shorewall_code/manpages6-lite/shorewall6-lite.xml
Tom Eastep 3110f7c74a Add enable/disable commands to the CLIs
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-12-01 10:25:51 -08:00

752 lines
25 KiB
XML

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall6-lite</refentrytitle>
<manvolnum>8</manvolnum>
</refmeta>
<refnamediv>
<refname>shorewall6-lite</refname>
<refpurpose>Administration tool for Shoreline Firewall 6 Lite
(Shorewall6-lite)</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>allow</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>clear</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>disable</option></arg>
<arg choice="plain"><replaceable>interface</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>drop</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>dump</option></arg>
<arg><option>-x</option></arg>
<arg><option>-m</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>enable</option></arg>
<arg choice="plain"><replaceable>interface</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>forget</option></arg>
<arg><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>help</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>hits</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logdrop</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logwatch</option></arg>
<arg><option>-m</option></arg>
<arg><replaceable>refresh-interval</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>logreject</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>reject</option></arg>
<arg choice="plain"><replaceable>address</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg
choice="plain"><option>restart</option><arg><option>-n</option></arg><arg><option>-p</option></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>restore</option></arg>
<arg><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>save</option></arg>
<arg choice="opt"><replaceable>filename</replaceable></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-x</option></arg>
<arg><option>-t</option>
{<option>filter</option>|<option>mangle</option>|<option>raw</option>}</arg>
<arg><arg><option>chain</option></arg><arg choice="plain"
rep="repeat"><replaceable>chain</replaceable></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-f</option></arg>
<arg choice="plain"><option>capabilities</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg
choice="req"><option>actions|classifiers|connections|config|zones</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-x</option></arg>
<arg choice="plain"><option>mangle</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg choice="plain"><option>tc</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg><option>-m</option></arg>
<arg choice="plain"><option>log</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg
choice="plain"><option>start</option><arg>-<option>n</option></arg><arg>-<option>p</option></arg><arg>-<option>f</option></arg></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg
choice="opt"><option>trace</option>|<option>debug</option><arg><option>nolock</option></arg></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>stop</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>status</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6-lite</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>version</option></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The shorewall6-lite utility is used to control the Shoreline
Firewall 6 (Shorewall6) Lite.</para>
</refsect1>
<refsect1>
<title>Options</title>
<para>The <option>trace</option> and <option>debug</option> options are
used for debugging. See <ulink
url="http://www.shorewall.net/starting_and_stopping.htm#Trace">http://www.shorewall.net/starting_and_stopping.htm#Trace</ulink>.</para>
<para>The nolock <option>option</option> prevents the command from
attempting to acquire the Shorewall6 Lite lockfile. It is useful if you
need to include <command>shorewall6-lite</command> commands in the
<filename>started</filename> extension script.</para>
<para>The <emphasis>options</emphasis> control the amount of output that
the command produces. They consist of a sequence of the letters <emphasis
role="bold">v</emphasis> and <emphasis role="bold">q</emphasis>. If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in <ulink
url="shorewall6.conf.html">shorewall6.conf</ulink>(5). Each <emphasis
role="bold">v</emphasis> adds one to the effective verbosity and each
<emphasis role="bold">q</emphasis> subtracts one from the effective
VERBOSITY. Anternately, <emphasis role="bold">v</emphasis> may be followed
immediately with one of -1,0,1,2 to specify a specify VERBOSITY. There may
be no white space between <emphasis role="bold">v</emphasis> and the
VERBOSITY.</para>
<para>The <emphasis>options</emphasis> may also include the letter
<option>t</option> which causes all progress messages to be
timestamped.</para>
</refsect1>
<refsect1>
<title>Commands</title>
<para>The available commands are listed below.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">allow</emphasis></term>
<listitem>
<para>Re-enables receipt of packets from hosts previously
blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
role="bold">logdrop</emphasis>, <emphasis
role="bold">reject</emphasis>, or <emphasis
role="bold">logreject</emphasis> command.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">clear</emphasis></term>
<listitem>
<para>Clear will remove all rules and chains installed by Shorewall6
Lite. The firewall is then wide open and unprotected. Existing
connections are untouched. Clear is often used to see if the
firewall is causing connection problems.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">drop</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be silently dropped.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">dump</emphasis></term>
<listitem>
<para>Produces a verbose report about the firewall configuration for
the purpose of problem analysis.</para>
<para>The <emphasis role="bold">-x</emphasis> option causes actual
packet and byte counts to be displayed. Without that option, these
counts are abbreviated. The <emphasis role="bold">-m</emphasis>
option causes any MAC addresses included in Shorewall6 Lite log
messages to be displayed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">forget</emphasis></term>
<listitem>
<para>Deletes /var/lib/shorewall6-lite/<emphasis>filenam</emphasis>e
and /var/lib/shorewall6-lite/save. If no
<emphasis>filename</emphasis> is given then the file specified by
RESTOREFILE in <ulink
url="shorewall6-lite.conf.html">shorewall6-lite.conf</ulink>(5) is
assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">help</emphasis></term>
<listitem>
<para>Displays a syntax summary.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">hits</emphasis></term>
<listitem>
<para>Generates several reports from Shorewall6 Lite log messages in
the current log file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logdrop</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be logged then discarded.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logwatch</emphasis></term>
<listitem>
<para>Monitors the log file specified by theLOGFILE option in <ulink
url="shorewall6-lite.conf.html">shorewall6-lite.conf</ulink>(5) and
produces an audible alarm when new Shorewall6 Lite messages are
logged. The <emphasis role="bold">-m</emphasis> option causes the
MAC address of each packet source to be displayed if that
information is available. The
<replaceable>refresh-interval</replaceable> specifies the time in
seconds between screen refreshes. You can enter a negative number by
preceding the number with "--" (e.g., <command>shorewall6-lite
logwatch -- -30</command>). In this case, when a packet count
changes, you will be prompted to hit any key to resume screen
refreshes.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">logreject</emphasis></term>
<listitem>
<para>Causes traffic from the listed <emphasis>address</emphasis>es
to be logged then rejected.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">reset</emphasis></term>
<listitem>
<para>All the packet and byte counters in the firewall are
reset.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">restart</emphasis></term>
<listitem>
<para>Restart is similar to <emphasis role="bold">shorewall6-lite
stop</emphasis> followed by <emphasis role="bold">shorewall6-lite
start</emphasis>. Existing connections are maintained.</para>
<para>The <option>-n</option> option causes Shorewall6 to avoid
updating the routing table(s).</para>
<para>The <option>-p</option> option causes the connection tracking
table to be flushed; the <command>conntrack</command> utility must
be installed to use this option.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">restore</emphasis></term>
<listitem>
<para>Restore Shorewall6 Lite to a state saved using the <emphasis
role="bold">shorewall6-lite save</emphasis> command. Existing
connections are maintained. The <emphasis>filename</emphasis> names
a restore file in /var/lib/shorewall6-lite created using <emphasis
role="bold">shorewall6-lite save</emphasis>; if no
<emphasis>filename</emphasis> is given then Shorewall6 Lite will be
restored from the file specified by the RESTOREFILE option in <ulink
url="shorewall6-lite.conf.html">shorewall6-lite.conf</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">save</emphasis></term>
<listitem>
<para>The dynamic blacklist is stored in
/var/lib/shorewall6-lite/save. The state of the firewall is stored
in /var/lib/shorewall6-lite/<emphasis>filename</emphasis> for use by
the <emphasis role="bold">shorewall6-lite restore</emphasis> and
<emphasis role="bold">shorewall6-lite -f start</emphasis> commands.
If <emphasis>filename</emphasis> is not given then the state is
saved in the file specified by the RESTOREFILE option in <ulink
url="shorewall6-lite.conf.html">shorewall6-lite.conf</ulink>(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">show</emphasis></term>
<listitem>
<para>The show command can have a number of different
arguments:</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">actions</emphasis></term>
<listitem>
<para>Produces a report about the available actions (built-in,
standard and user-defined).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">capabilities</emphasis></term>
<listitem>
<para>Displays your kernel/iptables capabilities. The
<emphasis role="bold">-f</emphasis> option causes the display
to be formatted as a capabilities file for use with <emphasis
role="bold">compile -e</emphasis>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>[ [ <option>chain</option> ] <emphasis>chain</emphasis>
... ]</term>
<listitem>
<para>The rules in each <emphasis>chain</emphasis> are
displayed using the <emphasis role="bold">ip6tables
-L</emphasis> <emphasis>chain</emphasis> <emphasis
role="bold">-n -v</emphasis> command. If no
<emphasis>chain</emphasis> is given, all of the chains in the
filter table are displayed. The <emphasis
role="bold">-x</emphasis> option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are abbreviated.
The <emphasis role="bold">-t</emphasis> option specifies the
Netfilter table to display. The default is <emphasis
role="bold">filter</emphasis>.</para>
<para>If the <emphasis role="bold">t</emphasis> option and the
<option>chain</option> keyword are both omitted and any of the
listed <replaceable>chain</replaceable>s do not exist, a usage
message will be displayed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">classifiers</emphasis></term>
<listitem>
<para>Displays information about the packet classifiers
defined on the system as a result of traffic shaping
configuration.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">config</emphasis></term>
<listitem>
<para>Dispays distribution-specific defaults.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">connections</emphasis></term>
<listitem>
<para>Displays the IPv6 connections currently being tracked by
the firewall.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">mangle</emphasis></term>
<listitem>
<para>Displays the Netfilter mangle table using the command
<emphasis role="bold">ip6tables -t mangle -L -n
-v</emphasis>.The <emphasis role="bold">-x</emphasis> option
is passed directly through to iptables and causes actual
packet and byte counts to be displayed. Without this option,
those counts are abbreviated.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">tc</emphasis></term>
<listitem>
<para>Displays information about queuing disciplines, classes
and filters.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">zones</emphasis></term>
<listitem>
<para>Displays the current composition of the Shorewall6 Lite
zones on the system.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">start</emphasis></term>
<listitem>
<para>Start shorewall6 Lite. Existing connections through
shorewall6-lite managed interfaces are untouched. New connections
will be allowed only if they are allowed by the firewall rules or
policies. If <emphasis role="bold">-f</emphasis> is specified, the
saved configuration specified by the RESTOREFILE option in <ulink
url="shorewall6-lite.conf.html">shorewall6-lite.conf</ulink>(5) will
be restored if that saved configuration exists and has been modified
more recently than the files in /etc/shorewall6.</para>
<para>The <option>-n</option> option causes Shorewall6 to avoid
updating the routing table(s).</para>
<para>The <option>-p</option> option causes the connection tracking
table to be flushed; the <command>conntrack</command> utility must
be installed to use this option.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">stop</emphasis></term>
<listitem>
<para>Stops the firewall. All existing connections, except those
listed in <ulink
url="shorewall6-routestopped.html">shorewall6-routestopped</ulink>(5)
or permitted by the ADMINISABSENTMINDED option in
shorewall6.conf(5), are taken down. The only new traffic permitted
through the firewall is from systems listed in <ulink
url="shorewall6-routestopped.html">shorewall6-routestopped</ulink>(5)
or by ADMINISABSENTMINDED.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">status</emphasis></term>
<listitem>
<para>Produces a short report about the state of the
Shorewall6-configured firewall.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">version</emphasis></term>
<listitem>
<para>Displays Shorewall6-lite's version.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall6-lite/</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="http://www.shorewall.net/starting_and_stopping_shorewall6.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
<para>shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-maclist(5), shorewall6-params(5), shorewall6-policy(5),
shorewall6-providers(5), shorewall6-route_rules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)</para>
</refsect1>
</refentry>