extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-04 13:33:42 +01:00
Code Issues Packages Projects Releases Wiki Activity
36aa2c8e88
shorewall_code/STABLE/documentation/News.htm
teastep 36aa2c8e88 Release changes for 1.3.12 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@385 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
2002-12-28 15:38:03 +00:00

1868 lines
102 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type"
content="text/html; charset=windows-1252">
<title>Shorewall News</title>
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
</head>
<body>
<table border="0" cellpadding="0" cellspacing="0"
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
id="AutoNumber1" bgcolor="#400169" height="90">
<tbody>
<tr>
<td width="100%">
<h1 align="center"><font color="#ffffff">Shorewall News Archive</font></h1>
</td>
</tr>
</tbody>
</table>
<p><b>12/27/2002 - Shorewall 1.3.12 Released</b></p>
<p> Features include:<br>
</p>
<ol>
<li>"shorewall refresh" now reloads the traffic shaping rules (tcrules
and tcstart).</li>
<li>"shorewall debug [re]start" now turns off debugging after an error
occurs. This places the point of the failure near the end of the trace rather
than up in the middle of it.</li>
<li>"shorewall [re]start" has been speeded up by more than 40% with my
configuration. Your milage may vary.</li>
<li>A "shorewall show classifiers" command has been added which shows
the current packet classification filters. The output from this command is
also added as a separate page in "shorewall monitor"</li>
<li>ULOG (must be all caps) is now accepted as a valid syslog level and
causes the subject packets to be logged using the ULOG target rather than
the LOG target. This allows you to run ulogd (available from <a
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
and log all Shorewall messages <a
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
<li>If you are running a kernel that has a FORWARD chain in the mangle
table ("shorewall show mangle" will show you the chains in the mangle table),
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
href="Documentation.htm#Conf">shorewall.conf</a>. This allows for marking
input packets based on their destination even when you are using Masquerading
or SNAT.</li>
<li>I have cluttered up the /etc/shorewall directory with empty 'init',
'start', 'stop' and 'stopped' files. If you already have a file with one
of these names, don't worry -- the upgrade process won't overwrite your file.</li>
<li>I have added a new RFC1918_LOG_LEVEL variable to <a
href="Documentation.htm#Conf">shorewall.conf</a>. This variable specifies
the syslog level at which packets are logged as a result of entries in the
/etc/shorewall/rfc1918 file. Previously, these packets were always logged
at the 'info' level.<br>
</li>
</ol>
<p><b>12/20/2002 - Shorewall 1.3.12 Beta 3<br>
</b></p>
This version corrects a problem with Blacklist logging. In Beta 2, if BLACKLIST_LOG_LEVEL
was set to anything but ULOG, the firewall would fail to start and "shorewall
refresh" would also fail.<br>
<p><b>12/20/2002 - Shorewall 1.3.12 Beta 2</b></p>
<p>The first public Beta version of Shorewall 1.3.12 is now available (Beta
1 was made available only to a limited audience).<br>
</p>
Features include:<br>
<ol>
<li>"shorewall refresh" now reloads the traffic shaping rules (tcrules
and tcstart).</li>
<li>"shorewall debug [re]start" now turns off debugging after an error
occurs. This places the point of the failure near the end of the trace rather
than up in the middle of it.</li>
<li>"shorewall [re]start" has been speeded up by more than 40% with
my configuration. Your milage may vary.</li>
<li>A "shorewall show classifiers" command has been added which shows
the current packet classification filters. The output from this command
is also added as a separate page in "shorewall monitor"</li>
<li>ULOG (must be all caps) is now accepted as a valid syslog level
and causes the subject packets to be logged using the ULOG target rather
than the LOG target. This allows you to run ulogd (available from <a
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
and log all Shorewall messages <a
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
<li>If you are running a kernel that has a FORWARD chain in the mangle
table ("shorewall show mangle" will show you the chains in the mangle table),
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for
marking input packets based on their destination even when you are using
Masquerading or SNAT.</li>
<li>I have cluttered up the /etc/shorewall directory with empty 'init',
'start', 'stop' and 'stopped' files. If you already have a file with one
of these names, don't worry -- the upgrade process won't overwrite your file.</li>
</ol>
You may download the Beta from:<br>
<blockquote><a href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a><br>
<a href="ftp://ftp.shorewall.net/pub/shorewall/Beta"
target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a><br>
</blockquote>
<p><b>12/12/2002 - Mandrake Multi Network Firewall <a
href="http://www.mandrakesoft.com"><img src="images/logo2.png"
alt="Powered by Mandrake Linux" width="140" height="21" border="0">
</a></b></p>
Shorewall is at the center of MandrakeSoft's recently-announced <a
href="http://www.mandrakestore.com/mdkinc/index.php?PAGE=tab_0/menu_0.php&amp;id_art=250&amp;LANG_=en#GOTO_250">Multi
Network Firewall (MNF)</a> product. Here is the <a
href="http://www.mandrakesoft.com/company/press/pr?n=/pr/products/2403">press
release</a>.<br>
<p><b>12/7/2002 - Shorewall Support for Mandrake 9.0</b></p>
<p>Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered.
I have installed 9.0 on one of my systems and I am now in a position to
support Shorewall users who run Mandrake 9.0.</p>
<p><b>12/6/2002 - Debian 1.3.11a Packages Available<br>
</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
<p><b>12/3/2002 - Shorewall 1.3.11a</b></p>
<p>This is a bug-fix roll up which includes Roger Aich's fix for DNAT with
excluded subnets (e.g., "DNAT foo!bar ..."). Current 1.3.11 users who
don't need rules of this type need not upgrade to 1.3.11.</p>
<p><b>11/24/2002 - Shorewall 1.3.11</b></p>
<p>In this version:</p>
<ul>
<li>A 'tcpflags' option has been added to entries in <a
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. This
option causes Shorewall to make a set of sanity check on TCP packet header
flags.</li>
<li>It is now allowed to use 'all' in the SOURCE or DEST column
in a <a href="Documentation.htm#Rules">rule</a>. When used, 'all'
must appear by itself (in may not be qualified) and it does not enable
intra-zone traffic. For example, the rule <br>
<br>
<20> <20> ACCEPT loc all tcp 80<br>
<br>
does not enable http traffic from 'loc' to 'loc'.</li>
<li>Shorewall's use of the 'echo' command is now compatible
with bash clones such as ash and dash.</li>
<li>fw-&gt;fw policies now generate a startup error. fw-&gt;fw
rules generate a warning and are ignored</li>
</ul>
<p><b>11/14/2002 - Shorewall Documentation in PDF Format</b></p>
<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation.
the PDF may be downloaded from</p>
<p><EFBFBD><EFBFBD><EFBFBD> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
<20><><EFBFBD> <a
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
</p>
<p><b>11/09/2002 - Shorewall is Back at SourceForge</b><b>
</b></p>
<p>The main Shorewall 1.3 web site is now back at SourceForge at <a
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>.<br>
</p>
<p><b>11/09/2002 - Shorewall 1.3.10</b></p>
<p>In this version:</p>
<ul>
<li>You may now <a href="IPSEC.htm#Dynamic">define the contents
of a zone dynamically</a> with the <a
href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
delete" commands</a>. These commands are expected to be used primarily
within <a href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a>
updown scripts.</li>
<li>Shorewall can now do<a href="MAC_Validation.html"> MAC
verification</a> on ethernet segments. You can specify the set of
allowed MAC addresses on the segment and you can optionally tie each
MAC address to one or more IP addresses.</li>
<li>PPTP Servers and Clients running on the firewall system
may now be defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a>
file.</li>
<li>A new 'ipsecnat' tunnel type is supported for use when
the <a href="IPSEC.htm">remote IPSEC endpoint is behind a NAT
gateway</a>.</li>
<li>The PATH used by Shorewall may now be specified in <a
href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
<li>The main firewall script is now /usr/lib/shorewall/firewall.
