extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-25 15:48:56 +01:00
Code Issues Packages Projects Releases Wiki Activity
dad45a396f
shorewall_code/STABLE/documentation/News.htm
teastep a6c7cf06ee Version 1.3.10 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
2002-11-09 18:10:22 +00:00

1466 lines
77 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type"
content="text/html; charset=windows-1252">
<title>Shorewall News</title>
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
</head>
<body>
<table border="0" cellpadding="0" cellspacing="0"
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
id="AutoNumber1" bgcolor="#400169" height="90">
<tbody>
<tr>
<td width="100%">
<h1 align="center"><font color="#ffffff">Shorewall News Archive</font></h1>
</td>
</tr>
</tbody>
</table>
<p><b>11/09/2002 - Shorewall 1.3.10</b></p>
<p>In this version:</p>
<ul>
<li>You may now <a href="IPSEC.htm#Dynamic">define the contents of a zone
dynamically</a> with the <a href="starting_and_stopping_shorewall.htm">"shorewall
add" and "shorewall delete" commands</a>. These commands are expected to
be used primarily within <a
href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown scripts.</li>
<li>Shorewall can now do<a href="MAC_Validation.html"> MAC verification</a>
on ethernet segments. You can specify the set of allowed MAC addresses
on the segment and you can optionally tie each MAC address to one or more
IP addresses.</li>
<li>PPTP Servers and Clients running on the firewall system may now be
defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a> file.</li>
<li>A new 'ipsecnat' tunnel type is supported for use when the
<a href="IPSEC.htm">remote IPSEC endpoint is behind a NAT gateway</a>.</li>
<li>The PATH used by Shorewall may now be specified in <a
href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
<li>The main firewall script is now /usr/lib/shorewall/firewall. The script
in /etc/init.d/shorewall is very small and uses /sbin/shorewall to do the
real work. This change makes custom distributions such as for Debian and
for Gentoo easier to manage since it is /etc/init.d/shorewall that tends
to have distribution-dependent code</li>
</ul>
<p><b>10/24/2002 - Shorewall is now in Gentoo Linux</b><b> </b><a
href="http://www.gentoo.org"><br>
</a></p>
Alexandru Hartmann reports that his Shorewall package is now a part of
<a href="http://www.gentoo.org">the Gentoo Linux distribution</a>. Thanks
Alex!<br>
<p><b>10/23/2002 - Shorewall 1.3.10 Beta 1</b><b> </b></p>
In this version:<br>
<ul>
<li>You may now <a href="IPSEC.htm#Dynamic">define the contents of a
zone dynamically</a> with the <a
href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
delete" commands</a>. These commands are expected to be used primarily within
<a href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown
scripts.</li>
<li>Shorewall can now do<a href="MAC_Validation.html"> MAC verification</a>
on ethernet segments. You can specify the set of allowed MAC addresses
on the segment and you can optionally tie each MAC address to one or more
IP addresses.</li>
<li>PPTP Servers and Clients running on the firewall system may now be
defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a> file.</li>
<li>A new 'ipsecnat' tunnel type is supported for use when the
<a href="IPSEC.htm">remote IPSEC endpoint is behind a NAT gateway</a>.</li>
<li>The PATH used by Shorewall may now be specified in <a
href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
<li>The main firewall script is now /usr/lib/shorewall/firewall. The
script in /etc/init.d/shorewall is very small and uses /sbin/shorewall to
do the real work. This change makes custom distributions such as for Debian
and for Gentoo easier to manage since it is /etc/init.d/shorewall that tends
to have distribution-dependent code.</li>
</ul>
You may download the Beta from:<br>
<ul>
<li><a href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a></li>
<li><a href="ftp://ftp.shorewall.net/pub/shorewall/Beta"
target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a></li>
</ul>
<p><b>10/10/2002 - <20>Debian 1.3.9b Packages Available<br>
</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
<p><b>10/9/2002 - Shorewall 1.3.9b</b></p>
This release rolls up fixes to the installer and to the firewall script.<br>
<p><b>10/6/2002 - Shorewall.net now running on RH8.0<br>
</b><br>
The firewall and server here at shorewall.net are now running RedHat
release 8.0.<br>
<b><br>
9/30/2002 - Shorewall 1.3.9a</b></p>
Roles up the fix for broken tunnels.<br>
<p><b>9/30/2002 - TUNNELS Broken in 1.3.9!!!</b></p>
There is an updated firewall script at <a
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
-- copy that file to /usr/lib/shorewall/firewall.<br>
<p><b>9/28/2002 - Shorewall 1.3.9</b></p>
<p>In this version:<br>
</p>
<ul>
<li><a href="configuration_file_basics.htm#dnsnames">DNS Names</a>
are now allowed in Shorewall config files (although I recommend against
using them).</li>
<li>The connection SOURCE may now be qualified by both interface
and IP address in a <a href="Documentation.htm#Rules">Shorewall rule</a>.</li>
<li>Shorewall startup is now disabled after initial installation
until the file /etc/shorewall/startup_disabled is removed. This avoids
nasty surprises during reboot for users who install Shorewall but don't
configure it.</li>
<li>The 'functions' and 'version' files and the 'firewall' symbolic
link have been moved from /var/lib/shorewall to /usr/lib/shorewall to
appease the LFS police at Debian.<br>
</li>
</ul>
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored</b><br>
</p>
<img src="images/j0233056.gif" alt="Brown Paper Bag"
width="50" height="86" align="left">
A couple of recent configuration changes at www.shorewall.net
broke the Search facility:<br>
<blockquote>
<ol>
<li>Mailing List Archive Search was not available.</li>
<li>The Site Search index was incomplete</li>
<li>Only one page of matches was presented.</li>
</ol>
</blockquote>
Hopefully these problems are now corrected.
