mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-16 03:10:39 +01:00
b66929a65e
1) Elimination of the "shorewall monitor" command. 2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into a single /etc/shorewall/zones file. This is done in an upwardly-compatible way so that current users can continue to use their existing files. 3) Support has been added for the arp_ignore interface option. 4) DROPINVALID has been removed from shorewall.conf. Behavior is as if DROPINVALID=No was specified. 5) The 'nobogons' option and BOGON_LOG_LEVEL are removed. 6) Error and warning messages have been made easier to spot by using capitalization (e.g., ERROR: and WARNING:). 7) The /etc/shorewall/policy file now contains a new connection policy and a policy for ESTABLISHED packets. Useful for users of snort-inline who want to pass all packets to the QUEUE target. 8) A new 'critical' option has been added to /etc/shorewall/routestopped. Shorewall insures communication between the firewall and 'critical' hosts throughout start, restart, stop and clear. Useful for diskless firewall's with NFS-mounted file systems, LDAP servers, Crossbow, etc. 9) Macros. Macros are very similar to actions but are easier to use, allow parameter substitution and are more efficient. Almost all of the standard actions have been converted to macros in the EXPERIMENTAL branch. 10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No. 11) If you have 'make' installed on your firewall, then when you use the '-f' option to 'shorewall start' (as happens when you reboot), if your /etc/shorewall/ directory contains files that were modified after Shorewall was last restarted then Shorewall is started using the config files rather than using the saved configuration. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
48 lines
1.9 KiB
Plaintext
Executable File
48 lines
1.9 KiB
Plaintext
Executable File
##############################################################################
|
|
#
|
|
# Shorewall 2.6 -- Network Address Translation Table
|
|
#
|
|
# /etc/shorewall/nat
|
|
#
|
|
# This file is used to define one-to-one Network Address Translation
|
|
# (NAT).
|
|
#
|
|
# WARNING: If all you want to do is simple port forwarding, do NOT use this
|
|
# file. See http://www.shorewall.net/FAQ.htm#faq1. Also, in most
|
|
# cases, Proxy ARP is a better solution that one-to-one NAT.
|
|
#
|
|
# Columns must be separated by white space and are:
|
|
#
|
|
# EXTERNAL External IP Address - this should NOT be the primary
|
|
# IP address of the interface named in the next
|
|
# column and must not be a DNS Name.
|
|
#
|
|
# INTERFACE Interface that you want to EXTERNAL address to appear
|
|
# on. If ADD_IP_ALIASES=Yes in shorewall.conf, you may
|
|
# follow the interface name with ":" and a digit to
|
|
# indicate that you want Shorewall to add the alias
|
|
# with this name (e.g., "eth0:0"). That allows you to
|
|
# see the alias with ifconfig. THAT IS THE ONLY THING
|
|
# THAT THIS NAME IS GOOD FOR -- YOU CANNOT USE IT
|
|
# ANYWHERE ELSE IN YOUR SHORWALL CONFIGURATION.
|
|
#
|
|
# If you want to override ADD_IP_ALIASES=Yes for a
|
|
# particular entry, follow the interface name with
|
|
# ":" and no digit (e.g., "eth0:").
|
|
# INTERNAL Internal Address (must not be a DNS Name).
|
|
#
|
|
# ALL INTERFACES If Yes or yes, NAT will be effective from all hosts.
|
|
# If No or no (or left empty) then NAT will be effective
|
|
# only through the interface named in the INTERFACE
|
|
# column
|
|
#
|
|
# LOCAL If Yes or yes, NAT will be effective from the firewall
|
|
# system
|
|
#
|
|
# For additional information, see http://shorewall.net/NAT.htm
|
|
##############################################################################
|
|
#EXTERNAL INTERFACE INTERNAL ALL LOCAL
|
|
# INTERFACES
|
|
#
|
|
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
|