shorewall_code/Shorewall-common/releasenotes.txt

Shorewall 4.1 Patch Release 0.

----------------------------------------------------------------------------
               R E L E A S E  4 . 1  H I G H L I G H T S
----------------------------------------------------------------------------
1) Support is included for multiple internet providers through the same
   ethernet interface.

2) Support for NFLOG has been added.

Problems corrected in Shorewall 4.1.1.

1)  Previously, incorrect output was generated by parameter lists to
    ULOG or NFLOG.

2)  Specifying NFQUEUE(<queue-number>) in the POLICY column of the
    policy file resulted in an error.


Other changes in Shorewall 4.1.1.

None.

New Features in Shorewall 4.1.

1) Shorewall 4.1.0 contains experimental support for multiple Internet
   providers through a single ethernet interface. Configuring two
   providers through a single interface differs from two providers
   through two interfaces in several ways.

   a) Only ethernet (or ethernet-like) interfaces can be used. For
      inbound traffic, the MAC addresses of the gateway routers is used
      to determine which provider a packet was received through. Note
      that only routed traffic can be categorized using this technique.

   b) The 'shared' provider option must be specified for both providers.

   c) Entries in /etc/shorewall/masq must be qualified by the provider
      name (or number).

   d) This feature requires Realm Match support in your kernel and
      iptables. If you use a capabilities file, you need to regenerate
      the file with Shorewall 4.0.6 or Shorewall-lite 4.0.6.

    Example:

    Providers Blarg (1) and Avvanta (2) are both connected to
    eth0. The firewall's IP address with Blarg is 206.124.146.176
    (gateway 206.124.146.254) and the IP address from Avvanta is
    130.252.144.8 (gateway 130.252.144.254).

    /etc/shorewall/providers:

       #PROVIDER   NUMBER  MARK    DUPLICATE       GATEWAY         OPTIONS
       Blarg       1       1       main            206.124.146.254 shared,...
       Avvanta     2       2       main            130.252.144.254 shared,...

    /etc/shorewall/masq:

       #INTERFACE          SOURCE          ADDRESS
       eth0(Blarg)         130.252.144.254 206.124.146.176
       eth0(Avvanta)       206.124.146.176 130.252.144.254
       eth0(Blarg)         eth1            206.124.146.176
       eth0(Avvanta)       eth1            130.252.144.254

2)  You may now include the name of a table (nat, mangle or filter) in
    a 'shorewall refresh' command by following the name with a colon
    (e.g., mangle:). This causes all non-builtin chains in the table to
    be reloaded.

    Example:

	shorewall refresh nat:

3)  When no chain name is given to the 'shorewall refresh' command, the
    mangle table is refreshed along with the blacklist chain (if
    any). This allows you to modify /etc/shorewall/tcrules and install
    the changes using 'shorewall refresh'.

4)  Support for the NFLOG log target has been added. NFLOG is a
    successor to ULOG. In addition, both ULOG and NFLOG may be followed
    by a list of up to three numbers in parentheses.

    The first number specifies the netlink group (1-32). If omitted
    (e.g., NFLOG(,0,10)) then a value of 1 is assumed.

    The second number specifies the maximum number of bytes to copy. If
    omitted, 0 (no limit) is assumed.

    The third number specifies the number of log messages that should
    be buffered in the kernel before they are sent to user space. The
    default is 1.

    Examples:

    /etc/shorewall/shorewall.conf:

	MACLIST_LOG_LEVEL=NFLOG(1,0,1)

    /etc/shorewall/rules:

	ACCEPT:NFLOG(1,0,1) vpn fw tcp ssh,time,631,8080

5)  Shorewall-perl 4.1.0 implements an alternative syntax for macro
    parameters and for the NFQUEUE queue number. Rather than following
    the macro name (or NFQUEUE) with a slash ("/") and the parameter,
    the parameter may be enclosed in parentheses.

    Examples -- each pair shown below are equivalent:

    DNS/ACCEPT	     DNS(ACCEPT)
    NFQUEUE/3	     NFQUEUE(3)
    
    The old syntax is still be accepted but will cease to be documented
    in some future Shorewall release.