mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-24 15:18:53 +01:00
b66929a65e
1) Elimination of the "shorewall monitor" command. 2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into a single /etc/shorewall/zones file. This is done in an upwardly-compatible way so that current users can continue to use their existing files. 3) Support has been added for the arp_ignore interface option. 4) DROPINVALID has been removed from shorewall.conf. Behavior is as if DROPINVALID=No was specified. 5) The 'nobogons' option and BOGON_LOG_LEVEL are removed. 6) Error and warning messages have been made easier to spot by using capitalization (e.g., ERROR: and WARNING:). 7) The /etc/shorewall/policy file now contains a new connection policy and a policy for ESTABLISHED packets. Useful for users of snort-inline who want to pass all packets to the QUEUE target. 8) A new 'critical' option has been added to /etc/shorewall/routestopped. Shorewall insures communication between the firewall and 'critical' hosts throughout start, restart, stop and clear. Useful for diskless firewall's with NFS-mounted file systems, LDAP servers, Crossbow, etc. 9) Macros. Macros are very similar to actions but are easier to use, allow parameter substitution and are more efficient. Almost all of the standard actions have been converted to macros in the EXPERIMENTAL branch. 10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No. 11) If you have 'make' installed on your firewall, then when you use the '-f' option to 'shorewall start' (as happens when you reboot), if your /etc/shorewall/ directory contains files that were modified after Shorewall was last restarted then Shorewall is started using the config files rather than using the saved configuration. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
46 lines
1.5 KiB
Plaintext
46 lines
1.5 KiB
Plaintext
#
|
|
# Shorewall 2.6 -- RFC1918 File
|
|
#
|
|
# /etc/shorewall/rfc1918
|
|
#
|
|
# Lists the subnetworks that are blocked by the 'norfc1918' interface option.
|
|
#
|
|
# The default list includes those IP addresses listed in RFC 1918.
|
|
#
|
|
# DO NOT MODIFY THIS FILE. IF YOU NEED TO MAKE CHANGES, COPY THE FILE
|
|
# TO /etc/shorewall AND MODIFY THE COPY.
|
|
#
|
|
# Columns are:
|
|
#
|
|
# SUBNETS A comma-separated list of subnet addresses
|
|
# (host addresses also allowed as are IP
|
|
# address ranges provided that your kernel and iptables
|
|
# have iprange match support).
|
|
# TARGET Where to send packets to/from this subnet
|
|
# RETURN - let the packet be processed normally
|
|
# DROP - silently drop the packet
|
|
# logdrop - log then drop
|
|
#
|
|
# By default, the RETURN target causes 'norfc1918' processing to cease for a
|
|
# packet if the packet's source IP address matches the rule. Thus, if you have:
|
|
#
|
|
# SUBNETS TARGET
|
|
# 192.168.1.0/24 RETURN
|
|
#
|
|
# then traffic from 192.168.1.4 to 10.0.3.9 will be accepted even though you
|
|
# also have:
|
|
#
|
|
# SUBNETS TARGET
|
|
# 10.0.0.0/8 logdrop
|
|
#
|
|
# Setting RFC1918_STRICT=Yes in shorewall.conf will cause such traffic to be
|
|
# logged and dropped since while the packet's source matches the RETURN rule,
|
|
# the packet's destination matches the 'logdrop' rule.
|
|
#
|
|
################################################################################
|
|
#SUBNETS TARGET
|
|
172.16.0.0/12 logdrop # RFC 1918
|
|
192.168.0.0/16 logdrop # RFC 1918
|
|
10.0.0.0/8 logdrop # RFC 1918
|
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|