mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-26 08:08:59 +01:00
53495ec0a8
Signed-off-by: Matt Darfeuille <matdarf@gmail.com> Signed-off-by: Tom Eastep <teastep@shorewall.net>
1135 lines
45 KiB
XML
1135 lines
45 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall-interfaces</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
|
|
<refmiscinfo>Configuration Files</refmiscinfo>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>interfaces</refname>
|
|
|
|
<refpurpose>Shorewall interfaces file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall[6]/interfaces</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>The interfaces file serves to define the firewall's network
|
|
interfaces to Shorewall. The order of entries in this file is not
|
|
significant in determining zone composition.</para>
|
|
|
|
<para>Beginning with Shorewall 4.5.3, the interfaces file supports two
|
|
different formats:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>FORMAT 1 (default - deprecated)</term>
|
|
|
|
<listitem>
|
|
<para>There is a BROADCAST column which can be used to specify the
|
|
broadcast address associated with the interface.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>FORMAT 2</term>
|
|
|
|
<listitem>
|
|
<para>The BROADCAST column is omitted.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>The format is specified by a line as follows:</para>
|
|
|
|
<blockquote>
|
|
<para><emphasis role="bold">?FORMAT {1|2}</emphasis></para>
|
|
</blockquote>
|
|
|
|
<para>The columns in the file are as follows.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ZONE</emphasis> -
|
|
<emphasis>zone-name</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Zone for this interface. Must match the name of a zone
|
|
declared in /etc/shorewall/zones. You may not list the firewall zone
|
|
in this column.</para>
|
|
|
|
<para>If the interface serves multiple zones that will be defined in
|
|
the <ulink
|
|
url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5)
|
|
file, you should place "-" in this column.</para>
|
|
|
|
<para>If there are multiple interfaces to the same zone, you must
|
|
list them in separate entries.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<blockquote>
|
|
<programlisting>#ZONE INTERFACE BROADCAST
|
|
loc eth1 -
|
|
loc eth2 -</programlisting>
|
|
</blockquote>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">INTERFACE</emphasis> -
|
|
<emphasis>interface</emphasis><emphasis
|
|
role="bold">[:</emphasis><emphasis>port</emphasis><emphasis
|
|
role="bold">]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Logical name of interface. Each interface may be listed only
|
|
once in this file. You may NOT specify the name of a "virtual"
|
|
interface (e.g., eth0:0) here; see <ulink
|
|
url="/FAQ.htm#faq18">http://www.shorewall.org/FAQ.htm#faq18</ulink>.
|
|
If the <option>physical</option> option is not specified, then the
|
|
logical name is also the name of the actual interface.</para>
|
|
|
|
<para>You may use wildcards here by specifying a prefix followed by
|
|
the plus sign ("+"). For example, if you want to make an entry that
|
|
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
|
|
ppp1, ppp2, …</para>
|
|
|
|
<para>When using Shorewall versions before 4.1.4, care must be
|
|
exercised when using wildcards where there is another zone that uses
|
|
a matching specific interface. See <ulink
|
|
url="/manpages/shorewall-nesting.html">shorewall-nesting</ulink>(5)
|
|
for a discussion of this problem.</para>
|
|
|
|
<para>Shorewall allows '+' as an interface name, but that usage is
|
|
deprecated. A better approach is to specify
|
|
'<option>physical</option>=+' in the OPTIONS column (see
|
|
below).</para>
|
|
|
|
<para>There is no need to define the loopback interface (lo) in this
|
|
file.</para>
|
|
|
|
<para>If a <replaceable>port</replaceable> is given, then the
|
|
<replaceable>interface</replaceable> must have been defined
|
|
previously with the <option>bridge</option> option. The OPTIONS
|
|
column may not contain the following options when a
|
|
<replaceable>port</replaceable> is given.</para>
|
|
|
|
<simplelist>
|
|
<member>arp_filter</member>
|
|
|
|
<member>arp_ignore</member>
|
|
|
|
<member>bridge</member>
|
|
|
|
<member>log_martians</member>
|
|
|
|
<member>mss</member>
|
|
|
|
<member>optional</member>
|
|
|
|
<member>proxyarp</member>
|
|
|
|
<member>required</member>
|
|
|
|
<member>routefilter</member>
|
|
|
|
<member>sourceroute</member>
|
|
|
|
<member>upnp</member>
|
|
|
|
<member>wait</member>
|
|
</simplelist>
|
|
|
|
