mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-27 00:29:02 +01:00
1598 lines
57 KiB
XML
1598 lines
57 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall6-lite</refentrytitle>
|
|
|
|
<manvolnum>8</manvolnum>
|
|
|
|
<refmiscinfo>Administrative Commands</refmiscinfo>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>shorewall6-lite</refname>
|
|
|
|
<refpurpose>Administration tool for Shoreline 6 Firewall Lite (Shorewall6
|
|
Lite)</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg rep="norepeat">-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>add</option></arg>
|
|
|
|
<arg choice="plain"
|
|
rep="repeat"><replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]</arg>
|
|
|
|
<arg choice="plain"><replaceable>zone</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>allow</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>blacklist</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>call</option></arg>
|
|
|
|
<arg
|
|
choice="plain"><replaceable>function</replaceable><arg><replaceable>parameter</replaceable>
|
|
...</arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg
|
|
choice="plain"><option>clear</option><arg><option>-f</option></arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>close</option><arg choice="req">
|
|
<replaceable>open-number</replaceable> |
|
|
<replaceable>source</replaceable><replaceable>dest</replaceable><arg><replaceable>protocol</replaceable><arg>
|
|
<replaceable>port</replaceable> </arg></arg></arg><replaceable>
|
|
</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>close</option><replaceable>
|
|
source</replaceable><replaceable> dest</replaceable><arg>
|
|
<replaceable>protocol</replaceable><arg> <replaceable>port</replaceable>
|
|
</arg> </arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg rep="norepeat">-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>delete</option></arg>
|
|
|
|
<arg choice="plain"
|
|
rep="repeat"><replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]</arg>
|
|
|
|
<arg choice="plain"><replaceable>zone</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>disable</option></arg>
|
|
|
|
<arg choice="plain">{ <replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>drop</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>dump</option></arg>
|
|
|
|
<arg><option>-x</option></arg>
|
|
|
|
<arg><option>-l</option></arg>
|
|
|
|
<arg><option>-m</option></arg>
|
|
|
|
<arg><option>-c</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>enable</option></arg>
|
|
|
|
<arg choice="plain">{ <replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>forget</option></arg>
|
|
|
|
<arg><replaceable>filename</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>help</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg
|
|
choice="plain"><option>hits</option><arg><option>-t</option></arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>iptrace</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>iptables match
|
|
expression</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>logdrop</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>logwatch</option></arg>
|
|
|
|
<arg><option>-m</option></arg>
|
|
|
|
<arg><replaceable>refresh-interval</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>logreject</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>noiptrace</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>iptables match
|
|
expression</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>open</option><replaceable>
|
|
source</replaceable><replaceable> dest</replaceable><arg>
|
|
<replaceable>protocol</replaceable><arg> <replaceable>port</replaceable>
|
|
</arg> </arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>reenable</option></arg>
|
|
|
|
<arg choice="plain">{ <replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>reject</option></arg>
|
|
|
|
<arg choice="plain"><replaceable>address</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>reset</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>restart</option></arg>
|
|
|
|
<arg><option>-n</option></arg>
|
|
|
|
<arg><option>-p</option></arg>
|
|
|
|
<arg><option>-C</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>restore</option></arg>
|
|
|
|
<arg><option>-C</option></arg>
|
|
|
|
<arg><replaceable>filename</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>run</option></arg>
|
|
|
|
<arg choice="plain">command</arg>
|
|
|
|
<arg><replaceable>parameter ...</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>save</option></arg>
|
|
|
|
<arg><option>-C</option></arg>
|
|
|
|
<arg choice="opt"><replaceable>filename</replaceable></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>savesets</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-b</option></arg>
|
|
|
|
<arg><option>-x</option></arg>
|
|
|
|
<arg><option>-l</option></arg>
|
|
|
|
<arg><option>-t</option>
|
|
{<option>filter</option>|<option>mangle</option>|<option>nat</option>|<option>raw|rawpost</option>}</arg>
|
|
|
|
<arg><arg><option>chain</option></arg><arg choice="plain"
|
|
rep="repeat"><replaceable>chain</replaceable></arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-f</option></arg>
|
|
|
|
<arg choice="plain"><option>capabilities</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-x</option></arg>
|
|
|
|
<arg choice="plain"><option>{bl|blacklists}</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg
|
|
choice="req"><option>classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg choice="plain"><option>event</option><arg