The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall
to do the real work. This change makes custom distributions such as
for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall
that tends to have distribution-dependent code</li>
</ul>
<p><b>10/24/2002 - Shorewall is now in Gentoo Linux</b><b> </b><a
href="http://www.gentoo.org"><br>
</a></p>
Alexandru Hartmann reports that his Shorewall package is
now a part of <a href="http://www.gentoo.org">the Gentoo Linux distribution</a>.
Thanks Alex!<br>
<p><b>10/23/2002 - Shorewall 1.3.10 Beta 1</b><b> </b></p>
In this version:<br>
<ul>
<li>You may now <a href="IPSEC.htm#Dynamic">define the
contents of a zone dynamically</a> with the <a
href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
delete" commands</a>. These commands are expected to be used primarily
within <a href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a>
updown scripts.</li>
<li>Shorewall can now do<a href="MAC_Validation.html">
MAC verification</a> on ethernet segments. You can specify the set
of allowed MAC addresses on the segment and you can optionally tie
each MAC address to one or more IP addresses.</li>
<li>PPTP Servers and Clients running on the firewall system
may now be defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a>
file.</li>
<li>A new 'ipsecnat' tunnel type is supported for use when
the <a href="IPSEC.htm">remote IPSEC endpoint is behind a NAT
gateway</a>.</li>
<li>The PATH used by Shorewall may now be specified in
<a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
<li>The main firewall script is now /usr/lib/shorewall/firewall.
The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall
to do the real work. This change makes custom distributions such as
for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall
that tends to have distribution-dependent code.</li>
</ul>
You may download the Beta from:<br>
<ul>
<li><a
href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a></li>
<li><a
href="ftp://ftp.shorewall.net/pub/shorewall/Beta" target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a></li>
</ul>
<p><b>10/10/2002 - <20>Debian 1.3.9b Packages Available<br>
</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
<p><b>10/9/2002 - Shorewall 1.3.9b</b></p>
This release rolls up fixes to the installer and to the
firewall script.<br>
<p><b>10/6/2002 - Shorewall.net now running on RH8.0<br>
</b><br>
The firewall and server here at shorewall.net are now
running RedHat release 8.0.<br>
<b><br>
9/30/2002 - Shorewall 1.3.9a</b></p>
Roles up the fix for broken tunnels.<br>
<p><b>9/30/2002 - TUNNELS Broken in 1.3.9!!!</b></p>
There is an updated firewall script at <a
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
-- copy that file to /usr/lib/shorewall/firewall.<br>
<p><b>9/28/2002 - Shorewall 1.3.9</b></p>
<p>In this version:<br>
</p>
<ul>
<li><a
href="configuration_file_basics.htm#dnsnames">DNS Names</a> are
now allowed in Shorewall config files (although I recommend against
using them).</li>
<li>The connection SOURCE may now be qualified
by both interface and IP address in a <a
href="Documentation.htm#Rules">Shorewall rule</a>.</li>
<li>Shorewall startup is now disabled after initial
installation until the file /etc/shorewall/startup_disabled is
removed. This avoids nasty surprises during reboot for users who
install Shorewall but don't configure it.</li>
<li>The 'functions' and 'version' files and the 'firewall'
symbolic link have been moved from /var/lib/shorewall to /usr/lib/shorewall
to appease the LFS police at Debian.<br>
</li>
</ul>
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored</b><br>
</p>
<img src="images/j0233056.gif"
alt="Brown Paper Bag" width="50" height="86" align="left">
A couple of recent configuration changes at www.shorewall.net
broke the Search facility:<br>
<blockquote>
<ol>
<li>Mailing List Archive Search was not available.</li>
<li>The Site Search index was incomplete</li>
<li>Only one page of matches was presented.</li>
</ol>
</blockquote>
Hopefully these problems are now corrected.
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored<br>
</b></p>
A couple of recent configuration changes at www.shorewall.net
had the negative effect of breaking the Search facility:<br>
<ol>
<li>Mailing List Archive Search was not available.</li>
<li>The Site Search index was incomplete</li>
<li>Only one page of matches was presented.</li>
</ol>
Hopefully these problems are now corrected.<br>
<p><b>9/18/2002 - <20>Debian 1.3.8 Packages Available<br>
</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
<p><b>9/16/2002 - Shorewall 1.3.8</b></p>
<p>In this version:<br>
</p>
<ul>
<li>A <a href="Documentation.htm#Conf">NEWNOTSYN</a>
option has been added to shorewall.conf. This option determines
whether Shorewall accepts TCP packets which are not part of an
established connection and that are not 'SYN' packets (SYN flag
on and ACK flag off).</li>
<li>The need for the 'multi' option to communicate
between zones za and zb on the same interface is removed in the
case where the chain 'za2zb' and/or 'zb2za' exists. 'za2zb' will
exist if:</li>
<ul>
<li> There is a policy for za to zb;
or </li>
<li>There is at least one rule for za
to zb.</li>
</ul>
</ul>
<ul>
<li>The /etc/shorewall/blacklist file now
contains three columns. In addition to the SUBNET/ADDRESS column,
there are optional PROTOCOL and PORT columns to block only certain
applications from the blacklisted addresses.<br>
</li>
</ul>
<p><b>9/11/2002 - Debian 1.3.7c Packages Available</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>9/2/2002 - Shorewall 1.3.7c</b></p>
<p>This is a role up of a fix for "DNAT" rules where the source zone is $FW
(fw).</p>
<p><b>8/31/2002 - I'm not available</b></p>
<p>I'm currently on vacation<6F> -- please respect my need for a couple of
weeks free of Shorewall problem reports.</p>
<p>-Tom</p>
<p><b>8/26/2002 - Shorewall 1.3.7b</b></p>
<p>This is a role up of the "shorewall refresh" bug fix and the change which
reverses the order of "dhcp" and "norfc1918" checking.</p>
<p><b>8/26/2002 - French FTP Mirror is Operational</b></p>
<p><a target="_blank"
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
is now available.</p>
<p><b>8/25/2002 - Shorewall Mirror in France</b></p>
<p>Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored
at <a target="_top" href="http://france.shorewall.net">http://france.shorewall.net</a>.</p>
<p><b>8/25/2002 - Shorewall 1.3.7a Debian Packages Available</b></p>
<p>Lorenzo Martignoni reports that the packages for version 1.3.7a are available
at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author
-- Shorewall 1.3.7a released<img border="0"
src="images/j0233056.gif" width="50" height="80" align="middle">
</b></p>
<p>1.3.7a corrects problems occurring in rules file processing when starting
Shorewall 1.3.7.</p>
<p><b>8/22/2002 - Shorewall 1.3.7 Released 8/13/2002</b></p>
<p>Features in this release include:</p>
<ul>
<li>The 'icmp.def' file is now empty! The
rules in that file were required in ipchains firewalls but
are not required in Shorewall. Users who have ALLOWRELATED=No
in <a href="Documentation.htm#Conf">shorewall.conf</a> should see
the <a href="errata.htm#Upgrade">Upgrade Issues</a>.</li>
<li>A 'FORWARDPING' option has been added
to <a href="Documentation.htm#Conf"> shorewall.conf</a>. The effect
of setting this variable to Yes is the same as the effect
of adding an ACCEPT rule for ICMP echo-request in <a
href="shorewall_extension_scripts.htm">/etc/shorewall/icmpdef</a>. Users
who have such a rule in icmpdef are encouraged to switch to
FORWARDPING=Yes.</li>
<li>The loopback CLASS A Network (127.0.0.0/8)
has been added to the rfc1918 file.</li>
<li>Shorewall now works with iptables 1.2.7</li>
<li>The documentation and web site no longer
uses FrontPage themes.</li>
</ul>
<p>I would like to thank John Distler for his valuable input regarding TCP
SYN and ICMP treatment in Shorewall. That input has led to
marked improvement in Shorewall in the last two releases.</p>