<para>Beginning with Shorewall 4.5.17, if you specify a zone for the
|
|
'lo' interface, then that zone must be defined as type
|
|
<option>local</option> in <ulink
|
|
url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">BROADCAST</emphasis> (Optional) -
|
|
{<emphasis role="bold">-</emphasis>|<emphasis
|
|
role="bold">detect</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...}</term>
|
|
|
|
<listitem>
|
|
<para>Only available if FORMAT 1.</para>
|
|
|
|
<para>If you use the special value <emphasis
|
|
role="bold">detect</emphasis>, Shorewall will detect the broadcast
|
|
address(es) for you if your iptables and kernel include Address Type
|
|
Match support.</para>
|
|
|
|
<para>If your iptables and/or kernel lack Address Type Match support
|
|
then you may list the broadcast address(es) for the network(s) to
|
|
which the interface belongs. For P-T-P interfaces, this column is
|
|
left blank. If the interface has multiple addresses on multiple
|
|
subnets then list the broadcast addresses as a comma-separated
|
|
list.</para>
|
|
|
|
<para>If you don't want to give a value for this column but you want
|
|
to enter a value in the OPTIONS column, enter <emphasis
|
|
role="bold">-</emphasis> in this column.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">OPTIONS</emphasis> (Optional) -
|
|
[<emphasis>option</emphasis>[<emphasis
|
|
role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
|
|
|
|
<listitem>
|
|
<para>A comma-separated list of options from the following list. The
|
|
order in which you list the options is not significant but the list
|
|
should have no embedded white-space.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">accept_ra</emphasis>[={0|1|2}]</term>
|
|
|
|
<listitem>
|
|
<para>IPv6 only; added in Shorewall 4.5.16. Values are:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>0</term>
|
|
|
|
<listitem>
|
|
<para>Do not accept Router Advertisements.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>1</term>
|
|
|
|
<listitem>
|
|
<para>Accept Route Advertisements if forwarding is
|
|
disabled.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>2</term>
|
|
|
|
<listitem>
|
|
<para>Overrule forwarding behavior. Accept Route
|
|
Advertisements even if forwarding is enabled.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>If the option is specified without a value, then the
|
|
value 1 is assumed.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">arp_filter[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. If specified, this interface will only
|
|
respond to ARP who-has requests for IP addresses configured on
|
|
the interface. If not specified, the interface can respond to
|
|
ARP who-has requests for IP addresses on any of the firewall's
|
|
interface. The interface must be up when Shorewall is
|
|
started.</para>
|
|
|
|
<para>Only those interfaces with the
|
|
<option>arp_filter</option> option will have their setting
|
|
changed; the value assigned to the setting will be the value
|
|
specified (if any) or 1 if no value is given.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">arp_ignore</emphasis>[=<emphasis>number</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. If specified, this interface will respond to
|
|
arp requests based on the value of <emphasis>number</emphasis>
|
|
(defaults to 1).</para>
|
|
|
|
<para>1 - reply only if the target IP address is local address
|
|
configured on the incoming interface</para>
|
|
|
|
<para>2 - reply only if the target IP address is local address
|
|
configured on the incoming interface and the sender's IP
|
|
address is part from same subnet on this interface's
|
|
address</para>
|
|
|
|
<para>3 - do not reply for local addresses configured with
|
|
scope host, only resolutions for global and link</para>
|
|
|
|
<para>4-7 - reserved</para>
|
|
|
|
<para>8 - do not reply for all local addresses</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
|
|
<warning>
|
|
<para>Do not specify <emphasis
|
|
role="bold">arp_ignore</emphasis> for any interface involved
|
|
in <ulink url="/ProxyARP.htm">Proxy ARP</ulink>.</para>
|
|
</warning>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">blacklist</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Checks packets arriving on this interface against the
|
|
<ulink
|
|
url="/manpages/shorewall-blacklist.html">shorewall-blacklist</ulink>(5)
|
|
file.</para>
|
|
|
|
<para>Beginning with Shorewall 4.4.13:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>If a <replaceable>zone</replaceable> is given in the
|
|
ZONES column, then the behavior is as if <emphasis
|
|