|
|
choice="plain"><replaceable>event</replaceable></arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-c</option></arg>
|
|
|
|
<arg choice="plain"><option>routing</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-x</option></arg>
|
|
|
|
<arg choice="req"><option>mangle|nat|raw|rawpost</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg choice="plain"><option>tc</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="req"><option>show | list | ls </option></arg>
|
|
|
|
<arg><option>-m</option></arg>
|
|
|
|
<arg choice="plain"><option>log</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>start</option></arg>
|
|
|
|
<arg><option>-n</option></arg>
|
|
|
|
<arg><option>-p</option></arg>
|
|
|
|
<arg><option>-f</option></arg>
|
|
|
|
<arg><option>-C</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg
|
|
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><option>stop</option></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg choice="plain"><arg
|
|
choice="plain"><option>status</option><arg><option>-i</option></arg></arg></arg>
|
|
</cmdsynopsis>
|
|
|
|
<cmdsynopsis>
|
|
<command>shorewall6-lite</command>
|
|
|
|
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
|
|
|
|
<arg>-<replaceable>options</replaceable></arg>
|
|
|
|
<arg
|
|
choice="plain"><option>version</option><arg><option>-a</option></arg></arg>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>The shorewall6-lite utility is used to control the Shoreline
|
|
Firewall Lite (Shorewall Lite).</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Options</title>
|
|
|
|
<para>The <option>trace</option> and <option>debug</option> options are
|
|
used for debugging. See <ulink
|
|
url="http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace">http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace</ulink>.</para>
|
|
|
|
<para>The <option>nolock</option> option prevents the command from
|
|
attempting to acquire the shorewall6-lite lockfile. It is useful if you
|
|
need to include <command>shorewall</command> commands in the
|
|
<filename>started</filename> <ulink
|
|
url="../shorewall_extension_scripts.html">extension script</ulink>.</para>
|
|
|
|
<para>The <emphasis>options</emphasis> control the amount of output that
|
|
the command produces. They consist of a sequence of the letters <emphasis
|
|
role="bold">v</emphasis> and <emphasis role="bold">q</emphasis>. If the
|
|
options are omitted, the amount of output is determined by the setting of
|
|
the VERBOSITY parameter in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5). Each <emphasis
|
|
role="bold">v</emphasis> adds one to the effective verbosity and each
|
|
<emphasis role="bold">q</emphasis> subtracts one from the effective
|
|
VERBOSITY. Alternately, <emphasis role="bold">v</emphasis> may be followed
|
|
immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no
|
|
white-space between <emphasis role="bold">v</emphasis> and the
|
|
VERBOSITY.</para>
|
|
|
|
<para>The <emphasis>options</emphasis> may also include the letter
|
|
<option>t</option> which causes all progress messages to be
|
|
timestamped.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Commands</title>
|
|
|
|
<para>The available commands are listed below.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">add </emphasis>{
|
|
<replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]...
|
|
<replaceable>zone</replaceable> | <replaceable>zone</replaceable>
|
|
<replaceable>host-list</replaceable> }</term>
|
|
|
|
<listitem>
|
|
<para>Adds a list of hosts or subnets to a dynamic zone usually used
|
|
with VPN's.</para>
|
|
|
|
<para>The <replaceable>interface</replaceable> argument names an
|
|
interface defined in the <ulink
|
|
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
|
|
file. A <replaceable>host-list</replaceable> is comma-separated list
|
|
whose elements are host or network addresses.</para>
|
|
|
|
<caution>
|
|
<para>The <command>add</command> command is not very robust. If
|
|
there are errors in the <replaceable>host-list</replaceable>, you
|
|
may see a large number of error messages yet a subsequent
|
|
<command>shorewall6-lite show zones</command> command will
|
|
indicate that all hosts were added. If this happens, replace
|
|
<command>add</command> by <command>delete</command> and run the
|
|
same command again. Then enter the correct command.</para>
|
|
</caution>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">allow
|
|
</emphasis><replaceable>address</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Re-enables receipt of packets from hosts previously
|
|
blacklisted by a <command>drop</command>,
|
|
<command>logdrop</command>, <command>reject</command>, or
|
|
<command>logreject</command> command. Beginning with Shorewall
|
|
5.0.10, this command can also re-enable addresses blacklisted using
|
|
the <command>blacklist</command> command.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">blacklist</emphasis>
|
|
<replaceable>address</replaceable> [ <replaceable>option</replaceable>
|
|
... ]</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.0.8 and requires
|
|
DYNAMIC_BLACKLIST=ipset.. in <ulink
|
|
url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
|
|
Causes packets from the given host or network
|
|
<replaceable>address</replaceable> to be dropped, based on the
|
|
setting of BLACKLIST in <ulink
|
|
url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).