<p><b>8/13/2002 - Documentation in the <a target="_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
<p>The Shorewall-docs project now contains just the HTML and image files -
the Frontpage files have been removed.</p>
<p><b>8/7/2002 - <i>STABLE</i></b> <b>branch added to <a target="_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
<p>This branch will only be updated after I release a new version of Shorewall
so you can always update from this branch to get the latest
stable tree.</p>
<p><b>8/7/2002 - <a href="errata.htm#Upgrade">Upgrade Issues</a> section added
to the <a href="errata.htm">Errata Page</a></b></p>
<p>Now there is one place to go to look for issues involved with upgrading
to recent versions of Shorewall.</p>
<p><b>8/7/2002 - Shorewall 1.3.6</b></p>
<p>This is primarily a bug-fix rollup with a couple of new features:</p>
<ul>
<li>The latest <a
href="shorewall_quickstart_guide.htm">QuickStart Guides </a>
including the <a href="shorewall_setup_guide.htm">Shorewall Setup
Guide.</a></li>
<li>Shorewall will now DROP TCP packets
that are not part of or related to an existing connection and
that are not SYN packets. These "New not SYN" packets may
be optionally logged by setting the LOGNEWNOTSYN option in
<a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.</li>
<li>The processing of "New not SYN" packets
may be extended by commands in the new <a
href="shorewall_extension_scripts.htm">newnotsyn extension script</a>.</li>
</ul>
<p><b>7/30/2002 - Shorewall 1.3.5b Released</b></p>
<p>This interim release:</p>
<ul>
<li>Causes the firewall script to remove
the lock file if it is killed.</li>
<li>Once again allows lists in the second
column of the <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>
file.</li>
<li>Includes the latest <a
href="shorewall_quickstart_guide.htm">QuickStart Guides</a>.</li>
</ul>
<p><b>7/29/2002 - New Shorewall Setup Guide Available</b></p>
<p>The first draft of this guide is available at <a
href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm</a>.
The guide is intended for use by people who are setting up
Shorewall to manage multiple public IP addresses and by people
who want to learn more about Shorewall than is described in the
single-address guides. Feedback on the new guide is welcome.</p>
<p><b>7/28/2002 - Shorewall 1.3.5 Debian Package Available</b></p>
<p>Lorenzo Martignoni reports that the packages are version 1.3.5a and are
available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>7/27/2002 - Shorewall 1.3.5a Released</b></p>
<p>This interim release restores correct handling of REDIRECT rules. </p>
<p><b>7/26/2002 - Shorewall 1.3.5 Released</b></p>
<p>This will be the last Shorewall release for a while. I'm going to be
focusing on rewriting a lot of the documentation.</p>
<p><b><EFBFBD></b>In this version:</p>
<ul>
<li>Empty and invalid source and destination
qualifiers are now detected in the rules file. It is a good
idea to use the 'shorewall check' command before you issue
a 'shorewall restart' command be be sure that you don't have any
configuration problems that will prevent a successful restart.</li>
<li>Added <b>MERGE_HOSTS</b> variable in
<a href="Documentation.htm#Conf"> shorewall.conf</a> to provide saner
behavior of the /etc/shorewall/hosts file.</li>
<li>The time that the counters were last
reset is now displayed in the heading of the 'status' and
'show' commands.</li>
<li>A <b>proxyarp </b>option has been added
for entries in <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.
This option facilitates Proxy ARP sub-netting as described
in the Proxy ARP subnetting mini-HOWTO (<a
href="http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/">http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/</a>).
Specifying the proxyarp option for an interface causes Shorewall
to set /proc/sys/net/ipv4/conf/&lt;interface&gt;/proxy_arp.</li>
<li>The Samples have been updated to reflect
the new capabilities in this release. </li>
</ul>
<p><b>7/16/2002 - New Mirror in Argentina</b></p>
<p>Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in
Argentina. Thanks Buanzo!!!</p>
<p><b>7/16/2002 - Shorewall 1.3.4 Released</b></p>
<p>In this version:</p>
<ul>
<li>A new <a
href="Documentation.htm#Routestopped"> /etc/shorewall/routestopped</a>
file has been added. This file is intended to eventually
replace the <b>routestopped</b> option in the /etc/shorewall/interface
and /etc/shorewall/hosts files. This new file makes remote
firewall administration easier by allowing any IP or subnet to be
enabled while Shorewall is stopped.</li>
<li>An /etc/shorewall/stopped <a
href="Documentation.htm#Scripts">extension script</a> has been added.
This script is invoked after Shorewall has stopped.</li>
<li>A <b>DETECT_DNAT_ADDRS </b>option has
been added to <a href="Documentation.htm#Conf">/etc/shoreall/shorewall.conf</a>.
When this option is selected, DNAT rules only apply when
the destination address is the external interface's primary
IP address.</li>
<li>The <a
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> has
been broken into three guides and has been almost entirely rewritten.</li>
<li>The Samples have been updated to reflect
the new capabilities in this release. </li>
</ul>
<p><b>7/8/2002 - Shorewall 1.3.3 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the packages are available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>7/6/2002 - Shorewall 1.3.3 Released</b></p>
<p>In this version:</p>
<ul>
<li>Entries in /etc/shorewall/interface
that use the wildcard character ("+") now have the "multi"
option assumed.</li>
<li>The 'rfc1918' chain in the mangle table
has been renamed 'man1918' to make log messages generated
from that chain distinguishable from those generated by the
'rfc1918' chain in the filter table.</li>
<li>Interface names appearing in the hosts
file are now validated against the interfaces file.</li>
<li>The TARGET column in the rfc1918 file
is now checked for correctness.</li>
<li>The chain structure in the nat table
has been changed to reduce the number of rules that a packet
must traverse and to correct problems with NAT_BEFORE_RULES=No</li>
<li>The "hits" command has been enhanced.</li>
</ul>
<p><b>6/25/2002 - Samples Updated for 1.3.2</b></p>
<p>The comments in the sample configuration files have been updated to reflect
new features introduced in Shorewall 1.3.2.</p>
<p><b>6/25/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the package is available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>6/19/2002 - Documentation Available in PDF Format</b></p>
<p>Thanks to Mike Martinez, the Shorewall Documentation is now available for
<a href="download.htm">download</a> in <a href="http://www.adobe.com">Adobe</a>
PDF format.</p>
<p><b>6/16/2002 - Shorewall 1.3.2 Released</b></p>
<p>In this version:</p>
<ul>
<li>A <a
href="Documentation.htm#Starting">logwatch command</a> has
been added to /sbin/shorewall.</li>
<li>A <a
href="blacklisting_support.htm">dynamic blacklist facility</a>
has been added.</li>
<li>Support for the <a
href="Documentation.htm#Conf">Netfilter multiport match function</a>
has been added.</li>
<li>The files <b>firewall, functions </b>and
<b>version</b> have been moved from /etc/shorewall to
/var/lib/shorewall.</li>
</ul>
<p><b>6/6/2002 - Why CVS Web access is Password Protected</b></p>
<p>Last weekend, I installed the CVS Web package to provide brower-based access
to the Shorewall CVS repository. Since then, I have had several instances
where my server was almost unusable due to the high load generated by website
copying tools like HTTrack and WebStripper. These mindless tools:</p>
<ul>
<li>Ignore robot.txt files.</li>
<li>Recursively copy everything that they
find.</li>
<li>Should be classified as weapons rather
than tools.</li>
</ul>
<p>These tools/weapons are particularly damaging when combined with CVS Web
because they doggedly follow every link in the cgi-generated
HTML resulting in 1000s of executions of the cvsweb.cgi script.