role="bold">blacklist</emphasis> had been specified in the
|
|
IN_OPTIONS column of <ulink
|
|
url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5).</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Otherwise, the option is ignored with a
|
|
warning:</para>
|
|
|
|
<blockquote>
|
|
<para><emphasis role="bold">WARNING: The 'blacklist'
|
|
option is ignored on multi-zone
|
|
interfaces</emphasis></para>
|
|
</blockquote>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">bridge</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Designates the interface as a bridge. Beginning with
|
|
Shorewall 4.4.7, setting this option also sets
|
|
<option>routeback</option>.</para>
|
|
|
|
<note>
|
|
<para>If you have a bridge that you don't intend to define
|
|
bport zones on, then it is best to omit this option and
|
|
simply specify <option>routeback</option>.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">dbl={none|src|dst|src-dst}</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.0.10. This option defined whether
|
|
or not dynamic blacklisting is applied to packets entering the
|
|
firewall through this interface and whether the source address
|
|
and/or destination address is to be compared against the
|
|
ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
|
|
<ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
|
|
The default is determine by the setting of
|
|
DYNAMIC_BLACKLIST:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>DYNAMIC_BLACKLIST=No</term>
|
|
|
|
<listitem>
|
|
<para>Default is <emphasis role="bold">none</emphasis>
|
|
(e.g., no dynamic blacklist checking).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>DYNAMIC_BLACKLIST=Yes</term>
|
|
|
|
<listitem>
|
|
<para>Default is <emphasis role="bold">src</emphasis>
|
|
(e.g., the source IP address is checked).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>DYNAMIC_BLACKLIST=ipset[-only]</term>
|
|
|
|
<listitem>
|
|
<para>Default is <emphasis
|
|
role="bold">src</emphasis>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>DYNAMIC_BLACKLIST=ipset[-only],src-dst...</term>
|
|
|
|
<listitem>
|
|
<para>Default is <emphasis
|
|
role="bold">src-dst</emphasis> (e.g., the source IP
|
|
addresses in checked against the ipset on input and the
|
|
destination IP address is checked against the ipset on
|
|
packets originating from the firewall and leaving
|
|
through this interface).</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>The normal setting for this option will be <emphasis
|
|
role="bold">dst</emphasis> or <emphasis
|
|
role="bold">none</emphasis> for internal interfaces and
|
|
<emphasis role="bold">src</emphasis> or <emphasis
|
|
role="bold">src-dst</emphasis> for Internet-facing
|
|
interfaces.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">destonly</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.17. Causes the compiler to omit
|
|
rules to handle traffic from this interface.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">dhcp</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Specify this option when any of the following are
|
|
true:</para>
|
|
|
|
<orderedlist spacing="compact">
|
|
<listitem>
|
|
<para>the interface gets its IP address via DHCP</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>the interface is used by a DHCP server running on
|
|
the firewall</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>the interface has a static IP but is on a LAN
|
|
segment with lots of DHCP clients.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>the interface is a <ulink
|
|
url="/SimpleBridge.html">simple bridge</ulink> with a DHCP
|
|
server on one port and DHCP clients on another
|
|
port.</para>
|
|
|
|
<note>
|
|
<para>If you use <ulink
|
|
url="/bridge-Shorewall-perl.html">Shorewall-perl for
|
|
firewall/bridging</ulink>, then you need to include
|
|
DHCP-specific rules in <ulink
|
|
url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5).
|
|
DHCP uses UDP ports 67 and 68.</para>
|
|
</note>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para>This option allows DHCP datagrams to enter and leave the
|
|
interface.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">forward</emphasis>[={0|1}]</term>
|
|
|
|
<listitem>
|
|
<para>IPv6 only Sets the
|
|
/proc/sys/net/ipv6/conf/interface/forwarding option to the
|
|
specified value. If no value is supplied, then 1 is
|
|
assumed.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ignore[=1]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>When specified, causes the generated script to ignore
|
|
up/down events from Shorewall-init for this device.