|
|
The <replaceable>address</replaceable> along with any
|
|
<replaceable>option</replaceable>s are passed to the <command>ipset
|
|
add</command> command.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">call <replaceable>function</replaceable> [
|
|
<replaceable>parameter</replaceable> ... ]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.10. Allows you to call a function in
|
|
one of the Shorewall libraries or in your compiled script. function
|
|
must name the shell function to be called. The listed parameters are
|
|
passed to the function.</para>
|
|
|
|
<para>The function is first searched for in
|
|
<filename>lib.base</filename>, <filename>lib.common</filename> and
|
|
<filename>lib.cli</filename>. If it is not found, the call command
|
|
is passed to the generated script to be executed.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">clear </emphasis><emphasis role="bold">
|
|
</emphasis>[-<option>f</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Clear will remove all rules and chains installed by
|
|
shorewall6-lite. The firewall is then wide open and unprotected.
|
|
Existing connections are untouched. Clear is often used to see if
|
|
the firewall is causing connection problems.</para>
|
|
|
|
<para>If <option>-f</option> is given, the command will be processed
|
|
by the compiled script that executed the last successful
|
|
<command>start</command>, <command>reload</command>, <emphasis
|
|
role="bold">restart</emphasis> or <command>refresh</command> command
|
|
if that script exists.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">close</emphasis> {
|
|
<replaceable>open-number</replaceable> |
|
|
<replaceable>source</replaceable> <replaceable>dest</replaceable> [
|
|
<replaceable>protocol</replaceable> [ <replaceable>port</replaceable>
|
|
] ] }</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.8. This command closes a temporary open
|
|
created by the <command>open</command> command. In the first form,
|
|
an <replaceable>open-number</replaceable> specifies the open to be
|
|
closed. Open numbers are displayed in the <emphasis
|
|
role="bold">num</emphasis> column of the output of the
|
|
<command>shorewall6-lite show opens </command>command.</para>
|
|
|
|
<para>When the second form of the command is used, the parameters
|
|
must match those given in the earlier <command>open</command>
|
|
command.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">delete </emphasis>{
|
|
<replaceable>interface</replaceable>[:<replaceable>host-list</replaceable>]...
|
|
<replaceable>zone</replaceable> | <replaceable>zone</replaceable>
|
|
<replaceable>host-list</replaceable> }</term>
|
|
|
|
<listitem>
|
|
<para>The delete command reverses the effect of an earlier
|
|
<command>add</command> command.</para>
|
|
|
|
<para>The <replaceable>interface</replaceable> argument names an
|
|
interface defined in the <ulink
|
|
url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
|
|
file. A <replaceable>host-list</replaceable> is comma-separated list
|
|
whose elements are a host or network address.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">disable </emphasis>{
|
|
<replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.26. Disables the optional provider
|
|
associated with the specified <replaceable>interface</replaceable>
|
|
or <replaceable>provider</replaceable>. Where more than one provider
|
|
share a single network interface, a
|
|
<replaceable>provider</replaceable> name must be given.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">drop
|
|
</emphasis><replaceable>address</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Causes traffic from the listed
|
|
<replaceable>address</replaceable>es to be silently dropped.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">dump </emphasis>[-<option>x</option>]
|
|
[-<option>l</option>] [-<option>m</option>]
|
|
[-<option>c</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Produces a verbose report about the firewall configuration for
|
|
the purpose of problem analysis.</para>
|
|
|
|
<para>The <option>-x</option> option causes actual packet and byte
|
|
counts to be displayed. Without that option, these counts are
|
|
abbreviated.</para>
|
|
|
|
<para>The <option>-m</option> option causes any MAC addresses