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored<br>
</b></p>
A couple of recent configuration changes at www.shorewall.net
had the negative effect of breaking the Search facility:<br>
<ol>
<li>Mailing List Archive Search was not available.</li>
<li>The Site Search index was incomplete</li>
<li>Only one page of matches was presented.</li>
</ol>
Hopefully these problems are now corrected.<br>
<p><b>9/18/2002 - <20>Debian 1.3.8 Packages Available<br>
</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
<p><b>9/16/2002 - Shorewall 1.3.8</b></p>
<p>In this version:<br>
</p>
<ul>
<li>A <a href="Documentation.htm#Conf">NEWNOTSYN</a> option
has been added to shorewall.conf. This option determines whether Shorewall
accepts TCP packets which are not part of an established connection
and that are not 'SYN' packets (SYN flag on and ACK flag off).</li>
<li>The need for the 'multi' option to communicate between
zones za and zb on the same interface is removed in the case where
the chain 'za2zb' and/or 'zb2za' exists. 'za2zb' will exist if:</li>
<ul>
<li> There is a policy for za to zb; or </li>
<li>There is at least one rule for za to zb.</li>
</ul>
</ul>
<ul>
<li>The /etc/shorewall/blacklist file now contains three
columns. In addition to the SUBNET/ADDRESS column, there are optional
PROTOCOL and PORT columns to block only certain applications from the
blacklisted addresses.<br>
</li>
</ul>
<p><b>9/11/2002 - Debian 1.3.7c Packages Available</b></p>
<p>Apt-get sources listed at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>9/2/2002 - Shorewall 1.3.7c</b></p>
<p>This is a role up of a fix for "DNAT" rules where the source zone is $FW
(fw).</p>
<p><b>8/31/2002 - I'm not available</b></p>
<p>I'm currently on vacation<6F> -- please respect my need for a couple of
weeks free of Shorewall problem reports.</p>
<p>-Tom</p>
<p><b>8/26/2002 - Shorewall 1.3.7b</b></p>
<p>This is a role up of the "shorewall refresh" bug fix and the change which
reverses the order of "dhcp" and "norfc1918" checking.</p>
<p><b>8/26/2002 - French FTP Mirror is Operational</b></p>
<p><a target="_blank"
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
is now available.</p>
<p><b>8/25/2002 - Shorewall Mirror in France</b></p>
<p>Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored
at <a target="_top" href="http://france.shorewall.net">http://france.shorewall.net</a>.</p>
<p><b>8/25/2002 - Shorewall 1.3.7a Debian Packages Available</b></p>
<p>Lorenzo Martignoni reports that the packages for version 1.3.7a are available
at <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author
-- Shorewall 1.3.7a released<img border="0"
src="images/j0233056.gif" width="50" height="80" align="middle">
</b></p>
<p>1.3.7a corrects problems occurring in rules file processing when starting
Shorewall 1.3.7.</p>
<p><b>8/22/2002 - Shorewall 1.3.7 Released 8/13/2002</b></p>
<p>Features in this release include:</p>
<ul>
<li>The 'icmp.def' file is now empty! The rules in that
file were required in ipchains firewalls but are not required in
Shorewall. Users who have ALLOWRELATED=No in <a
href="Documentation.htm#Conf">shorewall.conf</a> should see the <a
href="errata.htm#Upgrade">Upgrade Issues</a>.</li>
<li>A 'FORWARDPING' option has been added to <a
href="Documentation.htm#Conf"> shorewall.conf</a>. The effect of setting
this variable to Yes is the same as the effect of adding an ACCEPT
rule for ICMP echo-request in <a
href="shorewall_extension_scripts.htm">/etc/shorewall/icmpdef</a>. Users
who have such a rule in icmpdef are encouraged to switch to FORWARDPING=Yes.</li>
<li>The loopback CLASS A Network (127.0.0.0/8) has been
added to the rfc1918 file.</li>
<li>Shorewall now works with iptables 1.2.7</li>
<li>The documentation and web site no longer uses FrontPage
themes.</li>
</ul>
<p>I would like to thank John Distler for his valuable input regarding TCP
SYN and ICMP treatment in Shorewall. That input has led to marked
improvement in Shorewall in the last two releases.</p>
<p><b>8/13/2002 - Documentation in the <a target="_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
<p>The Shorewall-docs project now contains just the HTML and image files
- the Frontpage files have been removed.</p>
<p><b>8/7/2002 - <i>STABLE</i></b> <b>branch added to <a target="_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
<p>This branch will only be updated after I release a new version of Shorewall
so you can always update from this branch to get the latest stable
tree.</p>
<p><b>8/7/2002 - <a href="errata.htm#Upgrade">Upgrade Issues</a> section
added to the <a href="errata.htm">Errata Page</a></b></p>
<p>Now there is one place to go to look for issues involved with upgrading
to recent versions of Shorewall.</p>
<p><b>8/7/2002 - Shorewall 1.3.6</b></p>
<p>This is primarily a bug-fix rollup with a couple of new features:</p>
<ul>
<li>The latest <a
href="shorewall_quickstart_guide.htm">QuickStart Guides </a>
including the <a href="shorewall_setup_guide.htm">Shorewall Setup
Guide.</a></li>
<li>Shorewall will now DROP TCP packets that are not part
of or related to an existing connection and that are not SYN packets.
These "New not SYN" packets may be optionally logged by setting
the LOGNEWNOTSYN option in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.</li>
<li>The processing of "New not SYN" packets may be extended
by commands in the new <a
href="shorewall_extension_scripts.htm">newnotsyn extension script</a>.</li>
</ul>
<p><b>7/30/2002 - Shorewall 1.3.5b Released</b></p>
<p>This interim release:</p>
<ul>
<li>Causes the firewall script to remove the lock file
if it is killed.</li>
<li>Once again allows lists in the second column of the
<a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a> file.</li>
<li>Includes the latest <a
href="shorewall_quickstart_guide.htm">QuickStart Guides</a>.</li>
</ul>
<p><b>7/29/2002 - New Shorewall Setup Guide Available</b></p>
<p>The first draft of this guide is available at <a
href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm</a>.
The guide is intended for use by people who are setting up Shorewall
to manage multiple public IP addresses and by people who want to
learn more about Shorewall than is described in the single-address
guides. Feedback on the new guide is welcome.</p>
<p><b>7/28/2002 - Shorewall 1.3.5 Debian Package Available</b></p>
<p>Lorenzo Martignoni reports that the packages are version 1.3.5a and are
available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>7/27/2002 - Shorewall 1.3.5a Released</b></p>
<p>This interim release restores correct handling of REDIRECT rules. </p>
<p><b>7/26/2002 - Shorewall 1.3.5 Released</b></p>
<p>This will be the last Shorewall release for a while. I'm going to be
focusing on rewriting a lot of the documentation.</p>
<p><b><EFBFBD></b>In this version:</p>
<ul>
<li>Empty and invalid source and destination qualifiers
are now detected in the rules file. It is a good idea to use the
'shorewall check' command before you issue a 'shorewall restart'
command be be sure that you don't have any configuration problems
that will prevent a successful restart.</li>
<li>Added <b>MERGE_HOSTS</b> variable in <a
href="Documentation.htm#Conf"> shorewall.conf</a> to provide saner behavior
of the /etc/shorewall/hosts file.</li>
<li>The time that the counters were last reset is now displayed
in the heading of the 'status' and 'show' commands.</li>
<li>A <b>proxyarp </b>option has been added for entries
in <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.