|
|
Additionally, the option exempts the interface from hairpin
|
|
filtering. When '=1' is omitted, the ZONE column must contain
|
|
'-' and <option>ignore</option> must be the only
|
|
OPTION.</para>
|
|
|
|
<para>Beginning with Shorewall 4.5.5, may be specified as
|
|
'<option>ignore=1</option>' which only causes the generated
|
|
script to ignore up/down events from Shorewall-init; hairpin
|
|
filtering is still applied. In this case, the above
|
|
restrictions on the ZONE and OPTIONS columns are
|
|
lifted.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">loopback</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.6.6. Designates the interface as
|
|
the loopback interface. This option is assumed if the
|
|
interface's physical name is 'lo'. Only one interface man have
|
|
the <option>loopback</option> option specified.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">logmartians[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. Turn on kernel martian logging (logging of
|
|
packets with impossible source addresses. It is strongly
|
|
suggested that if you set <emphasis
|
|
role="bold">routefilter</emphasis> on an interface that you
|
|
also set <emphasis role="bold">logmartians</emphasis>. Even if
|
|
you do not specify the <option>routefilter</option> option, it
|
|
is a good idea to specify <option>logmartians</option> because
|
|
your distribution may have enabled route filtering without you
|
|
knowing it.</para>
|
|
|
|
<para>Only those interfaces with the
|
|
<option>logmartians</option> option will have their setting
|
|
changed; the value assigned to the setting will be the value
|
|
specified (if any) or 1 if no value is given.</para>
|
|
|
|
<para>To find out if route filtering is set on a given
|
|
<replaceable>interface</replaceable>, check the contents of
|
|
<filename>/proc/sys/net/ipv4/conf/<replaceable>interface</replaceable>/rp_filter</filename>
|
|
- a non-zero value indicates that route filtering is
|
|
enabled.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<programlisting> teastep@lists:~$ <command>cat /proc/sys/net/ipv4/conf/eth0/rp_filter </command>
|
|
1
|
|
teastep@lists:~$ </programlisting>
|
|
|
|
<para/>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
|
|
<blockquote>
|
|
<para>This option may also be enabled globally in the <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
|
|
file.</para>
|
|
</blockquote>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">maclist</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Connection requests from this interface are compared
|
|
against the contents of <ulink
|
|
url="/manpages/shorewall-maclist.html">shorewall-maclist</ulink>(5).
|
|
If this option is specified, the interface must be an Ethernet
|
|
NIC and must be up before Shorewall is started.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold"><emphasis
|
|
role="bold">mss</emphasis>=</emphasis><emphasis>number</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.0.3. Causes forwarded TCP SYN
|
|
packets entering or leaving on this interface to have their
|
|
MSS field set to the specified
|
|
<replaceable>number</replaceable>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">nets=(<emphasis>net</emphasis>[,...])</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Limit the zone named in the ZONE column to only the
|
|
listed networks. The parentheses may be omitted if only a
|
|
single <replaceable>net</replaceable> is given (e.g.,
|
|
nets=192.168.1.0/24). Limited broadcast to the zone is
|
|
supported. Beginning with Shorewall 4.4.1, multicast traffic
|
|
to the zone is also supported.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">nets=dynamic</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Defines the zone as <firstterm>dynamic</firstterm>.
|
|
Requires ipset match support in your iptables and kernel. See
|
|
<ulink
|
|
url="/Dynamic.html">http://www.shorewall.org/Dynamic.html</ulink>
|
|
for further information.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">nodbl</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 5.0.8. When specified, dynamic
|
|
blacklisting is disabled on the interface. Beginning with
|
|
Shorewall 5.0.10, <emphasis role="bold">nodbl</emphasis> is
|
|
equivalent to <emphasis
|
|
role="bold">dbl=none</emphasis>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">nosmurfs</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. Filter packets for smurfs (packets with a
|
|
broadcast address as the source).</para>
|
|
|
|
<para>Smurfs will be optionally logged based on the setting of
|
|
SMURF_LOG_LEVEL in <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).
