shorewall_code/manpages/shorewall-providers.xml

<?xml version="1.0" encoding="UTF-8"?>
<refentry>
  <refmeta>
    <refentrytitle>shorewall-providers</refentrytitle>

    <manvolnum>5</manvolnum>
  </refmeta>

  <refnamediv>
    <refname>providers</refname>

    <refpurpose>Shorewall Providers file</refpurpose>
  </refnamediv>

  <refsynopsisdiv>
    <cmdsynopsis>
      <command>/etc/shorewall/providers</command>
    </cmdsynopsis>
  </refsynopsisdiv>

  <refsect1>
    <title>Description</title>

    <para>This file is used to define additional routing tables. You will want
    to define an additional table if:</para>

    <itemizedlist>
      <listitem>
        <para>You have connections to more than one ISP or multiple
        connections to the same ISP</para>
      </listitem>

      <listitem>
        <para>You run Squid as a transparent proxy on a host other than the
        firewall.</para>
      </listitem>

      <listitem>
        <para>You have other requirements for policy routing.</para>
      </listitem>
    </itemizedlist>

    <para>Each entry in the file defines a single routing table.</para>

    <para>The columns in the file are as follows.</para>

    <variablelist>
      <varlistentry>
        <term><emphasis role="bold">NAME</emphasis></term>

        <listitem>
          <para>The provider name. Must be a valid shell variable name. The
          names 'local', 'main', 'default' and 'unspec' are reserved and may
          not be used as provider names.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">NUMBER</emphasis></term>

        <listitem>
          <para>The provider number -- a number between 1 and 15. Each
          provider must be assigned a unique value.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">MARK</emphasis></term>

        <listitem>
          <para>A FWMARK value used in your shorewall-tcrules(5) file to
          direct packets to this provider.</para>

          <para>If HIGH_ROUTE_MARKS=Yes in shorewall.conf(5), then the value
          must be a multiple of 256 between 256 and 65280 or their hexadecimal
          equivalents (0x0100 and 0xff00 with the low-order byte of the value
          being zero). Otherwise, the value must be between 1 and 255. Each
          provider must be assigned a unique mark value.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">DUPLICATE</emphasis></term>

        <listitem>
          <para>The name of an existing table to duplicate to create this
          routing. May be 'main' or the name of a previous provider. You may
          select only certain entries from the table to copy by using the COPY
          column below.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">INTERFACE</emphasis></term>

        <listitem>
          <para>The name of the network interface to the provider. Must be
          listed in shorewall-interfaces(5).</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">GATEWAY</emphasis></term>

        <listitem>
          <para>The IP address of the provider's gateway router.</para>

          <para>You can enter "detect" here and Shorewall will attempt to
          detect the gateway automatically.</para>

          <para>For PPP devices, you may omit this column.</para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">OPTIONS</emphasis> (Optional)</term>

        <listitem>
          <para>A comma-separated list selected from the following. The order
          of the options is not significant but the list may contain no
          embedded whitespace.</para>

          <variablelist>
            <varlistentry>
              <term><emphasis role="bold">track</emphasis></term>

              <listitem>
                <para>If specified, inbound connections on this interface are
                to be tracked so that responses may be routed back out this
                same interface.</para>

                <para>You want to specify 'track' if internet hosts will be
                connecting to local servers through this provider.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">balance</emphasis></term>

              <listitem>
                <para>The providers that have 'balance' specified will get
                outbound traffic load-balanced among them. By default, all
                interfaces with 'balance' specified will have the same weight
                (1). You can change the weight of an interface by specifiying
                balance=&lt;weight&gt; where &lt;weight&gt; is the weight of
                the route out of this interface.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">loose</emphasis></term>

              <listitem>
                <para>Shorewall normally adds a routing rule for each IP
                address on an interface which forces traffic whose source is
                that IP address to be sent using the routing table for that
                interface. Setting 'loose' prevents creation of such rules on
                this interface.</para>
              </listitem>
            </varlistentry>

            <varlistentry>
              <term><emphasis role="bold">optional</emphasis></term>

              <listitem>
                <para>If the interface named in the INTERFACE column is not up
                and configured with an IPv4 address then ignore this
                provider.</para>
              </listitem>
            </varlistentry>
          </variablelist>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term><emphasis role="bold">COPY</emphasis></term>

        <listitem>
          <para>A comma-separated list of other interfaces on your firewall.
          Usually used only when DUPLICATE is 'main'. Only copy routes through
          INTERFACE and through interfaces listed here. If you only wish to
          copy routes through INTERFACE, enter 'none' here.</para>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>Examples</title>

    <variablelist>
      <varlistentry>
        <term>Example 1:</term>

        <listitem>
          <para>You run squid in your DMZ on IP address 192.168.2.99. Your DMZ
          interface is eth2</para>

          <programlisting>        #NAME   NUMBER  MARK DUPLICATE  INTERFACE GATEWAY       OPTIONS
        Squid   1       1    -          eth2      192.168.2.99  -</programlisting>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>Example 2:</term>

        <listitem>
          <para>eth0 connects to ISP 1. The IP address of eth0 is
          206.124.146.176 and the ISP's gateway router has IP address
          206.124.146.254.</para>

          <para>eth1 connects to ISP 2. The IP address of eth1 is
          130.252.99.27 and the ISP's gateway router has IP address
          130.252.99.254.</para>

          <para>eth2 connects to a local network.</para>

          <programlisting>        #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY          OPTIONS            COPY
        ISP1  1       1    main      eth0      206.124.146.254 track,balance      eth2
        ISP2  2       2    main      eth1      130.252.99.254  track,balance      eth2</programlisting>
        </listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>FILES</title>

    <para>/etc/shorewall/providers</para>
  </refsect1>

  <refsect1>
    <title>See ALSO</title>

    <para><ulink
    url="http://shorewall.net/MultiISP.html">http://shorewall.net/MultiISP.html</ulink></para>

    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
    shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
    shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
    shorewall-policy(5), shorewall-proxyarp(5), shorewall-route_routes(5),
    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
  </refsect1>
</refentry>