This option facilitates Proxy ARP sub-netting as described in the Proxy
ARP subnetting mini-HOWTO (<a
href="http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/">http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/</a>).
Specifying the proxyarp option for an interface causes Shorewall
to set /proc/sys/net/ipv4/conf/&lt;interface&gt;/proxy_arp.</li>
<li>The Samples have been updated to reflect the new capabilities
in this release. </li>
</ul>
<p><b>7/16/2002 - New Mirror in Argentina</b></p>
<p>Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in
Argentina. Thanks Buanzo!!!</p>
<p><b>7/16/2002 - Shorewall 1.3.4 Released</b></p>
<p>In this version:</p>
<ul>
<li>A new <a href="Documentation.htm#Routestopped">
/etc/shorewall/routestopped</a> file has been added. This file is
intended to eventually replace the <b>routestopped</b> option
in the /etc/shorewall/interface and /etc/shorewall/hosts files.
This new file makes remote firewall administration easier by allowing
any IP or subnet to be enabled while Shorewall is stopped.</li>
<li>An /etc/shorewall/stopped <a
href="Documentation.htm#Scripts">extension script</a> has been added.
This script is invoked after Shorewall has stopped.</li>
<li>A <b>DETECT_DNAT_ADDRS </b>option has been added to
<a href="Documentation.htm#Conf">/etc/shoreall/shorewall.conf</a>.
When this option is selected, DNAT rules only apply when the destination
address is the external interface's primary IP address.</li>
<li>The <a href="shorewall_quickstart_guide.htm">QuickStart
Guide</a> has been broken into three guides and has been almost
entirely rewritten.</li>
<li>The Samples have been updated to reflect the new capabilities
in this release. </li>
</ul>
<p><b>7/8/2002 - Shorewall 1.3.3 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the packages are available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>7/6/2002 - Shorewall 1.3.3 Released</b></p>
<p>In this version:</p>
<ul>
<li>Entries in /etc/shorewall/interface that use the wildcard
character ("+") now have the "multi" option assumed.</li>
<li>The 'rfc1918' chain in the mangle table has been renamed
'man1918' to make log messages generated from that chain distinguishable
from those generated by the 'rfc1918' chain in the filter table.</li>
<li>Interface names appearing in the hosts file are now
validated against the interfaces file.</li>
<li>The TARGET column in the rfc1918 file is now checked
for correctness.</li>
<li>The chain structure in the nat table has been changed
to reduce the number of rules that a packet must traverse and to
correct problems with NAT_BEFORE_RULES=No</li>
<li>The "hits" command has been enhanced.</li>
</ul>
<p><b>6/25/2002 - Samples Updated for 1.3.2</b></p>
<p>The comments in the sample configuration files have been updated to reflect
new features introduced in Shorewall 1.3.2.</p>
<p><b>6/25/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the package is available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>6/19/2002 - Documentation Available in PDF Format</b></p>
<p>Thanks to Mike Martinez, the Shorewall Documentation is now available
for <a href="download.htm">download</a> in <a
href="http://www.adobe.com">Adobe</a> PDF format.</p>
<p><b>6/16/2002 - Shorewall 1.3.2 Released</b></p>
<p>In this version:</p>
<ul>
<li>A <a href="Documentation.htm#Starting">logwatch command</a>
has been added to /sbin/shorewall.</li>
<li>A <a href="blacklisting_support.htm">dynamic blacklist
facility</a> has been added.</li>
<li>Support for the <a href="Documentation.htm#Conf">Netfilter
multiport match function</a> has been added.</li>
<li>The files <b>firewall, functions </b>and <b>version</b>
have been moved from /etc/shorewall to /var/lib/shorewall.</li>
</ul>
<p><b>6/6/2002 - Why CVS Web access is Password Protected</b></p>
<p>Last weekend, I installed the CVS Web package to provide brower-based
access to the Shorewall CVS repository. Since then, I have had several
instances where my server was almost unusable due to the high load generated
by website copying tools like HTTrack and WebStripper. These mindless tools:</p>
<ul>
<li>Ignore robot.txt files.</li>
<li>Recursively copy everything that they find.</li>
<li>Should be classified as weapons rather than tools.</li>
</ul>
<p>These tools/weapons are particularly damaging when combined with CVS Web
because they doggedly follow every link in the cgi-generated HTML
resulting in 1000s of executions of the cvsweb.cgi script. Yesterday,
I spend several hours implementing measures to block these tools but
unfortunately, these measures resulted in my server OOM-ing under
even moderate load.</p>
<p>Until I have the time to understand the cause of the OOM (or until I buy
more RAM if that is what is required), CVS Web access will remain
Password Protected. </p>
<p><b>6/5/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
<p>Lorenzo Marignoni reports that the package is available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
<p><b>6/2/2002 - Samples Corrected</b></p>
<p>The 1.3.0 samples configurations had several serious problems that prevented
DNS and SSH from working properly. These problems have been corrected
in the <a href="/pub/shorewall/samples-1.3.1">1.3.1 samples.</a></p>
<p><b>6/1/2002 - Shorewall 1.3.1 Released</b></p>
<p>Hot on the heels of 1.3.0, this release:</p>
<ul>
<li>Corrects a serious problem with "all <i>&lt;zone&gt;</i>
CONTINUE" policies. This problem is present in all versions of
Shorewall that support the CONTINUE policy. These previous versions
optimized away the "all2<i>&lt;zone&gt;</i>" chain and replaced it
with the "all2all" chain with the usual result that a policy of REJECT
was enforced rather than the intended CONTINUE policy.</li>
<li>Adds an <a href="Documentation.htm#rfc1918">/etc/shorewall/rfc1918</a>
file for defining the exact behavior of the<a
href="Documentation.htm#Interfaces"> 'norfc1918' interface option</a>.</li>
</ul>
<p><b>5/29/2002 - Shorewall 1.3.0 Released</b></p>
<p>In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0
includes:</p>
<ul>
<li>A 'filterping' interface option that allows ICMP echo-request
(ping) requests addressed to the firewall to be handled by entries
in /etc/shorewall/rules and /etc/shorewall/policy.</li>
</ul>
<p><b>5/23/2002 - Shorewall 1.3 RC1 Available</b></p>
<p>In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92)
incorporates the following:</p>
<ul>
<li>Support for the /etc/shorewall/whitelist file has been
withdrawn. If you need whitelisting, see <a
href="/1.3/whitelisting_under_shorewall.htm">these instructions</a>.</li>
</ul>
<p><b>5/19/2002 - Shorewall 1.3 Beta 2 Available</b></p>
<p>In addition to the changes in Beta 1, this release which carries the
designation 1.2.91 adds:</p>
<ul>
<li>The structure of the firewall is changed markedly.