|
|
After logging, the packets are dropped.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">optional</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>When <option>optional</option> is specified for an
|
|
interface, Shorewall will be silent when:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>a <filename
|
|
class="directory">/proc/sys/net/ipv[46]/conf/</filename>
|
|
entry for the interface cannot be modified (including for
|
|
proxy ARP or proxy NDP).</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The first address of the interface cannot be
|
|
obtained.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>May not be specified with <emphasis
|
|
role="bold">required</emphasis>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">physical</emphasis>=<emphasis
|
|
role="bold"><emphasis>name</emphasis></emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.4. When specified, the interface
|
|
or port name in the INTERFACE column is a logical name that
|
|
refers to the name given in this option. It is useful when you
|
|
want to specify the same wildcard port name on two or more
|
|
bridges. See <ulink
|
|
url="/bridge-Shorewall-perl.html#Multiple">http://www.shorewall.org/bridge-Shorewall-perl.html#Multiple</ulink>.</para>
|
|
|
|
<para>If the <emphasis>interface</emphasis> name is a wildcard
|
|
name (ends with '+'), then the physical
|
|
<emphasis>name</emphasis> must also end in '+'. The physical
|
|
<replaceable>name</replaceable> may end in '+' (or be exactly
|
|
'+') when the <replaceable>interface</replaceable> name is not
|
|
a wildcard name.</para>
|
|
|
|
<para>If <option>physical</option> is not specified, then it's
|
|
value defaults to the <emphasis>interface</emphasis>
|
|
name.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">proxyarp[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. Sets
|
|
/proc/sys/net/ipv4/conf/<emphasis>interface</emphasis>/proxy_arp.
|
|
Do NOT use this option if you are employing Proxy ARP through
|
|
entries in <ulink
|
|
url="/manpages/shorewall-proxyarp.html">shorewall-proxyarp</ulink>(5).
|
|
This option is intended solely for use with Proxy ARP
|
|
sub-networking as described at: <ulink
|
|
url="http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html">http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.
|
|
</ulink></para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
|
|
<para>Only those interfaces with the <option>proxyarp</option>
|
|
option will have their setting changed; the value assigned to
|
|
the setting will be the value specified (if any) or 1 if no
|
|
value is given.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">proxyndp</emphasis>[={0|1}]</term>
|
|
|
|
<listitem>
|
|
<para>IPv6 only. Sets
|
|
/proc/sys/net/ipv6/conf/<emphasis>interface</emphasis>/proxy_ndp.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
|
|
<para>Only those interfaces with the <option>proxyndp</option>
|
|
option will have their setting changed; the value assigned to
|
|
the setting will be the value specified (if any) or 1 if no
|
|
value is given.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">required</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.10. If this option is set, the
|
|
firewall will fail to start if the interface is not usable.
|
|
May not be specified together with <emphasis
|
|
role="bold">optional</emphasis>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">routeback[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>If specified, indicates that Shorewall should include
|
|
rules that allow traffic arriving on this interface to be
|
|
routed back out that same interface. This option is also
|
|
required when you have used a wildcard in the INTERFACE column
|
|
if you want to allow traffic between the interfaces that match
|
|
the wildcard.</para>
|
|
|
|
<para>Beginning with Shorewall 4.4.20, if you specify this
|
|
option, then you should also specify either
|
|
<option>sfilter</option> (see below) or
|
|
<option>routefilter</option> on all interfaces (see
|
|
below).</para>
|
|
|
|
<para>Beginning with Shorewall 4.5.18, you may specify this
|
|
option to explicitly reset (e.g., <emphasis
|
|
role="bold">routeback=0</emphasis>). This can be used to
|
|
override Shorewall's default setting for bridge devices which
|
|
is <emphasis role="bold">routeback=1</emphasis>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">routefilter[={0|1|2}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv4 only. Turn on kernel route filtering for this
|
|