|
|
included in shorewall6-lite log messages to be displayed.</para>
|
|
|
|
<para>The <option>-l</option> option causes the rule number for each
|
|
Netfilter rule to be displayed.</para>
|
|
|
|
<para>The <option>-c</option> option causes the route cache to be
|
|
dumped in addition to the other routing information.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">enable </emphasis>{
|
|
<replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.26. Enables the optional provider
|
|
associated with the specified <replaceable>interface</replaceable>
|
|
or <replaceable>provider</replaceable>. Where more than one provider
|
|
share a single network interface, a
|
|
<replaceable>provider</replaceable> name must be given.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">forget </emphasis>[
|
|
<replaceable>filename</replaceable> ]</term>
|
|
|
|
<listitem>
|
|
<para>Deletes
|
|
<filename>/var/lib/shorewall6-lite/<replaceable>filename</replaceable></filename>
|
|
and <filename>/var/lib/shorewall6-lite/save</filename>. If no
|
|
<replaceable>filename</replaceable> is given then the file specified
|
|
by RESTOREFILE in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5) is
|
|
assumed.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">help</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays a syntax summary.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">hits</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Generates several reports from shorewall6-lite log messages in
|
|
the current log file. If the <option>-t</option> option is included,
|
|
the reports are restricted to log messages generated today.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">iptrace </emphasis><replaceable>ip6tables
|
|
match expression</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>This is a low-level debugging command that causes iptables
|
|
TRACE log records to be created. See iptables(8) for details.</para>
|
|
|
|
<para>The <replaceable>iptables match expression</replaceable> must
|
|
be one or more matches that may appear in both the raw table OUTPUT
|
|
and raw table PREROUTING chains.</para>
|
|
|
|
<para>The trace records are written to the kernel's log buffer with
|
|
facility = kernel and priority = warning, and they are routed from
|
|
there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
|
|
shorewall6-lite has no control over where the messages go; consult
|
|
your logging daemon's documentation.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">list</emphasis></term>
|
|
|
|
<listitem>
|
|
<para><command>list</command> is a synonym for
|
|
<command>show</command> -- please see below.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">logdrop
|
|
</emphasis><replaceable>address</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Causes traffic from the listed
|
|
<replaceable>address</replaceable>es to be logged then discarded.
|
|
Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL
|
|
setting in <ulink url="shorewall.conf.html">shorewall6.conf</ulink>
|
|
(5).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">logwatch </emphasis>[-<option>m</option>]
|
|
[<replaceable>refresh-interval</replaceable>]</term>
|
|
|
|
<listitem>
|
|
<para>Monitors the log file specified by the LOGFILE option in
|
|
<ulink url="shorewall.conf.html">shorewall6.conf</ulink>(5) and
|
|
produces an audible alarm when new shorewall6-lite messages are
|
|
logged.</para>
|
|
|
|
<para>The <option>-m</option> option causes the MAC address of each
|
|
packet source to be displayed if that information is
|
|
available.</para>
|
|
|
|
<para>The <replaceable>refresh-interval</replaceable> specifies the
|
|
time in seconds between screen refreshes. You can enter a negative
|
|
number by preceding the number with "--" (e.g.,
|
|
<command>shorewall6-lite logwatch -- -30</command>). In this case,
|
|
when a packet count changes, you will be prompted to hit any key to
|
|
resume screen refreshes.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">logreject
|
|
</emphasis><replaceable>address</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Causes traffic from the listed
|
|
<replaceable>address</replaceable>es to be logged then rejected.
