -L -n -v.The
-x option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.tcDisplays information about queuing disciplines, classes
and filters.zonesDisplays the current composition of the Shorewall zones
on the system.startStart shorewall. Existing connections through shorewall
managed interfaces are untouched. New connections will be allowed
only if they are allowed by the firewall rules or policies. If a
directory is included in the command,
Shorewall will look in that directory first for
configuration files. If -f is
specified, the saved configuration specified by the RESTOREFILE
option in shorewall.conf(5) will
be restored if that saved configuration exists and has been modified
more recently than the files in /etc/shorewall. When -f is given, a
directory may not be specified.Update: In Shorewall 4.4.20, a new LEGACY_FASTSTART option was
added to shorewall.conf(5). When
LEGACY_FASTSTART=No, the modification times of files in
/etc/shorewall are compared with that of /var/lib/shorewall/firewall
(the compiled script that last started/restarted the
firewall).The option causes Shorewall to avoid
updating the routing table(s).The option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.The option was added in Shorewall 4.4.20
and performs the compilation step unconditionally, overriding the
AUTOMAKE setting in shorewall.conf(5). When
both and are present, the
result is determined by the option that appears last.The option was added in Shorewall 4.5.3
and causes a Perl stack trace to be included with each
compiler-generated error and warning message.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).stopStops the firewall. All existing connections, except those
listed in shorewall-routestopped(5)
or permitted by the ADMINISABSENTMINDED option in shorewall.conf(5), are
taken down. The only new traffic permitted through the firewall is
from systems listed in shorewall-routestopped(5)
or by ADMINISABSENTMINDED.If is given, the command will be processed
by the compiled script that executed the last successful start, restart or refresh command if that script exists.statusProduces a short report about the state of the
Shorewall-configured firewall.tryIf Shorewall is started then the firewall state is saved to a
temporary saved configuration
(/var/lib/shorewall/.try). Next, if Shorewall
is currently started then a restart
command is issued using the specified configuration
directory; otherwise, a start command is performed using the
specified configuration directory. if an
error occurs during the compilation phase of the restart or start, the command terminates without
changing the Shorewall state. If an error occurs during the
restart phase, then a shorewall restore is performed using the
saved configuration. If an error occurs during the start phase, then Shorewall is cleared. If
the start/restart succeeds and a
timeout is specified then a clear or restore is performed after
timeout seconds.Beginning with Shorewall 4.5.0, the numeric
timeout may optionally be followed by an
, or suffix
(e.g., 5m) to specify seconds, minutes or hours respectively. If the
suffix is omitted, seconds is assumed.updateAdded in Shorewall 4.4.21 and causes the compiler to update
/etc/shorewall/shorewall.conf then validate the
configuration. The update will add options not present in
the old file with their default values, and will move deprecated
options with non-defaults to a deprecated options section at the
bottom of the file. Your existing
shorewall.conf file is renamed
shorewall.conf.bak.The option causes the updated
shorewall.conf file to be annotated with
documentation.The option was added in Shorewall 4.4.26
and causes legacy blacklisting rules (shorewall-blacklist
(5) ) to be converted to entries in the blrules file (shorewall-blrules (5)
). The blacklist keyword is removed from shorewall-zones (5),
shorewall-interfaces
(5) and shorewall-hosts (5).
The unmodified files are saved with a .bak suffix.The option was added in Shorewall 4.5.11.
When this option is specified, the compiler will walk through the
directories in the CONFIG_PATH replacing FORMAT and COMMENT entries
to compiler directives (e.g., ?FORMAT and ?COMMENT. When a file is
updated, the original is saved in a .bak file in the same
directory.The -i option was added in Shorewall 4.6.0 and causes a
warning message to be issued if the line current line contains
alternative input specifications following a semicolon (";"). Such
lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
shorewall.conf(5).For a description of the other options, see the check command above.versionDisplays Shorewall's version. The option
is included for compatibility with earlier Shorewall releases and is
ignored.EXIT STATUSIn general, when a command succeeds, status 0 is returned; when the
command fails, a non-zero status is returned.The status command returns exit status as
follows:0 - Firewall is started.3 - Firewall is stopped or cleared4 - Unknown state; usually means that the firewall has never been
started.FILES/etc/shorewall/See ALSOhttp://www.shorewall.net/starting_and_stopping_shorewall.htmshorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
shorewall-tunnels(5), shorewall-zones(5)