interface (anti-spoofing measure).</para>
|
|
|
|
<para>Only those interfaces with the
|
|
<option>routefilter</option> option will have their setting
|
|
changes; the value assigned to the setting will be the value
|
|
specified (if any) or 1 if no value is given.</para>
|
|
|
|
<para>The value 2 is only available with Shorewall 4.4.5.1 and
|
|
later when the kernel version is 2.6.31 or later. It specifies
|
|
a <firstterm>loose</firstterm> form of reverse path
|
|
filtering.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
|
|
<para>This option can also be enabled globally via the
|
|
ROUTE_FILTER option in the <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
|
|
file.</para>
|
|
|
|
<important>
|
|
<para>If ROUTE_FILTER=Yes in <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5),
|
|
or if your distribution sets net.ipv4.conf.all.rp_filter=1
|
|
in <filename>/etc/sysctl.conf</filename>, then setting
|
|
<emphasis role="bold">routefilter</emphasis>=0 in an
|
|
<replaceable>interface</replaceable> entry will not disable
|
|
route filtering on that
|
|
<replaceable>interface</replaceable>! The effective setting
|
|
for an <replaceable>interface</replaceable> is the maximum
|
|
of the contents of
|
|
<filename>/proc/sys/net/ipv4/conf/all/rp_filter</filename>
|
|
and the routefilter setting specified in this file
|
|
(/proc/sys/net/ipv4/conf/<replaceable>interface</replaceable>/rp_filter).</para>
|
|
</important>
|
|
|
|
<note>
|
|
<para>There are certain cases where
|
|
<option>routefilter</option> cannot be used on an
|
|
interface:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>If USE_DEFAULT_RT=Yes in <ulink
|
|
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
|
|
and the interface is listed in <ulink
|
|
url="/manpages/shorewall-providers.html">shorewall-providers</ulink>(5).</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If there is an entry for the interface in <ulink
|
|
url="/manpages/shorewall-providers.html">shorewall-providers</ulink>(5)
|
|
that doesn't specify the <option>balance</option>
|
|
option.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If IPSEC is used to allow a road-warrior to have a
|
|
local address, then any interface through which the
|
|
road-warrior might connect cannot specify
|
|
<option>routefilter</option>.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</note>
|
|
|
|
<para>Beginning with Shorewall 5.1.1, when
|
|
<option>routefilter</option> is set to a non-zero value, the
|
|
<option>logmartians</option> option is also implicitly set. If
|
|
you actually want route filtering without logging, then you
|
|
must also specify <option>logmartians=0</option> after
|
|
<option>routefilter</option>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">rpfilter</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.7. This is an anti-spoofing
|
|
measure that requires the 'RPFilter Match' capability in your
|
|
iptables and kernel. It provides a more efficient alternative
|
|
to the <option>sfilter</option> option below. It performs a
|
|
function similar to <option>routefilter</option> (see above)
|
|
but works with Multi-ISP configurations that do not use
|
|
balanced routes.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">sfilter=(<emphasis>net</emphasis>[,...])</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.20. This option provides an
|
|
anti-spoofing alternative to <option>routefilter</option> on
|
|
interfaces where that option cannot be used, but where the
|
|
<option>routeback</option> option is required (on a bridge,
|
|
for example). On these interfaces, <option>sfilter</option>
|
|
should list those local networks that are connected to the
|
|
firewall through other interfaces.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">sourceroute[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>If this option is not specified for an interface, then
|
|
source-routed packets will not be accepted from that interface
|
|
unless it has been explicitly enabled via sysconf. Only set
|
|
this option to 1 (enable source routing) if you know what you
|
|
are doing. This might represent a security risk and is usually
|
|
unneeded.</para>
|
|
|
|
<para>Only those interfaces with the
|
|
<option>sourceroute</option> option will have their setting
|
|
changed; the value assigned to the setting will be the value
|
|
specified (if any) or 1 if no value is given.</para>
|
|
|
|
<note>
|
|
<para>This option does not work with a wild-card <emphasis
|
|
role="bold">physical</emphasis> name (e.g., eth0.+).