|
|
Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL
|
|
setting in <ulink url="shorewall.conf.html">shorewall6.conf</ulink>
|
|
(5).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ls</emphasis></term>
|
|
|
|
<listitem>
|
|
<para><command>ls</command> is a synonym for <command>show</command>
|
|
-- please see below.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">noiptrace
|
|
</emphasis><replaceable>ip6tables match
|
|
expression</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>This is a low-level debugging command that cancels a trace
|
|
started by a preceding <command>iptrace</command> command.</para>
|
|
|
|
<para>The <replaceable>ip6tables match expression</replaceable> must
|
|
be one given in the <command>iptrace</command> command being
|
|
canceled.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">open</emphasis>
|
|
<replaceable>source</replaceable> <replaceable>dest</replaceable> [
|
|
<replaceable>protocol</replaceable> [ <replaceable>port</replaceable>
|
|
] ]</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.8. This command requires that the
|
|
firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in
|
|
<ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf
|
|
(5)</ulink>. The effect of the command is to temporarily open the
|
|
firewall for connections matching the parameters.</para>
|
|
|
|
<para>The <replaceable>source</replaceable> and
|
|
<replaceable>dest</replaceable> parameters may each be specified as
|
|
<emphasis role="bold">all</emphasis> if you don't wish to restrict
|
|
the connection source or destination respectively. Otherwise, each
|
|
must contain a host or network address or a valid DNS name.</para>
|
|
|
|
<para>The <replaceable>protocol</replaceable> may be specified
|
|
either as a number or as a name listed in /etc/protocols. The
|
|
<replaceable>port</replaceable> may be specified numerically or as a
|
|
name listed in /etc/services.</para>
|
|
|
|
<para>To reverse the effect of a successful <command>open</command>
|
|
command, use the <command>close</command> command with the same
|
|
parameters or simply restart the firewall.</para>
|
|
|
|
<para>Example: To open the firewall for SSH connections to address
|
|
2001:470:b:227::1, the command would be:</para>
|
|
|
|
<programlisting> shorewall6-lite open all 2001:470:b:227::1 tcp 22</programlisting>
|
|
|
|
<para>To reverse that command, use:</para>
|
|
|
|
<programlisting> shorewall6-lite close all 2001:470:b:227::1 tcp 22</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">reenable</emphasis>{
|
|
<replaceable>interface</replaceable> |
|
|
<replaceable>provider</replaceable> }</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.9. This is equivalent to a
|
|
<command>disable</command> command followed by an
|
|
<command>enable</command> command on the specified
|
|
<replaceable>interface</replaceable> or
|
|
<replaceable>provider</replaceable>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">reject</emphasis><replaceable>
|
|
address</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Causes traffic from the listed <emphasis>address</emphasis>es
|
|
to be silently rejected.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">reload </emphasis>[-n] [-p]
|
|
[-<option>C</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.0.0, <emphasis
|
|
role="bold">reload</emphasis> is similar to <command>shorewall6-lite
|
|
start</command> except that it assumes that the firewall is already
|
|
started. Existing connections are maintained.</para>
|
|
|
|
<para>The <option>-n</option> option causes shorewall6-lite to avoid
|
|
updating the routing table(s).</para>
|
|
|
|
<para>The <option>-p</option> option causes the connection tracking
|
|
table to be flushed; the <command>conntrack</command> utility must
|
|
be installed to use this option.</para>
|
|
|
|
<para>The <option>-C</option> option was added in Shorewall 4.6.5.
|
|
If the specified (or implicit) firewall script is the one that
|
|
generated the current running configuration, then the running
|
|
netfilter configuration will be reloaded as is so as to preserve the
|
|
iptables packet and byte counters.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">reset [<replaceable>chain</replaceable>,
|
|
...]</emphasis><acronym/></term>
|
|
|
|
<listitem>
|
|
<para>Resets the packet and byte counters in the specified
|
|
<replaceable>chain</replaceable>(s). If no
|
|
<replaceable>chain</replaceable> is specified, all the packet and
|
|
byte counters in the firewall are reset.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">restart </emphasis>[-n] [-p]
|
|
[-<option>C</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Beginning with Shorewall 5.0.0, this command performs a true
|
|
restart. The firewall is completely stopped as if a
|
|
<command>stop</command> command had been issued then it is started
|
|
again.</para>
|
|
|
|
<para>The <option>-n</option> option causes shorewall6-lite to avoid
|
|
updating the routing table(s).</para>
|
|
|
|
<para>The <option>-p</option> option causes the connection tracking
|
|
table to be flushed; the <command>conntrack</command> utility must
|
|
be installed to use this option.</para>
|
|
|
|
<para>The <option>-C</option> option was added in Shorewall 4.6.5.
|
|
If the specified (or implicit) firewall script is the one that
|
|
generated the current running configuration, then the running
|
|
netfilter configuration will be reloaded as is so as to preserve the
|
|
iptables packet and byte counters.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">restore </emphasis>[-<option>n</option>]
|
|
[-<option>p</option>] [-<option>C</option>] [
|
|
<replaceable>filename</replaceable> ]</term>
|
|
|
|
<listitem>
|
|
<para>Restore shorewall6-lite to a state saved using the
|
|
<command>shorewall6-lite save</command> command. Existing
|
|
connections are maintained. The <replaceable>filename</replaceable>
|
|
names a restore file in <filename
|
|
class="directory">/var/lib/shorewall6-lite</filename> created using
|
|
<command>shorewall6-lite save</command>; if no
|
|
<replaceable>filename</replaceable> is given then shorewall6-lite
|
|
will be restored from the file specified by the RESTOREFILE option
|
|
in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5).</para>
|
|
|
|
<caution>
|
|
<para>If your ip6tables ruleset depends on variables that are
|
|
detected at run-time, either in your params file or by
|
|
Shorewall-generated code, <command>restore</command> will use the
|
|
values that were current when the ruleset was saved, which may be
|
|
different from the current values.</para>
|
|
</caution>
|
|
|
|
<para>The <option>-C</option> option was added in Shorewall 4.6.5.
|
|
If the <option>-C</option> option was specified during
|
|
<command>shorewall7-lite save</command>, then the counters saved by
|
|
that operation will be restored.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">run
|
|
</emphasis><replaceable>command</replaceable> [
|
|
<replaceable>parameter</replaceable> ... ]</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.3. Executes
|
|
<replaceable>command</replaceable> in the context of the generated
|
|
script passing the supplied <replaceable>parameter</replaceable>s.
|
|
Normally, the <replaceable>command</replaceable> will be a function
|
|
declared in <filename>lib.private</filename>.</para>
|
|
|
|
<para>Before executing the command, the script will detect the
|
|
configuration, setting all SW_* variables and will run your
|
|
<filename>init</filename> extension script with $COMMAND =
|
|
'run'.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">save </emphasis>[-<option>C</option>] [
|
|
<replaceable>filename</replaceable> ]</term>
|
|
|
|
<listitem>
|
|
<para>The dynamic blacklist is stored in
|
|
<filename>/var/lib/shorewall6-lite/save</filename>. The state of the
|
|
firewall is stored in
|
|
<filename>/var/lib/shorewall6-lite/<replaceable>filename</replaceable></filename>
|
|
for use by the <command>shorewall6-lite restore</command> command.
|
|
If <replaceable>filename</replaceable> is not given then the state
|
|
is saved in the file specified by the RESTOREFILE option in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5).</para>
|
|
|
|
<para>The <option>-C</option> option, added in Shorewall 4.6.5,
|
|
causes the ip6tables packet and byte counters to be saved along with
|
|
the chains and rules.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">savesets</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in shorewall 4.6.8. Performs the same action as the
|
|
<command>stop</command> command with respect to saving ipsets (see
|
|
the SAVE_IPSETS option in <ulink
|
|
url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink> (5)).
|
|
This command may be used to proactively save your ipset contents in
|
|
the event that a system failure occurs prior to issuing a
|
|
<command>stop</command> command.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">show</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The show command can have a number of different
|
|
arguments:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>[-<option>x</option>] <emphasis
|
|
role="bold">bl|blacklists</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.2. Displays the dynamic chain
|
|
along with any chains produced by entries in
|
|
shorewall6-blrules(5).The <option>-x</option> option is passed
|
|
directly through to ip6tables and causes actual packet and
|
|
byte counts to be displayed. Without this option, those counts
|
|
are abbreviated.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>f</option>] <emphasis
|
|
role="bold">capabilities</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays your kernel/iptables capabilities. The
|
|
<option>-f</option> option causes the display to be formatted
|
|
as a capabilities file for use with <command>compile
|
|
-e</command>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>b</option>] [-<option>x</option>]
|
|
[-<option>l</option>] [-<option>t</option>
|
|
{<option>filter</option>|<option>mangle</option>|<option>nat</option>|<option>raw</option>|<option>rawpost</option>}][
|
|
<emphasis>chain</emphasis>... ]</term>
|
|
|
|
<listitem>
|
|
<para>The rules in each <emphasis>chain</emphasis> are
|
|
displayed using the <emphasis role="bold">iptables
|
|
-L</emphasis> <emphasis>chain</emphasis> <emphasis
|
|
role="bold">-n -v</emphasis> command. If no
|
|
<emphasis>chain</emphasis> is given, all of the chains in the
|
|
filter table are displayed.</para>
|
|
|
|
<para>The <option>-x</option> option is passed directly
|
|
through to iptables and causes actual packet and byte counts
|
|
to be displayed. Without this option, those counts are
|
|
abbreviated.</para>
|
|
|
|
<para>The <option>-t</option> option specifies the Netfilter
|
|
table to display. The default is <emphasis
|
|
role="bold">filter</emphasis>.</para>
|
|
|
|
<para>The <option>-b</option> ('brief') option causes rules
|
|
which have not been used (i.e. which have zero packet and byte
|
|
counts) to be omitted from the output. Chains with no rules
|
|
displayed are also omitted from the output.</para>
|
|
|
|
<para>The <option>-l</option> option causes the rule number
|
|
for each Netfilter rule to be displayed.</para>
|
|
|
|
<para>If the <option>-t</option> option and the
|
|
<option>chain</option> keyword are both omitted and any of the
|
|
listed <replaceable>chain</replaceable>s do not exist, a usage
|
|
message is displayed.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">classifiers|filters</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays information about the packet classifiers
|
|
defined on the system as a result of traffic shaping
|
|
configuration.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">config</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays distribution-specific defaults.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">connections
|
|
[<replaceable>filter_parameter</replaceable>
|
|
...]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the IP connections currently being tracked by
|
|
the firewall.</para>
|
|
|
|
<para>If the <command>conntrack</command> utility is
|
|
installed, beginning with Shorewall 4.6.11 the set of
|
|
connections displayed can be limited by including conntrack
|
|
filter parameters (-p , -s, --dport, etc). See conntrack(8)
|
|
for details.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">event</emphasis><replaceable>
|
|
event</replaceable></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.19. Displays the named
|
|
event.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">events</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.19. Displays all events.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ip</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the system's IPv4 configuration.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ipa</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.17. Displays the per-IP
|
|
accounting counters (<ulink
|
|
url="manpages/shorewall-accounting.html">shorewall-accounting</ulink>
|
|
(5)).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>m</option>] <emphasis
|
|
role="bold">log</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the last 20 shorewall6-lite messages from the
|
|
log file specified by the LOGFILE option in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5).</para>
|
|
|
|
<para>The <option>-m</option> option causes the MAC address of
|
|
each packet source to be displayed if that information is
|
|
available.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>x</option>] <emphasis
|
|
role="bold">mangle</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the Netfilter mangle table using the command
|
|
<command>ip6tables -t mangle -L -n -v</command>.The
|
|
<option>-x</option> option is passed directly through to
|
|
ip6tables and causes actual packet and byte counts to be
|
|
displayed. Without this option, those counts are
|
|
abbreviated.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">marks</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.26. Displays the various fields
|
|
in packet marks giving the min and max value (in both decimal
|
|
and hex) and the applicable mask (in hex).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">opens</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.8. Displays the iptables rules in
|
|
the 'dynamic' chain created through use of the <command>open
|
|
</command>command..</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>x</option>] <emphasis
|
|
role="bold">nat</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the Netfilter nat table using the command
|
|
<command>ip6tables -t nat -L -n -v</command>.The
|
|
<option>-x</option> option is passed directly through to
|
|
iptables and causes actual packet and byte counts to be
|
|
displayed. Without this option, those counts are
|
|
abbreviated.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">policies</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.4. Displays the applicable policy
|
|
between each pair of zones. Note that implicit intrazone
|
|
ACCEPT policies are not displayed for zones associated with a
|
|
single network where that network doesn't specify
|
|
<option>routeback</option>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>x</option>] <emphasis
|
|
role="bold">raw</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the Netfilter raw table using the command
|
|
<command>iptables -t raw -L -n -v</command>.The
|
|
<option>-x</option> option is passed directly through to
|
|
iptables and causes actual packet and byte counts to be
|
|
displayed. Without this option, those counts are
|
|
abbreviated.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>[-<option>c</option>]<emphasis role="bold">
|
|
</emphasis><emphasis role="bold">routing</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the system's IPv4 routing configuration. The -c
|
|
option causes the route cache to be displayed in addition to
|
|
the other routing information.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">tc</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays information about queuing disciplines, classes
|
|
and filters.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">zones</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Displays the current composition of the Shorewall zones
|
|
on the system.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">start </emphasis>[-<option>p</option>]
|
|
[-<option>n</option>] [<option>-f</option>]
|
|
[-<option>C</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Start Shorewall6 Lite. Existing connections through
|
|
shorewall6-lite managed interfaces are untouched. New connections
|
|
will be allowed only if they are allowed by the firewall rules or
|
|
policies.</para>
|
|
|
|
<para>The <option>-p</option> option causes the connection tracking
|
|
table to be flushed; the <command>conntrack</command> utility must
|
|
be installed to use this option.</para>
|
|
|
|
<para>The <option>-n</option> option prevents the firewall script
|
|
from modifying the current routing configuration.</para>
|
|
|
|
<para>The <option>-f</option> option was added in Shorewall 4.6.5.
