forked from extern/shorewall_code
165 lines
5.2 KiB
XML
165 lines
5.2 KiB
XML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
<refentry>
|
||
|
<refmeta>
|
||
|
<refentrytitle>shorewall-route_rules</refentrytitle>
|
||
|
|
||
|
<manvolnum>5</manvolnum>
|
||
|
</refmeta>
|
||
|
|
||
|
<refnamediv>
|
||
|
<refname>route_rules</refname>
|
||
|
|
||
|
<refpurpose>Shorewall Routing Rules file</refpurpose>
|
||
|
</refnamediv>
|
||
|
|
||
|
<refsynopsisdiv>
|
||
|
<cmdsynopsis>
|
||
|
<command>/etc/shorewall/route_rules</command>
|
||
|
</cmdsynopsis>
|
||
|
</refsynopsisdiv>
|
||
|
|
||
|
<refsect1>
|
||
|
<title>Description</title>
|
||
|
|
||
|
<para> Entries in this file cause traffic to be routed to one of the
|
||
|
providers listed in shorewall-providers(5).</para>
|
||
|
|
||
|
<para>The columns in the file are as follows.</para>
|
||
|
|
||
|
<variablelist>
|
||
|
<varlistentry>
|
||
|
<term><emphasis role="bold">SOURCE</emphasis> (Optional)</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>An ip address (network or host) that matches the source IP
|
||
|
address in a packet. May also be specified as an interface name
|
||
|
optionally followed by ":" and an address. If the device <emphasis
|
||
|
role="bold">lo</emphasis> is specified, the packet must originate
|
||
|
from the firewall itself.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term> <emphasis role="bold">DEST</emphasis> (Optional)</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>An ip address (network or host) that matches the destination
|
||
|
IP address in a packet.</para>
|
||
|
|
||
|
<para>If you choose to omit either <emphasis
|
||
|
role="bold">SOURCE</emphasis> or <emphasis
|
||
|
role="bold">DEST</emphasis>, place "-" in that column. Note that you
|
||
|
may not omit both <emphasis role="bold">SOURCE</emphasis> and
|
||
|
<emphasis role="bold">DEST</emphasis>.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term><emphasis role="bold">PROVIDER</emphasis></term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>The provider to route the traffic through. May be expressed
|
||
|
either as the provider name or the provider number. May also be
|
||
|
<emphasis role="bold">main</emphasis> or 254 for the main routing
|
||
|
table. This can be used in combination with VPN tunnels, see example
|
||
|
2 below.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term><emphasis role="bold">PRIORITY</emphasis></term>
|
||
|
|
||
|
<listitem>
|
||
|
<para> The rule's priority which determines the order in which the
|
||
|
rules are processed.</para>
|
||
|
|
||
|
<variablelist>
|
||
|
<varlistentry>
|
||
|
<term>1000-1999</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>Before Shorewall-generated 'MARK' rules</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term>11000-11999</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>After 'MARK' rules but before Shorewall-generated rules
|
||
|
for ISP interfaces.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term>26000-26999</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>After ISP interface rules but before 'default'
|
||
|
rule.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
</variablelist>
|
||
|
|
||
|
<para>Rules with equal priority are applied in the order in which
|
||
|
they appear in the file.</para>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
</variablelist>
|
||
|
</refsect1>
|
||
|
|
||
|
<refsect1>
|
||
|
<title>Examples</title>
|
||
|
|
||
|
<variablelist>
|
||
|
<varlistentry>
|
||
|
<term>Example 1:</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>You want all traffic coming in on eth1 to be routed to the
|
||
|
ISP1 provider.</para>
|
||
|
|
||
|
<programlisting> #SOURCE DEST PROVIDER PRIORITY
|
||
|
eth1 - ISP1 1000
|
||
|
</programlisting>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
|
||
|
<varlistentry>
|
||
|
<term>Example 2:</term>
|
||
|
|
||
|
<listitem>
|
||
|
<para>You use OpenVPN (routed setup /tunX) in combination with
|
||
|
multiple providers. In this case you have to set up a rule to ensure
|
||
|
that the OpenVPN traffic is routed back through the tunX
|
||
|
interface(s) rather than through any of the providers. 10.8.0.0/24
|
||
|
is the subnet choosen in your OpenVPN configuration (server 10.8.0.0
|
||
|
255.255.255.0).</para>
|
||
|
|
||
|
<programlisting> #SOURCE DEST PROVIDER PRIORITY
|
||
|
- 10.8.0.0/24 main 1000
|
||
|
</programlisting>
|
||
|
</listitem>
|
||
|
</varlistentry>
|
||
|
</variablelist>
|
||
|
</refsect1>
|
||
|
|
||
|
<refsect1>
|
||
|
<title>FILES</title>
|
||
|
|
||
|
<para>/etc/shorewall/route_rules</para>
|
||
|
</refsect1>
|
||
|
|
||
|
<refsect1>
|
||
|
<title>See ALSO</title>
|
||
|
|
||
|
<para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
|
||
|
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
|
||
|
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
|
||
|
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
|
||
|
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
|
||
|
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
|
||
|
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
|
||
|
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
|
||
|
</refsect1>
|
||
|
</refentry>
|