|
|
Beginning with Shorewall 5.1.10, If this option is
|
|
specified, a warning is issued and the option is
|
|
ignored.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">tcpflags[={0|1}]</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Packets arriving on this interface are checked for
|
|
certain illegal combinations of TCP flags. Packets found to
|
|
have such a combination of flags are handled according to the
|
|
setting of TCP_FLAGS_DISPOSITION after having been logged
|
|
according to the setting of TCP_FLAGS_LOG_LEVEL.</para>
|
|
|
|
<para>Beginning with Shorewall 4.6.0, tcpflags=1 is the
|
|
default. To disable this option, specify tcpflags=0.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">unmanaged</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.5.18. Causes all traffic between
|
|
the firewall and hosts on the interface to be accepted. When
|
|
this option is given:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>The ZONE column must contain '-'.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Only the following other options are allowed with
|
|
<emphasis role="bold">unmanaged</emphasis>:</para>
|
|
|
|
<simplelist>
|
|
<member><emphasis
|
|
role="bold">arp_filter</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">arp_ignore</emphasis></member>
|
|
|
|
<member><emphasis role="bold">ignore</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">routefilter</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">optional</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">physical</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">routefilter</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">proxyarp</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">proxyudp</emphasis></member>
|
|
|
|
<member><emphasis
|
|
role="bold">sourceroute</emphasis></member>
|
|
</simplelist>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">upnp</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Incoming requests from this interface may be remapped
|
|
via UPNP (upnpd). See <ulink
|
|
url="/UPnP.html">http://www.shorewall.org/UPnP.html</ulink>.
|
|
Supported in IPv4 and in IPv6 in Shorewall 5.1.4 and
|
|
later.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">upnpclient</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>This option is intended for laptop users who always run
|
|
Shorewall on their system yet need to run UPnP-enabled client
|
|
apps such as Transmission (BitTorrent client). The option
|
|
causes Shorewall to detect the default gateway through the
|
|
interface and to accept UDP packets from that gateway. Note
|
|
that, like all aspects of UPnP, this is a security hole so use
|
|
this option at your own risk. Supported in IPv4 and in IPv6 in
|
|
Shorewall 5.1.4 and later.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">wait</emphasis>=<emphasis>seconds</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Added in Shorewall 4.4.10. Causes the generated script
|
|
to wait up to <emphasis>seconds</emphasis> seconds for the
|
|
interface to become usable before applying the <emphasis
|
|
role="bold">required</emphasis> or <emphasis
|
|
role="bold">optional</emphasis> options.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Example</title>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>IPv4 Example 1:</term>
|
|
|
|
<listitem>
|
|
<para>Suppose you have eth0 connected to a DSL modem and eth1
|
|
connected to your local network and that your local subnet is
|
|
192.168.1.0/24. The interface gets its IP address via DHCP from
|
|
subnet 206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24
|
|
using eth2. Your iptables and/or kernel do not support "Address Type
|
|
Match" and you prefer to specify broadcast addresses explicitly
|
|
rather than having Shorewall detect them.</para>
|
|
|
|
<para>Your entries for this setup would look like:</para>
|
|
|
|
<programlisting>?FORMAT 1
|
|
#ZONE INTERFACE BROADCAST OPTIONS
|
|
net eth0 206.191.149.223 dhcp
|
|
loc eth1 192.168.1.255
|
|
dmz eth2 192.168.2.255</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 2:</term>
|
|
|
|
<listitem>
|
|
<para>The same configuration without specifying broadcast addresses
|
|
is:</para>
|
|
|
|
<programlisting>?FORMAT 2
|
|
#ZONE INTERFACE OPTIONS
|
|
net eth0 dhcp
|
|
loc eth1
|
|
dmz eth2</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 3:</term>
|
|
|
|
<listitem>
|
|
<para>You have a simple dial-in system with no Ethernet
|
|
connections.</para>
|
|
|
|
<programlisting>?FORMAT 2
|
|
#ZONE INTERFACE OPTIONS
|
|
net ppp0 -</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>Example 4 (Shorewall 4.4.9 and later):</term>
|
|
|
|
<listitem>
|
|
<para>You have a bridge with no IP address and you want to allow
|
|
traffic through the bridge.</para>
|
|
|
|
<programlisting>?FORMAT 2
|
|
#ZONE INTERFACE OPTIONS
|
|
- br0 bridge</programlisting>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall/interfaces</para>
|
|
|
|
<para>/etc/shorewall6/interfaces</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para><ulink
|
|
url="/configuration_file_basics.htm#Pairs">http://www.shorewall.org/configuration_file_basics.htm#Pairs</ulink></para>
|
|
|
|
<para>shorewall(8)</para>
|
|
</refsect1>
|
|
</refentry>
|