Shorewall-1.4.6

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@672 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Lrp/etc/shorewall/hosts

@@ -20,7 +20,7 @@
 #	ZONE	- The name of a zone defined in /etc/shorewall/zones
 #
 #	HOST(S)	- The name of an interface followed by a colon (":") and
-#		  either:
+#		  a comma-separated list whose elements are either:
 #
 #			a) The IP address of a host
 #			b) A subnetwork in the form
@@ -33,6 +33,7 @@
 #
 #			eth1:192.168.1.3
 #			eth2:192.168.2.0/24
+#			eth3:192.168.2.0/24,192.168.3.1
 #
 #	OPTIONS - A comma-separated list of options. Currently-defined
 #		  options are:

Lrp/etc/shorewall/interfaces

@@ -20,6 +20,10 @@
 #			an alias (e.g., eth0:0) here; see
 #			http://www.shorewall.net/FAQ.htm#faq18
 #
+#			You may specify wildcards here. For example, if you
+#			want to make an entry that applies to all PPP
+#			interfaces, use 'ppp+'.
+#
 #			DO NOT DEFINE THE LOOPBACK INTERFACE (lo) IN THIS FILE.
 #
 #	BROADCAST	The broadcast address for the subnetwork to which the
@@ -89,6 +93,16 @@
 #				sub-networking as described at:
 #				http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet
 #
+#			newnotsyn    - TCP packets that don't have the SYN 
+#				       flag set and which are not part of an
+#				       established connection will be accepted
+#				       from this interface, even if 
+#				       NEWNOTSYN=No has been specified in
+#				       /etc/shorewall/shorewall.conf.
+#
+#				       This option has no effect if 
+#				       NEWNOTSYN=Yes.
+#
 #			The order in which you list the options is not
 #			significant but the list should have no embedded white
 #			space.

Lrp/etc/shorewall/masq

@@ -42,12 +42,15 @@
 #				will automatically add this address to the
 #				INTERFACE named in the first column.
 #
-#				WARNING: Do NOT specify ADD_SNAT_ALIASES=Yes if
+#				You may also specify a range of up to 256
-#				the address given in this column is the primary
+#				IP addresses if you want the SNAT address to
-#				IP address for the interface in the INTERFACE
+#				be assigned from that range in a round-robin
-#				column.
+#				range by connection. The range is specified by
+#				<first ip in range>-<last ip in range>.
 #
-#				This column may not contain a DNS Name.
+#				Example: 206.124.146.177-206.124.146.180
+#				
+#				This column may not contain DNS Names.
 #
 #	Example 1:
 #

Lrp/etc/shorewall/rules

@@ -107,6 +107,12 @@
 #				3. You may not specify both an interface and
 #				   an address.
 #
+#			Unlike in the SOURCE column, you may specify a range of
+#			up to 256 IP addresses using the syntax
+#			<first ip>-<last ip>. When the ACTION is DNAT or DNAT-,
+#			the connections will be assigned to addresses in the
+#			range in a round-robin fashion.
+#
 #			The port that the server is listening on may be
 #			included and separated from the server's IP address by
 #			":". If omitted, the firewall will not modifiy the
@@ -137,7 +143,7 @@
 #			In that case, it is suggested that this field contain
 #			 "-"
 #
-#			If MULTIPORT=Yes in /etc/shorewall/shorewall.conf, then
+#			If your kernel contains multi-port match support, then
 #			only a single Netfilter rule will be generated if in
 #			this list and the CLIENT PORT(S) list below:
 #			1. There are 15 or less ports listed.
@@ -154,7 +160,7 @@
 #			specify an ADDRESS in the next column, then place "-"
 #			in this column.
 #
-#			If MULTIPORT=Yes in /etc/shorewall/shorewall.conf, then
+#			If your kernel contains multi-port match support, then
 #			only a single Netfilter rule will be generated if in
 #			this list and the DEST PORT(S) list above:
 #			1. There are 15 or less ports listed.
@@ -214,6 +220,14 @@
 #	#ACTION  SOURCE	DEST      	PROTO	DEST    SOURCE	ORIGINAL
 #	#                               	PORT    PORT(S) DEST
 #	DNAT      net	loc:192.168.1.3 tcp     80      -       130.252.100.69
+#
+#       Example: You want to accept SSH connections to your firewall only 
+#		 from internet IP addresses 130.252.100.69 and 130.252.100.70
+#
+#	#ACTION  SOURCE	DEST      	PROTO	DEST    SOURCE	ORIGINAL
+#	#                               	PORT    PORT(S) DEST
+#	ACCEPT	 net:130.252.100.69,130.252.100.70 \
+#					tcp	22
 ##############################################################################
 #ACTION  SOURCE		DEST      	PROTO	DEST    SOURCE	   ORIGINAL
 #                       	        	PORT    PORT(S)    DEST

Lrp/etc/shorewall/shorewall.conf

@@ -67,7 +67,7 @@ LOGFILE=/var/log/messages
 #
 # If you want to integrate Shorewall with fireparse, then set LOGFORMAT as:
 #
-#       LOGFORMAT="fp=%s:%d a=%s "
+#	LOGFORMAT="fp=%s:%d a=%s "
 #
 # If not specified or specified as empty (LOGFORMAT="") then the value
 # "Shorewall:%s:%s:" is assumed.
@@ -144,7 +144,7 @@ BLACKLIST_LOGLEVEL=
 # Example: LOGNEWNOTSYN=debug
 
 
-LOGNEWNOTSYN=
+LOGNEWNOTSYN=info
 
 #
 # MAC List Log Level
@@ -191,6 +191,14 @@ RFC1918_LOG_LEVEL=info
 #
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+#
+# SHELL
+#
+# The firewall script is normally interpreted by /bin/sh. If you wish to change
+# the shell used to interpret that script, specify the shell here.
+
+SHOREWALL_SHELL=/bin/sh
+
 # SUBSYSTEM LOCK FILE
 #
 # Set this to the name of the lock file expected by your init scripts. For
@@ -230,24 +238,6 @@ MODULESDIR=
 #
 FW=fw
 
-#
-# ENABLE NAT SUPPORT
-#
-# You probally want yes here. Only gateways not doing NAT in any form, like
-# SNAT,DNAT masquerading, port forwading etc. should say "no" here.
-#
-NAT_ENABLED=Yes
-
-#
-# ENABLE MANGLE SUPPORT
-#
-# If you say "no" here, Shorewall will ignore the /etc/shorewall/tos file
-# and will not initialize the mangle table when starting or stopping
-# your firewall. You must enable mangling if you want Traffic Shaping
-# (see TC_ENABLED below).
-#
-MANGLE_ENABLED=Yes
-
 #
 # ENABLE IP FORWARDING
 #
@@ -378,26 +368,6 @@ ROUTE_FILTER=No
 
 NAT_BEFORE_RULES=Yes
 
-# MULTIPORT support
-#
-# If your kernel includes the multiport match option
-# (CONFIG_IP_NF_MATCH_MULTIPORT), you may enable it's use here. When this
-# option is enabled by setting it's value to "Yes" or "yes":
-#
-#	1) If you list more that 15 ports in a comma-seperated list in
-#	   /etc/shorewall/rules, Shorewall will not use the multiport option
-#	   but will generate a separate rule for each element of each port
-#	   list.
-#	2) If you include a port range (<low port>:<high port>) in the
-#	   rule, Shorewall will not use the multiport option but will generate
-#	   a separate rule for each element of each port list.
-#
-# See the /etc/shorewall/rules file for additional information on this option.
-#
-# if this variable is not set or is set to the empty value, "No" is assumed.
-
-MULTIPORT=No
-
 # DNAT IP ADDRESS DETECTION
 #
 # Normally when Shorewall encounters the following rule:
@@ -447,7 +417,7 @@ MUTEX_TIMEOUT=60
 #
 # NEWNOTSYN
 #
-# If this variable is set to "No" or "no", then When a TCP packet that does
+# If this variable is set to "No" or "no", then when a TCP packet that does
 # not have the SYN flag set and the ACK and RST flags clear then unless the
 # packet is part of an established connection, it will be dropped by the
 # firewall
@@ -458,6 +428,9 @@ MUTEX_TIMEOUT=60
 # Users with a High-availability setup with two firewall's and one acting
 # as a backup should set NEWNOTSYN=Yes. Users with asymmetric routing may
 # also need to select NEWNOTSYN=Yes.
+#
+# The behavior of NEWNOTSYN=Yes may also be enabled on a per-interface basis 
+# using the 'newnotsyn' option in /etc/shorewall/interfaces.
 
 NEWNOTSYN=No
 

Lrp/sbin/shorewall

@@ -82,6 +82,22 @@
 #						   be automatically reinstated the
 #						   next time that Shorewall starts.
 #
+#          shorewall ipaddr [ <address>/<cidr> | <address> <netmask> ]
+#
+#                                                  Displays information about the network
+#                                                  defined by the argument[s]
+#
+#          shorewall iprange <address>-<address>   Decomposes a range of IP addresses into
+#                                                  a list of network/host addresses.
+#
+# Fatal Error
+#
+fatal_error() # $@ = Message
+{
+    echo "   $@" >&2
+    exit 2
+}
+
 # Display a chain if it exists
 #
 
@@ -138,6 +154,13 @@ get_config() {
     [ -n "LOGFORMAT" ] && LOGFORMAT="${LOGFORMAT%%%*}"
 
     [ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall:"
+
+    if [ -n "$SHOREWALL_SHELL" ]; then
+	if [ ! -e "$SHOREWALL_SHELL" ]; then
+	    echo "The program specified in SHOREWALL_SHELL does not exist or is not executable" >&2
+	    exit 2
+	fi
+    fi
 }
 
 #
@@ -521,6 +544,8 @@ usage() # $1 = exit status
     echo "   reject <address> ..."
     echo "   allow <address> ..."
     echo "   save"
+    echo "   ipcalc [ <address>/<vlsm> | <address> <netmask> ]"
+    echo "   iprange <address>-<address>"
     exit $1
 }
 
@@ -653,11 +678,13 @@ esac
 case "$1" in
     start|stop|restart|reset|clear|refresh|check)
 	[ $# -ne 1 ] && usage 1
-	exec $FIREWALL $debugging $nolock $1
+	get_config
+	exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $1
 	;;
     add|delete)
 	[ $# -ne 3 ] && usage 1
-	exec $FIREWALL $debugging $nolock $1 $2 $3
+	get_config
+	exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $1 $2 $3
 	;;
     show|list)
 	[ $# -gt 2 ] && usage 1
@@ -860,7 +887,48 @@ case "$1" in
 	fi
 	mutex_off
 	;;
+    ipcalc)
+	if [ $# -eq 2 ]; then
+	    address=${2%/*}
+	    vlsm=${2#*/}
+	elif [ $# -eq 3 ]; then
+	    address=$2
+	    vlsm=`ip_vlsm $3`
+	else
+	    usage 1
+	fi
+	
+	[ -z "$vlsm" ] && exit 2
+	[ "x$address" = "x$vlsm" ] && usage 2
+	[ $vlsm -gt 32 ] && echo "Invalid VLSM: /$vlsm" >&2 && exit 2
+
+	address=$address/$vlsm
+
+	                                  echo "   CIDR=$address"
+	temp=`ip_netmask $address`;       echo "   NETMASK=`encodeaddr $temp`"
+	temp=`ip_network $address`;       echo "   NETWORK=$temp"
+	temp=`broadcastaddress $address`; echo "   BROADCAST=$temp"
+	;;
+
+    iprange)
+	case $2 in
+	    *.*.*.*-*.*.*.*)
+		ip_range $2
+		;;
+	    *)
+		usage 1
+		;;
+	esac
+	;;
+    call) 
+	#
+	# Undocumented way to call functions in /usr/share/shorewall/functions directly
+	#
+	shift;
+	$@
+	;;
     *)
 	usage 1
 	;;
+
 esac

Lrp/usr/share/shorewall/firewall

@@ -233,8 +233,7 @@ createchain() # $1 = chain name, $2 = If "yes", create default rules
     run_iptables -N $1
 
     if [ $2 = yes ]; then
-	state="ESTABLISHED,RELATED"
+	run_iptables -A $1 -m state --state ESTABLISHED,RELATED -j ACCEPT
-	run_iptables -A $1 -m state --state $state -j ACCEPT
 	[ -z "$NEWNOTSYN" ] && \
 	    run_iptables -A $1 -m state --state NEW -p tcp ! --syn -j newnotsyn
     fi
@@ -495,10 +494,17 @@ first_chains() #$1 = interface
 #
 find_hosts() # $1 = host zone
 {
-    local hosts
+    local hosts interface address addresses
 
     while read z hosts options; do
-	[ "x`expand $z`" = "x$1" ] && expandv hosts && echo `separate_list $hosts`
+	if [ "x`expand $z`" = "x$1" ]; then
+	    expandv hosts
+	    interface=${hosts%:*}
+	    addresses=${hosts#*:}
+	    for address in `separate_list $addresses`; do 
+		echo $interface:$address
+	    done
+	fi
     done < $TMP_DIR/hosts
 }
 
@@ -608,7 +614,7 @@ validate_interfaces_file() {
 
 	for option in $options; do
 	    case $option in
-		dhcp|norfc1918|tcpflags)
+		dhcp|norfc1918|tcpflags|newnotsyn)
 		    ;;
 		routefilter|dropunclean|logunclean|blacklist|proxyarp|maclist|-)
 		    ;;
@@ -636,18 +642,20 @@ validate_hosts_file() {
 	r="$z $hosts $options"
 	validate_zone $z || startup_error "Invalid zone ($z) in record \"$r\""
 
+	interface=${hosts%:*}
+
+	list_search  $interface $all_interfaces || \
+	    startup_error "Unknown interface ($interface) in record \"$r\""
+
+	hosts=${hosts#*:}
+
 	for host in `separate_list $hosts`; do
-	    interface=${host%:*}
-
-	    list_search  $interface $all_interfaces || \
-		startup_error "Unknown interface ($interface) in record \"$r\""
-
 	    for option in `separate_list $options`; do
 		case $option in
 		    maclist|-)
 			;;
 		    routeback)
-			eval ${z}_routeback=\"$host \$${z}_routeback\"
+			eval ${z}_routeback=\"$interface:$host \$${z}_routeback\"
 			;;
 		    *)
 			error_message "Warning: Invalid option ($option) in record \"$r\""
@@ -689,7 +697,7 @@ validate_policy()
 	    [ $1 = $2 ]  || \
 	    [ $1 = all ] || \
 	    [ $2 = all ] || \
-	    echo "   Policy for $1 to $2 is $policy"
+	    echo "   Policy for $1 to $2 is $policy using chain $chain"
     }
 
     all_policy_chains=
@@ -832,6 +840,15 @@ find_interface_address() # $1 = interface
     echo $addr | sed 's/inet //;s/\/.*//;s/ peer.*//'
 }
 
+#
+# Find interface addresses--returns the set of addresses assigned to the passed
+# device
+#
+find_interface_addresses() # $1 = interface
+{
+    ip addr show $1 | grep inet | sed 's/inet //;s/\/.*//;s/ peer.*//'
+}
+
 #
 # Find interfaces that have the passed option specified
 #
@@ -848,10 +865,18 @@ find_interfaces_by_option() # $1 = option
 #
 find_hosts_by_option() # $1 = option
 {
+    local ignore hosts interface address addresses options
+
     while read ignore hosts options; do
 	expandv options
-	list_search $1 `separate_list $options` && \
+	if list_search $1 `separate_list $options`; then
-	    echo `expand $hosts`
+	    expandv hosts
+	    interface=${hosts%:*}
+	    addresses=${hosts#*:}
+	    for address in `separate_list $addresses`; do 
+		echo $interface:$address
+	    done
+	fi
     done < $TMP_DIR/hosts
 
     for interface in $all_interfaces; do
@@ -1685,14 +1710,16 @@ check_config() {
 
     disclaimer() {
 	echo
-	echo "WARNING: THE 'check' COMMAND IS TOTALLY UNSUPPORTED AND PROBLEM"
+	echo "Notice:  The 'check' command is unsupported and problem"
-	echo "         REPORTS COMPLAINING ABOUT ERRORS THAT IT DIDN'T CATCH"
+	echo "         reports complaining about errors that it didn't catch"
-	echo "         WILL NOT BE ACCEPTED"
+	echo "         will not be accepted"
 	echo
     }
 
     disclaimer
 
+    report_capabilities
+
     echo "Verifying Configuration..."
 
     verify_os_version
@@ -1839,7 +1866,11 @@ add_nat_rule() {
 
     if [ -n "$serv" ]; then
 	servport="${servport:+:$servport}"
-	target1="DNAT --to-destination ${serv}${servport}"
+	serv1=
+	for srv in `separate_list $serv`; do
+	    serv1="$serv1 --to-destination ${srv}${servport}"
+	done
+	target1="DNAT $serv1"
     else
 	target1="REDIRECT --to-port $servport"
     fi
@@ -1856,7 +1887,10 @@ add_nat_rule() {
 		chain=nonat${nonat_seq}
 		nonat_seq=$(($nonat_seq + 1))
 		createnatchain $chain
-		run_iptables -t nat -A OUTPUT $cli $proto $multiport $sports $dports -j $chain
+
+		for adr in `separate_list $addr`; do
+		    run_iptables2 -t nat -A OUTPUT $cli $proto $multiport $sports $dports -d $adr -j $chain
+		done
 
 		for adr in $excludedests; do
 		    addnatrule $chain -d $adr -j RETURN
@@ -1866,11 +1900,15 @@ add_nat_rule() {
 		    log_rule $loglevel $chain $logtarget -t nat
 		fi
 
-		addnatrule $chain -j $target1
+		addnatrule $chain $proto -j $target1 # Protocol is necessary for port redirection
 	    else
 		for adr in `separate_list $addr`; do
-		    run_iptables2 -t nat -A OUTPUT $proto $sports -d $adr \
+		    if [ -n "$loglevel" ]; then
-			$multiport $dports -j $target1
+			log_rule $loglevel $OUTPUT $logtarget -t nat \
+			    `fix_bang $proto $cli $sports -d $adr $multiport $dports`
+		    fi
+
+		    run_iptables2 -t nat -A OUTPUT $proto $sports -d $adr $multiport $dports -j $target1
 		done
 	    fi
 	else
@@ -1880,13 +1918,15 @@ add_nat_rule() {
 		chain=nonat${nonat_seq}
 		nonat_seq=$(($nonat_seq + 1))
 		createnatchain $chain
-		addnatrule `dnat_chain $source` $cli $proto $multiport $sports $dports -j $chain
+
+		for adr in `separate_list $addr`; do
+		    addnatrule `dnat_chain $source` $cli $proto $multiport $sports $dports -d $adr -j $chain
+		done
+
 		for z in $excludezones; do
 		    eval hosts=\$${z}_hosts
 		    for host in $hosts; do
-			for adr in `separate_list $addr`; do
+			addnatrule $chain -s ${host#*:} -j RETURN
-			    addnatrule $chain -s ${host#*:} -d $adr -j RETURN
-			done
 		    done
 		done
 
@@ -1894,13 +1934,11 @@ add_nat_rule() {
 		    addnatrule $chain -d $adr -j RETURN
 		done
 
-		for adr in `separate_list $addr`; do
+		if [ -n "$loglevel" ]; then
-		    if [ -n "$loglevel" ]; then
+		    log_rule $loglevel $chain $logtarget -t nat
-			log_rule $loglevel $chain $logtarget -t nat -d `fix_bang $adr`
+		fi
-		    fi
 
-		    addnatrule $chain -d $adr -j $target1
+		addnatrule $chain $proto -j $target1 # Protocol is necessary for port redirection
-		done
 	    else
 		for adr in `separate_list $addr`; do
 		    if [ -n "$loglevel" ]; then
@@ -1943,6 +1981,8 @@ add_nat_rule() {
 	    done
 	fi
     fi
+
+    [ "x$addr" = "x0.0.0.0/0" ] && addr= 
 }
 
 #
@@ -2015,9 +2055,12 @@ add_a_rule()
     servport=$serverport
     multiport=
 
+    [ x$port  = x- ] && port=
+    [ x$cport = x- ] && cport=
+
     case $proto in
 	tcp|udp|TCP|UDP|6|17)
-	    if [ -n "$port" -a "x${port}" != "x-" ]; then
+	    if [ -n "$port" ]; then
 		dports="--dport"
 		if [ -n "$multioption" -a "$port" != "${port%,*}" ]; then
 		    multiport="$multioption"
@@ -2026,7 +2069,7 @@ add_a_rule()
 		dports="$dports $port"
 	    fi
 
-	    if [ -n "$cport" -a "x${cport}" != "x-" ]; then
+	    if [ -n "$cport" ]; then
 		sports="--sport"
 		if [ -n "$multioption" -a "$cport" != "${cport%,*}" ]; then
 		    multiport="$multioption"
@@ -2036,18 +2079,17 @@ add_a_rule()
 	    fi
 		;;
 	icmp|ICMP|1)
-	    [ -n "$port" ] && [ "x${port}" != "x-" ] && \
+	    [ -n "$port" ]  && 	dports="--icmp-type $port"
-		dports="--icmp-type $port"
 	    state=
 	    ;;
 	all|ALL)
-	    [ -n "$port" ] && [ "x${port}" != "x-" ] && \
+	    [ -n "$port" ] && \
-		fatal_error "Port number not allowed with \"all\"; rule: \"$rule\""
+		fatal_error "Port number not allowed with protocol \"all\"; rule: \"$rule\""
 	    proto=
 	    ;;
 	*)
 	    state=
-	    [ -n "$port" ] && [ "x${port}" != "x-" ] && \
+	    [ -n "$port" ] && \
 		fatal_error "Port number not allowed with protocol \"$proto\"; rule: \"$rule\""
 	    ;;
     esac
@@ -2098,15 +2140,39 @@ add_a_rule()
 	    fi
 
 	    if [ -z "$dnat_only" -a $chain != ${FW}2${FW} ]; then
-		serv="${serv:+-d $serv}"
+		if [ -n "$serv" ]; then
+		    for serv1 in `separate_list $serv`; do
+			for srv in `ip_range $serv1`; do
+			    if [ -n "$addr" -a -n "$CONNTRACK_MATCH" ]; then
+				for adr in `separate_list $addr`; do
+				    if [ -n "$loglevel" -a -z "$natrule" ]; then
+					log_rule $loglevel $chain $logtarget -m conntrack --ctorigdst $adr \
+					    `fix_bang $proto $sports $multiport $state $cli -d $srv $dports`
+				    fi
 
-		if [ -n "$loglevel" -a -z "$natrule" ]; then
+				    run_iptables2 -A $chain $proto $multiport $state $cli $sports \
-		    log_rule $loglevel $chain $logtarget \
+					-d $srv $dports -m conntrack --ctorigdst $adr -j $target
-			`fix_bang $proto $sports $multiport $state $cli $serv $dports`
+				done
+			    else
+				if [ -n "$loglevel" -a -z "$natrule" ]; then
+				    log_rule $loglevel $chain $logtarget \
+					`fix_bang $proto $sports $multiport $state $cli -d $srv $dports`
+				fi
+
+				run_iptables2 -A $chain $proto $multiport $state $cli $sports \
+				    -d $srv $dports -j $target
+			    fi
+			done
+		    done
+		else
+		    if [ -n "$loglevel" -a -z "$natrule" ]; then
+		        log_rule $loglevel $chain $logtarget \
+			    `fix_bang $proto $sports $multiport $state $cli $dports`
+		    fi
+
+		    run_iptables2 -A $chain $proto $multiport $state $cli $sports \
+			$dports -j $target
 		fi
-
-		run_iptables2 -A $chain $proto $multiport $state $cli $sports \
-		    $serv $dports -j $target
 	    fi
 	fi
     else
@@ -2218,11 +2284,11 @@ process_rule() # $1 = target
 	   fatal_error "Empty source zone or qualifier: rule \"$rule\""
     fi
 
-    if [ "$clientzone" = "${clientzone%\!*}" ]; then
+    if [ "$clientzone" = "${clientzone%!*}" ]; then
 	excludezones=
     else
-	excludezones="${clientzone#*\!}"
+	excludezones="${clientzone#*!}"
-	clientzone="${clientzone%\!*}"
+	clientzone="${clientzone%!*}"
 
 	[ "$logtarget" = DNAT ] || [ "$logtarget" = REDIRECT ] ||\
 	    fatal_error "Exclude list only allowed with DNAT or REDIRECT"
@@ -2293,42 +2359,83 @@ process_rule() # $1 = target
 
     # Generate Netfilter rule(s)
 
-    if [ -n "$MULTIPORT" -a \
+    case $logtarget in
-	 "$ports" = "${ports%:*}" -a \
+	DNAT*)
-	 "$cports" = "${cports%:*}" -a \
+	    if [ -n "$MULTIPORT" -a \
-	 `list_count $ports` -le 15 -a \
+		"$ports" = "${ports%:*}" -a \
-	 `list_count $cports` -le 15 ]
+		"$cports" = "${cports%:*}" -a \
-    then
+		`list_count $ports` -le 15 -a \
-	#
+		`list_count $cports` -le 15 ]
-	# MULTIPORT is enabled, there are no port ranges in the rule and less than
+		then
-	# 16 ports are listed - use multiport match.
+	        #
-	#
+	        # MULTIPORT is enabled, there are no port ranges in the rule and less than
-	multioption="-m multiport"
+	        # 16 ports are listed - use multiport match.
-	for client in `separate_list ${clients:=-}`; do
+	        #
-	    for server in `separate_list ${servers:=-}`; do
+		multioption="-m multiport"
-		#
+		for client in `separate_list ${clients:=-}`; do
-		# add_a_rule() modifies these so we must set their values each time
+		    #
-		#
+		    # add_a_rule() modifies these so we must set their values each time
-		port=${ports:=-}
+		    #
-		cport=${cports:=-}
+		    server=${servers:=-}
-		add_a_rule
+		    port=${ports:=-}
-	    done
+		    cport=${cports:=-}
-	done
+		    add_a_rule
-    else
+		done
-	#
+	    else
-	# MULTIPORT is disabled or the rule isn't compatible with multiport match
+	        #
-	#
+	        # MULTIPORT is disabled or the rule isn't compatible with multiport match
-	multioption=
+	        #
-	for client in `separate_list ${clients:=-}`; do
+		multioption=
-	    for server in `separate_list ${servers:=-}`; do
+		for client in `separate_list ${clients:=-}`; do
-		for port in `separate_list ${ports:=-}`; do
+		    for port in `separate_list ${ports:=-}`; do
-		    for cport in `separate_list ${cports:=-}`; do
+			for cport in `separate_list ${cports:=-}`; do
+			    server=${servers:=-}
+			    add_a_rule
+			done
+		    done
+		done
+	    fi
+	    ;;
+	*)
+
+	    if [ -n "$MULTIPORT" -a \
+		"$ports" = "${ports%:*}" -a \
+		"$cports" = "${cports%:*}" -a \
+		`list_count $ports` -le 15 -a \
+		`list_count $cports` -le 15 ]
+		then
+	        #
+	        # MULTIPORT is enabled, there are no port ranges in the rule and less than
+	        # 16 ports are listed - use multiport match.
+	        #
+		multioption="-m multiport"
+		for client in `separate_list ${clients:=-}`; do
+		    for server in `separate_list ${servers:=-}`; do
+		        #
+		        # add_a_rule() modifies these so we must set their values each time
+		        #
+			port=${ports:=-}
+			cport=${cports:=-}
 			add_a_rule
 		    done
 		done
-	    done
+	    else
-	done
+	        #
-    fi
+	        # MULTIPORT is disabled or the rule isn't compatible with multiport match
+	        #
+		multioption=
+		for client in `separate_list ${clients:=-}`; do
+		    for server in `separate_list ${servers:=-}`; do
+			for port in `separate_list ${ports:=-}`; do
+			    for cport in `separate_list ${cports:=-}`; do
+				add_a_rule
+			    done
+			done
+		    done
+		done
+	    fi
+	    ;;
+    esac
     #
     # Report Result
     #
@@ -2360,7 +2467,7 @@ process_rules() # $1 = name of rules file
     while read xtarget xclients xservers xprotocol xports xcports xaddress; do
 	case "${xtarget%:*}" in
 
-	    ACCEPT|DROP|REJECT|DNAT|DNAT|DNAT-|REDIRECT|REDIRECT-|LOG|CONTINUE)
+	    ACCEPT|DROP|REJECT|DNAT|DNAT-|REDIRECT|REDIRECT-|LOG|CONTINUE)
 		expandv xclients xservers xprotocol xports xcports xaddress
 
 		if [ "x$xclients" = xall ]; then
@@ -2382,7 +2489,7 @@ process_rules() # $1 = name of rules file
 		;;
 	    *)
 		rule="`echo $xtarget $xclients $xservers $xprotocol $xports $xcports $xaddress`"
-		fatal_error "Invalid Target in rule \"$rule\""
+		fatal_error "Invalid Action in rule \"$rule\""
 		;;
 
 	esac
@@ -2582,24 +2689,19 @@ loadmodule() # $1 = module name, $2 - * arguments
 {
     local modulename=$1
     local modulefile
+    local suffix
 
     if [ -z "`lsmod | grep $modulename`" ]; then
 	shift
-	modulefile=$MODULESDIR/${modulename}.o
 	
-	if [ -f $modulefile ]; then
+	for suffix in o gz ko ; do
-	    insmod $modulefile $*
+	    modulefile=$MODULESDIR/${modulename}.${suffix}
-	    return
-	fi
-	#
-	# If the modules directory contains compressed modules then we'll
-	# assume that insmod can load them
-	#
-	modulefile=${modulefile}.gz
 
-	if [ -f $modulefile ]; then
+	    if [ -f $modulefile ]; then
-	    insmod $modulefile $*
+		insmod $modulefile $*
-	fi
+		return
+	    fi
+	done
     fi
 }
 
@@ -2900,8 +3002,16 @@ setup_masq()
 	esac
 
 	if [ -n "$address" -a -n "$ADD_SNAT_ALIASES" ]; then
-	    list_search $address $aliases_to_add || \
+	    for addr in `ip_range $address` ; do
-		aliases_to_add="$aliases_to_add $address $fullinterface"
+		if ! list_search $addr $aliases_to_add; then
+		    aliases_to_add="$aliases_to_add $addr $fullinterface"
+		    case $fullinterface in
+		    *:*)
+			fullinterface=${fullinterface%:*}:$((${fullinterface#*:} + 1 ))
+			;;
+		    esac
+		fi
+	    done
 	fi
 
 	destination=$destnet
@@ -3118,7 +3228,7 @@ verify_os_version() {
     osversion=`uname -r`
 
     case $osversion in
-    2.4.*|2.5.*)
+    2.4.*|2.5.*|2.6.*)
 	;;
     *)
 	startup_error "Shorewall version $version does not work with kernel version $osversion"
@@ -3134,35 +3244,30 @@ verify_os_version() {
 #
 add_ip_aliases()
 {
-    local external
+    local addresses external interface inet cidr rest val
-    local interface
-    local primary
 
-    do_one()
+    address_details() 
     {
 	#
 	# Folks feel uneasy if they don't see all of the same
 	# decoration on these IP addresses that they see when their
 	# distro's net config tool adds them. In an attempt to reduce
 	# the anxiety level, we have the following code which sets
-	# the VLSM and BRD from the primary address
+	# the VLSM and BRD from an existing address in the same subnet
 	#
-	# Get all of the lines that contain inet addresses with broadcast
+	# Get all of the lines that contain inet addresses 
 	#
-	val=`ip addr show $interface | grep 'inet.*brd '` 2> /dev/null
+	ip addr show $interface 2> /dev/null | grep 'inet' | while read inet cidr rest ; do
-
+	    if in_subnet $external $cidr; then
-	if [ -n "$val" ] ; then
+		echo "/${cidr#*/} brd `broadcastaddress $cidr`"
-	    #
+		break
-	    # Hack off the leading 'inet <ip addr>' (actually cut off the
+	    fi
-	    # "/" as well but add it back in).
+	done
-	    #
+    }
-	    val="/${val#*/}"
-	    #
-	    # Now get the VLSM, "brd" and the broadcast address
-	    #
-	    val=${val%% scope*}
-	fi
 
+    do_one()
+    {
+	val=`address_details`
 	run_ip addr add ${external}${val} dev $interface $label
 	echo "$external $interface" >> ${STATEDIR}/nat
 	[ -n "$label" ] && label="with $label"
@@ -3182,9 +3287,9 @@ add_ip_aliases()
 	    label="label $interface:$label"
 	fi
 
-	primary=`find_interface_address $interface`
 	shift;shift
-	[ "x${primary}" = "x${external}" ] || do_one
+
+	list_search $external `find_interface_addresses $interface` || do_one
     done
 }
 
@@ -3207,10 +3312,46 @@ load_kernel_modules() {
 # Verify that the 'ip' program is installed
 
 verify_ip() {
-    qt which ip ||\
+    qt ip link ls ||\
 	startup_error "Shorewall $version requires the iproute package ('ip' utility)"
 }
 
+# 
+# Determine which optional facilities are supported by iptables/netfilter
+#
+determine_capabilities() {
+    qt iptables -t nat    -L -n && NAT_ENABLED=Yes    || NAT_ENABLED=
+    qt iptables -t mangle -L -n && MANGLE_ENABLED=Yes || MANGLE_ENABLED=
+
+    CONNTRACK_MATCH=
+    MULTIPORT=
+
+    if qt iptables -N fooX1234 ; then
+	qt iptables -A fooX1234 -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT && CONNTRACK_MATCH=Yes
+        qt iptables -A fooX1234 -p tcp -m multiport --dports 21,22 -j ACCEPT   && MULTIPORT=Yes
+
+	qt iptables -F fooX1234
+	qt iptables -X fooX1234
+    fi
+}
+
+report_capability() # $1 = Capability Name, $2 Capability Setting (if any)
+{
+    local setting=
+
+    [ "x$1" = "xYes" ] && { setting="Available"; shift; } || setting="Not available"
+
+    echo "  " $@: $setting
+}
+
+report_capabilities() {
+    echo "Shorewall has detected the following iptables/netfilter capabilities:"
+    report_capability $NAT_ENABLED "NAT"
+    report_capability $MANGLE_ENABLED "Packet Mangling"
+    report_capability $MULTIPORT "Multi-port Match"
+    report_capability $CONNTRACK_MATCH "Connection Tracking Match"
+}
+
 #
 # Perform Initialization
 #	- Delete all old rules
@@ -3221,6 +3362,8 @@ verify_ip() {
 #
 initialize_netfilter () {
 
+    report_capabilities
+
     echo "Determining Zones..."
 
     determine_zones
@@ -3307,7 +3450,16 @@ initialize_netfilter () {
 
     if [ -z "$NEWNOTSYN" ]; then
 	createchain newnotsyn no
+
+	for interface in `find_interfaces_by_option newnotsyn`; do
+	    run_iptables -A newnotsyn -i $interface -p tcp --tcp-flags ACK ACK -j ACCEPT
+	    run_iptables -A newnotsyn -i $interface -p tcp --tcp-flags RST RST -j ACCEPT
+	    run_iptables -A newnotsyn -i $interface -p tcp --tcp-flags FIN FIN -j ACCEPT
+	    run_iptables -A newnotsyn -i $interface -j RETURN
+	done
+
 	run_user_exit newnotsyn
+
 	if [ -n "$LOGNEWNOTSYN" ]; then
 	    log_rule $LOGNEWNOTSYN newnotsyn DROP
 	fi
@@ -3334,7 +3486,7 @@ initialize_netfilter () {
 	done < /var/lib/shorewall/save
     fi
 
-    echo "Creating input Chains..."
+    echo "Creating Interface Chains..."
 
     for interface in $all_interfaces; do
 	createchain `forward_chain $interface` no
@@ -3369,6 +3521,7 @@ build_common_chain() {
     if [ -n "$NEWNOTSYN" ]; then
 	run_iptables -A common -p tcp --tcp-flags ACK ACK -j ACCEPT
 	run_iptables -A common -p tcp --tcp-flags RST RST -j ACCEPT
+	run_iptables -A common -p tcp --tcp-flags FIN FIN -j ACCEPT
     fi
     #
     # BROADCASTS
@@ -3462,13 +3615,17 @@ add_common_rules() {
     #
     # DHCP
     #
-    echo "Adding rules for DHCP"
+    interfaces=`find_interfaces_by_option dhcp`
 
-    for interface in `find_interfaces_by_option dhcp`; do
+    if [ -n "$interfaces" ]; then
-	run_iptables -A `input_chain $interface` -p udp --dport 67:68 -j ACCEPT
-	run_iptables -A OUTPUT	  -o $interface	 -p udp --dport 67:68 -j ACCEPT
-    done
 
+	echo "Adding rules for DHCP"
+
+	for interface in $interfaces; do
+	    run_iptables -A `input_chain $interface` -p udp --dport 67:68 -j ACCEPT
+	    run_iptables -A OUTPUT    -o $interface  -p udp --dport 67:68 -j ACCEPT
+	done
+    fi
     #
     # RFC 1918
     #
@@ -3487,11 +3644,12 @@ add_common_rules() {
 	
 	run_iptables -A logdrop -j DROP
 
-	if [ -n "$MANGLE_ENABLED" ]; then
+	if [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ]; then
 	    #
-	    # Mangling is enabled -- create a chain in the mangle table to
+	    # Mangling is enabled but conntrack match isn't available -- 
-	    # filter RFC1918 destination addresses. This must be done in the
+	    # create a chain in the mangle table to filter RFC1918 destination
-	    # mangle table before we apply any DNAT rules in the nat table
+            # addresses. This must be done in the mangle table before we apply
+	    # any DNAT rules in the nat table
 	    #
 	    # Also add a chain to log and drop any RFC1918 packets that we find
 	    #
@@ -3511,11 +3669,17 @@ add_common_rules() {
 	    esac
 
 	    run_iptables2 -A rfc1918 -s $subnet -j $target
-	    #
+
-	    # If packet mangling is enabled, trap packets with an
+	    if [ -n "$CONNTRACK_MATCH" ]; then
-	    # RFC1918 destination
+		#
-	    #
+		# We have connection tracking match -- match on the original destination
-	    if [ -n "$MANGLE_ENABLED" ]; then
+		#
+		run_iptables2 -A rfc1918 -m conntrack --ctorigdst $subnet -j $target
+	    elif [ -n "$MANGLE_ENABLED" ]; then
+		#
+		# No connection tracking match but we have mangling -- add a rule to
+		# the mangle table
+		#
 		run_iptables2 -t mangle -A man1918 -d $subnet -j $target
 	    fi
 	done < $TMP_DIR/rfc1918
@@ -3525,7 +3689,7 @@ add_common_rules() {
 		run_iptables -A $chain -m state --state NEW -j rfc1918
 	    done
 
-	    [ -n "$MANGLE_ENABLED" ] && \
+	    [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ] && \
 		run_iptables -t mangle -A PREROUTING -m state --state NEW -i $interface -j man1918
 	done
 
@@ -4366,6 +4530,7 @@ added_param_value_no() # $1 = Parameter Name, $2 = Parameter value
 # Initialize this program
 #
 do_initialize() {
+    
     # Run all utility programs using the C locale
     #
     # Thanks to Vincent Planchenault for this tip #
@@ -4388,8 +4553,6 @@ do_initialize() {
     LOGRATE=
     LOGBURST=
     LOGPARMS=
-    NAT_ENABLED=
-    MANGLE_ENABLED=
     ADD_IP_ALIASES=
     ADD_SNAT_ALIASES=
     TC_ENABLED=
@@ -4399,7 +4562,6 @@ do_initialize() {
     CLAMPMSS=
     ROUTE_FILTER=
     NAT_BEFORE_RULES=
-    MULTIPORT=
     DETECT_DNAT_IPADDRS=
     MUTEX_TIMEOUT=
     NEWNOTSYN=
@@ -4433,6 +4595,7 @@ do_initialize() {
     FUNCTIONS=$SHARED_DIR/functions
 
     if [ -f $FUNCTIONS ]; then
+	echo "Loading $FUNCTIONS..."
 	. $FUNCTIONS
     else
 	startup_error "$FUNCTIONS does not exist!"
@@ -4463,8 +4626,6 @@ do_initialize() {
     ALLOWRELATED="`added_param_value_yes ALLOWRELATED $ALLOWRELATED`"
     [ -n "$ALLOWRELATED" ] || \
 	startup_error "ALLOWRELATED=No is not supported"
-    NAT_ENABLED="`added_param_value_yes NAT_ENABLED $NAT_ENABLED`"
-    MANGLE_ENABLED="`added_param_value_yes MANGLE_ENABLED $MANGLE_ENABLED`"
     ADD_IP_ALIASES="`added_param_value_yes ADD_IP_ALIASES $ADD_IP_ALIASES`"
     TC_ENABLED="`added_param_value_yes TC_ENABLED $TC_ENABLED`"
 
@@ -4496,7 +4657,6 @@ do_initialize() {
     ADD_SNAT_ALIASES=`added_param_value_no ADD_SNAT_ALIASES $ADD_SNAT_ALIASES`
     ROUTE_FILTER=`added_param_value_no ROUTE_FILTER $ROUTE_FILTER`
     NAT_BEFORE_RULES=`added_param_value_yes NAT_BEFORE_RULES $NAT_BEFORE_RULES`
-    MULTIPORT=`added_param_value_no MULTIPORT $MULTIPORT`
     DETECT_DNAT_IPADDRS=`added_param_value_no DETECT_DNAT_IPADDRS $DETECT_DNAT_IPADDRS`
     FORWARDPING=`added_param_value_no FORWARDPING $FORWARDPING`
     [ -n "$FORWARDPING" ] && \
@@ -4567,6 +4727,19 @@ do_initialize() {
     #
     strip_file interfaces
     strip_file hosts
+    #
+    # Determine the capabilities of the installed iptables/netfilter
+    #
+    determine_capabilities
+    #
+    # Check out the user's shell
+    #
+    [ -n "$SHOREWALL_SHELL" ] || SHOREWALL_SHELL=/bin/sh
+
+    temp=`decodeaddr 192.168.1.1` 
+    if [ `encodeaddr $temp` != 192.168.1.1 ]; then
+	startup_error "Shell $SHOREWALL_SHELL is broken and may not be used with Shorewall"
+    fi
 }
 
 #
@@ -4719,6 +4892,15 @@ case "$command" in
 	my_mutex_off
 	;;
 
+    call)
+	#
+	# Undocumented way to call functions in /usr/share/shorewall/firewall directly
+	#
+	shift;
+	do_initialize
+	EMPTY=
+	$@
+	;;
     *)
 	usage
 	;;

Lrp/usr/share/shorewall/functions

@@ -83,29 +83,23 @@ find_display() # $1 = zone, $2 = name of the zone file
 	[ "x$1" = "x$z" ] && echo $display
     done
 }
-
+#
+# This function assumes that the TMP_DIR variable is set and that
+# its value named an existing directory.
+#
 determine_zones()
 {
     local zonefile=`find_file zones`
 
     multi_display=Multi-zone
+    strip_file zones $zonefile
+    zones=`find_zones $TMP_DIR/zones`
+    zones=`echo $zones` # Remove extra trash
     
-    if [ -f $zonefile ]; then
+    for zone in $zones; do
-	zones=`find_zones $zonefile`
+	dsply=`find_display $zone $TMP_DIR/zones`
-	zones=`echo $zones` # Remove extra trash
+	eval ${zone}_display=\$dsply
-
+    done
-	for zone in $zones; do
-	    dsply=`find_display $zone $zonefile`
-	    eval ${zone}_display=\$dsply
-        done
-    else
-	zones="net local dmz gw"
-	net_display=Net
-	local_display=Local
-	dmz_display=DMZ
-	gw_display=Gateway
-    fi
-
 }
 
 #
@@ -225,3 +219,164 @@ strip_file() # $1 = Base Name of the file, $2 = Full Name of File (optional)
 	> $TMP_DIR/$1
     fi
 }
+
+#
+#  Note: The following set of IP address manipulation functions have anomalous
+#        behavior when the shell only supports 32-bit signed arithmatic and
+#        the IP address is 128.0.0.0 or 128.0.0.1.
+#
+#
+# So that emacs doesn't get lost, we use $LEFTSHIFT rather than <<
+#
+LEFTSHIFT='<<'
+
+#
+# Convert an IP address in dot quad format to an integer
+#
+decodeaddr() {
+    local x
+    local temp=0
+    local ifs=$IFS
+    
+    IFS=.
+
+    for x in $1; do
+	temp=$(( $(( $temp $LEFTSHIFT 8 )) | $x ))
+    done
+
+    echo $temp
+
+    IFS=$ifs
+}
+
+#
+# convert an integer to dot quad format
+#
+encodeaddr() {
+    addr=$1
+    local x
+    local y=$(($addr & 255))
+
+    for x in 1 2 3 ; do
+	addr=$(($addr >> 8))
+	y=$(($addr & 255)).$y
+    done
+
+    echo $y
+}
+
+#
+# Enumerate the members of an IP range -- When using a shell supporting only
+# 32-bit signed arithmetic, the range cannot span 128.0.0.0.
+#
+ip_range() {
+    local first last l x y z vlsm
+
+    case $1 in 
+    [0-9]*.*.*.*-*.*.*.*)
+	;;
+    *)
+	echo $1
+	return
+	;;
+    esac
+
+    first=`decodeaddr ${1%-*}`
+    last=`decodeaddr ${1#*-}`
+
+    if [ $first -gt $last ]; then
+	fatal_error "Invalid IP address range: $1"
+    fi
+
+    l=$(( $last + 1 ))
+
+    while [ $first -le $last ]; do
+	vlsm=
+	x=31
+	y=2
+	z=1
+
+	while [ $(( $first % $y )) -eq 0 -a $(( $first + $y )) -le $l ]; do
+	    vlsm=/$x
+	    x=$(( $x - 1 ))
+	    z=$y
+	    y=$(( $y * 2 ))
+	done
+
+	echo `encodeaddr $first`$vlsm
+	first=$(($first + $z))
+    done
+}
+
+#
+# Netmask from CIDR
+#
+ip_netmask() {
+    local vlsm=${1#*/}
+
+    [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 $LEFTSHIFT $(( 32 - $vlsm )) ))
+}
+
+#
+# Network address from CIDR
+#
+ip_network() {
+    local decodedaddr=`decodeaddr ${1%/*}`
+    local netmask=`ip_netmask $1`
+
+    echo `encodeaddr $(($decodedaddr & $netmask))`
+}
+
+#
+# The following hack is supplied to compensate for the fact that many of
+# the popular light-weight Bourne shell derivatives don't support XOR ("^").
+#
+# Note: 2147483647 = 0x7fffffff
+
+ip_broadcast() {
+    local x=$(( ${1#*/} - 1 ))
+
+    [ $x -eq -1 ] && echo -1 || echo $(( 2147483647 >> $x ))
+}
+
+#
+# Calculate broadcast address from CIDR
+#
+broadcastaddress() {
+    local decodedaddr=`decodeaddr ${1%/*}`
+    local netmask=`ip_netmask $1`
+    local broadcast=`ip_broadcast $1`
+
+    echo `encodeaddr $(( $(($decodedaddr & $netmask)) | $broadcast ))`
+}
+
+#
+# Test for subnet membership
+#
+in_subnet() # $1 = IP address, $2 = CIDR network
+{
+    local netmask=`ip_netmask $2`
+
+    test $(( `decodeaddr $1` & $netmask)) -eq $(( `decodeaddr ${2%/*}` & $netmask ))
+}
+
+#
+# Netmask to VLSM
+#
+ip_vlsm() {
+    local mask=`decodeaddr $1`
+    local vlsm=0
+    local x=$(( 128 $LEFTSHIFT 24 ))
+
+    while [ $(( $x & $mask )) -ne 0 ]; do
+	[ $mask -eq $x ] && mask=0 || mask=$(( $mask $LEFTSHIFT 1 )) # Don't Ask...
+	vlsm=$(($vlsm + 1))
+    done
+
+    if [ $(( $mask & 2147483647)) -ne 0 ]; then
+	echo "Invalid net mask: $1" >&2
+    else
+	echo $vlsm
+    fi
+}
+

Lrp/usr/share/shorewall/version

@@ -1 +1 @@
-1.4.5
+1.4.6

Lrp/var/lib/lrpkg/shorwall.version

@@ -1 +1 @@
-1.4.5
+1.4.6

STABLE/changelog.txt

@@ -1,15 +1,53 @@
-Changes since 1.4.4b
+Changes since 1.4.5
 
-1) The command "shorewall debug try <directory>" now correctly traces
+1) Worked around RH7.3 "service" anomaly.
-   the attempt.
 
-2) The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may now
+2) Implemented 'newnotsyn' interface option.
-   contain a list of addresses. If the list begins with "!' then the
-   rule will take effect only if the original destination address in
-   the connection request does not match any of the addresses listed.
 
-3) Enhanced processing of the zones file to allow the INCLUDE
+3) Document range in masq ADDRESS column and suppress ADD_SNAT_ALIASES
-   directive.
+   behavior in that case.
 
-4) Fix processing of the routestopped file's second column.
+4) Enable ADD_SNAT_ALIASES=Yes for SNAT ranges.
 
+5) Allow Shorewall to add aliases to other than the first subnet on an
+   interface.
+
+6) Add support for load-balancing.
+
+7) Toned down the disclaimer for the 'check' command.
+
+8) Implemented support for the Connection Tracking Match extension in
+   iptables 1.2.8/Kernel 2.4.21.
+
+9) Removed the NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
+   parameters and replaced them with code that detects these
+   capabilities.
+
+10) Added the SHOREWALL_SHELL configuraiton parameter.
+
+11) Fixed capability reporting (thanks to Simon Matter).
+
+12) Correct the implementation of destination IP list in DNAT[-] rules.
+
+13) Check for shells whose arithmetic support is broken.
+
+14) Moved IP Address manipulation functions to
+    /usr/share/shorewall/functions.
+
+15. Added ipcalc command.
+
+16. Fixed handling of destination DNS names containing a "-"
+
+17. Make ip_range() smarter.
+
+18. Added /sbin/shorewall iprange command.
+
+19. Fixed handling of excluded zone processing in DNAT and REDIRECT
+    rules (re-added the protocol to the rule). Fixed parsing of exclude
+    zones.
+
+20. Display policy chain along with policy in 'check' command.
+
+21. Support Linux 2.6 compressed modules.
+
+22. Don't display DHCP message when there are no DHCP interface.

STABLE/documentation/6to4.htm

@@ -14,32 +14,32 @@
       
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-     <tbody>
+      <tbody>
-      <tr>
+       <tr>
-       <td width="100%">              
+        <td width="100%">                     
       <h1 align="center"><font color="#ffffff">6to4 Tunnels</font></h1>
-       </td>
+        </td>
-     </tr>
+      </tr>
             
   </tbody>   
 </table>
       
 <h3>The 6to4 tunnel documentation is provided by Eric de Thouars.<br>
- </h3>
+  </h3>
    
 <h3><font color="#ff6633">Warning: </font>The 6to4 tunnel feature of Shorewall
-only facilitates IPv6 over IPv4 tunneling. It does not provide any IPv6 security 
+ only facilitates IPv6 over IPv4 tunneling. It does not provide any IPv6
-measures.</h3>
+security  measures.</h3>
       
 <p>6to4 tunneling with Shorewall can be used to connect your IPv6 network
-to another IPv6 network over an IPv4 infrastructure</p>
+ to another IPv6 network over an IPv4 infrastructure</p>
       
 <p>More information on Linux and IPv6 can be found in the  <a
- href="http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO">Linux IPv6 HOWTO</a>. Details
+ href="http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO">Linux IPv6 HOWTO</a>.
-on how to setup a 6to4 tunnels are described in the section  <a
+Details on how to setup a 6to4 tunnels are described in the section  <a
  href="http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/configuring-ipv6to4-tunnels.html">Setup
- of 6to4 tunnels</a>.</p>
+  of 6to4 tunnels</a>.</p>
       
 <h2>Connecting two IPv6 Networks</h2>
       
@@ -47,42 +47,42 @@ on how to setup a 6to4 tunnels are described in the section  <a
       
 <p align="center"> <img border="0" src="images/TwoIPv6Nets1.png"
  width="745" height="427" alt="">
-  </p>
+   </p>
       
 <p align="left">We want systems in the 2002:100:333::/64 subnetwork to be
-able to communicate with the systems in the 2002:488:999::/64 network. This 
+ able to communicate with the systems in the 2002:488:999::/64 network. This
-is accomplished through use of the /etc/shorewall/tunnels file and the "ip" 
+ is accomplished through use of the /etc/shorewall/tunnels file and the "ip"
-utility for network interface  and routing configuration.</p>
+ utility for network interface  and routing configuration.</p>
       
 <p align="left">Unlike GRE and IPIP tunneling, the /etc/shorewall/policy,
-/etc/shorewall/interfaces and /etc/shorewall/zones files are not used. There 
+ /etc/shorewall/interfaces and /etc/shorewall/zones files are not used. There
-is no need to declare a zone to  represent the remote IPv6 network. This remote
+ is no need to declare a zone to  represent the remote IPv6 network. This
-network is not visible on IPv4 interfaces and to  iptables. All that is visible
+remote network is not visible on IPv4 interfaces and to  iptables. All that
-on the IPv4 level is an IPv4 stream which contains IPv6 traffic.  Separate
+is visible on the IPv4 level is an IPv4 stream which contains IPv6 traffic.
-IPv6 interfaces and ip6tables rules need to be defined to handle this traffic.
+ Separate IPv6 interfaces and ip6tables rules need to be defined to handle
-</p>
+this traffic. </p>
        
 <p align="left">In /etc/shorewall/tunnels on system A, we need the following:</p>
       
 <blockquote>         
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-       <tbody>
+        <tbody>
+         <tr>
+          <td><b>TYPE</b></td>
+          <td><b>ZONE</b></td>
+          <td><b>GATEWAY</b></td>
+          <td><b>GATEWAY ZONE</b></td>
+        </tr>
         <tr>
-         <td><b>TYPE</b></td>
+          <td>6to4</td>
-         <td><b>ZONE</b></td>
+          <td>net</td>
-         <td><b>GATEWAY</b></td>
+          <td>134.28.54.2</td>
-         <td><b>GATEWAY ZONE</b></td>
+          <td> </td>
-       </tr>
+        </tr>
-       <tr>
-         <td>6to4</td>
-         <td>net</td>
-         <td>134.28.54.2</td>
-         <td> </td>
-       </tr>
                   
     </tbody>         
   </table>
-   </blockquote>
+    </blockquote>
       
 <p>This entry in /etc/shorewall/tunnels, opens the firewall so that the IPv6 
   encapsulation protocol (41) will be accepted to/from the remote gateway.</p>
@@ -91,52 +91,53 @@ IPv6 interfaces and ip6tables rules need to be defined to handle this traffic.
       