There is now an INPUT and a FORWARD chain for each interface; this
reduces the number of rules that a packet must traverse, especially
in complicated setups.</li>
<li><a href="Documentation.htm#Exclude">Sub-zones may now
be excluded from DNAT and REDIRECT rules.</a></li>
<li>The names of the columns in a number of the configuration
files have been changed to be more consistent and self-explanatory
and the documentation has been updated accordingly.</li>
<li>The sample configurations have been updated for 1.3.</li>
</ul>
<p><b>5/17/2002 - Shorewall 1.3 Beta 1 Available</b></p>
<p>Beta 1 carries the version designation 1.2.90 and implements the following
features:</p>
<ul>
<li>Simplified rule syntax which makes the intent of each
rule clearer and hopefully makes Shorewall easier to learn.</li>
<li>Upward compatibility with 1.2 configuration files has
been maintained so that current users can migrate to the new syntax
at their convenience.</li>
<li><b><font color="#cc6666">WARNING:<3A> Compatibility with
the old parameterized sample configurations has NOT been maintained.
Users still running those configurations should migrate to the new
sample configurations before upgrading to 1.3 Beta 1.</font></b></li>
</ul>
<p><b>5/4/2002 - Shorewall 1.2.13 is Available</b></p>
<p>In this version:</p>
<ul>
<li><a href="Documentation.htm#Whitelist">White-listing</a>
is supported.</li>
<li><a href="Documentation.htm#Policy">SYN-flood protection
</a>is added.</li>
<li>IP addresses added under <a
href="Documentation.htm#Conf">ADD_IP_ALIASES and ADD_SNAT_ALIASES</a>
now inherit the VLSM and Broadcast Address of the interface's primary
IP address.</li>
<li>The order in which port forwarding DNAT and Static
DNAT <a href="Documentation.htm#Conf">can now be reversed</a> so
that port forwarding rules can override the contents of <a
href="Documentation.htm#NAT"> /etc/shorewall/nat</a>. </li>
</ul>
<p><b>4/30/2002 - Shorewall Debian News</b></p>
<p>Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the
<a href="http://packages.debian.org/testing/net/shorewall.html">Debian
Testing Branch</a> and the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch</a>.</p>
<p><b>4/20/2002 - Shorewall 1.2.12 is Available</b></p>
<ul>
<li>The 'try' command works again</li>
<li>There is now a single RPM that also works with SuSE.</li>
</ul>
<p><b>4/17/2002 - Shorewall Debian News</b></p>
<p>Lorenzo Marignoni reports that:</p>
<ul>
<li>Shorewall 1.2.10 is in the <a
href="http://packages.debian.org/testing/net/shorewall.html">Debian
Testing Branch</a></li>
<li>Shorewall 1.2.11 is in the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch</a></li>
</ul>
<p>Thanks, Lorenzo!</p>
<p><b>4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE</b></p>
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
is now a Shorewall 1.2.11 <a
href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm">
SuSE RPM</a> available. </p>
<p><b>4/13/2002 - Shorewall 1.2.11 Available </b></p>
<p>In this version:</p>
<ul>
<li>The 'try' command now accepts an optional timeout.
If the timeout is given in the command, the standard configuration
will automatically be restarted after the new configuration has been
running for that length of time. This prevents a remote admin from
being locked out of the firewall in the case where the new configuration
starts but prevents access.</li>
<li>Kernel route filtering may now be enabled globally
using the new ROUTE_FILTER parameter in <a
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
<li>Individual IP source addresses and/or subnets may now
be excluded from masquerading/SNAT.</li>
<li>Simple "Yes/No" and "On/Off" values are now case-insensitive
in /etc/shorewall/shorewall.conf.</li>
</ul>
<p><b>4/13/2002 - Hamburg Mirror now has FTP </b></p>
<p>Stefan now has an FTP mirror at <a target="_blank"
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall</a>.<2E>
Thanks Stefan!</p>
<p><b>4/12/2002 - New Mirror in Hamburg</b></p>
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
is now a mirror of the Shorewall website at <a target="_top"
href="http://germany.shorewall.net"> http://germany.shorewall.net</a>.
</p>
<p><b>4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available</b></p>
<p><a href="shorewall_quickstart_guide.htm">Version 1.1 of the QuickStart
Guide</a> is now available. Thanks to those who have read version
1.0 and offered their suggestions. Corrections have also been made
to the sample scripts.</p>
<p><b>4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available</b></p>
<p><a href="shorewall_quickstart_guide.htm">Version 1.0 of the QuickStart
Guide</a> is now available. This Guide and its accompanying sample
configurations are expected to provide a replacement for the recently
withdrawn parameterized samples. </p>
<p><b>4/8/2002 - Parameterized Samples Withdrawn </b></p>
<p>Although the <a
href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized
samples</a> have allowed people to get a firewall up and running
quickly, they have unfortunately set the wrong level of expectation
among those who have used them. I am therefore withdrawing support
for the samples and I am recommending that they not be used in new
Shorewall installations.</p>
<p><b>4/2/2002 - Updated Log Parser</b></p>
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided an updated
version of his <a href="pub/shorewall/parsefw/">CGI-based log parser</a>
with corrected date handling. </p>
<p><b>3/30/2002 - Shorewall Website Search Improvements</b></p>
<p>The quick search on the home page now excludes the mailing list archives.
The <a href="htdig/search.html">Extended Search</a> allows excluding
the archives or restricting the search to just the archives. An archive
search form is also available on the <a href="mailing_list.htm">mailing
list information page</a>.</p>
<p><b>3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)</b></p>
<ul>
<li>The 1.2.10 Debian Package is available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
<li>Shorewall 1.2.9 is now in the <a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Distribution</a>.</li>
</ul>
<p><b>3/25/2002 - Log Parser Available</b></p>
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided a <a
href="pub/shorewall/parsefw/">CGI-based log parser</a> for Shorewall. Thanks
John.</p>
<p><b>3/20/2002 - Shorewall 1.2.10 Released</b></p>
<p>In this version:</p>
<ul>
<li>A "shorewall try" command has been added (syntax: shorewall
try <i> &lt;configuration directory&gt;</i>). This command attempts
"shorewall -c <i> &lt;configuration directory&gt;</i> start" and
if that results in the firewall being stopped due to an error, a "shorewall
start" command is executed. The 'try' command allows you to create
a new <a href="Documentation.htm#Configs"> configuration</a> and attempt
to start it; if there is an error that leaves your firewall in the
stopped state, it will automatically be restarted using the default
configuration (in /etc/shorewall).</li>
<li>A new variable ADD_SNAT_ALIASES has been added to
<a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.