|
|
If the RESTOREFILE named in <ulink
|
|
url="shorewall.conf.html">shorewall.conf</ulink>(5) exists, is
|
|
executable and is not older than the current filewall script, then
|
|
that saved configuration is restored.</para>
|
|
|
|
<para>The <option>-C</option> option was added in Shorewall 4.6.5
|
|
and is only meaningful when the <option>-f</option> option is also
|
|
specified. If the previously-saved configuration is restored, and if
|
|
the <option>-C</option> option was also specified in the
|
|
<command>save</command> command, then the packet and byte counters
|
|
will be restored.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">stop </emphasis><emphasis role="bold">
|
|
</emphasis>[-<option>f</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Stops the firewall. All existing connections, except those
|
|
listed in <ulink
|
|
url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
|
|
or permitted by the ADMINISABSENTMINDED option in <ulink
|
|
url="shorewall.conf.html">shorewall6.conf</ulink>(5), are taken
|
|
down. The only new traffic permitted through the firewall is from
|
|
systems listed in <ulink
|
|
url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
|
|
or by ADMINISABSENTMINDED.</para>
|
|
|
|
<para>If <option>-f</option> is given, the command will be processed
|
|
by the compiled script that executed the last successful
|
|
<command>start</command>, <command>restart</command> or
|
|
<command>refresh</command> command if that script exists.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">status</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Produces a short report about the state of the
|
|
Shorewall-configured firewall.</para>
|
|
|
|
<para>The <option>-i</option> option was added in Shorewall 4.6.2
|
|
and causes the status of each optional or provider interface to be
|
|
displayed.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">version
|
|
</emphasis>[-<option>a</option>]</term>
|
|
|
|
<listitem>
|
|
<para>Displays Shorewall's version. The <option>-a</option> option
|
|
is included for compatibility with earlier Shorewall releases and is
|
|
ignored.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>EXIT STATUS</title>
|
|
|
|
<para>In general, when a command succeeds, status 0 is returned; when the
|
|
command fails, a non-zero status is returned.</para>
|
|
|
|
<para>The <command>status</command> command returns exit status as
|
|
follows:</para>
|
|
|
|
<para>0 - Firewall is started.</para>
|
|
|
|
<para>3 - Firewall is stopped or cleared</para>
|
|
|
|
<para>4 - Unknown state; usually means that the firewall has never been
|
|
started.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>ENVIRONMENT</title>
|
|
|
|
<para>Two environmental variables are recognized by
|
|
Shorewall6-lite:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>SHOREWALL_INIT_SCRIPT</term>
|
|
|
|
<listitem>
|
|
<para>When set to 1, causes Std out to be redirected to the file
|
|
specified in the STARTUP_LOG option in <ulink
|
|
url="shorewall6.conf.html">shorewall6.conf(5)</ulink>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>SW_LOGGERTAG</term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.0.8. When set to a non-empty value, that
|
|
value is passed to the logger utility in its -t (--tag)
|
|
option.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para><ulink
|
|
url="http://www.shorewall.net/starting_and_stopping_shorewall.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
|
|
|
|
<para>shorewall6-accounting(5), shorewall6-actions(5),
|
|
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall_interfaces(5),
|
|
shorewall6-ipsets(5), shorewall6-maclist(5), shorewall6-masq(5),
|
|
shorewall6-netmap(5), shorewall6-params(5), shorewall6-policy(5),
|
|
shorewall6-providers(5), shorewall6-proxyarp(5), shorewall6-rtrules(5),
|
|
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
|
|
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
|
|
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),
|
|
shorewall6-zones(5)</para>
|
|
</refsect1>
|
|
</refentry>
|