2004-09-24 00:58:32 +02:00
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
2003-12-30 02:19:52 +01:00
|
|
|
<html>
|
|
|
|
|
<head>
|
2004-09-24 00:58:32 +02:00
|
|
|
<meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8">
|
2004-04-12 16:16:46 +02:00
|
|
|
<title>Shoreline Firewall (Shorewall) 2.0</title>
|
|
|
|
|
<base target="_self">
|
2004-09-24 00:58:32 +02:00
|
|
|
<meta name="GENERATOR" content="OpenOffice.org 1.1.1 (Linux)">
|
|
|
|
|
<meta name="CREATED" content="20040920;15031500">
|
|
|
|
|
<meta name="CHANGED" content="20040920;15183300">
|
2003-12-30 02:19:52 +01:00
|
|
|
</head>
|
2004-09-24 00:58:32 +02:00
|
|
|
<body dir="ltr" lang="en-US">
|
2004-11-19 19:10:17 +01:00
|
|
|
<h1>Shorewall 2.x</h1>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p><b>Tom Eastep</b><br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-09-24 00:58:32 +02:00
|
|
|
The information on this site applies only
|
2004-11-19 19:10:17 +01:00
|
|
|
to 2.x releases of Shorewall. For older versions:</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<ul>
|
2004-09-24 00:58:32 +02:00
|
|
|
<li>
|
|
|
|
|
<p style="margin-bottom: 0in;">The 1.4 site is <a
|
|
|
|
|
href="http://www.shorewall.net/1.4" target="_top">here.</a></p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p style="margin-bottom: 0in;">The 1.3 site is <a
|
|
|
|
|
href="http://www.shorewall.net/1.3" target="_top">here.</a> </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>The 1.2 site is <a href="http://shorewall.net/1.2/"
|
|
|
|
|
target="_top">here</a>. </p>
|
|
|
|
|
</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
</ul>
|
2005-01-05 00:26:14 +01:00
|
|
|
<p>The current 2.0 Stable Release is 2.0.14 -- Here are the <a
|
|
|
|
|
href="http://shorewall.net/pub/shorewall/2.0/shorewall-2.0.14/releasenotes.txt">release
|
2004-09-11 16:31:50 +02:00
|
|
|
notes</a>.<br>
|
2005-01-12 22:12:27 +01:00
|
|
|
The current Developement Release is 2.2.0 RC4 -- Here
|
2004-09-24 00:58:32 +02:00
|
|
|
are the <a
|
2005-01-12 22:12:27 +01:00
|
|
|
href="http://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-RC4/releasenotes.txt">release
|
2004-12-31 20:12:00 +01:00
|
|
|
notes</a> and here are the <a
|
2005-01-12 22:12:27 +01:00
|
|
|
href="http://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-RC4/known_problems.txt">known
|
2004-12-31 20:12:00 +01:00
|
|
|
problems</a>.<br>
|
|
|
|
|
</p>
|
2004-12-29 00:19:15 +01:00
|
|
|
<p><a
|
|
|
|
|
href="http://lists.shorewall.net/pipermail/shorewall-announce/2004-December/000451.html"><span
|
|
|
|
|
style="font-weight: bold;">Preparing for Shorewall 2.2 -- End of
|
|
|
|
|
support life for Shorewall 1.4 is Near! </span></a><br>
|
2004-08-14 23:00:08 +02:00
|
|
|
<br>
|
2005-01-05 00:26:14 +01:00
|
|
|
Copyright © 2001-2005 Thomas M. Eastep</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<p>Permission is granted to copy, distribute and/or modify this
|
2004-09-24 00:58:32 +02:00
|
|
|
document under the terms of the GNU Free Documentation License,
|
|
|
|
|
Version 1.2 or any later version published by the Free Software
|
|
|
|
|
Foundation; with no Invariant Sections, with no Front-Cover, and with
|
|
|
|
|
no Back-Cover Texts. A copy of the license is included in the section
|
2004-10-27 15:54:31 +02:00
|
|
|
entitled “<a href="GnuCopyright.htm" target="_self">GNU
|
2004-09-24 00:58:32 +02:00
|
|
|
Free Documentation License</a>”.</p>
|
2005-01-12 22:12:27 +01:00
|
|
|
<p>2005-01-06</p>
|
2004-09-24 00:58:32 +02:00
|
|
|
<hr>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3>Table of Contents</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in; margin-bottom: 0in;"><a href="#Intro">Introduction
|
|
|
|
|
to Shorewall</a></p>
|
|
|
|
|
<p style="margin-left: 0.83in; margin-bottom: 0in;"><a href="#Glossary">Glossary</a><br>
|
|
|
|
|
<a href="#WhatIs">What
|
|
|
|
|
is Shorewall?</a><br>
|
|
|
|
|
<a href="#GettingStarted">Getting Started with
|
2004-05-28 19:24:32 +02:00
|
|
|
Shorewall</a><br>
|
|
|
|
|
<a href="#Info">Looking for Information?</a><br>
|
2004-09-24 00:58:32 +02:00
|
|
|
<a href="#Mandrake">Running
|
|
|
|
|
Shorewall on Mandrake® with a two-interface setup?</a><br>
|
|
|
|
|
<a href="#License">License</a></p>
|
2004-10-25 17:52:26 +02:00
|
|
|
<p style="margin-bottom: 0in; margin-left: 40px;"><a href="#2_0_10">News</a></p>
|
2005-01-12 22:12:27 +01:00
|
|
|
<p style="margin-left: 0.83in; margin-bottom: 0in;"><a href="#2_2_0_RC4">Shorewall
|
|
|
|
|
2.2.0-RC4</a><br>
|
|
|
|
|
<a href="#2_0_14">Shorewall
|
2005-01-05 00:26:14 +01:00
|
|
|
2.0.14</a><br>
|
|
|
|
|
<a href="#MandrakeRPMS">Mandrake-specific RPMs available</a><br>
|
2005-01-03 22:30:23 +01:00
|
|
|
<a href="#Redhat_Fedora">Redhat/Fedora-specific RPMs available</a><br>
|
2004-12-31 20:12:00 +01:00
|
|
|
<a href="#2_2_0_RC3">Shorewall
|
2005-01-05 00:26:14 +01:00
|
|
|
2.2.0 RC3</a><a href="#2_2_0_RC2"></a><br>
|
2004-09-24 00:58:32 +02:00
|
|
|
<br>
|
|
|
|
|
</p>
|
|
|
|
|
<div style="margin-left: 40px;"><a href="#Leaf">Leaf</a><br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</div>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 40px;"><a href="#Donations">Donations</a></p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h2><a name="Intro"></a>Introduction to Shorewall</h2>
|
|
|
|
|
<h3><a name="Glossary"></a>Glossary</h3>
|
|
|
|
|
<ul>
|
2004-09-24 00:58:32 +02:00
|
|
|
<li>
|
|
|
|
|
<p style="margin-bottom: 0in;"><a href="http://www.netfilter.org/"
|
|
|
|
|
target="_top">Netfilter</a> - the packet filter facility built into
|
|
|
|
|
the 2.4 and later Linux kernels. </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p style="margin-bottom: 0in;">ipchains - the packet filter
|
|
|
|
|
facility built into the 2.2 Linux kernels. Also the name of the utility
|
|
|
|
|
program used to configure and control that facility. Netfilter can be
|
|
|
|
|
used in ipchains compatibility mode. </p>
|
|
|
|
|
</li>
|
|
|
|
|
<li>
|
|
|
|
|
<p>iptables - the utility program used to configure and control
|
|
|
|
|
Netfilter. The term 'iptables' is often used to refer to the
|
2004-04-12 16:16:46 +02:00
|
|
|
combination of iptables+Netfilter (with Netfilter not in ipchains
|
2004-09-24 00:58:32 +02:00
|
|
|
compatibility mode). </p>
|
|
|
|
|
</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
</ul>
|
|
|
|
|
<h3><a name="WhatIs"></a>What is Shorewall?</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in;">The Shoreline Firewall, more commonly
|
|
|
|
|
known as "Shorewall", is a high-level tool for configuring
|
|
|
|
|
Netfilter. You describe your firewall/gateway requirements using
|
|
|
|
|
entries in a set of configuration files. Shorewall reads those
|
|
|
|
|
configuration files and with the help of the iptables utility,
|
|
|
|
|
Shorewall configures Netfilter to match your requirements. Shorewall
|
|
|
|
|
can be used on a dedicated firewall system, a multi-function
|
|
|
|
|
gateway/router/server or on a standalone GNU/Linux system. Shorewall
|
|
|
|
|
does not use Netfilter's ipchains compatibility mode and can thus
|
|
|
|
|
take advantage of Netfilter's <a
|
2004-04-12 16:16:46 +02:00
|
|
|
href="http://www.cs.princeton.edu/%7Ejns/security/iptables/iptables_conntrack.html"
|
|
|
|
|
target="_top">connection
|
2004-09-24 00:58:32 +02:00
|
|
|
state tracking capabilities</a>.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-09-24 00:58:32 +02:00
|
|
|
Shorewall is <u>not</u> a
|
|
|
|
|
daemon. Once Shorewall has configured Netfilter, it's job is
|
|
|
|
|
complete. After that, there is no Shorewall code running although the
|
|
|
|
|
<a href="starting_and_stopping_shorewall.htm">/sbin/shorewall program
|
|
|
|
|
can be used at any time to monitor the Netfilter firewall</a>.</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3><a name="GettingStarted"></a>Getting Started with Shorewall</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in;">New to Shorewall? Start by selecting
|
|
|
|
|
the <a href="shorewall_quickstart_guide.htm">QuickStart Guide</a>
|
|
|
|
|
that most closely matches your environment and follow the step by
|
|
|
|
|
step instructions.</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3><a name="Info"></a>Looking for Information?</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in;">The <a href="Documentation_Index.html">Documentation
|
|
|
|
|
Index</a> is a good place to start as is the Quick Search in the
|
|
|
|
|
frame above. </p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3><a name="Mandrake"></a>Running Shorewall on Mandrake® with a
|
|
|
|
|
two-interface setup?</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in;">If so, the documentation on this site
|
|
|
|
|
will not apply directly to your setup. If you want to use the
|
|
|
|
|
documentation that you find here, you will want to consider
|
|
|
|
|
uninstalling what you have and installing a setup that matches the
|
|
|
|
|
documentation on this site. See the <a href="two-interface.htm">Two-interface
|
|
|
|
|
QuickStart Guide</a> for details.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-09-24 00:58:32 +02:00
|
|
|
<b>Update: </b>I've been
|
2004-04-12 16:16:46 +02:00
|
|
|
informed by Mandrake Development that this problem has been corrected
|
2004-09-24 00:58:32 +02:00
|
|
|
in Mandrake 10.0 Final (the problem still exists in the 10.0
|
|
|
|
|
Community release).</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3><a name="License"></a>License</h3>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p style="margin-left: 0.42in;">This program is free software; you can
|
|
|
|
|
redistribute it and/or modify it under the terms of <a
|
|
|
|
|
href="http://www.gnu.org/licenses/gpl.html">Version
|
2004-04-12 16:16:46 +02:00
|
|
|
2 of the GNU General Public License</a> as published by the Free
|
2004-09-24 00:58:32 +02:00
|
|
|
Software Foundation.</p>
|
|
|
|
|
<p style="margin-left: 0.42in;">This program is distributed in the
|
|
|
|
|
hope that it will be useful, but WITHOUT ANY WARRANTY; without even
|
|
|
|
|
the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
|
|
|
PURPOSE. See the GNU General Public License for more detail.</p>
|
|
|
|
|
<p style="margin-left: 0.42in;">You should have received a copy of the
|
|
|
|
|
GNU General Public License along with this program; if not, write to
|
|
|
|
|
the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA
|
|
|
|
|
02139, USA</p>
|
|
|
|
|
<p style="margin-left: 0.42in;">Permission is granted to copy,
|
|
|
|
|
distribute and/or modify this document under the terms of the GNU
|
|
|
|
|
Free Documentation License, Version 1.2 or any later version
|
|
|
|
|
published by the Free Software Foundation; with no Invariant
|
|
|
|
|
Sections, with no Front-Cover, and with no Back-Cover Texts. A copy
|
|
|
|
|
of the license is included in the section entitled "GNU Free
|
|
|
|
|
Documentation License". </p>
|
|
|
|
|
<hr>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h2><a name="News"></a>News</h2>
|
2005-01-12 22:12:27 +01:00
|
|
|
<span style="font-weight: bold;"><a name="2_2_0_RC4"></a>01/06/2005 -
|
|
|
|
|
Shorewall 2.2.0 RC4<br>
|
|
|
|
|
</span><br>
|
|
|
|
|
New Features:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>A listing of loaded iptables kernel modules is now included in
|
|
|
|
|
the output of "shorewall status".<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
Problems Corrected.<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Several problems associated with processing the IPSEC colummn in
|
|
|
|
|
/etc/shorewall/masq have been corrected.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
2005-01-05 00:26:14 +01:00
|
|
|
<span style="font-weight: bold;"><a name="2_0_14"></a>01/03/2005 -
|
|
|
|
|
Shorewall 2.0.14<br>
|
|
|
|
|
</span><br>
|
|
|
|
|
New Features:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Previously, when rate-limiting was specified in
|
|
|
|
|
/etc/shorewall/policy (LIMIT:BURST column), any traffic which exceeded
|
|
|
|
|
the specified rate was silently dropped. Now, if a log level is given
|
|
|
|
|
in the entry (LEVEL column) then drops are logged at that level at a
|
|
|
|
|
rate of 5/min with a burst of 5.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
Problems Corrected:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>A typo in the /etc/shorewall/interfaces file has been fixed.</li>
|
|
|
|
|
<li>"bad variable" error messages occurring during "shorewall stop"
|
|
|
|
|
and "shorewall clear" have been eliminated.</li>
|
|
|
|
|
<li>A misleading typo in /etc/shorewall/tunnels has been corrected.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
2005-01-03 22:30:23 +01:00
|
|
|
<span style="font-weight: bold;"><a name="MandrakeRPMS"></a>12/31/2004
|
2005-01-07 05:24:21 +01:00
|
|
|
- Mandrake-specific RPMs available<br>
|
2005-01-03 22:30:23 +01:00
|
|
|
<br>
|
|
|
|
|
</span>Jack Coates has generously volunteered to provide Shorewall RPMs
|
|
|
|
|
for use under Mandrake. You can download Jack's RPMs from <a
|
2005-01-07 05:24:21 +01:00
|
|
|
target="_top" href="http://www.monkeynoodle.org/tmp/">http://www.monkeynoodle.org/tmp/</a><br>
|
2005-01-03 22:30:23 +01:00
|
|
|
<br>
|
2004-12-31 20:12:00 +01:00
|
|
|
<span style="font-weight: bold;"><a name="Redhat_Fedora"></a>12/31/2004
|
|
|
|
|
- Redhat/Fedora-specific RPMs available<br>
|
|
|
|
|
</span><br>
|
|
|
|
|
Simon Matter has graciously volunteered to provide RPMs taylored for
|
2005-01-03 22:30:23 +01:00
|
|
|
Redhat and Fedora. You can download Simon's RPMs from <a target="_top"
|
2004-12-31 20:12:00 +01:00
|
|
|
href="http://www.invoca.ch/pub/packages/shorewall/">http://www.invoca.ch/pub/packages/shorewall/</a><br>
|
|
|
|
|
<br>
|
|
|
|
|
Thanks, Simon!<br>
|
|
|
|
|
<br>
|
|
|
|
|
<span style="font-weight: bold;"><a name="2_2_0_RC3"></a>12/30/2004 -
|
|
|
|
|
Shorewall 2.2.0 RC3<br>
|
|
|
|
|
</span><br>
|
|
|
|
|
Problems Corrected:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>The following error message could appear during "shorewall stop"
|
|
|
|
|
or "shorewall clear":<br>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
local: lo:: bad variable name<br>
|
|
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>The rate limiting example in /etc/shorewall/rules has been
|
|
|
|
|
changed to use the RATE LIMIT column.</li>
|
|
|
|
|
<li>Entries in /etc/shorewall/masq with the INTERFACE column
|
|
|
|
|
containing <ifname>:: (e.g., "eth0::") would generate a progress
|
|
|
|
|
message but would not generate an iptables rule.</li>
|
|
|
|
|
<li>A misleading typo in /etc/shorewall/tunnels has been corrected.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
2005-01-05 00:26:14 +01:00
|
|
|
<span style="font-weight: bold;"></span>
|
2004-05-28 19:24:32 +02:00
|
|
|
<p><a href="News.htm">More News</a></p>
|
2004-09-24 00:58:32 +02:00
|
|
|
<hr>
|
|
|
|
|
<h2><a name="Leaf"></a>Leaf</h2>
|
|
|
|
|
<p><a href="http://leaf.sourceforge.net/" target="_top"><font
|
|
|
|
|
color="#000000"><img src="images/leaflogo.gif" name="Graphic1"
|
|
|
|
|
alt="(Leaf Logo)" align="bottom" border="1" height="39" width="52"></font></a>
|
|
|
|
|
LEAF is an open source project which provides a Firewall/router on a
|
|
|
|
|
floppy, CD or CF. Several LEAF distributions including Bering and
|
|
|
|
|
Bering-uClibc use Shorewall as their Netfilter configuration tool.</p>
|
|
|
|
|
<hr>
|
2004-08-07 05:33:54 +02:00
|
|
|
<h2><a name="Donations"></a>Donations</h2>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p align="left"><a href="http://www.alz.org/" target="_top"><font
|
|
|
|
|
color="#000000"><img src="images/alz_logo2.gif" name="Graphic2"
|
|
|
|
|
alt="(Alzheimer's Association Logo)" align="right" border="1"
|
|
|
|
|
height="63" width="303"></font></a><a href="http://www.starlight.org/"
|
|
|
|
|
target="_top"><font color="#000000"><img src="images/newlog.gif"
|
|
|
|
|
name="Graphic3" alt="(Starlight Foundation Logo)" align="right"
|
|
|
|
|
border="1" height="105" width="62"></font></a><font size="4">Shorewall
|
|
|
|
|
is free but if you try it and find it useful, please consider making
|
|
|
|
|
a donation to the <a href="http://www.alz.org/" target="_top">Alzheimer's
|
|
|
|
|
Association</a> or to the <a href="http://www.starlight.org/"
|
|
|
|
|
target="_top">Starlight
|
|
|
|
|
Children's Foundation</a>.</font></p>
|
2005-01-07 05:24:21 +01:00
|
|
|
<p align="left"><font size="4">Thank You<br>
|
|
|
|
|
</font></p>
|
2004-09-24 00:58:32 +02:00
|
|
|
<p align="left"><br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-09-24 00:58:32 +02:00
|
|
|
</p>
|
2004-04-12 16:16:46 +02:00
|
|
|
</body>
|
2003-12-30 02:19:52 +01:00
|
|
|
</html>
|
