shorewall6-interfaces5interfacesshorewall6 interfaces file/etc/shorewall6/interfacesDescriptionThe interfaces file serves to define the firewall's network
interfaces to shorewall6. The order of entries in this file is not
significant in determining zone composition.The columns in the file are as follows.ZONE -
zone-nameZone for this interface. Must match the name of a zone
declared in /etc/shorewall6/zones. You may not list the firewall
zone in this column.If the interface serves multiple zones that will be defined in
the shorewall6-hosts(5)
file, you should place "-" in this column.If there are multiple interfaces to the same zone, you must
list them in separate entries.Example:
#ZONE INTERFACE BROADCAST
loc eth1 -
loc eth2 -
INTERFACE -
interface[:port]Logical name of interface. Each interface may be listed only
once in this file. You may NOT specify the name of a "virtual"
interface (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18.
If the option is not specified, then the
logical name is also the name of the actual interface.You may use wildcards here by specifying a prefix followed by
the plus sign ("+"). For example, if you want to make an entry that
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
ppp1, ppp2, …Please note that the '+' means 'one or more additional characters' so 'ppp'
does not match 'ppp+'.Care must be exercised when using wildcards where there is
another zone that uses a matching specific interface. See shorewall6-nesting(5) for a
discussion of this problem.Shorewall6 allows '+' as an interface name.There is no need to define the loopback interface (lo) in this
file.If a port is given, then the
interface must have been defined
previously with the option. The OPTIONS
column must be empty when a port is
given.UNICAST - -Enter '-' in this column. It
is here for compatibility between Shorewall6 and Shorewall.OPTIONS (Optional) -
[option[,option]...]A comma-separated list of options from the following list. The
order in which you list the options is not significant but the list
should have no embedded white space.blacklistCheck packets arriving on this interface against the
shorewall6-blacklist(5)
file.Beginning with Shorewall 4.4.13:If a zone is given in the
ZONES column, then the behavior is as if blacklist had been specified in the
IN_OPTIONS column of shorewall6-zones(5).Otherwise, the option is ignored with a
warning:
WARNING: The 'blacklist'
option is ignored on mult-zone
interfaces
bridgeDesignates the interface as a bridge. Beginning with
Shorewall 4.4.7, setting this option also sets
.dhcpSpecify this option when any of the following are
true:the interface gets its IP address via DHCPthe interface is used by a DHCP server running on
the firewallthe interface has a static IP but is on a LAN
segment with lots of DHCP clients.the interface is a simple bridge with a
DHCP server on one port and DHCP clients on another
port.If you use Shorewall-perl for
firewall/bridging, then you need to include
DHCP-specific rules in shorewall-rules(8).
DHCP uses UDP ports 546 and 547.This option allows DHCP datagrams to enter and leave the
interface.forward[={0|1}]Sets the /proc/sys/net/ipv6/conf/interface/forwarding
option to the specified value. If no value is supplied, then 1
is assumed.mss=numberCauses forwarded TCP SYN packets entering or leaving on
this interface to have their MSS field set to the specified
number.nets=(net[,...])Limit the zone named in the ZONE column to only the
listed networks. If you specify this option, be sure to
include the link-local network (ff80::/10).nets=dynamicAdded in Shorewall 4.4.21. Defines the zone as
dynamic. Requires ipset match support
in your iptables and kernel. See http://www.shorewall.net/Dynamic.html
for further information.You may not have an ipv4 dynamic zone with the same
zone-name and
interface.optionalWhen is specified for an
interface, shorewall6 will be silent when:a /proc/sys/net/ipv6/conf/
entry for the interface cannot be modified.The first global IPv6 address of the interface
cannot be obtained.This option may not be specified together with required.physical=nameAdded in Shorewall 4.4.4. When specified, the interface
or port name in the INTERFACE column is a logical name that
refers to the name given in this option. It is useful when you
want to specify the same wildcard port name on two or more
bridges. See http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.If the interface name is a wildcard
name (ends with '+'), then the physical
name must also end in '+'.If is not specified, then it's
value defaults to the interface
name.requiredAdded in Shorewall 4.4.10. When specified, the firewall
will fail to start if the interface named in the INTERFACE
column is not usable. May not be specified together with
optional.routebackIf specified, indicates that shorewall6 should include
rules that allow traffic arriving on this interface to be
routed back out that same interface. This option is also
required when you have used a wildcard in the INTERFACE column
if you want to allow traffic between the interfaces that match
the wildcard.Beginning with Shorewall 4.4.20, if you specify this
option, then you should also specify ;
see above.sourceroute[={0|1}]If this option is not specified for an interface, then
source-routed packets will not be accepted from that interface
(sets
/proc/sys/net/ipv6/conf/interface/accept_source_route
to 1). Only set this option if you know what you are doing.
This might represent a security risk and is not usually
needed.Only those interfaces with the
option will have their setting
changes; the value assigned to the setting will be the value
specified (if any) or 1 if no value is given.This option does not work with a wild-card
interface name (e.g., eth0.+) in
the INTERFACE column.sfilter=(net[,...])Added in Shorewall 4.4.20. At this writing (spring
2011), Linux does not support reverse path filtering (RFC3704)
for IPv6. In its absence, may be used
as an anti-spoofing measure.This option should be used on bridges or other
interfaces with the option. On
these interfaces, should list those
local networks that are connected to the firewall through
other interfaces.tcpflagsPackets arriving on this interface are checked for
certain illegal combinations of TCP flags. Packets found to
have such a combination of flags are handled according to the
setting of TCP_FLAGS_DISPOSITION after having been logged
according to the setting of TCP_FLAGS_LOG_LEVEL.proxyndp[={0|1}]Sets
/proc/sys/net/ipv6/conf/interface/proxy_ndp.Note: This option does
not work with a wild-card interface
name (e.g., eth0.+) in the INTERFACE column.Only those interfaces with the
option will have their setting changed; the value assigned to
the setting will be the value specified (if any) or 1 if no
value is given.wait=secondsAdded in Shorewall 4.4.10. Causes the generated script
to wait up to seconds seconds for the
interface to become usable before applying the required or optional options.ExampleExample 1:Suppose you have eth0 connected to a DSL modem and eth1
connected to your local network You have a DMZ using eth2.Your entries for this setup would look like:#ZONE INTERFACE UNICAST OPTIONS
net eth0 -
loc eth1 -
dmz eth2 -Example 4 (Shorewall 4.4.9 and later):You have a bridge with no IP address and you want to allow
traffic through the bridge.#ZONE INTERFACE BROADCAST OPTIONS
- br0 - routebackFILES/etc/shorewall6/interfacesSee ALSOshorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
shorewall6-route_rules(5), shorewall6-routestopped(5),
shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5),
shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)