2002-09-16 19:02:45 +02:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2002-08-07 16:28:04 +02:00
< html >
< head >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
< title > Shorewall News< / title >
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
2002-08-07 16:28:04 +02:00
< / head >
2002-09-16 19:02:45 +02:00
< body >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< table border = "0" cellpadding = "0" cellspacing = "0"
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
id="AutoNumber1" bgcolor="#400169" height="90">
2003-05-29 16:48:09 +02:00
< tbody >
< tr >
< td
width="100%">
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< h1 align = "center" > < font color = "#ffffff" > Shorewall News Archive< / font > < / h1 >
2003-05-29 16:48:09 +02:00
< / td >
< / tr >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< / tbody >
2003-05-28 21:20:23 +02:00
2002-08-22 23:33:54 +02:00
< / table >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 5/29/2003 - Shorewall-1.4.4b< / b > < / p >
< p > Groan -- This version corrects a problem whereby the --log-level was not
being set when logging via syslog. The most commonly reported symptom was
that Shorewall messages were being written to the console even though console
logging was correctly configured per FAQ 16.< br >
< / p >
2003-05-28 21:20:23 +02:00
< p > < b > 5/27/2003 - Shorewall-1.4.4a< / b > < / p >
2003-05-29 16:48:09 +02:00
The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed out
that the code in 1.4.4 restricts the length of short zone names to 4 characters.
I've produced version 1.4.4a that restores the previous 5-character limit
by conditionally omitting the log rule number when the LOGFORMAT doesn't
2003-05-28 21:20:23 +02:00
contain '%d'. < br >
2003-05-29 16:48:09 +02:00
< p > < b > 5/23/2003 - Shorewall-1.4.4< / b > < / p >
I apologize for the rapid-fire releases but since there is a potential
configuration change required to go from 1.4.3a to 1.4.4, I decided to
make it a full release rather than just a bug-fix release. < br >
< br >
< b > <EFBFBD> <EFBFBD> <EFBFBD> Problems corrected:< / b > < br >
2003-05-28 21:20:23 +02:00
< blockquote > None.< br >
2003-05-29 16:48:09 +02:00
< / blockquote >
< b > <EFBFBD> <EFBFBD> <EFBFBD> New Features:< br >
< / b >
2003-05-28 21:20:23 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > A REDIRECT- rule target has been added. This target behaves for
REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter nat
2003-05-28 21:20:23 +02:00
table REDIRECT rule is added but not the companion filter table ACCEPT rule.< br >
2003-05-29 16:48:09 +02:00
< br >
< / li >
< li > The LOGMARKER variable has been renamed LOGFORMAT and has been
changed to a 'printf' formatting template which accepts three arguments
(the chain name, logging rule number and the disposition). To use LOGFORMAT
with fireparse (< a href = "http://www.fireparse.com" > http://www.fireparse.com< / a > ),
set it as:< br >
<20> < br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> LOGFORMAT="fp=%s:%d a=%s "< br >
<20> < br >
< b > CAUTION: < / b > /sbin/shorewall uses the leading part of the LOGFORMAT
string (up to but not including the first '%') to find log messages in
the 'show log', 'status' and 'hits' commands. This part should not be omitted
(the LOGFORMAT should not begin with "%") and the leading part should be
sufficiently unique for /sbin/shorewall to identify Shorewall messages.< br >
< br >
< / li >
< li > When logging is specified on a DNAT[-] or REDIRECT[-] rule, the
logging now takes place in the nat table rather than in the filter table.
This way, only those connections that actually undergo DNAT or redirection
2003-05-28 21:20:23 +02:00
will be logged.< br >
2003-05-29 16:48:09 +02:00
< / li >
2003-05-28 21:20:23 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-05-21 01:21:38 +02:00
< p > < b > 5/20/2003 - Shorewall-1.4.3a< / b > < b > < / b > < b > < / b > < br >
2003-05-29 16:48:09 +02:00
< / p >
This version primarily corrects the documentation included in the .tgz
and in the .rpm. In addition: < br >
2003-05-21 01:21:38 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > (This change is in 1.4.3 but is not documented) If you are running
iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject replies
2003-05-28 21:20:23 +02:00
as follows:< br >
2003-05-29 16:48:09 +02:00
<20> <> a) tcp - RST< br >
<20> <> b) udp - ICMP port unreachable< br >
<20> <> c) icmp - ICMP host unreachable< br >
<20> <> d) Otherwise - ICMP host prohibited< br >
If you are running earlier software, Shorewall will follow it's traditional
convention:< br >
<20> <> a) tcp - RST< br >
<20> <> b) Otherwise - ICMP port unreachable< / li >
< li > UDP port 135 is now silently dropped in the common.def chain.
Remember that this chain is traversed just before a DROP or REJECT policy
2003-05-28 21:20:23 +02:00
is enforced.< br >
2003-05-29 16:48:09 +02:00
< / li >
2003-05-21 01:21:38 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-05-18 20:38:34 +02:00
< p > < b > 5/18/2003 - Shorewall 1.4.3< / b > < b > < / b > < br >
2003-05-29 16:48:09 +02:00
< / p >
<20> <> <EFBFBD> < b > Problems Corrected:< br >
< / b >
2003-05-18 20:38:34 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > There were several cases where Shorewall would fail to remove
a temporary directory from /tmp. These cases have been corrected.< / li >
< li > The rules for allowing all traffic via the loopback interface
have been moved to before the rule that drops status=INVALID packets.
This insures that all loopback traffic is allowed even if Netfilter connection
tracking is confused.< / li >
2003-05-18 20:38:34 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
<20> <> <EFBFBD> < b > New Features:< br >
< / b >
2003-05-18 20:38:34 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > <EFBFBD> IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels
file.< / li >
< li value = "2" > You may now change the leading portion of the --log-prefix
used by Shorewall using the LOGMARKER variable in shorewall.conf. By default,
"Shorewall:" is used.< br >
< / li >
2003-05-18 20:38:34 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-05-18 20:38:34 +02:00
< p > < b > 5/10/2003 - Shorewall Mirror in Asia< br >
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-05-18 20:38:34 +02:00
< p > Ed Greshko has established a mirror in Taiwan -- Thanks Ed!< br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
< p > < b > 5/8/2003 - Shorewall Mirror in Chile< / b > < / p >
2003-05-29 16:48:09 +02:00
Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago
Chile.
2003-05-18 20:38:34 +02:00
< p > < b > 4/21/2003 - Samples updated for Shorewall version 1.4.2< / b > < / p >
2003-05-29 16:48:09 +02:00
< p > Thanks to Francesca Smith, the sample configurations are now upgraded
to Shorewall version 1.4.2.< / p >
2003-05-18 20:38:34 +02:00
< p > < b > 4/9/2003 - Shorewall 1.4.2< / b > < br >
2003-05-29 16:48:09 +02:00
< / p >
2003-04-13 17:28:32 +02:00
< p > < b > <EFBFBD> <EFBFBD> <EFBFBD> Problems Corrected:< / b > < / p >
2003-05-29 16:48:09 +02:00
< blockquote >
2003-04-13 17:28:32 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > TCP connection requests rejected out of the < b > common< / b >
chain are now properly rejected with TCP RST; previously, some of these
2003-05-28 21:20:23 +02:00
requests were rejected with an ICMP port-unreachable response.< / li >
2003-05-29 16:48:09 +02:00
< li > 'traceroute -I' from behind the firewall previously timed
2003-05-28 21:20:23 +02:00
out on the first hop (e.g., to the firewall). This has been worked around.< / li >
2003-05-29 16:48:09 +02:00
2003-04-13 17:28:32 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
< / blockquote >
2003-04-13 17:28:32 +02:00
< p > < b > <EFBFBD> <EFBFBD> <EFBFBD> New Features:< / b > < / p >
2003-05-29 16:48:09 +02:00
2003-05-18 20:38:34 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > Where an entry in the/etc/shorewall/hosts file specifies
a particular host or network, Shorewall now creates an intermediate
chain for handling input from the related zone. This can substantially
reduce the number of rules traversed by connections requests from such
zones.< br >
< br >
< / li >
< li > Any file may include an INCLUDE directive. An INCLUDE directive
consists of the word INCLUDE followed by a file name and causes the contents
of the named file to be logically included into the file containing the
INCLUDE. File names given in an INCLUDE directive are assumed to reside
in /etc/shorewall or in an alternate configuration directory if one
has been specified for the command. < br >
<20> < br >
<20> <> Examples:< br >
<20> <> shorewall/params.mgmt:< br >
<20> <> MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3< br >
<20> <> TIME_SERVERS=4.4.4.4< br >
<20> <> BACKUP_SERVERS=5.5.5.5< br >
<20> <> ----- end params.mgmt -----< br >
<20> < br >
<20> < br >
<20> <> shorewall/params:< br >
<20> <> # Shorewall 1.3 /etc/shorewall/params< br >
<20> <> [..]< br >
<20> <> #######################################< br >
<20> < br >
<20> <20> INCLUDE params.mgmt<6D> <74> <EFBFBD> < br >
<20> < br >
<20> <> # params unique to this host here< br >
<20> <> #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE< br >
<20> <> ----- end params -----< br >
<20> < br >
<20> < br >
<20> <> shorewall/rules.mgmt:< br >
<20> <> ACCEPT net:$MGMT_SERVERS<52> <53> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> $FW<46> <57> <EFBFBD> tcp<63> <70> <EFBFBD> 22< br >
<20> <> ACCEPT $FW<46> <57> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> net:$TIME_SERVERS<52> <53> <EFBFBD> udp<64> <70> <EFBFBD> 123< br >
<20> <> ACCEPT $FW<46> <57> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> net:$BACKUP_SERVERS<52> tcp<63> <70> <EFBFBD> 22< br >
<20> <> ----- end rules.mgmt -----< br >
<20> < br >
<20> <> shorewall/rules:< br >
<20> <> # Shorewall version 1.3 - Rules File< br >
<20> <> [..]< br >
<20> <> #######################################< br >
<20> < br >
<20> <> INCLUDE rules.mgmt<6D> <74> <EFBFBD> <EFBFBD> < br >
<20> < br >
<20> <> # rules unique to this host here< br >
<20> <> #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
2003-05-28 21:20:23 +02:00
REMOVE< br >
2003-05-29 16:48:09 +02:00
<20> <> ----- end rules -----< br >
<20> < br >
INCLUDE's may be nested to a level of 3 -- further nested INCLUDE
2003-05-28 21:20:23 +02:00
directives are ignored with a warning message.< br >
2003-05-29 16:48:09 +02:00
< br >
< / li >
< li > Routing traffic from an interface back out that interface
continues to be a problem. While I firmly believe that this should never
happen, people continue to want to do it. To limit the damage that such
nonsense produces, I have added a new 'routeback' option in /etc/shorewall/interfaces
and /etc/shorewall/hosts. When used in /etc/shorewall/interfaces, the
'ZONE' column may not contain '-'; in other words, 'routeback' can't
be used as an option for a multi-zone interface. The 'routeback' option
CAN be specified however on individual group entries in /etc/shorewall/hosts.< br >
<20> < br >
The 'routeback' option is similar to the old 'multi' option
2003-05-28 21:20:23 +02:00
with two exceptions:< br >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> a) The option pertains to a particular zone,interface,address
tuple.< br >
<20> < br >
<20> <> b) The option only created infrastructure to pass traffic
from (zone,interface,address) tuples back to themselves (the 'multi'
option affected all (zone,interface,address) tuples associated with
the given 'interface').< br >
<20> < br >
See the '< a href = "upgrade_issues.htm" > Upgrade Issues< / a > '
for information about how this new option may affect your configuration.< br >
< / li >
2003-05-18 20:38:34 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-05-18 20:38:34 +02:00
< p > < b > 3/24/2003 - Shorewall 1.4.1< / b > < b > < / b > < / p >
2003-05-29 16:48:09 +02:00
< b > < / b >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This release follows up on 1.4.0. It corrects a problem introduced in 1.4.0
and removes additional warts.< br >
< br >
< b > Problems Corrected:< / b > < br >
< / p >
2003-03-23 19:47:54 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > When Shorewall 1.4.0 is run under the ash shell (such
as on Bering/LEAF), it can attempt to add ECN disabling rules even
if the /etc/shorewall/ecn file is empty. That problem has been corrected
2003-05-28 21:20:23 +02:00
so that ECN disabling rules are only added if there are entries in /etc/shorewall/ecn.< / li >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< / ol >
2003-05-29 16:48:09 +02:00
< b > New Features:< / b > < br >
< blockquote > Note: In the list that follows, the term < i > group < / i > refers
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
a host address) accessed through a particular interface. Examples:< br >
2003-03-23 19:47:54 +01:00
< blockquote > eth0:0.0.0.0/0< br >
2003-05-29 16:48:09 +02:00
eth2:192.168.1.0/24< br >
eth3:192.0.2.123< br >
< / blockquote >
You can use the "shorewall check" command to see the groups
2003-05-28 21:20:23 +02:00
associated with each of your zones.< br >
2003-05-29 16:48:09 +02:00
< / blockquote >
2003-03-23 19:47:54 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > Beginning with Shorewall 1.4.1, if a zone Z comprises
more than one group< i > < / i > then if there is no explicit Z to Z policy
and there are no rules governing traffic from Z to Z then Shorewall will
permit all traffic between the groups in the zone.< / li >
< li > Beginning with Shorewall 1.4.1, Shorewall will never create
rules to handle traffic from a group to itself.< / li >
< li > A NONE policy is introduced in 1.4.1. When a policy of
2003-05-28 21:20:23 +02:00
NONE is specified from Z1 to Z2:< / li >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< ul >
2003-05-29 16:48:09 +02:00
< li > There may be no rules created that govern connections
from Z1 to Z2.< / li >
< li > Shorewall will not create any infrastructure to handle
2003-05-28 21:20:23 +02:00
traffic from Z1 to Z2.< / li >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< / ul >
2003-05-29 16:48:09 +02:00
See the < a href = "upgrade_issues.htm" > upgrade issues< / a > for
a discussion of how these changes may affect your configuration.
2003-03-18 16:16:33 +01:00
< p > < b > 3/17/2003 - Shorewall 1.4.0< / b > < b > < / b > < / p >
2003-05-29 16:48:09 +02:00
Shorewall
1.4 represents the next step in the evolution of Shorewall. The
main thrust of the initial release is simply to remove the cruft that
has accumulated in Shorewall over time. < br >
< br >
< b > IMPORTANT: Shorewall 1.4.0 requires< / b > < b > the iproute
package ('ip' utility).< / b > < br >
< br >
Function from 1.3 that has been omitted from this
version include:< br >
2003-03-08 16:48:57 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > The MERGE_HOSTS variable in shorewall.conf
is no longer supported. Shorewall 1.4 behavior is the same as 1.3 with
MERGE_HOSTS=Yes.< br >
< br >
< / li >
< li > Interface names of the form < device> :< integer>
in /etc/shorewall/interfaces now generate an error.< br >
< br >
< / li >
< li > Shorewall 1.4 implements behavior consistent
with OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate
an error at startup as will specification of the 'noping' or 'filterping'
2003-05-28 21:20:23 +02:00
interface options.< br >
2003-05-29 16:48:09 +02:00
< br >
< / li >
< li > The 'routestopped' option in the /etc/shorewall/interfaces
and /etc/shorewall/hosts files is no longer supported and will
generate an error at startup if specified.< br >
< br >
< / li >
< li > The Shorewall 1.2 syntax for DNAT and REDIRECT
rules is no longer accepted.< br >
< br >
< / li >
< li > The ALLOWRELATED variable in shorewall.conf is
no longer supported. Shorewall 1.4 behavior is the same as 1.3
with ALLOWRELATED=Yes.< br >
< br >
< / li >
< li > The icmp.def file has been removed.< br >
< / li >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< / ol >
Changes for 1.4 include:< br >
2003-05-28 21:20:23 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > The /etc/shorewall/shorewall.conf file has been
2003-05-28 21:20:23 +02:00
completely reorganized into logical sections.< br >
2003-05-29 16:48:09 +02:00
< br >
< / li >
< li > LOG is now a valid action for a rule (/etc/shorewall/rules).< br >
< br >
< / li >
< li > The firewall script and version file are now
installed in /usr/share/shorewall.< br >
< br >
< / li >
< li > Late arriving DNS replies are now silently dropped
in the common chain by default.< br >
< br >
< / li >
< li > In addition to behaving like OLD_PING_HANDLING=No,
Shorewall 1.4 no longer unconditionally accepts outbound ICMP
packets. So if you want to 'ping' from the firewall, you will need
the appropriate rule or policy.< br >
< br >
< / li >
< li > CONTINUE is now a valid action for a rule (/etc/shorewall/rules).< br >
< br >
< / li >
< li > 802.11b devices with names of the form wlan< n>
now support the 'maclist' option.< br >
< br >
< / li >
< li > Explicit Congestion Notification (ECN - RFC 3168) may
now be turned off on a host or network basis using the new /etc/shorewall/ecn
file. To use this facility:< br >
< br >
<20> <> a) You must be running kernel 2.4.20< br >
<20> <> b) You must have applied the patch in< br >
<20> <> http://www.shorewall/net/pub/shorewall/ecn/patch.< br >
<20> <> c) You must have iptables 1.2.7a installed.< br >
< br >
< / li >
< li > The /etc/shorewall/params file is now processed first
so that variables may be used in the /etc/shorewall/shorewall.conf file.< br >
2003-05-21 01:21:38 +02:00
< br >
< / li >
2003-05-29 16:48:09 +02:00
< li value = "10" > Shorewall now gives a more helpful diagnostic
when the 'ipchains' compatibility kernel module is loaded and a 'shorewall
start' command is issued.< br >
< br >
< / li >
< li > The SHARED_DIR variable has been removed from shorewall.conf.
This variable was for use by package maintainers and was not documented
for general use.< br >
< br >
< / li >
< li > Shorewall now ignores 'default' routes when detecting
masq'd networks.< / li >
2003-03-08 16:48:57 +01:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< p > < b > 3/10/2003 - Shoreall 1.3.14a< / b > < / p >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< p > A roleup of the following bug fixes and other updates:< / p >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< ul >
2003-05-29 16:48:09 +02:00
< li > There is an updated rfc1918 file that reflects the resent
2003-05-28 21:20:23 +02:00
allocation of 222.0.0.0/8 and 223.0.0.0/8.< / li >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< / ul >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The documentation for the routestopped file claimed that
a comma-separated list could appear in the second column while
the code only supported a single host or network address.< / li >
< li > Log messages produced by 'logunclean' and 'dropunclean'
2003-05-28 21:20:23 +02:00
were not rate-limited.< / li >
2003-05-29 16:48:09 +02:00
< li > 802.11b devices with names of the form < i > wlan< / i > < n>
2003-05-28 21:20:23 +02:00
don't support the 'maclist' interface option.< / li >
2003-05-29 16:48:09 +02:00
< li > Log messages generated by RFC 1918 filtering are not
rate limited.< / li >
< li > The firewall fails to start in the case where you have
"eth0 eth1" in /etc/shorewall/masq and the default route is through
eth1< / li >
2003-03-23 19:47:54 +01:00
< / ul >
2003-05-29 16:48:09 +02:00
2003-02-14 22:27:03 +01:00
< p > < b > 2/8/2003 - Shoreawall 1.3.14< / b > < / p >
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< p > New features include< / p >
2003-05-29 16:48:09 +02:00
2003-01-14 21:32:45 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > An OLD_PING_HANDLING option has been added
to shorewall.conf. When set to Yes, Shorewall ping handling
is as it has always been (see http://www.shorewall.net/ping.html).< br >
< br >
When OLD_PING_HANDLING=No, icmp echo (ping)
is handled via rules and policies just like any other connection
request. The FORWARDPING=Yes option in shorewall.conf and the
'noping' and 'filterping' options in /etc/shorewall/interfaces will
all generate an error.< br >
< br >
< / li >
< li > It is now possible to direct Shorewall to
create a "label" such as<61> "eth0:0" for IP addresses that it creates
under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done
by specifying the label instead of just the interface name:< br >
<20> < br >
<20> <> a) In the INTERFACE column of /etc/shorewall/masq< br >
<20> <> b) In the INTERFACE column of /etc/shorewall/nat< br >
<20> < / li >
< li > Support for OpenVPN Tunnels.< br >
< br >
< / li >
< li > Support for VLAN devices with names of the
form $DEV.$VID (e.g., eth0.0)< br >
< br >
< / li >
< li > In /etc/shorewall/tcrules, the MARK value may
be optionally followed by ":" and either 'F' or 'P' to designate
that the marking will occur in the FORWARD or PREROUTING chains respectively.
If this additional specification is omitted, the chain used to mark
packets will be determined by the setting of the MARK_IN_FORWARD_CHAIN
option in < a href = "Documentation.htm#Conf" > shorewall.conf< / a > .< br >
< br >
< / li >
< li > When an interface name is entered in the
SUBNET column of the /etc/shorewall/masq file, Shorewall previously
masqueraded traffic from only the first subnet defined on that
2003-05-28 21:20:23 +02:00
interface. It did not masquerade traffic from:< br >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> a) The subnets associated with other addresses
on the interface.< br >
<20> <> b) Subnets accessed through local routers.< br >
<20> < br >
Beginning with Shorewall 1.3.14, if you enter
an interface name in the SUBNET column, shorewall will use
the firewall's routing table to construct the masquerading/SNAT
rules.< br >
<20> < br >
Example 1 -- This is how it works in 1.3.14.< br >
<20> <> < br >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > < / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> [root@gateway test]# shorewall start< br > ...< br > Masqueraded Subnets and Hosts:< br > To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176< br > To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176< br > Processing /etc/shorewall/tos...< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
When upgrading to Shorewall 1.3.14, if you
have multiple local subnets connected to an interface that is
specified in the SUBNET column of an /etc/shorewall/masq entry,
your /etc/shorewall/masq file will need changing. In most cases,
you will simply be able to remove redundant entries. In some cases
though, you might want to change from using the interface name to listing
specific subnetworks if the change described above will cause masquerading
2003-05-28 21:20:23 +02:00
to occur on subnetworks that you don't wish to masquerade.< br >
2003-05-29 16:48:09 +02:00
<20> < br >
Example 2 -- Suppose that your current config
is as follows:< br >
<20> <> < br >
2003-05-21 01:21:38 +02:00
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.10.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > [root@gateway test]#< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> In this case, the second entry in /etc/shorewall/masq
2003-05-28 21:20:23 +02:00
is no longer required.< br >
2003-05-29 16:48:09 +02:00
<20> < br >
Example 3 -- What if your current configuration
is like this?< br >
<20> < br >
2003-05-21 01:21:38 +02:00
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > [root@gateway test]#< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> In this case, you would want to change
the entry in<69> /etc/shorewall/masq to:< br >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.1.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-29 16:48:09 +02:00
< / li >
2003-01-14 21:32:45 +01:00
< / ol >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< p > < br >
< b > 2/5/2003 - Shorewall Support included in Webmin
1.060< / b > < / p >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< p > Webmin version 1.060 now has Shorewall support included as standard. See
< a href = "http://www.webmin.com" > http://www.webmin.com< / a > .< br >
< b > < br >
2/4/2003 - Shorewall 1.3.14-RC1< / b > < / p >
2003-02-08 21:48:47 +01:00
< p > Includes the Beta 2 content plus support for OpenVPN tunnels.< / p >
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< p > < b > 1/28/2003 - Shorewall 1.3.14-Beta2< / b > < / p >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< p > Includes the Beta 1 content plus restores VLAN device names of the form
$dev.$vid (e.g., eth0.1)< / p >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 1/25/2003 - Shorewall 1.3.14-Beta1< / b > < br >
< / p >
< p > The Beta includes the following changes:< br >
< / p >
2003-02-08 21:48:47 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > An OLD_PING_HANDLING option has been
added to shorewall.conf. When set to Yes, Shorewall ping handling
2003-05-28 21:20:23 +02:00
is as it has always been (see http://www.shorewall.net/ping.html).< br >
2003-05-29 16:48:09 +02:00
< br >
When OLD_PING_HANDLING=No, icmp echo (ping)
is handled via rules and policies just like any other connection
request. The FORWARDPING=Yes option in shorewall.conf and the
'noping' and 'filterping' options in /etc/shorewall/interfaces will
all generate an error.< br >
< br >
< / li >
< li > It is now possible to direct Shorewall
to create a "label" such as<61> "eth0:0" for IP addresses that it
creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This
is done by specifying the label instead of just the interface name:< br >
<20> < br >
<20> <> a) In the INTERFACE column of /etc/shorewall/masq< br >
<20> <> b) In the INTERFACE column of /etc/shorewall/nat< br >
<20> < / li >
< li > When an interface name is entered in
the SUBNET column of the /etc/shorewall/masq file, Shorewall
previously masqueraded traffic from only the first subnet defined
2003-05-28 21:20:23 +02:00
on that interface. It did not masquerade traffic from:< br >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> a) The subnets associated with other addresses
on the interface.< br >
<20> <> b) Subnets accessed through local routers.< br >
<20> < br >
Beginning with Shorewall 1.3.14, if you enter
an interface name in the SUBNET column, shorewall will use
the firewall's routing table to construct the masquerading/SNAT
rules.< br >
<20> < br >
Example 1 -- This is how it works in 1.3.14.< br >
<20> <> < br >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > < / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> [root@gateway test]# shorewall start< br > ...< br > Masqueraded Subnets and Hosts:< br > To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176< br > To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176< br > Processing /etc/shorewall/tos...< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
When upgrading to Shorewall 1.3.14, if you
have multiple local subnets connected to an interface that is
specified in the SUBNET column of an /etc/shorewall/masq entry,
your /etc/shorewall/masq file will need changing. In most cases,
you will simply be able to remove redundant entries. In some cases
though, you might want to change from using the interface name to listing
specific subnetworks if the change described above will cause masquerading
2003-05-28 21:20:23 +02:00
to occur on subnetworks that you don't wish to masquerade.< br >
2003-05-29 16:48:09 +02:00
<20> < br >
Example 2 -- Suppose that your current config
is as follows:< br >
<20> <> < br >
2003-05-21 01:21:38 +02:00
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.10.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > [root@gateway test]#< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> In this case, the second entry in /etc/shorewall/masq
2003-05-28 21:20:23 +02:00
is no longer required.< br >
2003-05-29 16:48:09 +02:00
<20> < br >
Example 3 -- What if your current configuration
is like this?< br >
<20> < br >
2003-05-21 01:21:38 +02:00
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > [root@gateway test]#< / pre >
2003-05-29 16:48:09 +02:00
<20> < br >
<20> <> In this case, you would want to change
the entry in<69> /etc/shorewall/masq to:< br >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< pre > <EFBFBD> <EFBFBD> #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.1.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-29 16:48:09 +02:00
< b > < / b > < / li >
2003-02-08 21:48:47 +01:00
< / ol >
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< p > < b > 1/18/2003 - Shorewall 1.3.13 Documentation in PDF Format< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation.
2003-05-28 21:20:23 +02:00
the PDF may be downloaded from< / p >
2003-05-29 16:48:09 +02:00
<20> <> <EFBFBD> < a
2003-02-08 21:48:47 +01:00
href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/< / a > < br >
2003-05-29 16:48:09 +02:00
<20> <> <EFBFBD> < a
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/< / a >
2003-02-08 21:48:47 +01:00
< p > < b > 1/17/2003 - shorewall.net has MOVED< / b > < b > <EFBFBD> < / b > < / p >
2003-05-29 16:48:09 +02:00
2003-02-08 21:48:47 +01:00
< p > Thanks to the generosity of Alex Martin and < a
2003-05-29 16:48:09 +02:00
href="http://www.rettc.com">Rett Consulting< / a > , www.shorewall.net and
ftp.shorewall.net are now hosted on a system in Bellevue, Washington. A
big thanks to Alex for making this happen.< br >
< / p >
2003-02-08 21:48:47 +01:00
< p > < b > 1/13/2003 - Shorewall 1.3.13< br >
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-02-08 21:48:47 +01:00
< p > Just includes a few things that I had on the burner:< br >
2003-05-29 16:48:09 +02:00
< / p >
2003-02-08 21:48:47 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > A new 'DNAT-' action has been added
for entries in the /etc/shorewall/rules file. DNAT- is intended
for advanced users who wish to minimize the number of rules
that connection requests must traverse.< br >
< br >
A Shorewall DNAT rule actually generates
two iptables rules: a header rewriting rule in the 'nat' table
and an ACCEPT rule in the 'filter' table. A DNAT- rule only
generates the first of these rules. This is handy when you have
2003-05-28 21:20:23 +02:00
several DNAT rules that would generate the same ACCEPT rule.< br >
2003-05-29 16:48:09 +02:00
< br >
<20> <> Here are three rules from my previous
2003-05-28 21:20:23 +02:00
rules file:< br >
2003-05-29 16:48:09 +02:00
< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> DNAT<41> <54> net<65> dmz:206.124.146.177
tcp smtp - 206.124.146.178< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> DNAT<41> <54> net<65> dmz:206.124.146.177
tcp smtp - 206.124.146.179< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ACCEPT net<65> dmz:206.124.146.177
tcp www,smtp,ftp,...< br >
< br >
<20> <> These three rules ended up generating
2003-05-28 21:20:23 +02:00
_three_ copies of< br >
2003-05-29 16:48:09 +02:00
< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ACCEPT net<65> dmz:206.124.146.177
2003-05-28 21:20:23 +02:00
tcp smtp< br >
2003-05-29 16:48:09 +02:00
< br >
<20> <> By writing the rules this way, I end
up with only one copy of the ACCEPT rule.< br >
< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> DNAT-<2D> net<65> dmz:206.124.146.177
tcp smtp -<2D> 206.124.146.178< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> DNAT-<2D> net<65> dmz:206.124.146.177
tcp smtp -<2D> 206.124.146.179< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ACCEPT net<65> dmz:206.124.146.177
tcp www,smtp,ftp,....< br >
< br >
< / li >
< li > The 'shorewall check' command now
prints out the applicable policy between each pair of zones.< br >
< br >
< / li >
< li > A new CLEAR_TC option has been added
to shorewall.conf. If this option is set to 'No' then Shorewall
won't clear the current traffic control rules during [re]start.
This setting is intended for use by people that prefer to configure
traffic shaping when the network interfaces come up rather than
when the firewall is started. If that is what you want to do, set
TC_ENABLED=Yes and CLEAR_TC=No and do not supply an /etc/shorewall/tcstart
file. That way, your traffic shaping rules can still use the 'fwmark'
classifier based on packet marking defined in /etc/shorewall/tcrules.< br >
< br >
< / li >
< li > A new SHARED_DIR variable has been
added that allows distribution packagers to easily move the
shared directory (default /usr/lib/shorewall). Users should
2003-05-28 21:20:23 +02:00
never have a need to change the value of this shorewall.conf setting.< br >
2003-05-29 16:48:09 +02:00
< / li >
2003-02-08 21:48:47 +01:00
< / ol >
2003-05-29 16:48:09 +02:00
< p > < b > 1/6/2003 - < big > < big > < big > BURNOUT< / big > < / big > < / big > < / b > < b >
< / b > < / p >
< p > < b > Until further notice, I will not be involved in either Shorewall Development
or Shorewall Support< / b > < / p >
2003-01-14 21:32:45 +01:00
< p > < b > -Tom Eastep< / b > < br >
2003-05-29 16:48:09 +02:00
< / p >
2003-01-14 21:32:45 +01:00
< p > < b > 12/30/2002 - Shorewall Documentation in PDF Format< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation.
2003-05-28 21:20:23 +02:00
the PDF may be downloaded from< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-01-14 21:32:45 +01:00
< p > <EFBFBD> <EFBFBD> <EFBFBD> < a href = "ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/< / a > < br >
2003-05-29 16:48:09 +02:00
<20> <> <EFBFBD> < a
2003-01-14 21:32:45 +01:00
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/< / a > < br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > < b > 12/27/2002 - Shorewall 1.3.12 Released< / b > < / p >
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > Features include:< br >
2003-05-29 16:48:09 +02:00
< / p >
2002-12-28 16:38:03 +01:00
< ol >
2003-05-29 16:48:09 +02:00
< li > "shorewall refresh" now reloads
2003-05-28 21:20:23 +02:00
the traffic shaping rules (tcrules and tcstart).< / li >
2003-05-29 16:48:09 +02:00
< li > "shorewall debug [re]start" now
turns off debugging after an error occurs. This places
the point of the failure near the end of the trace rather than
up in the middle of it.< / li >
< li > "shorewall [re]start" has been
speeded up by more than 40% with my configuration. Your
milage may vary.< / li >
< li > A "shorewall show classifiers"
command has been added which shows the current packet
classification filters. The output from this command is
also added as a separate page in "shorewall monitor"< / li >
< li > ULOG (must be all caps) is now
accepted as a valid syslog level and causes the subject
packets to be logged using the ULOG target rather than the
LOG target. This allows you to run ulogd (available from < a
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd< / a > )
2003-05-28 21:20:23 +02:00
and log all Shorewall messages < a
2003-02-14 22:27:03 +01:00
href="shorewall_logging.html">to a separate log file< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > If you are running a kernel that
has a FORWARD chain in the mangle table ("shorewall show
mangle" will show you the chains in the mangle table),
you can set MARK_IN_FORWARD_CHAIN=Yes in < a
href="Documentation.htm#Conf">shorewall.conf< / a > . This allows for
marking input packets based on their destination even when
you are using Masquerading or SNAT.< / li >
< li > I have cluttered up the /etc/shorewall
directory with empty 'init', 'start', 'stop' and 'stopped'
files. If you already have a file with one of these names,
don't worry -- the upgrade process won't overwrite your file.< / li >
< li > I have added a new RFC1918_LOG_LEVEL
variable to < a href = "Documentation.htm#Conf" > shorewall.conf< / a > .
This variable specifies the syslog level at which packets
are logged as a result of entries in the /etc/shorewall/rfc1918
file. Previously, these packets were always logged at the 'info'
level.< br >
< / li >
2002-12-28 16:38:03 +01:00
< / ol >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 12/20/2002 - Shorewall 1.3.12 Beta 3< br >
< / b > < / p >
This version corrects a problem with
Blacklist logging. In Beta 2, if BLACKLIST_LOG_LEVEL was set
to anything but ULOG, the firewall would fail to start and "shorewall
refresh" would also fail.< br >
2003-05-28 21:20:23 +02:00
< p > < b > 12/20/2002 - Shorewall 1.3.12 Beta 2< / b > < / p >
2003-05-29 16:48:09 +02:00
< p > The first public Beta version of Shorewall 1.3.12 is now available (Beta
1 was made available only to a limited audience).< br >
< / p >
Features include:< br >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2003-05-28 21:20:23 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > "shorewall refresh" now
reloads the traffic shaping rules (tcrules and tcstart).< / li >
< li > "shorewall debug [re]start"
now turns off debugging after an error occurs. This
places the point of the failure near the end of the trace rather
than up in the middle of it.< / li >
< li > "shorewall [re]start" has
been speeded up by more than 40% with my configuration.
Your milage may vary.< / li >
< li > A "shorewall show classifiers"
command has been added which shows the current packet
classification filters. The output from this command is also
2003-05-28 21:20:23 +02:00
added as a separate page in "shorewall monitor"< / li >
2003-05-29 16:48:09 +02:00
< li > ULOG (must be all caps)
is now accepted as a valid syslog level and causes the
subject packets to be logged using the ULOG target rather than
the LOG target. This allows you to run ulogd (available from
< a href = "http://www.gnumonks.org/projects/ulogd" > http://www.gnumonks.org/projects/ulogd< / a > )
2003-05-28 21:20:23 +02:00
and log all Shorewall messages < a
href="shorewall_logging.html">to a separate log file< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > If you are running a kernel
that has a FORWARD chain in the mangle table ("shorewall
show mangle" will show you the chains in the mangle table),
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This
allows for marking input packets based on their destination even
when you are using Masquerading or SNAT.< / li >
< li > I have cluttered up the
/etc/shorewall directory with empty 'init', 'start',
'stop' and 'stopped' files. If you already have a file with
one of these names, don't worry -- the upgrade process won't overwrite
your file.< / li >
2003-05-28 21:20:23 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
You may download the Beta from:< br >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< blockquote > < a href = "http://www.shorewall.net/pub/shorewall/Beta" > http://www.shorewall.net/pub/shorewall/Beta< / a > < br >
2003-05-29 16:48:09 +02:00
< a
2003-02-14 22:27:03 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/Beta" target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta< / a > < br >
2003-05-29 16:48:09 +02:00
< / blockquote >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > < b > 12/12/2002 - Mandrake Multi Network Firewall < a
href="http://www.mandrakesoft.com">< img src = "images/logo2.png"
alt="Powered by Mandrake Linux" width="140" height="21" border="0">
2003-05-29 16:48:09 +02:00
< / a > < / b > < / p >
Shorewall is at the center
of MandrakeSoft's recently-announced < a
href="http://www.mandrakestore.com/mdkinc/index.php?PAGE=tab_0/menu_0.php& id_art=250& LANG_=en#GOTO_250">Multi
Network Firewall (MNF)< / a > product. Here is the < a
href="http://www.mandrakesoft.com/company/press/pr?n=/pr/products/2403">press
2003-05-28 21:20:23 +02:00
release< / a > .< br >
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > < b > 12/7/2002 - Shorewall Support for Mandrake 9.0< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered.
I have installed 9.0 on one of my systems and I am
now in a position to support Shorewall users who run Mandrake
2003-05-28 21:20:23 +02:00
9.0.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > < b > 12/6/2002 - Debian 1.3.11a Packages Available< br >
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > Apt-get sources listed at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< p > < b > 12/3/2002 - Shorewall 1.3.11a< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This is a bug-fix roll up which includes Roger Aich's fix for DNAT with
excluded subnets (e.g., "DNAT foo!bar ..."). Current
1.3.11 users who don't need rules of this type need not
2003-05-28 21:20:23 +02:00
upgrade to 1.3.11.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-24 21:12:22 +01:00
< p > < b > 11/24/2002 - Shorewall 1.3.11< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-24 21:12:22 +01:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-24 21:12:22 +01:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A 'tcpflags' option
2003-05-28 21:20:23 +02:00
has been added to entries in < a
2003-05-29 16:48:09 +02:00
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces< / a > .
This option causes Shorewall to make a set of sanity check on TCP
packet header flags.< / li >
< li > It is now allowed
2003-05-28 21:20:23 +02:00
to use 'all' in the SOURCE or DEST column in a < a
2003-05-29 16:48:09 +02:00
href="Documentation.htm#Rules">rule< / a > . When used, 'all' must appear
by itself (in may not be qualified) and it does not enable intra-zone
traffic. For example, the rule < br >
< br >
<20> <20> ACCEPT loc all tcp
80< br >
< br >
does not enable http traffic
from 'loc' to 'loc'.< / li >
< li > Shorewall's use of
the 'echo' command is now compatible with bash clones
such as ash and dash.< / li >
< li > fw-> fw policies
now generate a startup error. fw-> fw rules generate
a warning and are ignored< / li >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< p > < b > 11/14/2002 - Shorewall Documentation in PDF Format< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation.
2003-05-28 21:20:23 +02:00
the PDF may be downloaded from< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-24 21:12:22 +01:00
< p > <EFBFBD> <EFBFBD> <EFBFBD> < a href = "ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/< / a > < br >
2003-05-29 16:48:09 +02:00
<20> <> <EFBFBD> < a
2002-12-28 16:38:03 +01:00
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/< / a > < br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 11/09/2002 - Shorewall is Back at SourceForge< / b > < b >
< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-24 21:12:22 +01:00
< p > The main Shorewall 1.3 web site is now back at SourceForge at < a
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net< / a > .< br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-09 19:10:22 +01:00
< p > < b > 11/09/2002 - Shorewall 1.3.10< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-09 19:10:22 +01:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< ul >
2003-05-28 21:20:23 +02:00
< li > You may now < a
2003-05-29 16:48:09 +02:00
href="IPSEC.htm#Dynamic">define the contents of a zone dynamically< / a >
2003-05-28 21:20:23 +02:00
with the < a href = "starting_and_stopping_shorewall.htm" > "shorewall
2003-05-29 16:48:09 +02:00
add" and "shorewall delete" commands< / a > . These commands
are expected to be used primarily within
< a href = "http://www.xs4all.nl/%7Efreeswan/" > FreeS/Wan< / a > updown
2003-05-28 21:20:23 +02:00
scripts.< / li >
< li > Shorewall can
2003-05-29 16:48:09 +02:00
now do< a href = "MAC_Validation.html" > MAC verification< / a > on
ethernet segments. You can specify the set of allowed MAC addresses
on the segment and you can optionally tie each MAC address to one
or more IP addresses.< / li >
2003-05-28 21:20:23 +02:00
< li > PPTP Servers and
Clients running on the firewall system may now be
defined in the< a href = "PPTP.htm" > /etc/shorewall/tunnels< / a > file.< / li >
< li > A new 'ipsecnat'
tunnel type is supported for use when the < a
2003-03-18 16:16:33 +01:00
href="IPSEC.htm">remote IPSEC endpoint is behind a NAT gateway< / a > .< / li >
2003-05-28 21:20:23 +02:00
< li > The PATH used
by Shorewall may now be specified in < a
2003-05-18 20:38:34 +02:00
href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.< / a > < / li >
2003-05-28 21:20:23 +02:00
< li > The main firewall
script is now /usr/lib/shorewall/firewall. The script
2003-05-29 16:48:09 +02:00
in /etc/init.d/shorewall is very small and uses /sbin/shorewall
to do the real work. This change makes custom distributions
such as for Debian and for Gentoo easier to manage since
it is /etc/init.d/shorewall that tends to have distribution-dependent
code< / li >
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2002-11-09 19:10:22 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 10/24/2002 - Shorewall is now in Gentoo Linux< / b > < b > < / b > < a
href="http://www.gentoo.org">< br >
< / a > < / p >
Alexandru Hartmann
reports that his Shorewall package is now a part of
< a href = "http://www.gentoo.org" > the Gentoo Linux distribution< / a > .
Thanks Alex!< br >
< p > < b > 10/23/2002 - Shorewall 1.3.10 Beta 1< / b > < b > < / b > < / p >
In this version:< br >
< ul >
< li > You may now < a
href="IPSEC.htm#Dynamic">define the contents of a zone dynamically< / a >
with the < a href = "starting_and_stopping_shorewall.htm" > "shorewall
add" and "shorewall delete" commands< / a > . These
commands are expected to be used primarily within
< a href = "http://www.xs4all.nl/%7Efreeswan/" > FreeS/Wan< / a >
updown scripts.< / li >
< li > Shorewall can
now do< a href = "MAC_Validation.html" > MAC verification< / a > on ethernet
segments. You can specify the set of allowed MAC addresses
on the segment and you can optionally tie each MAC address
to one or more IP addresses.< / li >
< li > PPTP Servers
and Clients running on the firewall system may now
be defined in the< a href = "PPTP.htm" > /etc/shorewall/tunnels< / a >
file.< / li >
< li > A new 'ipsecnat'
tunnel type is supported for use when the
< a href = "IPSEC.htm" > remote IPSEC endpoint is behind a NAT
gateway< / a > .< / li >
< li > The PATH used
by Shorewall may now be specified in < a
href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.< / a > < / li >
< li > The main firewall
script is now /usr/lib/shorewall/firewall. The script
in /etc/init.d/shorewall is very small and uses /sbin/shorewall
to do the real work. This change makes custom distributions
such as for Debian and for Gentoo easier to manage since
it is /etc/init.d/shorewall that tends to have distribution-dependent
code.< / li >
< / ul >
You may download
the Beta from:< br >
2002-11-09 19:10:22 +01:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
2002-12-28 16:38:03 +01:00
href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta< / a > < / li >
2003-05-29 16:48:09 +02:00
< li > < a
2002-12-28 16:38:03 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/Beta" target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta< / a > < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-09 19:10:22 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-28 16:38:03 +01:00
< p > < b > 10/10/2002 - <20> Debian 1.3.9b Packages Available< br >
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-11-09 19:10:22 +01:00
< p > Apt-get sources listed at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< p > < b > 10/9/2002 - Shorewall 1.3.9b< / b > < / p >
2003-05-29 16:48:09 +02:00
This release rolls
up fixes to the installer and to the firewall script.< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-03-23 19:47:54 +01:00
< p > < b > 10/6/2002 - Shorewall.net now running on RH8.0< br >
2003-05-29 16:48:09 +02:00
< / b > < br >
The firewall and
server here at shorewall.net are now running RedHat
release 8.0.< br >
< b > < br >
9/30/2002 - Shorewall
1.3.9a< / b > < / p >
Roles up the fix
for broken tunnels.< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< p > < b > 9/30/2002 - TUNNELS Broken in 1.3.9!!!< / b > < / p >
2003-05-29 16:48:09 +02:00
There is an updated
2003-05-28 21:20:23 +02:00
firewall script at < a
2003-02-25 20:26:18 +01:00
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
2003-05-29 16:48:09 +02:00
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall< / a >
-- copy that file to /usr/lib/shorewall/firewall.< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< p > < b > 9/28/2002 - Shorewall 1.3.9< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< p > In this version:< br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
href="configuration_file_basics.htm#dnsnames">DNS Names< / a > are
now allowed in Shorewall config files (although I recommend against
using them).< / li >
< li > The
connection SOURCE may now be qualified by both interface
and IP address in a < a href = "Documentation.htm#Rules" > Shorewall
2003-05-28 21:20:23 +02:00
rule< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > Shorewall
startup is now disabled after initial installation
until the file /etc/shorewall/startup_disabled is removed.
This avoids nasty surprises during reboot for users
who install Shorewall but don't configure it.< / li >
< li > The 'functions'
and 'version' files and the 'firewall' symbolic
link have been moved from /var/lib/shorewall to /usr/lib/shorewall
2003-05-28 21:20:23 +02:00
to appease the LFS police at Debian.< br >
2003-05-29 16:48:09 +02:00
< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored< / b > < br >
< / p >
< img
2003-02-08 21:48:47 +01:00
src="images/j0233056.gif" alt="Brown Paper Bag" width="50" height="86"
align="left">
2003-05-29 16:48:09 +02:00
A couple
of recent configuration changes at www.shorewall.net
broke the Search facility:< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< blockquote >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > Mailing
List Archive Search was not available.< / li >
< li > The
Site Search index was incomplete< / li >
< li > Only
2003-05-28 21:20:23 +02:00
one page of matches was presented.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
< / blockquote >
Hopefully
these problems are now corrected.
< p > < b > 9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
Restored< br >
< / b > < / p >
A couple
of recent configuration changes at www.shorewall.net
had the negative effect of breaking the Search facility:< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< ol >
2003-05-29 16:48:09 +02:00
< li > Mailing
2003-05-28 21:20:23 +02:00
List Archive Search was not available.< / li >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
Site Search index was incomplete< / li >
2003-05-29 16:48:09 +02:00
< li > Only
one page of matches was presented.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< / ol >
2003-05-29 16:48:09 +02:00
Hopefully
2003-05-28 21:20:23 +02:00
these problems are now corrected.< br >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< p > < b > 9/18/2002 - <20> Debian 1.3.8 Packages Available< br >
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-30 20:11:25 +02:00
< p > Apt-get sources listed at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-10-09 17:47:48 +02:00
< p > < b > 9/16/2002 - Shorewall 1.3.8< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< br >
2003-05-29 16:48:09 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
< a href = "Documentation.htm#Conf" > NEWNOTSYN< / a > option has
been added to shorewall.conf. This option determines whether Shorewall
accepts TCP packets which are not part of an established
connection and that are not 'SYN' packets (SYN flag
on and ACK flag off).< / li >
< li > The
need for the 'multi' option to communicate between
zones za and zb on the same interface is removed in
the case where the chain 'za2zb' and/or 'zb2za' exists.
'za2zb' will exist if:< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li >
2003-05-28 21:20:23 +02:00
There is a policy for za to zb; or < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< li > There is at least one rule for za to zb.< / li >
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
/etc/shorewall/blacklist file now contains three
columns. In addition to the SUBNET/ADDRESS column, there
are optional PROTOCOL and PORT columns to block only certain
applications from the blacklisted addresses.< br >
< / li >
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 9/11/2002 - Debian 1.3.7c Packages Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Apt-get sources listed at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 9/2/2002 - Shorewall 1.3.7c< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This is a role up of a fix for "DNAT" rules where the source zone is $FW
2003-05-28 21:20:23 +02:00
(fw).< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/31/2002 - I'm not available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > I'm currently on vacation<6F> -- please respect my need for a couple of
weeks free of Shorewall problem reports.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > -Tom< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/26/2002 - Shorewall 1.3.7b< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This is a role up of the "shorewall refresh" bug fix and the change which
reverses the order of "dhcp" and "norfc1918"
2003-05-28 21:20:23 +02:00
checking.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/26/2002 - French FTP Mirror is Operational< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < a target = "_blank"
2003-05-29 16:48:09 +02:00
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall< / a >
2003-05-28 21:20:23 +02:00
is now available.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/25/2002 - Shorewall Mirror in France< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored
2003-05-28 21:20:23 +02:00
at < a target = "_top"
2003-02-08 21:48:47 +01:00
href="http://france.shorewall.net">http://france.shorewall.net< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/25/2002 - Shorewall 1.3.7a Debian Packages Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Lorenzo Martignoni reports that the packages for version 1.3.7a are available
2003-05-28 21:20:23 +02:00
at < a
2002-12-04 01:02:25 +01:00
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author
2003-05-28 21:20:23 +02:00
-- Shorewall 1.3.7a released< img
2003-04-13 17:28:32 +02:00
border="0" src="images/j0233056.gif" width="50" height="80"
align="middle">
2003-05-29 16:48:09 +02:00
< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > 1.3.7a corrects problems occurring in rules file processing when starting
2003-05-28 21:20:23 +02:00
Shorewall 1.3.7.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/22/2002 - Shorewall 1.3.7 Released 8/13/2002< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Features in this release include:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
'icmp.def' file is now empty! The rules in that file
were required in ipchains firewalls but are not
required in Shorewall. Users who have ALLOWRELATED=No
in < a href = "Documentation.htm#Conf" > shorewall.conf< / a > should
see the < a href = "errata.htm#Upgrade" > Upgrade Issues< / a > .< / li >
< li > A
'FORWARDPING' option has been added to < a
href="Documentation.htm#Conf"> shorewall.conf< / a > . The effect
of setting this variable to Yes is the same
as the effect of adding an ACCEPT rule for ICMP echo-request
in < a href = "shorewall_extension_scripts.htm" > /etc/shorewall/icmpdef< / a > .
Users who have such a rule in icmpdef
are encouraged to switch to FORWARDPING=Yes.< / li >
< li > The
loopback CLASS A Network (127.0.0.0/8) has been
added to the rfc1918 file.< / li >
< li > Shorewall
now works with iptables 1.2.7< / li >
< li > The
documentation and web site no longer uses FrontPage
themes.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > I would like to thank John Distler for his valuable input regarding TCP
SYN and ICMP treatment in Shorewall. That
input has led to marked improvement in Shorewall
2003-05-28 21:20:23 +02:00
in the last two releases.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/13/2002 - Documentation in the < a target = "_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository< / a > < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > The Shorewall-docs project now contains just the HTML and image files -
the Frontpage files have been removed.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/7/2002 - < i > STABLE< / i > < / b > < b > branch added to < a target = "_top"
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository< / a > < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This branch will only be updated after I release a new version of Shorewall
so you can always update from this branch
2003-05-28 21:20:23 +02:00
to get the latest stable tree.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 8/7/2002 - < a href = "errata.htm#Upgrade" > Upgrade Issues< / a > section added
to the < a href = "errata.htm" > Errata Page< / a > < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Now there is one place to go to look for issues involved with upgrading
2003-05-28 21:20:23 +02:00
to recent versions of Shorewall.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 8/7/2002 - Shorewall 1.3.6< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > This is primarily a bug-fix rollup with a couple of new features:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
latest < a href = "shorewall_quickstart_guide.htm" > QuickStart
Guides < / a > including the < a
2003-05-28 21:20:23 +02:00
href="shorewall_setup_guide.htm">Shorewall Setup Guide.< / a > < / li >
2003-05-29 16:48:09 +02:00
< li > Shorewall
will now DROP TCP packets that are not part of
or related to an existing connection and that are not
SYN packets. These "New not SYN" packets may be optionally
logged by setting the LOGNEWNOTSYN option in
< a href = "Documentation.htm#Conf" > /etc/shorewall/shorewall.conf< / a > .< / li >
< li > The
processing of "New not SYN" packets may be extended
by commands in the new < a
2003-05-21 01:21:38 +02:00
href="shorewall_extension_scripts.htm">newnotsyn extension script< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/30/2002 - Shorewall 1.3.5b Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > This interim release:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Causes
the firewall script to remove the lock file if it
2003-05-28 21:20:23 +02:00
is killed.< / li >
2003-05-29 16:48:09 +02:00
< li > Once
again allows lists in the second column of the
< a href = "Documentation.htm#Hosts" > /etc/shorewall/hosts< / a > file.< / li >
< li > Includes
the latest < a href = "shorewall_quickstart_guide.htm" > QuickStart
2003-05-28 21:20:23 +02:00
Guides< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/29/2002 - New Shorewall Setup Guide Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > The first draft of this guide is available at < a
2003-05-29 16:48:09 +02:00
href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm< / a > .
The guide is intended for use by people
who are setting up Shorewall to manage multiple
public IP addresses and by people who want to learn
more about Shorewall than is described in the single-address
2003-05-28 21:20:23 +02:00
guides. Feedback on the new guide is welcome.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/28/2002 - Shorewall 1.3.5 Debian Package Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Lorenzo Martignoni reports that the packages are version 1.3.5a and are
2003-05-28 21:20:23 +02:00
available at < a
2002-09-16 19:02:45 +02:00
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/27/2002 - Shorewall 1.3.5a Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > This interim release restores correct handling of REDIRECT rules. < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/26/2002 - Shorewall 1.3.5 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > This will be the last Shorewall release for a while. I'm going to be
focusing on rewriting a lot of the documentation.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > <EFBFBD> < / b > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Empty
and invalid source and destination qualifiers are
now detected in the rules file. It is a good idea
to use the 'shorewall check' command before you
issue a 'shorewall restart' command be be sure that you don't
have any configuration problems that will prevent
a successful restart.< / li >
< li > Added
< b > MERGE_HOSTS< / b > variable in < a
href="Documentation.htm#Conf"> shorewall.conf< / a > to provide
saner behavior of the /etc/shorewall/hosts
file.< / li >
< li > The
time that the counters were last reset is now displayed
in the heading of the 'status' and 'show' commands.< / li >
< li > A
< b > proxyarp < / b > option has been added for entries
in < a href = "Documentation.htm#Interfaces" > /etc/shorewall/interfaces< / a > .
This option facilitates Proxy ARP sub-netting as described
in the Proxy ARP subnetting mini-HOWTO (< a
href="http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/">http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/< / a > ).
Specifying the proxyarp option for an
2003-05-28 21:20:23 +02:00
interface causes Shorewall to set /proc/sys/net/ipv4/conf/< interface> /proxy_arp.< / li >
2003-05-29 16:48:09 +02:00
< li > The
Samples have been updated to reflect the new capabilities
in this release. < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/16/2002 - New Mirror in Argentina< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in
2003-05-28 21:20:23 +02:00
Argentina. Thanks Buanzo!!!< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/16/2002 - Shorewall 1.3.4 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
new < a href = "Documentation.htm#Routestopped" > /etc/shorewall/routestopped< / a >
file has been added. This file is intended
to eventually replace the < b > routestopped< / b >
option in the /etc/shorewall/interface and /etc/shorewall/hosts
files. This new file makes remote firewall administration
easier by allowing any IP or subnet to be enabled
while Shorewall is stopped.< / li >
< li > An
2003-05-28 21:20:23 +02:00
/etc/shorewall/stopped < a
2003-05-29 16:48:09 +02:00
href="Documentation.htm#Scripts">extension script< / a > has been
added. This script is invoked after Shorewall has
2003-05-28 21:20:23 +02:00
stopped.< / li >
2003-05-29 16:48:09 +02:00
< li > A
< b > DETECT_DNAT_ADDRS < / b > option has been added
to < a href = "Documentation.htm#Conf" > /etc/shoreall/shorewall.conf< / a > .
When this option is selected, DNAT rules only
apply when the destination address is the
external interface's primary IP address.< / li >
< li > The
< a href = "shorewall_quickstart_guide.htm" > QuickStart Guide< / a >
has been broken into three guides and has been
almost entirely rewritten.< / li >
< li > The
Samples have been updated to reflect the new capabilities
in this release. < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/8/2002 - Shorewall 1.3.3 Debian Package Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Lorenzo Marignoni reports that the packages are available at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 7/6/2002 - Shorewall 1.3.3 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Entries
in /etc/shorewall/interface that use the wildcard
character ("+") now have the "multi" option assumed.< / li >
< li > The
'rfc1918' chain in the mangle table has been renamed
'man1918' to make log messages generated from
that chain distinguishable from those generated
by the 'rfc1918' chain in the filter table.< / li >
< li > Interface
names appearing in the hosts file are now validated
against the interfaces file.< / li >
< li > The
TARGET column in the rfc1918 file is now checked
for correctness.< / li >
< li > The
chain structure in the nat table has been changed
to reduce the number of rules that a packet must
traverse and to correct problems with NAT_BEFORE_RULES=No< / li >
< li > The
"hits" command has been enhanced.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/25/2002 - Samples Updated for 1.3.2< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > The comments in the sample configuration files have been updated to reflect
2003-05-28 21:20:23 +02:00
new features introduced in Shorewall 1.3.2.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/25/2002 - Shorewall 1.3.1 Debian Package Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Lorenzo Marignoni reports that the package is available at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/19/2002 - Documentation Available in PDF Format< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Thanks to Mike Martinez, the Shorewall Documentation is now available for
< a href = "download.htm" > download< / a > in < a href = "http://www.adobe.com" > Adobe< / a >
PDF format.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/16/2002 - Shorewall 1.3.2 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
< a href = "Documentation.htm#Starting" > logwatch command< / a >
has been added to /sbin/shorewall.< / li >
< li > A
< a href = "blacklisting_support.htm" > dynamic blacklist facility< / a >
has been added.< / li >
< li > Support
for the < a href = "Documentation.htm#Conf" > Netfilter multiport
match function< / a > has been added.< / li >
< li > The
files < b > firewall, functions < / b > and < b > version< / b >
have been moved from /etc/shorewall to /var/lib/shorewall.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/6/2002 - Why CVS Web access is Password Protected< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Last weekend, I installed the CVS Web package to provide brower-based access
to the Shorewall CVS repository. Since then, I have had several instances
where my server was almost unusable due to the high load generated by website
copying tools like HTTrack and WebStripper. These mindless tools:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Ignore
2003-05-28 21:20:23 +02:00
robot.txt files.< / li >
2003-05-29 16:48:09 +02:00
< li > Recursively
copy everything that they find.< / li >
< li > Should
2003-05-28 21:20:23 +02:00
be classified as weapons rather than tools.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > These tools/weapons are particularly damaging when combined with CVS Web
because they doggedly follow every link
in the cgi-generated HTML resulting in 1000s
of executions of the cvsweb.cgi script. Yesterday, I
spend several hours implementing measures to block these
tools but unfortunately, these measures resulted in my
server OOM-ing under even moderate load.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Until I have the time to understand the cause of the OOM (or until I buy
more RAM if that is what is required),
CVS Web access will remain Password Protected.
2003-05-28 21:20:23 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/5/2002 - Shorewall 1.3.1 Debian Package Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Lorenzo Marignoni reports that the package is available at < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/2/2002 - Samples Corrected< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > The 1.3.0 samples configurations had several serious problems that prevented
DNS and SSH from working properly. These
2003-05-28 21:20:23 +02:00
problems have been corrected in the < a
2003-01-14 21:32:45 +01:00
href="/pub/shorewall/samples-1.3.1">1.3.1 samples.< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 6/1/2002 - Shorewall 1.3.1 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Hot on the heels of 1.3.0, this release:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Corrects
a serious problem with "all < i > < zone> < / i >
CONTINUE" policies. This problem is present in all versions
of Shorewall that support the CONTINUE policy.
These previous versions optimized away the "all2< i > < zone> < / i > "
chain and replaced it with the "all2all" chain with the
usual result that a policy of REJECT was enforced rather than
2003-05-28 21:20:23 +02:00
the intended CONTINUE policy.< / li >
2003-05-29 16:48:09 +02:00
< li > Adds
an < a href = "Documentation.htm#rfc1918" > /etc/shorewall/rfc1918< / a >
2003-05-28 21:20:23 +02:00
file for defining the exact behavior of the< a
2003-05-18 20:38:34 +02:00
href="Documentation.htm#Interfaces"> 'norfc1918' interface option< / a > .< / li >
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 5/29/2002 - Shorewall 1.3.0 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0
includes:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
'filterping' interface option that allows ICMP echo-request
(ping) requests addressed to the firewall to
be handled by entries in /etc/shorewall/rules and
/etc/shorewall/policy.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 5/23/2002 - Shorewall 1.3 RC1 Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92)
incorporates the following:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Support
for the /etc/shorewall/whitelist file has been
withdrawn. If you need whitelisting, see < a
2003-03-08 16:48:57 +01:00
href="/1.3/whitelisting_under_shorewall.htm">these instructions< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 5/19/2002 - Shorewall 1.3 Beta 2 Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > In addition to the changes in Beta 1, this release which carries the
designation 1.2.91 adds:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
structure of the firewall is changed markedly. There
is now an INPUT and a FORWARD chain for each interface;
this reduces the number of rules that a packet
must traverse, especially in complicated setups.< / li >
< li > < a
href="Documentation.htm#Exclude">Sub-zones may now be excluded
2003-05-28 21:20:23 +02:00
from DNAT and REDIRECT rules.< / a > < / li >
2003-05-29 16:48:09 +02:00
< li > The
names of the columns in a number of the configuration
files have been changed to be more consistent
and self-explanatory and the documentation has been
updated accordingly.< / li >
< li > The
sample configurations have been updated for 1.3.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 5/17/2002 - Shorewall 1.3 Beta 1 Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Beta 1 carries the version designation 1.2.90 and implements the following
2003-05-28 21:20:23 +02:00
features:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Simplified
rule syntax which makes the intent of each rule
clearer and hopefully makes Shorewall easier to learn.< / li >
< li > Upward
compatibility with 1.2 configuration files has
been maintained so that current users can migrate
to the new syntax at their convenience.< / li >
< li > < b > < font
color="#cc6666">WARNING:<3A> Compatibility with the old
parameterized sample configurations has NOT been maintained.
Users still running those configurations should migrate
to the new sample configurations before upgrading
to 1.3 Beta 1.< / font > < / b > < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 5/4/2002 - Shorewall 1.2.13 is Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
2002-12-28 16:38:03 +01:00
href="Documentation.htm#Whitelist">White-listing< / a > is supported.< / li >
2003-05-29 16:48:09 +02:00
< li > < a
href="Documentation.htm#Policy">SYN-flood protection < / a > is
added.< / li >
< li > IP
addresses added under < a href = "Documentation.htm#Conf" > ADD_IP_ALIASES
and ADD_SNAT_ALIASES< / a > now inherit the VLSM
and Broadcast Address of the interface's primary
2003-05-28 21:20:23 +02:00
IP address.< / li >
2003-05-29 16:48:09 +02:00
< li > The
order in which port forwarding DNAT and Static DNAT
< a href = "Documentation.htm#Conf" > can now be reversed< / a >
so that port forwarding rules can override the contents
of < a href = "Documentation.htm#NAT" > /etc/shorewall/nat< / a > .
< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/30/2002 - Shorewall Debian News< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the < a
href="http://packages.debian.org/testing/net/shorewall.html">Debian
Testing Branch< / a > and the < a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/20/2002 - Shorewall 1.2.12 is Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
'try' command works again< / li >
< li > There
is now a single RPM that also works with SuSE.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/17/2002 - Shorewall Debian News< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Lorenzo Marignoni reports that:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Shorewall
1.2.10 is in the < a
href="http://packages.debian.org/testing/net/shorewall.html">Debian
Testing Branch< / a > < / li >
< li > Shorewall
1.2.11 is in the < a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Branch< / a > < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Thanks, Lorenzo!< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Thanks to < a href = "mailto:s.mohr@familie-mohr.com" > Stefan Mohr< / a > , there
2003-05-28 21:20:23 +02:00
is now a Shorewall 1.2.11 < a
2003-05-29 16:48:09 +02:00
href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm">
SuSE RPM< / a > available. < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/13/2002 - Shorewall 1.2.11 Available < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
'try' command now accepts an optional timeout. If
the timeout is given in the command, the standard
configuration will automatically be restarted after
the new configuration has been running for that length
of time. This prevents a remote admin from being locked
out of the firewall in the case where the new configuration
starts but prevents access.< / li >
< li > Kernel
route filtering may now be enabled globally using
2003-05-28 21:20:23 +02:00
the new ROUTE_FILTER parameter in < a
2003-03-18 16:16:33 +01:00
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > Individual
IP source addresses and/or subnets may now be excluded
from masquerading/SNAT.< / li >
< li > Simple
"Yes/No" and "On/Off" values are now case-insensitive
2003-05-28 21:20:23 +02:00
in /etc/shorewall/shorewall.conf.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/13/2002 - Hamburg Mirror now has FTP < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Stefan now has an FTP mirror at < a target = "_blank"
2003-05-29 16:48:09 +02:00
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall< / a > .<2E>
2003-05-28 21:20:23 +02:00
Thanks Stefan!< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/12/2002 - New Mirror in Hamburg< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Thanks to < a href = "mailto:s.mohr@familie-mohr.com" > Stefan Mohr< / a > , there
is now a mirror of the Shorewall website
at < a target = "_top" href = "http://germany.shorewall.net" > http://germany.shorewall.net< / a > .
2003-05-28 21:20:23 +02:00
< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < a href = "shorewall_quickstart_guide.htm" > Version 1.1 of the QuickStart
Guide< / a > is now available. Thanks to those
who have read version 1.0 and offered their
suggestions. Corrections have also been made to the
sample scripts.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < a href = "shorewall_quickstart_guide.htm" > Version 1.0 of the QuickStart
Guide< / a > is now available. This Guide
and its accompanying sample configurations are
expected to provide a replacement for the recently
withdrawn parameterized samples. < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/8/2002 - Parameterized Samples Withdrawn < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Although the < a
2003-05-29 16:48:09 +02:00
href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized
samples< / a > have allowed people to get
a firewall up and running quickly, they have
unfortunately set the wrong level of expectation among
those who have used them. I am therefore withdrawing support
for the samples and I am recommending that they not be
2003-05-28 21:20:23 +02:00
used in new Shorewall installations.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/2/2002 - Updated Log Parser< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < a href = "mailto:JML@redwoodtech.com" > John Lodge< / a > has provided an updated
2003-05-28 21:20:23 +02:00
version of his < a
2003-05-29 16:48:09 +02:00
href="pub/shorewall/parsefw/">CGI-based log parser< / a >
with corrected date handling. < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/30/2002 - Shorewall Website Search Improvements< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > The quick search on the home page now excludes the mailing list archives.
The < a href = "htdig/search.html" > Extended
Search< / a > allows excluding the archives or
restricting the search to just the archives. An archive
search form is also available on the < a
href="http://lists.shorewall.net/mailing_list.htm">mailing list information
2003-05-28 21:20:23 +02:00
page< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
1.2.10 Debian Package is available at < a
2003-02-08 21:48:47 +01:00
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > Shorewall
1.2.9 is now in the < a
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
Unstable Distribution< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/25/2002 - Log Parser Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < a href = "mailto:JML@redwoodtech.com" > John Lodge< / a > has provided a < a
2003-05-29 16:48:09 +02:00
href="pub/shorewall/parsefw/">CGI-based log parser< / a > for Shorewall. Thanks
2003-05-28 21:20:23 +02:00
John.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/20/2002 - Shorewall 1.2.10 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
"shorewall try" command has been added (syntax: shorewall
try < i > < configuration directory> < / i > ).
This command attempts "shorewall -c < i > < configuration
directory> < / i > start" and if that results in the
firewall being stopped due to an error, a "shorewall start"
command is executed. The 'try' command allows you to create
a new < a href = "Documentation.htm#Configs" > configuration< / a >
and attempt to start it; if there is an error that leaves
your firewall in the stopped state, it will automatically
2003-05-28 21:20:23 +02:00
be restarted using the default configuration (in /etc/shorewall).< / li >
2003-05-29 16:48:09 +02:00
< li > A
new variable ADD_SNAT_ALIASES has been added to
< a href = "Documentation.htm#Conf" > /etc/shorewall/shorewall.conf< / a > .
If this variable is set to "Yes", Shorewall will
automatically add IP addresses listed in the
third column of the < a href = "Documentation.htm#Masq" > /etc/shorewall/masq< / a >
file.< / li >
< li > Copyright
notices have been added to the documenation.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/11/2002 - Shorewall 1.2.9 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Filtering
by < a href = "Documentation.htm#MAC" > MAC address< / a > has
been added. MAC addresses may be used as the source address
in:
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-04-13 17:28:32 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Filtering rules (< a href = "Documentation.htm#Rules" > /etc/shorewall/rules< / a > )< / li >
< li > Traffic Control Classification Rules (< a
2003-04-13 17:28:32 +02:00
href="traffic_shaping.htm#tcrules">/etc/shorewall/tcrules< / a > )< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< li > TOS Rules (< a href = "Documentation.htm#TOS" > /etc/shorewall/tos< / a > )< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< li > Blacklist (< a href = "Documentation.htm#Blacklist" > /etc/shorewall/blacklist< / a > )< / li >
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< / ul >
2003-05-29 16:48:09 +02:00
< / li >
< li > Several
bugs have been fixed< / li >
< li > The
1.2.9 Debian Package is also available at < a
2003-01-14 21:32:45 +01:00
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/1/2002 - 1.2.8 Debian Package is Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > See < a href = "http://security.dsi.unimi.it/%7Elorenzo/debian.html" > http://security.dsi.unimi.it/~lorenzo/debian.html< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > < b > 2/25/2002 - New Two-interface Sample< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > I've enhanced the two interface sample to allow access from the firewall
2003-05-28 21:20:23 +02:00
to servers in the local zone - < a
2003-05-29 16:48:09 +02:00
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz">
http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/23/2002 - Shorewall 1.2.8 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects
problems associated with the lock file used to prevent multiple state-changing
operations from occuring simultaneously.
My apologies for any inconvenience my carelessness
2003-05-28 21:20:23 +02:00
may have caused.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/22/2002 - Shorewall 1.2.7 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > UPnP
probes (UDP destination port 1900) are now silently
2003-05-28 21:20:23 +02:00
dropped in the < i > common< / i > chain< / li >
2003-05-29 16:48:09 +02:00
< li > RFC
1918 checking in the mangle table has been streamlined
to no longer require packet marking. RFC 1918
checking in the filter table has been changed to require
half as many rules as previously.< / li >
< li > A
'shorewall check' command has been added that does
a cursory validation of the zones, interfaces, hosts,
rules and policy files.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/18/2002 - 1.2.6 Debian Package is Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > See < a href = "http://security.dsi.unimi.it/%7Elorenzo/debian.html" > http://security.dsi.unimi.it/~lorenzo/debian.html< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/8/2002 - Shorewall 1.2.6 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > $-variables
may now be used anywhere in the configuration
files except /etc/shorewall/zones.< / li >
< li > The
interfaces and hosts files now have their contents
validated before any changes are made to the existing
Netfilter configuration. The appearance of a zone
name that isn't defined in /etc/shorewall/zones causes
"shorewall start" and "shorewall restart" to abort
without changing the Shorewall state. Unknown options
in either file cause a warning to be issued.< / li >
< li > A
problem occurring when BLACKLIST_LOGLEVEL was not
set has been corrected.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/4/2002 - Shorewall 1.2.5 Debian Package Available< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > see < a href = "http://security.dsi.unimi.it/%7Elorenzo/debian.html" > http://security.dsi.unimi.it/~lorenzo/debian.html< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 2/1/2002 - Shorewall 1.2.5 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Due to installation problems with Shorewall 1.2.4, I have released Shorewall
1.2.5. Sorry for the rapid-fire development.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In version 1.2.5:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
installation problems have been corrected.< / li >
2003-05-29 16:48:09 +02:00
< li > < a
2003-02-08 21:48:47 +01:00
href="Documentation.htm#Masq">SNAT< / a > is now supported.< / li >
2003-05-29 16:48:09 +02:00
< li > A
2003-05-28 21:20:23 +02:00
"shorewall version" command has been added< / li >
2003-05-29 16:48:09 +02:00
< li > The
default value of the STATEDIR variable in /etc/shorewall/shorewall.conf
has been changed to /var/lib/shorewall in
order to conform to the GNU/Linux File Hierarchy Standard,
2003-05-28 21:20:23 +02:00
Version 2.2.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/28/2002 - Shorewall 1.2.4 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
"fw" zone < a href = "Documentation.htm#FW" > may now be given
a different name< / a > .< / li >
< li > You
may now place end-of-line comments (preceded by '#')
in any of the configuration files< / li >
< li > There
is now protection against against two state changing
operations occuring concurrently. This is implemented
using the 'lockfile' utility if it is available
(lockfile is part of procmail); otherwise, a less robust
technique is used. The lockfile is created in the STATEDIR
defined in /etc/shorewall/shorewall.conf and has the
name "lock".< / li >
< li > "shorewall
start" no longer fails if "detect" is specified
in < a href = "Documentation.htm#Interfaces" > /etc/shorewall/interfaces< / a >
2003-05-28 21:20:23 +02:00
for an interface with subnet mask 255.255.255.255.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/27/2002 - Shorewall 1.2.3 Debian Package Available < / b > -- see < a
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/20/2002 - Corrected firewall script available<6C> < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Corrects a problem with BLACKLIST_LOGLEVEL. See < a href = "errata.htm" > the
errata< / a > for details.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/19/2002 - Shorewall 1.2.3 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > This is a minor feature and bugfix release. The single new feature is:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Support
for TCP MSS Clamp to PMTU -- This support is usually
required when the internet connection is via PPPoE
or PPTP and may be enabled using the < a
2003-03-18 16:16:33 +01:00
href="Documentation.htm#ClampMSS">CLAMPMSS< / a > option in /etc/shorewall/shorewall.conf.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > The following problems were corrected:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
"shorewall status" command no longer hangs.< / li >
2003-05-29 16:48:09 +02:00
< li > The
"shorewall monitor" command now displays the icmpdef
2003-05-28 21:20:23 +02:00
chain< / li >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
CLIENT PORT(S) column in tcrules is no longer ignored< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/18/2002 - Shorewall 1.2.2 packaged with new < / b > < a
href="http://leaf.sourceforge.net">LEAF< / a > < b > release< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution
that includes Shorewall 1.2.2. See < a
href="http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo< / a >
for details.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/11/2002 - Debian Package (.deb) Now Available - < / b > Thanks to < a
2003-05-29 16:48:09 +02:00
href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni< / a > , a 1.2.2
Shorewall Debian package is now available.
2003-05-28 21:20:23 +02:00
There is a link to Lorenzo's site from the < a
2003-02-14 22:27:03 +01:00
href="download.htm">Shorewall download page< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/9/2002 - Updated 1.2.2 /sbin/shorewall available - < / b > < a
2003-05-29 16:48:09 +02:00
href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version < / a > restores
2003-05-28 21:20:23 +02:00
the "shorewall status" command to health.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/8/2002 - Shorewall 1.2.2 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > In version 1.2.2< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Support
for IP blacklisting has been added
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > You
specify whether you want packets from blacklisted
hosts dropped or rejected using the < a
href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION
< / a > setting in /etc/shorewall/shorewall.conf< / li >
< li > You
specify whether you want packets from blacklisted
hosts logged and at what syslog level using the
< a href = "Documentation.htm#BLLoglevel" > BLACKLIST_LOGLEVEL< / a >
setting in /etc/shorewall/shorewall.conf< / li >
< li > You
list the IP addresses/subnets that you wish to blacklist
in < a href = "Documentation.htm#Blacklist" > /etc/shorewall/blacklist< / a > < / li >
< li > You
specify the interfaces you want checked against
the blacklist using the new "< a
href="Documentation.htm#BLInterface">blacklist< / a > " option
2003-05-28 21:20:23 +02:00
in /etc/shorewall/interfaces.< / li >
2003-05-29 16:48:09 +02:00
< li > The
black list is refreshed from /etc/shorewall/blacklist
by the "shorewall refresh" command.< / li >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< / ul >
2003-05-29 16:48:09 +02:00
< / li >
< li > Use
of TCP RST replies has been expanded<65>
2003-05-18 20:38:34 +02:00
2003-05-28 21:20:23 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > TCP
connection requests rejected because of a REJECT
policy are now replied with a TCP RST packet.< / li >
< li > TCP
connection requests rejected because of a protocol=all
rule in /etc/shorewall/rules are now replied
2003-05-28 21:20:23 +02:00
with a TCP RST packet.< / li >
2003-05-18 20:38:34 +02:00
2003-05-21 01:21:38 +02:00
2003-05-29 16:48:09 +02:00
2003-03-18 16:16:33 +01:00
< / ul >
2003-05-29 16:48:09 +02:00
< / li >
< li > A
< a href = "Documentation.htm#Logfile" > LOGFILE< / a > specification
has been added to /etc/shorewall/shorewall.conf. LOGFILE
is used to tell the /sbin/shorewall program where to look
for Shorewall messages.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/5/2002 - New Parameterized Samples (< a
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.2.0/"
2003-05-29 16:48:09 +02:00
target="_blank">version 1.2.0< / a > ) released. < / b > These are minor updates
to the previously-released samples. There
2003-05-28 21:20:23 +02:00
are two new rules added:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Unless
you have explicitly enabled Auth connections (tcp
port 113) to your firewall, these connections will be
REJECTED rather than DROPPED. This speeds up connection
establishment to some servers.< / li >
< li > Orphan
DNS replies are now silently dropped.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< p > See the README file for upgrade instructions.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 1/1/2002 - < u > < font color = "#ff6633" > Shorewall Mailing List Moving< / font > < / u > < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > The Shorewall mailing list hosted at < a href = "http://sourceforge.net" >
Sourceforge< / a > is moving to Shorewall.net.
If you are a current subscriber to the list at
2003-05-28 21:20:23 +02:00
Sourceforge, please < a
2003-05-29 16:48:09 +02:00
href="shorewall_mailing_list_migration.htm">see these instructions< / a > .
If you would like to subscribe to the new list,
visit < a
2003-03-18 16:16:33 +01:00
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 12/31/2001 - Shorewall 1.2.1 Released< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In version 1.2.1:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
href="Documentation.htm#LogUncleanOption">Logging of Mangled/Invalid
2003-05-28 21:20:23 +02:00
Packets< / a > is added.<2E> < / li >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
< a href = "IPIP.htm" > tunnel script< / a > has been corrected.< / li >
2003-05-29 16:48:09 +02:00
< li > 'shorewall
show tc' now correctly handles tunnels.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 12/21/2001 - Shorewall 1.2.0 Released!< / b > - < b > I couldn't resist releasing
1.2 on 12/21/2001< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Version 1.2 contains the following new features:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Support
2003-05-28 21:20:23 +02:00
for < a href = "traffic_shaping.htm" > Traffic Control/Shaping< / a > < / li >
2003-05-29 16:48:09 +02:00
< li > Support
for < a href = "Documentation.htm#Unclean" > Filtering of Mangled/Invalid
Packets< / a > < / li >
< li > Support
2003-05-28 21:20:23 +02:00
for < a href = "IPIP.htm" > GRE Tunnels< / a > < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > For the next month or so, I will continue to provide corrections to version
1.1.18 as necessary so that current version
1.1.x users will not be forced into a quick upgrade
to 1.2.0 just to have access to bug fixes.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > For those of you who have installed one of the Beta RPMS, you will need
to use the "--oldpackage" option when upgrading
2003-05-28 21:20:23 +02:00
to 1.2.0:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< blockquote >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm< / p >
2003-05-29 16:48:09 +02:00
< / blockquote >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 12/19/2001 - Thanks to < a href = "mailto:scowles@infohiiway.com" > Steve
Cowles< / a > , there is now a Shorewall mirror
in Texas. < / b > This web site is mirrored at < a
href="http://www.infohiiway.com/shorewall" target="_top">http://www.infohiiway.com/shorewall< / a >
and the ftp site is at < a
2003-03-08 16:48:57 +01:00
href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall">ftp://ftp.infohiiway.com/pub/mirrors/shorewall< / a > .< b > <EFBFBD> < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 11/30/2001 - A new set of the parameterized < a
2003-05-29 16:48:09 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.18">Sample
Configurations< / a > has been released< / b > . In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Ping
is now allowed between the zones.< / li >
< li > In
the three-interface configuration, it is now possible
to configure the internet services that are to be
available to servers in the DMZ.<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 11/20/2001 - The current version of Shorewall is 1.1.18.<2E> < / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
spelling of ADD_IP_ALIASES has been corrected in the
shorewall.conf file< / li >
< li > The
logic for deleting user-defined chains has been simplified
so that it avoids a bug in the LRP version of the
2003-05-28 21:20:23 +02:00
'cut' utility.< / li >
2003-05-29 16:48:09 +02:00
< li > The
/var/lib/lrpkg/shorwall.conf file has been corrected
2003-05-28 21:20:23 +02:00
to properly display the NAT entry in that file.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 11/19/2001 - Thanks to < a href = "mailto:shorewall@timelord.sk" > Juraj
Ontkanin< / a > , there is now a Shorewall
mirror in the Slovak Republic< / b > . The website
is now mirrored at < a href = "http://www.nrg.sk/mirror/shorewall"
target="_top">http://www.nrg.sk/mirror/shorewall< / a >
and the FTP site is mirrored at < a
2002-09-16 19:02:45 +02:00
href="ftp://ftp.nrg.sk/mirror/shorewall">ftp://ftp.nrg.sk/mirror/shorewall< / a > .< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations.< / b >
There are three sample configurations:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > One
2003-05-28 21:20:23 +02:00
Interface -- for a standalone system.< / li >
2003-05-29 16:48:09 +02:00
< li > Two
2003-05-28 21:20:23 +02:00
Interfaces -- A masquerading firewall.< / li >
2003-05-29 16:48:09 +02:00
< li > Three
2003-05-28 21:20:23 +02:00
Interfaces -- A masquerading firewall with DMZ.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > Samples may be downloaded from < a
2003-05-29 16:48:09 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17< / a >
. See the README file for instructions.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 11/1/2001 - The current version of Shorewall is 1.1.17< / b > .<2E> I intend
this to be the last of the 1.1
Shorewall releases.< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > In this version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
handling of < a href = "Documentation.htm#Aliases" > ADD_IP_ALIASES< / a >
2003-05-28 21:20:23 +02:00
has been corrected.<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 10/22/2001 - The current version of Shorewall is 1.1.16< / b > . In this
version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
new "shorewall show connections" command has been
added.< / li >
< li > In
the "shorewall monitor" output, the currently tracked
connections are now shown on a separate page.< / li >
< li > Prior
to this release, Shorewall unconditionally added
the external IP adddress(es) specified in /etc/shorewall/nat.
Beginning with version 1.1.16, a new parameter
(< a href = "Documentation.htm#Aliases" > ADD_IP_ALIASES< / a > )
may be set to "no" (or "No") to inhibit this behavior.
This allows IP aliases created using your distribution's
network configuration tools to be used in
static NAT.<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 10/15/2001 - The current version of Shorewall is 1.1.15.< / b > In this
version:< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Support
2003-05-28 21:20:23 +02:00
for nested zones has been improved. See < a
2003-05-29 16:48:09 +02:00
href="Documentation.htm#Nested"> the documentation< / a > for
details< / li >
< li > Shorewall
now correctly checks the alternate configuration
directory for the 'zones' file.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 10/4/2001 - The current version of Shorewall is 1.1.14.< / b > In this
2003-05-28 21:20:23 +02:00
version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Shorewall
now supports alternate configuration directories.
When an alternate directory is specified when starting
or restarting Shorewall (e.g., "shorewall -c /etc/testconf
restart"), Shorewall will first look for configuration
files in the alternate directory then in /etc/shorewall.
2003-05-28 21:20:23 +02:00
To create an alternate configuration simply:< br >
2003-05-29 16:48:09 +02:00
1.
Create a New Directory< br >
2.
Copy to that directory any of your configuration files
that you want to change.< br >
3.
Modify the copied files as needed.< br >
4.
Restart Shorewall specifying the new directory.< / li >
< li > The
rules for allowing/disallowing icmp echo-requests
(pings) are now moved after rules created when processing
the rules file. This allows you to add rules that
selectively allow/deny ping based on source or destination
address.< / li >
< li > Rules
that specify multiple client ip addresses or subnets
2003-05-28 21:20:23 +02:00
no longer cause startup failures.< / li >
2003-05-29 16:48:09 +02:00
< li > Zone
names in the policy file are now validated against
the zones file.< / li >
< li > If
you have < a href = "Documentation.htm#MangleEnabled" > packet mangling< / a >
support enabled, the "< a
href="Documentation.htm#Interfaces">norfc1918< / a > " interface
option now logs and drops any incoming packets on the interface
that have an RFC 1918 destination address.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 9/12/2001 - The current version of Shorewall is 1.1.13< / b > . In this
2003-05-28 21:20:23 +02:00
version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Shell
variables can now be used to parameterize Shorewall
2003-05-28 21:20:23 +02:00
rules.< / li >
2003-05-29 16:48:09 +02:00
< li > The
second column in the hosts file may now contain a
2003-05-28 21:20:23 +02:00
comma-separated list.< br >
2003-05-29 16:48:09 +02:00
< br >
Example:< br >
<20> <> <EFBFBD>
2003-05-28 21:20:23 +02:00
sea<65> <61> <EFBFBD> eth0:130.252.100.0/24,206.191.149.0/24< / li >
2003-05-29 16:48:09 +02:00
< li > Handling
of multi-zone interfaces has been improved. See
the < a href = "Documentation.htm#Interfaces" > documentation
for the /etc/shorewall/interfaces file< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 8/28/2001 - The current version of Shorewall is 1.1.12< / b > . In this
2003-05-28 21:20:23 +02:00
version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Several
columns in the rules file may now contain comma-separated
2003-05-28 21:20:23 +02:00
lists.< / li >
2003-05-29 16:48:09 +02:00
< li > Shorewall
is now more rigorous in parsing the options in
/etc/shorewall/interfaces.< / li >
< li > Complementation
2003-05-28 21:20:23 +02:00
using "!" is now supported in rules.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 7/28/2001 - The current version of Shorewall is 1.1.11< / b > . In this
2003-05-28 21:20:23 +02:00
version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
"shorewall refresh" command has been added to allow
for refreshing the rules associated with the broadcast
address on a dynamic interface. This command should
be used in place of "shorewall restart" when the internet
2003-05-28 21:20:23 +02:00
interface's IP address changes.< / li >
2003-05-29 16:48:09 +02:00
< li > The
/etc/shorewall/start file (if any) is now processed
after all temporary rules have been deleted.
This change prevents the accidental removal of
rules added during the processing of that file.< / li >
< li > The
"dhcp" interface option is now applicable to firewall
2003-05-28 21:20:23 +02:00
interfaces used by a DHCP server running on the firewall.< / li >
2003-05-29 16:48:09 +02:00
< li > The
RPM can now be built from the .tgz file using "rpm
2003-05-28 21:20:23 +02:00
-tb"<22> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 7/6/2001 - The current version of Shorewall is 1.1.10.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Shorewall
now enables Ipv4 Packet Forwarding by default. Packet
forwarding may be disabled by specifying IP_FORWARD=Off
in /etc/shorewall/shorewall.conf. If you don't
want Shorewall to enable or disable packet forwarding,
add IP_FORWARDING=Keep to your /etc/shorewall/shorewall.conf
file.< / li >
< li > The
"shorewall hits" command no longer lists extraneous
service names in its last report.< / li >
< li > Erroneous
instructions in the comments at the head of the
firewall script have been corrected.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 6/23/2001 - The current version of Shorewall is 1.1.9.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
"tunnels" file < u > really< / u > is in the RPM now.< / li >
2003-05-29 16:48:09 +02:00
< li > SNAT
can now be applied to port-forwarded connections.< / li >
< li > A
bug which would cause firewall start failures in some
dhcp configurations has been fixed.< / li >
< li > The
firewall script now issues a message if you have the
name of an interface in the second column in an entry
in /etc/shorewall/masq and that interface is not
up.< / li >
< li > You
2003-05-28 21:20:23 +02:00
can now configure Shorewall so that it< a
2003-05-29 16:48:09 +02:00
href="Documentation.htm#NatEnabled"> doesn't require the NAT and/or
2003-05-28 21:20:23 +02:00
mangle netfilter modules< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > Thanks
to Alex<65> Polishchuk, the "hits" command from
seawall is now in shorewall.< / li >
< li > Support
2003-05-28 21:20:23 +02:00
for < a href = "IPIP.htm" > IPIP tunnels< / a > has been added.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 6/18/2001 - The current version of Shorewall is 1.1.8< / b > . In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > A
2003-05-28 21:20:23 +02:00
typo in the sample rules file has been corrected.< / li >
2003-05-29 16:48:09 +02:00
< li > It
is now possible to restrict masquerading by< a
2003-03-23 19:47:54 +01:00
href="Documentation.htm#Masq"> destination host or subnet.< / a > < / li >
2003-05-29 16:48:09 +02:00
< li > It
is now possible to have static < a
href="NAT.htm#LocalPackets">NAT rules applied to packets originating
2003-05-28 21:20:23 +02:00
on the firewall itself< / a > .< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-07 16:28:04 +02:00
< p > < b > 6/2/2001 - The current version of Shorewall is 1.1.7.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
TOS rules are now deleted when the firewall is stopped.< / li >
2003-05-29 16:48:09 +02:00
< li > The
.rpm will now install regardless of which version
of iptables is installed.< / li >
< li > The
2003-05-28 21:20:23 +02:00
.rpm will now install without iproute2 being installed.< / li >
2003-05-29 16:48:09 +02:00
< li > The
2003-05-28 21:20:23 +02:00
documentation has been cleaned up.< / li >
2003-05-29 16:48:09 +02:00
< li > The
sample configuration files included in Shorewall
have been formatted to 80 columns for ease of editing
2003-05-28 21:20:23 +02:00
on a VGA console.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 5/25/2001 - The current version of Shorewall is 1.1.6< / b > . In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
href="Documentation.htm#lograte">You may now rate-limit the
packet log.< / a > < / li >
< li >
Previous versions of Shorewall have an implementation
of Static NAT which violates the principle
of least surprise.<2E> NAT only occurs for packets arriving
at (DNAT) or send from (SNAT) the interface named in the
INTERFACE column of /etc/shorewall/nat. Beginning with version
1.1.6, NAT effective regardless of which interface
packets come from or are destined to. To get compatibility
with prior versions, I have added a new "ALL < a
href="NAT.htm#AllInterFaces">"ALL INTERFACES"<22> column to /etc/shorewall/nat< / a > .
By placing "no" or "No" in the new column, the NAT
2003-05-28 21:20:23 +02:00
behavior of prior versions may be retained.<2E> < / li >
2003-05-29 16:48:09 +02:00
< li > The
treatment of < a href = "IPSEC.htm#RoadWarrior" > IPSEC Tunnels
where the remote gateway is a standalone system has been
improved< / a > . Previously, it was necessary to include an additional
rule allowing UDP port 500 traffic to pass through the tunnel.
Shorewall will now create this rule automatically when you
place the name of the remote peer's zone in a new GATEWAY ZONE column
in /etc/shorewall/tunnels.<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 5/20/2001 - The current version of Shorewall is 1.1.5.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > < a
href="Documentation.htm#modules">You may now pass parameters
when loading netfilter modules and you can specify the modules
to load.< / a > < / li >
< li > Compressed
modules are now loaded. This requires that you
modutils support loading compressed modules.< / li >
< li > < a
href="Documentation.htm#TOS">You may now set the Type of Service
(TOS) field in packets.< / a > < / li >
< li > Corrected
2003-05-28 21:20:23 +02:00
rules generated for port redirection (again).< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 5/10/2001 - The current version of Shorewall is 1.1.4.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li >
< a href = "Documentation.htm#Conf" > Accepting RELATED connections
is now optional.< / a > < / li >
< li > Corrected
problem where if "shorewall start" aborted early
(due to kernel configuration errors for example), superfluous
2003-05-28 21:20:23 +02:00
'sed' error messages were reported.< / li >
2003-05-29 16:48:09 +02:00
< li > Corrected
2003-05-28 21:20:23 +02:00
rules generated for port redirection.< / li >
2003-05-29 16:48:09 +02:00
< li > The
order in which iptables kernel modules are loaded
has been corrected (Thanks to Mark Pavlidis).<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 4/28/2001 - The current version of Shorewall is 1.1.3.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Correct
message issued when Proxy ARP address added (Thanks
2003-05-28 21:20:23 +02:00
to Jason Kirtland).< / li >
2003-05-29 16:48:09 +02:00
< li > /tmp/shorewallpolicy-$$
is now removed if there is an error while
starting the firewall.< / li >
< li > /etc/shorewall/icmp.def
and /etc/shorewall/common.def are now used
to define the icmpdef and common chains unless overridden
2003-05-28 21:20:23 +02:00
by the presence of /etc/shorewall/icmpdef or /etc/shorewall/common.< / li >
2003-05-29 16:48:09 +02:00
< li > In
the .lrp, the file /var/lib/lrpkg/shorwall.conf
has been corrected. An extra space after "/etc/shorwall/policy"
has been removed and "/etc/shorwall/rules" has
been added.< / li >
< li > When
a sub-shell encounters a fatal error and has stopped
the firewall, it now kills the main shell so that
the main shell will not continue.< / li >
< li > A
problem has been corrected where a sub-shell stopped
the firewall and main shell continued resulting in
a perplexing error message referring to "common.so"
2003-05-28 21:20:23 +02:00
resulted.< / li >
2003-05-29 16:48:09 +02:00
< li > Previously,
placing "-" in the PORT(S) column in /etc/shorewall/rules
resulted in an error message during start. This
has been corrected.< / li >
< li > The
first line of "install.sh" has been corrected -- I
had inadvertently deleted the initial "#".< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 4/12/2001 - The current version of Shorewall is 1.1.2.< / b > In this version< / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Port
redirection now works again.< / li >
< li > The
2003-05-28 21:20:23 +02:00
icmpdef and common chains < a
href="Documentation.htm#Icmpdef">may now be user-defined< / a > .< / li >
2003-05-29 16:48:09 +02:00
< li > The
firewall no longer fails to start if "routefilter"
is specified for an interface that isn't started.
A warning message is now issued in this case.< / li >
< li > The
LRP Version is renamed "shorwall" for 8,3 MSDOS file
system compatibility.< / li >
< li > A
2003-05-28 21:20:23 +02:00
couple of LRP-specific problems were corrected.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/8/2001 - Shorewall is now affiliated with the < a
href="http://leaf.sourceforge.net">Leaf Project< / a > < / b > < a
href="http://leaf.sourceforge.net"> < img border = "0"
src="images/leaflogo.gif" width="49" height="36">
2003-05-29 16:48:09 +02:00
< / a > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 4/5/2001 - The current version of Shorewall is 1.1.1. In this version:< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
common chain is traversed from INPUT, OUTPUT and FORWARD
before logging occurs< / li >
< li > The
2003-05-28 21:20:23 +02:00
source has been cleaned up dramatically< / li >
2003-05-29 16:48:09 +02:00
< li > DHCP
DISCOVER packets with RFC1918 source addresses no
longer generate log messages. Linux DHCP clients generate
such packets and it's annoying to see them logged.<2E> < / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/25/2001 - The current version of Shorewall is 1.1.0. In this version:< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Log
2003-05-28 21:20:23 +02:00
messages now indicate the packet disposition.< / li >
2003-05-29 16:48:09 +02:00
< li > Error
2003-05-28 21:20:23 +02:00
messages have been improved.< / li >
2003-05-29 16:48:09 +02:00
< li > The
ability to define zones consisting of an enumerated
set of hosts and/or subnetworks has been added.< / li >
< li > The
zone-to-zone chain matrix is now sparse so that only
those chains that contain meaningful rules are
2003-05-28 21:20:23 +02:00
defined.< / li >
2003-05-29 16:48:09 +02:00
< li > 240.0.0.0/4
and 169.254.0.0/16 have been added to the source
subnetworks whose packets are dropped under the
< i > norfc1918< / i > interface option.< / li >
< li > Exits
are now provided for executing an user-defined script
when a chain is defined, when the firewall is initialized,
when the firewall is started, when the firewall
2003-05-28 21:20:23 +02:00
is stopped and when the firewall is cleared.< / li >
2003-05-29 16:48:09 +02:00
< li > The
Linux kernel's route filtering facility can now be
specified selectively on network interfaces.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-09-16 19:02:45 +02:00
< p > < b > 3/19/2001 - The current version of Shorewall is 1.0.4. This version:< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > Allows
user-defined zones. Shorewall now has only one
pre-defined zone (fw) with the remaining zones being
defined in the new configuration file /etc/shorewall/zones.
The /etc/shorewall/zones file released in this version
provides behavior that is compatible with Shorewall
1.0.3.<2E> < / li >
< li > Adds
the ability to specify logging in entries in the
/etc/shorewall/rules file.< / li >
< li > Correct
handling of the icmp-def chain so that only ICMP
packets are sent through the chain.< / li >
< li > Compresses
the output of "shorewall monitor" if awk is
installed. Allows the command to work if awk isn't installed
(although it's not pretty).< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix
release with no new features.< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-08-22 23:33:54 +02:00
< ul >
2003-05-29 16:48:09 +02:00
< li > The
PATH variable in the firewall script now includes
/usr/local/bin and /usr/local/sbin.< / li >
< li > DMZ-related
chains are now correctly deleted if the DMZ is
2003-05-28 21:20:23 +02:00
deleted.< / li >
2003-05-29 16:48:09 +02:00
< li > The
interface OPTIONS for "gw" interfaces are no longer
2003-05-28 21:20:23 +02:00
ignored.< / li >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2002-12-04 01:02:25 +01:00
< / ul >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < b > 3/8/2001 - The current version of Shorewall is 1.0.2. It supports an
additional "gw" (gateway) zone for tunnels
and it supports IPSEC tunnels with end-points
on the firewall. There is also a .lrp available now.< / b > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
< p > < font size = "2" > Updated 5/29/2003 - < a href = "support.htm" > Tom Eastep< / a >
2003-05-28 21:20:23 +02:00
< / font > < / p >
2003-05-18 20:38:34 +02:00
2003-05-29 16:48:09 +02:00
2003-01-14 21:32:45 +01:00
< p > < a href = "copyright.htm" > < font size = "2" > Copyright< / font > <20> < font
size="2">2001, 2002 Thomas M. Eastep.< / font > < / a > < br >
2003-05-29 16:48:09 +02:00
< / p >
2002-09-16 19:02:45 +02:00
< / body >
< / html >
