mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-14 11:44:01 +01:00
b66929a65e
1) Elimination of the "shorewall monitor" command. 2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into a single /etc/shorewall/zones file. This is done in an upwardly-compatible way so that current users can continue to use their existing files. 3) Support has been added for the arp_ignore interface option. 4) DROPINVALID has been removed from shorewall.conf. Behavior is as if DROPINVALID=No was specified. 5) The 'nobogons' option and BOGON_LOG_LEVEL are removed. 6) Error and warning messages have been made easier to spot by using capitalization (e.g., ERROR: and WARNING:). 7) The /etc/shorewall/policy file now contains a new connection policy and a policy for ESTABLISHED packets. Useful for users of snort-inline who want to pass all packets to the QUEUE target. 8) A new 'critical' option has been added to /etc/shorewall/routestopped. Shorewall insures communication between the firewall and 'critical' hosts throughout start, restart, stop and clear. Useful for diskless firewall's with NFS-mounted file systems, LDAP servers, Crossbow, etc. 9) Macros. Macros are very similar to actions but are easier to use, allow parameter substitution and are more efficient. Almost all of the standard actions have been converted to macros in the EXPERIMENTAL branch. 10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No. 11) If you have 'make' installed on your firewall, then when you use the '-f' option to 'shorewall start' (as happens when you reboot), if your /etc/shorewall/ directory contains files that were modified after Shorewall was last restarted then Shorewall is started using the config files rather than using the saved configuration. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
144 lines
5.3 KiB
INI
144 lines
5.3 KiB
INI
#
|
|
# Shorewall 2.6 - /etc/shorewall/hosts
|
|
#
|
|
# THE ONLY TIME YOU NEED THIS FILE IS WHERE YOU HAVE MORE THAN
|
|
# ONE ZONE CONNECTED THROUGH A SINGLE INTERFACE.
|
|
#
|
|
# IF YOU DON'T HAVE THAT SITUATION THEN DON'T TOUCH THIS FILE.
|
|
#------------------------------------------------------------------------------
|
|
# IF YOU HAVE AN ENTRY FOR A ZONE AND INTERFACE IN
|
|
# /etc/shorewall/interfaces THEN DO NOT ADD ANY ENTRIES FOR THAT
|
|
# ZONE AND INTERFACE IN THIS FILE.
|
|
#------------------------------------------------------------------------------
|
|
# This file is used to define zones in terms of subnets and/or
|
|
# individual IP addresses. Most simple setups don't need to
|
|
# (should not) place anything in this file.
|
|
#
|
|
# The order of entries in this file is not significant in
|
|
# determining zone composition. Rather, the order that the zones
|
|
# are defined in /etc/shorewall/zones determines the order in
|
|
# which the records in this file are interpreted.
|
|
#
|
|
# ZONE - The name of a zone defined in /etc/shorewall/zones
|
|
#
|
|
# HOST(S) - The name of an interface defined in the
|
|
# /etc/shorewall/interfaces file followed by a colon (":") and
|
|
# a comma-separated list whose elements are either:
|
|
#
|
|
# a) The IP address of a host
|
|
# b) A subnetwork in the form
|
|
# <subnet-address>/<mask width>
|
|
# c) An IP address range of the form <low address>-<high
|
|
# address>. Your kernel and iptables must have iprange
|
|
# match support.
|
|
# d) A physical port name; only allowed when the
|
|
# interface names a bridge created by the
|
|
# brctl addbr command. This port must not
|
|
# be defined in /etc/shorewall/interfaces and may
|
|
# optionally followed by a colon (":") and a
|
|
# host or network IP or a range.
|
|
# See http://www.shorewall.net/Bridge.html for details.
|
|
# e) The name of an ipset (preceded by "+").
|
|
#
|
|
# Examples:
|
|
#
|
|
# eth1:192.168.1.3
|
|
# eth2:192.168.2.0/24
|
|
# eth3:192.168.2.0/24,192.168.3.1
|
|
# br0:eth4
|
|
# br0:eth0:192.168.1.16/28
|
|
# eth4:192.168.1.44-192.168.1.49
|
|
# eth2:+Admin
|
|
#
|
|
# OPTIONS - A comma-separated list of options. Currently-defined
|
|
# options are:
|
|
#
|
|
# maclist - Connection requests from these hosts
|
|
# are compared against the contents of
|
|
# /etc/shorewall/maclist. If this option
|
|
# is specified, the interface must be
|
|
# an ethernet NIC and must be up before
|
|
# Shorewall is started.
|
|
#
|
|
# routeback - Shorewall should set up the infrastructure
|
|
# to pass packets from this/these
|
|
# address(es) back to themselves. This is
|
|
# necessary if hosts in this group use the
|
|
# services of a transparent proxy that is
|
|
# a member of the group or if DNAT is used
|
|
# to send requests originating from this
|
|
# group to a server in the group.
|
|
#
|
|
# norfc1918 - This option only makes sense for ports
|
|
# on a bridge.
|
|
#
|
|
# The port should not accept
|
|
# any packets whose source is in one
|
|
# of the ranges reserved by RFC 1918
|
|
# (i.e., private or "non-routable"
|
|
# addresses. If packet mangling or
|
|
# connection-tracking match is enabled in
|
|
# your kernel, packets whose destination
|
|
# addresses are reserved by RFC 1918 are
|
|
# also rejected.
|
|
#
|
|
# nobogons - This option only makes sense for ports
|
|
# on a bridge.
|
|
#
|
|
# This port should not accept
|
|
# any packets whose source is in one
|
|
# of the ranges reserved by IANA (this
|
|
# option does not cover those ranges
|
|
# reserved by RFC 1918 -- see
|
|
# 'norfc1918' above).
|
|
#
|
|
# blacklist - This option only makes sense for ports
|
|
# on a bridge.
|
|
#
|
|
# Check packets arriving on this port
|
|
# against the /etc/shorewall/blacklist
|
|
# file.
|
|
#
|
|
# tcpflags - Packets arriving from these hosts are
|
|
# checked for certain illegal combinations
|
|
# of TCP flags. Packets found to have
|
|
# such a combination of flags are handled
|
|
# according to the setting of
|
|
# TCP_FLAGS_DISPOSITION after having been
|
|
# logged according to the setting of
|
|
# TCP_FLAGS_LOG_LEVEL.
|
|
#
|
|
# nosmurfs - This option only makes sense for ports
|
|
# on a bridge.
|
|
#
|
|
# Filter packets for smurfs
|
|
# (packets with a broadcast
|
|
# address as the source).
|
|
#
|
|
# Smurfs will be optionally logged based
|
|
# on the setting of SMURF_LOG_LEVEL in
|
|
# shorewall.conf. After logging, the
|
|
# packets are dropped.
|
|
#
|
|
# newnotsyn - TCP packets that don't have the SYN
|
|
# flag set and which are not part of an
|
|
# established connection will be accepted
|
|
# from these hosts, even if
|
|
# NEWNOTSYN=No has been specified in
|
|
# /etc/shorewall/shorewall.conf.
|
|
#
|
|
# This option has no effect if
|
|
# NEWNOTSYN=Yes.
|
|
#
|
|
# ipsec - The zone is accessed via a
|
|
# kernel 2.6 ipsec SA. Note that if the
|
|
# zone named in the ZONE column is
|
|
# specified as an IPSEC zone in the
|
|
# /etc/shorewall/ipsec file then you do NOT
|
|
# need to specify the 'ipsec' option here.
|
|
#
|
|
# For additional information, see http://shorewall.net/Documentation.htm#Hosts
|
|
#
|
|
#ZONE HOST(S) OPTIONS
|
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE
|