If this variable is set to "Yes", Shorewall will automatically add
IP addresses listed in the third column of the <a
href="Documentation.htm#Masq"> /etc/shorewall/masq</a> file.</li>
<li>Copyright notices have been added to the documenation.</li>
</ul>
<p><b>3/11/2002 - Shorewall 1.2.9 Released</b></p>
<p>In this version:</p>
<ul>
<li>Filtering by <a href="Documentation.htm#MAC">MAC address</a>
has been added. MAC addresses may be used as the source address
in:
<ul>
<li>Filtering rules (<a
href="Documentation.htm#Rules">/etc/shorewall/rules</a>)</li>
<li>Traffic Control Classification Rules (<a
href="traffic_shaping.htm#tcrules">/etc/shorewall/tcrules</a>)</li>
<li>TOS Rules (<a href="Documentation.htm#TOS">/etc/shorewall/tos</a>)</li>
<li>Blacklist (<a href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a>)</li>
</ul>
</li>
<li>Several bugs have been fixed</li>
<li>The 1.2.9 Debian Package is also available at <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
</ul>
<p><b>3/1/2002 - 1.2.8 Debian Package is Available</b></p>
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/25/2002 - New Two-interface Sample</b></p>
<p>I've enhanced the two interface sample to allow access from the firewall
to servers in the local zone - <a
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz">
http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz</a></p>
<p><b>2/23/2002 - Shorewall 1.2.8 Released</b></p>
<p>Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects
problems associated with the lock file used to prevent multiple state-changing
operations from occuring simultaneously. My apologies for any inconvenience
my carelessness may have caused.</p>
<p><b>2/22/2002 - Shorewall 1.2.7 Released</b></p>
<p>In this version:</p>
<ul>
<li>UPnP probes (UDP destination port 1900) are now silently
dropped in the <i>common</i> chain</li>
<li>RFC 1918 checking in the mangle table has been streamlined
to no longer require packet marking. RFC 1918 checking in the filter
table has been changed to require half as many rules as previously.</li>
<li>A 'shorewall check' command has been added that does
a cursory validation of the zones, interfaces, hosts, rules and
policy files.</li>
</ul>
<p><b>2/18/2002 - 1.2.6 Debian Package is Available</b></p>
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/8/2002 - Shorewall 1.2.6 Released</b></p>
<p>In this version:</p>
<ul>
<li>$-variables may now be used anywhere in the configuration
files except /etc/shorewall/zones.</li>
<li>The interfaces and hosts files now have their contents
validated before any changes are made to the existing Netfilter
configuration. The appearance of a zone name that isn't defined
in /etc/shorewall/zones causes "shorewall start" and "shorewall
restart" to abort without changing the Shorewall state. Unknown options
in either file cause a warning to be issued.</li>
<li>A problem occurring when BLACKLIST_LOGLEVEL was not
set has been corrected.</li>
</ul>
<p><b>2/4/2002 - Shorewall 1.2.5 Debian Package Available</b></p>
<p>see <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>2/1/2002 - Shorewall 1.2.5 Released</b></p>
<p>Due to installation problems with Shorewall 1.2.4, I have released Shorewall
1.2.5. Sorry for the rapid-fire development.</p>
<p>In version 1.2.5:</p>
<ul>
<li>The installation problems have been corrected.</li>
<li><a href="Documentation.htm#Masq">SNAT</a> is now supported.</li>
<li>A "shorewall version" command has been added</li>
<li>The default value of the STATEDIR variable in /etc/shorewall/shorewall.conf
has been changed to /var/lib/shorewall in order to conform to
the GNU/Linux File Hierarchy Standard, Version 2.2.</li>
</ul>
<p><b>1/28/2002 - Shorewall 1.2.4 Released</b></p>
<ul>
<li>The "fw" zone <a href="Documentation.htm#FW">may now
be given a different name</a>.</li>
<li>You may now place end-of-line comments (preceded by
'#') in any of the configuration files</li>
<li>There is now protection against against two state changing
operations occuring concurrently. This is implemented using the
'lockfile' utility if it is available (lockfile is part of procmail);
otherwise, a less robust technique is used. The lockfile is created
in the STATEDIR defined in /etc/shorewall/shorewall.conf and has the
name "lock".</li>
<li>"shorewall start" no longer fails if "detect" is
specified in <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>
for an interface with subnet mask 255.255.255.255.</li>
</ul>
<p><b>1/27/2002 - Shorewall 1.2.3 Debian Package Available </b>-- see <a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
<p><b>1/20/2002 - Corrected firewall script available<6C></b></p>
<p>Corrects a problem with BLACKLIST_LOGLEVEL. See <a href="errata.htm">the
errata</a> for details.</p>
<p><b>1/19/2002 - Shorewall 1.2.3 Released</b></p>
<p>This is a minor feature and bugfix release. The single new feature is:</p>
<ul>
<li>Support for TCP MSS Clamp to PMTU -- This support is
usually required when the internet connection is via PPPoE or PPTP
and may be enabled using the <a href="Documentation.htm#ClampMSS">CLAMPMSS</a>
option in /etc/shorewall/shorewall.conf.</li>
</ul>
<p>The following problems were corrected:</p>
<ul>
<li>The "shorewall status" command no longer hangs.</li>
<li>The "shorewall monitor" command now displays the icmpdef
chain</li>
<li>The CLIENT PORT(S) column in tcrules is no longer ignored</li>
</ul>
<p><b>1/18/2002 - Shorewall 1.2.2 packaged with new </b><a
href="http://leaf.sourceforge.net">LEAF</a><b> release</b></p>
<p>Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution
that includes Shorewall 1.2.2. See <a
href="http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo</a>
for details.</p>
<p><b>1/11/2002 - Debian Package (.deb) Now Available - </b>Thanks to <a
href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni</a>, a 1.2.2
Shorewall Debian package is now available. There is a link to Lorenzo's
site from the <a href="download.htm">Shorewall download page</a>.</p>
<p><b>1/9/2002 - Updated 1.2.2 /sbin/shorewall available - </b><a
href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version </a>restores
the "shorewall status" command to health.</p>
<p><b>1/8/2002 - Shorewall 1.2.2 Released</b></p>
<p>In version 1.2.2</p>
<ul>
<li>Support for IP blacklisting has been added
<ul>
<li>You specify whether you want packets from blacklisted
hosts dropped or rejected using the <a
href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION </a>setting
in /etc/shorewall/shorewall.conf</li>
<li>You specify whether you want packets from blacklisted
hosts logged and at what syslog level using the <a
href="Documentation.htm#BLLoglevel">BLACKLIST_LOGLEVEL</a> setting
in /etc/shorewall/shorewall.conf</li>
