Extension Scripts

Extension scripts are user-provided scripts that are invoked at various points during firewall start, restart, stop and clear. The scripts are placed in /etc/shorewall and are processed using the Bourne shell "source" mechanism. The following scripts can be supplied:

init -- invoked early in "shorewall start" and "shorewall restart"
start -- invoked after the firewall has been started or restarted.
stop -- invoked as a first step when the firewall is being stopped.
stopped -- invoked after the firewall has been stopped.
clear -- invoked after the firewall has been cleared.
refresh -- invoked while the firewall is being refreshed but before the common and/or blacklst chains have been rebuilt.
newnotsyn (added in version 1.3.6) -- invoked after the 'newnotsyn' chain has been created but before any rules have been added to it.

You can also supply a script with the same name as any of the filter chains in the firewall and the script will be invoked after the /etc/shorewall/rules file has been processed but before the /etc/shorewall/policy file has been processed.

The following two files receive special treatment:

/etc/shorewall/common -- If this file is present, the rules that it defines will totally replace the default rules in the common chain. These default rules are contained in the file /etc/shorewall/common.def which may be used as a starting point for making your own customized file.
/etc/shorewall/icmpdef -- If this file is present, the rules that it defines will totally replace the default rules in the icmpdef chain. These default rules are contained in the file /etc/shorewall/icmp.def which may be used as a starting point for making your own customized file.

Rather than running iptables directly, you should run it using the function run_iptables. Similarly, rather than running "ip" directly, you should use run_ip. These functions accept the same arguments as the underlying command but cause the firewall to be stopped if an error occurs during processing of the command.

If you decide to create /etc/shorewall/common or /etc/shorewall/icmp.def, it is a good idea to use the following technique (common file shown but the same technique applies to icmpdef).

/etc/shorewall/common:

source /etc/shorewall/common.def
<add your rules here>

If you need to supercede a rule in the released common.def file, you can add the superceding rule before the 'source' command. Using this technique allows you to add new rules while still getting the benefit of the latest common.def file.

Remember that /etc/shorewall/common and /etc/shorewall/icmpdef define rules that are only applied if the applicable policy is DROP or REJECT. These rules are NOT applied if the policy is ACCEPT or CONTINUE.

Last updated 8/5/2002 - Tom Eastep