mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-22 14:20:40 +01:00
41de5afd06
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@726 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
249 lines
7.2 KiB
Bash
Executable File
249 lines
7.2 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# Shorewall help subsystem - V1.4 - 3/14/2003
|
|
#
|
|
#
|
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
|
#
|
|
# (c) 2003 - Tom Eastep (teastep@shorewall.net)
|
|
# Steve Herber (herber@thing.com)
|
|
#
|
|
# This file should be placed in /usr/share/shorewall/help
|
|
#
|
|
# Shorewall documentation is available at http://shorewall.sourceforge.net
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of Version 2 of the GNU General Public License
|
|
# as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
|
##################################################################################
|
|
|
|
case $1 in
|
|
|
|
add)
|
|
echo "add: add <interface>[:<host>] <zone>
|
|
Adds a host or subnet to a dynamic zone usually used with VPN's.
|
|
|
|
shorewall add interface[:host] zone - Adds the specified interface
|
|
(and host if included) to the specified zone.
|
|
|
|
Example:
|
|
|
|
shorewall add ipsec0:192.0.2.24 vpn1 -- adds the address 192.0.2.24
|
|
from interface ipsec0 to the zone vpn1.
|
|
|
|
See also \"help host\""
|
|
;;
|
|
|
|
address|host)
|
|
echo "<$1>:
|
|
May be either a host IP address such as 192.168.1.4 or a network address in
|
|
CIDR format like 192.168.1.0/24"
|
|
;;
|
|
|
|
allow)
|
|
echo "allow: allow <address> ...
|
|
Re-enables receipt of packets from hosts previously blacklisted
|
|
by a drop or reject command.
|
|
|
|
Shorewall allow, drop, rejct and save implement dynamic blacklisting.
|
|
|
|
See also \"help address\""
|
|
;;
|
|
|
|
check)
|
|
echo "check: check [ -c <configuration-directory> ]
|
|
Performs a cursory validation of the zones, interfaces, hosts,
|
|
rules and policy files. Use this if you are unsure of any edits
|
|
you have made to the shorewall configuration. See the try command
|
|
examples for a recommended way to make changes."
|
|
;;
|
|
|
|
clear)
|
|
echo "clear: clear
|
|
Clear will remove all rules and chains installed by Shoreline.
|
|
The firewall is then wide open and unprotected. Existing
|
|
connections are untouched. Clear is often used to see if the
|
|
firewall is causing connection problems."
|
|
;;
|
|
|
|
debug)
|
|
echo "debug: debug
|
|
If you include the keyword debug as the first argument to any
|
|
of these commands:
|
|
|
|
start|stop|restart|reset|clear|refresh|check|add|delete
|
|
|
|
then a shell trace of the command is produced. For example:
|
|
|
|
shorewall debug start 2> /tmp/trace
|
|
|
|
The above command would trace the 'start' command and
|
|
place the trace information in the file /tmp/trace."
|
|
;;
|
|
|
|
delete)
|
|
echo "delete: delete <interface>[:<host>] <zone>
|
|
Deletes a host or subnet from a dynamic zone usually used with VPN's.
|
|
|
|
shorewall delete interface[:host] zone - Deletes the specified
|
|
interface (and host if included) from the specified zone.
|
|
|
|
Example:
|
|
|
|
shorewall delete ipsec0:192.0.2.24 vpn1 -- deletes the address
|
|
192.0.2.24 from interface ipsec0 from zone vpn1
|
|
|
|
See also \"help host\""
|
|
;;
|
|
|
|
drop)
|
|
echo "$1: $1 <address> ...
|
|
Causes packets from the specified <address> to be ignored
|
|
|
|
Shorewall allow, drop, rejct and save implement dynamic blacklisting.
|
|
|
|
See also \"help address\""
|
|
;;
|
|
|
|
help)
|
|
echo "help: help [<command> | host | address ]
|
|
Display helpful information about the shorewall commands."
|
|
;;
|
|
|
|
hits)
|
|
echo "hits: hits
|
|
Produces several reports about the Shorewall packet log messages
|
|
in the current /var/log/messages file."
|
|
;;
|
|
|
|
ipcalc)
|
|
echo "ipcalc: ipcalc [ address mask | address/vlsm ]
|
|
Ipcalc displays the network address, broadcast address,
|
|
network in CIDR notation and netmask corresponding to the input[s]."
|
|
;;
|
|
|
|
iprange)
|
|
echo "iprange: iprange address1-address2
|
|
Iprange decomposes the specified range of IP addresses into the
|
|
equivalent list of network/host addresses."
|
|
;;
|
|
|
|
logwatch)
|
|
echo "logwatch: logwatch [<refresh interval>]
|
|
Monitors the LOGFILE, $LOGFILE,
|
|
and produces an audible alarm when new Shorewall messages are logged."
|
|
;;
|
|
|
|
monitor)
|
|
echo "monitor: monitor [<refresh_interval>]
|
|
Continuously display the firewall status, last 20 log entries and nat.
|
|
When the log entry display changes, an audible alarm is sounded."
|
|
;;
|
|
|
|
refresh)
|
|
echo "refresh: refresh
|
|
The rules involving the broadcast addresses of firewall interfaces,
|
|
the black list, traffic control rules and ECN control rules are recreated
|
|
to reflect any changes made. Existing connections are untouched"
|
|
;;
|
|
|
|
reject)
|
|
echo "$1: $1 <address> ...
|
|
Causes packets from the specified <address> to be rejected
|
|
|
|
Shorewall allow, drop, rejct and save implement dynamic blacklisting.
|
|
|
|
See also \"help address\""
|
|
;;
|
|
|
|
reset)
|
|
echo "reset: reset
|
|
All the packet and byte counters in the firewall are reset."
|
|
;;
|
|
|
|
restart)
|
|
echo "restart: restart [ -c <configuration-directory> ]
|
|
Restart is the same as a shorewall stop && shorewall start.
|
|
Existing connections are dropped."
|
|
;;
|
|
|
|
save)
|
|
echo "save: save
|
|
The dynamic data is stored in /var/lib/shorewall/save
|
|
Shorewall allow, drop, rejct and save implement dynamic blacklisting."
|
|
;;
|
|
|
|
show)
|
|
echo "show: show [<chain> [ <chain> ...] |classifiers|connections|log|nat|tc|tos]
|
|
shorewall show <chain> [ <chain> ... ] - produce a verbose report about the IPtable chain(s).
|
|
(iptables -L chain -n -v)
|
|
|
|
shorewall show nat - produce a verbose report about the nat table.
|
|
(iptables -t nat -L -n -v)
|
|
|
|
shorewall show tos - produce a verbose report about the mangle table.
|
|
(iptables -t mangle -L -n -v)
|
|
|
|
shorewall show log - display the last 20 packet log entries.
|
|
|
|
shorewall show connections - displays the IP connections currently
|
|
being tracked by the firewall.
|
|
|
|
shorewall show tc - displays information about the traffic
|
|
control/shaping configuration."
|
|
;;
|
|
|
|
start)
|
|
echo "start: start [ -c <configuration-directory> ]
|
|
Start shorewall. Existing connections through shorewall managed
|
|
interfaces are untouched. New connections will be allowed only
|
|
if they are allowed by the firewall rules or policies."
|
|
;;
|
|
|
|
stop)
|
|
echo "stop: stop
|
|
Stops the firewall. All existing connections, except those
|
|
listed in /etc/shorewall/routestopped, are taken down.
|
|
The only new traffic permitted through the firewall
|
|
is from systems listed in /etc/shorewall/routestopped."
|
|
;;
|
|
|
|
status)
|
|
echo "status: status
|
|
Produce a verbose report about the firewall.
|
|
|
|
(iptables -L -n -v)"
|
|
;;
|
|
|
|
try)
|
|
echo "try: try <configuration-directory> [ <timeout> ]
|
|
Restart shorewall using the specified configuration. If an error
|
|
occurs during the restart, then another shorewall restart is performed
|
|
using the default configuration. If a timeout is specified then
|
|
the restart is always performed after the timeout occurs and uses
|
|
the default configuration."
|
|
;;
|
|
|
|
version)
|
|
echo "version: version
|
|
Show the current shorewall version which is: $version"
|
|
;;
|
|
|
|
*)
|
|
echo "$1: $1 is not recognized by the help command"
|
|
;;
|
|
|
|
esac
|
|
|
|
exit 0 # always ok
|
|
|