<li>You list the IP addresses/subnets that you wish to
blacklist in <a href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a></li>
<li>You specify the interfaces you want checked against
the blacklist using the new "<a
href="Documentation.htm#BLInterface">blacklist</a>" option in
/etc/shorewall/interfaces.</li>
<li>The black list is refreshed from /etc/shorewall/blacklist
by the "shorewall refresh" command.</li>
</ul>
</li>
<li>Use of TCP RST replies has been expanded<65>
<ul>
<li>TCP connection requests rejected because of a REJECT
policy are now replied with a TCP RST packet.</li>
<li>TCP connection requests rejected because of a protocol=all
rule in /etc/shorewall/rules are now replied with a TCP RST
packet.</li>
</ul>
</li>
<li>A <a href="Documentation.htm#Logfile">LOGFILE</a> specification
has been added to /etc/shorewall/shorewall.conf. LOGFILE is used
to tell the /sbin/shorewall program where to look for Shorewall messages.</li>
</ul>
<p><b>1/5/2002 - New Parameterized Samples (<a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.2.0/"
target="_blank">version 1.2.0</a>) released. </b>These are minor updates
to the previously-released samples. There are two new rules added:</p>
<ul>
<li>Unless you have explicitly enabled Auth connections
(tcp port 113) to your firewall, these connections will be REJECTED
rather than DROPPED. This speeds up connection establishment to
some servers.</li>
<li>Orphan DNS replies are now silently dropped.</li>
</ul>
<p>See the README file for upgrade instructions.</p>
<p><b>1/1/2002 - <u><font color="#ff6633">Shorewall Mailing List Moving</font></u></b></p>
<p>The Shorewall mailing list hosted at <a href="http://sourceforge.net">
Sourceforge</a> is moving to Shorewall.net. If you are a current
subscriber to the list at Sourceforge, please <a
href="shorewall_mailing_list_migration.htm">see these instructions</a>.
If you would like to subscribe to the new list, visit <a
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>.</p>
<p><b>12/31/2001 - Shorewall 1.2.1 Released</b></p>
<p>In version 1.2.1:</p>
<ul>
<li><a href="Documentation.htm#LogUncleanOption">Logging
of Mangled/Invalid Packets</a> is added.<2E></li>
<li>The <a href="IPIP.htm">tunnel script</a> has been corrected.</li>
<li>'shorewall show tc' now correctly handles tunnels.</li>
</ul>
<p><b>12/21/2001 - Shorewall 1.2.0 Released!</b> - <b>I couldn't resist
releasing 1.2 on 12/21/2001</b></p>
<p>Version 1.2 contains the following new features:</p>
<ul>
<li>Support for <a href="traffic_shaping.htm">Traffic Control/Shaping</a></li>
<li>Support for <a href="Documentation.htm#Unclean">Filtering
of Mangled/Invalid Packets</a></li>
<li>Support for <a href="IPIP.htm">GRE Tunnels</a></li>
</ul>
<p>For the next month or so, I will continue to provide corrections to version
1.1.18 as necessary so that current version 1.1.x users will not be
forced into a quick upgrade to 1.2.0 just to have access to bug fixes.</p>
<p>For those of you who have installed one of the Beta RPMS, you will need
to use the "--oldpackage" option when upgrading to 1.2.0:</p>
<blockquote>
<p>rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm</p>
</blockquote>
<p><b>12/19/2001 - Thanks to <a href="mailto:scowles@infohiiway.com">Steve
Cowles</a>, there is now a Shorewall mirror in Texas. </b>This web
site is mirrored at <a href="http://www.infohiiway.com/shorewall"
target="_top">http://www.infohiiway.com/shorewall</a> and the ftp site is
at <a href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall">ftp://ftp.infohiiway.com/pub/mirrors/shorewall</a>.<b><EFBFBD></b></p>
<p><b>11/30/2001 - A new set of the parameterized <a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.18">Sample
Configurations</a> has been released</b>. In this version:</p>
<ul>
<li>Ping is now allowed between the zones.</li>
<li>In the three-interface configuration, it is now possible
to configure the internet services that are to be available to servers
in the DMZ.<2E></li>
</ul>
<p><b>11/20/2001 - The current version of Shorewall is 1.1.18.<2E></b></p>
<p>In this version:</p>
<ul>
<li>The spelling of ADD_IP_ALIASES has been corrected in
the shorewall.conf file</li>
<li>The logic for deleting user-defined chains has been
simplified so that it avoids a bug in the LRP version of the 'cut'
utility.</li>
<li>The /var/lib/lrpkg/shorwall.conf file has been corrected
to properly display the NAT entry in that file.</li>
</ul>
<p><b>11/19/2001 - Thanks to <a href="mailto:shorewall@timelord.sk">Juraj
Ontkanin</a>, there is now a Shorewall mirror in the Slovak Republic</b>.
The website is now mirrored at <a
href="http://www.nrg.sk/mirror/shorewall" target="_top">http://www.nrg.sk/mirror/shorewall</a>
and the FTP site is mirrored at <a
href="ftp://ftp.nrg.sk/mirror/shorewall">ftp://ftp.nrg.sk/mirror/shorewall</a>.</p>
<p><b>11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations.</b>
There are three sample configurations:</p>
<ul>
<li>One Interface -- for a standalone system.</li>
<li>Two Interfaces -- A masquerading firewall.</li>
<li>Three Interfaces -- A masquerading firewall with DMZ.</li>
</ul>
<p>Samples may be downloaded from <a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17</a>
. See the README file for instructions.</p>
<p><b>11/1/2001 - The current version of Shorewall is 1.1.17</b>.<2E> I intend
this to be the last of the 1.1 Shorewall releases.</p>
<p> In this version:</p>
<ul>
<li>The handling of <a href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>
has been corrected.<2E></li>
</ul>
<p><b>10/22/2001 - The current version of Shorewall is 1.1.16</b>. In this
version:</p>
<ul>
<li>A new "shorewall show connections" command has been
added.</li>
<li>In the "shorewall monitor" output, the currently tracked
connections are now shown on a separate page.</li>
<li>Prior to this release, Shorewall unconditionally added
the external IP adddress(es) specified in /etc/shorewall/nat. Beginning
with version 1.1.16, a new parameter (<a
href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>) may be set
to "no" (or "No") to inhibit this behavior. This allows IP aliases
created using your distribution's network configuration tools
to be used in static NAT.<2E></li>
</ul>
<p><b>10/15/2001 - The current version of Shorewall is 1.1.15.</b> In this
version:</p>
<ul>
<li>Support for nested zones has been improved. See <a
href="Documentation.htm#Nested"> the documentation</a> for details</li>
<li>Shorewall now correctly checks the alternate configuration
directory for the 'zones' file.</li>
</ul>
<p><b>10/4/2001 - The current version of Shorewall is 1.1.14.</b> In this
version</p>
<ul>
<li>Shorewall now supports alternate configuration directories.
When an alternate directory is specified when starting or restarting
Shorewall (e.g., "shorewall -c /etc/testconf restart"), Shorewall
will first look for configuration files in the alternate directory
then in /etc/shorewall. To create an alternate configuration simply:<br>
1. Create a New Directory<br>
2. Copy to that directory any of your configuration files
that you want to change.<br>
3. Modify the copied files as needed.<br>
4. Restart Shorewall specifying the new directory.</li>
<li>The rules for allowing/disallowing icmp echo-requests
(pings) are now moved after rules created when processing the
rules file. This allows you to add rules that selectively allow/deny
ping based on source or destination address.</li>
<li>Rules that specify multiple client ip addresses or subnets
no longer cause startup failures.</li>
<li>Zone names in the policy file are now validated against
the zones file.</li>
<li>If you have <a
href="Documentation.htm#MangleEnabled">packet mangling</a> support
enabled, the "<a href="Documentation.htm#Interfaces">norfc1918</a>"
interface option now logs and drops any incoming packets on the interface
that have an RFC 1918 destination address.</li>
</ul>
<p><b>9/12/2001 - The current version of Shorewall is 1.1.13</b>. In this
version</p>
<ul>
<li>Shell variables can now be used to parameterize Shorewall
rules.</li>
<li>The second column in the hosts file may now contain
a comma-separated list.<br>
<br>
Example:<br>
<20><><EFBFBD> sea<65><61><EFBFBD> eth0:130.252.100.0/24,206.191.149.0/24</li>
<li>Handling of multi-zone interfaces has been improved.
See the <a href="Documentation.htm#Interfaces">documentation for
the /etc/shorewall/interfaces file</a>.</li>
</ul>
<p><b>8/28/2001 - The current version of Shorewall is 1.1.12</b>. In this
version</p>
<ul>
<li>Several columns in the rules file may now contain comma-separated
lists.</li>
<li>Shorewall is now more rigorous in parsing the options
in /etc/shorewall/interfaces.</li>
<li>Complementation using "!" is now supported in rules.</li>
</ul>
<p><b>7/28/2001 - The current version of Shorewall is 1.1.11</b>. In this
version</p>
<ul>
<li>A "shorewall refresh" command has been added to allow
for refreshing the rules associated with the broadcast address on
a dynamic interface. This command should be used in place of "shorewall
restart" when the internet interface's IP address changes.</li>
<li>The /etc/shorewall/start file (if any) is now processed
after all temporary rules have been deleted. This change prevents
the accidental removal of rules added during the processing of
that file.</li>
<li>The "dhcp" interface option is now applicable to firewall
interfaces used by a DHCP server running on the firewall.</li>
<li>The RPM can now be built from the .tgz file using "rpm
-tb"<22></li>
</ul>
<p><b>7/6/2001 - The current version of Shorewall is 1.1.10.</b> In this
version</p>
<ul>
<li>Shorewall now enables Ipv4 Packet Forwarding by default.
Packet forwarding may be disabled by specifying IP_FORWARD=Off in
/etc/shorewall/shorewall.conf. If you don't want Shorewall to enable
or disable packet forwarding, add IP_FORWARDING=Keep to your
/etc/shorewall/shorewall.conf file.</li>
<li>The "shorewall hits" command no longer lists extraneous
service names in its last report.</li>
<li>Erroneous instructions in the comments at the head of
the firewall script have been corrected.</li>
</ul>
<p><b>6/23/2001 - The current version of Shorewall is 1.1.9.</b> In this
version</p>
<ul>
<li>The "tunnels" file <u>really</u> is in the RPM now.</li>
<li>SNAT can now be applied to port-forwarded connections.</li>
<li>A bug which would cause firewall start failures in some
dhcp configurations has been fixed.</li>
<li>The firewall script now issues a message if you have
the name of an interface in the second column in an entry in /etc/shorewall/masq
and that interface is not up.</li>
<li>You can now configure Shorewall so that it<a
href="Documentation.htm#NatEnabled"> doesn't require the NAT and/or
mangle netfilter modules</a>.</li>
<li>Thanks to Alex<65> Polishchuk, the "hits" command from
seawall is now in shorewall.</li>
<li>Support for <a href="IPIP.htm">IPIP tunnels</a> has
been added.</li>
</ul>
<p><b>6/18/2001 - The current version of Shorewall is 1.1.8</b>. In this
version</p>
<ul>
<li>A typo in the sample rules file has been corrected.</li>
<li>It is now possible to restrict masquerading by<a
href="Documentation.htm#Masq"> destination host or subnet.</a></li>
<li>It is now possible to have static <a
href="NAT.htm#LocalPackets">NAT rules applied to packets originating
on the firewall itself</a>.</li>
</ul>
<p><b>6/2/2001 - The current version of Shorewall is 1.1.7.</b> In this version</p>
<ul>
<li>The TOS rules are now deleted when the firewall is stopped.</li>
<li>The .rpm will now install regardless of which version
of iptables is installed.</li>
<li>The .rpm will now install without iproute2 being installed.</li>
<li>The documentation has been cleaned up.</li>
<li>The sample configuration files included in Shorewall
have been formatted to 80 columns for ease of editing on a VGA
console.</li>
</ul>
<p><b>5/25/2001 - The current version of Shorewall is 1.1.6</b>. In this
version</p>
<ul>
<li><a href="Documentation.htm#lograte">You may now rate-limit
the packet log.</a></li>
<li><font face="Century Gothic, Arial, Helvetica"><EFBFBD>Previous
versions of Shorewall have an implementation of Static NAT which
violates the principle of least surprise.<2E> NAT only occurs for
packets arriving at (DNAT) or send from (SNAT) the interface named
in the INTERFACE column of /etc/shorewall/nat. Beginning with version
1.1.6, NAT effective regardless of which interface packets come from
or are destined to. To get compatibility with prior versions, I have
added a new "ALL <a href="NAT.htm#AllInterFaces">"ALL INTERFACES"<22> column
to /etc/shorewall/nat</a>. By placing "no" or "No" in the new column,
the NAT behavior of prior versions may be retained.<2E></font></li>
<li>The treatment of <a href="IPSEC.htm#RoadWarrior">IPSEC
Tunnels where the remote gateway is a standalone system has been
improved</a>. Previously, it was necessary to include an additional
rule allowing UDP port 500 traffic to pass through the tunnel. Shorewall
will now create this rule automatically when you place the name of
the remote peer's zone in a new GATEWAY ZONE column in /etc/shorewall/tunnels.<2E></li>
</ul>
<p><b>5/20/2001 - The current version of Shorewall is 1.1.5.</b> In this
version</p>
<ul>
<li><a href="Documentation.htm#modules">You may now pass
parameters when loading netfilter modules and you can specify the
modules to load.</a></li>
<li>Compressed modules are now loaded. This requires that
you modutils support loading compressed modules.</li>
<li><a href="Documentation.htm#TOS">You may now set the
Type of Service (TOS) field in packets.</a></li>
<li>Corrected rules generated for port redirection (again).</li>
</ul>
<p><b>5/10/2001 - The current version of Shorewall is 1.1.4.</b> In this
version</p>
<ul>
<li> <a href="Documentation.htm#Conf">Accepting RELATED
connections is now optional.</a></li>
<li>Corrected problem where if "shorewall start" aborted
early (due to kernel configuration errors for example), superfluous
'sed' error messages were reported.</li>
<li>Corrected rules generated for port redirection.</li>
<li>The order in which iptables kernel modules are loaded
has been corrected (Thanks to Mark Pavlidis).<2E></li>
</ul>
<p><b>4/28/2001 - The current version of Shorewall is 1.1.3.</b> In this
version</p>
<ul>
<li>Correct message issued when Proxy ARP address added
(Thanks to Jason Kirtland).</li>
<li>/tmp/shorewallpolicy-$$ is now removed if there is an
error while starting the firewall.</li>
<li>/etc/shorewall/icmp.def and /etc/shorewall/common.def
are now used to define the icmpdef and common chains unless overridden
by the presence of /etc/shorewall/icmpdef or /etc/shorewall/common.</li>
<li>In the .lrp, the file /var/lib/lrpkg/shorwall.conf has
been corrected. An extra space after "/etc/shorwall/policy" has been
removed and "/etc/shorwall/rules" has been added.</li>
<li>When a sub-shell encounters a fatal error and has stopped
the firewall, it now kills the main shell so that the main shell
will not continue.</li>
<li>A problem has been corrected where a sub-shell stopped
the firewall and main shell continued resulting in a perplexing error
message referring to "common.so" resulted.</li>
<li>Previously, placing "-" in the PORT(S) column in /etc/shorewall/rules
resulted in an error message during start. This has been corrected.</li>
<li>The first line of "install.sh" has been corrected --
I had inadvertently deleted the initial "#".</li>
</ul>
<p><b>4/12/2001 - The current version of Shorewall is 1.1.2.</b> In this
version</p>
<ul>
<li>Port redirection now works again.</li>
<li>The icmpdef and common chains <a
href="Documentation.htm#Icmpdef">may now be user-defined</a>.</li>
<li>The firewall no longer fails to start if "routefilter"
is specified for an interface that isn't started. A warning message
is now issued in this case.</li>
<li>The LRP Version is renamed "shorwall" for 8,3 MSDOS
file system compatibility.</li>
<li>A couple of LRP-specific problems were corrected.</li>
</ul>
<p><b>4/8/2001 - Shorewall is now affiliated with the <a
href="http://leaf.sourceforge.net">Leaf Project</a> </b> <a
href="http://leaf.sourceforge.net"> <img border="0"
src="images/leaflogo.gif" width="49" height="36">
</a></p>
<p><b>4/5/2001 - The current version of Shorewall is 1.1.1. In this version:</b></p>
<ul>
<li>The common chain is traversed from INPUT, OUTPUT and
FORWARD before logging occurs</li>
<li>The source has been cleaned up dramatically</li>
<li>DHCP DISCOVER packets with RFC1918 source addresses
no longer generate log messages. Linux DHCP clients generate such
packets and it's annoying to see them logged.<2E></li>
</ul>
<p><b>3/25/2001 - The current version of Shorewall is 1.1.0. In this version:</b></p>
<ul>
<li>Log messages now indicate the packet disposition.</li>
<li>Error messages have been improved.</li>
<li>The ability to define zones consisting of an enumerated
set of hosts and/or subnetworks has been added.</li>
<li>The zone-to-zone chain matrix is now sparse so that
only those chains that contain meaningful rules are defined.</li>
<li>240.0.0.0/4 and 169.254.0.0/16 have been added to the
source subnetworks whose packets are dropped under the <i>norfc1918</i>
interface option.</li>
<li>Exits are now provided for executing an user-defined
script when a chain is defined, when the firewall is initialized,
when the firewall is started, when the firewall is stopped and
when the firewall is cleared.</li>
<li>The Linux kernel's route filtering facility can now
be specified selectively on network interfaces.</li>
</ul>
<p><b>3/19/2001 - The current version of Shorewall is 1.0.4. This version:</b></p>
<ul>
<li>Allows user-defined zones. Shorewall now has only one
pre-defined zone (fw) with the remaining zones being defined
in the new configuration file /etc/shorewall/zones. The /etc/shorewall/zones
file released in this version provides behavior that is compatible
with Shorewall 1.0.3.<2E></li>
<li>Adds the ability to specify logging in entries in the
/etc/shorewall/rules file.</li>
<li>Correct handling of the icmp-def chain so that only
ICMP packets are sent through the chain.</li>
<li>Compresses the output of "shorewall monitor" if awk
is installed. Allows the command to work if awk isn't installed
(although it's not pretty).</li>
</ul>
<p><b>3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix
release with no new features.</b></p>
<ul>
<li>The PATH variable in the firewall script now includes
/usr/local/bin and /usr/local/sbin.</li>
<li>DMZ-related chains are now correctly deleted if the
DMZ is deleted.</li>
<li>The interface OPTIONS for "gw" interfaces are no longer
ignored.</li>
</ul>
<p><b>3/8/2001 - The current version of Shorewall is 1.0.2. It supports an
additional "gw" (gateway) zone for tunnels and it supports IPSEC
tunnels with end-points on the firewall. There is also a .lrp available
now.</b></p>
<p><font size="2">Updated 11/09/2002 - <a href="support.htm">Tom Eastep</a>
</font></p>
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">
Copyright</font> <20> <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink