2004-04-12 16:16:46 +02:00
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
2003-12-30 02:19:52 +01:00
|
|
|
<html>
|
|
|
|
|
<head>
|
2004-04-12 16:16:46 +02:00
|
|
|
<meta content="HTML Tidy, see www.w3.org" name="generator">
|
|
|
|
|
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
|
|
|
|
|
<title>Shoreline Firewall (Shorewall) 2.0</title>
|
|
|
|
|
<base target="_self">
|
2003-12-30 02:19:52 +01:00
|
|
|
</head>
|
2004-04-12 16:16:46 +02:00
|
|
|
<body>
|
|
|
|
|
<div>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h1>Shorewall 2.0</h1>
|
|
|
|
|
<span style="font-weight: bold;">Tom Eastep</span><br>
|
|
|
|
|
<br>
|
|
|
|
|
The information on this site
|
2004-04-12 16:16:46 +02:00
|
|
|
applies only to 2.0.x releases of
|
|
|
|
|
Shorewall. For older versions:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<ul>
|
|
|
|
|
<li>The 1.4 site is <a href="http://www.shorewall.net/1.4"
|
2004-04-12 16:16:46 +02:00
|
|
|
target="_top">here.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</a></li>
|
|
|
|
|
<li>The 1.3 site is <a href="http://www.shorewall.net/1.3"
|
2004-04-12 16:16:46 +02:00
|
|
|
target="_top">here.</a></li>
|
2004-05-28 19:24:32 +02:00
|
|
|
<li>The 1.2 site is <a href="http://shorewall.net/1.2/" target="_top">here</a>.</li>
|
|
|
|
|
</ul>
|
|
|
|
|
Copyright © 2001-2004 Thomas M. Eastep<br>
|
|
|
|
|
<div>
|
|
|
|
|
<div class="legalnotice">
|
|
|
|
|
<p>Permission is granted to copy, distribute and/or modify this
|
|
|
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
|
|
|
1.2 or any later version published by the Free Software Foundation;
|
|
|
|
|
with no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
|
|
|
Texts. A copy of the license is included in the section entitled “<span
|
|
|
|
|
class="quote"><a
|
|
|
|
|
href="file:///vfat/Ursa/Shorewall/Shorewall-Website/GnuCopyright.htm"
|
|
|
|
|
target="_self">GNU Free
|
|
|
|
|
Documentation License</a></span>”.</p>
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div>
|
2004-06-03 17:06:11 +02:00
|
|
|
<p class="pubdate">2004-06-03<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</p>
|
|
|
|
|
<hr style="width: 100%; height: 2px;"></div>
|
|
|
|
|
<h3>Table of Contents</h3>
|
|
|
|
|
<div style="margin-left: 40px;"><a href="#Intro">Introduction to
|
|
|
|
|
Shorewall</a><br>
|
|
|
|
|
<div style="margin-left: 40px;"><a href="#Glossary">Glossary</a><br>
|
|
|
|
|
<a href="#WhatIs">What is Shorewall?</a><br>
|
|
|
|
|
<a href="#GettingStarted">Getting Started with Shorewall</a><br>
|
|
|
|
|
<a href="#Info">Looking for Information?</a><br>
|
|
|
|
|
<a href="#Mandrake">Running Shorewall on Mandrake® with a
|
|
|
|
|
two-interface setup?</a><br>
|
|
|
|
|
<a href="#License">License</a><br>
|
|
|
|
|
</div>
|
|
|
|
|
<a href="#News">News</a><br>
|
2004-06-02 17:25:56 +02:00
|
|
|
<div style="margin-left: 40px;"><a href="#Downtime"><span
|
|
|
|
|
style="font-weight: bold;">shorewall.net Downtime</span></a><br>
|
2004-06-03 17:06:11 +02:00
|
|
|
<a href="#2_0_2f">Shorewall 2.0.2f</a><br>
|
2004-06-02 17:25:56 +02:00
|
|
|
<a href="#2_0_2e">Shorewall 2.0.2e</a><br>
|
|
|
|
|
<a href="#2_0_2d">Shorewall 2.0.2d</a><br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<a href="#2_0_2c">Shorewall 2.0.2c</a><br>
|
|
|
|
|
<a href="#2_0_2b">Shorewall 2.0.2b</a><br>
|
|
|
|
|
<a href="#2_0_2a">Shorewall 2.0.2a</a><br>
|
|
|
|
|
<a href="#2_0_2">Shorewall 2.0.2</a><br>
|
|
|
|
|
<a href="#LinuxFest">Presentation at LinuxFest NW</a><br>
|
|
|
|
|
</div>
|
|
|
|
|
<a href="#Leaf">Leaf</a><br>
|
|
|
|
|
<a href="#Donations">Donations</a><br>
|
|
|
|
|
</div>
|
|
|
|
|
<h2><a name="Intro"></a>Introduction to Shorewall</h2>
|
|
|
|
|
<h3><a name="Glossary"></a>Glossary</h3>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a href="http://www.netfilter.org" target="_top">Netfilter</a>
|
2004-04-12 16:16:46 +02:00
|
|
|
- the
|
|
|
|
|
packet filter facility built into the 2.4 and later Linux kernels.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
<li>ipchains - the packet filter facility built into the 2.2
|
2004-04-12 16:16:46 +02:00
|
|
|
Linux kernels. Also the name of the utility program used to configure
|
|
|
|
|
and control that facility. Netfilter can be used in ipchains
|
|
|
|
|
compatibility mode.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
<li>iptables - the utility program used to configure and
|
2004-04-12 16:16:46 +02:00
|
|
|
control Netfilter. The term 'iptables' is often used to refer to the
|
|
|
|
|
combination of iptables+Netfilter (with Netfilter not in ipchains
|
|
|
|
|
compatibility mode).</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
</ul>
|
|
|
|
|
<h3><a name="WhatIs"></a>What is Shorewall?</h3>
|
|
|
|
|
<div style="margin-left: 40px;">The Shoreline Firewall, more
|
2004-04-12 16:16:46 +02:00
|
|
|
commonly known as "Shorewall", is
|
2004-05-14 00:07:06 +02:00
|
|
|
a high-level tool for configuring Netfilter. You describe your
|
2004-04-12 16:16:46 +02:00
|
|
|
firewall/gateway requirements using entries in a set of configuration
|
|
|
|
|
files. Shorewall reads those configuration files and with the help of
|
|
|
|
|
the iptables utility, Shorewall configures Netfilter to match your
|
|
|
|
|
requirements. Shorewall can be used on a dedicated firewall system, a
|
|
|
|
|
multi-function gateway/router/server or on a standalone GNU/Linux
|
|
|
|
|
system. Shorewall does not use Netfilter's ipchains compatibility mode
|
|
|
|
|
and can thus take advantage of Netfilter's <a
|
|
|
|
|
href="http://www.cs.princeton.edu/%7Ejns/security/iptables/iptables_conntrack.html"
|
|
|
|
|
target="_top">connection
|
|
|
|
|
state tracking
|
|
|
|
|
capabilities</a>.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-04-12 16:16:46 +02:00
|
|
|
Shorewall is <span style="text-decoration: underline;">not</span> a
|
|
|
|
|
daemon. Once Shorewall has configured Netfilter, it's job is complete.
|
|
|
|
|
After that, there is no Shorewall code running although the <a
|
|
|
|
|
href="starting_and_stopping_shorewall.htm">/sbin/shorewall
|
|
|
|
|
program can be used at any time to monitor the Netfilter firewall</a>.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</div>
|
|
|
|
|
<h3><a name="GettingStarted"></a>Getting Started with Shorewall</h3>
|
|
|
|
|
<div style="margin-left: 40px;">New to Shorewall? Start by
|
2004-04-12 16:16:46 +02:00
|
|
|
selecting the <a href="shorewall_quickstart_guide.htm">QuickStart Guide</a>
|
|
|
|
|
that most
|
2004-05-28 19:24:32 +02:00
|
|
|
closely matches your environment and follow the step by step
|
|
|
|
|
instructions.<br>
|
|
|
|
|
</div>
|
|
|
|
|
<h3><a name="Info"></a>Looking for Information?</h3>
|
|
|
|
|
<div style="margin-left: 40px;">The <a href="Documentation_Index.html">Documentation
|
2004-04-12 16:16:46 +02:00
|
|
|
Index</a> is a good place to start as is the Quick Search in the frame
|
|
|
|
|
above. </div>
|
2004-05-28 19:24:32 +02:00
|
|
|
<h3><a name="Mandrake"></a>Running Shorewall on Mandrake® with a
|
|
|
|
|
two-interface setup?</h3>
|
|
|
|
|
<div style="margin-left: 40px;">If so, the documentation on this
|
2004-04-12 16:16:46 +02:00
|
|
|
site will not apply directly
|
|
|
|
|
to your setup. If you want to use the documentation that you find here,
|
|
|
|
|
you will want to consider uninstalling what you have and installing a
|
|
|
|
|
setup that matches the documentation on this site. See the <a
|
|
|
|
|
href="two-interface.htm">Two-interface QuickStart Guide</a> for
|
|
|
|
|
details.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
<span style="font-weight: bold;">Update: </span>I've been
|
2004-04-12 16:16:46 +02:00
|
|
|
informed by Mandrake Development that this problem has been corrected
|
|
|
|
|
in Mandrake 10.0 Final (the problem still exists in the 10.0 Community
|
|
|
|
|
release).<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</div>
|
|
|
|
|
<h3><a name="License"></a>License</h3>
|
|
|
|
|
<div style="margin-left: 40px;">This program is free software;
|
2004-04-12 16:16:46 +02:00
|
|
|
you can redistribute it and/or modify it
|
|
|
|
|
under the terms of <a href="http://www.gnu.org/licenses/gpl.html">Version
|
|
|
|
|
2 of the GNU General Public License</a> as published by the Free
|
|
|
|
|
Software Foundation.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</div>
|
|
|
|
|
<p style="margin-left: 40px;">This program is distributed in the
|
2004-04-12 16:16:46 +02:00
|
|
|
hope that it will be
|
|
|
|
|
useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
General Public License for more detail.</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<div style="margin-left: 40px;"> </div>
|
|
|
|
|
<p style="margin-left: 40px;">You should have received a copy of
|
2004-04-12 16:16:46 +02:00
|
|
|
the GNU General Public
|
|
|
|
|
License along with this program; if not, write to the Free Software
|
|
|
|
|
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
2004-05-28 19:24:32 +02:00
|
|
|
<div style="margin-left: 40px;">Permission is granted to copy,
|
2004-04-12 16:16:46 +02:00
|
|
|
distribute and/or modify this document
|
|
|
|
|
under the terms of the GNU Free Documentation License, Version 1.2 or
|
|
|
|
|
any later version published by the Free Software Foundation; with no
|
|
|
|
|
Invariant Sections, with no Front-Cover, and with no Back-Cover Texts.
|
|
|
|
|
A copy of the license is included in the section entitled <a>"GNU Free
|
|
|
|
|
Documentation License"</a>. </div>
|
2004-05-28 19:24:32 +02:00
|
|
|
<p> </p>
|
|
|
|
|
<hr style="width: 100%; height: 2px;">
|
|
|
|
|
<h2><a name="News"></a>News</h2>
|
2004-06-03 17:06:11 +02:00
|
|
|
<p><b><a name="2_0_2f"></a>6/3/2004 - Shorewall 2.0.2f<br>
|
|
|
|
|
</b></p>
|
|
|
|
|
<p>Fixes one problem:<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Versions 2.0.2d and 2.0.2e fail to load kernel modules unless
|
|
|
|
|
MODULE_SUFFIX is set in shorewall.conf<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
2004-06-02 17:25:56 +02:00
|
|
|
<p><b><a name="2_0_2e"></a>6/2/2004 - Shorewall 2.0.2e<br>
|
|
|
|
|
</b></p>
|
|
|
|
|
<p>One problem corrected:<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>LOG rules within an action generate two Netfilter logging rules.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="Downtime"></a>6/1/2004 - shorewall.net Downtime<br>
|
|
|
|
|
</b></p>
|
|
|
|
|
<p><b><span style="font-weight: bold;"><span style="font-weight: bold;"></span></span></b>The
|
|
|
|
|
following systems will be down on Saturday 5 June for server rebuild.<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>shorewall.net</li>
|
|
|
|
|
<li>lists.shorewall.net</li>
|
|
|
|
|
<li>www1.shorewall.net</li>
|
|
|
|
|
<li>ftp1.shorewall.net</li>
|
|
|
|
|
<li>cvs.shorewall.net</li>
|
|
|
|
|
<li>rsync.shorewall.net</li>
|
|
|
|
|
</ul>
|
|
|
|
|
This will affect:<br>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>Shorewall site and list archives search</li>
|
|
|
|
|
<li>Mailing Lists</li>
|
|
|
|
|
<li>Mailing List Archives</li>
|
|
|
|
|
<li>CVS</li>
|
|
|
|
|
<li>Primary shorewall.net DNS</li>
|
|
|
|
|
</ul>
|
|
|
|
|
I plan to start the rebuild on Saturday morning PDT (-0700) and hope to
|
|
|
|
|
be finished by Saturday evening.<br>
|
|
|
|
|
<p><b><a name="2_0_2d"><br>
|
|
|
|
|
</a>5/28/2004 - Shorewall 2.0.2d<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</b><br>
|
|
|
|
|
One problem corrected:<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Shorewall was checking capabilities before loading kernel
|
|
|
|
|
modules. Consequently, if kernel module autoloading was disabled, the
|
|
|
|
|
capabilities were mis-detected.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="2_0_2c"></a>5/21/2004 - Shorewall 2.0.2c</b></p>
|
|
|
|
|
One problem corrected:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li> DNAT rules with a dynamic source zone don't work
|
|
|
|
|
properly. When used, these rules cause the rule to be checked against
|
|
|
|
|
ALL input, not just input from the designated zone.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="2_0_2b"></a>5/18/2004 - Shorewall 2.0.2b</b><b> </b></p>
|
|
|
|
|
<p>Corrects two problems:</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Specifying a null common action in /etc/shorewall/actions
|
|
|
|
|
(e.g., :REJECT) results in a startup error.<br>
|
|
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>If /var/lib/shorewall does not exist, shorewall start fails.<br>
|
|
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="2_0_2a"></a>5/15/2004 - Shorewall 2.0.2a</b><b> </b><br>
|
|
|
|
|
</p>
|
|
|
|
|
<p>Corrects two problems:<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Temporary restore files were not being removed from
|
|
|
|
|
/var/lib/shorewall. These files have names of the form
|
|
|
|
|
'restore-nnnnn'.
|
|
|
|
|
You can remove files that have accumulated with the command: <br>
|
|
|
|
|
<br>
|
|
|
|
|
rm -f /var/lib/shorewall/restore-[0-9]* <br>
|
|
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>The restore script did not load kernel modules. The result
|
|
|
|
|
was that after a cold load, applications like FTP and IRC DCC didn't
|
|
|
|
|
work. <br>
|
|
|
|
|
<br>
|
|
|
|
|
To correct: <br>
|
|
|
|
|
<br>
|
|
|
|
|
1) Install 2.0.2a <br>
|
|
|
|
|
2) "shorewall restart" <br>
|
|
|
|
|
3) "shorewall save" </li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="2_0_2"></a>5/13/2004 - Shorewall 2.0.2</b><b> </b></p>
|
|
|
|
|
<p>Problems Corrected since 2.0.1<br>
|
|
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>The /etc/init.d/shorewall script installed on Debian by
|
2004-05-14 00:07:06 +02:00
|
|
|
install.sh failed silently due to a missing file
|
|
|
|
|
(/usr/share/shorewall/wait4ifup). That file is not part of the normal
|
|
|
|
|
Shorewall distribution and is provided by the Debian maintainer.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
<li>A meaningless warning message out of the proxyarp file
|
2004-05-14 00:07:06 +02:00
|
|
|
processing has been eliminated.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
<li>The "shorewall delete" command now correctly removes all
|
2004-05-14 00:07:06 +02:00
|
|
|
dynamic rules pertaining to the host(s) being deleted. Thanks to Stefan
|
|
|
|
|
Engel for this correction.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
</ol>
|
|
|
|
|
Issues when migrating from Shorewall 2.0.1 to Shorewall 2.0.2:<br>
|
|
|
|
|
<ol>
|
|
|
|
|
<li>Extension Scripts -- In order for extension scripts to work
|
2004-05-14 00:07:06 +02:00
|
|
|
properly with the new iptables-save/restore integration (see New
|
|
|
|
|
Feature 1 below), some change may be required to your extension
|
|
|
|
|
scripts. If your extension scripts are executing commands other than
|
|
|
|
|
iptables then those commands must also be written to the restore file
|
|
|
|
|
(a temporary file in /var/lib/shorewall that is renamed
|
|
|
|
|
/var/lib/shorewall/restore-base at the end of the operation).<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
The following functions should be of help:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
A. save_command() -- saves the passed command to the restore file.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Example:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
save_command echo Operation
|
|
|
|
|
Complete<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
That command would simply write "echo Operation Complete"
|
|
|
|
|
to the restore file.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
B. run_and_save_command() -- saves the passed command to the restore
|
|
|
|
|
file then executes it. The return value is the exit status of the
|
|
|
|
|
command.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Example:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
run_and_save_command "echo 1 >
|
|
|
|
|
/proc/sys/net/ipv4/icmp_echo_ignore_all"<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Note that as in this example, when the command
|
|
|
|
|
involves file redirection then the entire command must be enclosed in
|
|
|
|
|
quotes. This applies to all of the functions described here.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
C. ensure_and_save_command() -- runs the passed command. If the command
|
|
|
|
|
fails, the firewall is restored to it's prior saved state and the
|
|
|
|
|
operation is terminated. If the command succeeds, the command is
|
|
|
|
|
written to the restore file.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Dynamic Zone support -- If you don't need to use the
|
2004-05-14 00:07:06 +02:00
|
|
|
"shorewall add" and "shorewall delete commands, you should set
|
|
|
|
|
DYNAMIC_ZONES=No in /etc/shorewall/shorewall.conf.</li>
|
2004-05-28 19:24:32 +02:00
|
|
|
</ol>
|
2004-04-12 16:16:46 +02:00
|
|
|
New Features:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<ol>
|
|
|
|
|
<li>Shorewall has now been integrated with
|
2004-05-14 00:07:06 +02:00
|
|
|
iptables-save/iptables-restore to provide very fast start and restart.
|
|
|
|
|
The elements of this integration are as follows:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
a) The 'shorewall save' command now saves the current configuration in
|
|
|
|
|
addition to the current dynamic blacklist. If you have dynamic zones,
|
|
|
|
|
you will want to issue 'shorewall save' when the zones are empty or the
|
|
|
|
|
current contents of the zones will be restored by the 'shorewall
|
|
|
|
|
restore' and 'shorewall -f start' commands.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
b) The 'shorewall restore' command has been added. This command
|
|
|
|
|
restores the configuration at the time of the last 'save'.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
c) The -f (fast) option has been added to 'shorewall start'. When
|
|
|
|
|
specified (e.g. 'shorewall -f start'), shorewall will perform a
|
|
|
|
|
'shorewall restore' if there is a saved configuration. If there is no
|
|
|
|
|
saved configuration, a normal 'shorewall start' is performed.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
d) The /etc/init.d/shorewall script now translates the 'start' command
|
|
|
|
|
into 'shorewall -f start' so that fast restart is possible.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
e) When a state-changing command encounters an error and there is
|
|
|
|
|
current saved configuration, that configuration will be restored
|
|
|
|
|
(currently, the firewall is placed in the 'stopped' state).<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
f) If you have previously saved the running configuration and want
|
|
|
|
|
Shorewall to discard it, use the 'shorewall forget' command. WARNING:
|
|
|
|
|
iptables 1.2.9 is broken with respect to iptables-save; if your kernel
|
|
|
|
|
has connection tracking match support, you must patch iptables 1.2.9
|
|
|
|
|
with the iptables patch availale from the Shorewall errata page.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>The previous implementation of dynamic zones was difficult
|
2004-05-14 00:07:06 +02:00
|
|
|
to maintain. I have changed the code to make dynamic zones optional
|
|
|
|
|
under the control of the DYNAMIC_ZONES option in
|
|
|
|
|
/etc/shorewall/shorewall.conf.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>In earlier Shorewall 2.0 releases, Shorewall searches in
|
2004-05-14 00:07:06 +02:00
|
|
|
order the following directories for configuration files.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
a) The directory specified in a 'try' command or specified using the -c
|
|
|
|
|
option.<br>
|
|
|
|
|
b) /etc/shorewall<br>
|
|
|
|
|
c) /usr/share/shorewall<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
In this release, the CONFIG_PATH option is added to shorewall.conf.
|
|
|
|
|
CONFIG_PATH contains a list of directory names separated by colons
|
|
|
|
|
(":"). If not set or set to a null value (e.g., CONFIG_PATH="") then
|
|
|
|
|
"CONFIG_PATH=/etc/shorewall:/usr/share/shorewall" is assumed. Now
|
|
|
|
|
Shorewall searches for shorewall.conf according to the old rules and
|
|
|
|
|
for other configuration files as follows:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
a) The directory specified in a 'try' command or specified using the -c
|
|
|
|
|
option.<br>
|
|
|
|
|
b) Each directory in $CONFIG_PATH is searched in sequence.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
In case it is not obvious, your CONFIG_PATH should include
|
|
|
|
|
/usr/share/shorewall and your shorewall.conf file must be in the
|
|
|
|
|
directory specified via -c or in a try command, in /etc/shorewall or in
|
|
|
|
|
/usr/share/shorewall.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
For distribution packagers, the default CONFIG_PATH is set in
|
|
|
|
|
/usr/share/shorewall/configpath. You can customize this file to have a
|
|
|
|
|
default that differs from mine.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Previously, in /etc/shorewall/nat a Yes (or yes) in the
|
2004-05-14 00:07:06 +02:00
|
|
|
LOCAL column would only take effect if the ALL INTERFACES column also
|
|
|
|
|
contained Yes or yes. Now, the LOCAL columns contents are treated
|
|
|
|
|
independently of the contents of the ALL INTERFACES column.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>The folks at Mandrake have created yet another kernel
|
2004-05-14 00:07:06 +02:00
|
|
|
module naming convention (module names end in "ko.gz"). As a
|
|
|
|
|
consequence, beginning with this release, if MODULE_SUFFIX isn't
|
|
|
|
|
specified in shorewall.conf, then the default value is "o gz ko o.gz
|
|
|
|
|
ko.gz".<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>An updated bogons file is included in this release.<br>
|
|
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>In /etc/shorewall/rules and in action files generated from
|
2004-05-14 00:07:06 +02:00
|
|
|
/usr/share/shorewall/action.template, rules that perform logging can
|
|
|
|
|
specify an optional "log tag". A log tag is a string of alphanumeric
|
|
|
|
|
characters and is specified by following the log level with ":" and the
|
|
|
|
|
log tag.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Example:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
ACCEPT:info:ftp
|
|
|
|
|
net dmz
|
|
|
|
|
tcp 21<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
The log tag is appended to the log prefix generated by the LOGPREFIX
|
|
|
|
|
variable in /etc/shorewall/conf. If "ACCEPT:info" generates the log
|
|
|
|
|
prefix "Shorewall:net2dmz:ACCEPT:" then "ACCEPT:info:ftp" will generate
|
|
|
|
|
"Shorewall:net2dmz:ACCEPT:ftp " (note the trailing blank). The maximum
|
|
|
|
|
length of a log prefix supported by iptables is 29 characters; if a
|
|
|
|
|
larger prefix is generated, Shorewall will issue a warning message and
|
|
|
|
|
will truncate the prefix to 29 characters.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>A new "-q" option has been added to /sbin/shorewall
|
2004-05-14 00:07:06 +02:00
|
|
|
commands. It causes the start, restart, check and refresh commands to
|
|
|
|
|
produce much less output so that warning messages are more visible
|
|
|
|
|
(when testing this change, I discovered a bug where a bogus warning
|
|
|
|
|
message was being generated).<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Shorewall now uses 'modprobe' to load kernel modules if
|
2004-05-14 00:07:06 +02:00
|
|
|
that utility is available in the PATH; otherwise, 'insmod' is used.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>It is now possible to restrict entries in the
|
2004-05-14 00:07:06 +02:00
|
|
|
/etc/shorewall/masq file to particular protocols and destination
|
|
|
|
|
port(s). Two new columns (PROTO and PORT(S)) have been added to the
|
|
|
|
|
file.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Example:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
You want all outgoing SMTP traffic entering the firewall on eth1 to be
|
|
|
|
|
sent from eth0 with source IP address 206.124.146.177. You want all
|
|
|
|
|
other outgoing traffic from eth1 to be sent from eth0 with source IP
|
|
|
|
|
address 206.124.146.176.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
eth0
|
|
|
|
|
eth1 206.124.146.177 tcp 25<br>
|
|
|
|
|
eth0
|
|
|
|
|
eth1 206.124.146.176<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
THE ORDER OF THE ABOVE TWO RULES IS SIGNIFICANT!!!!!<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Assuming that 10.0.0.0/8 is the only host/network connected to eth1,
|
|
|
|
|
the progress message at "shorewall start" would be:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Masqueraded Networks and Hosts:<br>
|
|
|
|
|
To 0.0.0.0/0 (tcp 25) from
|
|
|
|
|
10.0.0.0/8 through eth0 using 206.124.146.177<br>
|
|
|
|
|
To 0.0.0.0/0 (all) from 10.0.0.0/8
|
|
|
|
|
through eth0 using 206.124.146.176<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Two new actions are available in the /etc/shorewall/rules
|
2004-05-14 00:07:06 +02:00
|
|
|
file.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
ACCEPT+ -- Behaves like ACCEPT
|
|
|
|
|
with the exception that it exempts matching connections from subsequent
|
|
|
|
|
DNAT[-] and REDIRECT[-] rules.<br>
|
|
|
|
|
NONAT -- Exempts
|
|
|
|
|
matching connections from subsequent DNAT[-] and REDIRECT[-] rules.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>A new extension script 'initdone' has been added. This
|
2004-05-14 00:07:06 +02:00
|
|
|
script is invoked at the same point as the 'common' script was
|
|
|
|
|
previously and is useful for users who mis-used that script under
|
|
|
|
|
Shorewall 1.x (the script was intended for adding rules to the 'common'
|
|
|
|
|
chain but many users treated it as a script for adding rules before
|
|
|
|
|
Shorewall's).<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>Installing/Upgrading Shorewall on Slackware has been
|
2004-05-14 00:07:06 +02:00
|
|
|
improved. Slackware users must use the tarball and must modify settings
|
|
|
|
|
in the install.sh script before running it as follows:<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
DEST="/etc/rc.d"<br>
|
|
|
|
|
INIT="rc.firewall"<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
<br>
|
2004-05-14 00:07:06 +02:00
|
|
|
Thanks to Alex Wilms for helping with this change.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</li>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><b><a name="LinuxFest"></a>4/17/2004 - Presentation at
|
|
|
|
|
LinuxFest NW</b><b><br>
|
|
|
|
|
</b></p>
|
|
|
|
|
<p>Today I gave a presentation at LinuxFest NW in Bellingham. The
|
2004-05-14 00:07:06 +02:00
|
|
|
presentation was entitled "<a
|
|
|
|
|
href="http://lists.shorewall.net/Shorewall_and_the_Enterprise.htm"
|
|
|
|
|
target="_blank">Shorewall
|
|
|
|
|
and the Enterprise</a>" and described the history of Shorewall and gave
|
|
|
|
|
an overview of its features.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</p>
|
|
|
|
|
<ol>
|
|
|
|
|
</ol>
|
|
|
|
|
<p><a href="News.htm">More News</a></p>
|
|
|
|
|
<hr style="width: 100%; height: 2px;">
|
|
|
|
|
<h2><a name="Leaf"></a>Leaf<br>
|
|
|
|
|
</h2>
|
|
|
|
|
<p><a href="http://leaf.sourceforge.net" target="_top"><img
|
2004-04-12 16:16:46 +02:00
|
|
|
alt="(Leaf Logo)"
|
|
|
|
|
style="border: 0px solid ; height: 36px; width: 49px;"
|
|
|
|
|
src="images/leaflogo.gif" title=""></a> LEAF is an open source project
|
|
|
|
|
which provides a Firewall/router on a floppy, CD or CF. Several LEAF
|
2004-05-28 19:24:32 +02:00
|
|
|
distributions including Bering and Bering-uClibc use Shorewall as their
|
2004-04-12 16:16:46 +02:00
|
|
|
Netfilter configuration tool.<br>
|
2004-05-28 19:24:32 +02:00
|
|
|
</p>
|
|
|
|
|
<div>
|
|
|
|
|
<div style="text-align: center;"> </div>
|
|
|
|
|
</div>
|
|
|
|
|
<hr style="width: 100%; height: 2px;">
|
|
|
|
|
<h2><a name="Donations"></a>Donations
|
|
|
|
|
</h2>
|
|
|
|
|
<p style="text-align: left;"> </p>
|
|
|
|
|
<p style="text-align: left;"><big><a href="http://www.alz.org"
|
2004-04-12 16:16:46 +02:00
|
|
|
target="_top"><img src="images/alz_logo2.gif" title=""
|
|
|
|
|
alt="(Alzheimer's Association Logo)"
|
2004-05-28 19:24:32 +02:00
|
|
|
style="border: 0px solid ; width: 300px; height: 60px;" align="left"></a></big></p>
|
|
|
|
|
<h2><big><a href="http://www.starlight.org" target="_top"><img
|
|
|
|
|
src="images/newlog.gif" title="" alt="(Starlight Foundation Logo)"
|
|
|
|
|
style="border: 0px solid ; width: 59px; height: 102px;" align="left"></a></big></h2>
|
|
|
|
|
<p style="text-align: left;"><big>Shorewall
|
2004-04-12 16:16:46 +02:00
|
|
|
is free but
|
|
|
|
|
if you
|
|
|
|
|
try it and find it useful,
|
|
|
|
|
please consider making a donation to the <a href="http://www.alz.org/"
|
2004-05-28 19:24:32 +02:00
|
|
|
target="_top">Alzheimer's Association</a> or to the <a
|
|
|
|
|
href="http://www.starlight.org" target="_top">Starlight Children's
|
|
|
|
|
Foundation</a>.<br>
|
|
|
|
|
</big></p>
|
|
|
|
|
<p style="text-align: left;"><big>Thanks<br>
|
|
|
|
|
<br>
|
|
|
|
|
</big></p>
|
|
|
|
|
<p style="text-align: left;"><big><br>
|
|
|
|
|
</big> </p>
|
2004-04-12 16:16:46 +02:00
|
|
|
</div>
|
|
|
|
|
</body>
|
2003-12-30 02:19:52 +01:00
|
|
|
</html>
|