Yesterday, I spend several hours implementing measures to block
these tools but unfortunately, these measures resulted in my server
OOM-ing under even moderate load.</p>
<p>Until I have the time to understand the cause of the OOM (or until I buy
more RAM if that is what is required), CVS Web access will
remain Password Protected. </p>
<p><b>6/5/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the package is available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>6/2/2002 - Samples Corrected</b></p>
<p>The 1.3.0 samples configurations had several serious problems that prevented
DNS and SSH from working properly. These problems have been
corrected in the <a href="/pub/shorewall/samples-1.3.1">1.3.1
samples.</a></p>
<p><b>6/1/2002 - Shorewall 1.3.1 Released</b></p>
<p>Hot on the heels of 1.3.0, this release:</p>
<ul>
<li>Corrects a serious problem with "all
<i>&lt;zone&gt;</i> CONTINUE" policies. This problem
is present in all versions of Shorewall that support the CONTINUE
policy. These previous versions optimized away the "all2<i>&lt;zone&gt;</i>"
chain and replaced it with the "all2all" chain with the usual result
that a policy of REJECT was enforced rather than the intended CONTINUE
policy.</li>
<li>Adds an <a
href="Documentation.htm#rfc1918">/etc/shorewall/rfc1918</a>
file for defining the exact behavior of the<a
href="Documentation.htm#Interfaces"> 'norfc1918' interface option</a>.</li>
</ul>
<p><b>5/29/2002 - Shorewall 1.3.0 Released</b></p>
<p>In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0
includes:</p>
<ul>
<li>A 'filterping' interface option that
allows ICMP echo-request (ping) requests addressed to the
firewall to be handled by entries in /etc/shorewall/rules and
/etc/shorewall/policy.</li>
</ul>
<p><b>5/23/2002 - Shorewall 1.3 RC1 Available</b></p>
<p>In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92)
incorporates the following:</p>
<ul>
<li>Support for the /etc/shorewall/whitelist
file has been withdrawn. If you need whitelisting, see <a
href="/1.3/whitelisting_under_shorewall.htm">these instructions</a>.</li>
</ul>
<p><b>5/19/2002 - Shorewall 1.3 Beta 2 Available</b></p>
<p>In addition to the changes in Beta 1, this release which carries the
designation 1.2.91 adds:</p>
<ul>
<li>The structure of the firewall is changed
markedly. There is now an INPUT and a FORWARD chain for each
interface; this reduces the number of rules that a packet
must traverse, especially in complicated setups.</li>
<li><a href="Documentation.htm#Exclude">Sub-zones
may now be excluded from DNAT and REDIRECT rules.</a></li>
<li>The names of the columns in a number
of the configuration files have been changed to be more consistent
and self-explanatory and the documentation has been updated
accordingly.</li>
<li>The sample configurations have been
updated for 1.3.</li>
</ul>
<p><b>5/17/2002 - Shorewall 1.3 Beta 1 Available</b></p>
<p>Beta 1 carries the version designation 1.2.90 and implements the following
features:</p>
<ul>
<li>Simplified rule syntax which makes the
intent of each rule clearer and hopefully makes Shorewall
easier to learn.</li>
<li>Upward compatibility with 1.2 configuration
files has been maintained so that current users can migrate
to the new syntax at their convenience.</li>
<li><b><font color="#cc6666">WARNING:<3A> Compatibility
with the old parameterized sample configurations has NOT been
maintained. Users still running those configurations should
migrate to the new sample configurations before upgrading to
1.3 Beta 1.</font></b></li>
</ul>
<p><b>5/4/2002 - Shorewall 1.2.13 is Available</b></p>
<p>In this version:</p>
<ul>
<li><a
href="Documentation.htm#Whitelist">White-listing</a> is supported.</li>
<li><a href="Documentation.htm#Policy">SYN-flood
protection </a>is added.</li>
<li>IP addresses added under <a
href="Documentation.htm#Conf">ADD_IP_ALIASES and ADD_SNAT_ALIASES</a>
now inherit the VLSM and Broadcast Address of the interface's
primary IP address.</li>
<li>The order in which port forwarding DNAT
and Static DNAT <a href="Documentation.htm#Conf">can now
be reversed</a> so that port forwarding rules can override
the contents of <a href="Documentation.htm#NAT"> /etc/shorewall/nat</a>.
</li>
</ul>
<p><b>4/30/2002 - Shorewall Debian News</b></p>
<p>Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the <a
href="http://packages.debian.org/testing/net/shorewall.html">Debian
Testing Branch</a> and the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch</a>.</p>
<p><b>4/20/2002 - Shorewall 1.2.12 is Available</b></p>
<ul>
<li>The 'try' command works again</li>
<li>There is now a single RPM that also
works with SuSE.</li>
</ul>
<p><b>4/17/2002 - Shorewall Debian News</b></p>
<p>Lorenzo Marignoni reports that:</p>
<ul>
<li>Shorewall 1.2.10 is in the <a
href="http://packages.debian.org/testing/net/shorewall.html">Debian Testing
Branch</a></li>
<li>Shorewall 1.2.11 is in the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch</a></li>
</ul>
<p>Thanks, Lorenzo!</p>
<p><b>4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE</b></p>
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
is now a Shorewall 1.2.11 <a
href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm">
SuSE RPM</a> available. </p>
<p><b>4/13/2002 - Shorewall 1.2.11 Available </b></p>
<p>In this version:</p>
<ul>
<li>The 'try' command now accepts an optional
timeout. If the timeout is given in the command, the standard
configuration will automatically be restarted after the new
configuration has been running for that length of time. This
prevents a remote admin from being locked out of the firewall in
the case where the new configuration starts but prevents access.</li>
<li>Kernel route filtering may now be enabled
globally using the new ROUTE_FILTER parameter in <a
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
<li>Individual IP source addresses and/or
subnets may now be excluded from masquerading/SNAT.</li>
<li>Simple "Yes/No" and "On/Off" values
are now case-insensitive in /etc/shorewall/shorewall.conf.</li>
</ul>
<p><b>4/13/2002 - Hamburg Mirror now has FTP </b></p>
<p>Stefan now has an FTP mirror at <a target="_blank"
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall</a>.<2E>
Thanks Stefan!</p>
<p><b>4/12/2002 - New Mirror in Hamburg</b></p>
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
is now a mirror of the Shorewall website at <a
target="_top" href="http://germany.shorewall.net"> http://germany.shorewall.net</a>.
</p>
<p><b>4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available</b></p>
<p><a href="shorewall_quickstart_guide.htm">Version 1.1 of the QuickStart
Guide</a> is now available. Thanks to those who have read
version 1.0 and offered their suggestions. Corrections have also
been made to the sample scripts.</p>
<p><b>4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available</b></p>
<p><a href="shorewall_quickstart_guide.htm">Version 1.0 of the QuickStart
Guide</a> is now available. This Guide and its accompanying
sample configurations are expected to provide a replacement
for the recently withdrawn parameterized samples. </p>
<p><b>4/8/2002 - Parameterized Samples Withdrawn </b></p>
<p>Although the <a
href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized
samples</a> have allowed people to get a firewall up and running
quickly, they have unfortunately set the wrong level of expectation
among those who have used them. I am therefore withdrawing
support for the samples and I am recommending that they not
be used in new Shorewall installations.</p>
<p><b>4/2/2002 - Updated Log Parser</b></p>
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided an updated
version of his <a href="pub/shorewall/parsefw/">CGI-based
log parser</a> with corrected date handling. </p>
<p><b>3/30/2002 - Shorewall Website Search Improvements</b></p>
<p>The quick search on the home page now excludes the mailing list archives.
The <a href="htdig/search.html">Extended Search</a> allows
excluding the archives or restricting the search to just the
archives. An archive search form is also available on the <a
href="mailing_list.htm">mailing list information page</a>.</p>
<p><b>3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)</b></p>
<ul>
<li>The 1.2.10 Debian Package is available
at <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
<li>Shorewall 1.2.9 is now in the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Distribution</a>.</li>
</ul>
<p><b>3/25/2002 - Log Parser Available</b></p>
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided a <a
href="pub/shorewall/parsefw/">CGI-based log parser</a> for Shorewall. Thanks
John.</p>
<p><b>3/20/2002 - Shorewall 1.2.10 Released</b></p>
<p>In this version:</p>
<ul>
<li>A "shorewall try" command has been added
(syntax: shorewall try <i> &lt;configuration directory&gt;</i>).
This command attempts "shorewall -c <i> &lt;configuration directory&gt;</i>
start" and if that results in the firewall being stopped due
to an error, a "shorewall start" command is executed. The 'try'
command allows you to create a new <a
href="Documentation.htm#Configs"> configuration</a> and attempt
to start it; if there is an error that leaves your firewall
in the stopped state, it will automatically be restarted using
the default configuration (in /etc/shorewall).</li>
<li>A new variable ADD_SNAT_ALIASES has
been added to <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.
If this variable is set to "Yes", Shorewall will automatically
add IP addresses listed in the third column of the <a
href="Documentation.htm#Masq"> /etc/shorewall/masq</a> file.</li>
<li>Copyright notices have been added to
the documenation.</li>
</ul>
<p><b>3/11/2002 - Shorewall 1.2.9 Released</b></p>
<p>In this version:</p>
<ul>
<li>Filtering by <a
href="Documentation.htm#MAC">MAC address</a> has been added.
MAC addresses may be used as the source address in:
<ul>
<li>Filtering rules (<a
href="Documentation.htm#Rules">/etc/shorewall/rules</a>)</li>
<li>Traffic Control Classification Rules
(<a href="traffic_shaping.htm#tcrules">/etc/shorewall/tcrules</a>)</li>
<li>TOS Rules (<a
href="Documentation.htm#TOS">/etc/shorewall/tos</a>)</li>
<li>Blacklist (<a
href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a>)</li>
</ul>
</li>
<li>Several bugs have been fixed</li>
<li>The 1.2.9 Debian Package is also available
at <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
</ul>
<p><b>3/1/2002 - 1.2.8 Debian Package is Available</b></p>
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/25/2002 - New Two-interface Sample</b></p>
<p>I've enhanced the two interface sample to allow access from the firewall
to servers in the local zone - <a
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz">
http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz</a></p>
<p><b>2/23/2002 - Shorewall 1.2.8 Released</b></p>
<p>Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects
problems associated with the lock file used to prevent multiple state-changing
operations from occuring simultaneously. My apologies for
any inconvenience my carelessness may have caused.</p>
<p><b>2/22/2002 - Shorewall 1.2.7 Released</b></p>
<p>In this version:</p>
<ul>
<li>UPnP probes (UDP destination port 1900)
are now silently dropped in the <i>common</i> chain</li>
<li>RFC 1918 checking in the mangle table
has been streamlined to no longer require packet marking.
RFC 1918 checking in the filter table has been changed to
require half as many rules as previously.</li>
<li>A 'shorewall check' command has been
added that does a cursory validation of the zones, interfaces,
hosts, rules and policy files.</li>
</ul>
<p><b>2/18/2002 - 1.2.6 Debian Package is Available</b></p>
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/8/2002 - Shorewall 1.2.6 Released</b></p>
<p>In this version:</p>
<ul>
<li>$-variables may now be used anywhere
in the configuration files except /etc/shorewall/zones.</li>
<li>The interfaces and hosts files now have
their contents validated before any changes are made to
the existing Netfilter configuration. The appearance of a
zone name that isn't defined in /etc/shorewall/zones causes "shorewall
start" and "shorewall restart" to abort without changing the Shorewall
state. Unknown options in either file cause a warning to be issued.</li>
<li>A problem occurring when BLACKLIST_LOGLEVEL
was not set has been corrected.</li>
</ul>
<p><b>2/4/2002 - Shorewall 1.2.5 Debian Package Available</b></p>
<p>see <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/1/2002 - Shorewall 1.2.5 Released</b></p>
<p>Due to installation problems with Shorewall 1.2.4, I have released Shorewall
1.2.5. Sorry for the rapid-fire development.</p>
<p>In version 1.2.5:</p>
<ul>
<li>The installation problems have been corrected.</li>
<li><a href="Documentation.htm#Masq">SNAT</a>
is now supported.</li>
<li>A "shorewall version" command has been
added</li>
<li>The default value of the STATEDIR variable
in /etc/shorewall/shorewall.conf has been changed to /var/lib/shorewall
in order to conform to the GNU/Linux File Hierarchy Standard,
Version 2.2.</li>
</ul>
<p><b>1/28/2002 - Shorewall 1.2.4 Released</b></p>
<ul>
<li>The "fw" zone <a
href="Documentation.htm#FW">may now be given a different name</a>.</li>
<li>You may now place end-of-line comments
(preceded by '#') in any of the configuration files</li>
<li>There is now protection against against
two state changing operations occuring concurrently. This
is implemented using the 'lockfile' utility if it is available
(lockfile is part of procmail); otherwise, a less robust technique
is used. The lockfile is created in the STATEDIR defined in /etc/shorewall/shorewall.conf
and has the name "lock".</li>
<li>"shorewall start" no longer fails if
"detect" is specified in <a
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>
for an interface with subnet mask 255.255.255.255.</li>
</ul>
<p><b>1/27/2002 - Shorewall 1.2.3 Debian Package Available </b>-- see <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>1/20/2002 - Corrected firewall script available<6C></b></p>
<p>Corrects a problem with BLACKLIST_LOGLEVEL. See <a href="errata.htm">the
errata</a> for details.</p>
<p><b>1/19/2002 - Shorewall 1.2.3 Released</b></p>
<p>This is a minor feature and bugfix release. The single new feature is:</p>
<ul>
<li>Support for TCP MSS Clamp to PMTU --
This support is usually required when the internet connection
is via PPPoE or PPTP and may be enabled using the <a
href="Documentation.htm#ClampMSS">CLAMPMSS</a> option in /etc/shorewall/shorewall.conf.</li>
</ul>
<p>The following problems were corrected:</p>
<ul>
<li>The "shorewall status" command no longer
hangs.</li>
<li>The "shorewall monitor" command now displays
the icmpdef chain</li>
<li>The CLIENT PORT(S) column in tcrules
is no longer ignored</li>
</ul>
<p><b>1/18/2002 - Shorewall 1.2.2 packaged with new </b><a
href="http://leaf.sourceforge.net">LEAF</a><b> release</b></p>
<p>Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution
that includes Shorewall 1.2.2. See <a
href="http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo</a>
for details.</p>
<p><b>1/11/2002 - Debian Package (.deb) Now Available - </b>Thanks to <a
href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni</a>, a 1.2.2
Shorewall Debian package is now available. There is a link to
Lorenzo's site from the <a href="download.htm">Shorewall download
page</a>.</p>
<p><b>1/9/2002 - Updated 1.2.2 /sbin/shorewall available - </b><a
href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version </a>restores
the "shorewall status" command to health.</p>
<p><b>1/8/2002 - Shorewall 1.2.2 Released</b></p>
<p>In version 1.2.2</p>
<ul>
<li>Support for IP blacklisting has been
added
<ul>
<li>You specify whether you want packets
from blacklisted hosts dropped or rejected using the
<a href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION
</a>setting in /etc/shorewall/shorewall.conf</li>
<li>You specify whether you want packets
from blacklisted hosts logged and at what syslog level
using the <a href="Documentation.htm#BLLoglevel">BLACKLIST_LOGLEVEL</a>
setting in /etc/shorewall/shorewall.conf</li>
<li>You list the IP addresses/subnets that
you wish to blacklist in <a
href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a></li>
<li>You specify the interfaces you want
checked against the blacklist using the new "<a
href="Documentation.htm#BLInterface">blacklist</a>" option in
/etc/shorewall/interfaces.</li>
<li>The black list is refreshed from /etc/shorewall/blacklist
by the "shorewall refresh" command.</li>
</ul>
</li>
<li>Use of TCP RST replies has been expanded<65>
<ul>
<li>TCP connection requests rejected because
of a REJECT policy are now replied with a TCP RST packet.</li>
<li>TCP connection requests rejected because
of a protocol=all rule in /etc/shorewall/rules are now
replied with a TCP RST packet.</li>
</ul>
</li>
<li>A <a
href="Documentation.htm#Logfile">LOGFILE</a> specification
has been added to /etc/shorewall/shorewall.conf. LOGFILE is used
to tell the /sbin/shorewall program where to look for Shorewall
messages.</li>
</ul>
<p><b>1/5/2002 - New Parameterized Samples (<a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.2.0/"
target="_blank">version 1.2.0</a>) released. </b>These are minor updates
to the previously-released samples. There are two new rules
added:</p>
<ul>
<li>Unless you have explicitly enabled Auth
connections (tcp port 113) to your firewall, these connections
will be REJECTED rather than DROPPED. This speeds up connection
establishment to some servers.</li>
<li>Orphan DNS replies are now silently dropped.</li>
</ul>
<p>See the README file for upgrade instructions.</p>
<p><b>1/1/2002 - <u><font color="#ff6633">Shorewall Mailing List Moving</font></u></b></p>
<p>The Shorewall mailing list hosted at <a href="http://sourceforge.net">
Sourceforge</a> is moving to Shorewall.net. If you are a current
subscriber to the list at Sourceforge, please <a
href="shorewall_mailing_list_migration.htm">see these instructions</a>.
If you would like to subscribe to the new list, visit <a
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>.</p>
<p><b>12/31/2001 - Shorewall 1.2.1 Released</b></p>
<p>In version 1.2.1:</p>
<ul>
<li><a
href="Documentation.htm#LogUncleanOption">Logging of Mangled/Invalid
Packets</a> is added.<2E></li>
<li>The <a href="IPIP.htm">tunnel script</a>
has been corrected.</li>
<li>'shorewall show tc' now correctly handles
tunnels.</li>
</ul>
<p><b>12/21/2001 - Shorewall 1.2.0 Released!</b> - <b>I couldn't resist releasing
1.2 on 12/21/2001</b></p>
<p>Version 1.2 contains the following new features:</p>
<ul>
<li>Support for <a
href="traffic_shaping.htm">Traffic Control/Shaping</a></li>
<li>Support for <a
href="Documentation.htm#Unclean">Filtering of Mangled/Invalid
Packets</a></li>
<li>Support for <a href="IPIP.htm">GRE Tunnels</a></li>
</ul>
<p>For the next month or so, I will continue to provide corrections to version
1.1.18 as necessary so that current version 1.1.x users will
not be forced into a quick upgrade to 1.2.0 just to have access
to bug fixes.</p>
<p>For those of you who have installed one of the Beta RPMS, you will need
to use the "--oldpackage" option when upgrading to 1.2.0:</p>
<blockquote>
<p>rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm</p>
</blockquote>
<p><b>12/19/2001 - Thanks to <a href="mailto:scowles@infohiiway.com">Steve
Cowles</a>, there is now a Shorewall mirror in Texas. </b>This
web site is mirrored at <a
href="http://www.infohiiway.com/shorewall" target="_top">http://www.infohiiway.com/shorewall</a>
and the ftp site is at <a
href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall">ftp://ftp.infohiiway.com/pub/mirrors/shorewall</a>.<b><EFBFBD></b></p>
<p><b>11/30/2001 - A new set of the parameterized <a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.18">Sample
Configurations</a> has been released</b>. In this version:</p>
<ul>
<li>Ping is now allowed between the zones.</li>
<li>In the three-interface configuration,
it is now possible to configure the internet services that
are to be available to servers in the DMZ.<2E></li>
</ul>
<p><b>11/20/2001 - The current version of Shorewall is 1.1.18.<2E></b></p>
<p>In this version:</p>
<ul>
<li>The spelling of ADD_IP_ALIASES has been
corrected in the shorewall.conf file</li>
<li>The logic for deleting user-defined chains
has been simplified so that it avoids a bug in the LRP version
of the 'cut' utility.</li>
<li>The /var/lib/lrpkg/shorwall.conf file
has been corrected to properly display the NAT entry in that
file.</li>
</ul>
<p><b>11/19/2001 - Thanks to <a href="mailto:shorewall@timelord.sk">Juraj
Ontkanin</a>, there is now a Shorewall mirror in the
Slovak Republic</b>. The website is now mirrored at <a
href="http://www.nrg.sk/mirror/shorewall" target="_top">http://www.nrg.sk/mirror/shorewall</a>
and the FTP site is mirrored at <a
href="ftp://ftp.nrg.sk/mirror/shorewall">ftp://ftp.nrg.sk/mirror/shorewall</a>.</p>
<p><b>11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations.</b>
There are three sample configurations:</p>
<ul>
<li>One Interface -- for a standalone system.</li>
<li>Two Interfaces -- A masquerading firewall.</li>
<li>Three Interfaces -- A masquerading firewall
with DMZ.</li>
</ul>
<p>Samples may be downloaded from <a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17</a>
. See the README file for instructions.</p>
<p><b>11/1/2001 - The current version of Shorewall is 1.1.17</b>.<2E> I intend
this to be the last of the 1.1 Shorewall releases.</p>
<p> In this version:</p>
<ul>
<li>The handling of <a
href="Documentation.htm#Aliases">ADD_IP_ALIASES</a> has
been corrected.<2E></li>
</ul>
<p><b>10/22/2001 - The current version of Shorewall is 1.1.16</b>. In this
version:</p>
<ul>
<li>A new "shorewall show connections" command
has been added.</li>
<li>In the "shorewall monitor" output, the
currently tracked connections are now shown on a separate
page.</li>
<li>Prior to this release, Shorewall unconditionally
added the external IP adddress(es) specified in /etc/shorewall/nat.
Beginning with version 1.1.16, a new parameter (<a
href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>) may be set
to "no" (or "No") to inhibit this behavior. This allows
IP aliases created using your distribution's network configuration
tools to be used in static NAT.<2E></li>
</ul>
<p><b>10/15/2001 - The current version of Shorewall is 1.1.15.</b> In this
version:</p>
<ul>
<li>Support for nested zones has been improved.
See <a href="Documentation.htm#Nested"> the documentation</a> for
details</li>
<li>Shorewall now correctly checks the alternate
configuration directory for the 'zones' file.</li>
</ul>
<p><b>10/4/2001 - The current version of Shorewall is 1.1.14.</b> In this
version</p>
<ul>
<li>Shorewall now supports alternate configuration
directories. When an alternate directory is specified when
starting or restarting Shorewall (e.g., "shorewall -c /etc/testconf
restart"), Shorewall will first look for configuration files
in the alternate directory then in /etc/shorewall. To create
an alternate configuration simply:<br>
1. Create a New Directory<br>
2. Copy to that directory any of your configuration
files that you want to change.<br>
3. Modify the copied files as needed.<br>
4. Restart Shorewall specifying the new
directory.</li>
<li>The rules for allowing/disallowing icmp
echo-requests (pings) are now moved after rules created
when processing the rules file. This allows you to add rules
that selectively allow/deny ping based on source or destination
address.</li>
<li>Rules that specify multiple client ip
addresses or subnets no longer cause startup failures.</li>
<li>Zone names in the policy file are now
validated against the zones file.</li>
<li>If you have <a
href="Documentation.htm#MangleEnabled">packet mangling</a> support
enabled, the "<a href="Documentation.htm#Interfaces">norfc1918</a>"
interface option now logs and drops any incoming packets on
the interface that have an RFC 1918 destination address.</li>
</ul>
<p><b>9/12/2001 - The current version of Shorewall is 1.1.13</b>. In this
version</p>
<ul>
<li>Shell variables can now be used to parameterize
Shorewall rules.</li>
<li>The second column in the hosts file may
now contain a comma-separated list.<br>
<br>
Example:<br>
<20><><EFBFBD> sea<65><61><EFBFBD> eth0:130.252.100.0/24,206.191.149.0/24</li>
<li>Handling of multi-zone interfaces has
been improved. See the <a
href="Documentation.htm#Interfaces">documentation for the /etc/shorewall/interfaces
file</a>.</li>
</ul>
<p><b>8/28/2001 - The current version of Shorewall is 1.1.12</b>. In this
version</p>
<ul>
<li>Several columns in the rules file may
now contain comma-separated lists.</li>
<li>Shorewall is now more rigorous in parsing
the options in /etc/shorewall/interfaces.</li>
<li>Complementation using "!" is now supported
in rules.</li>
</ul>
<p><b>7/28/2001 - The current version of Shorewall is 1.1.11</b>. In this
version</p>
<ul>
<li>A "shorewall refresh" command has been
added to allow for refreshing the rules associated with the
broadcast address on a dynamic interface. This command should
be used in place of "shorewall restart" when the internet interface's
IP address changes.</li>
<li>The /etc/shorewall/start file (if any)
is now processed after all temporary rules have been deleted.
This change prevents the accidental removal of rules added
during the processing of that file.</li>
<li>The "dhcp" interface option is now applicable
to firewall interfaces used by a DHCP server running on the
firewall.</li>
<li>The RPM can now be built from the .tgz
file using "rpm -tb"<22></li>
</ul>
<p><b>7/6/2001 - The current version of Shorewall is 1.1.10.</b> In this version</p>
<ul>
<li>Shorewall now enables Ipv4 Packet Forwarding
by default. Packet forwarding may be disabled by specifying
IP_FORWARD=Off in /etc/shorewall/shorewall.conf. If you don't
want Shorewall to enable or disable packet forwarding, add
IP_FORWARDING=Keep to your /etc/shorewall/shorewall.conf file.</li>
<li>The "shorewall hits" command no longer
lists extraneous service names in its last report.</li>
<li>Erroneous instructions in the comments
at the head of the firewall script have been corrected.</li>
</ul>
<p><b>6/23/2001 - The current version of Shorewall is 1.1.9.</b> In this version</p>
<ul>
<li>The "tunnels" file <u>really</u> is in
the RPM now.</li>
<li>SNAT can now be applied to port-forwarded
connections.</li>
<li>A bug which would cause firewall start
failures in some dhcp configurations has been fixed.</li>
<li>The firewall script now issues a message
if you have the name of an interface in the second column
in an entry in /etc/shorewall/masq and that interface is
not up.</li>
<li>You can now configure Shorewall so that
it<a href="Documentation.htm#NatEnabled"> doesn't require the NAT and/or
mangle netfilter modules</a>.</li>
<li>Thanks to Alex<65> Polishchuk, the "hits"
command from seawall is now in shorewall.</li>
<li>Support for <a href="IPIP.htm">IPIP tunnels</a>
has been added.</li>
</ul>
<p><b>6/18/2001 - The current version of Shorewall is 1.1.8</b>. In this version</p>
<ul>
<li>A typo in the sample rules file has been
corrected.</li>
<li>It is now possible to restrict masquerading
by<a href="Documentation.htm#Masq"> destination host or subnet.</a></li>
<li>It is now possible to have static <a
href="NAT.htm#LocalPackets">NAT rules applied to packets originating
on the firewall itself</a>.</li>
</ul>
<p><b>6/2/2001 - The current version of Shorewall is 1.1.7.</b> In this version</p>
<ul>
<li>The TOS rules are now deleted when the
firewall is stopped.</li>
<li>The .rpm will now install regardless
of which version of iptables is installed.</li>
<li>The .rpm will now install without iproute2
being installed.</li>
<li>The documentation has been cleaned up.</li>
<li>The sample configuration files included
in Shorewall have been formatted to 80 columns for ease
of editing on a VGA console.</li>
</ul>
<p><b>5/25/2001 - The current version of Shorewall is 1.1.6</b>. In this version</p>
<ul>
<li><a href="Documentation.htm#lograte">You
may now rate-limit the packet log.</a></li>
<li><font
face="Century Gothic, Arial, Helvetica"><EFBFBD>Previous versions of
Shorewall have an implementation of Static NAT which violates the
principle of least surprise.<2E> NAT only occurs for packets
arriving at (DNAT) or send from (SNAT) the interface named
in the INTERFACE column of /etc/shorewall/nat. Beginning with
version 1.1.6, NAT effective regardless of which interface packets
come from or are destined to. To get compatibility with prior versions,
I have added a new "ALL <a href="NAT.htm#AllInterFaces">"ALL INTERFACES"<22>
column to /etc/shorewall/nat</a>. By placing "no" or "No" in
the new column, the NAT behavior of prior versions may be retained.<2E></font></li>
<li>The treatment of <a
href="IPSEC.htm#RoadWarrior">IPSEC Tunnels where the remote gateway
is a standalone system has been improved</a>. Previously, it was
necessary to include an additional rule allowing UDP port 500 traffic
to pass through the tunnel. Shorewall will now create this rule
automatically when you place the name of the remote peer's zone in
a new GATEWAY ZONE column in /etc/shorewall/tunnels.<2E></li>
</ul>
<p><b>5/20/2001 - The current version of Shorewall is 1.1.5.</b> In this version</p>
<ul>
<li><a href="Documentation.htm#modules">You
may now pass parameters when loading netfilter modules and
you can specify the modules to load.</a></li>
<li>Compressed modules are now loaded. This
requires that you modutils support loading compressed modules.</li>
<li><a href="Documentation.htm#TOS">You may
now set the Type of Service (TOS) field in packets.</a></li>
<li>Corrected rules generated for port redirection
(again).</li>
</ul>
<p><b>5/10/2001 - The current version of Shorewall is 1.1.4.</b> In this version</p>
<ul>
<li> <a href="Documentation.htm#Conf">Accepting
RELATED connections is now optional.</a></li>
<li>Corrected problem where if "shorewall
start" aborted early (due to kernel configuration errors for
example), superfluous 'sed' error messages were reported.</li>
<li>Corrected rules generated for port redirection.</li>
<li>The order in which iptables kernel modules
are loaded has been corrected (Thanks to Mark Pavlidis).<2E></li>
</ul>
<p><b>4/28/2001 - The current version of Shorewall is 1.1.3.</b> In this version</p>
<ul>
<li>Correct message issued when Proxy ARP
address added (Thanks to Jason Kirtland).</li>
<li>/tmp/shorewallpolicy-$$ is now removed
if there is an error while starting the firewall.</li>
<li>/etc/shorewall/icmp.def and /etc/shorewall/common.def
are now used to define the icmpdef and common chains unless
overridden by the presence of /etc/shorewall/icmpdef or /etc/shorewall/common.</li>
<li>In the .lrp, the file /var/lib/lrpkg/shorwall.conf
has been corrected. An extra space after "/etc/shorwall/policy"
has been removed and "/etc/shorwall/rules" has been added.</li>
<li>When a sub-shell encounters a fatal error
and has stopped the firewall, it now kills the main shell so
that the main shell will not continue.</li>
<li>A problem has been corrected where a
sub-shell stopped the firewall and main shell continued resulting
in a perplexing error message referring to "common.so" resulted.</li>
<li>Previously, placing "-" in the PORT(S)
column in /etc/shorewall/rules resulted in an error message
during start. This has been corrected.</li>
<li>The first line of "install.sh" has been
corrected -- I had inadvertently deleted the initial "#".</li>
</ul>
<p><b>4/12/2001 - The current version of Shorewall is 1.1.2.</b> In this version</p>
<ul>
<li>Port redirection now works again.</li>
<li>The icmpdef and common chains <a
href="Documentation.htm#Icmpdef">may now be user-defined</a>.</li>
<li>The firewall no longer fails to start
if "routefilter" is specified for an interface that isn't
started. A warning message is now issued in this case.</li>
<li>The LRP Version is renamed "shorwall"
for 8,3 MSDOS file system compatibility.</li>
<li>A couple of LRP-specific problems were
corrected.</li>
</ul>
<p><b>4/8/2001 - Shorewall is now affiliated with the <a
href="http://leaf.sourceforge.net">Leaf Project</a> </b> <a
href="http://leaf.sourceforge.net"> <img border="0"
src="images/leaflogo.gif" width="49" height="36">
</a></p>
<p><b>4/5/2001 - The current version of Shorewall is 1.1.1. In this version:</b></p>
<ul>
<li>The common chain is traversed from INPUT,
OUTPUT and FORWARD before logging occurs</li>
<li>The source has been cleaned up dramatically</li>
<li>DHCP DISCOVER packets with RFC1918 source
addresses no longer generate log messages. Linux DHCP clients
generate such packets and it's annoying to see them logged.<2E></li>
</ul>
<p><b>3/25/2001 - The current version of Shorewall is 1.1.0. In this version:</b></p>
<ul>
<li>Log messages now indicate the packet
disposition.</li>
<li>Error messages have been improved.</li>
<li>The ability to define zones consisting
of an enumerated set of hosts and/or subnetworks has been
added.</li>
<li>The zone-to-zone chain matrix is now
sparse so that only those chains that contain meaningful
rules are defined.</li>
<li>240.0.0.0/4 and 169.254.0.0/16 have been
added to the source subnetworks whose packets are dropped
under the <i>norfc1918</i> interface option.</li>
<li>Exits are now provided for executing
an user-defined script when a chain is defined, when the
firewall is initialized, when the firewall is started, when
the firewall is stopped and when the firewall is cleared.</li>
<li>The Linux kernel's route filtering facility
can now be specified selectively on network interfaces.</li>
</ul>
<p><b>3/19/2001 - The current version of Shorewall is 1.0.4. This version:</b></p>
<ul>
<li>Allows user-defined zones. Shorewall
now has only one pre-defined zone (fw) with the remaining
zones being defined in the new configuration file /etc/shorewall/zones.
The /etc/shorewall/zones file released in this version
provides behavior that is compatible with Shorewall 1.0.3.<2E></li>
<li>Adds the ability to specify logging in
entries in the /etc/shorewall/rules file.</li>
<li>Correct handling of the icmp-def chain
so that only ICMP packets are sent through the chain.</li>
<li>Compresses the output of "shorewall monitor"
if awk is installed. Allows the command to work if awk isn't
installed (although it's not pretty).</li>
</ul>
<p><b>3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix
release with no new features.</b></p>
<ul>
<li>The PATH variable in the firewall script
now includes /usr/local/bin and /usr/local/sbin.</li>
<li>DMZ-related chains are now correctly
deleted if the DMZ is deleted.</li>
<li>The interface OPTIONS for "gw" interfaces
are no longer ignored.</li>
</ul>
<p><b>3/8/2001 - The current version of Shorewall is 1.0.2. It supports an
additional "gw" (gateway) zone for tunnels and it supports
IPSEC tunnels with end-points on the firewall. There is also
a .lrp available now.</b></p>
<p><font size="2">Updated 12/27/2002 - <a href="support.htm">Tom Eastep</a>
</font></p>
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2"> Copyright</font>
<EFBFBD> <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
</p>
<br>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink