2002-05-01 01:13:15 +02:00
|
|
|
##############################################################################
|
2003-02-15 01:09:44 +01:00
|
|
|
# /etc/shorewall/shorewall.conf V1.4 - Change the following variables to
|
2002-05-01 01:13:15 +02:00
|
|
|
# match your setup
|
|
|
|
#
|
2003-02-23 15:10:37 +01:00
|
|
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# This file should be placed in /etc/shorewall
|
|
|
|
#
|
2003-01-31 19:04:57 +01:00
|
|
|
# (c) 1999,2000,2001,2002,2003 - Tom Eastep (teastep@shorewall.net)
|
2002-05-01 01:13:15 +02:00
|
|
|
##############################################################################
|
2003-02-08 21:58:44 +01:00
|
|
|
# L O G G I N G
|
|
|
|
##############################################################################
|
2003-01-07 00:01:23 +01:00
|
|
|
#
|
2003-02-23 15:10:37 +01:00
|
|
|
# General note about log levels. Log levels are a method of describing
|
2002-12-13 05:06:24 +01:00
|
|
|
# to syslog (8) the importance of a message and a number of parameters
|
|
|
|
# in this file have log levels as their value.
|
|
|
|
#
|
|
|
|
# Valid levels are:
|
|
|
|
#
|
|
|
|
# 7 debug
|
|
|
|
# 6 info
|
|
|
|
# 5 notice
|
|
|
|
# 4 warning
|
|
|
|
# 3 err
|
|
|
|
# 2 crit
|
|
|
|
# 1 alert
|
|
|
|
# 0 emerg
|
|
|
|
#
|
|
|
|
# For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
2003-02-23 15:10:37 +01:00
|
|
|
# log messages are generated by NetFilter and are logged using facility
|
2002-12-21 19:18:45 +01:00
|
|
|
# 'kern' and the level that you specifify. If you are unsure of the level
|
2002-12-13 05:06:24 +01:00
|
|
|
# to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
|
|
|
# number.
|
|
|
|
#
|
2003-02-23 15:10:37 +01:00
|
|
|
# If you have build your kernel with ULOG target support, you may also
|
2002-12-13 05:06:24 +01:00
|
|
|
# specify a log level of ULOG (must be all caps). Rather than log its
|
|
|
|
# messages to syslogd, Shorewall will direct netfilter to log the messages
|
|
|
|
# via the ULOG target which will send them to a process called 'ulogd'.
|
2003-02-23 15:10:37 +01:00
|
|
|
# ulogd is available from http://www.gnumonks.org/projects/ulogd and can be
|
2002-12-13 05:06:24 +01:00
|
|
|
# configured to log all Shorewall message to their own log file
|
|
|
|
################################################################################
|
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# LOG FILE LOCATION
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# This variable tells the /sbin/shorewall program where to look for Shorewall
|
|
|
|
# log messages. If not set or set to an empty string (e.g., LOGFILE="") then
|
|
|
|
# /var/log/messages is assumed.
|
2002-07-31 15:58:53 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# WARNING: The LOGFILE variable simply tells the 'shorewall' program where to
|
|
|
|
# look for Shorewall messages.It does NOT control the destination for
|
|
|
|
# these messages. For information about how to do that, see
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# http://www.shorewall.net/shorewall_logging.html
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
LOGFILE=/var/log/messages
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2003-04-25 18:22:18 +02:00
|
|
|
#
|
|
|
|
# LOG MARKER
|
|
|
|
#
|
|
|
|
# Used to identify Shorewall log messages. If you are using fireparse, you must
|
|
|
|
# set this to "fp=Shorewall:". You may not use the ULOG level with fireparse and
|
|
|
|
# you must not embed white space in the LOGMARKER value.
|
|
|
|
|
|
|
|
LOGMARKER="Shorewall:"
|
|
|
|
|
2002-07-31 15:58:53 +02:00
|
|
|
#
|
|
|
|
# LOG RATE LIMITING
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# The next two variables can be used to control the amount of log output
|
|
|
|
# generated. LOGRATE is expressed as a number followed by an optional
|
|
|
|
# `/second', `/minute', `/hour', or `/day' suffix and specifies the maximum
|
|
|
|
# rate at which a particular message will occur. LOGBURST determines the
|
|
|
|
# maximum initial burst size that will be logged. If set empty, the default
|
|
|
|
# value of 5 will be used.
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# Example:
|
|
|
|
#
|
|
|
|
# LOGRATE=10/minute
|
|
|
|
# LOGBURST=5
|
|
|
|
#
|
2002-05-01 01:13:15 +02:00
|
|
|
# If BOTH variables are set empty then logging will not be rate-limited.
|
|
|
|
#
|
|
|
|
|
2002-06-02 19:05:51 +02:00
|
|
|
LOGRATE=
|
|
|
|
LOGBURST=
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2002-07-31 15:58:53 +02:00
|
|
|
#
|
|
|
|
# LEVEL AT WHICH TO LOG 'UNCLEAN' PACKETS
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# This variable determines the level at which Mangled/Invalid packets are logged
|
|
|
|
# under the 'dropunclean' interface option. If you set this variable to an
|
|
|
|
# empty value (e.g., LOGUNCLEAN= ), Mangled/Invalid packets will be dropped
|
|
|
|
# silently.
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# The value of this variable also determines the level at which Mangled/Invalid
|
|
|
|
# packets are logged under the 'logunclean' interface option. If the variable
|
|
|
|
# is empty, these packets will still be logged at the 'info' level.
|
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# See the comment at the top of this section for a description of log levels
|
2002-12-13 05:06:24 +01:00
|
|
|
#
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
LOGUNCLEAN=info
|
|
|
|
|
2002-07-31 15:58:53 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# BLACKLIST LOG LEVEL
|
2002-07-31 15:58:53 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# Set this variable to the syslogd level that you want blacklist packets logged
|
|
|
|
# (beware of DOS attacks resulting from such logging). If not set, no logging
|
|
|
|
# of blacklist packets occurs.
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# See the comment at the top of this section for a description of log levels
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
BLACKLIST_LOGLEVEL=
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
#
|
|
|
|
# LOGGING 'New not SYN' rejects
|
|
|
|
#
|
|
|
|
# This variable only has an effect when NEWNOTSYN=No (see below).
|
|
|
|
#
|
|
|
|
# When a TCP packet that does not have the SYN flag set and the ACK and RST
|
|
|
|
# flags clear then unless the packet is part of an established connection,
|
2003-02-23 15:10:37 +01:00
|
|
|
# it will be rejected by the firewall. If you want these rejects logged,
|
2003-02-08 21:58:44 +01:00
|
|
|
# then set LOGNEWNOTSYN to the syslog log level at which you want them logged.
|
|
|
|
#
|
|
|
|
# See the comment at the top of this section for a description of log levels
|
|
|
|
#
|
|
|
|
# Example: LOGNEWNOTSYN=debug
|
|
|
|
|
|
|
|
|
|
|
|
LOGNEWNOTSYN=
|
|
|
|
|
|
|
|
#
|
|
|
|
# MAC List Log Level
|
|
|
|
#
|
|
|
|
# Specifies the logging level for connection requests that fail MAC
|
|
|
|
# verification. If set to the empty value (MACLIST_LOG_LEVEL="") then
|
2003-02-23 15:10:37 +01:00
|
|
|
# such connection requests will not be logged.
|
2003-02-08 21:58:44 +01:00
|
|
|
#
|
|
|
|
# See the comment at the top of this section for a description of log levels
|
2003-02-23 15:10:37 +01:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
|
|
|
|
MACLIST_LOG_LEVEL=info
|
|
|
|
|
|
|
|
#
|
|
|
|
# TCP FLAGS Log Level
|
|
|
|
#
|
|
|
|
# Specifies the logging level for packets that fail TCP Flags
|
|
|
|
# verification. If set to the empty value (TCP_FLAGS_LOG_LEVEL="") then
|
2003-02-23 15:10:37 +01:00
|
|
|
# such packets will not be logged.
|
2003-02-08 21:58:44 +01:00
|
|
|
#
|
|
|
|
# See the comment at the top of this section for a description of log levels
|
2003-02-23 15:10:37 +01:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
|
|
|
|
TCP_FLAGS_LOG_LEVEL=info
|
|
|
|
|
|
|
|
#
|
|
|
|
# RFC1918 Log Level
|
|
|
|
#
|
|
|
|
# Specifies the logging level for packets that fail RFC 1918
|
|
|
|
# verification. If set to the empty value (RFC1918_LOG_LEVEL="") then
|
|
|
|
# RFC1918_LOG_LEVEL=info is assumed.
|
|
|
|
#
|
|
|
|
# See the comment at the top of this section for a description of log levels
|
2003-02-23 15:10:37 +01:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
|
|
|
|
RFC1918_LOG_LEVEL=info
|
|
|
|
|
|
|
|
################################################################################
|
|
|
|
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
|
|
|
|
################################################################################
|
|
|
|
#
|
|
|
|
# PATH - Change this if you want to change the order in which Shorewall
|
2003-02-23 15:10:37 +01:00
|
|
|
# searches directories for executable files.
|
2003-02-08 21:58:44 +01:00
|
|
|
#
|
|
|
|
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
|
|
|
|
|
|
|
|
# SUBSYSTEM LOCK FILE
|
|
|
|
#
|
|
|
|
# Set this to the name of the lock file expected by your init scripts. For
|
|
|
|
# RedHat, this should be /var/lock/subsys/shorewall. On Debian, it
|
|
|
|
# should be /var/state/shorewall. If your init scripts don't use lock files,
|
|
|
|
# set this to "".
|
|
|
|
#
|
|
|
|
|
|
|
|
SUBSYSLOCK=/var/lock/subsys/shorewall
|
|
|
|
|
|
|
|
#
|
|
|
|
# SHOREWALL TEMPORARY STATE DIRECTORY
|
|
|
|
#
|
|
|
|
# This is the directory where the firewall maintains state information while
|
|
|
|
# it is running
|
|
|
|
#
|
|
|
|
|
|
|
|
STATEDIR=/var/lib/shorewall
|
|
|
|
|
|
|
|
#
|
|
|
|
# KERNEL MODULE DIRECTORY
|
|
|
|
#
|
|
|
|
# If your netfilter kernel modules are in a directory other than
|
|
|
|
# /lib/modules/`uname -r`/kernel/net/ipv4/netfilter then specify that
|
|
|
|
# directory in this variable. Example: MODULESDIR=/etc/modules.
|
|
|
|
|
|
|
|
MODULESDIR=
|
|
|
|
|
|
|
|
################################################################################
|
|
|
|
# F I R E W A L L O P T I O N S
|
|
|
|
################################################################################
|
|
|
|
|
|
|
|
# NAME OF THE FIREWALL ZONE
|
|
|
|
#
|
|
|
|
# Name of the firewall zone -- if not set or if set to an empty string, "fw"
|
|
|
|
# is assumed.
|
|
|
|
#
|
|
|
|
FW=fw
|
|
|
|
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# ENABLE NAT SUPPORT
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# You probally want yes here. Only gateways not doing NAT in any form, like
|
|
|
|
# SNAT,DNAT masquerading, port forwading etc. should say "no" here.
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
NAT_ENABLED=Yes
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# ENABLE MANGLE SUPPORT
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# If you say "no" here, Shorewall will ignore the /etc/shorewall/tos file
|
|
|
|
# and will not initialize the mangle table when starting or stopping
|
|
|
|
# your firewall. You must enable mangling if you want Traffic Shaping
|
|
|
|
# (see TC_ENABLED below).
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
MANGLE_ENABLED=Yes
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# ENABLE IP FORWARDING
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# If you say "On" or "on" here, IPV4 Packet Forwarding is enabled. If you
|
|
|
|
# say "Off" or "off", packet forwarding will be disabled. You would only want
|
|
|
|
# to disable packet forwarding if you are installing Shorewall on a
|
|
|
|
# standalone system or if you want all traffic through the Shorewall system
|
|
|
|
# to be handled by proxies.
|
|
|
|
#
|
|
|
|
# If you set this variable to "Keep" or "keep", Shorewall will neither
|
|
|
|
# enable nor disable packet forwarding.
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
IP_FORWARDING=On
|
2002-07-31 15:58:53 +02:00
|
|
|
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# AUTOMATICALLY ADD NAT IP ADDRESSES
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# If you say "Yes" or "yes" here, Shorewall will automatically add IP addresses
|
2002-05-01 01:13:15 +02:00
|
|
|
# for each NAT external address that you give in /etc/shorewall/nat. If you say
|
|
|
|
# "No" or "no", you must add these aliases youself.
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
ADD_IP_ALIASES=Yes
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# AUTOMATICALLY ADD SNAT IP ADDRESSES
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# If you say "Yes" or "yes" here, Shorewall will automatically add IP addresses
|
2002-05-01 01:13:15 +02:00
|
|
|
# for each SNAT external address that you give in /etc/shorewall/masq. If you say
|
2002-10-21 20:13:49 +02:00
|
|
|
# "No" or "no", you must add these aliases youself. LEAVE THIS SET TO "No" unless
|
|
|
|
# you are sure that you need it -- most people don't!!!
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
ADD_SNAT_ALIASES=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# ENABLE TRAFFIC SHAPING
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# If you say "Yes" or "yes" here, Traffic Shaping is enabled in the firewall. If
|
|
|
|
# you say "No" or "no" then traffic shaping is not enabled. If you enable traffic
|
|
|
|
# shaping you must have iproute[2] installed (the "ip" and "tc" utilities) and
|
|
|
|
# you must enable packet mangling above.
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
TC_ENABLED=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# Clear Traffic Shapping/Control
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# If this option is set to 'No' then Shorewall won't clear the current
|
|
|
|
# traffic control rules during [re]start. This setting is intended
|
|
|
|
# for use by people that prefer to configure traffic shaping when
|
|
|
|
# the network interfaces come up rather than when the firewall
|
|
|
|
# is started. If that is what you want to do, set TC_ENABLED=Yes and
|
|
|
|
# CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. That
|
|
|
|
# way, your traffic shaping rules can still use the 'fwmark'
|
|
|
|
# classifier based on packet marking defined in /etc/shorewall/tcrules.
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# If omitted, CLEAR_TC=Yes is assumed.
|
|
|
|
|
|
|
|
CLEAR_TC=Yes
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# Mark Packets in the forward chain
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# When processing the tcrules file, Shorewall normally marks packets in the
|
|
|
|
# PREROUTING chain. To cause Shorewall to use the FORWARD chain instead, set
|
2003-02-23 15:10:37 +01:00
|
|
|
# this to "Yes". If not specified or if set to the empty value (e.g.,
|
2003-02-08 21:58:44 +01:00
|
|
|
# MARK_IN_FORWARD_CHAIN="") then MARK_IN_FORWARD_CHAIN=No is assumed.
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# Marking packets in the FORWARD chain has the advantage that inbound
|
|
|
|
# packets destined for Masqueraded/SNATed local hosts have had their destination
|
|
|
|
# address rewritten so they can be marked based on their destination. When
|
2003-02-23 15:10:37 +01:00
|
|
|
# packets are marked in the PREROUTING chain, packets destined for
|
2003-02-08 21:58:44 +01:00
|
|
|
# Masqueraded/SNATed local hosts still have a destination address corresponding
|
|
|
|
# to the firewall's external interface.
|
2002-12-13 05:06:24 +01:00
|
|
|
#
|
2003-02-08 21:58:44 +01:00
|
|
|
# Note: Older kernels do not support marking packets in the FORWARD chain and
|
|
|
|
# setting this variable to Yes may cause startup problems.
|
|
|
|
|
|
|
|
MARK_IN_FORWARD_CHAIN=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# MSS CLAMPING
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# Set this variable to "Yes" or "yes" if you want the TCP "Clamp MSS to PMTU"
|
|
|
|
# option. This option is most commonly required when your internet
|
|
|
|
# interface is some variant of PPP (PPTP or PPPoE). Your kernel must
|
2002-05-04 20:38:49 +02:00
|
|
|
# have CONFIG_IP_NF_TARGET_TCPMSS set.
|
|
|
|
#
|
|
|
|
# [From the kernel help:
|
|
|
|
#
|
|
|
|
# This option adds a `TCPMSS' target, which allows you to alter the
|
|
|
|
# MSS value of TCP SYN packets, to control the maximum size for that
|
|
|
|
# connection (usually limiting it to your outgoing interface's MTU
|
|
|
|
# minus 40).
|
|
|
|
#
|
|
|
|
# This is used to overcome criminally braindead ISPs or servers which
|
|
|
|
# block ICMP Fragmentation Needed packets. The symptoms of this
|
|
|
|
# problem are that everything works fine from your Linux
|
|
|
|
# firewall/router, but machines behind it can never exchange large
|
|
|
|
# packets:
|
|
|
|
# 1) Web browsers connect, then hang with no data received.
|
|
|
|
# 2) Small mail works fine, but large emails hang.
|
|
|
|
# 3) ssh works fine, but scp hangs after initial handshaking.
|
|
|
|
# ]
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# If left blank, or set to "No" or "no", the option is not enabled.
|
|
|
|
#
|
2002-06-02 19:05:51 +02:00
|
|
|
CLAMPMSS=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# ROUTE FILTERING
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# Set this variable to "Yes" or "yes" if you want kernel route filtering on all
|
|
|
|
# interfaces (anti-spoofing measure).
|
|
|
|
#
|
2002-05-04 20:38:49 +02:00
|
|
|
# If this variable is not set or is set to the empty value, "No" is assumed.
|
2002-07-31 15:58:53 +02:00
|
|
|
# In that case, you can still enable route filtering on individual interfaces
|
|
|
|
# in the /etc/shorewall/interfaces file.
|
2002-05-04 20:38:49 +02:00
|
|
|
|
2002-06-02 19:05:51 +02:00
|
|
|
ROUTE_FILTER=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# NAT BEFORE RULES
|
2002-05-01 01:13:15 +02:00
|
|
|
#
|
|
|
|
# Shorewall has traditionally processed static NAT rules before port forwarding
|
|
|
|
# rules. If you would like to reverse the order, set this variable to "No".
|
2002-05-04 20:38:49 +02:00
|
|
|
#
|
|
|
|
# If this variable is not set or is set to the empty value, "Yes" is assumed.
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2002-06-02 19:05:51 +02:00
|
|
|
NAT_BEFORE_RULES=Yes
|
|
|
|
|
2002-07-31 15:58:53 +02:00
|
|
|
# MULTIPORT support
|
2002-06-02 19:05:51 +02:00
|
|
|
#
|
2002-06-03 01:14:51 +02:00
|
|
|
# If your kernel includes the multiport match option
|
|
|
|
# (CONFIG_IP_NF_MATCH_MULTIPORT), you may enable it's use here. When this
|
|
|
|
# option is enabled by setting it's value to "Yes" or "yes":
|
2002-06-02 19:05:51 +02:00
|
|
|
#
|
2002-06-02 21:47:17 +02:00
|
|
|
# 1) If you list more that 15 ports in a comma-seperated list in
|
|
|
|
# /etc/shorewall/rules, Shorewall will not use the multiport option
|
|
|
|
# but will generate a separate rule for each element of each port
|
|
|
|
# list.
|
2002-06-02 19:05:51 +02:00
|
|
|
# 2) If you include a port range (<low port>:<high port>) in the
|
|
|
|
# rule, Shorewall will not use the multiport option but will generate
|
|
|
|
# a separate rule for each element of each port list.
|
2002-06-02 21:47:17 +02:00
|
|
|
#
|
2002-06-03 01:14:51 +02:00
|
|
|
# See the /etc/shorewall/rules file for additional information on this option.
|
|
|
|
#
|
2002-06-02 21:47:17 +02:00
|
|
|
# if this variable is not set or is set to the empty value, "No" is assumed.
|
2002-06-02 19:05:51 +02:00
|
|
|
|
|
|
|
MULTIPORT=No
|
2002-05-01 01:13:15 +02:00
|
|
|
|
2002-07-31 15:58:53 +02:00
|
|
|
# DNAT IP ADDRESS DETECTION
|
2002-07-09 17:44:49 +02:00
|
|
|
#
|
|
|
|
# Normally when Shorewall encounters the following rule:
|
|
|
|
#
|
|
|
|
# DNAT net loc:192.168.1.3 tcp 80
|
|
|
|
#
|
|
|
|
# it will forward TCP port 80 connections from the net to 192.168.1.3
|
2003-02-23 15:10:37 +01:00
|
|
|
# REGARDLESS OF THE ORIGINAL DESTINATION ADDRESS. This behavior is
|
2002-07-09 17:44:49 +02:00
|
|
|
# convenient for two reasons:
|
|
|
|
#
|
|
|
|
# a) If the the network interface has a dynamic IP address, the
|
|
|
|
# firewall configuration will work even when the address
|
|
|
|
# changes.
|
|
|
|
#
|
2003-02-23 15:10:37 +01:00
|
|
|
# b) It saves having to configure the IP address in the rule
|
2002-07-09 17:44:49 +02:00
|
|
|
# while still allowing the firewall to be started before the
|
|
|
|
# internet interface is brought up.
|
|
|
|
#
|
|
|
|
# This default behavior can also have a negative effect. If the
|
2003-02-23 15:10:37 +01:00
|
|
|
# internet interface has more than one IP address then the above
|
|
|
|
# rule will forward connection requests on all of these addresses;
|
2002-07-09 17:44:49 +02:00
|
|
|
# that may not be what is desired.
|
|
|
|
#
|
2002-07-09 23:21:28 +02:00
|
|
|
# By setting DETECT_DNAT_IPADDRS=Yes, rules such as the above will apply
|
2002-07-09 17:44:49 +02:00
|
|
|
# only if the original destination address is the primary IP address of
|
2002-07-09 23:21:28 +02:00
|
|
|
# one of the interfaces associated with the source zone. Note that this
|
|
|
|
# requires all interfaces to the source zone to be up when the firewall
|
2003-02-23 15:10:37 +01:00
|
|
|
# is [re]started.
|
2002-07-09 17:44:49 +02:00
|
|
|
|
2002-07-09 23:21:28 +02:00
|
|
|
DETECT_DNAT_IPADDRS=No
|
2002-07-09 17:44:49 +02:00
|
|
|
|
2002-07-24 05:47:34 +02:00
|
|
|
#
|
2002-07-31 15:58:53 +02:00
|
|
|
# MUTEX TIMEOUT
|
2002-07-24 05:47:34 +02:00
|
|
|
#
|
|
|
|
# The value of this variable determines the number of seconds that programs
|
|
|
|
# will wait for exclusive access to the Shorewall lock file. After the number
|
|
|
|
# of seconds corresponding to the value of this variable, programs will assume
|
|
|
|
# that the last program to hold the lock died without releasing the lock.
|
|
|
|
#
|
|
|
|
# If not set or set to the empty value, a value of 60 (60 seconds) is assumed.
|
2002-07-24 16:34:28 +02:00
|
|
|
#
|
|
|
|
# An appropriate value for this parameter would be twice the length of time
|
|
|
|
# that it takes your firewall system to process a "shorewall restart" command.
|
2002-07-24 05:47:34 +02:00
|
|
|
|
|
|
|
MUTEX_TIMEOUT=60
|
|
|
|
|
2002-08-23 20:51:55 +02:00
|
|
|
#
|
|
|
|
# NEWNOTSYN
|
|
|
|
#
|
|
|
|
# If this variable is set to "No" or "no", then When a TCP packet that does
|
|
|
|
# not have the SYN flag set and the ACK and RST flags clear then unless the
|
2002-09-01 20:14:40 +02:00
|
|
|
# packet is part of an established connection, it will be dropped by the
|
2002-08-23 20:51:55 +02:00
|
|
|
# firewall
|
|
|
|
#
|
|
|
|
# If this variable is set to "Yes" or "yes" then such packets will not be
|
2002-09-01 20:14:40 +02:00
|
|
|
# dropped but will pass through the normal rule processing.
|
2002-08-23 20:51:55 +02:00
|
|
|
#
|
|
|
|
# Users with a High-availability setup with two firewall's and one acting
|
|
|
|
# as a backup should set NEWNOTSYN=Yes. Users with asymmetric routing may
|
|
|
|
# also need to select NEWNOTSYN=Yes.
|
2003-02-23 15:10:37 +01:00
|
|
|
|
2002-08-23 20:51:55 +02:00
|
|
|
NEWNOTSYN=No
|
|
|
|
|
2003-02-08 21:58:44 +01:00
|
|
|
################################################################################
|
|
|
|
# P A C K E T D I S P O S I T I O N
|
|
|
|
################################################################################
|
|
|
|
#
|
|
|
|
# BLACKLIST DISPOSITION
|
|
|
|
#
|
|
|
|
# Set this variable to the action that you want to perform on packets from
|
|
|
|
# Blacklisted systems. Must be DROP or REJECT. If not set or set to empty,
|
|
|
|
# DROP is assumed.
|
|
|
|
#
|
|
|
|
BLACKLIST_DISPOSITION=DROP
|
|
|
|
|
2002-10-22 20:07:52 +02:00
|
|
|
#
|
|
|
|
# MAC List Disposition
|
|
|
|
#
|
|
|
|
# This variable determines the disposition of connection requests arriving
|
|
|
|
# on interfaces that have the 'maclist' option and that are from a device
|
|
|
|
# that is not listed for that interface in /etc/shorewall/maclist. Valid
|
|
|
|
# values are ACCEPT, DROP and REJECT. If not specified or specified as
|
|
|
|
# empty (MACLIST_DISPOSITION="") then REJECT is assumed
|
|
|
|
|
|
|
|
MACLIST_DISPOSITION=REJECT
|
|
|
|
|
2002-11-10 22:34:20 +01:00
|
|
|
#
|
|
|
|
# TCP FLAGS Disposition
|
|
|
|
#
|
2003-02-23 15:10:37 +01:00
|
|
|
# This variable determins the disposition of packets having an invalid
|
2002-11-10 22:34:20 +01:00
|
|
|
# combination of TCP flags that are received on interfaces having the
|
|
|
|
# 'tcpflags' option specified in /etc/shorewall/interfaces. If not specified
|
|
|
|
# or specified as empty (TCP_FLAGS_DISPOSITION="") then DROP is assumed.
|
|
|
|
|
|
|
|
TCP_FLAGS_DISPOSITION=DROP
|
|
|
|
|
2002-05-01 01:13:15 +02:00
|
|
|
#LAST LINE -- DO NOT REMOVE
|