 <blockquote>         
   <p>&gt;ip tunnel add tun6to4 mode sit ttl 254 remote 134.28.54.2<br>
-    &gt;ip link set dev tun6to4 up<br>
+     &gt;ip link set dev tun6to4 up<br>
-    &gt;ip addr add 3ffe:8280:0:2001::1/64 dev tun6to4<br>
+     &gt;ip addr add 3ffe:8280:0:2001::1/64 dev tun6to4<br>
-    &gt;ip route add 2002:488:999::/64 via 3ffe:8280:0:2001::2</p>
+     &gt;ip route add 2002:488:999::/64 via 3ffe:8280:0:2001::2</p>
-   </blockquote>
+    </blockquote>
       
 <p>Similarly, in /etc/shorewall/tunnels on system B we have:</p>
       
 <blockquote>         
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-       <tbody>
+        <tbody>
+         <tr>
+          <td><b>TYPE</b></td>
+          <td><b>ZONE</b></td>
+          <td><b>GATEWAY</b></td>
+          <td><b>GATEWAY ZONE</b></td>
+        </tr>
         <tr>
-         <td><b>TYPE</b></td>
+          <td>6to4</td>
-         <td><b>ZONE</b></td>
+          <td>net</td>
-         <td><b>GATEWAY</b></td>
+          <td>206.191.148.9</td>
-         <td><b>GATEWAY ZONE</b></td>
+          <td> </td>
-       </tr>
+        </tr>
-       <tr>
-         <td>6to4</td>
-         <td>net</td>
-         <td>206.191.148.9</td>
-         <td> </td>
-       </tr>
                   
     </tbody>         
   </table>
-   </blockquote>
+    </blockquote>
       
 <p>And use the following commands to setup system B:</p>
       
 <blockquote>         
   <p>&gt;ip tunnel add tun6to4 mode sit ttl 254 remote 206.191.148.9<br>
-    &gt;ip link set dev tun6to4 up<br>
+     &gt;ip link set dev tun6to4 up<br>
-    &gt;ip addr add 3ffe:8280:0:2001::2/64 dev tun6to4<br>
+     &gt;ip addr add 3ffe:8280:0:2001::2/64 dev tun6to4<br>
-    &gt;ip route add 2002:100:333::/64 via 3ffe:8280:0:2001::1</p>
+     &gt;ip route add 2002:100:333::/64 via 3ffe:8280:0:2001::1</p>
-   </blockquote>
+    </blockquote>
        
 <p>On both systems, restart Shorewall and issue the configuration commands
-as  listed above. The systems in both IPv6 subnetworks can now talk to each 
+ as  listed above. The systems in both IPv6 subnetworks can now talk to each
-other using IPv6.</p>
+ other using IPv6.</p>
       
 <p><font size="2">Updated 5/18/2003 - <a href="support.htm">Tom Eastep</a> 
  </font></p>
       
 <p><a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2001, 2002, 2003Thomas M. Eastep and Eric de Thouars.</font></a></p>
-    <br>
+     <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/ECN.html

@@ -2,82 +2,90 @@
 <html>
 <head>
   <title>Shorewall and ECN</title>
+      
   <meta http-equiv="content-type"
  content="text/html; charset=ISO-8859-1">
+   
   <meta name="author" content="Tom Eastep">
 </head>
-<body>
+  <body>
+ 
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber4"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                                                       <tbody>
+                                                        <tbody>
-                                                        <tr>
+                                                         <tr>
-                                                         <td
+                                                          <td
  width="100%">                   
       <h1 align="center"><font color="#ffffff">ECN</font></h1>
-                                                         </td>
+                                                          </td>
-                                                       </tr>
+                                                        </tr>
           
   </tbody>  
 </table>
-<br>
+ <br>
-Explicit Congestion Notification (ECN) is described in RFC 3168 and is a
+ Explicit Congestion Notification (ECN) is described in RFC 3168 and is a 
-proposed internet standard. Unfortunately, not all sites support ECN and
+proposed internet standard. Unfortunately, not all sites support ECN and when
-when a TCP connection offering ECN is sent to sites that don't support it,
+a TCP connection offering ECN is sent to sites that don't support it, the
-the result is often that the connection request is ignored.<br>
+result is often that the connection request is ignored.<br>
-<br>
+ <br>
-To allow ECN to be used, Shorewall allows you to enable ECN on your Linux
+ To allow ECN to be used, Shorewall allows you to enable ECN on your Linux 
 systems then disable it in your firewall when the destination matches a list 
 that you create (the /etc/shorewall/ecn file).<br>
-<br>
+ <br>
-You enable ECN by<br>
+ You enable ECN by<br>
-<br>
+ <br>
+ 
 <blockquote>   
   <pre><b><font color="#009900">echo 1 &gt; /proc/sys/net/ipv4/tcp_ecn</font></b></pre>
-</blockquote>
+ </blockquote>
-You must arrange for that command to be executed at system boot. Most distributions
+ You must arrange for that command to be executed at system boot. Most distributions 
 have a method for doing that -- on RedHat, you make an entry in /etc/sysctl.conf.<br>
-<br>
+ <br>
+ 
 <blockquote>   
   <pre><b><font color="#009900">net.ipv4.tcp_ecn = 1<br><br></font></b></pre>
-</blockquote>
+ </blockquote>
-Entries in /etc/shorewall/ecn have two columns as follows:<br>
+ Entries in /etc/shorewall/ecn have two columns as follows:<br>
-<br>
+ <br>
-INTERFACE&nbsp;&nbsp;&nbsp; - The name of an interface on your system<br>
+ INTERFACE&nbsp;&nbsp;&nbsp; - The name of an interface on your system<br>
-<br>
+ <br>
-HOST(S)&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; - An address (host or subnet)
+ HOST(S)&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; - An address (host or subnet) 
 of a system or group of systems accessed through the &nbsp;interface in the 
 first column. You may include a comma-separated list of such addresses in 
 this column. <br>
-<br>
+ <br>
-Example: Your external interface is eth0 and you want to disable ECN for
+ Example: Your external interface is eth0 and you want to disable ECN for 
 tcp connections to 192.0.2.0/24:<br>
-<br>
+ <br>
-In /etc/shorewall/ecn:<br>
+ In /etc/shorewall/ecn:<br>
-<br>
+ <br>
+ 
 <blockquote>   
   <table cellpadding="2" cellspacing="0" border="1">
-    <tbody>
+     <tbody>
-      <tr>
+       <tr>
-        <td valign="top"><b>INTERFACE<br>
+         <td valign="top"><b>INTERFACE<br>
-        </b></td>
+         </b></td>
-        <td valign="top"><b>HOST(S)<br>
+         <td valign="top"><b>HOST(S)<br>
-        </b></td>
+         </b></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td valign="top">eth0<br>
+         <td valign="top">eth0<br>
-        </td>
+         </td>
-        <td valign="top">192.0.2.0/24<br>
+         <td valign="top">192.0.2.0/24<br>
-        </td>
+         </td>
-      </tr>
+       </tr>
+     
     </tbody>   
   </table>
-  <br>
+   <br>
-</blockquote>
+ </blockquote>
-<font size="2">Last updated 3/28/2003 - <a href="support.htm">Tom    Eastep</a></font> 
+ <font size="2">Last updated 3/28/2003 - <a href="support.htm">Tom    Eastep</a></font>
    
 <p><a href="copyright.htm"><font size="2">Copyright</font> &copy; <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
- </p>
+  </p>
+ <br>
 </body>
 </html>

STABLE/documentation/Forum.html

@@ -14,29 +14,32 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-   <tbody>
+    <tbody>
-    <tr>
+     <tr>
-     <td width="100%">
+      <td width="100%">       
       <h1 align="center"><font color="#ffffff">Support Forum</font></h1>
-     </td>
+      </td>
-   </tr>
+    </tr>
     
   </tbody> 
 </table>
   
 <h3><font color="#ff6633"></font></h3>
+ 
 <h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please 
  read the <a href="support.htm">Shorewall Support  Guide</a>.</h1>
+ 
 <p><a href="http://www.developercube.com/forum/index.php?c=8">Shorewall Support 
 Forum</a><br>
-</p>
+ </p>
   
 <p><font size="2">Updated 3/6/2003 - <a href="support.htm">Tom Eastep</a> 
 </font></p>
   
 <p><a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2003 Thomas M. Eastep.</font></a></p>
-  <br>
+   <br>
+ <br>
 </body>
 </html>

STABLE/documentation/GnuCopyright.htm

@@ -1,282 +1,341 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-
 <head>
-<meta http-equiv="Content-Language" content="en-us">
+ 
-<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+  <meta http-equiv="Content-Language" content="en-us">
-<meta name="ProgId" content="FrontPage.Editor.Document">
+ 
-<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-<title>Copyright</title>
+ 
+  <meta name="ProgId" content="FrontPage.Editor.Document">
+ 
+  <meta http-equiv="Content-Type"
+ content="text/html; charset=windows-1252">
+  <title>Copyright</title>
 </head>
+  <body>
   
-<body>
+<table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
+   <tbody>
+    <tr>
+     <td width="100%">     
+      <h2 align="center"><font color="#ffffff">GNU Free Documentation License</font></h2>
+     </td>
+   </tr>
  
-<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
+  </tbody>
-  <tr>
-    <td width="100%">
-    <h2 align="center"><font color="#FFFFFF">GNU Free Documentation License</font></h2>
-    </td>
-  </tr>
 </table>
+ 
 <p>Version 1.1, March 2000 </p>
-<pre>Copyright (C) 2000  Free Software Foundation, Inc.
+ 
-59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+<pre>Copyright (C) 2000  Free Software Foundation, Inc.<br>59 Temple Place, Suite 330, Boston, MA  02111-1307  USA<br>Everyone is permitted to copy and distribute verbatim copies<br>of this license document, but changing it is not allowed.<br></pre>
-Everyone is permitted to copy and distribute verbatim copies
+ 
-of this license document, but changing it is not allowed.
-</pre>
 <p><strong>0. PREAMBLE</strong> </p>
+ 
 <p>The purpose of this License is to make a manual, textbook, or other written 
-document &quot;free&quot; in the sense of freedom: to assure everyone the effective
+document "free" in the sense of freedom: to assure everyone the effective 
 freedom to copy and redistribute it, with or without modifying it, either 
-commercially or noncommercially. Secondarily, this License preserves for the
+commercially or noncommercially. Secondarily, this License preserves for
-author and publisher a way to get credit for their work, while not being
+the author and publisher a way to get credit for their work, while not being 
 considered responsible for modifications made by others. </p>
-<p>This License is a kind of &quot;copyleft&quot;, which means that derivative works of
+ 
-the document must themselves be free in the same sense. It complements the GNU
+<p>This License is a kind of "copyleft", which means that derivative works
-General Public License, which is a copyleft license designed for free software.
+of the document must themselves be free in the same sense. It complements
-</p>
+the GNU General Public License, which is a copyleft license designed for
-<p>We have designed this License in order to use it for manuals for free
+free software. </p>
-software, because free software needs free documentation: a free program should
+ 
-come with manuals providing the same freedoms that the software does. But this
+<p>We have designed this License in order to use it for manuals for free software,
-License is not limited to software manuals; it can be used for any textual work,
+because free software needs free documentation: a free program should come
-regardless of subject matter or whether it is published as a printed book. We
+with manuals providing the same freedoms that the software does. But this 
-recommend this License principally for works whose purpose is instruction or
+License is not limited to software manuals; it can be used for any textual
-reference. </p>
+work, regardless of subject matter or whether it is published as a printed
+book. We recommend this License principally for works whose purpose is instruction
+or reference. </p>
+ 
 <p><strong>1. APPLICABILITY AND DEFINITIONS</strong> </p>
+ 
 <p>This License applies to any manual or other work that contains a notice 
-placed by the copyright holder saying it can be distributed under the terms of
+placed by the copyright holder saying it can be distributed under the terms
-this License. The &quot;Document&quot;, below, refers to any such manual or work. Any
+of this License. The "Document", below, refers to any such manual or work.
-member of the public is a licensee, and is addressed as &quot;you&quot;. </p>
+Any member of the public is a licensee, and is addressed as "you". </p>
-<p>A &quot;Modified Version&quot; of the Document means any work containing the Document
+ 
-or a portion of it, either copied verbatim, or with modifications and/or
+<p>A "Modified Version" of the Document means any work containing the Document 
-translated into another language. </p>
+or a portion of it, either copied verbatim, or with modifications and/or translated
-<p>A &quot;Secondary Section&quot; is a named appendix or a front-matter section of the
+into another language. </p>
-Document that deals exclusively with the relationship of the publishers or
+ 
-authors of the Document to the Document's overall subject (or to related
+<p>A "Secondary Section" is a named appendix or a front-matter section of
+the Document that deals exclusively with the relationship of the publishers
+or authors of the Document to the Document's overall subject (or to related 
 matters) and contains nothing that could fall directly within that overall 
-subject. (For example, if the Document is in part a textbook of mathematics, a
+subject. (For example, if the Document is in part a textbook of mathematics,
-Secondary Section may not explain any mathematics.) The relationship could be a
+a Secondary Section may not explain any mathematics.) The relationship could
-matter of historical connection with the subject or with related matters, or of
+be a matter of historical connection with the subject or with related matters,
-legal, commercial, philosophical, ethical or political position regarding them.
+or of legal, commercial, philosophical, ethical or political position regarding
-</p>
+them. </p>
-<p>The &quot;Invariant Sections&quot; are certain Secondary Sections whose titles are
+ 
-designated, as being those of Invariant Sections, in the notice that says that
+<p>The "Invariant Sections" are certain Secondary Sections whose titles are 
-the Document is released under this License. </p>
+designated, as being those of Invariant Sections, in the notice that says
-<p>The &quot;Cover Texts&quot; are certain short passages of text that are listed, as
+that the Document is released under this License. </p>
-Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document
+ 
-is released under this License. </p>
+<p>The "Cover Texts" are certain short passages of text that are listed,
-<p>A &quot;Transparent&quot; copy of the Document means a machine-readable copy,
+as Front-Cover Texts or Back-Cover Texts, in the notice that says that the
-represented in a format whose specification is available to the general public,
+Document is released under this License. </p>
-whose contents can be viewed and edited directly and straightforwardly with
+ 
-generic text editors or (for images composed of pixels) generic paint programs
+<p>A "Transparent" copy of the Document means a machine-readable copy, represented
-or (for drawings) some widely available drawing editor, and that is suitable for
+in a format whose specification is available to the general public, whose
-input to text formatters or for automatic translation to a variety of formats
+contents can be viewed and edited directly and straightforwardly with generic
-suitable for input to text formatters. A copy made in an otherwise Transparent
+text editors or (for images composed of pixels) generic paint programs or
-file format whose markup has been designed to thwart or discourage subsequent
+(for drawings) some widely available drawing editor, and that is suitable
-modification by readers is not Transparent. A copy that is not &quot;Transparent&quot; is
+for input to text formatters or for automatic translation to a variety of
-called &quot;Opaque&quot;. </p>
+formats suitable for input to text formatters. A copy made in an otherwise
+Transparent file format whose markup has been designed to thwart or discourage
+subsequent modification by readers is not Transparent. A copy that is not
+"Transparent" is called "Opaque". </p>
+ 
 <p>Examples of suitable formats for Transparent copies include plain ASCII 
-without markup, Texinfo input format, LaTeX input format, SGML or XML using a
+without markup, Texinfo input format, LaTeX input format, SGML or XML using
-publicly available DTD, and standard-conforming simple HTML designed for human
+a publicly available DTD, and standard-conforming simple HTML designed for
-modification. Opaque formats include PostScript, PDF, proprietary formats that
+human modification. Opaque formats include PostScript, PDF, proprietary formats
-can be read and edited only by proprietary word processors, SGML or XML for
+that can be read and edited only by proprietary word processors, SGML or
-which the DTD and/or processing tools are not generally available, and the
+XML for which the DTD and/or processing tools are not generally available,
-machine-generated HTML produced by some word processors for output purposes
+and the machine-generated HTML produced by some word processors for output
-only. </p>
+purposes only. </p>
-<p>The &quot;Title Page&quot; means, for a printed book, the title page itself, plus such
+ 
-following pages as are needed to hold, legibly, the material this License
+<p>The "Title Page" means, for a printed book, the title page itself, plus
-requires to appear in the title page. For works in formats which do not have any
+such following pages as are needed to hold, legibly, the material this License 
-title page as such, &quot;Title Page&quot; means the text near the most prominent
+requires to appear in the title page. For works in formats which do not have
-appearance of the work's title, preceding the beginning of the body of the text.
+any title page as such, "Title Page" means the text near the most prominent 
-</p>
+appearance of the work's title, preceding the beginning of the body of the
+text. </p>
+ 
 <p><strong>2. VERBATIM COPYING</strong> </p>
+ 
 <p>You may copy and distribute the Document in any medium, either commercially 
-or noncommercially, provided that this License, the copyright notices, and the
+or noncommercially, provided that this License, the copyright notices, and
-license notice saying this License applies to the Document are reproduced in all
+the license notice saying this License applies to the Document are reproduced
-copies, and that you add no other conditions whatsoever to those of this
+in all copies, and that you add no other conditions whatsoever to those of
-License. You may not use technical measures to obstruct or control the reading
+this License. You may not use technical measures to obstruct or control the
-or further copying of the copies you make or distribute. However, you may accept
+reading or further copying of the copies you make or distribute. However,
-compensation in exchange for copies. If you distribute a large enough number of
+you may accept compensation in exchange for copies. If you distribute a large
-copies you must also follow the conditions in section 3. </p>
+enough number of copies you must also follow the conditions in section 3.
-<p>You may also lend copies, under the same conditions stated above, and you may
+</p>
-publicly display copies. </p>
+ 
+<p>You may also lend copies, under the same conditions stated above, and
+you may publicly display copies. </p>
+ 
 <p><strong>3. COPYING IN QUANTITY</strong> </p>
-<p>If you publish printed copies of the Document numbering more than 100, and
+ 
-the Document's license notice requires Cover Texts, you must enclose the copies
+<p>If you publish printed copies of the Document numbering more than 100,
-in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover
+and the Document's license notice requires Cover Texts, you must enclose
-Texts on the front cover, and Back-Cover Texts on the back cover. Both covers
+the copies in covers that carry, clearly and legibly, all these Cover Texts:
-must also clearly and legibly identify you as the publisher of these copies. The
+Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover.
-front cover must present the full title with all words of the title equally
+Both covers must also clearly and legibly identify you as the publisher of
-prominent and visible. You may add other material on the covers in addition.
+these copies. The front cover must present the full title with all words
-Copying with changes limited to the covers, as long as they preserve the title
+of the title equally prominent and visible. You may add other material on
-of the Document and satisfy these conditions, can be treated as verbatim copying
+the covers in addition. Copying with changes limited to the covers, as long
-in other respects. </p>
+as they preserve the title of the Document and satisfy these conditions,
-<p>If the required texts for either cover are too voluminous to fit legibly, you
+can be treated as verbatim copying in other respects. </p>
-should put the first ones listed (as many as fit reasonably) on the actual
+ 
+<p>If the required texts for either cover are too voluminous to fit legibly,
+you should put the first ones listed (as many as fit reasonably) on the actual 
 cover, and continue the rest onto adjacent pages. </p>
+ 
 <p>If you publish or distribute Opaque copies of the Document numbering more 
-than 100, you must either include a machine-readable Transparent copy along with
+than 100, you must either include a machine-readable Transparent copy along
-each Opaque copy, or state in or with each Opaque copy a publicly-accessible
+with each Opaque copy, or state in or with each Opaque copy a publicly-accessible 
-computer-network location containing a complete Transparent copy of the
+computer-network location containing a complete Transparent copy of the Document,
-Document, free of added material, which the general network-using public has
+free of added material, which the general network-using public has access
-access to download anonymously at no charge using public-standard network
+to download anonymously at no charge using public-standard network protocols.
-protocols. If you use the latter option, you must take reasonably prudent steps,
+If you use the latter option, you must take reasonably prudent steps, when
-when you begin distribution of Opaque copies in quantity, to ensure that this
+you begin distribution of Opaque copies in quantity, to ensure that this Transparent
-Transparent copy will remain thus accessible at the stated location until at
+copy will remain thus accessible at the stated location until at least one
-least one year after the last time you distribute an Opaque copy (directly or
+year after the last time you distribute an Opaque copy (directly or through
-through your agents or retailers) of that edition to the public. </p>
+your agents or retailers) of that edition to the public. </p>
+ 
 <p>It is requested, but not required, that you contact the authors of the 
-Document well before redistributing any large number of copies, to give them a
+Document well before redistributing any large number of copies, to give them
-chance to provide you with an updated version of the Document. </p>
+a chance to provide you with an updated version of the Document. </p>
+ 
 <p><strong>4. MODIFICATIONS</strong> </p>
+ 
 <p>You may copy and distribute a Modified Version of the Document under the 
 conditions of sections 2 and 3 above, provided that you release the Modified 
-Version under precisely this License, with the Modified Version filling the role
+Version under precisely this License, with the Modified Version filling the
-of the Document, thus licensing distribution and modification of the Modified
+role of the Document, thus licensing distribution and modification of the
-Version to whoever possesses a copy of it. In addition, you must do these things
+Modified Version to whoever possesses a copy of it. In addition, you must
-in the Modified Version: </p>
+do these things in the Modified Version: </p>
-<p>&nbsp;</p>
+ 
+<p> </p>
+ 
 <ul>
-  <li><strong>A.</strong> Use in the Title Page (and on the covers, if any) a
+   <li><strong>A.</strong> Use in the Title Page (and on the covers, if any)
-  title distinct from that of the Document, and from those of previous versions
+a   title distinct from that of the Document, and from those of previous
-  (which should, if there were any, be listed in the History section of the
+versions   (which should, if there were any, be listed in the History section
-  Document). You may use the same title as a previous version if the original
+of the   Document). You may use the same title as a previous version if the
-  publisher of that version gives permission. </li>
+original   publisher of that version gives permission. </li>
-  <li><strong>B.</strong> List on the Title Page, as authors, one or more
+   <li><strong>B.</strong> List on the Title Page, as authors, one or more 
-  persons or entities responsible for authorship of the modifications in the
+  persons or entities responsible for authorship of the modifications in
-  Modified Version, together with at least five of the principal authors of the
+the   Modified Version, together with at least five of the principal authors
-  Document (all of its principal authors, if it has less than five). </li>
+of the   Document (all of its principal authors, if it has less than five).
-  <li><strong>C.</strong> State on the Title page the name of the publisher of
-  the Modified Version, as the publisher. </li>
-  <li><strong>D.</strong> Preserve all the copyright notices of the Document.
   </li>
-  <li><strong>E.</strong> Add an appropriate copyright notice for your
+   <li><strong>C.</strong> State on the Title page the name of the publisher
-  modifications adjacent to the other copyright notices. </li>
+of   the Modified Version, as the publisher. </li>
-  <li><strong>F.</strong> Include, immediately after the copyright notices, a
+   <li><strong>D.</strong> Preserve all the copyright notices of the Document. 
-  license notice giving the public permission to use the Modified Version under
+  </li>
-  the terms of this License, in the form shown in the Addendum below. </li>
+   <li><strong>E.</strong> Add an appropriate copyright notice for your 
-  <li><strong>G.</strong> Preserve in that license notice the full lists of
+ modifications adjacent to the other copyright notices. </li>
-  Invariant Sections and required Cover Texts given in the Document's license
+   <li><strong>F.</strong> Include, immediately after the copyright notices,
-  notice. </li>
+a   license notice giving the public permission to use the Modified Version
-  <li><strong>H.</strong> Include an unaltered copy of this License. </li>
+under   the terms of this License, in the form shown in the Addendum below.
-  <li><strong>I.</strong> Preserve the section entitled &quot;History&quot;, and its
+  </li>
+   <li><strong>G.</strong> Preserve in that license notice the full lists
+of   Invariant Sections and required Cover Texts given in the Document's
+license   notice. </li>
+   <li><strong>H.</strong> Include an unaltered copy of this License. </li>
+   <li><strong>I.</strong> Preserve the section entitled "History", and its 
   title, and add to it an item stating at least the title, year, new authors, 
-  and publisher of the Modified Version as given on the Title Page. If there is
+  and publisher of the Modified Version as given on the Title Page. If there
-  no section entitled &quot;History&quot; in the Document, create one stating the title,
+is   no section entitled "History" in the Document, create one stating the
-  year, authors, and publisher of the Document as given on its Title Page, then
+title,   year, authors, and publisher of the Document as given on its Title
-  add an item describing the Modified Version as stated in the previous
+Page, then   add an item describing the Modified Version as stated in the
-  sentence. </li>
+previous   sentence. </li>
-  <li><strong>J.</strong> Preserve the network location, if any, given in the
+   <li><strong>J.</strong> Preserve the network location, if any, given in
-  Document for public access to a Transparent copy of the Document, and likewise
+the   Document for public access to a Transparent copy of the Document, and
-  the network locations given in the Document for previous versions it was based
+likewise   the network locations given in the Document for previous versions
-  on. These may be placed in the &quot;History&quot; section. You may omit a network
+it was based   on. These may be placed in the "History" section. You may
-  location for a work that was published at least four years before the Document
+omit a network   location for a work that was published at least four years
-  itself, or if the original publisher of the version it refers to gives
+before the Document   itself, or if the original publisher of the version
-  permission. </li>
+it refers to gives   permission. </li>
-  <li><strong>K.</strong> In any section entitled &quot;Acknowledgements&quot; or
+   <li><strong>K.</strong> In any section entitled "Acknowledgements" or 
-  &quot;Dedications&quot;, preserve the section's title, and preserve in the section all
+ "Dedications", preserve the section's title, and preserve in the section
-  the substance and tone of each of the contributor acknowledgements and/or
+all   the substance and tone of each of the contributor acknowledgements
-  dedications given therein. </li>
+and/or   dedications given therein. </li>
-  <li><strong>L.</strong> Preserve all the Invariant Sections of the Document,
+   <li><strong>L.</strong> Preserve all the Invariant Sections of the Document, 
   unaltered in their text and in their titles. Section numbers or the equivalent 
   are not considered part of the section titles. </li>
-  <li><strong>M.</strong> Delete any section entitled &quot;Endorsements&quot;. Such a
+   <li><strong>M.</strong> Delete any section entitled "Endorsements". Such
-  section may not be included in the Modified Version. </li>
+a   section may not be included in the Modified Version. </li>
-  <li><strong>N.</strong> Do not retitle any existing section as &quot;Endorsements&quot;
+   <li><strong>N.</strong> Do not retitle any existing section as "Endorsements" 
   or to conflict in title with any Invariant Section. </li>
+ 
 </ul>
-<p>If the Modified Version includes new front-matter sections or appendices that
+ 
-qualify as Secondary Sections and contain no material copied from the Document,
+<p>If the Modified Version includes new front-matter sections or appendices
-you may at your option designate some or all of these sections as invariant. To
+that qualify as Secondary Sections and contain no material copied from the
-do this, add their titles to the list of Invariant Sections in the Modified
+Document, you may at your option designate some or all of these sections
-Version's license notice. These titles must be distinct from any other section
+as invariant. To do this, add their titles to the list of Invariant Sections
-titles. </p>
+in the Modified Version's license notice. These titles must be distinct from
-<p>You may add a section entitled &quot;Endorsements&quot;, provided it contains nothing
+any other section titles. </p>
+ 
+<p>You may add a section entitled "Endorsements", provided it contains nothing 
 but endorsements of your Modified Version by various parties--for example, 
 statements of peer review or that the text has been approved by an organization 
 as the authoritative definition of a standard. </p>
+ 
 <p>You may add a passage of up to five words as a Front-Cover Text, and a 
-passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover
+passage of up to 25 words as a Back-Cover Text, to the end of the list of
-Texts in the Modified Version. Only one passage of Front-Cover Text and one of
+Cover Texts in the Modified Version. Only one passage of Front-Cover Text
-Back-Cover Text may be added by (or through arrangements made by) any one
+and one of Back-Cover Text may be added by (or through arrangements made
-entity. If the Document already includes a cover text for the same cover,
+by) any one entity. If the Document already includes a cover text for the
-previously added by you or by arrangement made by the same entity you are acting
+same cover, previously added by you or by arrangement made by the same entity
-on behalf of, you may not add another; but you may replace the old one, on
+you are acting on behalf of, you may not add another; but you may replace
-explicit permission from the previous publisher that added the old one. </p>
+the old one, on explicit permission from the previous publisher that added
-<p>The author(s) and publisher(s) of the Document do not by this License give
+the old one. </p>
-permission to use their names for publicity for or to assert or imply
+ 
+<p>The author(s) and publisher(s) of the Document do not by this License
+give permission to use their names for publicity for or to assert or imply 
 endorsement of any Modified Version. </p>
+ 
 <p><strong>5. COMBINING DOCUMENTS</strong> </p>
-<p>You may combine the Document with other documents released under this
+ 
-License, under the terms defined in section 4 above for modified versions,
+<p>You may combine the Document with other documents released under this License,
-provided that you include in the combination all of the Invariant Sections of
+under the terms defined in section 4 above for modified versions, provided
-all of the original documents, unmodified, and list them all as Invariant
+that you include in the combination all of the Invariant Sections of all
-Sections of your combined work in its license notice. </p>
+of the original documents, unmodified, and list them all as Invariant Sections
+of your combined work in its license notice. </p>
+ 
 <p>The combined work need only contain one copy of this License, and multiple 
-identical Invariant Sections may be replaced with a single copy. If there are
+identical Invariant Sections may be replaced with a single copy. If there
-multiple Invariant Sections with the same name but different contents, make the
+are multiple Invariant Sections with the same name but different contents,
-title of each such section unique by adding at the end of it, in parentheses,
+make the title of each such section unique by adding at the end of it, in
-the name of the original author or publisher of that section if known, or else a
+parentheses, the name of the original author or publisher of that section
-unique number. Make the same adjustment to the section titles in the list of
+if known, or else a unique number. Make the same adjustment to the section
-Invariant Sections in the license notice of the combined work. </p>
+titles in the list of Invariant Sections in the license notice of the combined
-<p>In the combination, you must combine any sections entitled &quot;History&quot; in the
+work. </p>
-various original documents, forming one section entitled &quot;History&quot;; likewise
+ 
-combine any sections entitled &quot;Acknowledgements&quot;, and any sections entitled
+<p>In the combination, you must combine any sections entitled "History" in
-&quot;Dedications&quot;. You must delete all sections entitled &quot;Endorsements.&quot; </p>
+the various original documents, forming one section entitled "History"; likewise 
+combine any sections entitled "Acknowledgements", and any sections entitled 
+"Dedications". You must delete all sections entitled "Endorsements." </p>
+ 
 <p><strong>6. COLLECTIONS OF DOCUMENTS</strong> </p>
+ 
 <p>You may make a collection consisting of the Document and other documents 
 released under this License, and replace the individual copies of this License 
 in the various documents with a single copy that is included in the collection, 
-provided that you follow the rules of this License for verbatim copying of each
+provided that you follow the rules of this License for verbatim copying of
-of the documents in all other respects. </p>
+each of the documents in all other respects. </p>
-<p>You may extract a single document from such a collection, and distribute it
+ 
-individually under this License, provided you insert a copy of this License into
+<p>You may extract a single document from such a collection, and distribute
-the extracted document, and follow this License in all other respects regarding
+it individually under this License, provided you insert a copy of this License
-verbatim copying of that document. </p>
+into the extracted document, and follow this License in all other respects
+regarding verbatim copying of that document. </p>
+ 
 <p><strong>7. AGGREGATION WITH INDEPENDENT WORKS</strong> </p>
+ 
 <p>A compilation of the Document or its derivatives with other separate and 
 independent documents or works, in or on a volume of a storage or distribution 
-medium, does not as a whole count as a Modified Version of the Document,
+medium, does not as a whole count as a Modified Version of the Document, provided
-provided no compilation copyright is claimed for the compilation. Such a
+no compilation copyright is claimed for the compilation. Such a compilation
-compilation is called an &quot;aggregate&quot;, and this License does not apply to the
+is called an "aggregate", and this License does not apply to the other self-contained
-other self-contained works thus compiled with the Document, on account of their
+works thus compiled with the Document, on account of their being thus compiled,
-being thus compiled, if they are not themselves derivative works of the
+if they are not themselves derivative works of the Document. </p>
-Document. </p>
+ 
-<p>If the Cover Text requirement of section 3 is applicable to these copies of
+<p>If the Cover Text requirement of section 3 is applicable to these copies
-the Document, then if the Document is less than one quarter of the entire
+of the Document, then if the Document is less than one quarter of the entire 
-aggregate, the Document's Cover Texts may be placed on covers that surround only
+aggregate, the Document's Cover Texts may be placed on covers that surround
-the Document within the aggregate. Otherwise they must appear on covers around
+only the Document within the aggregate. Otherwise they must appear on covers
-the whole aggregate. </p>
+around the whole aggregate. </p>
+ 
 <p><strong>8. TRANSLATION</strong> </p>
+ 
 <p>Translation is considered a kind of modification, so you may distribute 
 translations of the Document under the terms of section 4. Replacing Invariant 
 Sections with translations requires special permission from their copyright 
-holders, but you may include translations of some or all Invariant Sections in
+holders, but you may include translations of some or all Invariant Sections
-addition to the original versions of these Invariant Sections. You may include a
+in addition to the original versions of these Invariant Sections. You may
-translation of this License provided that you also include the original English
+include a translation of this License provided that you also include the
-version of this License. In case of a disagreement between the translation and
+original English version of this License. In case of a disagreement between
-the original English version of this License, the original English version will
+the translation and the original English version of this License, the original
-prevail. </p>
+English version will prevail. </p>
+ 
 <p><strong>9. TERMINATION</strong> </p>
-<p>You may not copy, modify, sublicense, or distribute the Document except as
+ 
-expressly provided for under this License. Any other attempt to copy, modify,
+<p>You may not copy, modify, sublicense, or distribute the Document except
-sublicense or distribute the Document is void, and will automatically terminate
+as expressly provided for under this License. Any other attempt to copy,
-your rights under this License. However, parties who have received copies, or
+modify, sublicense or distribute the Document is void, and will automatically
-rights, from you under this License will not have their licenses terminated so
+terminate your rights under this License. However, parties who have received
-long as such parties remain in full compliance. </p>
+copies, or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance. </p>
+ 
 <p><strong>10. FUTURE REVISIONS OF THIS LICENSE</strong> </p>
-<p>The Free Software Foundation may publish new, revised versions of the GNU
-Free Documentation License from time to time. Such new versions will be similar
-in spirit to the present version, but may differ in detail to address new
-problems or concerns. See http://www.gnu.org/copyleft/. </p>
-<p>Each version of the License is given a distinguishing version number. If the
-Document specifies that a particular numbered version of this License &quot;or any
-later version&quot; applies to it, you have the option of following the terms and
-conditions either of that specified version or of any later version that has
-been published (not as a draft) by the Free Software Foundation. If the Document
-does not specify a version number of this License, you may choose any version
-ever published (not as a draft) by the Free Software Foundation. </p>
-<p align="left">&nbsp;</p>
  
+<p>The Free Software Foundation may publish new, revised versions of the
+GNU Free Documentation License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns. See http://www.gnu.org/copyleft/. </p>
+ 
+<p>Each version of the License is given a distinguishing version number.
+If the Document specifies that a particular numbered version of this License
+"or any later version" applies to it, you have the option of following the
+terms and conditions either of that specified version or of any later version
+that has been published (not as a draft) by the Free Software Foundation.
+If the Document does not specify a version number of this License, you may
+choose any version ever published (not as a draft) by the Free Software Foundation.
+</p>
+ 
+<p align="left"> </p>
+  <br>
 </body>
-
 </html>

STABLE/documentation/IPIP.htm

@@ -14,13 +14,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-   <tbody>
+    <tbody>
-    <tr>
+     <tr>
-     <td width="100%">
+      <td width="100%">       
       <h1 align="center"><font color="#ffffff">GRE and IPIP Tunnels</font></h1>
-     </td>
+      </td>
-   </tr>
+    </tr>
     
   </tbody> 
 </table>
@@ -43,7 +43,7 @@ directory (usually /usr/share/doc/shorewall-&lt;version&gt;/).</p>
   
 <p align="center"> <img border="0" src="images/TwoNets1.png" width="745"
  height="427">
-</p>
+ </p>
   
 <p align="left">We want systems in the 192.168.1.0/24 subnetwork to be able 
 to communicate with the systems in the 10.0.0.0/8 network. This is accomplished 
@@ -62,7 +62,7 @@ parameter to the type of tunnel that you want to create.</p>
   
 <blockquote>   
   <p align="left">tunnel_type=gre</p>
- </blockquote>
+  </blockquote>
   
 <p align="left">On each firewall, you will need to declare a zone to represent 
  the remote subnet. We'll assume that this zone is called 'vpn' and declare 
@@ -70,66 +70,66 @@ it in  /etc/shorewall/zones on both systems as follows.</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                <tbody>
+                 <tbody>
+       <tr>
+                <td><strong>ZONE</strong></td>
+                <td><strong>DISPLAY</strong></td>
+                <td><strong>COMMENTS</strong></td>
+            </tr>
+            <tr>
+                <td>vpn</td>
+                <td>VPN</td>
+                <td>Remote Subnet</td>
+            </tr>
+      
+    </tbody>   
+  </table>
+   </blockquote>
+  
+<p align="left">On system A, the 10.0.0.0/8 will comprise the <b>vpn</b> zone.
+In /etc/shorewall/interfaces:</p>
+  
+<blockquote>   
+  <table border="2" cellpadding="2" style="border-collapse: collapse;">
+      <tbody>
+       <tr>
+        <td><b>ZONE</b></td>
+        <td><b>INTERFACE</b></td>
+        <td><b>BROADCAST</b></td>
+        <td><b>OPTIONS</b></td>
+      </tr>
       <tr>
-               <td><strong>ZONE</strong></td>
+        <td>vpn</td>
-               <td><strong>DISPLAY</strong></td>
+        <td>tosysb</td>
-               <td><strong>COMMENTS</strong></td>
+        <td>10.255.255.255</td>
-           </tr>
+        <td> </td>
-           <tr>
+      </tr>
-               <td>vpn</td>
-               <td>VPN</td>
-               <td>Remote Subnet</td>
-           </tr>
       
     </tbody>   
   </table>
   </blockquote>
   
-<p align="left">On system A, the 10.0.0.0/8 will comprise the <b>vpn</b>
-zone. In /etc/shorewall/interfaces:</p>
-
-<blockquote>
-  <table border="2" cellpadding="2" style="border-collapse: collapse;">
-     <tbody>
-      <tr>
-       <td><b>ZONE</b></td>
-       <td><b>INTERFACE</b></td>
-       <td><b>BROADCAST</b></td>
-       <td><b>OPTIONS</b></td>
-     </tr>
-     <tr>
-       <td>vpn</td>
-       <td>tosysb</td>
-       <td>10.255.255.255</td>
-       <td> </td>
-     </tr>
-
-    </tbody>
-  </table>
- </blockquote>
-
 <p align="left">In /etc/shorewall/tunnels on system A, we need the following:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-     <tbody>
+      <tbody>
+       <tr>
+        <td><b>TYPE</b></td>
+        <td><b>ZONE</b></td>
+        <td><b>GATEWAY</b></td>
+        <td><b>GATEWAY ZONE</b></td>
+      </tr>
       <tr>
-       <td><b>TYPE</b></td>
+        <td>ipip</td>
-       <td><b>ZONE</b></td>
+        <td>net</td>
-       <td><b>GATEWAY</b></td>
+        <td>134.28.54.2</td>
-       <td><b>GATEWAY ZONE</b></td>
+        <td> </td>
-     </tr>
+      </tr>
-     <tr>
-       <td>ipip</td>
-       <td>net</td>
-       <td>134.28.54.2</td>
-       <td> </td>
-     </tr>
       
     </tbody>   
   </table>
- </blockquote>
+  </blockquote>
   
 <p>This entry in /etc/shorewall/tunnels, opens the firewall so that the IP 
  encapsulation protocol (4) will be accepted to/from the remote gateway.</p>
@@ -138,111 +138,112 @@ zone. In /etc/shorewall/interfaces:</p>
   
 <blockquote>   
   <p>tunnel=tosysb<br>
-   myrealip=206.161.148.9 (for GRE tunnel only)<br>
+    myrealip=206.161.148.9 (for GRE tunnel only)<br>
-   myip=192.168.1.1<br>
+    myip=192.168.1.1<br>
-   hisip=10.0.0.1<br>
+    hisip=10.0.0.1<br>
-   gateway=134.28.54.2<br>
+    gateway=134.28.54.2<br>
-   subnet=10.0.0.0/8</p>
+    subnet=10.0.0.0/8</p>
- </blockquote>
+  </blockquote>
   
 <p>Similarly, On system B the 192.168.1.0/24 subnet will comprise the <b>vpn</b> 
 zone. In /etc/shorewall/interfaces:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-     <tbody>
+      <tbody>
+       <tr>
+        <td><b>ZONE</b></td>
+        <td><b>INTERFACE</b></td>
+        <td><b>BROADCAST</b></td>
+        <td><b>OPTIONS</b></td>
+      </tr>
       <tr>
-       <td><b>ZONE</b></td>
+        <td>vpn</td>
-       <td><b>INTERFACE</b></td>
+        <td>tosysa</td>
-       <td><b>BROADCAST</b></td>
+        <td>192.168.1.255</td>
-       <td><b>OPTIONS</b></td>
+        <td> </td>
-     </tr>
+      </tr>
-     <tr>
-       <td>vpn</td>
-       <td>tosysa</td>
-       <td>192.168.1.255</td>
-       <td> </td>
-     </tr>
       
     </tbody>   
   </table>
- </blockquote>
+  </blockquote>
   
 <p>In /etc/shorewall/tunnels on system B, we have:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-     <tbody>
+      <tbody>
+       <tr>
+        <td><b>TYPE</b></td>
+        <td><b>ZONE</b></td>
+        <td><b>GATEWAY</b></td>
+        <td><b>GATEWAY ZONE</b></td>
+      </tr>
       <tr>
-       <td><b>TYPE</b></td>
+        <td>ipip</td>
-       <td><b>ZONE</b></td>
+        <td>net</td>
-       <td><b>GATEWAY</b></td>
+        <td>206.191.148.9</td>
-       <td><b>GATEWAY ZONE</b></td>
+        <td> </td>
-     </tr>
+      </tr>
-     <tr>
-       <td>ipip</td>
-       <td>net</td>
-       <td>206.191.148.9</td>
-       <td> </td>
-     </tr>
       
     </tbody>   
   </table>
- </blockquote>
+  </blockquote>
   
 <p>And in the tunnel script on system B:</p>
   
 <blockquote>   
   <p>tunnel=tosysa<br>
-   myrealip=134.28.54.2 (for GRE tunnel only)<br>
+    myrealip=134.28.54.2 (for GRE tunnel only)<br>
-   myip=10.0.0.1<br>
+    myip=10.0.0.1<br>
-   hisip=192.168.1.1<br>
+    hisip=192.168.1.1<br>
-   gateway=206.191.148.9<br>
+    gateway=206.191.148.9<br>
-   subnet=192.168.1.0/24</p>
+    subnet=192.168.1.0/24</p>
- </blockquote>
+  </blockquote>
   
 <p>You can rename the modified tunnel scripts if you like; be sure that they 
 are secured so that root can execute them.  </p>
   
 <p align="left"> You will need to allow traffic between the "vpn" zone and 
-       the "loc" zone on both systems -- if you simply want to admit all
+       the "loc" zone on both systems -- if you simply want to admit all traffic
-traffic        in both directions, you can use the policy file:</p>
+       in both directions, you can use the policy file:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                <tbody>
+                 <tbody>
-      <tr>
+       <tr>
-               <td><strong>SOURCE</strong></td>
+                <td><strong>SOURCE</strong></td>
-               <td><strong>DEST</strong></td>
+                <td><strong>DEST</strong></td>
-               <td><strong>POLICY</strong></td>
+                <td><strong>POLICY</strong></td>
-               <td><strong>LOG LEVEL</strong></td>
+                <td><strong>LOG LEVEL</strong></td>
-           </tr>
+            </tr>
-           <tr>
+            <tr>
-               <td>loc</td>
+                <td>loc</td>
-               <td>vpn</td>
+                <td>vpn</td>
-               <td>ACCEPT</td>
+                <td>ACCEPT</td>
-           <td> </td>
+            <td> </td>
-           </tr>
+            </tr>
-                               <tr>
+                                <tr>
-               <td>vpn</td>
+                <td>vpn</td>
-               <td>loc</td>
+                <td>loc</td>
-               <td>ACCEPT</td>
+                <td>ACCEPT</td>
-           <td> </td>
+            <td> </td>
-           </tr>
+            </tr>
       
     </tbody>   
   </table>
- </blockquote>
+  </blockquote>
   
-<p>On both systems, restart Shorewall and run the modified tunnel script
+<p>On both systems, restart Shorewall and run the modified tunnel script with
-with the "start" argument on each system. The systems in the two masqueraded
+the "start" argument on each system. The systems in the two masqueraded subnetworks
-subnetworks can now talk to each other</p>
+can now talk to each other</p>
   
 <p><font size="2">Updated 2/22/2003 - <a href="support.htm">Tom Eastep</a> 
 </font></p>
   
 <p><a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2001, 2002, 2003Thomas M. Eastep.</font></a></p>
-  <br>
+   <br>
+ <br>
 </body>
 </html>

STABLE/documentation/Install.htm

@@ -14,74 +14,74 @@
           
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-            <tbody>
+             <tbody>
-             <tr>
+              <tr>
-              <td width="100%">                            
+               <td width="100%">                                   
       <h1 align="center"><font color="#ffffff">Shorewall Installation and 
     Upgrade</font></h1>
-              </td>
+               </td>
-            </tr>
+             </tr>
                     
   </tbody>     
 </table>
           
 <p align="center"><b>Before upgrading, be sure to review the <a
  href="upgrade_issues.htm">Upgrade Issues<br>
-   </a></b></p>
+    </a></b></p>
        
-<div align="left"><b>Before attempting installation, I strongly urge you to
+<div align="left"><b>Before attempting installation, I strongly urge you
-read and print a copy of the       <a
+to read and print a copy of the       <a
  href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>    
-    for the configuration that most closely matches your own.</b><br>
+   for the configuration that most closely matches your own.</b><br>
-   </div>
+    </div>
           
 <p><font size="4"><b><a href="#Install_RPM">Install using RPM</a><br>
-          <a href="#Install_Tarball">Install using tarball<br>
+           <a href="#Install_Tarball">Install using tarball<br>
-       </a><a href="#LRP">Install the .lrp</a><br>
+        </a><a href="#LRP">Install the .lrp</a><br>
-          <a href="#Upgrade_RPM">Upgrade using RPM</a><br>
+           <a href="#Upgrade_RPM">Upgrade using RPM</a><br>
-          <a href="#Upgrade_Tarball">Upgrade using tarball<br>
+           <a href="#Upgrade_Tarball">Upgrade using tarball<br>
-       </a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
+        </a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
-          <a href="#Config_Files">Configuring Shorewall</a><br>
+           <a href="#Config_Files">Configuring Shorewall</a><br>
-          <a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
+           <a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
           
 <p><a name="Install_RPM"></a>To install Shorewall using the RPM:</p>
           
 <p><b>If you have RedHat 7.2 and are running iptables version 1.2.3 (at a 
-    shell  prompt, type "/sbin/iptables --version"), you must upgrade to
+    shell  prompt, type "/sbin/iptables --version"), you must upgrade to version
-version     1.2.4  either from the <a
+    1.2.4  either from the <a
  href="http://www.redhat.com/support/errata/RHSA-2001-144.html">RedHat update 
-     site</a> or from the <a href="errata.htm">Shorewall Errata page</a>
+     site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
-before      attempting to start Shorewall.</b></p>
+     attempting to start Shorewall.</b></p>
           
 <ul>
-            <li>Install the RPM (rpm -ivh &lt;shorewall rpm&gt;).<br>
+             <li>Install the RPM (rpm -ivh &lt;shorewall rpm&gt;).<br>
-            <br>
+             <br>
-            <b>Note1: </b>Some SuSE  users have encountered a problem whereby
+             <b>Note1: </b>Some SuSE  users have encountered a problem whereby 
   rpm  reports  a    conflict with kernel &lt;= 2.2 even though a 2.4 kernel 
   is installed.  If this    happens, simply use the --nodeps option to rpm 
  (rpm -ivh --nodeps  &lt;shorewall    rpm&gt;.<br>
-    <br>
+     <br>
-        <b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
+         <b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent 
   on the iproute package. Unfortunately, some distributions call this package 
   iproute2 which will cause the installation of Shorewall to fail with the 
  diagnostic:<br>
-        <br>
+         <br>
-         error: failed dependencies:iproute is needed by  shorewall-1.4.x-1
+          error: failed dependencies:iproute is needed by  shorewall-1.4.x-1 
      <br>
-        <br>
+         <br>
-    This may be worked around by using the --nodeps option of rpm (rpm -ivh 
+     This may be worked around by using the --nodeps option of rpm (rpm -ivh
- --nodeps &lt;shorewall rpm&gt;).<br>
+  --nodeps &lt;shorewall rpm&gt;).<br>
-        <br>
+         <br>
-      </li>
+       </li>
-            <li>Edit the <a href="#Config_Files"> configuration files</a> 
+             <li>Edit the <a href="#Config_Files"> configuration files</a>
-to  match   your configuration. <font color="#ff0000"><b>WARNING - YOU CAN 
+ to  match   your configuration. <font color="#ff0000"><b>WARNING - YOU CAN
-    <u>NOT</u>    SIMPLY INSTALL THE RPM  AND ISSUE A "shorewall start" COMMAND. 
+     <u>NOT</u>    SIMPLY INSTALL THE RPM  AND ISSUE A "shorewall start"
-SOME CONFIGURATION    IS REQUIRED BEFORE THE  FIREWALL WILL START. IF YOU 
+COMMAND.  SOME CONFIGURATION    IS REQUIRED BEFORE THE  FIREWALL WILL START.
-ISSUE A "start" COMMAND    AND THE FIREWALL FAILS TO  START, YOUR SYSTEM WILL
+IF YOU  ISSUE A "start" COMMAND    AND THE FIREWALL FAILS TO  START, YOUR
-NO LONGER ACCEPT ANY  NETWORK  TRAFFIC. IF THIS HAPPENS,  ISSUE A "shorewall 
+SYSTEM WILL NO LONGER ACCEPT ANY  NETWORK  TRAFFIC. IF THIS HAPPENS,  ISSUE
-clear" COMMAND TO  RESTORE NETWORK  CONNECTIVITY.</b></font></li>
+A "shorewall  clear" COMMAND TO  RESTORE NETWORK  CONNECTIVITY.</b></font></li>
-            <li>Start the firewall by typing "shorewall start"</li>
+             <li>Start the firewall by typing "shorewall start"</li>
           
 </ul>
           
@@ -89,50 +89,50 @@ clear" COMMAND TO  RESTORE NETWORK  CONNECTIVITY.</b></font></li>
     and install     script: </p>
           
 <ul>
-            <li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
+             <li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
-            <li>cd to the shorewall directory (the version is encoded in
+             <li>cd to the shorewall directory (the version is encoded in 
 the               directory name as in "shorewall-1.1.10").</li>
-            <li>If you are using <a
+             <li>If you are using <a
  href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
  href="http://www.redhat.com">RedHat</a>,           <a
  href="http://www.linux-mandrake.com">Mandrake</a>, <a
  href="http://www.corel.com">Corel</a>,           <a
  href="http://www.slackware.com/">Slackware</a> or           <a
  href="http://www.debian.org">Debian</a>             then type "./install.sh"</li>
-            <li>If you are using <a href="http://www.suse.com">SuSe</a> then
+             <li>If you are using <a href="http://www.suse.com">SuSe</a>
-  type       "./install.sh /etc/init.d"</li>
+then   type       "./install.sh /etc/init.d"</li>
-            <li>If your distribution has directory             /etc/rc.d/init.d
+             <li>If your distribution has directory             /etc/rc.d/init.d 
    or  /etc/init.d then type             "./install.sh"</li>
-            <li>For other distributions, determine where your           
+             <li>For other distributions, determine where your          
- distribution    installs init scripts and type             "./install.sh 
+  distribution    installs init scripts and type             "./install.sh
-&lt;init script   directory&gt;</li>
+ &lt;init script   directory&gt;</li>
-            <li>Edit the <a href="#Config_Files"> configuration files</a> 
+             <li>Edit the <a href="#Config_Files"> configuration files</a>
-to  match   your configuration.</li>
+ to  match   your configuration.</li>
-            <li>Start the firewall by typing "shorewall             start"</li>
+             <li>Start the firewall by typing "shorewall             start"</li>
-            <li>If the install script was unable to configure Shorewall to
+             <li>If the install script was unable to configure Shorewall
- be  started   automatically at boot,             see <a
+to  be  started   automatically at boot,             see <a
  href="starting_and_stopping_shorewall.htm">these             instructions</a>.</li>
           
 </ul>
           
 <p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering 
    disk, simply replace the "shorwall.lrp" file on the image with the file
- that  you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
+  that  you downloaded. See the <a href="two-interface.htm">two-interface
-  Guide</a> for information about further steps required.</p>
+QuickStart   Guide</a> for information about further steps required.</p>
           
 <p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed 
     and are upgrading to a new version:</p>
           
-<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
+<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version or
-or and you  have entries in the /etc/shorewall/hosts file then please check
+and you  have entries in the /etc/shorewall/hosts file then please check 
- your  /etc/shorewall/interfaces file to be sure that it contains an entry
+your  /etc/shorewall/interfaces file to be sure that it contains an entry 
    for each  interface mentioned in the hosts file. Also, there are certain 
   1.2 rule forms  that are no longer supported under 1.4 (you must use the
- new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for 
+  new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
- details.</p>
+  details.</p>
           
 <ul>
-            <li>Upgrade the RPM (rpm -Uvh &lt;shorewall rpm file&gt;) <b>Note:
+             <li>Upgrade the RPM (rpm -Uvh &lt;shorewall rpm file&gt;) <b>Note: 
        </b>If  you     are installing version 1.2.0 and have one of the 1.2.0 
    Beta RPMs installed,     you must use the "--oldpackage" option to rpm 
 (e.g.,   "rpm     -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").        
@@ -140,69 +140,69 @@ or and you  have entries in the /etc/shorewall/hosts file then please check
     <p>   <b>Note1: </b>Some SuSE users have encountered a problem whereby 
     rpm reports a    conflict with kernel &lt;= 2.2 even though a 2.4 kernel 
    is installed. If this    happens, simply use the --nodeps option to rpm
- (rpm   -Uvh --nodeps &lt;shorewall    rpm&gt;).<br>
+  (rpm   -Uvh --nodeps &lt;shorewall    rpm&gt;).<br>
+         <br>
+         <b>Note3: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
+  on the iproute package. Unfortunately, some distributions call this package
+  iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
         <br>
-        <b>Note3: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent 
+           error: failed dependencies:iproute is needed by  shorewall-1.4.0-1 
- on the iproute package. Unfortunately, some distributions call this package 
- iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
-       <br>
-          error: failed dependencies:iproute is needed by  shorewall-1.4.0-1
       <br>
-       <br>
+        <br>
-     This may be worked around by using the --nodeps option of rpm (rpm -Uvh
+      This may be worked around by using the --nodeps option of rpm (rpm
-  --nodeps &lt;shorewall rpm&gt;). </p>
+-Uvh   --nodeps &lt;shorewall rpm&gt;). </p>
-           </li>
+            </li>
-           <li>See if there are any incompatibilities between your configuration
+            <li>See if there are any incompatibilities between your configuration 
-   and the    new Shorewall version (type "shorewall check") and correct
+   and the    new Shorewall version (type "shorewall check") and correct as
-as   necessary.</li>
+  necessary.</li>
-            <li>Restart the firewall (shorewall restart).</li>
+             <li>Restart the firewall (shorewall restart).</li>
           
 </ul>
           
-<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed and
+<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed
-are upgrading to a new version using the tarball:</p>
+and are upgrading to a new version using the tarball:</p>
           
-<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version and
+<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
-you  have entries in the /etc/shorewall/hosts file then please check your
+and you  have entries in the /etc/shorewall/hosts file then please check
- /etc/shorewall/interfaces file to be sure that it contains an entry for
+your  /etc/shorewall/interfaces file to be sure that it contains an entry
-each  interface mentioned in the hosts file.  Also, there are certain 1.2
+for each  interface mentioned in the hosts file.  Also, there are certain
-rule  forms that are no longer supported under 1.4 (you must use the new
+1.2 rule  forms that are no longer supported under 1.4 (you must use the
-1.4 syntax).  See <a href="errata.htm#Upgrade">the upgrade issues</a> for
+new 1.4 syntax).  See <a href="errata.htm#Upgrade">the upgrade issues</a>
-details. </p>
+for details. </p>
           
 <ul>
-        <li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
+         <li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
-            <li>cd to the shorewall directory (the version is encoded in
+             <li>cd to the shorewall directory (the version is encoded in 
 the               directory name as in "shorewall-3.0.1").</li>
-            <li>If you are using <a
+             <li>If you are using <a
  href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
  href="http://www.redhat.com">RedHat</a>,           <a
  href="http://www.linux-mandrake.com">Mandrake</a>, <a
  href="http://www.corel.com">Corel</a>,           <a
  href="http://www.slackware.com/">Slackware</a> or           <a
  href="http://www.debian.org">Debian</a>             then type "./install.sh"</li>
-            <li>If you are using<a href="http://www.suse.com"> SuSe</a> then
+             <li>If you are using<a href="http://www.suse.com"> SuSe</a>
-  type       "./install.sh /etc/init.d"</li>
+then   type       "./install.sh /etc/init.d"</li>
-            <li>If your distribution has directory             /etc/rc.d/init.d
+             <li>If your distribution has directory             /etc/rc.d/init.d 
    or  /etc/init.d then type             "./install.sh"</li>
-            <li>For other distributions, determine where your           
+             <li>For other distributions, determine where your          
- distribution    installs init scripts and type             "./install.sh 
+  distribution    installs init scripts and type             "./install.sh
-&lt;init script   directory&gt;</li>
+ &lt;init script   directory&gt;</li>
-            <li>See if there are any incompatibilities between your configuration
+             <li>See if there are any incompatibilities between your configuration 
-   and the    new Shorewall version (type "shorewall check") and correct
+   and the    new Shorewall version (type "shorewall check") and correct as
-as   necessary.</li>
+  necessary.</li>
-            <li>Restart the firewall by typing "shorewall restart"</li>
+             <li>Restart the firewall by typing "shorewall restart"</li>
           
 </ul>
-                <a name="LRP_Upgrade"></a>If you already have a running Bering
+                 <a name="LRP_Upgrade"></a>If you already have a running
-   installation and wish to upgrade to a later version of Shorewall:<br>
+Bering    installation and wish to upgrade to a later version of Shorewall:<br>
-       <br>
+        <br>
-           <b>UNDER CONSTRUCTION...</b><br>
+            <b>UNDER CONSTRUCTION...</b><br>
           
 <h3><a name="Config_Files"></a>Configuring Shorewall</h3>
           
-<p>You will need to edit some or all of the configuration files to match
+<p>You will need to edit some or all of the configuration files to match your
-your  setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall
+ setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall 
     QuickStart Guides</a> contain all of the information you need.</p>
           
 <ul>
@@ -214,7 +214,8 @@ your  setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewa
           
 <p><a href="copyright.htm"><font size="2">Copyright</font>   © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
- </p>
+  </p>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/MAC_Validation.html

@@ -12,106 +12,110 @@
         
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber4"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                   <tbody>
+                     <tbody>
-                  <tr>
+                    <tr>
-                    <td width="100%">               
+                      <td width="100%">                             
       <h1 align="center"><font color="#ffffff">MAC Verification</font><br>
-           </h1>
+             </h1>
-                    <br>
+                      <br>
-           </td>
+             </td>
-                  </tr>
+                    </tr>
                 
   </tbody>    
 </table>
-          <br>
+            <br>
-          All traffic from an interface    or  from a subnet on an interface
+            All traffic from an interface    or  from a subnet on an interface
- can be verified to originate from a defined     set of MAC addresses. Furthermore,
+  can be verified to originate from a defined     set of MAC addresses. Furthermore,
- each MAC address may be optionally associated    with one or more IP addresses.
+  each MAC address may be optionally associated    with one or more IP addresses.
- <br>
+  <br>
-      <br>
+        <br>
-      <b>Your kernel must include MAC match support (CONFIG_IP_NF_MATCH_MAC
+        <b>Your kernel must include MAC match support (CONFIG_IP_NF_MATCH_MAC
-  - module name ipt_mac.o).</b><br>
+   - module name ipt_mac.o).</b><br>
-      <br>
+        <br>
-      There are four components to this facility.<br>
+        There are four components to this facility.<br>
         
 <ol>
-            <li>The <b>maclist</b> interface option in <a
+              <li>The <b>maclist</b> interface option in <a
  href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When
 this option is specified, all traffic arriving on the interface is subjet
 to MAC verification.</li>
-            <li>The <b>maclist </b>option in <a
+              <li>The <b>maclist </b>option in <a
  href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>.   When this option
-  is specified for a subnet, all traffic from that subnet  is subject to
+   is specified for a subnet, all traffic from that subnet  is subject to
 MAC   verification.</li>
-            <li>The /etc/shorewall/maclist file. This file is used to associate
+              <li>The /etc/shorewall/maclist file. This file is used to associate
-   MAC  addresses with interfaces and to optionally associate IP addresses
+    MAC  addresses with interfaces and to optionally associate IP addresses
- with  MAC  addresses.</li>
+  with  MAC  addresses.</li>
-            <li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
+              <li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL 
-     in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
+    </b>variables      in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
-  The   MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT
+   The   MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT
-and  determines   the disposition of connection requests that fail MAC verification.
+ and  determines   the disposition of connection requests that fail MAC verification.
-  The MACLIST_LOG_LEVEL   variable gives the syslogd level at which connection
+   The MACLIST_LOG_LEVEL   variable gives the syslogd level at which connection
-  requests that fail verification  are to be logged. If set the the empty
+   requests that fail verification  are to be logged. If set the the empty
-value  (e.g., MACLIST_LOG_LEVEL="")   then failing connection requests are
+ value  (e.g., MACLIST_LOG_LEVEL="")   then failing connection requests are
-not logged.<br>
+ not logged.<br>
-            </li>
+              </li>
         
 </ol>
-          The columns in /etc/shorewall/maclist are:<br>
+            The columns in /etc/shorewall/maclist are:<br>
         
 <ul>
-            <li>INTERFACE - The name of an ethernet interface on the Shorewall
+              <li>INTERFACE - The name of an ethernet interface on the Shorewall
-   system.</li>
+    system.</li>
-            <li>MAC - The MAC address of a device on the ethernet segment 
+              <li>MAC - The MAC address of a device on the ethernet segment 
-connected     by INTERFACE. It is not necessary to use the Shorewall MAC format
+ connected     by INTERFACE. It is not necessary to use the Shorewall MAC 
-in this     column although you may use that format if you so choose.</li>
+format in this     column although you may use that format if you so choose.</li>
-            <li>IP Address - An optional comma-separated list of IP addresses
+              <li>IP Address - An optional comma-separated list of IP addresses
-  for   the device whose MAC is listed in the MAC column.</li>
+   for   the device whose MAC is listed in the MAC column.</li>
         
 </ul>
         
-<h3>Example 1: Here are my files:</h3>
+<h3>Example 1: Here are my files (look <a href="myfiles.htm">here</a> for 
-          <b>/etc/shorewall/shorewall.conf:<br>
+details about my setup):</h3>
-          </b>  
+            <b>/etc/shorewall/shorewall.conf:<br>
+            </b>    
 <pre>     MACLIST_DISPOSITION=REJECT<br>     MACLIST_LOG_LEVEL=info<br></pre>
-          <b>/etc/shorewall/interfaces:</b><br>
+            <b>/etc/shorewall/interfaces:</b><br>
         
 <blockquote>         
-  <pre>#ZONE   INTERFACE        BROADCAST       OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>wap     eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255</pre>
+  <pre>#ZONE   INTERFACE        BROADCAST       OPTIONS<br>net     eth0            206.124.146.255 dhcp,norfc1918,routefilter,blacklist,tcpflags<br>loc     eth2            192.168.1.255   dhcp<br>dmz     eth1            192.168.2.255<br>WiFi    eth3            192.168.3.255   dhcp,maclist<br>-       texas           192.168.9.255</pre>
- </blockquote>
+   </blockquote>
-          <b>/etc/shorewall/maclist:</b><br>
+            <b>/etc/shorewall/maclist:</b><br>
         
 <blockquote>         
-  <pre>#INTERFACE              MAC                     IP ADDRESSES (Optional)<br>eth3                    00:A0:CC:A2:0C:A0       192.168.3.7     #Work Laptop<br>eth3                    00:04:5a:fe:85:b9       192.168.3.250   #WAP11<br>eth3                    00:06:25:56:33:3c                       #WET11<br>eth3                    00:0b:cd:C4:cc:97       192.168.3.8     #TIPPER</pre>
+  <pre>#INTERFACE              MAC                     IP ADDRESSES (Optional)<br>eth3                    00:A0:CC:A2:0C:A0       192.168.3.7                 #Work Laptop<br>eth3                    00:04:5a:fe:85:b9       192.168.3.250               #WAP11<br>eth3                    00:06:25:56:33:3c       192.168.3.225,192.168.3.8   #WET11<br>eth3                    00:0b:cd:C4:cc:97       192.168.3.8                 #TIPPER</pre>
- </blockquote>
+   </blockquote>
- As shown above, I use MAC Verification on my wireless zone.<br>
+   As shown above, I use MAC Verification on my wireless zone.<br>
-<br>
+  <br>
-<b>Note: </b>The WET11 is a somewhat curious device; when forwarding DHCP
+  <b>Note: </b>While marketed as a wireless bridge, the WET11 behaves like 
-traffic, it uses the MAC address of the host (TIPPER) but for other forwarded
+a wireless router with DHCP relay. When forwarding DHCP traffic, it uses the
-traffic it uses it's own MAC address. Consequently, I don't assign the WET11
+MAC address of the host (TIPPER) but for other forwarded traffic it uses it's
-a fixed IP address in /etc/shorewall/maclist.<br>
+own MAC address. Consequently, I list the IP addresses of both devices in
+/etc/shorewall/maclist.<br>
         
-<h3>Example 2: Router in Local Zone</h3>
+<h3>Example 2: Router in Wireless Zone</h3>
-          Suppose now that I add a second wireless segment to my wireless 
+            Suppose now that I add a second wireless segment to my wireless 
-zone and   gateway  that segment via a router with MAC address 00:06:43:45:C6:15
+ zone and   gateway  that segment via a router with MAC address 00:06:43:45:C6:15
- and   IP address  192.168.3.253. Hosts in the second segment have IP addresses
+  and   IP address  192.168.3.253. Hosts in the second segment have IP addresses
-  in the subnet  192.168.4.0/24. I would add the following entry to my /etc/shorewall/maclist
+   in the subnet  192.168.4.0/24. I would add the following entry to my /etc/shorewall/maclist
-     file:<br>
+      file:<br>
         
 <pre>     eth3                     00:06:43:45:C6:15       192.168.3.253,192.168.4.0/24<br></pre>
-          This entry accomodates traffic from the router itself (192.168.3.253)
+            This entry accomodates traffic from the router itself (192.168.3.253)
-   and  from the second wireless segment (192.168.4.0/24). Remember that
+    and  from the second wireless segment (192.168.4.0/24). Remember that
 all traffic    being  sent to my firewall from the 192.168.4.0/24 segment
 will be forwarded    by the router so that traffic's MAC address will be
 that of the router (00:06:43:45:C6:15)    and not that of the host sending
 the traffic.     
-<p><font size="2">   Updated 6/10/2002 - <a href="support.htm">Tom  Eastep</a>
+<p><font size="2">   Updated 6/30/2002 - <a href="support.htm">Tom  Eastep</a>
-        </font></p>
+         </font></p>
           
 <p><a href="copyright.htm"><font size="2">Copyright</font>         &copy;
-  <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
+   <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-    </p>
+      </p>
+      <br>
+     <br>
     <br>
    <br>
   <br>

STABLE/documentation/NAT.htm

@@ -12,106 +12,108 @@
 </head>
   <body>
                                 
-<blockquote>   
+<table border="0" cellpadding="0" cellspacing="0"
-  <table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- style="border-collapse: collapse;" width="100%" id="AutoNumber1"
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
- bgcolor="#400169" height="90">
+       <tbody>
-        <tbody>
+        <tr>
-       <tr>
+         <td width="100%">                            
-          <td width="100%">         
+      <h1 align="center"><font color="#ffffff">Static Nat</font></h1>
-        <h1 align="center"><font color="#ffffff">Static NAT</font></h1>
+         </td>
-          </td>
+       </tr>
-        </tr>
                 
-    </tbody>   
+  </tbody>    
-  </table>
+</table>
+<br>
+                <br>
                 
-  <p><font color="#ff0000"><b>IMPORTANT: If all you want to do is forward 
+<p><font color="#ff0000"><b>IMPORTANT: If all you want to do is forward  
      ports to servers behind your firewall, you do NOT want to use static
-NAT.      Port forwarding can be accomplished with simple entries in the 
+  NAT.      Port forwarding can be accomplished with simple entries in the
-  <a href="Documentation.htm#Rules">rules file</a>.</b></font></p>
+    <a href="Documentation.htm#Rules">rules file</a>.</b></font></p>
-    
+<blockquote>                </blockquote>
-  <p>Static NAT is a way to make systems behind a     firewall and configured 
+<p>Static NAT is a way to make systems behind a     firewall and configured
-with private IP addresses (those     reserved for private use in RFC1918) 
+  with private IP addresses (those     reserved for private use in RFC1918)
-appear to have public IP     addresses. Before you try to use this technique, 
+  appear to have public IP     addresses. Before you try to use this technique,
-I strongly recommend that you read the <a
+  I strongly recommend that you read the <a
  href="shorewall_setup_guide.htm">Shorewall Setup Guide.</a></p>
-    
+<blockquote>                </blockquote>
-  <p>The following figure represents a static NAT     environment.</p>
+<p>The following figure represents a static NAT     environment.</p>
-    
+<blockquote>                
   <p align="center"><strong>     <img src="images/staticnat.png"
  width="435" height="397">
-   </strong></p>
+      </strong></p>
                 
   <blockquote>     </blockquote>
-    
+                </blockquote>
-  <p align="left">Static NAT can be used to make the systems with the  10.1.1.*
+<p align="left">Static NAT can be used to make the systems with the  10.1.1.* 
-addresses appear to be on the upper (130.252.100.*) subnet. If we     assume
+ addresses appear to be on the upper (130.252.100.*) subnet. If we     assume 
-that the interface to the upper subnet is eth0, then the following     /etc/shorewall/NAT
+ that the interface to the upper subnet is eth0, then the following     /etc/shorewall/NAT 
-file would make the lower left-hand system appear to have     IP address
+ file would make the lower left-hand system appear to have     IP address 
 130.252.100.18 and the right-hand one to have IP address     130.252.100.19.</p>
                 
-  <table border="2" cellpadding="2" style="border-collapse: collapse;">
+<table border="2" cellpadding="2" style="border-collapse: collapse;">
-        <tbody>
+           <tbody>
-       <tr>
+          <tr>
-          <td><b>EXTERNAL</b></td>
+             <td><b>EXTERNAL</b></td>
-          <td><b>INTERFACE</b></td>
+             <td><b>INTERFACE</b></td>
-          <td><b>INTERNAL</b></td>
+             <td><b>INTERNAL</b></td>
-          <td><b>ALL INTERFACES</b></td>
+             <td><b>ALL INTERFACES</b></td>
-          <td><b>LOCAL</b></td>
+             <td><b>LOCAL</b></td>
-        </tr>
+           </tr>
-        <tr>
+           <tr>
-          <td>130.252.100.18</td>
+             <td>130.252.100.18</td>
-          <td>eth0</td>
+             <td>eth0</td>
-          <td>10.1.1.2</td>
+             <td>10.1.1.2</td>
-          <td>yes</td>
+             <td>yes</td>
-          <td>yes</td>
+             <td>yes</td>
-        </tr>
+           </tr>
-        <tr>
+           <tr>
-          <td>130.252.100.19</td>
+             <td>130.252.100.19</td>
-          <td>eth0</td>
+             <td>eth0</td>
-          <td>10.1.1.3</td>
+             <td>10.1.1.3</td>
-          <td>yes</td>
+             <td>yes</td>
-          <td>yes</td>
+             <td>yes</td>
-        </tr>
+           </tr>
                         
-    </tbody>   
+  </tbody>            
-  </table>
+</table>
                 
-  <p>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the above 
+<p>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the above
-    example) is (are) not included in any specification in /etc/shorewall/masq 
+      example) is (are) not included in any specification in /etc/shorewall/masq
-    or /etc/shorewall/proxyarp.</p>
+      or /etc/shorewall/proxyarp.</p>
                 
-  <p><a name="AllInterFaces"></a>Note 1: The "ALL INTERFACES" column is used
+<p><a name="AllInterFaces"></a>Note 1: The "ALL INTERFACES" column is used 
-to specify whether access to the external IP from all firewall   interfaces
+ to specify whether access to the external IP from all firewall   interfaces 
-should undergo NAT (Yes or yes) or if only access from the    interface in
+ should undergo NAT (Yes or yes) or if only access from the    interface in
-the INTERFACE column should undergo NAT. If you leave this     column empty,
+ the INTERFACE column should undergo NAT. If you leave this     column empty,
-"Yes" is assumed. The ALL INTERFACES column was     added in version 1.1.6.</p>
+ "Yes" is assumed. The ALL INTERFACES column was     added in version 1.1.6.</p>
                 
-  <p>Note 2: Shorewall will automatically add the external address to the 
+<p>Note 2: Shorewall will automatically add the external address to the  
     specified interface unless you specify <a
  href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>="no"     (or "No") in
-/etc/shorewall/shorewall.conf; If you do not set     ADD_IP_ALIASES or if 
+  /etc/shorewall/shorewall.conf; If you do not set     ADD_IP_ALIASES or
-you set it to "Yes" or "yes" then you must NOT configure your own alias(es).
+if   you set it to "Yes" or "yes" then you must NOT configure your own alias(es). 
-  <b>RESTRICTION: </b>Shorewall can only add external addresses to an interface
+   <b>RESTRICTION: </b>Shorewall versions earlier than 1.4.6 can only add
-that is configured with a single subnetwork -- if your external interface
+ external addresses to an interface that is configured with a single subnetwork
-has addresses in more than one subnetwork, Shorewall can only add addresses
+ -- if your external interface has addresses in more than one subnetwork,
-to the first one.</p>
+Shorewall 1.4.5 and earlier can only add addresses to the first one.</p>
                 
-  <p><a name="LocalPackets"></a>Note 3: The contents of the "LOCAL"     column 
+<p><a name="LocalPackets"></a>Note 3: The contents of the "LOCAL"     column
-determine whether packets originating on the firewall itself and     destined 
+  determine whether packets originating on the firewall itself and     destined
-for the EXTERNAL address are redirected to the internal ADDRESS. If     this 
+  for the EXTERNAL address are redirected to the internal ADDRESS. If   
-column contains "yes" or "Yes" (and the ALL     INTERFACES COLUMN also contains 
+ this  column contains "yes" or "Yes" (and the ALL     INTERFACES COLUMN
-"Yes" or "yes") then     such packets are redirected; otherwise, such packets 
+also contains  "Yes" or "yes") then     such packets are redirected; otherwise,
-are not redirected. The     LOCAL column was added in version 1.1.8.</p>
+such packets  are not redirected. The     LOCAL column was added in version
-  </blockquote>
+1.1.8.</p>
              
 <blockquote> </blockquote>
         
-<p><font size="2">Last updated 4/11/2003 - </font><font size="2"> <a
+<p><font size="2">Last updated 7/6/2003 - </font><font size="2"> <a
  href="support.htm">Tom Eastep</a></font> </p>
-  <a href="copyright.htm"><font size="2">Copyright</font>  © <font
+     <a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/OPENVPN.html

@@ -14,19 +14,19 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-    <tbody>
+     <tbody>
-      <tr>
+       <tr>
-      <td width="100%">
+       <td width="100%">       
       <h1 align="center"><font color="#ffffff">OpenVPN Tunnels</font></h1>
-      </td>
+       </td>
-    </tr>
+     </tr>
     
   </tbody> 
 </table>
   
 <h3><br>
-  </h3>
+   </h3>
   
 <p>OpenVPN is a robust and highly configurable VPN (Virtual Private Network) 
  daemon which can be used to securely link two or more private networks using 
@@ -34,10 +34,10 @@
 and is <a href="http://openvpn.sourceforge.net/license.html">licensed under 
 the GPL</a>. OpenVPN can be downloaded from <a
  href="http://openvpn.sourceforge.net/">http://openvpn.sourceforge.net/</a>.<br>
-  </p>
+   </p>
   
 <p>OpenVPN support was added to Shorewall in version 1.3.14.<br>
-  </p>
+   </p>
   
 <h2>Bridging two Masqueraded Networks</h2>
   
@@ -45,7 +45,7 @@ the GPL</a>. OpenVPN can be downloaded from <a
   
 <p align="center"><img border="0" src="images/TwoNets1.png" width="745"
  height="427">
- </p>
+  </p>
   
 <p align="left">We want systems in the 192.168.1.0/24 subnetwork to be able 
  to communicate with the systems in the 10.0.0.0/8 network. This is accomplished 
@@ -62,221 +62,222 @@ the GPL</a>. OpenVPN can be downloaded from <a
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                 <tbody>
+                  <tbody>
-        <tr>
+         <tr>
-                <td><strong>ZONE</strong></td>
+                 <td><strong>ZONE</strong></td>
-                <td><strong>DISPLAY</strong></td>
+                 <td><strong>DISPLAY</strong></td>
-                <td><strong>COMMENTS</strong></td>
+                 <td><strong>COMMENTS</strong></td>
-            </tr>
+             </tr>
-            <tr>
+             <tr>
-                <td>vpn</td>
+                 <td>vpn</td>
-                <td>VPN</td>
+                 <td>VPN</td>
-                <td>Remote Subnet</td>
+                 <td>Remote Subnet</td>
-            </tr>
+             </tr>
+      
+    </tbody>   
+  </table>
+    </blockquote>
+  
+<p align="left">On system A, the 10.0.0.0/8 will comprise the <b>vpn</b> zone.
+In /etc/shorewall/interfaces:</p>
+  
+<blockquote>   
+  <table border="2" cellpadding="2" style="border-collapse: collapse;">
+       <tbody>
+         <tr>
+         <td><b>ZONE</b></td>
+         <td><b>INTERFACE</b></td>
+         <td><b>BROADCAST</b></td>
+         <td><b>OPTIONS</b></td>
+       </tr>
+       <tr>
+         <td>vpn</td>
+         <td>tun0</td>
+         <td><br>
+           </td>
+         <td> </td>
+       </tr>
       
     </tbody>   
   </table>
    </blockquote>
   
-<p align="left">On system A, the 10.0.0.0/8 will comprise the <b>vpn</b>
-zone. In /etc/shorewall/interfaces:</p>
-
-<blockquote>
-  <table border="2" cellpadding="2" style="border-collapse: collapse;">
-      <tbody>
-        <tr>
-        <td><b>ZONE</b></td>
-        <td><b>INTERFACE</b></td>
-        <td><b>BROADCAST</b></td>
-        <td><b>OPTIONS</b></td>
-      </tr>
-      <tr>
-        <td>vpn</td>
-        <td>tun0</td>
-        <td><br>
-          </td>
-        <td> </td>
-      </tr>
-
-    </tbody>
-  </table>
-  </blockquote>
-
 <p align="left">In /etc/shorewall/tunnels on system A, we need the following:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-        <td><b>TYPE</b></td>
+         <td><b>TYPE</b></td>
-        <td><b>ZONE</b></td>
+         <td><b>ZONE</b></td>
-        <td><b>GATEWAY</b></td>
+         <td><b>GATEWAY</b></td>
-        <td><b>GATEWAY ZONE</b></td>
+         <td><b>GATEWAY ZONE</b></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td>openvpn</td>
+         <td>openvpn</td>
-        <td>net</td>
+         <td>net</td>
-        <td>134.28.54.2</td>
+         <td>134.28.54.2</td>
-        <td> </td>
+         <td> </td>
-      </tr>
+       </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>This entry in /etc/shorewall/tunnels opens the firewall so that OpenVPN 
  traffic on the default port 5000/udp will be accepted to/from the remote 
 gateway. If you change the port used by OpenVPN to 7777, you can define /etc/shorewall/tunnels 
  like this:<br>
-  </p>
+   </p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-        <td><b>TYPE</b></td>
+         <td><b>TYPE</b></td>
-        <td><b>ZONE</b></td>
+         <td><b>ZONE</b></td>
-        <td><b>GATEWAY</b></td>
+         <td><b>GATEWAY</b></td>
-        <td><b>GATEWAY ZONE</b></td>
+         <td><b>GATEWAY ZONE</b></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td>openvpn:7777</td>
+         <td>openvpn:7777</td>
-        <td>net</td>
+         <td>net</td>
-        <td>134.28.54.2</td>
+         <td>134.28.54.2</td>
-        <td> </td>
+         <td> </td>
-      </tr>
+       </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>This is the OpenVPN config on system A:</p>
   
 <blockquote>   
   <p></p>
-  </blockquote>
+   </blockquote>
   
 <blockquote>   
   <p>dev tun<br>
-  local 206.162.148.9<br>
+   local 206.162.148.9<br>
-  remote 134.28.54.2<br>
+   remote 134.28.54.2<br>
-  ifconfig 192.168.99.1 192.168.99.2<br>
+   ifconfig 192.168.99.1 192.168.99.2<br>
-  up ./route-a.up<br>
+   up ./route-a.up<br>
-  tls-server<br>
+   tls-server<br>
-  dh dh1024.pem<br>
+   dh dh1024.pem<br>
-  ca ca.crt<br>
+   ca ca.crt<br>
-  cert my-a.crt<br>
+   cert my-a.crt<br>
-  key my-a.key<br>
+   key my-a.key<br>
-  comp-lzo<br>
+   comp-lzo<br>
-  verb 5<br>
+   verb 5<br>
-    </p>
+     </p>
-  </blockquote>
+   </blockquote>
   
 <p>Similarly, On system B the 192.168.1.0/24 subnet will comprise the <b>vpn</b> 
  zone. In /etc/shorewall/interfaces:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-        <td><b>ZONE</b></td>
+         <td><b>ZONE</b></td>
-        <td><b>INTERFACE</b></td>
+         <td><b>INTERFACE</b></td>
-        <td><b>BROADCAST</b></td>
+         <td><b>BROADCAST</b></td>
-        <td><b>OPTIONS</b></td>
+         <td><b>OPTIONS</b></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td>vpn</td>
+         <td>vpn</td>
-        <td>tun0</td>
+         <td>tun0</td>
-        <td>192.168.1.255</td>
+         <td>192.168.1.255</td>
-        <td> </td>
+         <td> </td>
-      </tr>
+       </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>In /etc/shorewall/tunnels on system B, we have:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-        <td><b>TYPE</b></td>
+         <td><b>TYPE</b></td>
-        <td><b>ZONE</b></td>
+         <td><b>ZONE</b></td>
-        <td><b>GATEWAY</b></td>
+         <td><b>GATEWAY</b></td>
-        <td><b>GATEWAY ZONE</b></td>
+         <td><b>GATEWAY ZONE</b></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td>openvpn</td>
+         <td>openvpn</td>
-        <td>net</td>
+         <td>net</td>
-        <td>206.191.148.9</td>
+         <td>206.191.148.9</td>
-        <td> </td>
+         <td> </td>
-      </tr>
+       </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>And in the OpenVPN config on system B:</p>
   
 <blockquote>   
   <p>dev tun<br>
-  local 134.28.54.2<br>
+   local 134.28.54.2<br>
-  remote 206.162.148.9<br>
+   remote 206.162.148.9<br>
-  ifconfig 192.168.99.2 192.168.99.1<br>
+   ifconfig 192.168.99.2 192.168.99.1<br>
-  up ./route-b.up<br>
+   up ./route-b.up<br>
-  tls-client<br>
+   tls-client<br>
-  ca ca.crt<br>
+   ca ca.crt<br>
-  cert my-b.crt<br>
+   cert my-b.crt<br>
-  key my-b.key<br>
+   key my-b.key<br>
-  comp-lzo<br>
+   comp-lzo<br>
-  verb 5<br>
+   verb 5<br>
-    </p>
+     </p>
-  </blockquote>
+   </blockquote>
   
 <p align="left">You will need to allow traffic between the "vpn" zone and 
-       the "loc" zone on both systems -- if you simply want to admit all
+       the "loc" zone on both systems -- if you simply want to admit all traffic
-traffic        in both directions, you can use the policy file:</p>
+       in both directions, you can use the policy file:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                 <tbody>
+                  <tbody>
-        <tr>
+         <tr>
-                <td><strong>SOURCE</strong></td>
+                 <td><strong>SOURCE</strong></td>
-                <td><strong>DEST</strong></td>
+                 <td><strong>DEST</strong></td>
-                <td><strong>POLICY</strong></td>
+                 <td><strong>POLICY</strong></td>
-                <td><strong>LOG LEVEL</strong></td>
+                 <td><strong>LOG LEVEL</strong></td>
-            </tr>
+             </tr>
-            <tr>
+             <tr>
-                <td>loc</td>
+                 <td>loc</td>
-                <td>vpn</td>
+                 <td>vpn</td>
-                <td>ACCEPT</td>
+                 <td>ACCEPT</td>
-            <td> </td>
+             <td> </td>
-            </tr>
+             </tr>
-                                <tr>
+                                 <tr>
-                <td>vpn</td>
+                 <td>vpn</td>
-                <td>loc</td>
+                 <td>loc</td>
-                <td>ACCEPT</td>
+                 <td>ACCEPT</td>
-            <td> </td>
+             <td> </td>
-            </tr>
+             </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>On both systems, restart Shorewall and start OpenVPN. The systems in the 
  two masqueraded subnetworks can now talk to each other.</p>
   
 <p><font size="2">Updated 2/4/2003 - <a href="support.htm">Tom Eastep</a></font> 
 <small>and Simon Mater</small><br>
- </p>
+  </p>
   
 <p><font size="2"> </font></p>
   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
  © <font size="2">2003 Thomas M. Eastep. and Simon Mater<br>
- </font></a></font></p>
+  </font></a></font></p>
-  <br>
+   <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/ProxyARP.htm

@@ -16,13 +16,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-          <tbody>
+           <tbody>
-       <tr>
+        <tr>
-            <td width="100%">
+             <td width="100%">       
       <h1 align="center"><font color="#ffffff">Proxy ARP</font></h1>
-            </td>
+             </td>
-          </tr>
+           </tr>
     
   </tbody> 
 </table>
@@ -37,45 +37,45 @@ the <a href="shorewall_setup_guide.htm">Shorewall Setup Guide.</a></p>
 <blockquote>   
   <p align="center"><strong>     <img src="images/proxyarp.png"
  width="519" height="397">
-     </strong></p>
+      </strong></p>
     
   <blockquote>     </blockquote>
-    </blockquote>
+     </blockquote>
   
 <p align="left">Proxy ARP can be used to make the systems with addresses 
-    130.252.100.18 and 130.252.100.19 appear to be on the upper (130.252.100.*)
+   130.252.100.18 and 130.252.100.19 appear to be on the upper (130.252.100.*) 
       subnet.  Assuming that the upper firewall interface is eth0 and the 
      lower interface is eth1, this is accomplished using the following entries 
  in      /etc/shorewall/proxyarp:</p>
   
 <blockquote>   
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-          <tbody>
+           <tbody>
-         <tr>
-            <td><b>ADDRESS</b></td>
-            <td><b>INTERFACE</b></td>
-            <td><b>EXTERNAL</b></td>
-            <td><b>HAVEROUTE</b></td>
-          </tr>
           <tr>
-            <td>130.252.100.18</td>
+             <td><b>ADDRESS</b></td>
-            <td>eth1</td>
+             <td><b>INTERFACE</b></td>
-            <td>eth0</td>
+             <td><b>EXTERNAL</b></td>
-            <td>no</td>
+             <td><b>HAVEROUTE</b></td>
-          </tr>
+           </tr>
-          <tr>
+           <tr>
-            <td>130.252.100.19</td>
+             <td>130.252.100.18</td>
-            <td>eth1</td>
+             <td>eth1</td>
-            <td>eth0</td>
+             <td>eth0</td>
-            <td>no</td>
+             <td>no</td>
-          </tr>
+           </tr>
+           <tr>
+             <td>130.252.100.19</td>
+             <td>eth1</td>
+             <td>eth0</td>
+             <td>no</td>
+           </tr>
       
     </tbody>   
   </table>
-    </blockquote>
+     </blockquote>
   
 <p>Be sure that the internal systems (130.242.100.18 and 130.252.100.19  
-    in the above example) are not included in any specification in      /etc/shorewall/masq
+   in the above example) are not included in any specification in      /etc/shorewall/masq 
 or /etc/shorewall/nat.</p>
   
 <p>Note that I've used an RFC1918 IP address for eth1 - that IP address is 
@@ -86,103 +86,105 @@ or /etc/shorewall/nat.</p>
  the      Firewall system's eth0 is configured.  In other words, they should 
 be configured just like they would be if they were parallel to the firewall 
 rather than behind it.<br>
- </p>
+  </p>
   
 <p><font color="#ff0000"><b>NOTE: Do not add the Proxy ARP'ed address(es) 
 (130.252.100.18 and 130.252.100.19 in the above example)  to the external 
 interface (eth0 in this example) of the firewall.</b></font><br>
-                     </p>
+                      </p>
+ 
 <div align="left">            </div>
   
 <div align="left"> 
 <p align="left">A word of warning is in order here. ISPs typically configure 
     their routers with a long ARP cache timeout. If you move a system from 
-    parallel to your firewall to behind your firewall with Proxy ARP, it will
+    parallel to your firewall to behind your firewall with Proxy ARP, it
-    probably be HOURS before that system can communicate with the internet.
+will     probably be HOURS before that system can communicate with the internet. 
  There are a couple of things that you can try:<br>
-   </p>
+    </p>
   
 <ol>
-     <li>(Courtesy of Bradey Honsinger) A reading of Stevens' <i>TCP/IP Illustrated,
+      <li>(Courtesy of Bradey Honsinger) A reading of Stevens' <i>TCP/IP
- Vol 1</i> reveals that a <br>
+Illustrated,  Vol 1</i> reveals that a <br>
-       <br>
+        <br>
-   "gratuitous" ARP packet should cause the ISP's router to refresh their
+    "gratuitous" ARP packet should cause the ISP's router to refresh their 
 ARP  cache (section 4.7). A gratuitous ARP is simply a host requesting the 
-MAC  address for its own IP; in addition to ensuring that the IP address isn't
+MAC  address for its own IP; in addition to ensuring that the IP address
- a duplicate...<br>
+isn't  a duplicate...<br>
-       <br>
+        <br>
-   "if the host sending the gratuitous ARP has just changed its hardware
+    "if the host sending the gratuitous ARP has just changed its hardware 
 address...,  this packet causes any other host...that has an entry in its 
 cache for the  old hardware address to update its ARP cache entry accordingly."<br>
-       <br>
+        <br>
-   Which is, of course, exactly what you want to do when you switch a host
+    Which is, of course, exactly what you want to do when you switch a host 
  from being exposed to the Internet to behind Shorewall using proxy ARP (or 
  static NAT for that matter). Happily enough, recent versions of Redhat's 
 iputils package include "arping", whose "-U" flag does just that:<br>
-       <br>
+        <br>
-       <font color="#009900"><b>arping -U -I <i>&lt;net if&gt; &lt;newly
+        <font color="#009900"><b>arping -U -I <i>&lt;net if&gt; &lt;newly 
 proxied  IP&gt;</i></b></font><br>
-       <font color="#009900"><b>arping -U -I eth0 66.58.99.83 # for example</b></font><br>
+        <font color="#009900"><b>arping -U -I eth0 66.58.99.83 # for example</b></font><br>
+        <br>
+    Stevens goes on to mention that not all systems respond correctly to
+gratuitous  ARPs, but googling for "arping -U" seems to support the idea
+that it works  most of the time.<br>
        <br>
-   Stevens goes on to mention that not all systems respond correctly to gratuitous
+   To use arping with Proxy ARP in the above example, you would have to:<br>
- ARPs, but googling for "arping -U" seems to support the idea that it works
+       <br>
- most of the time.<br>
+       <font color="#009900"><b>    shorewall clear<br>
-      <br>
+       </b></font>    <font color="#009900"><b>ip addr add 130.252.100.18 
-  To use arping with Proxy ARP in the above example, you would have to:<br>
-      <br>
-      <font color="#009900"><b>    shorewall clear<br>
-      </b></font>    <font color="#009900"><b>ip addr add 130.252.100.18
 dev  eth0<br>
-      ip addr add 130.252.100.19 dev eth0</b></font><br>
+       ip addr add 130.252.100.19 dev eth0</b></font><br>
-       <font color="#009900"><b>arping -U -I eth0 130.252.100.18</b></font><br>
+        <font color="#009900"><b>arping -U -I eth0 130.252.100.18</b></font><br>
-      <font color="#009900"><b>arping -U -I eth0 130.252.100.19</b></font><br>
+       <font color="#009900"><b>arping -U -I eth0 130.252.100.19</b></font><br>
-      <b><font color="#009900">ip addr del 130.252.100.18 dev eth0<br>
+       <b><font color="#009900">ip addr del 130.252.100.18 dev eth0<br>
-      ip addr del 130.252.100.19 dev eth0<br>
+       ip addr del 130.252.100.19 dev eth0<br>
-      shorewall start</font></b><br>
+       shorewall start</font></b><br>
-      <br>
+       <br>
-    </li>
+     </li>
-     <li>You    can call your ISP and ask them to purge the stale ARP cache
+      <li>You    can call your ISP and ask them to purge the stale ARP cache 
  entry but many    either can't or won't purge individual entries.</li>
   
 </ol>
-   You can determine if your    ISP's gateway ARP cache is stale using ping
+    You can determine if your    ISP's gateway ARP cache is stale using ping 
  and tcpdump. Suppose that we    suspect that the gateway router has a stale 
  ARP cache entry for 130.252.100.19.    On the firewall, run tcpdump as follows:</div>
   
 <div align="left"> 
 <pre>	<font color="#009900"><b>tcpdump -nei eth0 icmp</b></font></pre>
-    </div>
+     </div>
   
 <div align="left"> 
 <p align="left">Now from 130.252.100.19, ping the ISP's gateway (which we 
  will    assume is 130.252.100.254):</p>
-   </div>
+    </div>
   
 <div align="left"> 
 <pre>	<b><font color="#009900">ping 130.252.100.254</font></b></pre>
-    </div>
+     </div>
   
 <div align="left"> 
 <p align="left">We can now observe the tcpdump output:</p>
-   </div>
+    </div>
   
 <div align="left"> 
 <pre>	13:35:12.159321 <u>0:4:e2:20:20:33</u> 0:0:77:95:dd:19 ip 98: 130.252.100.19 &gt; 130.252.100.254: icmp: echo request (DF)<br>	13:35:12.207615 0:0:77:95:dd:19 <u>0:c0:a8:50:b2:57</u> ip 98: 130.252.100.254 &gt; 130.252.100.177 : icmp: echo reply</pre>
-    </div>
+     </div>
   
 <div align="left"> 
 <p align="left">Notice that the source MAC address in the echo request is 
     different from the destination MAC address in the echo reply!! In this 
  case    0:4:e2:20:20:33 was the MAC of the firewall's eth0 NIC while 0:c0:a8:50:b2:57 
-    was the MAC address of the system on the lower left. In other words, the
+    was the MAC address of the system on the lower left. In other words,
- gateway's ARP cache still    associates 130.252.100.19 with the NIC in that
+the  gateway's ARP cache still    associates 130.252.100.19 with the NIC
- system rather than with the firewall's    eth0.</p>
+in that  system rather than with the firewall's    eth0.</p>
-   </div>
+    </div>
   
 <p><font size="2">Last updated 3/21/2003 - </font><font size="2"> <a
  href="support.htm">Tom Eastep</a></font> </p>
-    <a href="copyright.htm"><font size="2">Copyright</font>  © <font
+     <a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
+    <br>
    <br>
   <br>
  <br>

STABLE/documentation/SeattleInTheSpring.html

@@ -14,39 +14,40 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-    <tbody>
+     <tbody>
-     <tr>
+      <tr>
-      <td width="100%">
+       <td width="100%">       
       <h1 align="center"><font color="#ffffff">Visit Seattle in the Springtime!!!!</font></h1>
-      </td>
+       </td>
-    </tr>
+     </tr>
     
   </tbody> 
 </table>
   
 <h3><font color="#ff6633"></font></h3>
- <img src="images/P1000048.jpg" alt="" width="640" height="480">
+  <img src="images/P1000048.jpg" alt="" width="640" height="480">
+  <br>
+  <br>
+  <b>March 6, 2003 - Nice day for a walk....</b><br>
+  <br>
+  <img src="images/P1000050.jpg" alt="" width="640" height="480">
  <br>
+  <br>
  <br>
- <b>March 6, 2003 - Nice day for a walk....</b><br>
+ <img src="images/P1000049.jpg" alt="" width="480" height="640">
- <br>
- <img src="images/P1000050.jpg" alt="" width="640" height="480">
-<br>
- <br>
-<br>
-<img src="images/P1000049.jpg" alt="" width="480" height="640">
   
 <p><b>The view from my office window -- think I'll go out and enjoy the deck 
 (Yes -- that is snow on the deck...)</b>.<br>
- </p>
+  </p>
   
 <p><font size="2">Updated 3/7/2003 - <a href="support.htm">Tom Eastep</a> 
 </font></p>
   
 <p><a href="copyright.htm"><font size="2">Copyright</font>  © <font
  size="2">2001, 2002 Thomas M. Eastep.</font></a></p>
-   <br>
+    <br>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/Shorewall_CA_html.html

@@ -12,81 +12,81 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-          <tbody>
+           <tbody>
-           <tr>
+            <tr>
-            <td width="100%">
+             <td width="100%">        
-
       <h1 align="center"><font color="#ffffff">Shorewall Certificate Authority 
  (CA) Certificate</font></h1>
-            </td>
+             </td>
-          </tr>
+           </tr>
     
   </tbody> 
 </table>
-  <br>
+   <br>
-  Given that I develop and support Shorewall without asking for any renumeration,
+   Given that I develop and support Shorewall without asking for any renumeration, 
  I can hardly justify paying $200US+ a year to a Certificate Authority such 
  as Thawte (A Division of VeriSign) for an X.509 certificate to prove that 
  I am who I am. I have therefore established my own Certificate Authority 
 (CA) and sign my own X.509 certificates. I use these certificates on my list 
 server (<a href="https://lists.shorewall.net">https://lists.shorewall.net</a>) 
 which hosts parts of this web site.<br>
-  <br>
+   <br>
-  X.509 certificates are the basis for the Secure Socket Layer (SSL). As
+   X.509 certificates are the basis for the Secure Socket Layer (SSL). As 
 part  of establishing an SSL session (URL https://...), your browser verifies 
 the  X.509 certificate supplied by the HTTPS server against the set of Certificate 
  Authority Certificates that were shipped with your browser. It is expected 
  that the server's certificate was issued by one of the authorities whose 
 identities are known to your browser. <br>
-  <br>
+   <br>
-  This mechanism, while supposedly guaranteeing that when you connect to
+   This mechanism, while supposedly guaranteeing that when you connect to 
 https://www.foo.bar  you are REALLY connecting to www.foo.bar, means that 
 the CAs literally have  a license to print money -- they are selling a string 
 of bits (an X.509 certificate)  for $200US+ per year!!!I <br>
-  <br>
+   <br>
-  I wish that I had decided to become a CA rather that designing and writing
+   I wish that I had decided to become a CA rather that designing and writing 
  Shorewall.<br>
-  <br>
+   <br>
-  What does this mean to you? It means that the X.509 certificate that my
+   What does this mean to you? It means that the X.509 certificate that my 
 server will present to your browser will not have been signed by one of the 
 authorities known to your browser. If you try to connect to my server using 
 SSL, your browser will frown and give you a dialog box asking if you want 
 to accept the sleezy X.509 certificate being presented by my server. <br>
-  <br>
+   <br>
-  There are two things that you can do:<br>
+   There are two things that you can do:<br>
   
 <ol>
-    <li>You can accept the mail.shorewall.net certificate when your browser
+     <li>You can accept the mail.shorewall.net certificate when your browser 
  asks -- your acceptence of the certificate can be temporary (for that access 
  only) or perminent.</li>
-    <li>You can download and install <a href="ca.crt">my (self-signed) CA
+     <li>You can download and install <a href="ca.crt">my (self-signed) CA 
 certificate.</a> This will make my Certificate Authority known to your browser 
 so that it will accept any certificate signed by me. <br>
-    </li>
+     </li>
   
 </ol>
-  What are the risks?<br>
+   What are the risks?<br>
   
 <ol>
-    <li>If you install my CA certificate then you assume that I am trustworthy
+     <li>If you install my CA certificate then you assume that I am trustworthy 
  and that Shorewall running on your firewall won't redirect HTTPS requests 
  intented to go to your bank's server to one of my systems that will present 
-your browser with a bogus certificate claiming that my server is that of your
+your browser with a bogus certificate claiming that my server is that of
-bank.</li>
+your bank.</li>
-    <li>If you only accept my server's certificate when prompted then the
+     <li>If you only accept my server's certificate when prompted then the 
 most that you have to loose is that when you connect to https://mail.shorewall.net, 
  the server you are connecting to might not be mine.</li>
   
 </ol>
-  I have my CA certificate loaded into all of my browsers but I certainly
+   I have my CA certificate loaded into all of my browsers but I certainly 
 won't be offended if you decline to load it into yours... :-)<br>
   
 <p align="left"><font size="2">Last Updated 1/17/2003 - Tom Eastep</font></p>
   
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
- size="2">Copyright</font> &copy; <font size="2">2001, 2002, 2003 Thomas
+ size="2">Copyright</font> &copy; <font size="2">2001, 2002, 2003 Thomas M.
-M. Eastep.</font></a></font></p>
+Eastep.</font></a></font></p>
+    <br>
    <br>
   <br>
  <br>

STABLE/documentation/Shorewall_CVS_Access.html

@@ -12,40 +12,41 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-         <tbody>
+          <tbody>
-         <tr>
+          <tr>
-          <td width="100%">
+           <td width="100%">       
       <h1 align="center"><font color="#ffffff">Shorewall CVS Access</font> 
     </h1>
-          <br>
+           <br>
-      </td>
+       </td>
-        </tr>
+         </tr>
     
   </tbody> 
 </table>
-     <br>
+      <br>
-     Lots of people try to download the entire Shorewall website for off-line
+      Lots of people try to download the entire Shorewall website for off-line 
   browsing, including the CVS portion. In addition to being an enormous volume 
-  of data (HTML versions of all versions of all Shorewall files), all of
+  of data (HTML versions of all versions of all Shorewall files), all of the
-the   pages in Shorewall CVS access are cgi-generated which places a tremendous
+  pages in Shorewall CVS access are cgi-generated which places a tremendous 
   load on my little server. I have therefore resorted to making CVS access 
  password controlled. When you are asked to log in, enter "Shorewall" (NOTE 
  THE CAPITALIZATION!!!!!) for both the user name and the password.<br>
-     <br>
+      <br>
   
 <div align="center"> 
 <h3><a href="http://cvs.shorewall.net/cgi-bin/cvs/cvsweb.cgi"
  target="_top">CVS Login</a>  &nbsp;<br>
-    </h3>
+     </h3>
-     </div>
+      </div>
   
 <p><font size="2" face="Century Gothic, Arial, Helvetica">Updated 1/14/2002 
   - <a href="support.htm">Tom Eastep</a>        </font>                 
-                          </p>
+         </p>
   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
  &copy; <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+       <br>
       <br>
      <br>
     <br>

STABLE/documentation/Shorewall_Squid_Usage.html

@@ -11,521 +11,534 @@
   <body>
                 
 <table cellpadding="0" cellspacing="0" border="0" width="100%"
- bgcolor="#400169">
+ bgcolor="#3366ff">
-         <tbody>
+              <tbody>
-           <tr>
+                <tr>
-             <td valign="middle" width="33%" bgcolor="#400169"><a
+                  <td valign="middle" width="33%" bgcolor="#3366ff"><a
  href="http://www.squid-cache.org/"><img src="images/squidnow.gif"
  alt="" width="88" height="31" hspace="4">
-             </a><br>
+                  </a><br>
-             </td>
+                  </td>
-             <td valign="middle" height="90" align="center" width="34%"><font
+                  <td valign="middle" height="90" align="center"
- color="#ffffff"><b><big><big><big><big>Using Shorewall with Squid</big></big></big></big></b></font><br>
+ width="34%">              
-             </td>
+      <h1><font color="#ffffff"><b>Using Shorewall with Squid</b></font></h1>
-             <td valign="middle" height="90" width="33%" align="right"><a
+               
- href="http://www.squid-cache.org/"><img src="images/cache_now.gif"
+      <h1>                </h1>
- alt="" width="100" height="31" hspace="4">
+        </td>
-             </a><br>
+                  <td valign="middle" height="90" width="33%"
-             </td>
+ align="right"><a href="http://www.squid-cache.org/"><img
-           </tr>
+ src="images/cache_now.gif" alt="" width="100" height="31" hspace="4">
+                  </a><br>
+                  </td>
+                </tr>
                                 
   </tbody>        
 </table>
-       <br>
+            <br>
-          This page covers Shorewall configuration to use with <a
+               This page covers Shorewall configuration to use with <a
  href="http://www.squid-cache.org/">Squid </a>running as a <u><b>Transparent
-     Proxy</b></u>. If you are running Shorewall 1.3, please see <a
+        Proxy</b></u>. If you are running Shorewall 1.3, please see <a
  href="1.3/Shorewall_Squid_Usage.html">this documentation</a>.<br>
-         <a href="#DMZ"></a><br>
+              <br>
-           <img border="0" src="images/j0213519.gif" width="60"
+                <img border="0" src="images/j0213519.gif" width="60"
  height="60" alt="Caution" align="middle">
-         &nbsp;&nbsp;&nbsp; Please observe the following general requirements:<br>
+              &nbsp;&nbsp;&nbsp; Please observe the following general requirements:<br>
-         <br>
+              <br>
-         <b><img src="images/BD21298_3.gif" alt="" width="13"
+              <b><img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-         &nbsp;&nbsp;&nbsp; </b>In all cases, Squid should be configured
+              &nbsp;&nbsp;&nbsp; </b>In all cases, Squid should be configured 
-to  run   as  a transparent proxy  as described at <a
+  to  run   as  a transparent proxy  as described at <a
  href="http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html">http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html</a>.<br>
-         <b><br>
+              <b><br>
-         </b><b><img src="images/BD21298_3.gif" alt="" width="13"
+              </b><b><img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-         &nbsp;&nbsp;&nbsp; </b>The following instructions mention the files 
+              &nbsp;&nbsp;&nbsp; </b>The following instructions mention the 
- /etc/shorewall/start   and /etc/shorewall/init -- if you don't have those 
+ files   /etc/shorewall/start   and /etc/shorewall/init -- if you don't have 
- files, siimply create  them.<br>
+ those   files, siimply create  them.<br>
-         <br>
+              <br>
-         <b><img src="images/BD21298_3.gif" alt="" width="13"
+              <b><img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-          </b>&nbsp;&nbsp;&nbsp; When the Squid server is in the DMZ zone 
+               </b>&nbsp;&nbsp;&nbsp; When the Squid server is in the DMZ 
-or  in  the  local zone, that zone must be defined ONLY by its interface --
+zone   or  in  the  local zone, that zone must be defined ONLY by its interface
-no  /etc/shorewall/hosts   file entries. That is because the packets being 
+  -- no  /etc/shorewall/hosts   file entries. That is because the packets
-routed  to the Squid server   still have their original destination IP addresses.<br>
+being   routed  to the Squid server   still have their original destination
-         <br>
+IP addresses.<br>
-         <b><img src="images/BD21298_3.gif" alt="" width="13"
+              <br>
+              <b><img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-          </b>&nbsp;&nbsp;&nbsp; You must have iptables installed on your 
+               </b>&nbsp;&nbsp;&nbsp; You must have iptables installed on 
-Squid    server.<br>
+your   Squid    server.<br>
-         <br>
+              <br>
-         <b><img src="images/BD21298_3.gif" alt="" width="13"
+              <b><img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-          </b>&nbsp;&nbsp;&nbsp; You must have NAT and MANGLE enabled in
+               </b>&nbsp;&nbsp;&nbsp; If you run a Shorewall version earlier
-your   /etc/shorewall/conf   file<br>
+  than 1.4.6, you must have NAT and MANGLE enabled in your   /etc/shorewall/conf
-         <br>
+    file<br>
-         &nbsp;&nbsp;&nbsp; <b><font color="#009900">&nbsp;&nbsp;&nbsp; NAT_ENABLED=Yes<br>
+              <br>
-       </font></b>&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <font
+              &nbsp;&nbsp;&nbsp; <b><font color="#009900">&nbsp;&nbsp;&nbsp;
+  NAT_ENABLED=Yes<br>
+            </font></b>&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <font
  color="#009900"><b>MANGLE_ENABLED=Yes</b></font><br>
-         <br>
+              <br>
-         Three different configurations are covered:<br>
+              Three different configurations are covered:<br>
                 
 <ol>
-           <li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running
+                <li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running 
- on  the  Firewall.</a></li>
+   on  the  Firewall.</a></li>
-           <li><a href="Shorewall_Squid_Usage.html#Local">Squid running in
+                <li><a href="Shorewall_Squid_Usage.html#Local">Squid running
- the  local  network</a></li>
+  in  the  local  network</a></li>
-           <li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running in
+                <li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running
-the  DMZ</a></li>
+ in  the  DMZ</a></li>
                 
 </ol>
                 
 <h2><a name="Firewall"></a>Squid Running on the Firewall</h2>
-            You want to redirect all local www connection requests EXCEPT 
+                 You want to redirect all local www connection requests EXCEPT
-                                                    those to your     own
+                                                       those to your    
-    http server                                                  (206.124.146.177) 
+own       http server                                                  (206.124.146.177)
-             to a Squid                                                  transparent
+                to a Squid                                              
-           proxy  running on the firewall and listening on port 3128. Squid
+   transparent            proxy  running on the firewall and listening on
-     will     of course  require access to remote web servers.<br>
+port  3128. Squid      will     of course  require access to remote web servers.<br>
-           <br>
+                <br>
-           In /etc/shorewall/rules:<br>
+                In /etc/shorewall/rules:<br>
-           <br>
+                <br>
                 
 <blockquote>                        
   <table border="1" cellpadding="2" style="border-collapse: collapse;">
-                                     <tbody>
+                                          <tbody>
-                    <tr>
+                         <tr>
-                                  <td><b>ACTION</b></td>
+                                       <td><b>ACTION</b></td>
-                                       <td><b>SOURCE</b></td>
+                                            <td><b>SOURCE</b></td>
-                                       <td><b>DEST</b></td>
+                                            <td><b>DEST</b></td>
-                                       <td><b>   PROTO</b></td>
+                                            <td><b>   PROTO</b></td>
-                                       <td><b>DEST<br>
+                                            <td><b>DEST<br>
-                                PORT(S)</b></td>
+                                     PORT(S)</b></td>
-                                       <td><b>SOURCE<br>
+                                            <td><b>SOURCE<br>
-                                       PORT(S)</b></td>
+                                            PORT(S)</b></td>
-                                       <td><b>ORIGINAL<br>
+                                            <td><b>ORIGINAL<br>
-                                       DEST</b></td>
+                                            DEST</b></td>
-                         </tr>
+                              </tr>
-                                     <tr>
+                                          <tr>
-                                       <td>REDIRECT</td>
+                                            <td>REDIRECT</td>
-                                       <td>loc</td>
+                                            <td>loc</td>
-                                       <td>3128</td>
+                                            <td>3128</td>
-                                       <td>tcp</td>
+                                            <td>tcp</td>
-                                       <td>www</td>
+                                            <td>www</td>
-                                       <td> -<br>
+                                            <td> -<br>
-                       </td>
+                            </td>
-                                       <td>!206.124.146.177</td>
+                                            <td>!206.124.146.177</td>
-                                     </tr>
+                                          </tr>
-                                     <tr>
+                                          <tr>
-                                       <td>ACCEPT</td>
+                                            <td>ACCEPT</td>
-                                       <td>fw</td>
+                                            <td>fw</td>
-                                       <td>net</td>
+                                            <td>net</td>
-                                       <td>tcp</td>
+                                            <td>tcp</td>
-                                       <td>www</td>
+                                            <td>www</td>
-                                       <td> <br>
+                                            <td> <br>
-                       </td>
+                            </td>
-                                       <td> <br>
+                                            <td> <br>
-                       </td>
+                            </td>
-                                     </tr>
+                                          </tr>
                                                     
     </tbody>                           
   </table>
-                             <br>
+                                  <br>
-           </blockquote>
+                </blockquote>
-      There may be a requirement to exclude additional destination hosts
+           There may be a requirement to exclude additional destination hosts 
-or networks from being redirected. For example, you might also want requests
+  or networks from being redirected. For example, you might also want requests 
-destined for 130.252.100.0/24 to not be routed to Squid. In that case, you
+  destined for 130.252.100.0/24 to not be routed to Squid. In that case, you
-must add a manual rule in /etc/shorewall/start:<br>
+  must add a manual rule in /etc/shorewall/start:<br>
+         
 <blockquote>               
   <pre>run_iptables -t nat -I loc_dnat -p tcp --dport www -d 130.252.100.0/24 -j RETURN<br></pre>
-</blockquote>
+     </blockquote>
-&nbsp;To exclude additional hosts or networks, just add additional similar
+     &nbsp;To exclude additional hosts or networks, just add additional similar 
-rules.<br>
+  rules.<br>
+         
 <h2><a name="Local"></a>Squid Running in the local network</h2>
-            You want to redirect all local www connection requests  to a
+                 You want to redirect all local www connection requests 
-Squid                                                    transparent    
+to  a  Squid                                                    transparent 
-  proxy   running   in your local zone at 192.168.1.3 and listening on port
+      proxy   running   in your local zone at 192.168.1.3 and listening on 
- 3128.    Your local  interface is eth1. There may also be a web server running 
+port   3128.    Your local  interface is eth1. There may also be a web server 
-on   192.168.1.3. It is assumed that web access is already enabled from the 
+running  on   192.168.1.3. It is assumed that web access is already enabled 
-local   zone to the internet.<br>
+from the  local   zone to the internet.<br>
                 
 <p><font color="#ff0000"><b>WARNING: </b></font>This setup may conflict with
-     other aspects of your gateway including but not limited to traffic shaping 
+        other aspects of your gateway including but not limited to traffic
-     and route redirection. For that reason, <b>I don't recommend it</b>.<br>
+ shaping       and route redirection. For that reason, <b>I don't recommend
-             </p>
+ it</b>.<br>
+                  </p>
                 
 <ul>
-             <li>On your firewall system, issue the following command<br>
+                  <li>On your firewall system, issue the following command<br>
-            </li>
+                 </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><b><font color="#009900">echo 202 www.out &gt;&gt; /etc/iproute2/rt_tables</font></b><br></pre>
-            </blockquote>
+                 </blockquote>
                 
 <ul>
-             <li>In /etc/shorewall/init, put:<br>
+                  <li>In /etc/shorewall/init, put:<br>
-              </li>
+                   </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><b><font color="#009900">if [ -z "`ip rule list | grep www.out`" ] ; then<br>	ip rule add fwmark 202 table www.out<br>	ip route add default via 192.168.1.3 dev eth1 table www.out<br>	ip route flush cache<br>	echo 0 &gt; /proc/sys/net/ipv4/conf/eth1/send_redirects<br>fi<br></font></b></pre>
-            </blockquote>
+                 </blockquote>
                 
 <ul>
-             <li>If you are running Shorewall 1.4.1 or Shorewall 1.4.1a,
+                  <li>If you are running Shorewall 1.4.1 or Shorewall 1.4.1a, 
-please upgrade to Shorewall 1.4.2 or later.<br>
+  please upgrade to Shorewall 1.4.2 or later.<br>
-     <br>
+          <br>
-   </li>
+        </li>
-      <li>If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:<br>
+           <li>If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:<br>
-     <br>
+          <br>
                                            
     <table cellpadding="2" cellspacing="0" border="1">
-          <tbody>
+               <tbody>
-            <tr>
+                 <tr>
-              <td valign="top">ZONE<br>
+                   <td valign="top">ZONE<br>
-              </td>
+                   </td>
-              <td valign="top">INTERFACE<br>
+                   <td valign="top">INTERFACE<br>
-              </td>
+                   </td>
-              <td valign="top">BROADCAST<br>
+                   <td valign="top">BROADCAST<br>
-              </td>
+                   </td>
-              <td valign="top">OPTIONS<br>
+                   <td valign="top">OPTIONS<br>
-              </td>
+                   </td>
-            </tr>
+                 </tr>
-            <tr>
+                 <tr>
-              <td valign="top">loc<br>
+                   <td valign="top">loc<br>
-              </td>
+                   </td>
-              <td valign="top">eth1<br>
+                   <td valign="top">eth1<br>
-              </td>
+                   </td>
-              <td valign="top">detect<br>
+                   <td valign="top">detect<br>
-              </td>
+                   </td>
-              <td valign="top"><b>routeback</b><br>
+                   <td valign="top"><b>routeback</b><br>
-              </td>
+                   </td>
-            </tr>
+                 </tr>
                                                          
       </tbody>                                     
     </table>
-     <br>
+          <br>
-      </li>
+           </li>
-            <li>In /etc/shorewall/rules:<br>
+                 <li>In /etc/shorewall/rules:<br>
-     <br>
+          <br>
                                                   
     <table border="1" cellpadding="2" style="border-collapse: collapse;">
-                                     <tbody>
+                                          <tbody>
-                    <tr>
+                         <tr>
-                                  <td><b>ACTION</b></td>
+                                       <td><b>ACTION</b></td>
-                                       <td><b>SOURCE</b></td>
+                                            <td><b>SOURCE</b></td>
-                                       <td><b>DEST</b></td>
+                                            <td><b>DEST</b></td>
-                                       <td><b>   PROTO</b></td>
+                                            <td><b>   PROTO</b></td>
-                                       <td><b>DEST<br>
+                                            <td><b>DEST<br>
-                                PORT(S)</b></td>
+                                     PORT(S)</b></td>
-                                       <td><b>SOURCE<br>
+                                            <td><b>SOURCE<br>
-                                       PORT(S)</b></td>
+                                            PORT(S)</b></td>
-                                       <td><b>ORIGINAL<br>
+                                            <td><b>ORIGINAL<br>
-                                       DEST</b></td>
+                                            DEST</b></td>
-                         </tr>
+                              </tr>
-                                     <tr>
+                                          <tr>
-                                       <td>ACCEPT<br>
+                                            <td>ACCEPT<br>
-                  </td>
-                                       <td>loc</td>
-                                       <td>loc<br>
-                  </td>
-                                       <td>tcp</td>
-                                       <td>www</td>
-                                       <td> <br>
                        </td>
-                                       <td><br>
+                                            <td>loc</td>
-                  </td>
+                                            <td>loc<br>
-                                     </tr>
+                       </td>
+                                            <td>tcp</td>
+                                            <td>www</td>
+                                            <td> <br>
+                            </td>
+                                            <td><br>
+                       </td>
+                                          </tr>
                                                                       
       </tbody>                                             
     </table>
-            </li>
+                 </li>
-                  <br>
+                       <br>
-   <li>Alternativfely, if you are running Shorewall 1.4.0 you can have the 
+        <li>Alternativfely, if you are running Shorewall 1.4.0 you can have 
-following policy in place of the above rule:<br>
+ the  following policy in place of the above rule:<br>
                                                 
     <table cellpadding="2" cellspacing="0" border="1">
-              <tbody>
+                   <tbody>
-                <tr>
+                     <tr>
-                  <td valign="top"><b>SOURCE<br>
+                       <td valign="top"><b>SOURCE<br>
-                  </b></td>
+                       </b></td>
-                  <td valign="top"><b>DESTINATION<br>
+                       <td valign="top"><b>DESTINATION<br>
-                  </b></td>
+                       </b></td>
-                  <td valign="top"><b>POLICY<br>
+                       <td valign="top"><b>POLICY<br>
-                  </b></td>
+                       </b></td>
-                  <td valign="top"><b>LOG LEVEL<br>
+                       <td valign="top"><b>LOG LEVEL<br>
-                  </b></td>
+                       </b></td>
-                  <td valign="top"><b>BURST PARAMETERS<br>
+                       <td valign="top"><b>BURST PARAMETERS<br>
-                  </b></td>
+                       </b></td>
-                </tr>
+                     </tr>
-                <tr>
+                     <tr>
-                  <td valign="top">loc<br>
+                       <td valign="top">loc<br>
-                  </td>
+                       </td>
-                  <td valign="top">loc<br>
+                       <td valign="top">loc<br>
-                  </td>
+                       </td>
-                  <td valign="top">ACCEPT<br>
+                       <td valign="top">ACCEPT<br>
-                  </td>
+                       </td>
-                  <td valign="top"><br>
+                       <td valign="top"><br>
-                  </td>
+                       </td>
-                  <td valign="top"><br>
+                       <td valign="top"><br>
-                  </td>
+                       </td>
-                </tr>
+                     </tr>
                                                                 
       </tbody>                                        
     </table>
-            <br>
+                 <br>
-          </li>
+               </li>
-          <li>In /etc/shorewall/start add:<br>
+               <li>In /etc/shorewall/start add:<br>
-            </li>
+                 </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><font color="#009900"><b>iptables -t mangle -A PREROUTING -i eth1 -s ! 192.168.1.3 -p tcp --dport 80 -j MARK --set-mark 202</b></font><br></pre>
-          </blockquote>
+               </blockquote>
                 
 <ul>
-            <li>On 192.168.1.3, arrange for the following command to be executed 
+                 <li>On 192.168.1.3, arrange for the following command to 
-   after   networking has come up<br>
+be  executed     after   networking has come up<br>
                                                 
     <pre><b><font color="#009900">iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-ports 3128</font></b><br></pre>
-              </li>
+                   </li>
                 
 </ul>
                 
 <blockquote>  If you are running RedHat on the server, you can simply execute
-    the following  commands after you have typed the iptables command above:<br>
+       the following  commands after you have typed the iptables command
-            </blockquote>
+above:<br>
+                 </blockquote>
                 
 <blockquote>                        
   <blockquote>          </blockquote>
                                 
   <pre><font color="#009900"><b>iptables-save &gt; /etc/sysconfig/iptables</b></font><font
- color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
+ color="#009900"><b><br>chkconfig --level 35 iptables on<br></b></font></pre>
-              </blockquote>
+                   </blockquote>
                 
 <blockquote>  </blockquote>
                 
 <h2><a name="DMZ"></a>Squid Running in the DMZ (This is what I do)</h2>
-           You have a single Linux system in your DMZ with IP address 192.0.2.177. 
+                You have a single Linux system in your DMZ with IP address
-    You want to run both a web server and Squid on that system. Your DMZ interface
+ 192.0.2.177.       You want to run both a web server and Squid on that system.
-    is eth1 and your local interface is eth2.<br>
+ Your DMZ  interface     is eth1 and your local interface is eth2.<br>
                 
 <ul>
-             <li>On your firewall system, issue the following command<br>
+                  <li>On your firewall system, issue the following command<br>
-            </li>
+                 </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><font color="#009900"><b>echo 202 www.out &gt;&gt; /etc/iproute2/rt_tables</b></font><br></pre>
-            </blockquote>
+                 </blockquote>
                 
 <ul>
-             <li>In /etc/shorewall/init, put:<br>
+                  <li>In /etc/shorewall/init, put:<br>
-              </li>
+                   </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><font color="#009900"><b>if [ -z "`ip rule list | grep www.out`" ] ; then<br>	ip rule add fwmark 202 table www.out<br>	ip route add default via 192.0.2.177 dev eth1 table www.out<br>	ip route flush cache<br>fi</b></font><br></pre>
-            </blockquote>
+                 </blockquote>
                 
 <ul>
-             <li>&nbsp;Do<b> one </b>of the following:<br>
+                  <li>&nbsp;Do<b> one </b>of the following:<br>
-          <br>
+               <br>
-      A) In /etc/shorewall/start add<br>
+           A) In /etc/shorewall/start add<br>
-            </li>
+                 </li>
                 
 </ul>
                 
 <blockquote>                        
   <pre><b><font color="#009900">	iptables -t mangle -A PREROUTING -i eth2 -p tcp --dport 80 -j MARK --set-mark 202</font></b><br></pre>
-      </blockquote>
+           </blockquote>
                 
 <blockquote>B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf
-  and add the following entry in /etc/shorewall/tcrules:<br>
+     and add the following entry in /etc/shorewall/tcrules:<br>
-      </blockquote>
+           </blockquote>
                 
 <blockquote>                        
   <blockquote>                                        
     <table cellpadding="2" border="1" cellspacing="0">
-            <tbody>
+                 <tbody>
-              <tr>
+                   <tr>
-                <td valign="top">MARK<br>
+                     <td valign="top">MARK<br>
-                </td>
+                     </td>
-                <td valign="top">SOURCE<br>
+                     <td valign="top">SOURCE<br>
-                </td>
+                     </td>
-                <td valign="top">DESTINATION<br>
+                     <td valign="top">DESTINATION<br>
-                </td>
+                     </td>
-                <td valign="top">PROTOCOL<br>
+                     <td valign="top">PROTOCOL<br>
-                </td>
+                     </td>
-                <td valign="top">PORT<br>
+                     <td valign="top">PORT<br>
-                </td>
+                     </td>
-                <td valign="top">CLIENT PORT<br>
+                     <td valign="top">CLIENT PORT<br>
-                </td>
+                     </td>
-              </tr>
+                   </tr>
-              <tr>
+                   <tr>
-                <td valign="top">202<br>
+                     <td valign="top">202<br>
-                </td>
+                     </td>
-                <td valign="top">eth2<br>
+                     <td valign="top">eth2<br>
-                </td>
+                     </td>
-                <td valign="top">0.0.0.0/0<br>
+                     <td valign="top">0.0.0.0/0<br>
-                </td>
+                     </td>
-                <td valign="top">tcp<br>
+                     <td valign="top">tcp<br>
-                </td>
+                     </td>
-                <td valign="top">80<br>
+                     <td valign="top">80<br>
-                </td>
+                     </td>
-                <td valign="top">-<br>
+                     <td valign="top">-<br>
-                </td>
+                     </td>
-              </tr>
+                   </tr>
                                                                 
       </tbody>                                        
     </table>
-        </blockquote>
+             </blockquote>
-      C) Run Shorewall 1.3.14 or later and add the following entry in /etc/shorewall/tcrules:<br>
+           C) Run Shorewall 1.3.14 or later and add the following entry in
-      </blockquote>
+ /etc/shorewall/tcrules:<br>
+           </blockquote>
                 
 <blockquote>                        
   <blockquote>                                        
     <table cellpadding="2" border="1" cellspacing="0">
-             <tbody>
+                  <tbody>
-               <tr>
+                    <tr>
-                 <td valign="top">MARK<br>
+                      <td valign="top">MARK<br>
-                 </td>
+                      </td>
-                 <td valign="top">SOURCE<br>
+                      <td valign="top">SOURCE<br>
-                 </td>
+                      </td>
-                 <td valign="top">DESTINATION<br>
+                      <td valign="top">DESTINATION<br>
-                 </td>
+                      </td>
-                 <td valign="top">PROTOCOL<br>
+                      <td valign="top">PROTOCOL<br>
-                 </td>
+                      </td>
-                 <td valign="top">PORT<br>
+                      <td valign="top">PORT<br>
-                 </td>
+                      </td>
-                 <td valign="top">CLIENT PORT<br>
+                      <td valign="top">CLIENT PORT<br>
-                 </td>
+                      </td>
-               </tr>
+                    </tr>
-               <tr>
+                    <tr>
-                 <td valign="top">202:P<br>
+                      <td valign="top">202:P<br>
-                 </td>
+                      </td>
-                 <td valign="top">eth2<br>
+                      <td valign="top">eth2<br>
-                 </td>
+                      </td>
-                 <td valign="top">0.0.0.0/0<br>
+                      <td valign="top">0.0.0.0/0<br>
-                 </td>
+                      </td>
-                 <td valign="top">tcp<br>
+                      <td valign="top">tcp<br>
-                 </td>
+                      </td>
-                 <td valign="top">80<br>
+                      <td valign="top">80<br>
-                 </td>
+                      </td>
-                 <td valign="top">-<br>
+                      <td valign="top">-<br>
-                 </td>
+                      </td>
-               </tr>
+                    </tr>
                                                                 
       </tbody>                                        
     </table>
-         </blockquote>
+              </blockquote>
-            </blockquote>
+                 </blockquote>
                 
 <ul>
-             <li>In /etc/shorewall/rules, you will need:</li>
+                  <li>In /etc/shorewall/rules, you will need:</li>
                 
 </ul>
                 
 <blockquote>                        
   <table cellpadding="2" border="1" cellspacing="0">
-               <tbody>
+                    <tbody>
-                 <tr>
+                      <tr>
-                   <td valign="top">ACTION<br>
+                        <td valign="top">ACTION<br>
-                   </td>
+                        </td>
-                   <td valign="top">SOURCE<br>
+                        <td valign="top">SOURCE<br>
-                   </td>
+                        </td>
-                   <td valign="top">DEST<br>
+                        <td valign="top">DEST<br>
-                   </td>
+                        </td>
-                   <td valign="top">PROTO<br>
+                        <td valign="top">PROTO<br>
-                   </td>
+                        </td>
-                   <td valign="top">DEST<br>
+                        <td valign="top">DEST<br>
-           PORT(S)<br>
+                PORT(S)<br>
-                   </td>
+                        </td>
-                   <td valign="top">CLIENT<br>
+                        <td valign="top">CLIENT<br>
-           PORT(2)<br>
+                PORT(2)<br>
-                   </td>
+                        </td>
-                   <td valign="top">ORIGINAL<br>
+                        <td valign="top">ORIGINAL<br>
-           DEST<br>
+                DEST<br>
-                   </td>
+                        </td>
-                 </tr>
+                      </tr>
-                 <tr>
+                      <tr>
-          <td valign="top">ACCEPT<br>
+               <td valign="top">ACCEPT<br>
-          </td>
+               </td>
-          <td valign="top">loc<br>
+               <td valign="top">loc<br>
-          </td>
+               </td>
-          <td valign="top">dmz<br>
+               <td valign="top">dmz<br>
-          </td>
+               </td>
-          <td valign="top">tcp<br>
+               <td valign="top">tcp<br>
-          </td>
+               </td>
-          <td valign="top">80<br>
+               <td valign="top">80<br>
-          </td>
+               </td>
-          <td valign="top"><br>
+               <td valign="top"><br>
-          </td>
+               </td>
-          <td valign="top"><br>
+               <td valign="top"><br>
-          </td>
+               </td>
-        </tr>
+             </tr>
-        <tr>
+             <tr>
-                   <td valign="top">ACCEPT<br>
+                        <td valign="top">ACCEPT<br>
-                   </td>
+                        </td>
-                   <td valign="top">dmz<br>
+                        <td valign="top">dmz<br>
-                   </td>
+                        </td>
-                   <td valign="top">net<br>
+                        <td valign="top">net<br>
-                   </td>
+                        </td>
-                   <td valign="top">tcp<br>
+                        <td valign="top">tcp<br>
-                   </td>
+                        </td>
-                   <td valign="top">80<br>
+                        <td valign="top">80<br>
-                   </td>
+                        </td>
-                   <td valign="top"><br>
+                        <td valign="top"><br>
-                   </td>
+                        </td>
-                   <td valign="top"><br>
+                        <td valign="top"><br>
-                   </td>
+                        </td>
-                 </tr>
+                      </tr>
                                                 
     </tbody>                        
   </table>
-             <br>
+                  <br>
-           </blockquote>
+                </blockquote>
                 
 <ul>
-             <li>On 192.0.2.177 (your Web/Squid server), arrange for the
+                  <li>On 192.0.2.177 (your Web/Squid server), arrange for 
-following     command to be executed after  networking has come up<br>
+the   following     command to be executed after  networking has come up<br>
                                                 
     <pre><font color="#009900"><b>iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128</b></font><br></pre>
-              </li>
+                   </li>
                 
 </ul>
                 
 <blockquote>  If you are running RedHat on the server, you can simply execute
-    the following  commands after you have typed the iptables command above:<br>
+       the following  commands after you have typed the iptables command
-            </blockquote>
+above:<br>
+                 </blockquote>
                 
 <blockquote>                        
   <blockquote>          </blockquote>
                                 
   <pre><font color="#009900"><b>iptables-save &gt; /etc/sysconfig/iptables</b></font><font
- color="#009900"><b><br>chkconfig --level 35 iptables start<br></b></font></pre>
+ color="#009900"><b><br>chkconfig --level 35 iptables on<br></b></font></pre>
-              </blockquote>
+                   </blockquote>
                 
 <blockquote>  </blockquote>
                 
-<p><font size="-1">   Updated 5/29/2003 - <a href="support.htm">Tom  Eastep</a> 
+<p><font size="-1">   Updated 7/18/2003 - <a href="support.htm">Tom  Eastep</a>
-              </font></p>
+                 </font></p>
                                                                         
-   <a href="copyright.htm"><font size="2">Copyright</font>           &copy;
+        <a href="copyright.htm"><font size="2">Copyright</font>         
- <font size="2">2003 Thomas M. Eastep.</font></a><br>
+ &copy;    <font size="2">2003 Thomas M. Eastep.</font></a><br>
-  <br>
+    <br>
- <br>
+   <br>
+   <br>
 </body>
 </html>

STABLE/documentation/Shorewall_index_frame.htm

@@ -12,123 +12,130 @@
   <meta name="ProgId" content="FrontPage.Editor.Document">
   <title>Shorewall Index</title>
                                                                         
-                                         <base target="main">           
+                                                                     <base
-                      
+ target="main">                                                       
   <meta name="Microsoft Theme" content="none">
 </head>
   <body>
                                     
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#4b017c" height="90">
+ bgcolor="#3366ff" height="90">
-                                                 <tbody>
+                                                        <tbody>
-                                                  <tr>
+                                                         <tr>
-                                                   <td width="100%"
+                                                          <td
- height="90">                                                            
+ width="100%" height="90">                                               
+                                                                        
            
       <h3 align="center"><font color="#ffffff">Shorewall</font></h3>
-                                                   </td>
+                                                          </td>
-                                                 </tr>
+                                                        </tr>
-                                                 <tr>
+                                                        <tr>
-                                                   <td width="100%"
+                                                          <td
- bgcolor="#ffffff">                                                      
+ width="100%" bgcolor="#ffffff">                                         
+                                                                        
               
       <ul>
-                                                     <li> <a
+                                                            <li> <a
  href="seattlefirewall_index.htm">Home</a></li>
-                                                             <li> <a
+                                                                    <li>
- href="shorewall_features.htm">Features</a></li>
+          <a href="shorewall_features.htm">Features</a></li>
-                                                     <li> <a
+           <li><a href="Shorewall_Doesnt.html">What it Cannot Do</a><br>
+           </li>
+                                                            <li> <a
  href="shorewall_prerequisites.htm">Requirements</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="download.htm">Download</a><br>
-                                             </li>
+                                                    </li>
-                                             <li> <a href="Install.htm">Installation/Upgrade/</a><br>
+                                                    <li> <a
-                                               <a href="Install.htm">Configuration</a><br>
+ href="Install.htm">Installation/Upgrade/</a><br>
-                                             </li>
+                                                      <a
-                                             <li> <a
+ href="Install.htm">Configuration</a><br>
+                                                    </li>
+                                                    <li> <a
  href="shorewall_quickstart_guide.htm">QuickStart       Guides   (HOWTOs)</a><br>
-                                              </li>
+                                                     </li>
-                                                                     <li> 
+                                                                        
-          <b><a href="shorewall_quickstart_guide.htm#Documentation">Documentation 
+           <li>             <b><a
-Index</a></b></li>
+ href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
-                                                     <li> <a
+                                                                        
- href="Documentation.htm">Reference      Manual</a></li>
+                                         <li> <a href="FAQ.htm">FAQs</a></li>
-                                                     <li> <a
+                                                             <li><a
- href="FAQ.htm">FAQs</a></li>
-                                                      <li><a
  href="useful_links.html">Useful     Links</a><br>
-                                                      </li>
+                                                             </li>
-                                                     <li> <a
+                                                            <li> <a
  href="troubleshoot.htm">Things to try if it doesn't work</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="errata.htm">Errata</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="upgrade_issues.htm">Upgrade     Issues</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="support.htm">Getting   help or Answers to Questions</a></li>
-                <li><a href="http://lists.shorewall.net">Mailing Lists</a><a
+                       <li><a href="http://lists.shorewall.net">Mailing Lists</a><a
  href="http://lists.shorewall.net"> </a><br>
-                </li>
+                       </li>
-                                          <li><a href="1.3"
+                                                                        
- target="_top">Shorewall       1.3 Site</a></li>
+ <li><a href="shorewall_mirrors.htm">Mirrors</a>                        
-                                          <li><a
+                                                                        
- href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall  1.2
-Site</a></li>
-                  <li><a href="shorewall_mirrors.htm">Mirrors</a>       
                                                                         
                                  
           <ul>
-                                                       <li><a
+                                                              <li><a
  target="_top" href="http://slovakia.shorewall.net">Slovak    Republic</a></li>
-                                                       <li><a
+                                                              <li><a
  target="_top" href="http://shorewall.infohiiway.com">Texas,   USA</a></li>
-                                                       <li><a
+                                                              <li><a
  target="_top" href="http://germany.shorewall.net">Germany</a></li>
                                                                         
-                                 <li><a target="_top"
+                                        <li><a target="_top"
  href="http://france.shorewall.net">France</a></li>
-                   <li><a href="http://shorewall.syachile.cl"
+                          <li><a href="http://shorewall.syachile.cl"
  target="_top">Chile</a></li>
-                  <li><a href="http://shorewall.greshko.com"
+                         <li><a href="http://shorewall.greshko.com"
- target="_top">Taiwan</a><br>
+ target="_top">Taiwan</a></li>
-                  </li>
+                 <li><a href="http://argentina.shorewall.net"
-                                           <li><a
+ target="_top">Argentina</a></li>
+              <li><a href="http://shorewall.securityopensource.org.br"
+ target="_top">Brazil</a><br>
+              </li>
+                                                  <li><a
  href="http://www.shorewall.net" target="_top">Washington    State, USA</a><br>
-                                           </li>
+                                                  </li>
+                                                                        
+                                                                        
                                                                         
   
           </ul>
-                                                     </li>
+                                                            </li>
+                                                                        
                                                                         
  
       </ul>
                                                                         
                                                                         
+ 
       <ul>
-                                                     <li>   <a
+                                                            <li>   <a
  href="News.htm">News    Archive</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="Shorewall_CVS_Access.html">CVS   Repository</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="quotes.htm">Quotes     from   Users</a></li>
-         <li>GSLUG Presentation</li>
                 
         <ul>
-           <li><a href="GSLUG.htm">HTML</a></li>
+                                                                        
-           <li><a href="GSLUG.ppt">PowerPoint</a><br>
-           </li>
       
         </ul>
-                                                     <li> <a
+                                                            <li> <a
  href="shoreline.htm">About    the   Author</a></li>
-                                                     <li> <a
+                                                            <li> <a
  href="seattlefirewall_index.htm#Donations">Donations</a></li>
                                                                         
                                                                         
+ 
       </ul>
-                                                   </td>
+                                                          </td>
-                                                 </tr>
+                                                        </tr>
                                                                         
   </tbody>                  
 </table>

STABLE/documentation/Shorewall_sfindex_frame.htm

@@ -12,123 +12,127 @@
   <meta name="ProgId" content="FrontPage.Editor.Document">
   <title>Shorewall Index</title>
                                                                         
-                                     <base target="main">               
+                                                                 <base
-               
+ target="main">                                                    
   <meta name="Microsoft Theme" content="none">
 </head>
   <body>
                                   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#4b017c" height="90">
+ bgcolor="#3366ff" height="90">
-                                                <tbody>
+                                                       <tbody>
-                                                 <tr>
+                                                        <tr>
-                                                  <td width="100%"
+                                                         <td
- height="90">                                                           
+ width="100%" height="90">                                              
+                                                                        
      
       <h3 align="center"><font color="#ffffff">Shorewall</font></h3>
-                                                  </td>
+                                                         </td>
-                                                </tr>
+                                                       </tr>
-                                                <tr>
+                                                       <tr>
-                                                  <td width="100%"
+                                                         <td
- bgcolor="#ffffff">                                                     
+ width="100%" bgcolor="#ffffff">                                        
+                                                                        
         
       <ul>
-                                                    <li> <a
+                                                           <li> <a
  href="seattlefirewall_index.htm">Home</a></li>
-                                                            <li> <a
+                                                                   <li> <a
  href="shorewall_features.htm">Features</a></li>
-                                                    <li> <a
+           <li><a href="Shorewall_Doesnt.html">What it Cannot Do</a><br>
+    </li>
+                                                           <li> <a
  href="shorewall_prerequisites.htm">Requirements</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="download.htm">Download</a><br>
-                                            </li>
+                                                   </li>
-                                            <li> <a href="Install.htm">Installation/Upgrade/</a><br>
+                                                   <li> <a
-                                              <a href="Install.htm">Configuration</a><br>
+ href="Install.htm">Installation/Upgrade/</a><br>
-                                            </li>
+                                                     <a
-                                            <li> <a
+ href="Install.htm">Configuration</a><br>
+                                                   </li>
+                                                   <li> <a
  href="shorewall_quickstart_guide.htm">QuickStart       Guides   (HOWTOs)</a><br>
-                                             </li>
+                                                    </li>
-                                                                    <li>
+                                                                        
-          <b><a href="shorewall_quickstart_guide.htm#Documentation">Documentation
+          <li>             <b><a
-Index</a></b></li>
+ href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
-                                                    <li> <a
+                                                                        
- href="Documentation.htm">Reference      Manual</a></li>
+                                       <li> <a href="FAQ.htm">FAQs</a></li>
-                                                    <li> <a
+                                                            <li><a
- href="FAQ.htm">FAQs</a></li>
-                                                     <li><a
  href="useful_links.html">Useful     Links</a><br>
-                                                     </li>
+                                                            </li>
-                                                    <li> <a
+                                                           <li> <a
  href="troubleshoot.htm">Things to try if it doesn't work</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="errata.htm">Errata</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="upgrade_issues.htm">Upgrade     Issues</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="support.htm">Getting   help or Answers to Questions</a>          
-       </li>
-                                         <li><a
- href="http://lists.shorewall.net">Mailing Lists</a> <br>
         </li>
-               <li><a href="1.3" target="_top">Shorewall   1.3 Site</a></li>
+                                                <li><a
-                                         <li><a
+ href="http://lists.shorewall.net">Mailing Lists</a> <br>
- href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall 
+               </li>
-1.2 Site</a></li>
+                                              <li><a
-                 <li><a href="shorewall_mirrors.htm">Mirrors</a>        
+ href="shorewall_mirrors.htm">Mirrors</a>                               
+                                                                        
                                                                         
                
           <ul>
-                                                      <li><a
+                                                             <li><a
  target="_top" href="http://slovakia.shorewall.net">Slovak    Republic</a></li>
-                                                      <li><a
+                                                             <li><a
  target="_top" href="http://shorewall.infohiiway.com">Texas,   USA</a></li>
-                                                      <li><a
+                                                             <li><a
  target="_top" href="http://germany.shorewall.net">Germany</a></li>
                                                                         
-                               <li><a target="_top"
+                                      <li><a target="_top"
  href="http://france.shorewall.net">France</a></li>
-                  <li><a href="http://shorewall.syachile.cl"
+                         <li><a href="http://shorewall.syachile.cl"
  target="_top">Chile</a></li>
-                 <li><a href="http://shorewall.greshko.com"
+                        <li><a href="http://shorewall.greshko.com"
- target="_top">Taiwan</a><br>
+ target="_top">Taiwan</a></li>
-      </li>
+                 <li><a href="http://argentina.shorewall.net"
-                                          <li><a
+ target="_top">Argentina</a></li>
+              <li><a href="http://shorewall.securityopensource.org.br"
+ target="_top">Brazil</a><br>
+   </li>
+                                                 <li><a
  href="http://www.shorewall.net" target="_top">Washington    State, USA</a><br>
-                                          </li>
+                                                 </li>
+                                                                        
                                                                         
                                                                
           </ul>
-                                                    </li>
+                                                           </li>
                                                                         
                                                                   
       </ul>
                                                                         
                                                                   
       <ul>
-                                                    <li>   <a
+                                                           <li>   <a
  href="News.htm">News    Archive</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="Shorewall_CVS_Access.html">CVS   Repository</a></li>
-         <li>GSLUG Presentation</li>
                 
         <ul>
-           <li><a href="GSLUG.htm">HTML</a></li>
+                                                                        
-           <li><a href="GSLUG.ppt">PowerPoint</a><br>
-    </li>
       
         </ul>
-                                                    <li> <a
+                                                           <li> <a
  href="quotes.htm">Quotes     from   Users</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="shoreline.htm">About    the   Author</a></li>
-                                                    <li> <a
+                                                           <li> <a
  href="seattlefirewall_index.htm#Donations">Donations</a></li>
                                                                         
                                                                   
       </ul>
-                                                  </td>
+                                                         </td>
-                                                </tr>
+                                                       </tr>
                                                                      
   </tbody>                 
 </table>

STABLE/documentation/VPN.htm

@@ -16,13 +16,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-   <tbody>
+    <tbody>
-    <tr>
+     <tr>
-     <td width="100%">
+      <td width="100%">       
       <h1 align="center"><font color="#ffffff">VPN</font></h1>
-     </td>
+      </td>
-   </tr>
+    </tr>
     
   </tbody> 
 </table>
@@ -34,71 +34,73 @@ is shown in the  following diagram:</p>
   
 <p align="center"><img border="0" src="images/VPN.png" width="568"
  height="796">
-</p>
+ </p>
   
 <p align="left">A system with an RFC 1918 address needs to access a remote 
- network through a remote gateway. For this example, we will assume that
+ network through a remote gateway. For this example, we will assume that the
-the  local system has IP address 192.168.1.12 and that the remote gateway
+ local system has IP address 192.168.1.12 and that the remote gateway has
-has IP  address 192.0.2.224.</p>
+IP  address 192.0.2.224.</p>
   
 <p align="left">If PPTP is being used, there are no firewall requirements 
 beyond  the default loc-&gt;net ACCEPT policy. There is one restriction however: 
 Only one  local system at a time can be connected to a single remote gateway 
-unless you  patch your kernel from the 'Patch-o-matic' patches available
+unless you  patch your kernel from the 'Patch-o-matic' patches available at
-at <a href="http://www.netfilter.org">http://www.netfilter.org</a>. </p>
+<a href="http://www.netfilter.org">http://www.netfilter.org</a>. </p>
   
 <p align="left">If IPSEC is being used then only one system may connect to 
-the remote gateway and there are firewall configuration  requirements as
+the remote gateway and there are firewall configuration  requirements as follows:</p>
-follows:</p>
   
 <blockquote>   
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  bordercolor="#111111" id="AutoNumber2" height="98">
-     <tbody>
+      <tbody>
+       <tr>
+        <td height="38"><u><b>ACTION</b></u></td>
+        <td height="38"><u><b>SOURCE</b></u></td>
+        <td height="38"><u><b>DESTINATION</b></u></td>
+        <td height="38"><u><b>PROTOCOL</b></u></td>
+        <td height="38"><u><b>PORT</b></u></td>
+        <td height="38"><u><b>CLIENT<br>
+        PORT</b></u></td>
+        <td height="38"><u><b>ORIGINAL<br>
+        DEST</b></u></td>
+      </tr>
       <tr>
-       <td height="38"><u><b>ACTION</b></u></td>
+        <td height="19">DNAT</td>
-       <td height="38"><u><b>SOURCE</b></u></td>
+        <td height="19">net:192.0.2.224</td>
-       <td height="38"><u><b>DESTINATION</b></u></td>
+        <td height="19">loc:192.168.1.12</td>
-       <td height="38"><u><b>PROTOCOL</b></u></td>
+        <td height="19">50</td>
-       <td height="38"><u><b>PORT</b></u></td>
+        <td height="19"> </td>
-       <td height="38"><u><b>CLIENT<br>
+        <td height="19"> </td>
-       PORT</b></u></td>
+        <td height="19"> </td>
-       <td height="38"><u><b>ORIGINAL<br>
+      </tr>
-       DEST</b></u></td>
+      <tr>
-     </tr>
+        <td height="19">DNAT</td>
-     <tr>
+        <td height="19">net:192.0.2.224</td>
-       <td height="19">DNAT</td>
+        <td height="19">loc:192.168.1.12</td>
-       <td height="19">net:192.0.2.224</td>
+        <td height="19">udp</td>
-       <td height="19">loc:192.168.1.12</td>
+        <td height="19">500</td>
-       <td height="19">50</td>
+        <td height="19"> </td>
-       <td height="19"> </td>
+        <td height="19"> </td>
-       <td height="19"> </td>
+      </tr>
-       <td height="19"> </td>
-     </tr>
-     <tr>
-       <td height="19">DNAT</td>
-       <td height="19">net:192.0.2.224</td>
-       <td height="19">loc:192.168.1.12</td>
-       <td height="19">udp</td>
-       <td height="19">500</td>
-       <td height="19"> </td>
-       <td height="19"> </td>
-     </tr>
       
     </tbody>   
   </table>
- </blockquote>
+  </blockquote>
   
-<p>If you want to be able to give access to all of your local systems to
+<p>If you want to be able to give access to all of your local systems to the
-the  remote network, you should consider running a VPN client on your firewall.
+ remote network, you should consider running a VPN client on your firewall. 
 As  starting points, see <a
  href="http://www.shorewall.net/Documentation.htm#Tunnels"> http://www.shorewall.net/Documentation.htm#Tunnels</a> 
 or <a href="http://www.shorewall.net/PPTP.htm">http://www.shorewall.net/PPTP.htm</a>.</p>
   
 <p><font size="2">Last modified 12/21/2002 - <a href="support.htm">Tom Eastep</a></font></p>
+ 
 <p><font face="Trebuchet MS"><a href="copyright.htm"> <font size="2">Copyright</font> 
 © <font size="2">2002 Thomas M. Eastep.</font></a></font></p>
+ 
 <p> </p>
-  <br>
+   <br>
+ <br>
 </body>
 </html>

STABLE/documentation/blacklisting_support.htm

@@ -16,13 +16,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-     <tbody>
+      <tbody>
-      <tr>
+       <tr>
-       <td width="100%">
+        <td width="100%">       
       <h1 align="center"><font color="#ffffff">Blacklisting Support</font></h1>
-       </td>
+        </td>
-     </tr>
+      </tr>
     
   </tbody> 
 </table>
@@ -31,26 +31,25 @@
   
 <h2>Static Blacklisting</h2>
   
-<p>Shorewall static blacklisting support has the following configuration
+<p>Shorewall static blacklisting support has the following configuration parameters:</p>
-parameters:</p>
   
 <ul>
-     <li>You specify whether you want packets from blacklisted hosts dropped
+      <li>You specify whether you want packets from blacklisted hosts dropped 
  or     rejected using the <a href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION</a> 
      setting in /etc/shorewall/shorewall.conf</li>
-     <li>You specify whether you want packets from blacklisted hosts logged
+      <li>You specify whether you want packets from blacklisted hosts logged 
  and at     what syslog level using the <a
  href="Documentation.htm#BLLoglevel">BLACKLIST_LOGLEVEL</a>     setting in 
  /etc/shorewall/shorewall.conf</li>
-     <li>You list the IP addresses/subnets that you wish to blacklist in
+      <li>You list the IP addresses/subnets that you wish to blacklist in 
     <a href="Documentation.htm#Blacklist">/etc/shorewall/blacklist.</a> Beginning 
  with Shorewall version 1.3.8, you may also specify PROTOCOL and Port numbers/Service 
  names in the blacklist file.<br>
-    </li>
+     </li>
-     <li>You specify the interfaces whose incoming packets you want checked
+      <li>You specify the interfaces whose incoming packets you want checked 
  against     the blacklist using the "<a
  href="Documentation.htm#Interfaces">blacklist</a>"     option in /etc/shorewall/interfaces.</li>
-     <li>The black list is refreshed from /etc/shorewall/blacklist by the
+      <li>The black list is refreshed from /etc/shorewall/blacklist by the 
 "<a href="Documentation.htm#Starting">shorewall     refresh</a>" command.</li>
   
 </ul>
@@ -62,18 +61,18 @@ parameters:</p>
  /sbin/shorewall commands:</p>
   
 <ul>
-     <li>drop <i>&lt;ip address list&gt; </i>- causes packets from the listed
+      <li>drop <i>&lt;ip address list&gt; </i>- causes packets from the listed 
  IP    addresses to be silently dropped by the firewall.</li>
-     <li>reject <i>&lt;ip address list&gt; </i>- causes packets from the
+      <li>reject <i>&lt;ip address list&gt; </i>- causes packets from the 
 listed  IP    addresses to be rejected by the firewall.</li>
-     <li>allow <i>&lt;ip address list&gt; </i>- re-enables receipt of packets
+      <li>allow <i>&lt;ip address list&gt; </i>- re-enables receipt of packets 
  from hosts    previously blacklisted by a <i>deny</i> or <i>reject</i> command.</li>
-     <li>save - save the dynamic blacklisting configuration so that it will
+      <li>save - save the dynamic blacklisting configuration so that it will 
  be    automatically restored the next time that the firewall is restarted.</li>
-     <li>show dynamic - displays the dynamic blacklisting configuration.</li>
+      <li>show dynamic - displays the dynamic blacklisting configuration.</li>
   
 </ul>
-Dynamic blacklisting is <u>not</u> dependent on the "blacklist" option in
+ Dynamic blacklisting is <u>not</u> dependent on the "blacklist" option in 
 /etc/shorewall/interfaces.<br>
   
 <p>Example 1:</p>
@@ -92,7 +91,8 @@ Dynamic blacklisting is <u>not</u> dependent on the "blacklist" option in
   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
   © <font size="2">2002, 2003 Thomas M. Eastep.</font></a></font></p>
-    <br>
+     <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/configuration_file_basics.htm

@@ -16,80 +16,82 @@
       
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-                     <tbody>
+                       <tbody>
-                      <tr>
+                        <tr>
-                       <td width="100%">         
+                         <td width="100%">                       
       <h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
-                       </td>
+                         </td>
-                     </tr>
+                       </tr>
             
   </tbody>   
 </table>
       
 <p><b><font color="#ff0000">Warning: </font>If you copy or edit your   configuration
-files on a system running Microsoft Windows, you <u>must</u>            
+ files on a system running Microsoft Windows, you <u>must</u>           
-   run them through <a
+    run them through <a
  href="http://www.megaloman.com/%7Ehany/software/hd2u/">       dos2unix</a> 
-        before you use them with Shorewall.</b></p>
+         before you use them with Shorewall.</b></p>
       
 <h2><a name="Files"></a>Files</h2>
       
 <p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
       
 <ul>
-                           <li>/etc/shorewall/shorewall.conf - used to set 
+                             <li>/etc/shorewall/shorewall.conf - used to
-several     firewall             parameters.</li>
+set  several     firewall             parameters.</li>
-                           <li>/etc/shorewall/params - use this file to set 
+                             <li>/etc/shorewall/params - use this file to 
- shell    variables     that you will     expand in other files.</li>
+set   shell    variables     that you will     expand in other files.</li>
-                           <li>/etc/shorewall/zones - partition the firewall's 
+                             <li>/etc/shorewall/zones - partition the firewall's 
-  view   of  the   world         into <i>zones.</i></li>
+   view   of  the   world         into <i>zones.</i></li>
-                           <li>/etc/shorewall/policy - establishes firewall 
+                             <li>/etc/shorewall/policy - establishes firewall 
- high-level      policy.</li>
+  high-level      policy.</li>
-                           <li>/etc/shorewall/interfaces - describes the
+                             <li>/etc/shorewall/interfaces - describes the
-interfaces      on  the          firewall system.</li>
+ interfaces      on  the          firewall system.</li>
-                           <li>/etc/shorewall/hosts - allows defining zones 
+                             <li>/etc/shorewall/hosts - allows defining zones 
- in  terms    of  individual           hosts and subnetworks.</li>
+  in  terms    of  individual           hosts and subnetworks.</li>
-                           <li>/etc/shorewall/masq - directs the firewall 
+                             <li>/etc/shorewall/masq - directs the firewall 
-where    to  use   many-to-one            (dynamic) Network Address Translation 
+ where    to  use   many-to-one            (dynamic) Network Address Translation 
-(a.k.a.    Masquerading)   and  Source          Network Address Translation 
+ (a.k.a.    Masquerading)   and  Source          Network Address Translation 
-(SNAT).</li>
+ (SNAT).</li>
-                           <li>/etc/shorewall/modules - directs the firewall 
+                             <li>/etc/shorewall/modules - directs the firewall 
- to  load   kernel    modules.</li>
+  to  load   kernel    modules.</li>
-                           <li>/etc/shorewall/rules - defines rules that
+                             <li>/etc/shorewall/rules - defines rules that
-are  exceptions      to  the         overall policies established in /etc/shorewall/policy.</li>
+ are  exceptions      to  the         overall policies established in /etc/shorewall/policy.</li>
-                           <li>/etc/shorewall/nat - defines static NAT rules.</li>
+                             <li>/etc/shorewall/nat - defines static NAT
-                           <li>/etc/shorewall/proxyarp - defines use of Proxy 
+rules.</li>
-  ARP.</li>
+                             <li>/etc/shorewall/proxyarp - defines use of 
-                           <li>/etc/shorewall/routestopped (Shorewall 1.3.4 
+Proxy    ARP.</li>
- and   later)    -  defines  hosts    accessible when Shorewall is stopped.</li>
+                             <li>/etc/shorewall/routestopped (Shorewall 1.3.4 
-                           <li>/etc/shorewall/tcrules - defines marking of 
+  and   later)    -  defines  hosts    accessible when Shorewall is stopped.</li>
-packets     for   later   use by     traffic control/shaping or policy routing.</li>
+                             <li>/etc/shorewall/tcrules - defines marking 
-                           <li>/etc/shorewall/tos - defines rules for setting 
+of  packets     for   later   use by     traffic control/shaping or policy 
-  the   TOS   field   in packet         headers.</li>
+routing.</li>
-                           <li>/etc/shorewall/tunnels - defines IPSEC, GRE 
+                             <li>/etc/shorewall/tos - defines rules for setting 
-and   IPIP   tunnels    with end-points on         the firewall system.</li>
+   the   TOS   field   in packet         headers.</li>
-                           <li>/etc/shorewall/blacklist - lists blacklisted 
+                             <li>/etc/shorewall/tunnels - defines IPSEC,
- IP/subnet/MAC        addresses.</li>
+GRE  and   IPIP   tunnels    with end-points on         the firewall system.</li>
-        <li>/etc/shorewall/init - commands that you wish to execute at the 
+                             <li>/etc/shorewall/blacklist - lists blacklisted 
-beginning   of a "shorewall start" or "shorewall restart".</li>
+  IP/subnet/MAC        addresses.</li>
-        <li>/etc/shorewall/start - commands that you wish to execute at the 
+          <li>/etc/shorewall/init - commands that you wish to execute at
- completion  of a "shorewall start" or "shorewall restart"</li>
+the  beginning   of a "shorewall start" or "shorewall restart".</li>
-        <li>/etc/shorewall/stop - commands that you wish to execute at the 
+          <li>/etc/shorewall/start - commands that you wish to execute at 
-beginning   of a "shorewall stop".</li>
+the   completion  of a "shorewall start" or "shorewall restart"</li>
-        <li>/etc/shorewall/stopped - commands that you wish to execute at 
+          <li>/etc/shorewall/stop - commands that you wish to execute at
-the   completion of a "shorewall stop".</li>
+the  beginning   of a "shorewall stop".</li>
-   <li>/etc/shorewall/ecn - disable Explicit Congestion Notification (ECN 
+          <li>/etc/shorewall/stopped - commands that you wish to execute
-- RFC 3168) to remote hosts or networks.<br>
+at  the   completion of a "shorewall stop".</li>
-   </li>
+     <li>/etc/shorewall/ecn - disable Explicit Congestion Notification (ECN 
+ - RFC 3168) to remote hosts or networks.<br>
+     </li>
       
 </ul>
       
 <h2><a name="Comments"></a>Comments</h2>
       
 <p>You may place comments in configuration files by making the first non-whitespace 
-               character a pound sign ("#"). You may also place comments at
+                character a pound sign ("#"). You may also place comments 
-  the    end  of any line, again by       delimiting the comment from the
+at   the    end  of any line, again by       delimiting the comment from the
 rest  of   the line  with a pound sign.</p>
       
 <p>Examples:</p>
@@ -101,165 +103,166 @@ rest  of   the line  with a pound sign.</p>
 <h2><a name="Continuation"></a>Line Continuation</h2>
       
 <p>You may continue lines in the configuration files using the usual backslash 
-        ("\") followed        immediately by a new line character.</p>
+         ("\") followed        immediately by a new line character.</p>
       
 <p>Example:</p>
       
 <pre>ACCEPT	net	fw	tcp \<br>smtp,www,pop3,imap  #Services running on the firewall</pre>
       
 <h2><a name="INCLUDE"></a>IN<small><small></small></small>CLUDE Directive</h2>
- Beginning with Shorewall version 1.4.2, any file may contain INCLUDE directives.
+   Beginning with Shorewall version 1.4.2, any file may contain INCLUDE directives.
-An INCLUDE directive   consists of the word INCLUDE followed by a file name
+ An INCLUDE directive   consists of the word INCLUDE followed by a file name
-and causes the contents   of the named file to be logically included into
+ and causes the contents   of the named file to be logically included into
-the file containing the INCLUDE.  File names given in an INCLUDE directive
+ the file containing the INCLUDE.  File names given in an INCLUDE directive
-are assumed to reside in /etc/shorewall  or in an alternate configuration
+ are assumed to reside in /etc/shorewall  or in an alternate configuration
-directory if one has been specified for the command.<br>
+ directory if one has been specified for the command.<br>
-<br>
+  <br>
-INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives 
+  INCLUDE's may be nested to a level of 3 -- further nested INCLUDE directives 
-  are ignored with a warning message.<big><big><br>
+   are ignored with a warning message.<big><big><br>
-<br>
+  <br>
-</big></big> Examples:<big> </big>       <br>
+  </big></big> Examples:<big> </big>       <br>
      
 <blockquote>         shorewall/params.mgmt:<br>
            
   <blockquote>         MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
-          TIME_SERVERS=4.4.4.4<br>
+            TIME_SERVERS=4.4.4.4<br>
-          BACKUP_SERVERS=5.5.5.5<br>
+            BACKUP_SERVERS=5.5.5.5<br>
+     </blockquote>
+            ----- end params.mgmt -----<br>
    </blockquote>
-          ----- end params.mgmt -----<br>
- </blockquote>
      
 <blockquote>         shorewall/params:<br>
- </blockquote>
+   </blockquote>
      
 <blockquote>         
   <blockquote>         # Shorewall 1.3 /etc/shorewall/params<br>
-          [..]<br>
+            [..]<br>
-          #######################################<br>
+            #######################################<br>
-        <br>
+          <br>
-          INCLUDE params.mgmt    <br>
+            INCLUDE params.mgmt    <br>
-         <br>
+           <br>
-          # params unique to this host here<br>
+            # params unique to this host here<br>
-          #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
+            #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
+     </blockquote>
    </blockquote>
- </blockquote>
      
 <blockquote>         ----- end params -----<br>
- </blockquote>
+   </blockquote>
      
 <blockquote>         shorewall/rules.mgmt:<br>
- </blockquote>
+   </blockquote>
      
 <blockquote>         
   <blockquote>         ACCEPT net:$MGMT_SERVERS          $FW    tcp    22<br>
-          ACCEPT $FW          net:$TIME_SERVERS    udp    123<br>
+            ACCEPT $FW          net:$TIME_SERVERS    udp    123<br>
-          ACCEPT $FW          net:$BACKUP_SERVERS  tcp    22<br>
+            ACCEPT $FW          net:$BACKUP_SERVERS  tcp    22<br>
+     </blockquote>
    </blockquote>
- </blockquote>
      
 <blockquote>         ----- end rules.mgmt -----<br>
- </blockquote>
+   </blockquote>
      
 <blockquote>         shorewall/rules:<br>
- </blockquote>
+   </blockquote>
      
 <blockquote>         
   <blockquote>         # Shorewall version 1.3 - Rules File<br>
-          [..]<br>
+            [..]<br>
-          #######################################<br>
+            #######################################<br>
-        <br>
+          <br>
-          INCLUDE rules.mgmt     <br>
+            INCLUDE rules.mgmt     <br>
-         <br>
+           <br>
-          # rules unique to this host here<br>
+            # rules unique to this host here<br>
-          #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
+            #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE<br>
+     </blockquote>
    </blockquote>
- </blockquote>
      
 <blockquote>         ----- end rules -----<br>
- </blockquote>
+   </blockquote>
+   
 <h2><a name="dnsnames"></a>Using DNS Names</h2>
       
 <p align="left">     </p>
       
 <p align="left"><b>WARNING: I personally recommend strongly <u>against</u> 
-         using DNS names in Shorewall configuration files. If you use DNS 
+          using DNS names in Shorewall configuration files. If you use DNS 
-names      and   you are called out of bed at 2:00AM because Shorewall won't 
+ names      and   you are called out of bed at 2:00AM because Shorewall won't 
-start    as  a result  of DNS problems then don't say that you were not forewarned. 
+ start    as  a result  of DNS problems then don't say that you were not forewarned.
-    <br>
+     <br>
-                   </b></p>
+                     </b></p>
       
 <p align="left"><b>    -Tom<br>
-                   </b></p>
+                     </b></p>
       
-<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall 
+<p align="left">Beginning with Shorewall 1.3.9, Host addresses in Shorewall 
-        configuration files may be specified as either IP addresses or DNS 
+         configuration files may be specified as either IP addresses or DNS 
-   Names.<br>
+    Names.<br>
-                   <br>
+                     <br>
-                  DNS names in iptables rules  aren't nearly as useful as 
+                    DNS names in iptables rules  aren't nearly as useful
-they   first    appear.    When a DNS name appears in a rule,  the iptables 
+as  they   first    appear.    When a DNS name appears in a rule,  the iptables 
-utility   resolves    the name    to one or more IP addresses and inserts 
+ utility   resolves    the name    to one or more IP addresses and inserts 
- those addresses   into    the rule.  So  changes in the DNS-&gt;IP address 
+  those addresses   into    the rule.  So  changes in the DNS-&gt;IP address 
-relationship  that   occur   after the firewall    has started have absolutely 
+ relationship  that   occur   after the firewall    has started have absolutely 
-no effect on the    firewall's   ruleset.    </p>
+ no effect on the    firewall's   ruleset.    </p>
       
 <p align="left">     If your firewall rules include DNS names then:</p>
       
 <ul>
-                    <li>If your /etc/resolv.conf is wrong then your firewall 
+                      <li>If your /etc/resolv.conf is wrong then your firewall 
- won't        start.</li>
-                    <li>If your /etc/nsswitch.conf is wrong then your firewall 
   won't        start.</li>
-                    <li>If your Name Server(s) is(are) down then your firewall 
+                      <li>If your /etc/nsswitch.conf is wrong then your firewall 
-  won't        start.</li>
+   won't        start.</li>
-                    <li>If your startup scripts try to start your firewall 
+                      <li>If your Name Server(s) is(are) down then your firewall 
-before    starting     your DNS server then your firewall won't start.<br>
+   won't        start.</li>
-                   </li>
+                      <li>If your startup scripts try to start your firewall 
-                    <li>Factors totally outside your control (your ISP's
+ before    starting     your DNS server then your firewall won't start.<br>
-router    is      down   for example), can prevent your firewall from starting.</li>
+                     </li>
-                   <li>You must bring up your network interfaces prior to 
+                      <li>Factors totally outside your control (your ISP's
-starting     your   firewall.<br>
+ router    is      down   for example), can prevent your firewall from starting.</li>
-                   </li>
+                     <li>You must bring up your network interfaces prior
+to  starting     your   firewall.<br>
+                     </li>
       
 </ul>
       
 <p align="left"> Each DNS name much be fully qualified and include a minumum 
-        of two periods (although one may be trailing). This restriction is 
+         of two periods (although one may be trailing). This restriction is
- imposed       by Shorewall to insure backward compatibility with existing 
+  imposed       by Shorewall to insure backward compatibility with existing 
- configuration       files.<br>
+  configuration       files.<br>
-                   <br>
+                     <br>
-                   Examples of valid DNS names:<br>
+                     Examples of valid DNS names:<br>
-                   </p>
+                     </p>
       
 <ul>
-                    <li>mail.shorewall.net</li>
+                      <li>mail.shorewall.net</li>
-                    <li>shorewall.net. (note the trailing period).</li>
+                      <li>shorewall.net. (note the trailing period).</li>
       
 </ul>
-                   Examples of invalid DNS names:<br>
+                     Examples of invalid DNS names:<br>
       
 <ul>
-                    <li>mail (not fully qualified)</li>
+                      <li>mail (not fully qualified)</li>
-                    <li>shorewall.net (only one period)</li>
+                      <li>shorewall.net (only one period)</li>
       
 </ul>
-                   DNS names may not be used as:<br>
+                     DNS names may not be used as:<br>
       
 <ul>
-                    <li>The server address in a DNAT rule (/etc/shorewall/rules 
+                      <li>The server address in a DNAT rule (/etc/shorewall/rules 
-   file)</li>
+    file)</li>
-                    <li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
+                      <li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
-                    <li>In the /etc/shorewall/nat file.</li>
+                      <li>In the /etc/shorewall/nat file.</li>
       
 </ul>
-                   These restrictions are not imposed by Shorewall simply 
+                     These restrictions are not imposed by Shorewall simply 
-for   your inconvenience but are rather limitations of iptables.<br>
+ for   your inconvenience but are rather limitations of iptables.<br>
       
 <h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
       
 <p>Where specifying an IP address, a subnet or an interface, you can   precede
-the item with "!" to specify the complement of the item. For      example,
+ the item with "!" to specify the complement of the item. For      example,
-!192.168.1.4 means "any host but 192.168.1.4". There must be no white space
+ !192.168.1.4 means "any host but 192.168.1.4". There must be no white space
-following the "!".</p>
+ following the "!".</p>
       
 <h2><a name="Lists"></a>Comma-separated Lists</h2>
       
@@ -267,33 +270,34 @@ following the "!".</p>
      configuration files. A comma separated list:</p>
       
 <ul>
-                           <li>Must not have any embedded white space.<br>
+                             <li>Must not have any embedded white space.<br>
-                           Valid: routefilter,dhcp,norfc1918<br>
+                             Valid: routefilter,dhcp,norfc1918<br>
-                           Invalid: routefilter,     dhcp,              norfc1818</li>
+                             Invalid: routefilter,     dhcp,            
-                           <li>If you use line continuation to break a comma-separated 
+ norfc1818</li>
-      list,   the          continuation line(s) must begin in column 1 (or 
+                             <li>If you use line continuation to break a
- there     would  be embedded          white space)</li>
+comma-separated        list,   the          continuation line(s) must begin
-                           <li>Entries in a comma-separated list may appear 
+in column 1 (or   there     would  be embedded          white space)</li>
- in  any   order.</li>
+                             <li>Entries in a comma-separated list may appear 
+  in  any   order.</li>
       
 </ul>
       
 <h2><a name="Ports"></a>Port Numbers/Service Names</h2>
       
 <p>Unless otherwise specified, when giving a port number you can use   either
-an integer or a service name from /etc/services. </p>
+ an integer or a service name from /etc/services. </p>
       
 <h2><a name="Ranges"></a>Port Ranges</h2>
       
 <p>If you need to specify a range of ports, the proper syntax is &lt;<i>low 
-               port number</i>&gt;:&lt;<i>high port number</i>&gt;. For example, 
+                port number</i>&gt;:&lt;<i>high port number</i>&gt;. For example,
-       if you want to forward the range of tcp ports 4000 through 4100 to 
+        if you want to forward the range of tcp ports 4000 through 4100 to
-local      host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
+ local      host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
-                </p>
+                  </p>
       
 <pre>     DNAT	net	loc:192.168.1.3	tcp	4000:4100<br></pre>
-   If you omit the low port number, a value of zero is assumed; if you omit 
+     If you omit the low port number, a value of zero is assumed; if you
- the high port number, a value of 65535 is assumed.<br>
+omit   the high port number, a value of 65535 is assumed.<br>
       
 <h2><a name="Variables"></a>Using Shell Variables</h2>
       
@@ -302,106 +306,104 @@ that you can then use in some of the other    configuration files.</p>
       
 <p>It is suggested that variable names begin with an upper case letter<font
  size="1">      </font>to distinguish them from variables used internally 
-        within the  Shorewall    programs</p>
+         within the  Shorewall    programs</p>
       
 <p>Example:</p>
       
 <blockquote>          
   <pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=routefilter,norfc1918</pre>
-                        </blockquote>
+                          </blockquote>
       
 <p><br>
-                        Example (/etc/shorewall/interfaces record):</p>
+                          Example (/etc/shorewall/interfaces record):</p>
-                                             <font
+                                               <font
  face="Century Gothic, Arial, Helvetica">    
 <blockquote>          
   <pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
-                        </blockquote>
+                          </blockquote>
-                                                          </font>  
+                                                            </font>    
 <p>The result will be the same as if the record had been written</p>
-                                                 <font
+                                                   <font
  face="Century Gothic, Arial, Helvetica">    
 <blockquote>          
   <pre>net eth0 130.252.100.255 routefilter,norfc1918</pre>
-                        </blockquote>
+                          </blockquote>
-                                                              </font>   
+                                                                </font> 
+   
 <p>Variables may be used anywhere in the              other configuration 
-        files.</p>
+         files.</p>
       
 <h2><a name="MAC"></a>Using MAC Addresses</h2>
       
 <p>Media Access Control (MAC)        addresses can be used to specify packet 
-        source in several of the        configuration files. To use this
+         source in several of the        configuration files. To use this
-feature,         your kernel must have MAC        Address Match support (CONFIG_IP_NF_MATCH_MAC) 
+ feature,         your kernel must have MAC        Address Match support
-        included.</p>
+(CONFIG_IP_NF_MATCH_MAC)          included.</p>
       
 <p>MAC addresses are 48 bits wide and each Ethernet Controller has a   unique
-MAC address.<br>
+ MAC address.<br>
-                         <br>
+                           <br>
-                         In GNU/Linux, MAC addresses are usually written
+                           In GNU/Linux, MAC addresses are usually written
-as  a  series    of  6  hex numbers        separated by colons. Example:<br>
+ as  a  series    of  6  hex numbers        separated by colons. Example:<br>
-                         <br>
+                           <br>
-                        [root@gateway root]# ifconfig eth0<br>
+                          [root@gateway root]# ifconfig eth0<br>
-                        eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
+                          eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
-                        inet addr:206.124.146.176 Bcast:206.124.146.255 
+                          inet addr:206.124.146.176 Bcast:206.124.146.255 
-    Mask:255.255.255.0<br>
+     Mask:255.255.255.0<br>
-                        UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
+                          UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
-                        RX packets:2398102 errors:0 dropped:0 overruns:0 
+                          RX packets:2398102 errors:0 dropped:0 overruns:0 
-     frame:0<br>
+      frame:0<br>
-                        TX packets:3044698 errors:0 dropped:0 overruns:0 
+                          TX packets:3044698 errors:0 dropped:0 overruns:0 
-     carrier:0<br>
+      carrier:0<br>
-                        collisions:30394 txqueuelen:100<br>
+                          collisions:30394 txqueuelen:100<br>
-                        RX bytes:419871805 (400.4 Mb) TX bytes:1659782221 
+                          RX bytes:419871805 (400.4 Mb) TX bytes:1659782221 
-       (1582.8     Mb)<br>
+        (1582.8     Mb)<br>
-                        Interrupt:11 Base address:0x1800<br>
+                          Interrupt:11 Base address:0x1800<br>
-                         <br>
+                           <br>
-                         Because Shorewall uses colons as a separator for 
+                           Because Shorewall uses colons as a separator for 
-address     fields,     Shorewall requires        MAC addresses to be written 
+ address     fields,     Shorewall requires        MAC addresses to be written 
-in another     way. In   Shorewall, MAC addresses        begin with a tilde 
+ in another     way. In   Shorewall, MAC addresses        begin with a tilde 
-("~") and  consist   of 6  hex numbers separated by        hyphens. In Shorewall, 
+ ("~") and  consist   of 6  hex numbers separated by        hyphens. In Shorewall, 
-the  MAC address    in  the example above would be        written "~02-00-08-E3-FA-55".<br>
+ the  MAC address    in  the example above would be        written "~02-00-08-E3-FA-55".<br>
-              </p>
+                </p>
       
 <p><b>Note: </b>It is not necessary to use the special Shorewall notation 
-      in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
+       in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
-              </p>
+                </p>
       
 <h2><a name="Levels"></a>Shorewall Configurations</h2>
       
 <p>  Shorewall allows you to have configuration  directories other than /etc/shorewall. 
-        The <a href="starting_and_stopping_shorewall.htm">shorewall start 
+         The <a href="starting_and_stopping_shorewall.htm">shorewall check, 
-and    restart</a>       commands allow you to specify an alternate configuration 
+start  and    restart</a>       commands allow you to specify an alternate 
-    directory and    Shorewall will use the files in the alternate directory 
+configuration      directory and    Shorewall will use the files in the alternate 
-   rather than the  corresponding  files in /etc/shorewall. The alternate 
+directory     rather than the  corresponding  files in /etc/shorewall. The 
-directory    need not contain a complete  configuration; those files not
+alternate  directory    need not contain a complete  configuration; those 
-in the alternate    directory  will be read from  /etc/shorewall.</p>
+files not in the alternate    directory  will be read from  /etc/shorewall.</p>
       
 <p>  This facility permits you to easily create a test or temporary configuration 
-         by:</p>
+          by:</p>
       
 <ol>
-                           <li>  copying the files that need modification 
+                             <li>  copying the files that need modification 
-from   /etc/shorewall       to a separate      directory;</li>
+ from   /etc/shorewall       to a separate      directory;</li>
-                           <li>  modify those files in the separate directory; 
+                             <li>  modify those files in the separate directory; 
-  and</li>
+   and</li>
-                           <li>  specifying the separate directory in a shorewall 
+                             <li>  specifying the separate directory in a 
-    start    or  shorewall     restart command (e.g., <i><b>shorewall -c /etc/testconfig
+shorewall      start    or  shorewall     restart command (e.g., <i><b>shorewall 
-       restart</b></i>  )</li>
+-c /etc/testconfig        restart</b></i>  )</li>
       
 </ol>
+ The <a href="starting_and_stopping_shorewall.htm"><b>try</b> command</a> 
+allows you to attempt to restart using an alternate configuration and if an
+error occurs to automatically restart the standard configuration.<br>
          
-<p><font size="2">   Updated 4/18/2003 - <a href="support.htm">Tom  Eastep</a> 
+<p><font size="2">   Updated 6/29/2003 - <a href="support.htm">Tom  Eastep</a> 
-            </font></p>
+             </font></p>
         
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
-           © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
+            © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
-       </p>
+ </p>
-       <br>
-      <br>
-     <br>
-    <br>
-   <br>
-  <br>
  <br>
 </body>
 </html>

STABLE/documentation/copyright.htm

@@ -16,20 +16,20 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-   <tbody>
+    <tbody>
-    <tr>
+     <tr>
-     <td width="100%">
+      <td width="100%">       
       <h1 align="center"><font color="#ffffff">Copyright</font></h1>
-     </td>
+      </td>
-   </tr>
+    </tr>
     
   </tbody> 
 </table>
   
 <p align="left">Copyright <font face="Trebuchet MS">©</font>  2000, 2001, 
 2003  Thomas M Eastep<br>
-  </p>
+   </p>
   
 <blockquote>   
   <p align="left">Permission is granted to copy, distribute and/or modify 
@@ -38,8 +38,9 @@ this    document under the terms of the GNU Free Documentation License, Version
 no Invariant    Sections, with no Front-Cover, and with no Back-Cover Texts. 
 A copy of the    license is included in the section entitled "<a
  href="GnuCopyright.htm">GNU Free Documentation License</a>".<br>
-  </p>
+   </p>
- </blockquote>
+  </blockquote>
-  <br>
+   <br>
+ <br>
 </body>
 </html>

STABLE/documentation/dhcp.htm

@@ -16,13 +16,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-   <tbody>
+    <tbody>
-    <tr>
+     <tr>
-     <td width="100%">
+      <td width="100%">       
       <h1 align="center"><font color="#ffffff">DHCP</font></h1>
-     </td>
+      </td>
-   </tr>
+    </tr>
     
   </tbody> 
 </table>
@@ -30,46 +30,48 @@
 <h2 align="left">If you want to Run a DHCP Server on your firewall</h2>
   
 <ul>
+    <li>     
+    <p align="left">Specify the "dhcp" option on each interface to be  served
+by your server in the <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a> 
+    file. This will generate rules that will allow DHCP to and from your firewall
+system.   </p>
+   </li>
    <li>     
-    <p align="left">Specify the "dhcp" option on each interface to be
- served by your server in the <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>
-    file. This will generate rules that will allow DHCP to and from your
-firewall system.   </p>
-  </li>
-  <li>
     <p align="left">When starting "dhcpd", you need to list those     interfaces 
 on the run line. On a RedHat system, this is done by modifying     /etc/sysconfig/dhcpd. 
     </p>
-  </li>
+   </li>
+ 
 </ul>
   
 <h2 align="left">If a Firewall Interface gets its IP Address via DHCP</h2>
   
 <ul>
-   <li>
+    <li>     
     <p align="left">Specify the "dhcp" option for this interface in     the 
     <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a> 
-   file. This will generate rules that will allow DHCP to and from your firewall
+  file. This will generate rules that will allow DHCP to and from your firewall 
 system.      </p>
-  </li>
+   </li>
-  <li>
+   <li>     
-    <p align="left">If you know that the dynamic address is always going
+    <p align="left">If you know that the dynamic address is always going to
-to be     in the same subnet, you can specify the subnet address in the interface's
+be     in the same subnet, you can specify the subnet address in the interface's 
     entry in the <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a> 
     file.   </p>
-  </li>
+   </li>
-  <li>
+   <li>     
-    <p align="left">If you don't know the subnet address in advance, you
+    <p align="left">If you don't know the subnet address in advance, you should
-should     specify "detect" for the interface's subnet address in the <a
+    specify "detect" for the interface's subnet address in the <a
  href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>     file 
 and start Shorewall after the interface has started.   </p>
-  </li>
+   </li>
-  <li>
+   <li>     
     <p align="left">In the event that the subnet address might change while 
     Shorewall is started, you need to arrange for a "shorewall     refresh" 
 command to be executed when a new dynamic IP address gets     assigned to 
 the interface. Check your DHCP client's documentation. </p>
-  </li>
+   </li>
+ 
 </ul>
   
 <p align="left"><font size="2">Last updated 11/03/2002 - <a
@@ -77,6 +79,7 @@ the interface. Check your DHCP client's documentation. </p>
   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
  © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
-  <br>
+   <br>
+ <br>
 </body>
 </html>

STABLE/documentation/download.htm

@@ -16,14 +16,14 @@
                 
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-                         <tbody>
+                             <tbody>
-                          <tr>
+                              <tr>
-                           <td width="100%">                            
+                               <td width="100%">                        
                                  
       <h1 align="center"><font color="#ffffff">Shorewall Download</font></h1>
-                           </td>
+                               </td>
-                         </tr>
+                             </tr>
                                 
   </tbody>        
 </table>
@@ -31,15 +31,16 @@
 <p><b>I strongly urge you to read and print a copy of the       <a
  href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>    
 for the configuration that most closely matches your own.<br>
-             </b></p>
+                 </b></p>
                 
 <p>The entire set of Shorewall documentation is available in PDF format at:</p>
                 
 <p>    <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
-                 <a
+                     <a
  href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
-                <a href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
+                    <a
-      </p>
+ href="rsync://slovakia.shorewall.net/shorewall/pdf/">rsync://slovakia.shorewall.net/shorewall/pdf/</a>
+        </p>
                 
 <p>The documentation in HTML format is included   in the .rpm and in the
 .tgz packages below.</p>
@@ -48,48 +49,49 @@ for the configuration that most closely matches your own.<br>
  one</u> of the modules:</p>
                 
 <ul>
-                         <li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
+                             <li>If you run a <b>RedHat</b>, <b>SuSE, Mandrake</b>,
-       <b>               Linux PPC</b> or     <b> TurboLinux</b> distribution
+         <b>               Linux PPC</b> or     <b> TurboLinux</b> distribution
-       with   a  2.4   kernel,   you can use the  RPM version (note: the
+         with   a  2.4   kernel,   you can use the  RPM version (note: the
-         RPM   should   also work  with other distributions that     store 
+          RPM   should   also work  with other distributions that     store 
- init  scripts in  /etc/init.d  and that             include chkconfig  or 
+   init  scripts in  /etc/init.d  and that             include chkconfig 
- insserv).  If you find  that it works   in other cases, let <a
+or   insserv).  If you find  that it works   in other cases, let <a
  href="mailto:teastep@shorewall.net">     me</a>                know so that
-        I can mention them here. See the   <a href="Install.htm">Installation
+          I can mention them here. See the   <a href="Install.htm">Installation
-    Instructions</a>    if you have problems    installing the RPM.</li>
+      Instructions</a>    if you have problems    installing the RPM.</li>
-                         <li>If you are running LRP, download the .lrp file 
+                             <li>If you are running LRP, download the .lrp
- (you   might    also   want  to     download the .tgz so you will have a 
+ file   (you   might    also   want  to     download the .tgz so you will
-copy of   the documentation).</li>
+have a  copy of   the documentation).</li>
-                         <li>If you run <a href="http://www.debian.org"><b>Debian</b></a>
+                             <li>If you run <a
-        and   would      like a .deb package, Shorewall is included in both
+ href="http://www.debian.org"><b>Debian</b></a>          and   would    
-  the     <a
+ like a .deb package, Shorewall is included in both    the     <a
  href="http://packages.debian.org/testing/net/shorewall.html">Debian    
      Testing Branch</a> and the    <a
  href="http://packages.debian.org/unstable/net/shorewall.html">Debian  Unstable 
- Branch</a>.</li>
+   Branch</a>.</li>
-                         <li>Otherwise, download the <i>shorewall</i>   
+                             <li>Otherwise, download the <i>shorewall</i> 
-  module    (.tgz)</li>
+     module    (.tgz)</li>
                 
 </ul>
                 
 <p>The documentation in HTML format is included in the .tgz and .rpm files
-           and  there is an documentation .deb that also contains the documentation.  The
+             and  there is an documentation .deb that also contains the documentation.  The
-   .rpm will install the documentation in your default document directory
+     .rpm will install the documentation in your default document directory
-which   can be obtained using the following command:<br>
+  which   can be obtained using the following command:<br>
-          </p>
+              </p>
                 
 <blockquote>                        
   <p><font color="#009900"><b>rpm --eval '%{defaultdocdir}'</b></font></p>
-       </blockquote>
+           </blockquote>
                 
 <p>Please check the        <font color="#ff0000"> <a href="errata.htm"> errata</a></font>
-           to see    if there are updates that apply to the version     
+             to see    if there are updates that apply to the version   
-  that you have    downloaded.</p>
+    that you have    downloaded.</p>
                 
 <p><font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u> SIMPLY        INSTALL
-    THE RPM  AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION  
+      THE RPM  AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
- IS REQUIRED BEFORE THE  FIREWALL WILL START. Once you have completed  configuration 
+   IS REQUIRED BEFORE THE  FIREWALL WILL START. Once you have completed 
-     of your firewall, you can enable startup by removing the   file /etc/shorewall/startup_disabled.</b></font></p>
+configuration        of your firewall, you can enable startup by removing
+the   file /etc/shorewall/startup_disabled.</b></font></p>
                 
 <p><b></b></p>
                 
@@ -97,95 +99,133 @@ which   can be obtained using the following command:<br>
                 
 <blockquote>                        
   <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                           <tbody>
+                               <tbody>
-                            <tr>
+                                <tr>
-                             <td><b>SERVER LOCATION</b></td>
+                                 <td><b>SERVER LOCATION</b></td>
-                             <td><b>DOMAIN</b></td>
+                                 <td><b>DOMAIN</b></td>
-                             <td><b>HTTP</b></td>
+                                 <td><b>HTTP</b></td>
-                             <td><b>FTP</b></td>
+                                 <td><b>FTP</b></td>
-                           </tr>
+                               </tr>
-                            <tr>
+                                <tr>
-                             <td>SourceForge<br>
+                                 <td>SourceForge<br>
-                        </td>
+                            </td>
-                             <td>sf.net</td>
+                                 <td>sf.net</td>
-                             <td><a
+                                 <td><a
  href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
-                             <td>N/A</td>
+                                 <td>N/A</td>
-                            </tr>
+                                </tr>
-                           <tr>
+                               <tr>
-                             <td>Slovak Republic</td>
+                                 <td>Slovak Republic</td>
-                             <td>Shorewall.net</td>
+                                 <td>Shorewall.net</td>
-                             <td><a
+                                 <td><a
  href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></td>
-                             <td>       <a target="_blank"
+                                 <td>       <a target="_blank"
  href="ftp://slovakia.shorewall.net/mirror/shorewall/">Browse</a></td>
-                           </tr>
+                               </tr>
-                           <tr>
+                               <tr>
-                             <td>Texas, USA</td>
+                                 <td>Texas, USA</td>
-                             <td>Infohiiway.com</td>
+                                 <td>Infohiiway.com</td>
-                             <td><a
+                                 <td><a
  href="http://shorewall.infohiiway.com/pub/shorewall">Browse</a></td>
-                             <td><a target="_blank"
+                                 <td><a target="_blank"
  href="ftp://ftp.infohiiway.com/pub/shorewall/">Browse</a></td>
-                           </tr>
+                               </tr>
-                           <tr>
+                               <tr>
-                             <td>Hamburg, Germany</td>
+                                 <td>Hamburg, Germany</td>
-                             <td>Shorewall.net</td>
+                                 <td>Shorewall.net</td>
-                             <td><a
+                                 <td><a
  href="http://germany.shorewall.net/pub/shorewall/">Browse</a></td>
-                             <td><a target="_blank"
+                                 <td><a target="_blank"
  href="ftp://germany.shorewall.net/pub/shorewall">Browse</a></td>
-                           </tr>
+                               </tr>
-                                                      <tr>
+                                                          <tr>
-                             <td>France</td>
+                                 <td>France</td>
-                             <td>Shorewall.net</td>
+                                 <td>Shorewall.net</td>
-                             <td><a
+                                 <td><a
  href="http://france.shorewall.net/pub/shorewall/LATEST.lrp">Browse</a></td>
-                             <td>       <a target="_blank"
+                                 <td>       <a target="_blank"
  href="ftp://france.shorewall.net/pub/mirrors/shorewall/">Browse</a></td>
-                           </tr>
+                               </tr>
-                            <tr>
+                                <tr>
-         <td valign="top">Taiwan<br>
+             <td valign="top">Taiwan<br>
-         </td>
+             </td>
-         <td valign="top">Greshko.com<br>
+             <td valign="top">Greshko.com<br>
-         </td>
+             </td>
-         <td valign="top"><a
+             <td valign="top"><a
  href="http://shorewall.greshko.com/pub/shorewall/">Browse<br>
-         </a></td>
+             </a></td>
-         <td valign="top"><a
+             <td valign="top"><a
  href="ftp://shorewall.greshko.com/pub/shorewall/" target="_top">Browse</a><br>
+             </td>
+           </tr>
+           <tr>
+          <td valign="top">Argentina<br>
+          </td>
+          <td valign="top">Shorewall.net<br>
+          </td>
+          <td valign="top"><a
+ href="http://argentina.shorewall.net/pub/shorewall/shorewall">Browse</a><br>
+          </td>
+          <td valign="top">N/A<br>
+          </td>
+        </tr>
+        <tr>
+         <td valign="top">Brazil<br>
+         </td>
+         <td valign="top">securityopensource.org.br<br>
+         </td>
+         <td valign="top"><a
+ href="http://shorewall.securityopensource.org.br/pub/shorewall/">Browse</a><br>
+         </td>
+         <td valign="top">N/A<br>
          </td>
        </tr>
        <tr>
-                             <td>Washington State, USA</td>
+                                 <td>Washington State, USA</td>
-                             <td>Shorewall.net</td>
+                                 <td>Shorewall.net</td>
-                             <td><a
+                                 <td><a
  href="http://www.shorewall.net/pub/shorewall/">Browse</a></td>
-                             <td><a
+                                 <td><a
  href="ftp://ftp.shorewall.net/pub/shorewall/" target="_blank">Browse</a></td>
-                            </tr>
+                                </tr>
                                                  
     </tbody>                        
   </table>
-                       </blockquote>
+                           </blockquote>
                 
 <p align="left"><b>CVS:</b></p>
                 
 <blockquote>                        
   <p align="left">The <a target="_top"
  href="http://cvs.shorewall.net/Shorewall_CVS_Access.html">CVS  repository
-   at        cvs.shorewall.net</a> contains the latest snapshots of the each
+     at        cvs.shorewall.net</a> contains the latest snapshots of the
-    Shorewall        component. There's no guarantee that what you find there
+each      Shorewall        component. There's no guarantee that what you
-   will work at    all.<br>
+find there     will work at    all.<br>
-                 </p>
+     </p>
-               </blockquote>
+   </blockquote>
      
-<p align="left"><font size="2">Last Updated 3/24/2003 - <a
+<p align="left"><b>Shapshots:<br>
+   </b></p>
+     
+<blockquote>         
+  <p align="left">Periodic snapshots from CVS may be found at <a
+ href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots</a> 
+ (<a href="ftp://shorewall.net/pub/shorewall/Snapshots/" target="_top">FTP</a>). 
+ These snapshots have undergone initial testing and will have been installed 
+ and run at shorewall.net.<br>
+                     </p>
+   </blockquote>
+                                
+<p align="left"><font size="2">Last Updated 7/15/2003 - <a
  href="support.htm">Tom Eastep</a></font></p>
                 
 <p><a href="copyright.htm"><font size="2">Copyright</font>         © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-    </p>
+        </p>
+        <br>
+       <br>
+      <br>
+     <br>
     <br>
    <br>
   <br>

STABLE/documentation/errata.htm

@@ -6,6 +6,7 @@
  content="text/html; charset=windows-1252">
   <title>Shorewall 1.4 Errata</title>
                                                                         
+      
   <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                                              
   <meta name="ProgId" content="FrontPage.Editor.Document">
@@ -18,14 +19,14 @@
                       
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                                   <tbody>
+                                    <tbody>
-                                   <tr>
+                                    <tr>
-                                     <td width="100%">                  
+                                      <td width="100%">                 
                                                              
       <h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
-                                     </td>
+                                      </td>
-                                   </tr>
+                                    </tr>
                                              
   </tbody>           
 </table>
@@ -33,67 +34,67 @@
 <p align="center">       <b><u>IMPORTANT</u></b></p>
                       
 <ol>
-                                   <li>                                 
+                                    <li>                                
                        
     <p align="left">          <b><u>I</u>f you use a Windows system to download 
                a corrected     script, be sure to run the script through 
-    <u>             <a
+   <u>             <a
  href="http://www.megaloman.com/%7Ehany/software/hd2u/"
  style="text-decoration: none;"> dos2unix</a></u>      after you have moved 
                it to your Linux system.</b></p>
-                                                </li>
+                                                 </li>
-                                   <li>                                 
+                                    <li>                                
                        
-    <p align="left">          <b>If you are installing Shorewall for the first
+    <p align="left">          <b>If you are installing Shorewall for the
-time and plan to use the        .tgz and install.sh script, you can untar
+first time and plan to use the        .tgz and install.sh script, you can
-the archive, replace the        'firewall' script in the untarred directory
+untar the archive, replace the        'firewall' script in the untarred directory 
                with the one you downloaded        below, and then run install.sh.</b></p>
-                                                </li>
+                                                 </li>
-                                   <li>                                 
+                                    <li>                                
                        
     <p align="left">          <b>When the instructions say to install a corrected 
              firewall   script in        /usr/share/shorewall/firewall, you 
   may    rename the existing file before copying in the new file.</b></p>
-                           </li>
+                            </li>
-                           <li>                                         
+                            <li>                                        
                
     <p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS 
-            ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER
+            ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
-BELOW.       For    example,  do NOT install the 1.3.9a firewall script if
+      For    example,  do NOT install the 1.3.9a firewall script if you are
-you are   running     1.3.7c.</font></b><br>
+  running     1.3.7c.</font></b><br>
-                                       </p>
+                                        </p>
-                           </li>
+                            </li>
                       
 </ol>
                       
 <ul>
-                                   <li><b><a href="upgrade_issues.htm">Upgrade
+                                    <li><b><a href="upgrade_issues.htm">Upgrade 
    Issues</a></b></li>
-              <li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
+               <li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
-              </li>
+               </li>
-                                   <li>                            <b><a
+                                    <li>                            <b><a
  href="errata_3.html">Problems      in  Version    1.3</a></b></li>
-                                   <li>                            <b><a
+                                    <li>                            <b><a
  href="errata_2.htm">Problems      in  Version 1.2</a></b></li>
-                                   <li>                            <b><font
+                                    <li>                            <b><font
  color="#660066">       <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
-                                   <li>                            <b><font
+                                    <li>                            <b><font
  color="#660066"><a href="#iptables">    Problem with iptables version 1.2.3 
          on RH7.2</a></font></b></li>
-                                   <li>                            <b><a
+                                    <li>                            <b><a
- href="#Debug">Problems      with   kernels  &gt;= 2.4.18 and            RedHat
+ href="#Debug">Problems      with   kernels  &gt;= 2.4.18 and           
-iptables</a></b></li>
+RedHat iptables</a></b></li>
-                                   <li><b><a href="#SuSE">Problems installing/upgrading
+                                    <li><b><a href="#SuSE">Problems installing/upgrading 
        RPM   on  SuSE</a></b></li>
-                                   <li><b><a href="#Multiport">Problems with
+                                    <li><b><a href="#Multiport">Problems
-  iptables     version     1.2.7    and       MULTIPORT=Yes</a></b></li>
+with   iptables     version     1.2.7    and       MULTIPORT=Yes</a></b></li>
-                             <li><b><a href="#NAT">Problems with RH Kernel
+                              <li><b><a href="#NAT">Problems with RH Kernel 
  2.4.18-10      and   NAT</a></b></li>
-   <li><b><a href="#REJECT">Problems with RH Kernels after 2.4.20-9 and REJECT 
+    <li><b><a href="#REJECT">Problems with RH Kernels after 2.4.20-9 and
-(also applies to 2.4.21-RC1) <img src="images/new10.gif" alt="(New)"
+REJECT  (also applies to 2.4.21-RC1) <img src="images/new10.gif"
- width="28" height="12" border="0">
+ alt="(New)" width="28" height="12" border="0">
-     </a><br>
+      </a><br>
-     </b></li>
+      </b></li>
                       
 </ul>
                       
@@ -105,112 +106,113 @@ iptables</a></b></li>
 <h3>1.4.4b</h3>
      
 <ul>
-    <li>Shorewall is ignoring records in /etc/shorewall/routestopped that 
+     <li>Shorewall is ignoring records in /etc/shorewall/routestopped that
-have an empty second column (HOSTS). This problem may be corrected by installing 
+ have an empty second column (HOSTS). This problem may be corrected by installing
-       <a
+        <a
  href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4b/firewall"
- target="_top">this firewall script</a> in /usr/share/shorewall/firewall as
+ target="_top">this firewall script</a> in /usr/share/shorewall/firewall
-described above.</li>
+as described above.</li>
-  <li>The INCLUDE directive doesn't work when placed in the /etc/shorewall/zones
+   <li>The INCLUDE directive doesn't work when placed in the /etc/shorewall/zones 
 file. This problem may be corrected by installing <a
  href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4b/functions"
  target="_top">this functions script</a> in /usr/share/shorewall/functions.<br>
-  </li>
+   </li>
      
 </ul>
      
 <h3>1.4.4-1.4.4a</h3>
        
 <ul>
-     <li>Log messages are being displayed on the system console even though 
+      <li>Log messages are being displayed on the system console even though
- the log level for the console is set properly according to <a
+  the log level for the console is set properly according to <a
  href="FAQ.htm#faq16">FAQ 16</a>. This problem may be corrected by installing
-       <a
+        <a
  href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4a/firewall"
- target="_top">this firewall script</a> in /usr/share/shorewall/firewall as
+ target="_top">this firewall script</a> in /usr/share/shorewall/firewall
-described above.<br>
+as described above.<br>
-     </li>
+      </li>
        
 </ul>
        
 <h3>1.4.4<br>
-     </h3>
+      </h3>
          
 <ul>
-      <li> If you have zone names that are 5 characters long, you may experience
+       <li> If you have zone names that are 5 characters long, you may experience 
-  problems starting Shorewall because the --log-prefix in a logging rule
+  problems starting Shorewall because the --log-prefix in a logging rule is
-is   too long. Upgrade to Version 1.4.4a to fix this problem..</li>
+  too long. Upgrade to Version 1.4.4a to fix this problem..</li>
          
 </ul>
          
 <h3>1.4.3</h3>
            
 <ul>
-       <li>The LOGMARKER variable introduced in version 1.4.3 was intended
+        <li>The LOGMARKER variable introduced in version 1.4.3 was intended 
  to  allow integration of Shorewall with Fireparse (http://www.firewparse.com).
-  Unfortunately, LOGMARKER only solved part of the integration problem. I 
+   Unfortunately, LOGMARKER only solved part of the integration problem.
-have  implimented a new LOGFORMAT variable which will replace LOGMARKER which 
+I  have  implimented a new LOGFORMAT variable which will replace LOGMARKER
-has  completely solved this problem and is currently in production with fireparse 
+which  has  completely solved this problem and is currently in production
-  here at shorewall.net. The updated files may be found at <a
+with fireparse    here at shorewall.net. The updated files may be found at
+    <a
  href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/"
  target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/</a>.
-  See the 0README.txt file for details.<br>
+   See the 0README.txt file for details.<br>
-       </li>
+        </li>
            
 </ul>
            
 <h3>1.4.2</h3>
                
 <ul>
-         <li>When an 'add' or 'delete' command is executed, a temporary directory 
+          <li>When an 'add' or 'delete' command is executed, a temporary
-   created in /tmp is not being removed. This problem may be corrected by 
+directory     created in /tmp is not being removed. This problem may be corrected
-installing       <a
+by  installing       <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall"
- target="_top">this firewall script</a> in /usr/share/shorewall/firewall as
+ target="_top">this firewall script</a> in /usr/share/shorewall/firewall
-described above. <br>
+as described above. <br>
-         </li>
+          </li>
                
 </ul>
                
 <h3>1.4.1a, 1.4.1 and 1.4.0</h3>
                  
 <ul>
-          <li>Some TCP requests are rejected in the 'common' chain with an
+           <li>Some TCP requests are rejected in the 'common' chain with
- ICMP   port-unreachable response rather than the more appropriate TCP RST
+an  ICMP   port-unreachable response rather than the more appropriate TCP
- response.   This problem is corrected in <a
+RST  response.   This problem is corrected in <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def"
  target="_top">this updated common.def file</a> which may be installed in 
    /etc/shorewall/common.def.<br>
-          </li>
+           </li>
                  
 </ul>
                  
 <h3>1.4.1</h3>
                    
 <ul>
-           <li>When a "shorewall check" command is executed, each "rule"
+            <li>When a "shorewall check" command is executed, each "rule" 
 produces     the harmless additional message:<br>
-             <br>
+              <br>
-              /usr/share/shorewall/firewall: line 2174: [: =: unary operator
+               /usr/share/shorewall/firewall: line 2174: [: =: unary operator 
   expected<br>
-             <br>
+              <br>
-         You may correct the problem by installing <a
+          You may correct the problem by installing <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
  target="_top">this corrected script</a> in /usr/share/shorewall/firewall
-    as described above.<br>
+     as described above.<br>
-           </li>
+            </li>
                    
 </ul>
                    
 <h3>1.4.0</h3>
                      
 <ul>
-            <li>When running under certain shells Shorewall will attempt
+             <li>When running under certain shells Shorewall will attempt 
 to  create    ECN rules even when /etc/shorewall/ecn is empty. You may either
- just remove    /etc/shorewall/ecn or you can install <a
+  just remove    /etc/shorewall/ecn or you can install <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this 
      correct script</a> in /usr/share/shorewall/firewall as described above.<br>
-            </li>
+             </li>
                      
 </ul>
                      
@@ -234,9 +236,9 @@ to  create    ECN rules even when /etc/shorewall/ecn is empty. You may either
                  corrected 1.2.3 rpm which you can download here</a>  and 
 I  have     also     built            an <a
  href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm"> 
- iptables-1.2.4   rpm which you can download here</a>. If  you are currently
+iptables-1.2.4   rpm which you can download here</a>. If  you are currently 
                running RedHat 7.1, you can install either of these RPMs  
-       <b><u>before</u>        </b>you upgrade to RedHat 7.2.</p>
+      <b><u>before</u>        </b>you upgrade to RedHat 7.2.</p>
                                              
   <p align="left"><font color="#ff6633"><b>Update   11/9/2001: </b></font>RedHat 
                has   released an iptables-1.2.4 RPM of their own which you 
@@ -256,14 +258,14 @@ I  have     also     built            an <a
   <p align="left">To install one of the above patches:</p>
                                              
   <ul>
-                                          <li>cd iptables-1.2.3/extensions</li>
+                                           <li>cd iptables-1.2.3/extensions</li>
-                                          <li>patch -p0 &lt; <i>the-patch-file</i></li>
+                                           <li>patch -p0 &lt; <i>the-patch-file</i></li>
                                              
   </ul>
-                                           </blockquote>
+                                            </blockquote>
                        
-<h3><a name="Debug"></a>Problems with kernels &gt;= 2.4.18               and
+<h3><a name="Debug"></a>Problems with kernels &gt;= 2.4.18              
-RedHat iptables</h3>
+and RedHat iptables</h3>
                       
 <blockquote>                                  
   <p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19 
@@ -271,82 +273,83 @@ RedHat iptables</h3>
                                              
   <blockquote>                                                        
     <pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br></pre>
-                                   </blockquote>
+                                    </blockquote>
                                              
   <p>The RedHat iptables RPM is compiled with debugging enabled but the 
- user-space debugging code was not updated to reflect recent changes in 
+  user-space debugging code was not updated to reflect recent changes in
-         the     Netfilter 'mangle' table. You can correct the problem by
+          the     Netfilter 'mangle' table. You can correct the problem by 
       installing            <a
  href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm"> 
                    this iptables RPM</a>. If you are already running a 1.2.5 
    version        of       iptables, you will need to specify the --oldpackage 
    option  to   rpm   (e.g.,        "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
-                                 </blockquote>
+                                  </blockquote>
                        
 <h3><a name="SuSE"></a>Problems                                installing/upgrading 
                RPM on SuSE</h3>
                        
 <p>If you find that rpm complains about a conflict         with kernel &lt;=
-    2.2 yet you have a 2.4 kernel               installed, simply use the 
+     2.2 yet you have a 2.4 kernel               installed, simply use the
-"--nodeps"    option to                    rpm.</p>
+ "--nodeps"    option to                    rpm.</p>
                        
 <p>Installing: rpm -ivh --nodeps <i>&lt;shorewall rpm&gt;</i></p>
                        
 <p>Upgrading: rpm -Uvh --nodeps <i>&lt;shorewall rpm&gt;</i></p>
                        
 <h3><a name="Multiport"></a><b>Problems with   iptables version 1.2.7 and
-    MULTIPORT=Yes</b></h3>
+     MULTIPORT=Yes</b></h3>
                        
 <p>The iptables 1.2.7 release of iptables has made         an incompatible
-    change to the syntax used to            specify multiport match rules; 
+     change to the syntax used to            specify multiport match rules;
- as   a consequence,                   if you install iptables 1.2.7 you must
+  as   a consequence,                   if you install iptables 1.2.7 you
-  be  running                           Shorewall 1.3.7a or later or:</p>
+must   be  running                           Shorewall 1.3.7a or later or:</p>
                        
 <ul>
-                                                                <li>set MULTIPORT=No
+                                                                 <li>set
-      in                                   /etc/shorewall/shorewall.conf;
+MULTIPORT=No       in                                   /etc/shorewall/shorewall.conf; 
 or     </li>
-                                                                <li>if you
+                                                                 <li>if you 
  are   running     Shorewall      1.3.6    you may                       
-           install                                    <a
+          install                                    <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">   
-                        this firewall script</a> in /var/lib/shorewall/firewall
+                         this firewall script</a> in /var/lib/shorewall/firewall 
                                                 as described above.</li>
                       
 </ul>
                       
 <h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
-                              </h3>
+                               </h3>
-                           /etc/shorewall/nat entries of the following form 
+                            /etc/shorewall/nat entries of the following form
- will   result    in  Shorewall     being unable to start:<br>
+  will   result    in  Shorewall     being unable to start:<br>
-                           <br>
+                            <br>
                       
 <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>192.0.2.22      eth0            192.168.9.22    yes                     yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-                           Error message is:<br>
+                            Error message is:<br>
                       
 <pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
-                           The solution is to put "no" in the LOCAL column. 
+                            The solution is to put "no" in the LOCAL column.
- Kernel    support     for   LOCAL=yes   has never worked properly and 2.4.18-10
+  Kernel    support     for   LOCAL=yes   has never worked properly and 2.4.18-10 
-  has    disabled  it.   The  2.4.19 kernel   contains corrected support
+  has    disabled  it.   The  2.4.19 kernel   contains corrected support under
-under   a  new  kernel configuraiton    option; see <a
+  a  new  kernel configuraiton    option; see <a
  href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
- <br>
+  <br>
    
-<h3><a name="REJECT"></a><b> Problems with RH Kernels after 2.4.20-9 and REJECT
+<h3><a name="REJECT"></a><b> Problems with RH Kernels after 2.4.20-9 and
-(also applies to 2.4.21-RC1)</b></h3>
+REJECT (also applies to 2.4.21-RC1)</b></h3>
- Beginning with errata kernel 2.4.20-13.9, "REJECT --reject-with tcp-reset" 
+  Beginning with errata kernel 2.4.20-13.9, "REJECT --reject-with tcp-reset"
-is broken. The symptom most commonly seen is that REJECT rules act just like 
+ is broken. The symptom most commonly seen is that REJECT rules act just
-DROP rules when dealing with TCP. A kernel patch and precompiled modules to
+like  DROP rules when dealing with TCP. A kernel patch and precompiled modules
-fix this problem are available at <a
+to fix this problem are available at <a
  href="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel"
  target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel</a>.<br>
                       
 <hr>                    
-<p><font size="2">  Last updated 6/13/2003 -   <a href="support.htm">Tom Eastep</a></font>
+<p><font size="2">  Last updated 6/13/2003 -   <a href="support.htm">Tom
-</p>
+Eastep</a></font> </p>
                       
 <p><a href="copyright.htm"><font size="2">Copyright</font>          © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-</p>
+ </p>
+ <br>
 </body>
 </html>

STABLE/documentation/errata_1.htm

@@ -1,215 +1,196 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-
 <head>
-<meta http-equiv="Content-Language" content="en-us">
+ 
-<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+  <meta http-equiv="Content-Language" content="en-us">
-<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ 
-<meta name="ProgId" content="FrontPage.Editor.Document">
+  <meta http-equiv="Content-Type"
-<title>Shorewall Errata for Version 1</title>
+ content="text/html; charset=windows-1252">
+ 
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ 
+  <meta name="ProgId" content="FrontPage.Editor.Document">
+  <title>Shorewall Errata for Version 1</title>
 </head>
+  <body>
   
-<body>
+<table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
+   <tbody>
+    <tr>
+     <td width="100%">     
+      <h1 align="center"><font color="#ffffff">Shorewall Errata for Version
+1.1</font></h1>
+     </td>
+   </tr>
  
-<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
+  </tbody>
-  <tr>
-    <td width="100%">
-    <h1 align="center"><font color="#FFFFFF">Shorewall Errata for Version 1.1</font></h1>
-    </td>
-  </tr>
 </table>
         
-      <h3 align="Left"><font color="#660066"><u>To those of you who downloaded the 1.1.13 updated firewall script prior
+<h3 align="left"><font color="#660066"><u>To those of you who downloaded
-to Sept 20, 2001:</u></font></h3>
+the 1.1.13 updated firewall script prior to Sept 20, 2001:</u></font></h3>
         
-      <blockquote>
+<blockquote>          
+  <p align="left">Prior to 20:00 20 Sept 2001 GMT, the link under 1.1.13
+pointed to   a broken version of the firewall script. This has now been corrected.
+I apologize for any confusion this may have caused.</p>
+    </blockquote>
             
-        <p align="Left">Prior
+<h3 align="left">Version 1.1.18</h3>
-to 20:00 20 Sept 2001 GMT, the link under 1.1.13 pointed to   a broken version
+   
-of the firewall script. This has now been corrected. I apologize for any confusion
+<blockquote>            
-this may have caused.</p>
+  <p align="left">In the original .lrp, /etc/init.d/shorewall was not   
+       secured for execute access. I have replaced the incorrect .lrp   
+       (shorwall-1.1.18.lrp) with a corrected one (shorwall-1.1.18a.lrp).</p>
    </blockquote>
             
-          <h3 align="Left">Version 1.1.18</h3>
+<h3 align="left"><font color="#660066">  Version 1.1.17</font></h3>
             
- <blockquote>
+<blockquote>              
+  <p align="left">In             shorewall.conf, ADD_IP_ALIASES was incorrectly
+spelled             IP_ADD_ALIASAES. There is a corrected version of the
+file <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.17/shorewall.conf">here.</a></p>
               
-          <p align="Left">In the original .lrp, /etc/init.d/shorewall was not
+  <p align="left">This             problem is also corrected in version 1.1.18.</p>
-          secured for execute access. I have replaced the incorrect .lrp
+      </blockquote>
-          (shorwall-1.1.18.lrp) with a corrected one (shorwall-1.1.18a.lrp).</p>
               
- </blockquote>
+<h3 align="left"><font color="#660066">  Version 1.1.16</font></h3>
               
-          <h3 align="Left"><font color="#660066">
+<blockquote>               
- Version 1.1.17</font></h3>
+  <p align="left">  The ADD_IP_ALIASES variable added in 1.1.16 was incorrectly
+  spelled IP_ADD_ALIASES in the firewall script. To correct this problem,
+  install the <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.16/firewall">  corrected
+  firewall script</a>   in the location pointed to by the symbolic link 
+ /etc/shorewall/firewall.</p>
                 
-          <blockquote>
+  <p align="left">  This problem is also corrected in version 1.1.17.</p>
+      </blockquote>
                 
-            <p align="Left">In
+<h3 align="left"><font color="#660066">  Version 1.1.14-1.1.15</font></h3>
-            shorewall.conf, ADD_IP_ALIASES was incorrectly spelled
-            IP_ADD_ALIASAES. There is a corrected version of the file <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.17/shorewall.conf">here.</a></p>
                 
-            <p align="Left">This
+<blockquote>                 
-            problem is also corrected in version 1.1.18.</p>
+  <p align="left">  There are no corrections for these versions.</p>
-     </blockquote>
+      </blockquote>
                   
-            <h3 align="Left"><font color="#660066">
+<h3 align="left"><font color="#660066">  Version 1.1.13</font></h3>
- Version 1.1.16</font></h3>
                   
-            <blockquote>
+<blockquote>                   
-              <p align="Left">
+  <p align="left">  The firewall fails to start if a rule with the following
- The ADD_IP_ALIASES variable added in 1.1.16 was incorrectly   spelled IP_ADD_ALIASES
+  format is given:</p>
-in the firewall script. To correct this problem,   install the <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.16/firewall">
- corrected   firewall script</a>
-  in the location pointed to by the symbolic link   /etc/shorewall/firewall.</p>
                     
-              <p align="Left">
+  <p align="left">  &lt;disposition&gt;      z1:www.xxx.yyy.zzz    z2   
- This problem is also corrected in version 1.1.17.</p>
+  proto    p1,p2,p3</p>
-     </blockquote>
                     
-              <h3 align="Left"><font color="#660066">
+  <p align="left">  To correct this problem, install <a
- Version 1.1.14-1.1.15</font></h3>
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.13/firewall">  this
+  corrected firewall script</a>   in the location pointed to by the symbolic
+link   /etc/shorewall/firewall. </p>
+      </blockquote>
                     
-              <blockquote>
+<h3 align="left"><font color="#660066">  Version 1.1.12</font></h3>
-                <p align="Left">
- There are no corrections for these versions.</p>
-     </blockquote>
                     
-                <h3 align="Left"><font color="#660066">
+<blockquote>                     
- Version 1.1.13</font></h3>
+  <p align="left">  The LRP version of Shorewall 1.1.12 has the incorrect
+  /etc/shorewall/functions file. This incorrect file results in many error
+  messages of the form:</p>
                       
-                <blockquote>
+  <blockquote>                       
-                  <p align="Left">
+    <p align="left">  separate_list: not found</p>
- The firewall fails to start if a rule with the following   format is given:</p>
+                     </blockquote>
                         
-                  <p align="Left">
+  <p align="left"><a
- &lt;disposition&gt;      z1:www.xxx.yyy.zzz    z2      proto    p1,p2,p3</p>
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.12/functions">  The
+  correct file may be obtained here</a>  . This problem is also corrected
+in version 1.1.13.</p>
+      </blockquote>
                         
-                  <p align="Left">
+<h3 align="left"><font color="#660066">  Version 1.1.11</font></h3>
- To correct this problem, install <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.13/firewall">
- this   corrected firewall script</a>
-  in the location pointed to by the symbolic link   /etc/shorewall/firewall. </p>
-     </blockquote>
                         
-                  <h3 align="Left"><font color="#660066">
+<blockquote>                         
- Version 1.1.12</font></h3>
+  <p align="left">  There are no known problems with this version.</p>
+      </blockquote>
                           
-                  <blockquote>
+<h3 align="left"><font color="#660066">  Version 1.1.10</font></h3>
-                    <p align="Left">
- The LRP version of Shorewall 1.1.12 has the incorrect   /etc/shorewall/functions
-file. This incorrect file results in many error   messages of the form:</p>
                           
-                    <blockquote>
+<blockquote>                           
-                      <p align="Left">
+  <p align="left">  If the following conditions were met:<br>
- separate_list: not found</p>
+                           </p>
-                    </blockquote>
                             
-                      <p align="Left"><a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.12/functions">
+  <ol>
- The   correct file may be obtained here</a>
+                              <li>                               
- . This problem is also corrected in version 1.1.13.</p>
+      <p align="left">  A LAN segment attached to the firewall was served
-     </blockquote>
+by a         DHCP server running on the firewall.</p>
+                              </li>
+                              <li>                               
+      <p align="left">  There were entries in /etc/shorewall/hosts that referred
+        to the interface to that LAN segment.</p>
+                              </li>
                             
-                      <h3 align="Left"><font color="#660066">
+  </ol>
- Version 1.1.11</font></h3>
                             
-                      <blockquote>
+  <p align="left">  then up until now it has been necessary to include entries
-                        <p align="Left">
+    for 0.0.0.0 and 255.255.255.255 for that interface in /etc/shorewall/hosts.
- There are no known problems with this version.</p>
+  <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.10/firewall"> 
-     </blockquote>
+ This     version of the firewall script</a>   makes those additions unnecessary
+    provided that you simply include "dhcp" in the options for the     interface
+in /etc/shorewall/interfaces. Install the script into     the location pointed
+to by the symbolic link /etc/shorewall/firewall.</p>
                             
-                        <h3 align="Left"><font color="#660066">
+  <p align="left">  This problem has also been corrected in version 1.1.11.</p>
- Version 1.1.10</font></h3>
+   </blockquote>
                             
-                        <blockquote>
+<h3 align="left"><font color="#660066">  Version 1.1.9</font></h3>
-                          <p align="Left">
- If the following conditions were met:<br>
-                          </p>
-
-                          <ol>
-
-                            <li>
-                              <p align="Left">
- A LAN segment attached to the firewall was served by a         DHCP server
-running on the firewall.</p>
-                             </li>
-
-                            <li>
-                              <p align="Left">
- There were entries in /etc/shorewall/hosts that referred         to the
-interface to that LAN segment.</p>
-                             </li>
-
-                          </ol>
-
-                          <p align="Left">
- then up until now it has been necessary to include entries     for 0.0.0.0
-and 255.255.255.255 for that interface in /etc/shorewall/hosts. <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.10/firewall">
- This     version of the firewall script</a>
-  makes those additions unnecessary     provided that you simply include
-"dhcp" in the options for the     interface in /etc/shorewall/interfaces.
-Install the script into     the location pointed to by the symbolic link
-/etc/shorewall/firewall.</p>
-
-                          <p align="Left">
- This problem has also been corrected in version 1.1.11.</p>
-  </blockquote>
-
-                          <h3 align="Left"><font color="#660066">
- Version 1.1.9</font></h3>
   
 <ul>
-  <li>The shorewall "hits" command lists extraneous     service names in the final
+   <li>The shorewall "hits" command lists extraneous     service names in
-report. <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.9/shorewall">
+the final report. <a
- This     version of the shorewall script</a>
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.9/shorewall">  This
-  corrects this problem.<br>
+    version of the shorewall script</a>   corrects this problem.<br>
+     </li>
  
-
-  </li>
 </ul>
                              
-
+<h3 align="left">Version 1.1.8</h3>
-                          <h3 align="Left">Version 1.1.8</h3>
   
 <ul>
-  <li>Under some circumstances, the "dhcp" option on an     interface triggers
+   <li>Under some circumstances, the "dhcp" option on an     interface triggers 
 a bug in the firewall script that results in a     "chain already exists" 
-error. <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.8/firewall">
+error. <a
- This     version of the firewall script</a>
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.1.8/firewall">  This
-   corrects this problem. Install it into     the location pointed to by
+    version of the firewall script</a>    corrects this problem. Install
-the symbolic link /etc/shorewall/firewall.<br>
+it into     the location pointed to by the symbolic link /etc/shorewall/firewall.<br>
-                                <br>
+                                 <br>
-      This problem is also corrected in version 1.1.9.<br>
+       This problem is also corrected in version 1.1.9.<br>
+     </li>
  
-
-  </li>
 </ul>
                              
-
+<h3 align="left">Version 1.1.7</h3>
-                          <h3 align="Left">Version 1.1.7</h3>
   
 <ul>
-  <li>If the /etc/shorewall/rules template from version 1.1.7 is     used, a warning
+   <li>If the /etc/shorewall/rules template from version 1.1.7 is     used,
-message appears during firewall startup:<br>
+a warning message appears during firewall startup:<br>
-                                <br>
+                                 <br>
-          Warning: Invalid Target - rule "@ icmp-unreachable     packet."
+           Warning: Invalid Target - rule "@ icmp-unreachable     packet." 
 ignored<br>
-                                <br>
+                                 <br>
-      This warning may be eliminated by replacing the "@" in column 1 of
+       This warning may be eliminated by replacing the "@" in column 1 of 
     line 17 with "#"</li>
+ 
 </ul>
                             
-                          <blockquote>
+<blockquote>                             
-                            <p align="Left">
+  <p align="left">  This problem is also corrected in version 1.1.8</p>
- This problem is also corrected in version 1.1.8</p>
+                              </blockquote>
-                             </blockquote>
   
-<p align="left"><font size="2">
+<p align="left"><font size="2">  Last updated 12/21/2001 - </font><font
- Last updated 12/21/2001 - </font><font size="2">
+ size="2">  <a href="support.htm">Tom Eastep</a></font> </p>
- <a href="support.htm">Tom Eastep</a></font>
-</p>
-
-<p align="left"><a href="copyright.htm">
-<font size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></p>
   
+<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
+© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></p>
+  <br>
 </body>
-
 </html>

STABLE/documentation/errata_2.htm

@@ -2,438 +2,424 @@
 <html>
 <head>
     
-  <meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+  <meta http-equiv="Content-Type"
+ content="text/html; charset=windows-1252">
   <title>Shorewall 1.2 Errata</title>
        
   <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
     
   <meta name="ProgId" content="FrontPage.Editor.Document">
+</head>
+  <body>
   
+<table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
+ id="AutoNumber1" height="90" bgcolor="#3366ff">
+    <tbody>
+    <tr>
+      <td width="100%">      
+      <h1 align="center"><font color="#ffffff">Shorewall 1.2 Errata</font></h1>
+      </td>
+    </tr>
   
-  </head>
+  </tbody>
- <body>
+</table>
- <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" height="90" bgcolor="#400169">
-   <tr>
-     <td width="100%">
-     <h1 align="center"><font color="#FFFFFF">Shorewall 1.2 Errata</font></h1>
-     </td>
-   </tr>
- </table>
    
- <p align="center">
+<p align="center">   <font face="Century Gothic, Arial, Helvetica">     
-  <font face="Century Gothic, Arial, Helvetica">
+  <b><u>IMPORTANT</u></b></font></p>
    
-      <b><u>IMPORTANT</u></b></font></p>
+<p align="center">        <b><u>If you use a Windows system to download a
+corrected     script, be sure to run the script through <a
+ href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>   
+  after you have moved it to your Linux system.</u></b></p>
    
- <p align="center">
+<p align="center">        <u><b>When the instructions say to install a corrected
+firewall script in       /etc/shorewall/firewall, use the 'cp' (or 'scp')
+utility to overwrite the       existing file. DO NOT REMOVE OR RENAME THE
+OLD /etc/shorewall/firewall       before you do that. /etc/shorewall/firewall
+is a symbolic link that points       to the 'shorewall' file used by your
+system initialization scripts to       start Shorewall during boot and it
+is that file that must be overwritten       with the corrected script. </b></u></p>
    
-      <b><u>If you use a Windows system to download a corrected     script, be sure to
+<ul>
-run the script through <a href="http://www.megaloman.com/%7Ehany/software/hd2u/">
+    <li>            
-dos2unix</a>
+    <h3 align="left"><font color="#660066">  <a href="errata_1.htm">  Problems
-     after you have moved it to your Linux system.</u></b></p>
+in Version 1.1</a></font></h3>
+     </li>
+    <li>            
+    <h3 align="left"><a href="#V1.2">Problems in Version 1.2</a></h3>
+     </li>
+    <li>            
+    <h3 align="left"><font color="#660066"><a href="#iptables">  Problem
+with iptables version 1.2.3</a></font></h3>
+     </li>
+    <li>            
+    <h3 align="left"><a href="#Debug">Problems with kernel 2.4.18 and   
+       RedHat iptables</a></h3>
+     </li>
   
- <p align="center">
+</ul>
   
-      <u><b>When the instructions say to install a corrected firewall script in
+<hr>            
-      /etc/shorewall/firewall, use the 'cp' (or 'scp') utility to overwrite the
+<h3 align="left"><a name="V1.2"></a>Problems in Version 1.2</h3>
-      existing file. DO NOT REMOVE OR RENAME THE OLD /etc/shorewall/firewall
-      before you do that. /etc/shorewall/firewall is a symbolic link that points
-      to the 'shorewall' file used by your system initialization scripts to
-      start Shorewall during boot and it is that file that must be overwritten
-      with the corrected script. </b></u></p>
             
- <ul>
+<h3 align="left">Version 1.2.13</h3>
-   <li>
             
-          <h3 align="Left"><font color="#660066">
+<ul>
- <a href="errata_1.htm">
+             <li>            
- Problems in Version 1.1</a></font></h3>
+    <p align="left">Some users have reported problems installing the RPM 
-
+         on SuSE 7.3 where rpm reports a conflict with kernel &lt;= 2.2 even 
-   </li>
+          though a 2.4 kernel RPM is installed. To get around this problem,
-   <li>
+use           the --nodeps option to rpm (e.g., "rpm -ivh --nodeps      
-
+    shorewall-1.2-13.noarch.rpm").<br>
-          <h3 align="Left"><a href="#V1.2">Problems in Version 1.2</a></h3>
+           <br>
-
+           The problem stems from the fact that SuSE does not           include
-   </li>
+a package named "kernel" but rather has a number of packages           that
-   <li>
+provide the virtual package "kernel". Since virtual packages have       
-
+   no version associated with them, a conflict results. Since the       
-          <h3 align="Left"><font color="#660066"><a href="#iptables">
+   workaround is simple, I don't intend to change the Shorewall package.</p>
- Problem with iptables version 1.2.3</a></font></h3>
+              </li>
-
+             <li>            
-   </li>
+    <p align="left">Shorewall accepts invalid rules of the form:<br>
-   <li>
+           <br>
-
+           <font face="Courier">ACCEPT &lt;src&gt; &lt;dest&gt;:&lt;ip addr&gt;
-          <h3 align="Left"><a href="#Debug">Problems with kernel 2.4.18 and
+all &lt;port number&gt; -           &lt;original ip address&gt;<br>
-          RedHat iptables</a></h3>
+           <br>
-
+           </font>The &lt;port number&gt; is ignored with the result that
-   </li>
+    <u>all</u>           connection requests from the &lt;src&gt; zone whose
- </ul>
+original destination IP           address matches the last column are forwarded
- <hr>
+to the &lt;dest&gt; zone, IP           address &lt;ip addr&gt;.         
-
+  <a
-          <h3 align="Left"><a name="V1.2"></a>Problems in Version 1.2</h3>
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.13/firewall">  
-
+        This corrected firewall script</a> correctly generates an error when 
-          <h3 align="Left">Version 1.2.13</h3>
-
-          <ul>
-            <li>
-
-          <p align="Left">Some users have reported problems installing the RPM
-          on SuSE 7.3 where rpm reports a conflict with kernel &lt;= 2.2 even
-          though a 2.4 kernel RPM is installed. To get around this problem, use
-          the --nodeps option to rpm (e.g., &quot;rpm -ivh --nodeps
-          shorewall-1.2-13.noarch.rpm&quot;).<br>
-          <br>
-          The problem stems from the fact that SuSE does not
-          include a package named &quot;kernel&quot; but rather has a number of packages
-          that provide the virtual package &quot;kernel&quot;. Since virtual packages have
-          no version associated with them, a conflict results. Since the
-          workaround is simple, I don't intend to change the Shorewall package.</p>
-
-            </li>
-            <li>
-
-          <p align="Left">Shorewall accepts invalid rules of the form:<br>
-          <br>
-          <font face="Courier">ACCEPT &lt;src&gt; &lt;dest&gt;:&lt;ip addr&gt; all &lt;port number&gt; -
-          &lt;original ip address&gt;<br>
-          <br>
-          </font>The &lt;port number&gt; is ignored with the result that <u>all</u>
-          connection requests from the &lt;src&gt; zone whose original destination IP
-          address matches the last column are forwarded to the &lt;dest&gt; zone, IP
-          address &lt;ip addr&gt;.&nbsp;
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.13/firewall">
-          This corrected firewall script</a> correctly generates an error when
           such a rule is encountered.</p>
+              </li>
   
-            </li>
+</ul>
- </ul>
             
-          <h3 align="Left">Version 1.2.11</h3>
+<h3 align="left">Version 1.2.11</h3>
             
-          <ul>
+<ul>
-            <li>
+             <li>            
+    <p align="left">The 'try' command is broken.             </p>
+  </li>
+  <li>            
+    <p align="left">The usage text printed by the shorewall utility     
+     doesn't show the optional timeout for the 'try' command.  </p>
+  </li>
+</ul>
             
-          <p align="Left">The 'try' command is broken.</li>
+<p align="left">Both problems are corrected by           <a
-            <li>
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.11/shorewall"> 
+         this new version of /sbin/shorewall</a>.</p>
             
-          <p align="Left">The usage text printed by the shorewall utility
+<h3 align="left">Sample Configurations:</h3>
-          doesn't show the optional timeout for the 'try' command.</li>
- </ul>
             
-          <p align="Left">Both problems are corrected by
+<ul>
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.11/shorewall">
+             <li>            
-          this new version of /sbin/shorewall</a>.</p>
+    <p align="left">There have been several problems with SSH, DNS and  
+        ping in the two- and three-interface examples. Before reporting 
+         problems with these services, please verify that you have the latest 
+          version of the appropriate sample 'rules' file.  </p>
+  </li>
+</ul>
             
-          <h3 align="Left">Sample Configurations:</h3>
+<h3 align="left">All Versions through 1.2.10</h3>
             
-          <ul>
+<ul>
-            <li>
+             <li>            
+    <p align="left">The <a href="PPTP.htm#ServerFW">documentation for   
+       running PoPToP on the firewall system</a> contained an incorrect entry 
+          in the /etc/shorewall/hosts file. The corrected entry (underlined)
+is           shown here:  </p>
+  </li>
+</ul>
   
-          <p align="Left">There have been several problems with SSH, DNS and
+<blockquote>    
-          ping in the two- and three-interface examples. Before reporting
+  <blockquote>      
-          problems with these services, please verify that you have the latest
+    <table border="2">
-          version of the appropriate sample 'rules' file.</li>
+     <tbody>
- </ul>
+        <tr>
+       <td><b>ZONE</b></td>
+       <td><b>HOST(S)</b></td>
+       <td><b>OPTIONS</b></td>
+     </tr>
+     <tr>
+       <td>loc</td>
+       <td><u>eth2</u>:192.168.1.0/24</td>
+       <td>routestopped</td>
+     </tr>
+     <tr>
+       <td>loc</td>
+       <td>ppp+:192.168.1.0/24</td>
+       <td> </td>
+     </tr>
    
-          <h3 align="Left">All Versions through 1.2.10</h3>
+      </tbody>
+    </table>
+    </blockquote>
+  </blockquote>
             
-          <ul>
+<h3 align="left">All Versions through 1.2.8</h3>
-            <li>
             
-          <p align="Left">The <a href="PPTP.htm#ServerFW">documentation for
+<ul>
-          running PoPToP on the firewall system</a> contained an incorrect entry
+             <li>            
-          in the /etc/shorewall/hosts file. The corrected entry (underlined) is
+    <p align="left">The shorewall.conf file and the documentation       
-          shown here:</li>
+   incorrectly refer to a parameter in /etc/shorewall/shorewall.conf    
- </ul>
+      called LOCKFILE; the correct name for the parameter is SUBSYSLOCK (<a
- <blockquote>
+ href="Documentation.htm#Conf">see           the corrected online documentation</a>).
-   <blockquote>
+Users of the rpm should           change the name (and possibly the value)
-     <table border="2">
+of this parameter so that           Shorewall interacts properly with the
-    <tr>
+SysV init scripts. The           documentation on this web site has been
-      <td><b>ZONE</b></td>
+corrected and           <a
-      <td><b>HOST(S)</b></td>
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.8/shorewall.conf"> 
-      <td><b>OPTIONS</b></td>
-    </tr>
-    <tr>
-      <td>loc</td>
-      <td><u>eth2</u>:192.168.1.0/24</td>
-      <td>routestopped</td>
-    </tr>
-    <tr>
-      <td>loc</td>
-      <td>ppp+:192.168.1.0/24</td>
-      <td>&nbsp;</td>
-    </tr>
-  </table>
-   </blockquote>
- </blockquote>
-
-          <h3 align="Left">All Versions through 1.2.8</h3>
-
-          <ul>
-            <li>
-
-          <p align="Left">The shorewall.conf file and the documentation
-          incorrectly refer to a parameter in /etc/shorewall/shorewall.conf
-          called LOCKFILE; the correct name for the parameter is SUBSYSLOCK (<a href="Documentation.htm#Conf">see
-          the corrected online documentation</a>). Users of the rpm should
-          change the name (and possibly the value) of this parameter so that
-          Shorewall interacts properly with the SysV init scripts. The
-          documentation on this web site has been corrected and
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.8/shorewall.conf">
           here's a corrected version of shorewall.conf</a>.</p>
+              </li>
+             <li>            
+    <p align="left">The documentation indicates that a comma-separated  
+        list of IP/subnet addresses may appear in an entry in the hosts file. 
+          This is not the case; if you want to specify multiple addresses
+for a           zone, you need to have a separate entry for each address.</p>
+              </li>
   
-            </li>
+</ul>
-            <li>
             
-          <p align="Left">The documentation indicates that a comma-separated
+<h3 align="left">Version 1.2.7</h3>
-          list of IP/subnet addresses may appear in an entry in the hosts file.
-          This is not the case; if you want to specify multiple addresses for a
-          zone, you need to have a separate entry for each address.</p>
             
-            </li>
+<p align="left">Version 1.2.7 is quite broken -- please install 1.2.8</p>
- </ul>
             
-          <h3 align="Left">Version 1.2.7</h3>
+<p>If you have installed and started version 1.2.7 then before trying   
+       to restart under 1.2.8:</p>
   
-          <p align="Left">Version 1.2.7 is quite broken -- please install 1.2.8</p>
+<ol>
+    <li>Look at your /etc/shorewall/shorewall.conf file and note the directory 
+   named in the STATEDIR variable. If that variable is empty, assume    /var/state/shorewall.</li>
+    <li>Remove the file 'lock' in the directory determined in step 1.</li>
   
-          <p>If you have installed and started version 1.2.7 then before trying
+</ol>
-          to restart under 1.2.8:</p>
- <ol>
-   <li>Look at your /etc/shorewall/shorewall.conf file and note the directory
-   named in the STATEDIR variable. If that variable is empty, assume
-   /var/state/shorewall.</li>
-   <li>Remove the file 'lock' in the directory determined in step 1.</li>
- </ol>
- <p>You may now restart using 1.2.8.</p>
   
-          <h3 align="Left">Version 1.2.6</h3>
+<p>You may now restart using 1.2.8.</p>
             
- <ul>
+<h3 align="left">Version 1.2.6</h3>
-   <li>
    
-          <p align="Left">GRE and IPIP tunnels are broken.</li>
+<ul>
-   <li>
+    <li>            
+    <p align="left">GRE and IPIP tunnels are broken.    </p>
+  </li>
+  <li>            
+    <p align="left">The following rule results in a start error:<br>
+           <br>
+     ACCEPT    z1    z2              icmp  </p>
+  </li>
+</ul>
             
-          <p align="Left">The following rule results in a start error:<br>
+<p align="left">To correct the above problems, install           <a
-          <br>
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.6/firewall">this 
-&nbsp;&nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; z1&nbsp;&nbsp;&nbsp; z2&nbsp;&nbsp;&nbsp;
+    corrected firewall script</a> in  /etc/shorewall/firewall..</p>
-          icmp</li>
+<h3 align="left">Version 1.2.5</h3>
- </ul>
    
-          <p align="Left">To correct the above problems, install
+<ul>
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.6/firewall">this
+    <li>            
-    corrected firewall script</a> in&nbsp; /etc/shorewall/firewall..<h3 align="Left">Version 1.2.5</h3>
+    <p align="left">The new ADDRESS column in /etc/shorewall/masq cannot 
+         contain a $-variable name.    </p>
+  </li>
+  <li>            
+    <p align="left">Errors result if $FW appears in the           /etc/shorewall/policy
+file.    </p>
+  </li>
+  <li>            
+    <p align="left">Using Blacklisting without setting BLACKLIST_LOGLEVEL 
+          results in an error at start time.  </p>
+  </li>
+</ul>
             
- <ul>
+<p align="left">To correct the above problems, install           <a
-   <li>
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.5/firewall">this 
+    corrected firewall script</a> in  /etc/shorewall/firewall.</p>
+<p align="left"> </p>
+<ul>
+    <li>            
+    <p align="left">The /sbin/shorewall script produces error messages  
+        saying that 'mygrep' cannot be found.           <a
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.5/shorewall">  
+        Here is the correct version of /sbin/shorewall.</a>  </p>
+  </li>
+</ul>
             
-          <p align="Left">The new ADDRESS column in /etc/shorewall/masq cannot
+<h3 align="left">Version 1.2.4</h3>
-          contain a $-variable name.</li>
-   <li>
    
-          <p align="Left">Errors result if $FW appears in the
+<ul>
-          /etc/shorewall/policy file.</li>
+    <li>
-   <li>
+    <p align="left">This version will not install "out of the box" without 
+    modification. Before attempting to start the     firewall, please change
+the STATEDIR in /etc/shorewall/shorewall.conf to     refer to /var/lib/shorewall.
+This only applies to fresh installations -- if     you are upgrading from
+a previous version of Shorewall, version 1.2.4 will     work without modification. 
+ </p>
+  </li>
+</ul>
             
-          <p align="Left">Using Blacklisting without setting BLACKLIST_LOGLEVEL
+<h3 align="left">Version 1.2.3</h3>
-          results in an error at start time.</li>
- </ul>
    
-          <p align="Left">To correct the above problems, install
+<ul>
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.5/firewall">this
+    <li>     
-    corrected firewall script</a> in  /etc/shorewall/firewall.<p align="Left">&nbsp;<ul>
+    <p align="left">When BLACKLIST_LOGLEVEL is set, packets from blacklisted 
-   <li>
+    hosts aren't logged. Install <a
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.3/firewall">this 
+    corrected firewall script</a> in /etc/shorewall/firewall.  </p>
+  </li>
+</ul>
   
-          <p align="Left">The /sbin/shorewall script produces error messages
+<blockquote>   
-          saying that 'mygrep' cannot be found.
+  <p>Alternatively, edit /etc/shorewall/firewall and change line 1564 from:</p>
-          <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.5/shorewall">
-          Here is the correct version of /sbin/shorewall.</a></li>
- </ul>
-
-          <h3 align="Left">Version 1.2.4</h3>
-
- <ul>
-   <li><p align="Left">This version will not install &quot;out of the box&quot; without
-    modification. Before attempting to start the
-    firewall, please change the STATEDIR in /etc/shorewall/shorewall.conf to
-    refer to /var/lib/shorewall. This only applies to fresh installations -- if
-    you are upgrading from a previous version of Shorewall, version 1.2.4 will
-    work without modification.</li>
- </ul>
-
-          <h3 align="Left">Version 1.2.3</h3>
-
- <ul>
-   <li>
-    <p align="Left">When BLACKLIST_LOGLEVEL is set, packets from blacklisted
-    hosts aren't logged. Install <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.3/firewall">this
-    corrected firewall script</a> in /etc/shorewall/firewall.</li>
- </ul>
- <blockquote>
-
- <p>Alternatively, edit /etc/shorewall/firewall and change line 1564 from:</p>
-
- </blockquote>
- <pre>          run_iptables -A blacklst -d $addr -j LOG $LOGPARAMS --log-prefix \</pre>
- <blockquote>
-
- <p>to</p>
-
- </blockquote>
- <pre>          run_iptables -A blacklst -s $addr -j LOG $LOGPARAMS --log-prefix \</pre>
-
-          <h3 align="Left">Version 1.2.2</h3>
-
- <ul>
-   <li>The &quot;shorewall status&quot; command hangs after
-          it displays the chain information. <a href="pub/shorewall/errata/1.2.2/shorewall">Here's
-          a corrected /sbin/shorewall.</a> if&nbsp; you want to simply modify your copy of
-          /sbin/shorewall, then at line 445 change this:</li>
- </ul>
-
- <div align="left">
-
-          <pre align="Left">       status)
-           clear</pre>
-
- </div>
- <blockquote>
-
-          <p align="Left">to this:</p>
-
- </blockquote>
- <div align="left">
-
-          <pre align="Left">       status)
-           get_config
-           clear</pre>
-
- </div>
- <ul>
-   <li>The &quot;shorewall monitor&quot; command
-    doesn't show the icmpdef chain - <a href="pub/shorewall/errata/1.2.2/shorewall">this
-    corrected /sbin/shorewall</a> fixes that problem as well as the status
-    problem described above.</li>
- </ul>
- <ul>
-   <li>In all 1.2.x versions, the 'CLIENT PORT(S)'
-    column in /etc/shorewall/tcrules is ignored. This is corrected in <a href="/pub/shorewall/errata/1.2.2/firewall">this
-    updated firewall script</a>.&nbsp; Place the script in  /etc/shorewall/firewall. Thanks to Shingo Takeda for
-    spotting this bug.</li>
- </ul>
-
-          <h3 align="Left">Version 1.2.1</h3>
-
- <ul>
-   <li>The new <i>logunclean </i>interface option is not
-          described in the help text in /etc/shorewall/interfaces. An <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.2.1/interfaces">updated
-          interfaces file</a> is available.</li>
-   <li>When REJECT is specified in a TCP rule, Shorewall
-          correctly replies with a TCP RST packet. Previous versions of the
-          firewall script are broken in the case of a REJECT policy, however; in
-          REJECT policy chains, all requests are currently replied to with an
-          ICMP port-unreachable packet. <a href="http://www.shorewall.net/pub/shorewall/errata/1.2.1/firewall">This
-          corrected firewall script</a> replies to TCP requests with TCP RST in
-   REJECT policy chains. Place the script in /etc/shorewall/firewall.</li>
- </ul>
-
-          <h3 align="Left">Version 1.2.0</h3>
-
- <blockquote>
-
-          <p align="Left"><b>Note: </b>If you are upgrading from one of the Beta
-          RPMs to 1.2.0, you must use the &quot;--oldpackage&quot; option to rpm
-          (e.g., rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm).</p>
-
-          <p align="Left">The tunnel script released in version 1.2.0 contained
-          errors -- a <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.2.0/tunnel">corrected
-          script</a> is available.</p>
-
- </blockquote>
-
- <hr>
-
-        <h3 align="Left"><a name="iptables"></a><font color="#660066">
- Problem with iptables version 1.2.3</font></h3>
-
- <blockquote>
-
-        <p align="Left">There are a couple of serious bugs in iptables 1.2.3 that
-        prevent it from working with Shorewall. Regrettably,
-RedHat released this buggy iptables in RedHat   7.2.&nbsp;</p>
-
-        <p align="Left"> I have built a <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
- corrected 1.2.3 rpm which you can download here</a>&nbsp; and I have also built
-        an <a href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
- iptables-1.2.4   rpm which you can download here</a>. If
-you are currently running RedHat 7.1, you can install either of these RPMs
-          <b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
-
-  <p align="Left"><font face="Century Gothic, Arial, Helvetica" color="#FF6633"><b>Update
-  11/9/2001: </b></font>RedHat has
-  released an iptables-1.2.4 RPM of their own which you can download from<font face="Century Gothic, Arial, Helvetica" color="#FF6633">
-  <a href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
-  </font>I have installed this RPM
-  on my firewall and it works fine.</p>
-
-        <p align="Left">If you
-        would like to patch iptables 1.2.3 yourself, the patches are available
-        for download. This <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
-    which corrects a problem with parsing of the --log-level specification while
-        this <a href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
-        corrects a problem in handling the&nbsp; TOS target.</p>
-
-          <p align="Left">To install one of the above patches:</p>
-        <ul>
-          <li>cd iptables-1.2.3/extensions</li>
-          <li>patch -p0 &lt; <i>the-patch-file</i></li>
-        </ul>
-
- </blockquote>
-
-                            <h3><a name="Debug"></a>Problems with kernel 2.4.18
-                            and RedHat iptables</h3>
- <blockquote>
-   <p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18 may
-   experience the following:</p>
-   <blockquote>
-     <pre># shorewall start
-Processing /etc/shorewall/shorewall.conf ...
-Processing /etc/shorewall/params ...
-Starting Shorewall...
-Loading Modules...
-Initializing...
-Determining Zones...
-Zones: net
-Validating interfaces file...
-Validating hosts file...
-Determining Hosts in Zones...
-Net Zone: eth0:0.0.0.0/0
-iptables: libiptc/libip4tc.c:380: do_check: Assertion
-`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.
-Aborted (core dumped)
-iptables: libiptc/libip4tc.c:380: do_check: Assertion
-`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.
-Aborted (core dumped)
-</pre>
    </blockquote>
-   <p>The RedHat iptables RPM is compiled with debugging enabled but the
+  
-   user-space debugging code was not updated to reflect recent changes in the
+<pre>          run_iptables -A blacklst -d $addr -j LOG $LOGPARAMS --log-prefix \</pre>
-   Netfilter 'mangle' table. You can correct the problem by installing
+  
-   <a href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
+<blockquote>   
+  <p>to</p>
+   </blockquote>
+  
+<pre>          run_iptables -A blacklst -s $addr -j LOG $LOGPARAMS --log-prefix \</pre>
+            
+<h3 align="left">Version 1.2.2</h3>
+   
+<ul>
+    <li>The "shorewall status" command hangs after           it displays
+the chain information. <a href="pub/shorewall/errata/1.2.2/shorewall">Here's 
+          a corrected /sbin/shorewall.</a> if  you want to simply modify
+your copy of           /sbin/shorewall, then at line 445 change this:</li>
+  
+</ul>
+   
+<div align="left">            
+<pre align="Left">       status)<br>           clear</pre>
+   </div>
+  
+<blockquote>            
+  <p align="left">to this:</p>
+   </blockquote>
+  
+<div align="left">            
+<pre align="Left">       status)<br>           get_config<br>           clear</pre>
+   </div>
+  
+<ul>
+    <li>The "shorewall monitor" command     doesn't show the icmpdef chain
+- <a href="pub/shorewall/errata/1.2.2/shorewall">this     corrected /sbin/shorewall</a>
+fixes that problem as well as the status     problem described above.</li>
+  
+</ul>
+  
+<ul>
+    <li>In all 1.2.x versions, the 'CLIENT PORT(S)'     column in /etc/shorewall/tcrules
+is ignored. This is corrected in <a
+ href="/pub/shorewall/errata/1.2.2/firewall">this     updated firewall script</a>. 
+Place the script in  /etc/shorewall/firewall. Thanks to Shingo Takeda for 
+    spotting this bug.</li>
+  
+</ul>
+            
+<h3 align="left">Version 1.2.1</h3>
+   
+<ul>
+    <li>The new <i>logunclean </i>interface option is not           described
+in the help text in /etc/shorewall/interfaces. An <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.2.1/interfaces">updated 
+          interfaces file</a> is available.</li>
+    <li>When REJECT is specified in a TCP rule, Shorewall           correctly
+replies with a TCP RST packet. Previous versions of the           firewall
+script are broken in the case of a REJECT policy, however; in           REJECT
+policy chains, all requests are currently replied to with an           ICMP
+port-unreachable packet. <a
+ href="http://www.shorewall.net/pub/shorewall/errata/1.2.1/firewall">This 
+          corrected firewall script</a> replies to TCP requests with TCP
+RST in    REJECT policy chains. Place the script in /etc/shorewall/firewall.</li>
+  
+</ul>
+            
+<h3 align="left">Version 1.2.0</h3>
+   
+<blockquote>            
+  <p align="left"><b>Note: </b>If you are upgrading from one of the Beta 
+         RPMs to 1.2.0, you must use the "--oldpackage" option to rpm   
+       (e.g., rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm).</p>
+            
+  <p align="left">The tunnel script released in version 1.2.0 contained 
+         errors -- a <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.2.0/tunnel">corrected 
+          script</a> is available.</p>
+   </blockquote>
+   
+<hr>          
+<h3 align="left"><a name="iptables"></a><font color="#660066">  Problem with
+iptables version 1.2.3</font></h3>
+   
+<blockquote>          
+  <p align="left">There are a couple of serious bugs in iptables 1.2.3 that 
+        prevent it from working with Shorewall. Regrettably, RedHat released
+this buggy iptables in RedHat   7.2. </p>
+          
+  <p align="left"> I have built a <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm"> 
+ corrected 1.2.3 rpm which you can download here</a>  and I have also built 
+        an <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm"> 
+iptables-1.2.4   rpm which you can download here</a>. If you are currently
+running RedHat 7.1, you can install either of these RPMs           <b><u>before</u>
+  </b>you upgrade to RedHat 7.2.</p>
+    
+  <p align="left"><font face="Century Gothic, Arial, Helvetica"
+ color="#ff6633"><b>Update   11/9/2001: </b></font>RedHat has   released
+an iptables-1.2.4 RPM of their own which you can download from<font
+ face="Century Gothic, Arial, Helvetica" color="#ff6633">   <a
+ href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>. 
+  </font>I have installed this RPM   on my firewall and it works fine.</p>
+          
+  <p align="left">If you         would like to patch iptables 1.2.3 yourself,
+the patches are available         for download. This <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a> 
+    which corrects a problem with parsing of the --log-level specification
+while         this <a
+ href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a> 
+        corrects a problem in handling the  TOS target.</p>
+            
+  <p align="left">To install one of the above patches:</p>
+         
+  <ul>
+           <li>cd iptables-1.2.3/extensions</li>
+           <li>patch -p0 &lt; <i>the-patch-file</i></li>
+         
+  </ul>
+   </blockquote>
+                              
+<h3><a name="Debug"></a>Problems with kernel 2.4.18                     
+       and RedHat iptables</h3>
+  
+<blockquote>    
+  <p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18
+may    experience the following:</p>
+    
+  <blockquote>      
+    <pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br></pre>
+    </blockquote>
+    
+  <p>The RedHat iptables RPM is compiled with debugging enabled but the 
+  user-space debugging code was not updated to reflect recent changes in
+the    Netfilter 'mangle' table. You can correct the problem by installing 
+   <a
+ href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm"> 
    this iptables RPM</a>. If you are already running a 1.2.5 version of 
-   iptables, you will need to specify the --oldpackage option to rpm (e.g.,
+  iptables, you will need to specify the --oldpackage option to rpm (e.g., 
-   &quot;iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm&quot;).</p>
+   "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
- </blockquote>
+  </blockquote>
                                 
-                              <p><font face="Century Gothic, Arial, Helvetica"><font size="2">
+<p><font face="Century Gothic, Arial, Helvetica"><font size="2">  Last updated
- Last updated 5/24/2002 - </font><font size="2">
+5/24/2002 - </font><font size="2">                               <a
-                              <a href="support.htm">Tom Eastep</a></font>
+ href="support.htm">Tom Eastep</a></font>   </font></p>
-  </font></p>
    
- <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
+<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
  © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
-
+  <br>
 </body>
-                        </html>
+</html>

STABLE/documentation/errata_3.html

@@ -2,35 +2,27 @@
 <html>
 <head>
      
-
   <meta http-equiv="Content-Type"
  content="text/html; charset=windows-1252">
   <title>Shorewall 1.3 Errata</title>
          
-
-
   <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
      
-
   <meta name="ProgId" content="FrontPage.Editor.Document">
      
-
   <meta name="Microsoft Theme" content="none">
 </head>
   <body>
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                          <tbody>
+                           <tbody>
-                          <tr>
+                           <tr>
-                            <td width="100%">
+                             <td width="100%">         
-
-
       <h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
-                            </td>
+                             </td>
-                          </tr>
+                           </tr>
-
      
   </tbody> 
 </table>
@@ -38,82 +30,73 @@
 <p align="center">       <b><u>IMPORTANT</u></b></p>
   
 <ol>
-                          <li>
+                           <li>       
-
-
     <p align="left">          <b><u>I</u>f you use a Windows system to download 
            a corrected     script, be sure to run the script through <u> 
-           <a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
+          <a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
  style="text-decoration: none;"> dos2unix</a></u>      after you have moved 
            it to your Linux system.</b></p>
-                                       </li>
+                                        </li>
-                          <li>
+                           <li>       
-
+    <p align="left">          <b>If you are installing Shorewall for the first
-
+time and plan to use the        .tgz and install.sh script, you can untar
-    <p align="left">          <b>If you are installing Shorewall for the
+the archive, replace the        'firewall' script in the untarred directory 
-first time and plan to use the        .tgz and install.sh script, you can
-untar the archive, replace the        'firewall' script in the untarred directory
            with the one you downloaded        below, and then run install.sh.</b></p>
-                                       </li>
+                                        </li>
-                          <li>
+                           <li>       
-
-
     <p align="left">          <b>If you are running a Shorewall version earlier 
-    than 1.3.11, when the instructions say to install a corrected
+    than 1.3.11, when the instructions say to install a corrected firewall
-firewall     script in        /etc/shorewall/firewall, /usr/lib/shorewall/firewall
+    script in        /etc/shorewall/firewall, /usr/lib/shorewall/firewall 
       or /var/lib/shorewall/firewall,  use the 'cp' (or 'scp') utility to 
 overwrite        the        existing file. DO  NOT REMOVE OR RENAME THE OLD 
 /etc/shorewall/firewall               or /var/lib/shorewall/firewall  before 
 you do that. /etc/shorewall/firewall               and /var/lib/shorewall/firewall 
- are symbolic links that point           to the 'shorewall' file used by
+ are symbolic links that point           to the 'shorewall' file used by your
-your  system initialization scripts     to         start Shorewall during
+ system initialization scripts     to         start Shorewall during boot.
-boot. It is  that file that must be overwritten              with the corrected
+It is  that file that must be overwritten              with the corrected 
 script. Beginning with Shorewall 1.3.11, you may rename the existing file 
 before copying in the new file.</b></p>
-                  </li>
+                   </li>
-                  <li>
+                   <li>      
-
     <p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS 
         ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW. 
   For    example,  do NOT install the 1.3.9a firewall script if you are running 
    1.3.7c.</font></b><br>
-                              </p>
+                               </p>
-                  </li>
+                   </li>
   
 </ol>
   
 <ul>
-                          <li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
+                           <li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
-                          <li>                            <b><a
+                           <li>                            <b><a
  href="#V1.3">Problems      in  Version    1.3</a></b></li>
-                          <li>                            <b><a
+                           <li>                            <b><a
  href="errata_2.htm">Problems      in  Version 1.2</a></b></li>
-                          <li>                            <b><font
+                           <li>                            <b><font
  color="#660066">       <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
-                          <li>                            <b><font
+                           <li>                            <b><font
  color="#660066"><a href="#iptables">    Problem with iptables version 1.2.3 
     on RH7.2</a></font></b></li>
-                          <li>                            <b><a
+                           <li>                            <b><a
- href="#Debug">Problems      with   kernels  &gt;= 2.4.18 and
+ href="#Debug">Problems      with   kernels  &gt;= 2.4.18 and RedHat iptables</a></b></li>
-RedHat iptables</a></b></li>
+                           <li><b><a href="#SuSE">Problems installing/upgrading 
-                          <li><b><a href="#SuSE">Problems installing/upgrading
    RPM   on  SuSE</a></b></li>
-                          <li><b><a href="#Multiport">Problems with iptables
+                           <li><b><a href="#Multiport">Problems with iptables 
   version     1.2.7    and       MULTIPORT=Yes</a></b></li>
-                    <li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
+                     <li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10 
  and   NAT</a></b><br>
-                    </li>
+                     </li>
   
 </ul>
   
 <hr> 
 <h2 align="left"><small></small><a name="V1.3"></a>Problems in Version 1.3</h2>
    
-
 <h3>Version 1.3.14</h3>
   
 <ul>
-   <li>There is an <a
+    <li>There is an <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.14/rfc1918">updated 
   rfc1918</a> file that reflects the resent allocation of 222.0.0.0/8 and 
 223.0.0.0/8.</li>
@@ -121,19 +104,20 @@ RedHat iptables</a></b></li>
 </ul>
   
 <ul>
-   <li>The documentation for the routestopped file claimed that a comma-separated
+    <li>The documentation for the routestopped file claimed that a comma-separated 
-  list could appear in the second column while the code only supported a single
+  list could appear in the second column while the code only supported a
-  host or network address.</li>
+single   host or network address.</li>
-   <li>Log messages produced by 'logunclean' and 'dropunclean' were not rate-limited.</li>
+    <li>Log messages produced by 'logunclean' and 'dropunclean' were not
-   <li>802.11b devices with names of the form <i>wlan</i>&lt;n&gt; don't
+rate-limited.</li>
+    <li>802.11b devices with names of the form <i>wlan</i>&lt;n&gt; don't 
 support  the 'maclist' interface option.</li>
-   <li>Log messages generated by RFC 1918 filtering are not rate limited.</li>
+    <li>Log messages generated by RFC 1918 filtering are not rate limited.</li>
-  <li>The firewall fails to start in the case where you have "eth0 eth1"
+   <li>The firewall fails to start in the case where you have "eth0 eth1" 
 in /etc/shorewall/masq and the default route is through eth1.<br>
-   </li>
+    </li>
   
 </ul>
-    These problems have been corrected in <a
+     These problems have been corrected in <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.14/firewall">this 
   firewall script</a> which may be installed in /usr/lib/shorewall as described 
   above.<br>
@@ -141,112 +125,112 @@ in /etc/shorewall/masq and the default route is through eth1.<br>
 <h3>Version 1.3.13</h3>
   
 <ul>
-         <li>The 'shorewall add' command produces an error message referring
+          <li>The 'shorewall add' command produces an error message referring 
   to  'find_interfaces_by_maclist'.</li>
-        <li>The 'shorewall delete' command can leave behind undeleted rules.</li>
+         <li>The 'shorewall delete' command can leave behind undeleted rules.</li>
-      <li>The 'shorewall add' command can fail with "iptables: Index of insertion
+       <li>The 'shorewall add' command can fail with "iptables: Index of
-  too big".<br>
+insertion   too big".<br>
-      </li>
+       </li>
   
 </ul>
-      All three problems are corrected by <a
+       All three problems are corrected by <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.13/firewall">this 
     firewall script</a> which may be installed in /usr/lib/shorewall as described 
     above.<br>
   
 <ul>
-       <li>VLAN interface names of the form "eth<i>n</i>.<i>m</i>" (e.g.,
+        <li>VLAN interface names of the form "eth<i>n</i>.<i>m</i>" (e.g., 
 eth0.1)   are not supported in this version or in 1.3.12. If you need such 
 support,   post on the users list and I can provide you with a patched version.<br>
-       </li>
+        </li>
   
 </ul>
   
 <h3>Version 1.3.12</h3>
   
 <ul>
-          <li>If RFC_1918_LOG_LEVEL is set to anything but ULOG, the effect
+           <li>If RFC_1918_LOG_LEVEL is set to anything but ULOG, the effect 
  is  the  same as if RFC_1918_LOG_LEVEL=info had been specified. The problem 
   is  corrected  by <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.12/firewall">this 
     firewall script</a> which may be installed in /usr/lib/shorewall as described 
     above.</li>
-       <li>VLAN interface names of the form "eth<i>n</i>.<i>m</i>" (e.g.,
+        <li>VLAN interface names of the form "eth<i>n</i>.<i>m</i>" (e.g., 
 eth0.1)   are not supported in this version or in 1.3.13. If you need such 
 support,   post on the users list and I can provide you with a patched version.<br>
-        </li>
+         </li>
   
 </ul>
   
 <h3>Version 1.3.12 LRP</h3>
   
 <ul>
-           <li>The .lrp was missing the /etc/shorewall/routestopped file
+            <li>The .lrp was missing the /etc/shorewall/routestopped file 
---  a  new   lrp (shorwall-1.3.12a.lrp) has been released which corrects
+--  a  new   lrp (shorwall-1.3.12a.lrp) has been released which corrects this
-this  problem.<br>
+ problem.<br>
-           </li>
+            </li>
   
 </ul>
   
 <h3>Version 1.3.11a</h3>
   
 <ul>
-            <li><a
+             <li><a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/rfc1918">This 
      copy of /etc/shorewall/rfc1918</a> reflects the recent allocation of 
 82.0.0.0/8.<br>
-            </li>
+             </li>
   
 </ul>
   
 <h3>Version 1.3.11</h3>
   
 <ul>
-               <li>When installing/upgrading using the .rpm, you may receive
+                <li>When installing/upgrading using the .rpm, you may receive 
   the   following   warnings:<br>
-                 <br>
+                  <br>
-                  user teastep does not exist - using root<br>
+                   user teastep does not exist - using root<br>
-                  group teastep does not exist - using root<br>
+                   group teastep does not exist - using root<br>
-                 <br>
+                  <br>
-             These warnings are harmless and may be ignored. Users downloading
+              These warnings are harmless and may be ignored. Users downloading 
    the   .rpm  from shorewall.net or mirrors should no longer see these warnings 
    as  the .rpm you will get from there has been corrected.</li>
-              <li>DNAT rules that exclude a source subzone (SOURCE column
+               <li>DNAT rules that exclude a source subzone (SOURCE column 
 contains     !  followed by a sub-zone list) result in an error message and 
 Shorewall    fails  to start.<br>
-                <br>
+                 <br>
-            Install <a
+             Install <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/firewall">this 
       corrected script</a> in /usr/lib/shorewall/firewall to correct this 
 problem.     Thanks go to Roger Aich who analyzed this problem and provided 
 a fix.<br>
-               <br>
+                <br>
-           This problem is corrected in version 1.3.11a.<br>
+            This problem is corrected in version 1.3.11a.<br>
-              </li>
+               </li>
   
 </ul>
   
 <h3>Version 1.3.10</h3>
   
 <ul>
-                 <li>If you experience problems connecting to a PPTP server
+                  <li>If you experience problems connecting to a PPTP server 
  running     on  your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels, 
            <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.10/firewall">this 
        version of the firewall script</a> may help. Please report any cases 
-  where     installing this script in /usr/lib/shorewall/firewall solved
+  where     installing this script in /usr/lib/shorewall/firewall solved your
-your   connection     problems. Beginning with version 1.3.10, it is safe
+  connection     problems. Beginning with version 1.3.10, it is safe to save
-to save   the old version     of /usr/lib/shorewall/firewall before copying
+  the old version     of /usr/lib/shorewall/firewall before copying in the
-in the  new one since /usr/lib/shorewall/firewall     is the real script
+ new one since /usr/lib/shorewall/firewall     is the real script now and
-now and not just a symbolic link to the real script.<br>
+not just a symbolic link to the real script.<br>
-                 </li>
+                  </li>
   
 </ul>
   
 <h3>Version 1.3.9a</h3>
   
 <ul>
-                  <li> If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No
+                   <li> If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No 
       then  the following message appears during "shorewall [re]start":</li>
   
 </ul>
@@ -258,116 +242,101 @@ now and not just a symbolic link to the real script.<br>
  target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a> 
         corrects this problem.Copy the script to /usr/lib/shorewall/firewall 
    as   described  above.<br>
-                </blockquote>
+                 </blockquote>
   
 <blockquote> Alternatively, edit /usr/lob/shorewall/firewall and change the 
         single occurence (line 483 in version 1.3.9a) of 'recalculate_interefacess' 
         to 'recalculate_interface'. <br>
-                </blockquote>
+                 </blockquote>
   
 <ul>
-                  <li>The installer (install.sh) issues a misleading message
+                   <li>The installer (install.sh) issues a misleading message 
   "Common     functions   installed in /var/lib/shorewall/functions" whereas 
   the file   is  installed  in /usr/lib/shorewall/functions. The installer 
  also performs   incorrectly  when updating old configurations that had the 
  file /etc/shorewall/functions.         <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.3.9/install.sh">Here 
         is an updated version that corrects these problems.<br>
-                    </a></li>
+                     </a></li>
   
 </ul>
   
 <h3>Version 1.3.9</h3>
-                   <b>TUNNELS Broken in 1.3.9!!! </b>There is an updated
+                    <b>TUNNELS Broken in 1.3.9!!! </b>There is an updated 
 firewall     script    at  <a
  href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
  target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a> 
         -- copy that file to /usr/lib/shorewall/firewall as described above.<br>
-                    <br>
+                     <br>
-                   Version 1.3.8
+                    Version 1.3.8 
 <ul>
-                       <li> Use of shell variables in the LOG LEVEL or SYNPARMS
+                        <li> Use of shell variables in the LOG LEVEL or SYNPARMS 
    columns     of  the  policy file doesn't work.</li>
-                       <li>A DNAT rule with the same original and new IP
+                        <li>A DNAT rule with the same original and new IP 
 addresses      but   with   different  port numbers doesn't work (e.g., "DNAT 
 loc dmz:10.1.1.1:24        tcp   25 - 10.1.1.1")<br>
-                       </li>
+                        </li>
   
 </ul>
-                     Installing                               <a
+                      Installing                               <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.8/firewall">   
-                           this corrected firewall script</a> in /var/lib/shorewall/firewall
+                        this corrected firewall script</a> in /var/lib/shorewall/firewall 
                                           as described above corrects these 
   problems. 
 <h3>Version 1.3.7b</h3>
    
-
+<p>DNAT rules where the source zone is 'fw' ($FW)         result in an error
-<p>DNAT rules where the source zone is 'fw' ($FW)
+message. Installing     <a
-        result in an error message. Installing
-    <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">   
-                           this corrected firewall script</a> in /var/lib/shorewall/firewall
+                        this corrected firewall script</a> in /var/lib/shorewall/firewall 
                                           as described above corrects this 
  problem.</p>
    
-
 <h3>Version 1.3.7a</h3>
    
-
+<p>"shorewall refresh" is not creating the proper         rule for FORWARDPING=Yes.
-<p>"shorewall refresh" is not creating the proper
+Consequently, after             "shorewall refresh", the firewall will not
-        rule for FORWARDPING=Yes. Consequently, after
+forward                      icmp echo-request (ping) packets. Installing 
-            "shorewall refresh", the firewall will not forward
-                     icmp echo-request (ping) packets. Installing
                        <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">   
-                           this corrected firewall script</a> in /var/lib/shorewall/firewall
+                        this corrected firewall script</a> in /var/lib/shorewall/firewall 
                                           as described above corrects this 
  problem.</p>
    
-
 <h3>Version &lt;= 1.3.7a</h3>
    
-
+<p>If "norfc1918" and "dhcp" are both specified as          options on a
-<p>If "norfc1918" and "dhcp" are both specified as
+given interface then RFC 1918           checking is occurring before DHCP
-         options on a given interface then RFC 1918
+checking. This                  means that if a DHCP client broadcasts using
-          checking is occurring before DHCP checking. This
+an                        RFC 1918 source address, then the firewall will 
-                 means that if a DHCP client broadcasts using an
-                       RFC 1918 source address, then the firewall will
                              reject the broadcast (usually logging it). This 
                                           has two problems:</p>
    
-
 <ol>
-                                                       <li>If the firewall
+                                                        <li>If the firewall 
- is  running     a  DHCP   server,                                   the
+ is  running     a  DHCP   server,                                   the client
-client   won't be   able   to obtain   an IP  address
+  won't be   able   to obtain   an IP  address               lease  from
-              lease  from that   server.</li>
+that   server.</li>
-                                                       <li>With this order
+                                                        <li>With this order 
  of  checking,      the   "dhcp"                                   option 
-cannot  be used as   a  noise-reduction
+cannot  be used as   a  noise-reduction    measure  where there   are  both
-   measure  where there   are  both dynamic and    static
+dynamic and    static                   clients  on a LAN segment.</li>
-                  clients  on a LAN segment.</li>
   
 </ol>
    
-
 <p>                               <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">   
-                           This version of the 1.3.7a firewall script </a>
+                        This version of the 1.3.7a firewall script </a> 
-                                         corrects the problem. It must be
+                                        corrects the problem. It must be installed
-installed          in /var/lib/shorewall                                as
+         in /var/lib/shorewall                                as described
-described  above.</p>
+ above.</p>
-
    
 <h3>Version 1.3.7</h3>
    
-
+<p>Version 1.3.7 dead on arrival -- please use      version 1.3.7a and check
-<p>Version 1.3.7 dead on arrival -- please use
+your version against          these md5sums -- if there's a difference, please 
-     version 1.3.7a and check your version against
-         these md5sums -- if there's a difference, please
                 download again.</p>
    
-
 <pre>	d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz<br>	6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm<br>	3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp</pre>
   
 <p>In other words, type "md5sum &lt;<i>whatever package you downloaded</i>&gt; 
@@ -379,56 +348,51 @@ described  above.</p>
 <h3 align="left">Version 1.3.6</h3>
   
 <ul>
-                                   <li>
+                                    <li>       
-
-
     <p align="left">If ADD_SNAT_ALIASES=Yes is specified in            /etc/shorewall/shorewall.conf, 
            an error occurs when the firewall            script attempts to 
  add    an   SNAT   alias.  </p>
-                        </li>
+                         </li>
-                        <li>
+                         <li>       
-
-
     <p align="left">The <b>logunclean </b>and <b>dropunclean</b> options 
-           cause errors during startup when Shorewall is run with iptables
+          cause errors during startup when Shorewall is run with iptables 
            1.2.7. </p>
-                        </li>
+                         </li>
   
 </ul>
   
 <p align="left">These problems are fixed in           <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">   
-       this correct firewall script</a> which must be installed in
+    this correct firewall script</a> which must be installed in      /var/lib/shorewall/
-     /var/lib/shorewall/ as described above. These problems are also
+as described above. These problems are also        corrected in version 1.3.7.</p>
-       corrected in version 1.3.7.</p>
   
 <h3 align="left">Two-interface Samples 1.3.6 (file two-interfaces.tgz)</h3>
   
 <p align="left">A line was inadvertently deleted from the "interfaces   
-        file" -- this line should be added back in if the version that you
+     file" -- this line should be added back in if the version that you 
-                      downloaded is missing it:</p>
+                     downloaded is missing it:</p>
   
 <p align="left">net    eth0    detect               routefilter,dhcp,norfc1918</p>
   
 <p align="left">If you downloaded two-interfaces-a.tgz then the above   
-        line should already be in the file.</p>
+     line should already be in the file.</p>
   
 <h3 align="left">Version 1.3.5-1.3.5b</h3>
   
 <p align="left">The new 'proxyarp' interface option doesn't work :-(    
-       This is fixed in           <a
+   This is fixed in           <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">   
-       this corrected firewall script</a> which must be installed in
+    this corrected firewall script</a> which must be installed in       
-       /var/lib/shorewall/ as described above.</p>
+/var/lib/shorewall/ as described above.</p>
   
 <h3 align="left">Versions 1.3.4-1.3.5a</h3>
   
 <p align="left">Prior to version 1.3.4, host file entries such as the   
-        following were allowed:</p>
+     following were allowed:</p>
   
 <div align="left"> 
 <pre>	adm	eth0:1.2.4.5,eth0:5.6.7.8</pre>
-                        </div>
+                         </div>
   
 <div align="left"> 
 <p align="left">That capability was lost in version 1.3.4 so that it is only 
@@ -437,98 +401,95 @@ described  above.</p>
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.5a/firewall">this 
                modified 1.3.5a firewall script</a>. Install the script in 
 /var/lib/pub/shorewall/firewall               as instructed above.</p>
-                      </div>
+                       </div>
   
 <div align="left"> 
 <p align="left">This problem is corrected in version 1.3.5b.</p>
-                      </div>
+                       </div>
   
 <h3 align="left">Version 1.3.5</h3>
   
-<p align="left">REDIRECT rules are broken in this version. Install
+<p align="left">REDIRECT rules are broken in this version. Install     <a
-    <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">   
-       this corrected firewall script</a> in /var/lib/pub/shorewall/firewall
+    this corrected firewall script</a> in /var/lib/pub/shorewall/firewall 
                       as instructed above. This problem is corrected in version 
       1.3.5a.</p>
   
 <h3 align="left">Version 1.3.n, n &lt; 4</h3>
   
 <p align="left">The "shorewall start" and "shorewall restart" commands  
-         to not verify that the zones named in the /etc/shorewall/policy
+       to not verify that the zones named in the /etc/shorewall/policy file
-file            have been previously defined in the /etc/shorewall/zones
+           have been previously defined in the /etc/shorewall/zones file.
-file. The            "shorewall check" command does perform this verification
+The            "shorewall check" command does perform this verification so
-so it's a            good idea to run that command after you have made configuration
+it's a            good idea to run that command after you have made configuration 
                       changes.</p>
   
 <h3 align="left">Version 1.3.n, n &lt; 3</h3>
   
-<p align="left">If you have upgraded from Shorewall 1.2 and after
+<p align="left">If you have upgraded from Shorewall 1.2 and after     "Activating
-    "Activating rules..." you see the message: "iptables: No            chains/target/match
+rules..." you see the message: "iptables: No            chains/target/match 
            by that name" then you probably have an entry in            /etc/shorewall/hosts 
            that specifies an interface that you didn't            include 
 in   /etc/shorewall/interfaces.        To correct this problem, you     
-      must add an entry to /etc/shorewall/interfaces.        Shorewall 1.3.3
+ must add an entry to /etc/shorewall/interfaces.        Shorewall 1.3.3 
- and             later versions produce a clearer error    message    in
+and             later versions produce a clearer error    message    in this
-this  case.</p>
+ case.</p>
   
 <h3 align="left">Version 1.3.2</h3>
   
-<p align="left">Until approximately 2130 GMT on 17 June 2002, the
+<p align="left">Until approximately 2130 GMT on 17 June 2002, the     download
-    download sites contained an incorrect version of the .lrp file. That
+sites contained an incorrect version of the .lrp file. That            file
-           file can be identified by its size (56284 bytes). The correct
+can be identified by its size (56284 bytes). The correct version        
-version            has a size of 38126 bytes.</p>
+   has a size of 38126 bytes.</p>
   
 <ul>
-                                   <li>The code to detect a duplicate interface
+                                    <li>The code to detect a duplicate interface 
    entry    in             /etc/shorewall/interfaces contained a typo that 
  prevented    it from               working correctly. </li>
-                                   <li>"NAT_BEFORE_RULES=No" was broken;
+                                    <li>"NAT_BEFORE_RULES=No" was broken; 
 it  behaved     just   like   "NAT_BEFORE_RULES=Yes".</li>
   
 </ul>
   
 <p align="left">Both problems are corrected in           <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/firewall">   
-       this script</a> which should be installed in <b><u>/var/lib/shorewall</u></b>
+    this script</a> which should be installed in <b><u>/var/lib/shorewall</u></b> 
            as described above.</p>
   
 <ul>
-                                   <li>
+                                    <li>       
-
-
     <p align="left">The IANA have just announced the allocation of subnet 
                       221.0.0.0/8. This           <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/rfc1918">    
-      updated rfc1918</a> file reflects that allocation.</p>
+  updated rfc1918</a> file reflects that allocation.</p>
-                                                    </li>
+                                                     </li>
   
 </ul>
   
 <h3 align="left">Version 1.3.1</h3>
   
 <ul>
-                                   <li>TCP SYN packets may be double counted
+                                    <li>TCP SYN packets may be double counted 
   when              LIMIT:BURST  is included in a CONTINUE or ACCEPT policy 
   (i.e.,    each              packet is sent through the limit chain twice).</li>
-                                   <li>An unnecessary jump to the policy
+                                    <li>An unnecessary jump to the policy 
 chain    is  sometimes                 generated for a CONTINUE policy.</li>
-                                   <li>When an option is given for more than
+                                    <li>When an option is given for more
-  one   interface      in               /etc/shorewall/interfaces then depending
+than   one   interface      in               /etc/shorewall/interfaces then
-   on the option,     Shorewall                may ignore all but the first
+depending    on the option,     Shorewall                may ignore all but
-  appearence of the   option.  For example:<br>
+the first   appearence of the   option.  For example:<br>
-                                   <br>
+                                    <br>
-                                   net    eth0    dhcp<br>
+                                    net    eth0    dhcp<br>
-                                   loc    eth1    dhcp<br>
+                                    loc    eth1    dhcp<br>
-                                   <br>
+                                    <br>
-                                   Shorewall will ignore the 'dhcp' on eth1.</li>
+                                    Shorewall will ignore the 'dhcp' on eth1.</li>
-                                   <li>Update 17 June 2002 - The bug described
+                                    <li>Update 17 June 2002 - The bug described 
    in  the   prior    bullet               affects the following options: 
 dhcp,   dropunclean,   logunclean,                 norfc1918, routefilter, 
 multi,   filterping and   noping. An additional                 bug has been 
 found   that affects only   the 'routestopped' option.<br>
-                                   <br>
+                                    <br>
-                                   Users who downloaded the corrected script
+                                    Users who downloaded the corrected script 
   prior    to  1850   GMT   today              should download and install 
  the corrected     script   again   to ensure              that this second 
  problem is corrected.</li>
@@ -537,22 +498,22 @@ found   that affects only   the 'routestopped' option.<br>
   
 <p align="left">These problems are corrected in           <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.1/firewall">   
-       this firewall script</a> which should be installed in            /etc/shorewall/firewall
+    this firewall script</a> which should be installed in            /etc/shorewall/firewall 
            as described above.</p>
   
 <h3 align="left">Version 1.3.0</h3>
   
 <ul>
-                                   <li>Folks who downloaded 1.3.0 from the
+                                    <li>Folks who downloaded 1.3.0 from the 
  links    on  the   download    page              before 23:40 GMT, 29 May 
  2002 may    have  downloaded   1.2.13    rather than              1.3.0. 
 The "shorewall    version"  command   will tell    you which version    
-         that you   have installed.</li>
+     that you   have installed.</li>
-                                   <li>The documentation NAT.htm file uses
+                                    <li>The documentation NAT.htm file uses 
  non-existent                  wallpaper and bullet graphic files. The  
-        <a
+      <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.0/NAT.htm">    
-      corrected version is here</a>.</li>
+  corrected version is here</a>.</li>
   
 </ul>
   
@@ -567,21 +528,18 @@ The "shorewall    version"  command   will tell    you which version
            iptables version 1.2.3</font></h3>
   
 <blockquote>    
-
   <p align="left">There are a couple of serious bugs in iptables 1.2.3 that 
-                   prevent it from working with Shorewall. Regrettably,  RedHat
+                   prevent it from working with Shorewall. Regrettably, 
-      released    this buggy iptables in RedHat   7.2. </p>
+RedHat       released    this buggy iptables in RedHat   7.2. </p>
-
      
   <p align="left"> I have built a <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm"> 
             corrected 1.2.3 rpm which you can download here</a>  and I have 
   also     built            an <a
- href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
+ href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm"> iptables-1.2.4
-iptables-1.2.4   rpm which you can download here</a>. If  you are currently
+  rpm which you can download here</a>. If  you are currently            running
-           running RedHat 7.1, you can install either of these RPMs
+RedHat 7.1, you can install either of these RPMs         <b><u>before</u>
-        <b><u>before</u>        </b>you upgrade to RedHat 7.2.</p>
+       </b>you upgrade to RedHat 7.2.</p>
-
      
   <p align="left"><font color="#ff6633"><b>Update   11/9/2001: </b></font>RedHat 
            has   released an iptables-1.2.4 RPM of their own which you can 
@@ -590,7 +548,6 @@ iptables-1.2.4   rpm which you can download here</a>. If  you are currently
              </font>I have installed this RPM   on my firewall and it works 
   fine.</p>
      
-
   <p align="left">If you         would like to patch iptables 1.2.3 yourself, 
            the patches are available         for download. This <a
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a> 
@@ -599,105 +556,89 @@ iptables-1.2.4   rpm which you can download here</a>. If  you are currently
  href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a> 
                    corrects a problem in handling the  TOS target.</p>
      
-
   <p align="left">To install one of the above patches:</p>
      
-
   <ul>
-                                 <li>cd iptables-1.2.3/extensions</li>
+                                  <li>cd iptables-1.2.3/extensions</li>
-                                 <li>patch -p0 &lt; <i>the-patch-file</i></li>
+                                  <li>patch -p0 &lt; <i>the-patch-file</i></li>
-
      
   </ul>
-                                  </blockquote>
+                                   </blockquote>
-
    
 <h3><a name="Debug"></a>Problems with kernels &gt;= 2.4.18              
-               and RedHat iptables</h3>
+ and RedHat iptables</h3>
   
 <blockquote>    
-
   <p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19 
            may     experience the following:</p>
      
-
   <blockquote>      
-
     <pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h-&gt;info.valid_hooks == (1 &lt;&lt; 0 | 1 &lt;&lt; 3)' failed.<br>Aborted (core dumped)<br></pre>
-                          </blockquote>
+                           </blockquote>
-
      
   <p>The RedHat iptables RPM is compiled with debugging enabled but the 
-  user-space debugging code was not updated to reflect recent changes in
+ user-space debugging code was not updated to reflect recent changes in 
-           the     Netfilter 'mangle' table. You can correct the problem
+          the     Netfilter 'mangle' table. You can correct the problem by
-by   installing            <a
+  installing            <a
  href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm"> 
               this iptables RPM</a>. If you are already running a 1.2.5 version 
       of       iptables, you will need to specify the --oldpackage option 
 to   rpm   (e.g.,        "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
-                        </blockquote>
+                         </blockquote>
-
    
 <h3><a name="SuSE"></a>Problems                                installing/upgrading 
            RPM on SuSE</h3>
    
-
+<p>If you find that rpm complains about a conflict          with kernel &lt;=
-<p>If you find that rpm complains about a conflict
+2.2 yet you have a 2.4 kernel                installed, simply use the "--nodeps"
-         with kernel &lt;= 2.2 yet you have a 2.4 kernel
+option to                     rpm.</p>
-               installed, simply use the "--nodeps" option to
-                    rpm.</p>
-
    
 <p>Installing: rpm -ivh --nodeps <i>&lt;shorewall rpm&gt;</i></p>
    
-
 <p>Upgrading: rpm -Uvh --nodeps <i>&lt;shorewall rpm&gt;</i></p>
    
+<h3><a name="Multiport"></a><b>Problems with    iptables version 1.2.7 and
+MULTIPORT=Yes</b></h3>
    
-<h3><a name="Multiport"></a><b>Problems with
+<p>The iptables 1.2.7 release of iptables has made          an incompatible
-   iptables version 1.2.7 and MULTIPORT=Yes</b></h3>
+change to the syntax used to             specify multiport match rules; as
-
+a consequence,                    if you install iptables 1.2.7 you must
-
+be running                            Shorewall 1.3.7a or later or:</p>
-<p>The iptables 1.2.7 release of iptables has made
-         an incompatible change to the syntax used to
-            specify multiport match rules; as a consequence,
-                   if you install iptables 1.2.7 you must be running
-                           Shorewall 1.3.7a or later or:</p>
-
    
 <ul>
-                                                       <li>set MULTIPORT=No
+                                                        <li>set MULTIPORT=No 
  in                                   /etc/shorewall/shorewall.conf; or </li>
-                                                       <li>if you are running
+                                                        <li>if you are running 
   Shorewall      1.3.6    you may                                  install 
                                  <a
  href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">   
-                             this firewall script</a> in /var/lib/shorewall/firewall
+                          this firewall script</a> in /var/lib/shorewall/firewall 
                                             as described above.</li>
   
 </ul>
   
 <h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
-                     </h3>
+                      </h3>
-                  /etc/shorewall/nat entries of the following form will result
+                   /etc/shorewall/nat entries of the following form will
-   in  Shorewall     being unable to start:<br>
+result    in  Shorewall     being unable to start:<br>
-                  <br>
+                   <br>
   
 <pre>#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES          LOCAL<br>192.0.2.22      eth0            192.168.9.22    yes                     yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-                  Error message is:<br>
+                   Error message is:<br>
   
 <pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
-                  The solution is to put "no" in the LOCAL column. Kernel
+                   The solution is to put "no" in the LOCAL column. Kernel 
 support     for   LOCAL=yes   has never worked properly and 2.4.18-10 has 
 disabled  it.   The  2.4.19 kernel   contains corrected support under a new 
 kernel configuraiton    option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
   
-<p><font size="2">  Last updated 3/8/2003 -
+<p><font size="2">  Last updated 3/8/2003 - <a href="support.htm">Tom Eastep</a></font>
-<a href="support.htm">Tom Eastep</a></font> </p>
+</p>
   
 <p><a href="copyright.htm"><font size="2">Copyright</font>          © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-             </p>
+              </p>
+              <br>
              <br>
             <br>
            <br>

STABLE/documentation/fallback.htm

@@ -1,74 +1,77 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-
 <head>
-<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+ 
-<title>Shorewall Fallback and Uninstall</title>
+  <meta http-equiv="Content-Type"
-<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ content="text/html; charset=windows-1252">
-<meta name="ProgId" content="FrontPage.Editor.Document">
+  <title>Shorewall Fallback and Uninstall</title>
+  
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ 
+  <meta name="ProgId" content="FrontPage.Editor.Document">
 </head>
+  <body>
   
-<body>
+<table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
+   <tbody>
+    <tr>
+     <td width="100%">  
+      <h1 align="center"><font color="#ffffff">Fallback and Uninstall</font></h1>
+      </td>
+   </tr>
  
-<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
+  </tbody>
-  <tr>
-    <td width="100%">
-
-<h1 align="center"><font color="#FFFFFF">Fallback and Uninstall</font></h1>
-
-    </td>
-  </tr>
 </table>
   
-<p><strong>Shorewall includes
+<p><strong>Shorewall includes a </strong><a href="#fallback"><strong>fallback
-a </strong><a href="#fallback"><strong>fallback script</strong></a><strong>
+script</strong></a><strong> and an </strong><a href="#uninstall"><strong>uninstall
-and an </strong><a href="#uninstall"><strong>uninstall script</strong></a><strong>.</strong></p>
+script</strong></a><strong>.</strong></p>
   
 <h2><a name="fallback"></a>Falling Back to the Previous Version of Shorewall 
 using the Fallback Script</h2>
   
-<p>If you install Shorewall and discover that
+<p>If you install Shorewall and discover that it doesn't work for you, you
-it doesn't work for you, you can fall back to your previously
+can fall back to your previously installed version. To do that:</p>
-installed version. To do that:</p>
   
 <ul>
-  <li>cd to the distribution directory for the version
+   <li>cd to the distribution directory for the version         of Seattle
-        of Seattle Firewall <u>that you are
+Firewall <u>that you are         currently running </u>(NOT the version 
-        currently running </u>(NOT the version
+       that you want to fall back to).</li>
-        that you want to fall back to).</li>
+   <li>Type "./fallback.sh"</li>
-  <li>Type &quot;./fallback.sh&quot;</li>
+ 
 </ul>
   
-<h3><strong><u>Warning:</u> The fallback script
+<h3><strong><u>Warning:</u> The fallback script will replace /etc/shorewall/policy,
-will replace /etc/shorewall/policy, /etc/shorewall/rules, /etc/shorewall/interfaces,
+/etc/shorewall/rules, /etc/shorewall/interfaces, /etc/shorewall/nat, /etc/shorewall/proxyarp
-/etc/shorewall/nat, /etc/shorewall/proxyarp and /etc/shorewall/masq with the version of
+and /etc/shorewall/masq with the version of these files from before the current
-these files from before the current version was installed. Any
+version was installed. Any changes to any of these files will be lost.</strong></h3>
-changes to any of these files will be lost.</strong></h3>
   
 <h2><a name="rpm"></a>Falling Back to the Previous Version of Shorewall using 
 rpm</h2>
   
-<p>If your previous version of Shorewall was
+<p>If your previous version of Shorewall was installed using RPM, you may
-installed using RPM, you may fall back to that version by typing
+fall back to that version by typing "rpm -Uvh --force &lt;old rpm&gt;" at
-&quot;rpm -Uvh --force &lt;old rpm&gt;&quot; at a root shell
+a root shell prompt (Example: "rpm -Uvh --force /downloads/shorewall-3.1=0noarch.rpm"
-prompt (Example: &quot;rpm -Uvh --force /downloads/shorewall-3.1=0noarch.rpm&quot; would fall back to the 3.1-0
+would fall back to the 3.1-0 version of Shorewall).</p>
-version of Shorewall).</p>
   
 <h2><a name="uninstall"></a>Uninstalling Shorewall</h2>
   
-<p>If you no longer wish to use Shorewall, you
+<p>If you no longer wish to use Shorewall, you may remove it by:</p>
-may remove it by:</p>
   
 <ul>
-  <li>cd to the distribution directory for the version
+   <li>cd to the distribution directory for the version         of Shorewall
-        of Shorewall that you have installed.</li>
+that you have installed.</li>
-  <li>type &quot;./uninstall.sh&quot;</li>
+   <li>type "./uninstall.sh"</li>
+ 
 </ul>
   
-<p>If you installed using an rpm, at a root shell prompt
+<p>If you installed using an rpm, at a root shell prompt type "rpm -e shorewall".</p>
-type &quot;rpm -e shorewall&quot;.</p>
   
-<p><font size="2">Last updated 3/26/2001 - </font><font size="2">
+<p><font size="2">Last updated 3/26/2001 - </font><font size="2"> <a
-<a href="support.htm">Tom
+ href="support.htm">Tom Eastep</a></font> </p>
-Eastep</a></font> </p>
+ <a href="copyright.htm"><font size="2">Copyright</font> © <font
-<a href="copyright.htm"><font size="2">Copyright</font>
+ size="2">2001, 2002 Thomas M. Eastep.</font></a><br>
-© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></body></html>
+</body>
+</html>

STABLE/documentation/gnu_mailman.htm

@@ -16,14 +16,14 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-     <tbody>
+      <tbody>
-      <tr>
+       <tr>
-       <td width="100%">
+        <td width="100%">       
       <h1 align="center"><font color="#ffffff">GNU Mailman/Postfix the Easy 
  Way</font></h1>
-       </td>
+        </td>
-     </tr>
+      </tr>
     
   </tbody> 
 </table>
@@ -34,34 +34,34 @@
   Tokarev as a suggested addition to the Postfix FAQ.</h4>
   
 <p>Q: Mailman does not work with Postfix, complaining about GID mismatch<br>
-   <br>
+    <br>
-   A: Mailman uses a setgid wrapper that is designed to be used in system-wide
+    A: Mailman uses a setgid wrapper that is designed to be used in system-wide 
   aliases file so that rest of mailman's mail handling processes will run 
 with  proper uid/gid. Postfix has an ability to run a command specified in 
 an alias as  owner of that alias, thus mailman's wrapper is not needed here. 
  The best method  to invoke mailman's mail handling via aliases is to use 
 separate alias file  especially for mailman, and made it owned by mailman 
 and group mailman. Like:<br>
-   <br>
+    <br>
-   alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
+    alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
-   <br>
+    <br>
-   Make sure that /var/mailman/aliases.db is owned by mailman user (this
+    Make sure that /var/mailman/aliases.db is owned by mailman user (this 
 may  be  done by executing postalias as mailman userid).<br>
-   <br>
+    <br>
-   Next, instead of using mailman-suggested aliases entries with wrapper,
+    Next, instead of using mailman-suggested aliases entries with wrapper, 
 use the  following:<br>
-   <br>
+    <br>
-   instead of<br>
+    instead of<br>
-   mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
+    mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
-   mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
+    mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
-   mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
+    mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
-   ...<br>
+    ...<br>
-   <br>
+    <br>
-   use<br>
+    use<br>
-   mailinglist: /var/mailman/scripts/post mailinglist<br>
+    mailinglist: /var/mailman/scripts/post mailinglist<br>
-   mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
+    mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
-   mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
+    mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
-   ...</p>
+    ...</p>
   
 <h4>The above tip works with Mailman 2.0; Mailman 2.1 has adopted something 
 very similar so that no workaround is necessary. See the README.POSTFIX file 
@@ -72,7 +72,8 @@ included with Mailman-2.1.
   
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
  size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
-    <br>
+     <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/kernel.htm

@@ -1,146 +1,165 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-
 <head>
-<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+ 
-<title>Shorewall Kernel Configuration</title>
+  <meta http-equiv="Content-Type"
-<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ content="text/html; charset=windows-1252">
-<meta name="ProgId" content="FrontPage.Editor.Document">
+  <title>Shorewall Kernel Configuration</title>
+  
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+ 
+  <meta name="ProgId" content="FrontPage.Editor.Document">
 </head>
+  <body>
  
-<body>
+<table border="0" cellpadding="0" cellspacing="0"
-<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
-  <tr>
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-    <td width="100%">
+   <tbody>
-    <h1 align="center"><font color="#FFFFFF">Kernel Configuration</font></h1>
+    <tr>
-    </td>
+     <td width="100%">     
-  </tr>
+      <h1 align="center"><font color="#ffffff">Kernel Configuration</font></h1>
+     </td>
+   </tr>
+ 
+  </tbody>
 </table>
-<p>For information regarding configuring and building GNU/Linux kernels, see <a href="http://www.kernelnewbies.org">http://www.kernelnewbies.org</a>.</p>
+ 
+<p>For information regarding configuring and building GNU/Linux kernels,
+see <a href="http://www.kernelnewbies.org">http://www.kernelnewbies.org</a>.</p>
+ 
 <p>Here's a screen shot of my Network Options Configuration:</p>
-<blockquote>
-  <p>&nbsp;<img border="0" src="images/netopts.jpg" width="609" height="842"></p>
-</blockquote>
-<p>While not all of the options that I've selected are required, they should be
-sufficient for most applications. Here's an excerpt from the corresponding .config
-file (Note: If you are running a kernel older than 2.4.17, be sure to select
-CONFIG_NETLINK and CONFIG_RTNETLINK):</p>
  
 <blockquote>   
-  <font SIZE="2">
+  <p> <img border="0" src="images/netopts.jpg" width="609" height="842">
+  </p>
+ </blockquote>
+ 
+<p>While not all of the options that I've selected are required, they should
+be sufficient for most applications. Here's an excerpt from the corresponding
+.config file (Note: If you are running a kernel older than 2.4.17, be sure
+to select CONFIG_NETLINK and CONFIG_RTNETLINK):</p>
+  
+<blockquote>   <font size="2">   
   <p>#<br>
-  # Networking options<br>
+   # Networking options<br>
-  #<br>
+   #<br>
-  CONFIG_PACKET=y<br>
+   CONFIG_PACKET=y<br>
-  # CONFIG_PACKET_MMAP is not set<br>
+   # CONFIG_PACKET_MMAP is not set<br>
-  # CONFIG_NETLINK_DEV is not set<br>
+   # CONFIG_NETLINK_DEV is not set<br>
-  CONFIG_NETFILTER=y<br>
+   CONFIG_NETFILTER=y<br>
-  CONFIG_NETFILTER_DEBUG=y<br>
+   CONFIG_NETFILTER_DEBUG=y<br>
-  CONFIG_FILTER=y<br>
+   CONFIG_FILTER=y<br>
-  CONFIG_UNIX=y<br>
+   CONFIG_UNIX=y<br>
-  CONFIG_INET=y<br>
+   CONFIG_INET=y<br>
-  CONFIG_IP_MULTICAST=y<br>
+   CONFIG_IP_MULTICAST=y<br>
-  CONFIG_IP_ADVANCED_ROUTER=y<br>
+   CONFIG_IP_ADVANCED_ROUTER=y<br>
-  CONFIG_IP_MULTIPLE_TABLES=y<br>
+   CONFIG_IP_MULTIPLE_TABLES=y<br>
-  CONFIG_IP_ROUTE_FWMARK=y<br>
+   CONFIG_IP_ROUTE_FWMARK=y<br>
-  CONFIG_IP_ROUTE_NAT=y<br>
+   CONFIG_IP_ROUTE_NAT=y<br>
-  CONFIG_IP_ROUTE_MULTIPATH=y<br>
+   CONFIG_IP_ROUTE_MULTIPATH=y<br>
-  CONFIG_IP_ROUTE_TOS=y<br>
+   CONFIG_IP_ROUTE_TOS=y<br>
-  CONFIG_IP_ROUTE_VERBOSE=y<br>
+   CONFIG_IP_ROUTE_VERBOSE=y<br>
-  # CONFIG_IP_ROUTE_LARGE_TABLES is not set<br>
+   # CONFIG_IP_ROUTE_LARGE_TABLES is not set<br>
-  # CONFIG_IP_PNP is not set<br>
+   # CONFIG_IP_PNP is not set<br>
-  CONFIG_NET_IPIP=m<br>
+   CONFIG_NET_IPIP=m<br>
-  CONFIG_NET_IPGRE=m<br>
+   CONFIG_NET_IPGRE=m<br>
-  # CONFIG_NET_IPGRE_GROADCAST is not set<br>
+   # CONFIG_NET_IPGRE_GROADCAST is not set<br>
-  # CONFIG_IP_MROUTE is not set<br>
+   # CONFIG_IP_MROUTE is not set<br>
-  # CONFIG_ARPD is not set<br>
+   # CONFIG_ARPD is not set<br>
-  CONFIG_INET_ECN=y<br>
+   CONFIG_INET_ECN=y<br>
-  CONFIG_SYN_COOKIES=y</p>
+   CONFIG_SYN_COOKIES=y</p>
-  </font>
+   </font> </blockquote>
-</blockquote>
   
 <p>Here's a screen shot of my Netfilter configuration:</p>
-<blockquote>
  
-<p><img border="0" src="images/menuconfig.jpg" width="609" height="842"></p>
+<blockquote>  
-</blockquote>
+  <p><img border="0" src="images/menuconfig.jpg" width="609"
+ height="842">
+  </p>
+ </blockquote>
   
 <p>Here's an excerpt from the corresponding .config file.</p>
-<blockquote>
-  <p><font size="2">#<br>
-  #   IP: Netfilter Configuration<br>
-  #<br>
-  CONFIG_IP_NF_CONNTRACK=y<br>
-  CONFIG_IP_NF_FTP=m<br>
-  # CONFIG_IP_NF_QUEUE is not set<br>
-  CONFIG_IP_NF_IPTABLES=y<br>
-  CONFIG_IP_NF_MATCH_LIMIT=y<br>
-  CONFIG_IP_NF_MATCH_MAC=y<br>
-  CONFIG_IP_NF_MATCH_MARK=y<br>
-  CONFIG_IP_NF_MATCH_MULTIPORT=y<br>
-  CONFIG_IP_NF_MATCH_TOS=y<br>
-  # CONFIG_IP_NF_MATCH_TCPMSS is not set<br>
-  CONFIG_IP_NF_MATCH_STATE=y<br>
-  # CONFIG_IP_NF_MATCH_UNCLEAN is not set<br>
-  # CONFIG_IP_NF_MATCH_OWNER is not set<br>
-  CONFIG_IP_NF_FILTER=y<br>
-  CONFIG_IP_NF_TARGET_REJECT=y<br>
-  # CONFIG_IP_NF_TARGET_MIRROR is not set<br>
-  CONFIG_IP_NF_NAT=y<br>
-  CONFIG_IP_NF_NAT_NEEDED=y<br>
-  CONFIG_IP_NF_TARGET_MASQUERADE=y<br>
-  CONFIG_IP_NF_TARGET_REDIRECT=y<br>
-  CONFIG_IP_NF_NAT_FTP=m<br>
-  CONFIG_IP_NF_MANGLE=y<br>
-  CONFIG_IP_NF_TARGET_TOS=y<br>
-  CONFIG_IP_NF_TARGET_MARK=y<br>
-  CONFIG_IP_NF_TARGET_LOG=y<br>
-  CONFIG_IP_NF_TARGET_TCPMSS=y<br>
-  # CONFIG_IPV6 is not set</font><font face="Courier"><br>
-  </font></p>
-</blockquote>
-<p>Note that I have built everything I need into the kernel except for the FTP
-connection tracking and NAT modules. I have also run successfully with all of
-the options selected above built as modules:</p>
  
 <blockquote>   
-  <p><img border="0" src="images/menuconfig1.jpg" width="609" height="842"></p>
+  <p><font size="2">#<br>
+   #   IP: Netfilter Configuration<br>
+   #<br>
+   CONFIG_IP_NF_CONNTRACK=y<br>
+   CONFIG_IP_NF_FTP=m<br>
+   # CONFIG_IP_NF_QUEUE is not set<br>
+   CONFIG_IP_NF_IPTABLES=y<br>
+   CONFIG_IP_NF_MATCH_LIMIT=y<br>
+   CONFIG_IP_NF_MATCH_MAC=y<br>
+   CONFIG_IP_NF_MATCH_MARK=y<br>
+   CONFIG_IP_NF_MATCH_MULTIPORT=y<br>
+   CONFIG_IP_NF_MATCH_TOS=y<br>
+   # CONFIG_IP_NF_MATCH_TCPMSS is not set<br>
+   CONFIG_IP_NF_MATCH_STATE=y<br>
+   # CONFIG_IP_NF_MATCH_UNCLEAN is not set<br>
+   # CONFIG_IP_NF_MATCH_OWNER is not set<br>
+   CONFIG_IP_NF_FILTER=y<br>
+   CONFIG_IP_NF_TARGET_REJECT=y<br>
+   # CONFIG_IP_NF_TARGET_MIRROR is not set<br>
+   CONFIG_IP_NF_NAT=y<br>
+   CONFIG_IP_NF_NAT_NEEDED=y<br>
+   CONFIG_IP_NF_TARGET_MASQUERADE=y<br>
+   CONFIG_IP_NF_TARGET_REDIRECT=y<br>
+   CONFIG_IP_NF_NAT_FTP=m<br>
+   CONFIG_IP_NF_MANGLE=y<br>
+   CONFIG_IP_NF_TARGET_TOS=y<br>
+   CONFIG_IP_NF_TARGET_MARK=y<br>
+   CONFIG_IP_NF_TARGET_LOG=y<br>
+   CONFIG_IP_NF_TARGET_TCPMSS=y<br>
+   # CONFIG_IPV6 is not set</font><font face="Courier"><br>
+   </font></p>
+ </blockquote>
+ 
+<p>Note that I have built everything I need into the kernel except for the
+FTP connection tracking and NAT modules. I have also run successfully with
+all of the options selected above built as modules:</p>
+  
+<blockquote>   
+  <p><img border="0" src="images/menuconfig1.jpg" width="609"
+ height="842">
+  </p>
     
   <p><font size="2">#<br>
-  #   IP: Netfilter Configuration<br>
+   #   IP: Netfilter Configuration<br>
-  #<br>
+   #<br>
-  CONFIG_IP_NF_CONNTRACK=m<br>
+   CONFIG_IP_NF_CONNTRACK=m<br>
-  CONFIG_IP_NF_FTP=m<br>
+   CONFIG_IP_NF_FTP=m<br>
-  # CONFIG_IP_NF_QUEUE is not set<br>
+   # CONFIG_IP_NF_QUEUE is not set<br>
-  CONFIG_IP_NF_IPTABLES=m<br>
+   CONFIG_IP_NF_IPTABLES=m<br>
-  CONFIG_IP_NF_MATCH_LIMIT=m<br>
+   CONFIG_IP_NF_MATCH_LIMIT=m<br>
-  CONFIG_IP_NF_MATCH_MAC=m<br>
+   CONFIG_IP_NF_MATCH_MAC=m<br>
-  CONFIG_IP_NF_MATCH_MARK=m<br>
+   CONFIG_IP_NF_MATCH_MARK=m<br>
-  CONFIG_IP_NF_MATCH_MULTIPORT=m<br>
+   CONFIG_IP_NF_MATCH_MULTIPORT=m<br>
-  CONFIG_IP_NF_MATCH_TOS=m<br>
+   CONFIG_IP_NF_MATCH_TOS=m<br>
-  # CONFIG_IP_NF_MATCH_TCPMSS is not set<br>
+   # CONFIG_IP_NF_MATCH_TCPMSS is not set<br>
-  CONFIG_IP_NF_MATCH_STATE=m<br>
+   CONFIG_IP_NF_MATCH_STATE=m<br>
-  # CONFIG_IP_NF_MATCH_UNCLEAN is not set<br>
+   # CONFIG_IP_NF_MATCH_UNCLEAN is not set<br>
-  # CONFIG_IP_NF_MATCH_OWNER is not set<br>
+   # CONFIG_IP_NF_MATCH_OWNER is not set<br>
-  CONFIG_IP_NF_FILTER=m<br>
+   CONFIG_IP_NF_FILTER=m<br>
-  CONFIG_IP_NF_TARGET_REJECT=m<br>
+   CONFIG_IP_NF_TARGET_REJECT=m<br>
-  # CONFIG_IP_NF_TARGET_MIRROR is not set<br>
+   # CONFIG_IP_NF_TARGET_MIRROR is not set<br>
-  CONFIG_IP_NF_NAT=m<br>
+   CONFIG_IP_NF_NAT=m<br>
-  CONFIG_IP_NF_NAT_NEEDED=m<br>
+   CONFIG_IP_NF_NAT_NEEDED=m<br>
-  CONFIG_IP_NF_TARGET_MASQUERADE=m<br>
+   CONFIG_IP_NF_TARGET_MASQUERADE=m<br>
-  CONFIG_IP_NF_TARGET_REDIRECT=m<br>
+   CONFIG_IP_NF_TARGET_REDIRECT=m<br>
-  CONFIG_IP_NF_NAT_FTP=m<br>
+   CONFIG_IP_NF_NAT_FTP=m<br>
-  CONFIG_IP_NF_MANGLE=m<br>
+   CONFIG_IP_NF_MANGLE=m<br>
-  CONFIG_IP_NF_TARGET_TOS=m<br>
+   CONFIG_IP_NF_TARGET_TOS=m<br>
-  CONFIG_IP_NF_TARGET_MARK=m<br>
+   CONFIG_IP_NF_TARGET_MARK=m<br>
-  CONFIG_IP_NF_TARGET_LOG=m<br>
+   CONFIG_IP_NF_TARGET_LOG=m<br>
-  CONFIG_IP_NF_TARGET_TCPMSS=m<br>
+   CONFIG_IP_NF_TARGET_TCPMSS=m<br>
-  # CONFIG_IPV6 is not set<br>
+   # CONFIG_IPV6 is not set<br>
-  </font></p>
+   </font></p>
+  </blockquote>
   
-</blockquote>
+<p><font size="2">Last updated 3/10/2002 - </font><font size="2"> <a
-
+ href="support.htm">Tom Eastep</a></font> </p>
-<p><font size="2">Last updated 3/10/2002 - </font><font size="2">
+ <a href="copyright.htm"><font size="2">Copyright</font> © <font
-<a href="support.htm">Tom
+ size="2">2001, 2002 Thomas M. Eastep.</font></a><br>
-Eastep</a></font> </p>
+</body>
-<a href="copyright.htm"><font size="2">Copyright</font>
+</html>
-© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></body></html>

STABLE/documentation/mailing_list.htm

@@ -16,62 +16,64 @@
 </head>
   <body>
                     
-<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
+<table height="90" bgcolor="#3366ff" id="AutoNumber1" width="100%"
  style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
  border="0">
-                                 <tbody>
+                                   <tbody>
-                                  <tr>
+                                    <tr>
-                                   <td width="33%" valign="middle"
+                                     <td width="33%" valign="middle"
  align="left">                                                          
                
       <h1 align="center"><a
  href="http://www.centralcommand.com/linux_products.html"><img
  src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
  height="79" align="left">
-                              </a></h1>
+                                </a></h1>
-                                                         <a
+                                                           <a
  href="http://www.gnu.org/software/mailman/mailman.html">         <img
  border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
  height="35" alt="">
-                                    </a>                                
+                                      </a>                              
                                        
       <p align="right"><font color="#ffffff"><b>      </b></font><a
  href="http://razor.sourceforge.net/"><img src="images/razor.gif"
  alt="(Razor Logo)" width="100" height="22" align="left" border="0">
-       </a>      </p>
+         </a>      </p>
-                                    </td>
+                                      </td>
-                      <td valign="middle" width="34%" align="center">   
+                        <td valign="middle" width="34%" align="center"> 
                                                                      
       <h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
-                      </td>
+                        </td>
-                      <td valign="middle" width="33%">                  
+                        <td valign="middle" width="33%">                
-        <a href="http://www.postfix.org/">       <img
+          <a href="http://www.postfix.org/">       <img
  src="images/postfix-white.gif" align="right" border="0" width="158"
  height="84" alt="(Postfix Logo)">
-                                    </a><br>
+                                      </a><br>
+                                                                        
        
       <div align="left"><a href="http://www.spamassassin.org"><img
  src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
  border="0">
-                   </a> </div>
+                     </a> </div>
-                   <br>
+                     <br>
+                                                                        
        
       <div align="right"><b><font color="#ffffff"><br>
-      </font></b><br>
+        </font></b><br>
-                      </div>
+                        </div>
-                      </td>
+                        </td>
-                                 </tr>
+                                   </tr>
                                          
   </tbody>          
 </table>
                      
 <h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
-    read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
+     read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
-    Guide</a>.<br>
+     Guide</a>.<br>
-        </h1>
+          </h1>
                    
 <p align="left">If you experience problems with any of these lists, please
-               let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
+                let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
                     
 <h2 align="left">Not able to Post Mail to shorewall.net?</h2>
                     
@@ -83,54 +85,47 @@ hotmail dot com.</p>
                      
 <p>Please note that the mail server                     at shorewall.net checks
 incoming mail:<br>
-                          </p>
+                            </p>
                     
 <ol>
-                            <li>against <a
+                              <li>against <a
  href="http://spamassassin.org">Spamassassin</a>          (including <a
  href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
-                    </li>
+                      </li>
-                            <li>to ensure that the sender address is fully
+                              <li>to ensure that the sender address is fully
- qualified.</li>
+  qualified.</li>
-                            <li>to verify that the sender's domain has an 
+                              <li>to verify that the sender's domain has
-A  or  MX  record    in  DNS.</li>
+an  A  or  MX  record    in  DNS.</li>
-                            <li>to ensure that the host name in the HELO/EHLO 
+                              <li>to ensure that the host name in the HELO/EHLO 
-  command    is  a  valid    fully-qualified  DNS name that resolves.</li>
+   command    is  a  valid    fully-qualified  DNS name that resolves.</li>
-    <li>to ensure that the sending system has a valid PTR record in DNS.</li>
        
 </ol>
-<big><font color="#cc0000"><b>This last point is important. If you run your
-own outgoing mail server and it doesn't have a valid DNS PTR record, your
-email won't reach the lists unless/until the postmaster notices that your
-posts are being rejected. To avoid this problem, you should configure your
-MTA to forward posts to shorewall.net through an MTA that <u>does</u> have
-a valid PTR record (such as the one at your ISP). </b></font></big><br>
                     
 <h2>Please post in plain text</h2>
-                    A growing number of MTAs serving list subscribers are 
+                      A growing number of MTAs serving list subscribers are 
-rejecting     all   HTML   traffic. At least one MTA has gone so far as to 
+ rejecting     all   HTML   traffic. At least one MTA has gone so far as to
-blacklist  shorewall.net     "for  continuous abuse" because it has been my
+ blacklist  shorewall.net     "for  continuous abuse" because it has been 
-policy to  allow HTML in  list   posts!!<br>
+my policy to  allow HTML in  list   posts!!<br>
-                    <br>
+                      <br>
-                    I think that blocking all HTML is a Draconian way to
+                      I think that blocking all HTML is a Draconian way to
-control     spam    and   that the ultimate losers here are not the spammers
+ control     spam    and   that the ultimate losers here are not the spammers
-but the    list subscribers      whose MTAs are bouncing all shorewall.net
+ but the    list subscribers      whose MTAs are bouncing all shorewall.net
-mail. As   one list subscriber   wrote  to me privately "These e-mail admin's
+ mail. As   one list subscriber   wrote  to me privately "These e-mail admin's
-need to  get a <i>(explitive   deleted)</i>  life instead of trying to rid
+ need to  get a <i>(explitive   deleted)</i>  life instead of trying to rid
-the planet  of HTML based e-mail".   Nevertheless,  to allow subscribers
+ the planet  of HTML based e-mail".   Nevertheless,  to allow subscribers
 to receive list   posts as must as possible,   I have now  configured the
 list server at shorewall.net   to strip all HTML   from outgoing  posts.
 This means that  HTML-only posts   will be bounced by  the list server.<br>
                     
 <p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
-                 </p>
+                   </p>
                     
 <h2>Other Mail Delivery Problems</h2>
-                  If you find that you are missing an occasional list post, 
+                    If you find that you are missing an occasional list post, 
- your   e-mail    admin  may be blocking mail whose <i>Received:</i> headers 
+  your   e-mail    admin  may be blocking mail whose <i>Received:</i> headers 
- contain   the names   of certain ISPs. Again, I believe that such policies 
+  contain   the names   of certain ISPs. Again, I believe that such policies 
- hurt more   than they  help but I'm not prepared to go so far as to start 
+  hurt more   than they  help but I'm not prepared to go so far as to start 
- stripping <i>Received:</i>      headers to circumvent those policies.<br>
+  stripping <i>Received:</i>      headers to circumvent those policies.<br>
                     
 <h2 align="left">Mailing Lists Archive Search</h2>
                     
@@ -142,12 +137,12 @@ This means that  HTML-only posts   will be bounced by  the list server.<br>
   <option value="or">Any </option>
   <option value="boolean">Boolean </option>
   </select>
-                              Format:                         
+                                Format:                               
   <select name="format">
   <option value="builtin-long">Long </option>
   <option value="builtin-short">Short </option>
   </select>
-                              Sort by:                         
+                                Sort by:                               
   <select name="sort">
   <option value="score">Score </option>
   <option value="time">Time </option>
@@ -156,46 +151,46 @@ This means that  HTML-only posts   will be bounced by  the list server.<br>
   <option value="revtime">Reverse Time </option>
   <option value="revtitle">Reverse Title </option>
   </select>
-                              </font> <input type="hidden" name="config"
+                                </font> <input type="hidden"
- value="htdig">    <input type="hidden" name="restrict"
+ name="config" value="htdig">    <input type="hidden" name="restrict"
  value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
  name="exclude" value=""> <br>
-                              Search: <input type="text" size="30"
+                                Search: <input type="text" size="30"
  name="words" value="">    <input type="submit" value="Search"> </p>
-                              </form>
+                                </form>
                      
 <h2 align="left"><font color="#ff0000">Please do not try to download the entire
 Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
 stand the traffic. If I catch you, you will be blacklisted.<br>
-                       </font></h2>
+                         </font></h2>
                     
 <h2 align="left">Shorewall CA Certificate</h2>
-                            If you want to trust X.509 certificates issued
+                              If you want to trust X.509 certificates issued
- by  Shoreline     Firewall     (such   as the one used on my web site),
+  by  Shoreline     Firewall     (such   as the one used on my web site),
 you  may  <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
-              in your browser. If you don't wish to trust my certificates
+               in your browser. If you don't wish to trust my certificates
-then     you    can    either use unencrypted access when subscribing to
+ then     you    can    either use unencrypted access when subscribing to
 Shorewall     mailing    lists    or you can use secure access (SSL) and
 accept the server's    certificate     when   prompted by your browser.<br>
                     
 <h2 align="left">Shorewall Users Mailing List</h2>
                     
 <p align="left">The Shorewall Users Mailing list provides a way for users
-               to get answers to questions and to report problems. Information
+                to get answers to questions and to report problems. Information
-     of   general       interest to the Shorewall user community is also
+      of   general       interest to the Shorewall user community is also
 posted      to  this list.</p>
                     
 <p align="left"><b>Before posting a problem report to this list, please see
-               the <a href="http://www.shorewall.net/support.htm">problem
+                the <a href="http://www.shorewall.net/support.htm">problem
-reporting      guidelines</a>.</b></p>
+ reporting      guidelines</a>.</b></p>
                     
 <p align="left">To subscribe to the mailing list:<br>
-              </p>
+                </p>
                     
 <ul>
-                <li><b>Insecure: </b><a
+                  <li><b>Insecure: </b><a
  href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
-                <li><b>SSL:</b> <a
+                  <li><b>SSL:</b> <a
  href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
  target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
                     
@@ -215,37 +210,37 @@ list may be found at <a
 <h2 align="left">Shorewall Announce Mailing List</h2>
                     
 <p align="left">This list is for announcements of general interest to the
-               Shorewall community. To subscribe:<br>
+                Shorewall community. To subscribe:<br>
-              </p>
+                </p>
                     
 <p align="left"></p>
                     
 <ul>
-                <li><b>Insecure:</b> <a
+                  <li><b>Insecure:</b> <a
  href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
-                <li><b>SSL</b>: <a
+                  <li><b>SSL</b>: <a
  href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
  target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
                     
 </ul>
                     
 <p align="left"><br>
-                            The list archives are at <a
+                              The list archives are at <a
  href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
                     
 <h2 align="left">Shorewall Development Mailing List</h2>
                     
 <p align="left">The Shorewall Development Mailing list provides a forum for
-               the exchange of ideas about the future of Shorewall and for
+                the exchange of ideas about the future of Shorewall and for
- coordinating             ongoing Shorewall Development.</p>
+  coordinating             ongoing Shorewall Development.</p>
                     
 <p align="left">To subscribe to the mailing list:<br>
-               </p>
+                 </p>
                     
 <ul>
-                <li><b>Insecure: </b><a
+                  <li><b>Insecure: </b><a
  href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
-                <li><b>SSL:</b> <a
+                  <li><b>SSL:</b> <a
  href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
  target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
                     
@@ -258,34 +253,34 @@ list may be found at <a
  href="http://lists.shorewall.net/pipermail/shorewall-devel">http://lists.shorewall.net/pipermail/shorewall-devel</a>.</p>
                     
 <h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
-               the  Mailing Lists</h2>
+                the  Mailing Lists</h2>
                     
 <p align="left">There seems to be near-universal confusion about unsubscribing
-                from Mailman-managed lists although Mailman 2.1 has attempted
+                 from Mailman-managed lists although Mailman 2.1 has attempted
-    to   make  this less confusing. To unsubscribe:</p>
+     to   make  this less confusing. To unsubscribe:</p>
                     
 <ul>
-                                 <li>                                   
+                                   <li>                                 
                  
     <p align="left">Follow the same link above that you used to subscribe
-               to the  list.</p>
+                to the  list.</p>
-                                 </li>
+                                   </li>
-                                 <li>                                   
+                                   <li>                                 
                  
     <p align="left">Down at the bottom of that page is the following text:
-               " 	To <b>unsubscribe</b> from <i>&lt;list name&gt;</i>, get
+                " 	To <b>unsubscribe</b> from <i>&lt;list name&gt;</i>, get
- a  password      reminder,         or change your subscription options enter
+  a  password      reminder,         or change your subscription options
-   your subscription              email address:". Enter your email  address
+enter     your subscription              email address:". Enter your email
-     in the box and click      on the "<b>Unsubscribe</b> or edit options"
+ address       in the box and click      on the "<b>Unsubscribe</b> or edit
- button.</p>
+options"   button.</p>
-                                 </li>
+                                   </li>
-                                 <li>                                   
+                                   <li>                                 
                  
     <p align="left">There will now be a box where you can enter your password
-               and  click on "Unsubscribe"; if you have forgotten your password,
+                and  click on "Unsubscribe"; if you have forgotten your password,
-       there      is  another  button that will cause your password to be
+        there      is  another  button that will cause your password to be
-emailed       to you.</p>
+ emailed       to you.</p>
-                                 </li>
+                                   </li>
                     
 </ul>
                     
@@ -294,11 +289,13 @@ emailed       to you.</p>
                     
 <p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
                     
-<p align="left"><font size="2">Last updated 6/14/2003 - <a
+<p align="left"><font size="2">Last updated 7/7/2003 - <a
  href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
                     
 <p align="left"><a href="copyright.htm"> <font size="2">Copyright</font> ©
 <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-</p>
+  </p>
+  <br>
+ <br>
 </body>
 </html>

STABLE/documentation/ping.html

@@ -12,181 +12,180 @@
       
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-        <tbody>
+          <tbody>
-         <tr>
+           <tr>
-          <td width="100%">       
+            <td width="100%">                     
       <h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
-          </td>
+            </td>
-        </tr>
+          </tr>
             
   </tbody>   
 </table>
-     <br>
+       <br>
-     Shorewall 'Ping' management has evolved over time with the latest change 
+       Shorewall 'Ping' management has evolved over time with the latest
- coming in Shorewall version 1.4.0. <br>
+change   coming in Shorewall version 1.4.0. To find out which version of
+Shorewall you are running, at a shell prompt type "<font color="#009900"><b>/sbin/shorewall 
+version</b></font>". If that command gives you an error, it's time to upgrade 
+since you have a very old version of Shorewall installed (1.2.4 or earlier).<br>
       
 <h2>Shorewall Versions &gt;= 1.4.0</h2>
-In Shoreall 1.4.0 and later version, ICMP echo-request's are treated just
+  In Shoreall 1.4.0 and later version, ICMP echo-request's are treated just
-like any other connection request.<br>
+ like any other connection request.<br>
-<br>
+  <br>
-  In order to accept ping requests from zone z1 to zone z2 where the policy 
+    In order to accept ping requests from zone z1 to zone z2 where the policy 
-for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the 
+ for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the 
-form:<br>
+ form:<br>
       
 <blockquote>ACCEPT&nbsp;&nbsp;&nbsp; <i>z1&nbsp;&nbsp;&nbsp; z2&nbsp;&nbsp;&nbsp; 
-   </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
+    </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-    Example: <br>
+      Example: <br>
-    <br>
+      <br>
-    To permit ping from the local zone to the firewall:<br>
+      To permit ping from the local zone to the firewall:<br>
       
 <blockquote>ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
- icmp&nbsp;&nbsp;&nbsp; 8<br>
+  icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-        If you would like to accept 'ping' by default even when the relevant 
+          If you would like to accept 'ping' by default even when the relevant 
- policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't 
+  policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't 
- already exist and in that file place the following command:<br>
+  already exist and in that file place the following command:<br>
       
 <blockquote>         
   <pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
-    </blockquote>
+      </blockquote>
-    With that rule in place, if you want to ignore 'ping' from z1 to z2 then 
+      With that rule in place, if you want to ignore 'ping' from z1 to z2 
- you need a rule of the form:<br>
+then   you need a rule of the form:<br>
       
 <blockquote>DROP&nbsp;&nbsp;&nbsp; <i>z1&nbsp;&nbsp;&nbsp; z2&nbsp;&nbsp;&nbsp; 
-   </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
+    </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-    Example:<br>
+      Example:<br>
+      <br>
+      To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
     <br>
-    To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
-  <br>
       
 <blockquote>DROP&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
- icmp&nbsp;&nbsp;&nbsp; 8<br>
+  icmp&nbsp;&nbsp;&nbsp; 8<br>
-  </blockquote>
+    </blockquote>
       
 <h2>Shorewall Versions &gt;= 1.3.14 &nbsp;and &lt; 1.4.0 with OLD_PING_HANDLING=No
-in /etc/shorewall/shorewall.conf</h2>
+ in /etc/shorewall/shorewall.conf</h2>
-    In 1.3.14, Ping handling was put under control of the rules and policies 
+      In 1.3.14, Ping handling was put under control of the rules and policies 
- just like any other connection request. In order to accept ping requests 
+  just like any other connection request. In order to accept ping requests 
-from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you
+ from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you
-need a rule in /etc/shoreall/rules of the form:<br>
+ need a rule in /etc/shoreall/rules of the form:<br>
       
 <blockquote>ACCEPT&nbsp;&nbsp;&nbsp; <i>z1&nbsp;&nbsp;&nbsp; z2&nbsp;&nbsp;&nbsp; 
-   </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
+    </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-    Example: <br>
+      Example: <br>
-    <br>
+      <br>
-    To permit ping from the local zone to the firewall:<br>
+      To permit ping from the local zone to the firewall:<br>
       
 <blockquote>ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
- icmp&nbsp;&nbsp;&nbsp; 8<br>
+  icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-        If you would like to accept 'ping' by default even when the relevant 
+          If you would like to accept 'ping' by default even when the relevant 
- policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't 
+  policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't 
- already exist and in that file place the following command:<br>
+  already exist and in that file place the following command:<br>
       
 <blockquote>         
   <pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
-    </blockquote>
+      </blockquote>
-    With that rule in place, if you want to ignore 'ping' from z1 to z2 then 
+      With that rule in place, if you want to ignore 'ping' from z1 to z2 
- you need a rule of the form:<br>
+then   you need a rule of the form:<br>
       
 <blockquote>DROP&nbsp;&nbsp;&nbsp; <i>z1&nbsp;&nbsp;&nbsp; z2&nbsp;&nbsp;&nbsp; 
-   </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
+    </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
-    Example:<br>
+      Example:<br>
-    <br>
+      <br>
-    To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
+      To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
       
 <blockquote>DROP&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
- icmp&nbsp;&nbsp;&nbsp; 8<br>
+  icmp&nbsp;&nbsp;&nbsp; 8<br>
-    </blockquote>
+      </blockquote>
       
 <blockquote>      </blockquote>
       
 <h2>Shorewall Versions &lt; 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
-    </h2>
+      </h2>
-    There are several aspects to the old Shorewall Ping management:<br>
+      There are several aspects to the old Shorewall Ping management:<br>
       
 <ol>
-       <li>The <b>noping</b> and <b>filterping </b>interface options in <a
+         <li>The <b>noping</b> and <b>filterping </b>interface options in 
- href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
+    <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
-       <li>The <b>FORWARDPING</b> option in<a
+         <li>The <b>FORWARDPING</b> option in<a
  href="Documentation.htm#Conf">  /etc/shorewall/shorewall.conf</a>.</li>
-       <li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
+         <li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
       
 </ol>
-     There are two cases to consider:<br>
+       There are two cases to consider:<br>
       
 <ol>
-       <li>Ping requests addressed to the firewall itself; and</li>
+         <li>Ping requests addressed to the firewall itself; and</li>
-       <li>Ping requests being forwarded to another system. Included here 
+         <li>Ping requests being forwarded to another system. Included here 
-are   all cases of packet forwarding including NAT, DNAT rule, Proxy ARP and
+ are   all cases of packet forwarding including NAT, DNAT rule, Proxy ARP 
-simple   routing.</li>
+and simple   routing.</li>
       
 </ol>
-     These cases will be covered separately.<br>
+       These cases will be covered separately.<br>
       
 <h3>Ping Requests Addressed to the Firewall Itself</h3>
-     For ping requests addressed to the firewall, the sequence is as follows:<br>
+       For ping requests addressed to the firewall, the sequence is as follows:<br>
       
 <ol>
-       <li>If neither <b>noping</b> nor <b>filterping </b>are specified for 
+         <li>If neither <b>noping</b> nor <b>filterping </b>are specified 
- the  interface that receives the ping request then the request will be responded 
+for   the  interface that receives the ping request then the request will 
-  to with an ICMP echo-reply.</li>
+be responded    to with an ICMP echo-reply.</li>
-       <li>If <b>noping</b> is specified for the interface that receives
+         <li>If <b>noping</b> is specified for the interface that receives
-the  ping request then the request is ignored.</li>
+ the  ping request then the request is ignored.</li>
-       <li>If <b>filterping </b>is specified for the interface then the request 
+         <li>If <b>filterping </b>is specified for the interface then the 
-  is passed to the rules/policy evaluation.</li>
+request    is passed to the rules/policy evaluation.</li>
       
 </ol>
       
 <h3>Ping Requests Forwarded by the Firewall</h3>
-     These requests are <b>always</b> passed to rules/policy evaluation.<br>
+       These requests are <b>always</b> passed to rules/policy evaluation.<br>
       
 <h3>Rules Evaluation</h3>
-     Ping requests are ICMP type 8. So the general rule format is:<br>
+       Ping requests are ICMP type 8. So the general rule format is:<br>
-     <br>
+       <br>
-     &nbsp;&nbsp;&nbsp; <i>Target&nbsp;&nbsp;&nbsp; Source&nbsp;&nbsp;&nbsp; 
+       &nbsp;&nbsp;&nbsp; <i>Target&nbsp;&nbsp;&nbsp; Source&nbsp;&nbsp;&nbsp; 
- Destination&nbsp;&nbsp;&nbsp; </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
+  Destination&nbsp;&nbsp;&nbsp; </i>icmp&nbsp;&nbsp;&nbsp; 8<br>
-     <br>
+       <br>
-     Example 1. Accept pings from the net to the dmz (pings are responded 
+       Example 1. Accept pings from the net to the dmz (pings are responded 
-to  with an ICMP echo-reply):<br>
+ to  with an ICMP echo-reply):<br>
-     <br>
+       <br>
-     &nbsp;&nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp; 
+       &nbsp;&nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-  icmp&nbsp;&nbsp;&nbsp; 8<br>
+dmz&nbsp;&nbsp;&nbsp;    icmp&nbsp;&nbsp;&nbsp; 8<br>
-     <br>
+       <br>
-     Example 2. Drop pings from the net to the firewall<br>
+       Example 2. Drop pings from the net to the firewall<br>
-     <br>
+       <br>
-     &nbsp;&nbsp;&nbsp; DROP&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
+       &nbsp;&nbsp;&nbsp; DROP&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; 
-  icmp&nbsp;&nbsp;&nbsp; 8<br>
+   icmp&nbsp;&nbsp;&nbsp; 8<br>
       
 <h3>Policy Evaluation</h3>
-     If no applicable rule is found, then the policy for the source to the 
+       If no applicable rule is found, then the policy for the source to
-destination  is applied.<br>
+the  destination  is applied.<br>
       
 <ol>
-       <li>If the relevant policy is ACCEPT then the request is responded 
+         <li>If the relevant policy is ACCEPT then the request is responded 
-to  with an ICMP echo-reply.</li>
+ to  with an ICMP echo-reply.</li>
-       <li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf 
+         <li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf 
-  then the request is responded to with an ICMP echo-reply.</li>
+   then the request is responded to with an ICMP echo-reply.</li>
-       <li>Otherwise, the relevant REJECT or DROP policy is used and the
+         <li>Otherwise, the relevant REJECT or DROP policy is used and the
-request   is either rejected or simply ignored.</li>
+ request   is either rejected or simply ignored.</li>
       
 </ol>
       
-<p><font size="2">Updated 5/4/2003 - <a href="support.htm">Tom Eastep</a> 
+<p><font size="2">Updated 7/7/2003 - <a href="support.htm">Tom Eastep</a> 
- </font></p>
+  </font></p>
       
 <p><a href="copyright.htm"><font size="2">Copyright</font>  &copy; <font
- size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
+ size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-      <br>
+ </p>
-     <br>
-    <br>
-   <br>
-  <br>
  <br>
 </body>
 </html>

STABLE/documentation/ports.htm

@@ -14,114 +14,121 @@
           
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-          <tbody>
+            <tbody>
-           <tr>
+             <tr>
-            <td width="100%">                     
+              <td width="100%">                                   
       <h1 align="center"><font color="#ffffff">Ports required for Various 
-   Services/Applications</font></h1>
+    Services/Applications</font></h1>
-            </td>
+              </td>
-          </tr>
+            </tr>
                     
   </tbody>     
 </table>
           
 <p>In addition to those applications described in <a
  href="Documentation.htm">the /etc/shorewall/rules documentation</a>, here 
-   are some other services/applications that you may need to configure your 
+    are some other services/applications that you may need to configure your 
-  firewall to accommodate.</p>
+   firewall to accommodate.</p>
           
 <p>NTP (Network Time Protocol)</p>
           
 <blockquote>               
   <p>UDP Port 123</p>
-        </blockquote>
+          </blockquote>
           
 <p>rdate</p>
           
 <blockquote>               
   <p>TCP Port 37</p>
-        </blockquote>
+          </blockquote>
           
 <p>UseNet (NNTP)</p>
           
 <blockquote>               
   <p>TCP Port 119</p>
-        </blockquote>
+          </blockquote>
           
 <p>DNS</p>
           
 <blockquote>               
   <p>UDP Port 53. If you are configuring a DNS client, you will probably want
 to   open TCP Port 53 as well.<br>
-          If you are configuring a server, only open TCP Port 53 if you will 
+            If you are configuring a server, only open TCP Port 53 if you 
- return  long   replies to queries or if you need to enable ZONE transfers. In 
+will   return  long   replies to queries or if you need to enable ZONE transfers. In 
- the  latter   case, be sure that your server is properly configured.</p>
+  the  latter   case, be sure that your server is properly configured.</p>
-        </blockquote>
+          </blockquote>
           
 <p>ICQ   </p>
           
 <blockquote>               
   <p>UDP Port 4000. You will also need to open a range of TCP ports which 
-   you   can specify to your ICQ client. By default, clients use 4000-4100.</p>
+    you   can specify to your ICQ client. By default, clients use 4000-4100.</p>
-        </blockquote>
+          </blockquote>
           
 <p>PPTP</p>
           
 <blockquote>               
   <p><u>Protocol</u> 47 (NOT <u>port</u> 47) and TCP Port 1723 (<a
  href="PPTP.htm">Lots more   information here</a>).</p>
-        </blockquote>
+          </blockquote>
           
 <p>IPSEC</p>
           
 <blockquote>               
   <p><u>Protocols</u> 50 and 51 (NOT <u>ports</u> 50 and 51) and UDP Port 
-   500.    These should be opened in both directions (Lots more information 
+    500.    These should be opened in both directions (Lots more information 
-    <a href="IPSEC.htm">here</a> and <a href="VPN.htm">here</a>).</p>
+     <a href="IPSEC.htm">here</a> and <a href="VPN.htm">here</a>).</p>
-        </blockquote>
+          </blockquote>
           
-<p>SMTP</p>
+<p>SMTP (Email)</p>
           
 <blockquote>               
   <p> TCP Port 25.</p>
-        </blockquote>
+          </blockquote>
           
 <p>RealPlayer<br>
-</p>
+  </p>
+   
 <blockquote>      
   <p>UDP Port 6790 inbound<br>
-  </p>
+    </p>
-</blockquote>
+  </blockquote>
+   
 <p>POP3</p>
           
 <blockquote>               
-  <p>TCP Port 110.</p>
+  <p>TCP Port 110 (Secure = TCP Port 995)<br>
-        </blockquote>
+  </p>
+</blockquote>
+<p>IMAP<br>
+</p>
+<blockquote>TCP Port 143 (Secure = TCP Port 993)<br>
+</blockquote>
                     
 <p>TELNET</p>
           
 <blockquote>               
   <p>TCP Port 23.</p>
-        </blockquote>
+          </blockquote>
           
 <p>SSH</p>
           
 <blockquote>               
   <p>TCP Port 22.</p>
-        </blockquote>
+          </blockquote>
           
 <p>Auth (identd)</p>
           
 <blockquote>               
   <p>TCP Port 113</p>
-        </blockquote>
+          </blockquote>
           
 <p>Web Access</p>
           
 <blockquote>               
   <p>TCP Ports 80 and 443.</p>
-        </blockquote>
+          </blockquote>
           
 <p>FTP</p>
           
@@ -130,51 +137,51 @@ to   open TCP Port 53 as well.<br>
  href="Documentation.htm#Rules">the   /etc/shorewall/rules documentation</a>,</p>
                     
   <p>For a client, you must open outbound TCP port 21 and be sure that your 
-     kernel is compiled to support FTP connection tracking. If you build this
+      kernel is compiled to support FTP connection tracking. If you build 
-     support as a module, Shorewall will automatically load the module from
+this      support as a module, Shorewall will automatically load the module 
-    /var/lib/&lt;<i>kernel version</i>&gt;/kernel/net/ipv4/netfilter. <br>
+from     /var/lib/&lt;<i>kernel version</i>&gt;/kernel/net/ipv4/netfilter. <br>
-         </p>
+           </p>
                     
   <p>If you run an FTP server on a nonstandard port or you need to access 
-  such a server, then you must specify that port in /etc/shorewall/modules. 
+   such a server, then you must specify that port in /etc/shorewall/modules. 
-  For example, if you run an FTP server that listens on port 49 then you would
+   For example, if you run an FTP server that listens on port 49 then you 
-  have:<br>
+would   have:<br>
-         </p>
+           </p>
                     
   <blockquote>                         
     <p>loadmodule ip_conntrack_ftp ports=21,49<br>
-       loadmodule ip_nat_ftp ports=21,49<br>
+         loadmodule ip_nat_ftp ports=21,49<br>
-           </p>
+             </p>
-         </blockquote>
+           </blockquote>
                     
   <p>Note that you MUST include port 21 in the <i>ports</i> list or you may 
-  have problems accessing regular FTP servers.</p>
+   have problems accessing regular FTP servers.</p>
                     
   <p>If there is a possibility that these modules might be loaded before Shorewall
 starts, then you should include the port list in /etc/modules.conf:<br>
-         </p>
+           </p>
                     
   <blockquote>                         
     <p>options ip_conntrack_ftp ports=21,49<br>
-       options ip_nat_ftp ports=21,49<br>
+         options ip_nat_ftp ports=21,49<br>
-      </p>
+        </p>
-    </blockquote>
+      </blockquote>
                
   <p><b>IMPORTANT: </b>Once you have made these changes to /etc/shorewall/modules
- and/or /etc/modules.conf, you must either:<br>
+  and/or /etc/modules.conf, you must either:<br>
-    </p>
+      </p>
                
   <ol>
-      <li>Unload the modules and restart shorewall: (<b><font
+        <li>Unload the modules and restart shorewall: (<b><font
  color="#009900">rmmod ip_nat_ftp; rmmod ip_conntrack_ftp; shorewall restart</font></b>);
- or</li>
+  or</li>
-      <li>Reboot<br>
+        <li>Reboot<br>
-      </li>
+        </li>
                
   </ol>
                
   <p>         </p>
-         </blockquote>
+           </blockquote>
        
 <blockquote>     </blockquote>
           
@@ -184,57 +191,52 @@ starts, then you should include the port list in /etc/modules.conf:<br>
           
 <blockquote>               
   <p>TCP Ports 137, 139 and 445.<br>
-          UDP Ports 137-139.<br>
+            UDP Ports 137-139.<br>
-          <br>
+            <br>
-          Also, <a href="samba.htm">see this page</a>.</p>
+            Also, <a href="samba.htm">see this page</a>.</p>
-        </blockquote>
+          </blockquote>
           
 <p>Traceroute</p>
           
 <blockquote>               
-  <p>UDP ports 33434 through 33434+<i>&lt;max number of hops&gt;</i>-1</p>
+  <p>UDP ports 33434 through 33434+<i>&lt;max number of hops&gt;</i>-1<br>
-        </blockquote>
+ICMP type 8 ('ping')<br>
+  </p>
+          </blockquote>
           
 <p>NFS<br>
-    </p>
+      </p>
           
 <blockquote>               
   <p>I personally use the following rules for opening access from zone z1 
- to a server with IP address a.b.c.d in zone z2:<br>
+  to a server with IP address a.b.c.d in zone z2:<br>
-      </p>
+        </p>
                     
   <pre>ACCEPT	z1	z2:a.b.c.d	udp	111<br>ACCEPT	z1	z2:a.b.c.d	tcp	111<br>ACCEPT	z1	z2:a.b.c.d	udp	2049<br>ACCEPT	z1	z2:a.b.c.d	udp	32700:<br></pre>
-    </blockquote>
+      </blockquote>
           
 <blockquote>               
   <p>Note that my rules only cover NFS using UDP (the normal case). There 
- is lots of additional information at    <a
+  is lots of additional information at    <a
  href="http://nfs.sourceforge.net/nfs-howto/security.html">   http://nfs.sourceforge.net/nfs-howto/security.html</a></p>
-        </blockquote>
+          </blockquote>
           
 <p>VNC<br>
- </p>
+   </p>
      
 <blockquote>         
   <p>TCP port 5900 + &lt;display number&gt;</p>
- </blockquote>
+   </blockquote>
      
 <p>Didn't find what you are looking for -- have you looked in your own /etc/services
- file? </p>
+  file? </p>
           
 <p>Still looking? Try   <a
  href="http://www.networkice.com/advice/Exploits/Ports">   http://www.networkice.com/advice/Exploits/Ports</a></p>
           
-<p><font size="2">Last updated 5/5/2003 - </font><font size="2"> <a
+<p><font size="2">Last updated 7/16/2003 - </font><font size="2"> <a
  href="support.htm">Tom Eastep</a></font> </p>
-        <a href="copyright.htm"><font size="2">Copyright</font>   © <font
+          <a href="copyright.htm"><font size="2">Copyright</font>   © <font
  size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
-       <br>
-      <br>
-     <br>
-    <br>
-   <br>
-  <br>
- <br>
 </body>
 </html>

STABLE/documentation/quotes.htm

@@ -16,93 +16,102 @@
     
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-     <tbody>
+       <tbody>
-      <tr>
+        <tr>
-       <td width="100%">
+         <td width="100%">              
       <h1 align="center"><font color="#ffffff">Quotes from Shorewall Users</font></h1>
-       </td>
+         </td>
-     </tr>
+       </tr>
         
   </tbody>  
 </table>
+   <font size="3">"I have fought with IPtables for untold hours. First I
+tried the SuSE firewall, which worked for 80% of what I needed. Then gShield,
+which also worked for 80%. Then I set out to write my own IPtables parser
+in shell and awk, which was a lot of fun but never got me past the "hey,
+cool" stage. Then I discovered Shorewall. After about an hour, everything
+just worked. I am stunned, and very grateful"</font> -- ES, Phoenix AZ, USA.<br>
  
 <p>"The configuration is intuitive and flexible, and much easier than any
-of the other iptables-based firewall programs out there. After sifting through
+ of the other iptables-based firewall programs out there. After sifting through
-many other scripts, it is obvious that yours is the most well thought-out
+ many other scripts, it is obvious that yours is the most well thought-out
-and complete one available." -- BC, USA</p>
+ and complete one available." -- BC, USA</p>
+   
 <p>"I just installed Shorewall after weeks of messing with       ipchains/iptables
- and I had it up and running in under 20 minutes!"       -- JL, Ohio<br>
+  and I had it up and running in under 20 minutes!"       -- JL, Ohio<br>
-  </p>
+    </p>
-  "My case was almost like [the one above]. Well. instead of 'weeks' it was
+    "My case was almost like [the one above]. Well. instead of 'weeks' it 
- 'months' for me, and I think I needed two minutes more:<br>
+was  'months' for me, and I think I needed two minutes more:<br>
     
 <ul>
-    <li>One to see that I had no Internet access from the firewall itself.</li>
+      <li>One to see that I had no Internet access from the firewall itself.</li>
-    <li>Other to see that this was the default configuration, and it was
+      <li>Other to see that this was the default configuration, and it was
-enough  to uncomment a line in /etc/shorewall/policy.<br>
+ enough  to uncomment a line in /etc/shorewall/policy.<br>
-    </li>
+      </li>
     
 </ul>
-  Minutes instead of months! Congratulations and thanks for such a simple
+    Minutes instead of months! Congratulations and thanks for such a simple
-and well documented thing for something as huge as iptables." -- JV, Spain.
+ and well documented thing for something as huge as iptables." -- JV, Spain.
    
 <p>"I downloaded Shorewall 1.2.0 and installed it on Mandrake 8.1       without
- any problems. Your documentation is great and I really appreciate
+  any problems. Your documentation is great and I really appreciate your
-your  network configuration info. That really helped me out alot.       THANKS!!!"
+ network configuration info. That really helped me out alot.       THANKS!!!"
- -- MM.           </p>
+  -- MM.           </p>
     
 <p>"[Shorewall is a] great, great project. I've used/tested may       firewall
- scripts but this one is till now the best." -- B.R,       Netherlands
+  scripts but this one is till now the best." -- B.R,       Netherlands 
-        </p>
+       </p>
     
 <p>"Never in my +12 year career as a sys admin have I witnessed       someone
- so relentless in developing a secure, state of the art, safe and       useful
+  so relentless in developing a secure, state of the art, safe and      
- product as the Shorewall firewall package for no cost or obligation
+useful   product as the Shorewall firewall package for no cost or obligation
   involved." -- Mario Kerecki, Toronto           </p>
     
-<p>"one time more to report, that your great shorewall in the latest
+<p>"one time more to report, that your great shorewall in the latest    release 
-   release       1.2.9 is working fine for me with SuSE Linux 7.3! I now
+      1.2.9 is working fine for me with SuSE Linux 7.3! I now have 7 machines 
-have 7 machines up       and running with shorewall on several versions -
+up       and running with shorewall on several versions - starting with 1.2.2 
-starting with 1.2.2 up to       the new 1.2.9 and I never have encountered
+up to       the new 1.2.9 and I never have encountered any problems!" -- SM,
-any problems!" -- SM, Germany</p>
+Germany</p>
     
 <p>"You have the best support of any other package I've ever       used."
- -- SE, US           </p>
+  -- SE, US           </p>
     
 <p>"Because our company has information which has been classified by the
  national government as secret, our security doesn't stop by putting a fence
-  around our company. Information security is a hot issue. We also make use
+   around our company. Information security is a hot issue. We also make
- of  checkpoint firewalls, but not all of the internet servers are guarded
+use   of  checkpoint firewalls, but not all of the internet servers are guarded
- by  checkpoint, some of them are running....Shorewall." -- Name withheld
+  by  checkpoint, some of them are running....Shorewall." -- Name withheld
-by request,  Europe</p>
+ by request,  Europe</p>
     
 <p>"thanx for all your efforts you put into shorewall - this product stands
- out  against a lot of commercial stuff i´ve been working with in terms of
+  out  against a lot of commercial stuff i´ve been working with in terms
-  flexibillity, quality &amp; support" -- RM, Austria</p>
+of    flexibillity, quality &amp; support" -- RM, Austria</p>
     
 <p>"I have never seen such a complete firewall package that is so easy to
-  configure. I searched the Debian package system for firewall scripts and
+   configure. I searched the Debian package system for firewall scripts and
-  Shorewall won hands down." -- RG, Toronto</p>
+   Shorewall won hands down." -- RG, Toronto</p>
     
 <p>"My respects... I've just found and installed Shorewall 1.3.3-1 and it
- is a  wonderful piece of software. I've just sent out an email to about
+  is a  wonderful piece of software. I've just sent out an email to about
 30  people  recommending it. :-)<br>
-   While I had previously taken the time (maybe 40 hours) to really understand
+     While I had previously taken the time (maybe 40 hours) to really understand
-  ipchains, then spent at least an hour per server customizing and carefully
+   ipchains, then spent at least an hour per server customizing and carefully
-  scrutinizing firewall rules, I've got shorewall running on my home firewall,
+   scrutinizing firewall rules, I've got shorewall running on my home firewall,
-  with rulesets and policies that I know make sense, in under 20 minutes."
+   with rulesets and policies that I know make sense, in under 20 minutes."
- -- RP,  Guatamala<br>
+  -- RP,  Guatamala<br>
-   <br>
+     <br>
-    </p>
+      </p>
     
-<p><font size="2" face="Century Gothic, Arial, Helvetica">Updated 3/18/2003
+<p><font size="2" face="Century Gothic, Arial, Helvetica">Updated 7/1/2003
- - <a href="support.htm">Tom Eastep</a>      </font>
+  - <a href="support.htm">Tom Eastep</a>      </font>                   
-                        </p>
+     </p>
     
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
-  © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+   © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+      <br>
     <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/samba.htm

@@ -1,98 +1,114 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-
 <head>
-<meta http-equiv="Content-Language" content="en-us">
+ 
-<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
+  <meta http-equiv="Content-Language" content="en-us">
-<meta name="ProgId" content="FrontPage.Editor.Document">
+ 
-<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-<title>Samba</title>
+ 
+  <meta name="ProgId" content="FrontPage.Editor.Document">
+ 
+  <meta http-equiv="Content-Type"
+ content="text/html; charset=windows-1252">
+  <title>Samba</title>
 </head>
+  <body>
   
-<body>
+<table border="0" cellpadding="0" cellspacing="0"
+ style="border-collapse: collapse;" bordercolor="#111111" width="100%"
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
+   <tbody>
+    <tr>
+     <td width="100%">     
+      <h1 align="center"><font color="#ffffff">Samba</font></h1>
+     </td>
+   </tr>
  
-<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
+  </tbody>
-  <tr>
-    <td width="100%">
-    <h1 align="center"><font color="#FFFFFF">Samba</font></h1>
-    </td>
-  </tr>
 </table>
+ 
 <p>If you wish to run Samba on your firewall and access shares between the 
 firewall and local hosts, you need the following rules:</p>
+ 
 <h4>/etc/shorewall/rules:</h4>
-<blockquote>
+ 
-  <table border="2" cellpadding="2" style="border-collapse: collapse">
+<blockquote>   <font face="Century Gothic, Arial, Helvetica">          </font>
-  <tr>
+  <table border="2" cellpadding="2" style="border-collapse: collapse;">
-    <font face="Century Gothic, Arial, Helvetica">
+   <tbody>
-         <td><b>ACTION</b></td>
+      <tr>
-         <td><b>SOURCE</b></td>
+     <td><b>ACTION</b></td>
-         <td><b>DEST</b></td>
+          <td><b>SOURCE</b></td>
-         <td><b>
+          <td><b>DEST</b></td>
-  PROTO</b></td>
+          <td><b>   PROTO</b></td>
-         <td><b>DEST<br>
+          <td><b>DEST<br>
-  PORT(S)</b></td>
+   PORT(S)</b></td>
-         <td><b>SOURCE<br>
+          <td><b>SOURCE<br>
-         PORT(S)</b></td>
+          PORT(S)</b></td>
-         <td><b>ORIGINAL<br>
+          <td><b>ORIGINAL<br>
-         DEST</b></td>
+          DEST</b></td>
-    </font>
+        </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>udp</td>
-    <td>udp</td>
+     <td>137:139</td>
-    <td>137:139</td>
+     <td> </td>
-    <td>&nbsp;</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>tcp</td>
-    <td>tcp</td>
+     <td>137,139</td>
-    <td>137,139</td>
+     <td> </td>
-    <td>&nbsp;</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>udp</td>
-    <td>udp</td>
+     <td>1024:</td>
-    <td>1024:</td>
+     <td>137</td>
-    <td>137</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>udp</td>
-    <td>udp</td>
+     <td>137:139</td>
-    <td>137:139</td>
+     <td> </td>
-    <td>&nbsp;</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>tcp</td>
-    <td>tcp</td>
+     <td>137,139</td>
-    <td>137,139</td>
+     <td> </td>
-    <td>&nbsp;</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+   <tr>
-  <tr>
+     <td>ACCEPT</td>
-    <td>ACCEPT</td>
+     <td>loc</td>
-    <td>loc</td>
+     <td>fw</td>
-    <td>fw</td>
+     <td>udp</td>
-    <td>udp</td>
+     <td>1024:</td>
-    <td>1024:</td>
+     <td>137</td>
-    <td>137</td>
+     <td> </td>
-    <td>&nbsp;</td>
+   </tr>
-  </tr>
+ 
-</table>
+    </tbody>
-</blockquote>
+  </table>
-<p><font size="2">Last modified 5/29/2002 - <a href="support.htm">Tom
+ </blockquote>
-Eastep</a></font><p><font face="Trebuchet MS"><a href="copyright.htm">
+ 
-<font size="2">Copyright</font> © <font size="2">2002 Thomas M. Eastep.</font></a></font></body></html>
+<p><font size="2">Last modified 5/29/2002 - <a href="support.htm">Tom Eastep</a></font></p>
+<p><font face="Trebuchet MS"><a href="copyright.htm"> <font size="2">Copyright</font>
+© <font size="2">2002 Thomas M. Eastep.</font></a></font></p>
+<br>
+</body>
+</html>

STABLE/documentation/seattlefirewall_index.htm

@@ -3,66 +3,93 @@
 <head>
                                                                         
                                                                         
+                                                       
   <meta http-equiv="Content-Type"
  content="text/html; charset=windows-1252">
   <title>Shoreline Firewall (Shorewall) 1.4</title>
                                                                         
                                                                         
-                  <base target="_self">
+                                                                        
+         <base target="_self">
 </head>
   <body>
                                                                         
-<table border="0" cellpadding="0" cellspacing="4"
+                            
+<table cellpadding="0" cellspacing="4"
  style="border-collapse: collapse;" width="100%" id="AutoNumber3"
- bgcolor="#4b017c">
+ bgcolor="#3366ff">
                                                                         
-           <tbody>
+                           <tbody>
                                                                         
-          <tr>
+                          <tr>
                                                                         
-                     <td width="33%" height="90" valign="middle"
+                                     <td width="33%" height="90"
- align="left"><a href="http://www.cityofshoreline.com"><img
+ valign="middle" align="left"><a href="http://www.cityofshoreline.com"><img
  src="images/washington.jpg" alt="" width="97" height="80" hspace="4"
  border="0">
-          </a></td>
+                          </a></td>
-          <td valign="middle" width="34%" align="center">               
+                          <td valign="middle" width="34%" align="center"
+ bgcolor="#3366ff">                                                     
                                                                         
                                                                         
                                                                         
-      <h1><font color="#ffffff">Shorewall 1.4</font><i><font
+                                                                        
- color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i></h1>
+                 
-          </td>
+      <div align="center">                                              
-          <td valign="middle">                            
+                                                                        
+                                                                        
+                                                                        
+                                              <img
+ src="images/Logo1.png" alt="(Shorewall Logo)" width="430" height="90">
+       </div>
+            </td>
+                          <td valign="middle" width="33%">              
+                                                                        
+                                                    
       <h1 align="center"><a href="http://www.shorewall.net"
  target="_top"><img border="0" src="images/shorewall.jpg" width="119"
  height="38" hspace="4" alt="(Shorewall Logo)" align="right" vspace="4">
-                                                               </a></h1>
+                                                                        
-          <br>
+            </a></h1>
-          </td>
+                          <br>
-                                   </tr>
+                          </td>
+                                                   </tr>
+                                                                        
                                                                         
                                          
   </tbody>                                               
 </table>
                                                                         
+                            
 <div align="center">      
+<div align="center">                                            </div>
+           
 <center>      
+<div align="center">                                            </div>
+           
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber4">
                                                                         
-             <tbody>
+                             <tbody>
                                                                         
-          <tr>
+                          <tr>
                                                                         
-                       <td width="90%">                                 
+                                       <td width="90%">                 
+                       
+      <div align="center">                                              
                                                                         
                                                                         
                                                                         
+                                              <br>
+            </div>
+                                               
       <h2 align="left">What is it?</h2>
                                                                         
                                                                         
                                                                         
                                                                         
+                                                                        
+                                      
       <p>The Shoreline Firewall, more commonly known as "Shorewall",  is a
       <a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
        that can be used on a dedicated firewall system, a multi-function 
@@ -71,29 +98,35 @@
                                                                         
                                                                         
                                                                         
+                                                                        
+                                      
       <p>This program is free software; you can redistribute it and/or modify 
-                                                                       it 
+                                                                         
-       under      the    terms      of         <a
+     it          under      the    terms      of         <a
  href="http://www.gnu.org/licenses/gpl.html">Version           2 of  the GNU
 General Public License</a> as published by the Free   Software          
  Foundation.<br>
                                                                         
-                    <br>
+                                    <br>
                                                                         
-         This     program         is   distributed            in   the  
+                         This     program         is   distributed      
-  hope       that      it   will        be  useful,    but          WITHOUT
+     in    the       hope       that      it   will        be  useful,  
-    ANY         WARRANTY;         without           even the   implied  
+ but            WITHOUT        ANY         WARRANTY;         without    
-   warranty          of MERCHANTABILITY                   or  FITNESS   
+      even  the    implied      warranty          of MERCHANTABILITY    
- FOR   A  PARTICULAR          PURPOSE.        See the     GNU  General  
+              or  FITNESS     FOR   A  PARTICULAR          PURPOSE.     
-  Public  License                for   more details.<br>
+  See the     GNU  General     Public  License                for   more
+details.<br>
+                                                                        
+                                    <br>
+                                                                        
+                         You     should       have     received        a
+  copy       of    the       GNU     General          Public         License
+                 along       with    this   program;            if   not,
+   write      to    the    Free   Software              Foundation,     
+             Inc.,    675     Mass   Ave,  Cambridge,      MA    02139, 
+     USA</p>
                                                                         
-                    <br>
                                                                         
-         You     should       have     received        a   copy     of  
-the       GNU     General          Public         License               
- along       with    this   program;            if   not,    write  to  
- the    Free   Software              Foundation,                   Inc.,
- 675     Mass   Ave,  Cambridge,      MA    02139,       USA</p>
                                                                         
                                                                         
                                                                         
@@ -107,19 +140,39 @@ the       GNU     General          Public         License
                                                                         
                                                                         
                                                                         
+                                                                        
+                                   
+      <h2>This is the Shorewall 1.4 Web Site</h2>
+    The information on this site applies only to 1.4.x releases of Shorewall.
+  For older versions:<br>
+                                                                 
+      <ul>
+                <li>The 1.3 site is <a
+ href="http://www.shorewall.net/1.3" target="_top">here.</a></li>
+                <li>The 1.2 site is <a href="http://shorewall.net/1.2/"
+ target="_top">here</a>.<br>
+           </li>
+                                                               
+      </ul>
+                                                               
+      <h2>Getting Started with Shorewall</h2>
+                                        New to Shorewall? Start by selecting
+  the         <a href="shorewall_quickstart_guide.htm">QuickStart  Guide</a>
+  that   most closely               match your environment and follow the
+step  by   step instructions.<br>
+                                                                         
+     
+      <h2>Looking for Information?</h2>
+          The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
+     Index</a> is a good place to start as is the Quick Search to your right.
+                                                                        
       <h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
-              If so, almost <b>NOTHING </b>on this site will apply directly 
+                              If so, the documentation<b> </b>on this site
- to  your   setup.  If you want to use the documentation that you find here,
+ will   not   apply   directly   to  your   setup.  If you want to use the
-  it  is best   if you  uninstall what you have and install a setup that
+ documentation     that you  find here, you will want to consider uninstalling
-matches    the documentation    on this site. See the <a
+ what you have     and installing  a setup that matches    the documentation
- href="two-interface.htm">Two-interface    QuickStart    Guide</a> for details.<br>
+    on this site.     See the <a href="two-interface.htm">Two-interface 
-                                                                        
+  QuickStart    Guide</a>     for details.<br>
-                                      
-      <h2> Getting Started with Shorewall</h2>
-                        New to Shorewall? Start by selecting the <a
- href="shorewall_quickstart_guide.htm">QuickStart  Guide</a> that most closely 
-          match your environment and follow the step by  step instructions.<br>
-                                                                        
                                                                          
      
       <h2>News</h2>
@@ -127,226 +180,306 @@ matches    the documentation    on this site. See the <a
                                                                         
                                                                         
                                                                         
-      <p><b>6/17/2003 - Shorewall-1.4.5</b><b>       </b><b><img
+                                                                        
- border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
+                                          
-                       </b></p>
+      <ol>
+                                                                        
+                                      
+      </ol>
+                                                                        
+                                                                        
+                       
+      <p><b>7/20/2003 - Shorewall-1.4.6</b><b> <img border="0"
+ src="images/new10.gif" width="28" height="12" alt="(New)">
+             <br>
+             </b></p>
+                                                                        
+                                             
+      <blockquote>                </blockquote>
+                                                                       
+      <p><b>Problems Corrected:</b><br>
+           </p>
+                                                                        
+   
+      <ol>
+                 <li>A problem seen on RH7.3 systems where Shorewall encountered
+    start  errors when started using the "service" mechanism has been worked
+   around.<br>
+               <br>
+             </li>
+                 <li>Where a list of IP addresses appears in the DEST column
+  of  a  DNAT[-]  rule, Shorewall incorrectly created multiple DNAT rules
+in  the  nat  table (one for each element in the list). Shorewall now correctly
+  creates   a single DNAT rule with multiple "--to-destination" clauses.<br>
+              <br>
+          </li>
+                 <li>Corrected a problem in Beta 1 where DNS names containing 
+  a  "-"  were mis-handled when they appeared in the DEST column of a rule.<br>
+                  <br>
+                </li>
+                <li>A number of problems with rule parsing have been corrected. 
+   Corrections involve the handling of "z1!z2" in the SOURCE column as well 
+  as lists in the ORIGINAL DESTINATION column.<br>
+          <br>
+        </li>
+        <li>The message "Adding rules for DHCP" is now suppressed if there
+are no DHCP rules to add.<br>
+        </li>
+                                                                       
+      </ol>
+                                                                        
+   
+      <p><b>Migration Issues:</b><br>
+          </p>
+                                                                        
+      <ol>
+                 <li>In earlier versions, an undocumented feature allowed 
+entries     in the host file as follows:<br>
+              <br>
+              z    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
+              <br>
+          This capability was never documented and has been removed in 1.4.6
+  to  allow  entries of the following format:<br>
+              <br>
+              z   eth1:192.168.1.0/24,192.168.2.0/24<br>
+              <br>
+            </li>
+                 <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options
+ have   been  removed from /etc/shorewall/shorewall.conf. These capabilities
+ are  now automatically  detected by Shorewall (see below).<br>
+            </li>
+                                                                       
+      </ol>
+                                                                        
+      <p><b>New Features:</b><br>
+           </p>
+                                                                        
+   
+      <ol>
+                 <li>A 'newnotsyn' interface option has been added. This
+option    may  be specified in /etc/shorewall/interfaces and overrides the
+setting   NEWNOTSYN=No  for packets arriving on the associated interface.<br>
+               <br>
+             </li>
+                 <li>The means for specifying a range of IP addresses in
+/etc/shorewall/masq      to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes
+is enabled for   address   ranges.<br>
+               <br>
+             </li>
+                 <li>Shorewall can now add IP addresses to subnets other
+than   the   first  one on an interface.<br>
+               <br>
+             </li>
+                 <li>DNAT[-] rules may now be used to load balance (round-robin)
+    over a  set of servers. Servers may be specified in a range of addresses
+    given as &lt;first address&gt;-&lt;last address&gt;.<br>
+               <br>
+           Example:<br>
+               <br>
+               DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
+               <br>
+             </li>
+                 <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
+    options  have been removed and have been replaced by code that detects
+ whether   these  capabilities are present in the current kernel. The output
+ of the  start, restart and check commands have been enhanced to report the
+ outcome:<br>
+               <br>
+           Shorewall has detected the following iptables/netfilter capabilities:<br>
+              NAT: Available<br>
+              Packet Mangling: Available<br>
+              Multi-port Match: Available<br>
+           Verifying Configuration...<br>
+               <br>
+             </li>
+                 <li>Support for the Connection Tracking Match Extension
+has   been   added.  This extension is available in recent kernel/iptables
+releases   and   allows  for rules which match against elements in netfilter's
+connection    tracking  table. Shorewall automatically detects the availability
+of this    extension  and reports its availability in the output of the start,
+restart    and check  commands.<br>
+               <br>
+           Shorewall has detected the following iptables/netfilter capabilities:<br>
+              NAT: Available<br>
+              Packet Mangling: Available<br>
+              Multi-port Match: Available<br>
+              Connection Tracking Match: Available<br>
+           Verifying Configuration...<br>
+               <br>
+           If this extension is available, the ruleset generated by Shorewall 
+  is  changed  in the following ways:</li>
+                                                                        
+                
+        <ul>
+                   <li>To handle 'norfc1918' filtering, Shorewall will not
+ create    chains  in the mangle table but will rather do all 'norfc1918'
+filtering   in the filter  table (rfc1918 chain).</li>
+                   <li>Recall that Shorewall DNAT rules generate two netfilter
+   rules;  one  in the nat table and one in the filter table. If the Connection
+   Tracking  Match Extension is available, the rule in the filter table is
+ extended  to  check that the original destination address was the same as
+ specified  (or  defaulted to) in the DNAT rule.<br>
+                 <br>
+               </li>
+                                                                        
+                
+        </ul>
+                 <li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall) 
+     may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
+              <br>
+          </li>
+                 <li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
+              <br>
+                ipcalc [ &lt;address&gt; &lt;netmask&gt; | &lt;address&gt;/&lt;vlsm&gt; 
+    ]<br>
+              <br>
+          Examples:<br>
+              <br>
+                [root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
+                   CIDR=192.168.1.0/24<br>
+                   NETMASK=255.255.255.0<br>
+                   NETWORK=192.168.1.0<br>
+                   BROADCAST=192.168.1.255<br>
+                [root@wookie root]#<br>
+              <br>
+                [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
+                   CIDR=192.168.1.0/24<br>
+                   NETMASK=255.255.255.0<br>
+                   NETWORK=192.168.1.0<br>
+                   BROADCAST=192.168.1.255<br>
+                [root@wookie root]#<br>
+              <br>
+          Warning:<br>
+              <br>
+          If your shell only supports 32-bit signed arithmatic (ash or dash), 
+  then   the ipcalc command produces incorrect information for IP addresses 
+  128.0.0.0-1   and for /1 networks. Bash should produce correct information 
+  for all valid   IP addresses.<br>
+              <br>
+            </li>
+                 <li>An 'iprange' command has been added to /sbin/shorewall.
+            <br>
+              <br>
+                iprange &lt;address&gt;-&lt;address&gt;<br>
+              <br>
+          This command decomposes a range of IP addressses into a list of 
+network     and host addresses. The command can be useful if you need to construct
+ an   efficient set of rules that accept connections from a range of network
+ addresses.<br>
+              <br>
+          Note: If your shell only supports 32-bit signed arithmetic (ash 
+or  dash)   then the range may not span 128.0.0.0.<br>
+              <br>
+          Example:<br>
+              <br>
+                [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
+                192.168.1.4/30<br>
+                192.168.1.8/29<br>
+                192.168.1.16/28<br>
+                192.168.1.32/27<br>
+                192.168.1.64/26<br>
+                192.168.1.128/25<br>
+                192.168.2.0/23<br>
+                192.168.4.0/22<br>
+                192.168.8.0/22<br>
+                192.168.12.0/29<br>
+                192.168.12.8/31<br>
+                [root@gateway root]#<br>
+              <br>
+            </li>
+                 <li>A list of host/net addresses is now allowed in an entry
+  in  /etc/shorewall/hosts.<br>
+              <br>
+          Example:<br>
+              <br>
+              foo    eth1:192.168.1.0/24,192.168.2.0/24<br>
+          <br>
+        </li>
+        <li>The "shorewall check" command now includes the chain name when
+printing the applicable policy for each pair of zones.<br>
+ <br>
+    Example:<br>
+ <br>
+        Policy for dmz to net is REJECT using chain all2all<br>
+ <br>
+This means that the policy for connections from the dmz to the internet is
+REJECT and the applicable entry in the /etc/shorewall/policy was the all-&gt;all
+policy.<br>
+          <br>
+        </li>
+        <li>Support for the 2.6 Kernel series has been added.<br>
+        </li>
+                                                                       
+      </ol>
+                                                                       
+      <p><b>7/15/2003 - New Mirror in Brazil</b><b> <img border="0"
+ src="images/new10.gif" width="28" height="12" alt="(New)">
+             <br>
+             </b></p>
+       Thanks to the folks at securityopensource.org.br, there is now a <a
+ href="http://shorewall.securityopensource.org.br" target="_top">Shorewall 
+   mirror in Brazil</a>.
+      <p><b>6/17/2003 - Shorewall-1.4.5</b><b>                         </b></p>
+                                                                        
                                                        
       <p>Problems Corrected:<br>
- </p>
- 
-      <ol>
-        <li>The command "shorewall debug try &lt;directory&gt;" now correctly
-traces the attempt.</li>
-        <li>The INCLUDE directive now works properly in the zones file; previously,
-INCLUDE in that file was ignored.</li>
-        <li>/etc/shorewall/routestopped records with an empty second column
-are no longer ignored.<br>
-   </li>
-      </ol>
- 
-      <p>New Features:<br>
- </p>
- 
-      <ol>
-        <li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may
-now contain a list of addresses. If the list begins with "!' then the rule
-will take effect only if the original destination address in the connection
-request does not match any of the addresses listed.</li>
-      </ol>
-      <p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b> 
-      </b><b><img border="0" src="images/new10.gif" width="28"
- height="12" alt="(New)">
-                       </b></p>
-         
-      <p>The firewall at shorewall.net has been upgraded to the 2.4.21 kernel 
-and iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems
- have been encountered with this set of software. The Shorewall version is
- 1.4.4b plus the accumulated changes for 1.4.5.<br>
-  </p>
-         
-      <p><b>6/8/2003 - Updated Samples</b><b>                      </b></p>
-                 
-      <p>Thanks to Francesca Smith, the samples have been updated to Shorewall
- version 1.4.4.</p>
-                 
-      <p><b>5/29/2003 - Shorewall-1.4.4b</b><b>                      </b></p>
-                                         
-      <p>Groan -- This version corrects a problem whereby the --log-level 
-  was not being set when logging via syslog. The most commonly reported symptom 
-  was that Shorewall messages were being written to the console even though 
-  console logging was correctly configured per <a href="FAQ.htm#faq16">FAQ 
- 16</a>.<br>
-      </p>
-                                         
-      <p><b>5/27/2003 - Shorewall-1.4.4a</b><b>                      </b></p>
-        The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed
-  out   that the code in 1.4.4 restricts the length of short zone names to
- 4 characters.   I've produced version 1.4.4a that restores the previous
-5-character   limit   by conditionally omitting the log rule number when
-the LOGFORMAT  doesn't  contain '%d'.                                   
-                     
-      <p><b>5/23/2003 - Shorewall-1.4.4</b><b>                      </b><b> 
-           </b></p>
-         I apologize for the rapid-fire releases but since there is a potential 
-   configuration  change required to go from 1.4.3a to 1.4.4, I decided to 
- make  it a full release  rather than just a bug-fix release. <br>
-          <br>
-          <b>    Problems corrected:</b><br>
-                                                                        
-      <blockquote>None.<br>
-          </blockquote>
-          <b>    New Features:<br>
-          </b>                                                          
-     
-      <ol>
-                 <li>A REDIRECT- rule target has been added. This target
-behaves     for REDIRECT in the same way as DNAT- does for DNAT in that the
-Netfilter     nat table REDIRECT rule is added but not the companion filter
-table ACCEPT     rule.<br>
-              <br>
-            </li>
-                 <li>The LOGMARKER variable has been renamed LOGFORMAT and
- has   been  changed to a 'printf' formatting template which accepts three
- arguments   (the  chain name, logging rule number and the disposition).
-To  use LOGFORMAT   with  fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>), 
-    set it as:<br>
-           <br>
-                 LOGFORMAT="fp=%s:%d a=%s "<br>
-           <br>
-              <b>CAUTION: </b>/sbin/shorewall uses the leading part of the
- LOGFORMAT     string (up to but not including the first '%') to find log
-messages in  the   'show log', 'status' and 'hits' commands. This part should
-not be omitted     (the LOGFORMAT should not begin with "%") and the leading
-part should be   sufficiently unique for /sbin/shorewall to identify Shorewall
- messages.<br>
-              <br>
-            </li>
-                 <li>When logging is specified on a DNAT[-] or REDIRECT[-]
- rule,    the logging now takes place in the nat table rather than in the
-filter table.   This way, only those connections that actually undergo DNAT
-or redirection    will be logged.<br>
-            </li>
-                                                                       
-      </ol>
-                                                                       
-      <p><b>5/20/2003 - Shorewall-1.4.3a</b><br>
                  </p>
-           This version primarily corrects the documentation included in
-the   .tgz   and  in the .rpm. In addition: <br>
                                                                         
                                                        
       <ol>
-                   <li>(This change is in 1.4.3 but is not documented) If 
+                        <li>The command "shorewall debug try &lt;directory&gt;" 
-you   are   running  iptables 1.2.7a and kernel 2.4.20, then Shorewall will 
+   now   correctly   traces the attempt.</li>
-return   reject   replies  as follows:<br>
+                        <li>The INCLUDE directive now works properly in the 
-              a) tcp - RST<br>
+ zones    file;    previously, INCLUDE in that file was ignored.</li>
-              b) udp - ICMP port unreachable<br>
+                        <li>/etc/shorewall/routestopped records with an empty 
-              c) icmp - ICMP host unreachable<br>
+  second    column   are no longer ignored.<br>
-              d) Otherwise - ICMP host prohibited<br>
-           If you are running earlier software, Shorewall will follow it's
- traditional     convention:<br>
-              a) tcp - RST<br>
-              b) Otherwise - ICMP port unreachable</li>
-                   <li>UDP port 135 is now silently dropped in the common.def 
-  chain.    Remember that this chain is traversed just before a DROP or REJECT 
-  policy    is enforced.<br>
                    </li>
                                                                         
                                                       
       </ol>
                                                                         
                                                        
-      <p><b>5/18/2003 - Shorewall 1.4.3</b><br>
+      <p>New Features:<br>
-                    </p>
+                 </p>
-                  <b>Problems Corrected:<br>
+                                                                        
-               </b>                                                     
                                                        
       <ol>
-                     <li>There were several cases where Shorewall would fail
+                        <li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-]
-  to  remove    a temporary directory from /tmp. These cases have been corrected.</li>
+    rule   may  now contain a list of addresses. If the list begins with
-                     <li>The rules for allowing all traffic via the loopback
+"!'    then the   rule  will take effect only if the original destination
-  interface      have been moved to before the rule that drops status=INVALID
+address    in the connection    request does not match any of the addresses
-  packets.  This    insures that all loopback traffic is allowed even if
+listed.</li>
-Netfilter   connection      tracking is confused.</li>
-                                                                        
-                              
-      </ol>
-                   <b>New Features:<br>
-               </b>                                                     
-                                             
-      <ol>
-                     <li> <a href="6to4.htm">IPV6-IPV4 (6to4) tunnels are</a> 
-  now   supported  in the /etc/shorewall/tunnels  file.</li>
-                  <li>You may now change the leading portion of the --log-prefix
-    used  by Shorewall using the LOGMARKER variable in shorewall.conf. By
-default,    "Shorewall:" is used.<br>
-                  </li>
                                                                         
                                                       
       </ol>
                                                                         
                                                       
-      <p><b>5/10/2003 - Shorewall Mirror in Asia</b><b>          </b><br>
+      <p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b> 
-                       </p>
+                               </b></p>
-                  Ed Greshko has established a mirror in Taiwan -- Thanks 
-Ed!                                                                      
-                                                  
-      <p><b>5/8/2003 - Shorewall Mirror in Chile</b><b>      </b></p>
                                                                         
                                                                
-      <p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
+      <p>The firewall at shorewall.net has been upgraded to the 2.4.21 kernel 
-                        </p>
+        and iptables 1.2.8 (using the "official" RPM from netfilter.org). 
+No   problems     have been encountered with this set of software. The Shorewall 
+   version  is   1.4.4b plus the accumulated changes for 1.4.5.<br>
+                  </p>
                                                                         
                                                                
-      <p><b>4/26/2003 - lists.shorewall.net Downtime</b><b>           </b></p>
+      <p><b>6/8/2003 - Updated Samples</b><b>                      </b></p>
+                                                                        
+                                                                       
+      <p>Thanks to Francesca Smith, the samples have been updated to Shorewall
+         version 1.4.4.</p>
+                                                                        
+                                                                       
+      <p><b></b></p>
+                                                                        
+                                      
+      <ol>
                                                                         
                                                                         
                                                                      
-      <p>The list server will be down this morning for upgrade to RH9.0.<br>
+      </ol>
-                        </p>
-                                                                        
-                                                                        
-                                     
-      <p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
-                                           </b></p>
-                                                                        
-                                                                        
-                                                      
-      <p>Thanks to Francesca Smith, the sample configurations are now upgraded 
-            to Shorewall version 1.4.2.</p>
-                                                                        
-                                                                        
-                                                      
-      <p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
-                                           </b></p>
-                                                                        
-                                                                        
-                                                                        
-    
-      <blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a 
-             Shorewall presentation to GSLUG</a>.         The presentation 
- is   in   HTML     format but was generated from Microsoft PowerPoint and 
- is best   viewed   using    Internet Explorer (although Konqueror also seems 
-  to work   reasonably   well   as does Opera 7.1.0).  Neither Opera 6 nor 
- Netscape work  well to view  the   presentation.<br>
-                                  </blockquote>
-                                                                        
-                                                                        
-                                                                        
-                                                                        
-          
-      <blockquote>                                                       
-                                                             
-        <ol>
-                                                                        
-                                                                        
-                                                                        
-                                                                        
-      
-        </ol>
-                               </blockquote>
-                                                                        
-                                                                        
                                                                         
                                                                         
                                                                      
@@ -355,82 +488,98 @@ Ed!
                                                                         
                                                                         
                                                                         
+                                                                        
+                           
       <p> <a href="http://leaf.sourceforge.net" target="_top"><img
  border="0" src="images/leaflogo.gif" width="49" height="36"
  alt="(Leaf Logo)">
                                                                         
-                </a>Jacques        Nilo       and     Eric     Wolzak   
+                                </a>Jacques        Nilo       and     Eric
-   have       a   LEAF  (router/firewall/gateway                        on
+     Wolzak          have       a   LEAF  (router/firewall/gateway      
-  a  floppy,       CD    or compact     flash)  distribution            
+                 on   a  floppy,       CD    or compact     flash)  distribution
-   called                 <i>Bering</i>          that          features 
+                  called                 <i>Bering</i>          that    
-             Shorewall-1.3.14         and    Kernel-2.4.20.          You
+     features                   Shorewall-1.4.2         and    Kernel-2.4.20.
-   can     find         their    work at:                <a
+            You        can     find         their    work at:           
- href="http://leaf.sourceforge.net/devel/jnilo">       http://leaf.sourceforge.net/devel/jnilo<br>
+          <a href="http://leaf.sourceforge.net/devel/jnilo">       http://leaf.sourceforge.net/devel/jnilo<br>
                                                                         
-                              </a></p>
+                                              </a></p>
+                                                                        
+                                                                        
+                                   <b>Congratulations to Jacques and Eric 
+on  the   recent    release     of  Bering    1.2!!! </b><br>
                                                                         
                                                                         
-                   <b>Congratulations to Jacques and Eric on the recent release 
-   of  Bering    1.2!!! </b><br>
                                                                         
                             
       <h2><a name="Donations"></a>Donations</h2>
-                                                           </td>
                                                                         
-                       <td width="88" bgcolor="#4b017c" valign="top"
+        </td>
- align="center">                                                        
+                                                                        
+                                       <td width="88" bgcolor="#3366ff"
+ valign="top" align="center">                                            
+                                                                        
+                                                                        
                                                                         
   
       <form method="post"
  action="http://lists.shorewall.net/cgi-bin/htsearch">                  
        <strong><br>
-                                                       <font
+                                                                       <font
  color="#ffffff"><b>Note:              </b></font></strong><font
  color="#ffffff">Search is unavailable      Daily    0200-0330      GMT.</font><br>
-                                                       <strong></strong>
+                                                                       <strong></strong>
+                                                                        
+                                                                        
                                                                         
                                                                         
                                                 
         <p><font color="#ffffff"><strong>Quick Search</strong></font><br>
-                                                             <font
+                                                                        
- face="Arial" size="-1">        <input type="text" name="words"
+            <font face="Arial" size="-1">        <input type="text"
- size="15"></font><font size="-1"> </font>      <font face="Arial"
+ name="words" size="15"></font><font size="-1"> </font>      <font
- size="-1">     <input type="hidden" name="format" value="long">     <input
+ face="Arial" size="-1">     <input type="hidden" name="format"
- type="hidden" name="method" value="and">     <input type="hidden"
+ value="long">     <input type="hidden" name="method" value="and">     <input
- name="config" value="htdig">     <input type="submit" value="Search"></font>
+ type="hidden" name="config" value="htdig">     <input type="submit"
-        </p>
+ value="Search"></font>               </p>
-                                                             <font
+                                                                        
- face="Arial">            <input type="hidden" name="exclude"
+            <font face="Arial">            <input type="hidden"
- value="[http://lists.shorewall.net/pipermail/*]">   </font>        </form>
+ name="exclude" value="[http://lists.shorewall.net/pipermail/*]">   </font>
+         </form>
+                                                                        
+                                                                        
                                                                         
                                                                         
    
       <p><font color="#ffffff"><b><a
  href="http://lists.shorewall.net/htdig/search.html"><font
  color="#ffffff">Extended Search</font></a></b></font></p>
-                          <br>
+                                          <br>
-                                       </td>
+                                                       </td>
+                                                                        
+                                 </tr>
                                                                         
-                 </tr>
                                                                         
                                                        
   </tbody>                                                  
 </table>
                                                                         
-       </center>
+                       </center>
+                                                                        
+                     </div>
                                                                         
-     </div>
                             
 <table border="0" cellpadding="5" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber2"
- bgcolor="#4b017c">
+ bgcolor="#3366ff">
                                                                         
-      <tbody>
+                      <tbody>
+                                                                        
+                          <tr>
+                                                                        
+                                <td width="100%"
+ style="margin-top: 1px;" valign="middle">                              
                                                                         
-          <tr>
                                                                         
-                <td width="100%" style="margin-top: 1px;"
- valign="middle">                                                       
                                                                         
                                                                         
                              
@@ -438,28 +587,33 @@ Ed!
  border="4" src="images/newlog.gif" width="57" height="100" align="left"
  hspace="10" alt="(Starlight Logo)">
                                                                         
-                  </a></p>
+                                  </a></p>
+                                                                        
+                                                                        
                                                                         
                                                                         
                                                                         
                                       
       <p align="center"><font size="4" color="#ffffff"><br>
-         <font size="+2"> Shorewall is free but if       you try it and find 
+                         <font size="+2"> Shorewall is free but if      
- it useful, please consider making a donation                            
+you   try   it  and   find   it useful, please consider making a donation
-                                         to             <a
+                                                                     to 
- href="http://www.starlight.org"><font color="#ffffff">Starlight    Children's 
+                 <a href="http://www.starlight.org"><font
-         Foundation.</font></a> Thanks!</font></font></p>
+ color="#ffffff">Starlight      Children's              Foundation.</font></a>
+Thanks!</font></font></p>
                                                                         
-                </td>
+                                </td>
+                                                                        
+                          </tr>
                                                                         
-          </tr>
                                                                         
                                                        
   </tbody>                                                  
 </table>
                                                                         
-<p><font size="2">Updated 6/17/2003 - <a href="support.htm">Tom Eastep</a></font> 
+                            
-                                                                <br>
+<p><font size="2">Updated 7/19/2003 - <a href="support.htm">Tom Eastep</a></font> 
+                                                                        <br>
 </p>
 </body>
 </html>

STABLE/documentation/shoreline.htm

@@ -6,6 +6,7 @@
  content="text/html; charset=windows-1252">
   <title>About the Shorewall Author</title>
                                                                         
+            
   <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
                                                 
   <meta name="ProgId" content="FrontPage.Editor.Document">
@@ -16,51 +17,51 @@
                         
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                                <tbody>
+                                  <tbody>
-                           <tr>
+                             <tr>
-                                  <td width="100%">                     
+                                    <td width="100%">                   
                                                                  
       <h1 align="center"><font color="#ffffff">Tom Eastep</font></h1>
-                                  </td>
+                                    </td>
-                                </tr>
+                                  </tr>
                                                 
   </tbody>            
 </table>
                         
 <p align="center">       <img border="3" src="images/Tom.jpg"
- alt="Tom - June 2003" width="640" height="480">
+ alt="Aging Geek - June 2003" width="320" height="240">
-                       </p>
+                         </p>
                         
 <p align="center">Tom -- June 2003<br>
-                              <br>
+                                <br>
-                   </p>
+                     </p>
                         
 <ul>
-                            <li>Born 1945 in <a
+                              <li>Born 1945 in <a
  href="http://www.experiencewashington.com">Washington     State</a> .</li>
-                            <li>BA Mathematics from <a
+                              <li>BA Mathematics from <a
  href="http://www.wsu.edu">Washington      State    University</a>  1967</li>
-                            <li>MA Mathematics from <a
+                              <li>MA Mathematics from <a
  href="http://www.washington.edu">University      of Washington</a> 1969</li>
-                            <li>Burroughs Corporation (now <a
+                              <li>Burroughs Corporation (now <a
  href="http://www.unisys.com">Unisys</a>    ) 1969 - 1980</li>
-                            <li><a href="http://www.tandem.com">Tandem Computers, 
+                              <li><a href="http://www.tandem.com">Tandem
-    Incorporated</a>         (now part of the <a
+Computers,      Incorporated</a>         (now part of the <a
  href="http://www.hp.com">The     New HP</a>) 1980 -  present</li>
-                            <li>Married 1969 - no children.</li>
+                              <li>Married 1969 - no children.</li>
                         
 </ul>
                         
 <p>I am currently a member of the design team for the next-generation   operating 
-    system from the NonStop Enterprise Division of HP. </p>
+     system from the NonStop Enterprise Division of HP. </p>
                         
 <p>I became interested in Internet Security when I established a home office
-           in 1999 and had DSL service installed in our       home. I investigated
+            in 1999 and had DSL service installed in our       home. I investigated
-         ipchains  and developed the scripts which are now collectively known 
+          ipchains  and developed the scripts which are now collectively
-    as   <a href="http://seawall.sourceforge.net"> Seattle       Firewall</a>. 
+known      as   <a href="http://seawall.sourceforge.net"> Seattle       Firewall</a>. 
-    Expanding       on what I learned from Seattle Firewall, I then      
+     Expanding       on what I learned from Seattle Firewall, I then     
-designed    and wrote      Shorewall. </p>
+ designed    and wrote      Shorewall. </p>
                         
 <p>I telework from our <a
  href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a> in <a
@@ -70,29 +71,29 @@ I live with my wife Tarry.
 <p>Our current home network consists of: </p>
                         
 <ul>
-                            <li>1.2Gz Athlon, Windows XP Pro, 320MB RAM,
+                              <li>1.2Gz Athlon, Windows XP Pro, 320MB RAM,
-40GB   &amp;   20GB   IDE   HDs   and LNE100TX      (Tulip) NIC - My personal 
+ 40GB   &amp;   20GB   IDE   HDs   and LNE100TX      (Tulip) NIC - My personal 
-Windows   system.   Serves as a PPTP server for Road Warrior access. Dual 
+ Windows   system.   Serves as a PPTP server for Road Warrior access. Dual 
-boots <a href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
+ boots <a href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
-                            <li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, 
+                              <li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, 
-LNE100TX(Tulip)        NIC   -  My      personal Linux System which runs Samba.
+ LNE100TX(Tulip)        NIC   -  My      personal Linux System which runs 
-   This      system also has <a href="http://www.vmware.com/">VMware</a> 
+Samba.    This      system also has <a href="http://www.vmware.com/">VMware</a> 
-installed    and      can run both     <a href="http://www.debian.org">Debian 
+ installed    and      can run both     <a href="http://www.debian.org">Debian 
- Woody</a> and         <a href="http://www.suse.com">SuSE 8.1</a> in virtual 
+  Woody</a> and         <a href="http://www.suse.com">SuSE 8.1</a> in virtual 
- machines.</li>
+  machines.</li>
-                            <li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100
+                              <li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, 
-    NIC    - Email   (Postfix, Courier-IMAP and Mailman), HTTP (Apache),
+EEPRO100     NIC    - Email   (Postfix, Courier-IMAP and Mailman), HTTP (Apache),
-FTP    (Pure_ftpd),   DNS  server        (Bind 9).</li>
+ FTP    (Pure_ftpd),   DNS  server        (Bind 9).</li>
-                            <li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI  HD
+                              <li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI
- -  3   LNE100TX       (Tulip) and 1 TLAN NICs  - Firewall running Shorewall
+ HD  -  3   LNE100TX       (Tulip) and 1 TLAN NICs  - Firewall running Shorewall
-  1.4.4c, a DHCP         server and Samba configured as a WINS server..</li>
+   1.4.6Beta1, a DHCP         server and Samba configured as a WINS server..</li>
-                            <li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
+                              <li>Duron 750, Win ME, 192MB RAM, 20GB HD,
-   NIC   -  My  wife's        personal system.</li>
+RTL8139     NIC   -  My  wife's        personal system.</li>
-                            <li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB
+                              <li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB
- HD,  built-in     EEPRO100, EEPRO100 in expansion base - My   work system.</li>
+  HD,  built-in     EEPRO100, EEPRO100 in expansion base - My   work system.</li>
-       <li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and
+         <li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC
- LinkSys  WET11 - Our Laptop.<br>
+and   LinkSys  WET11 - Our Laptop.<br>
-       </li>
+         </li>
                         
 </ul>
                         
@@ -105,31 +106,33 @@ FTP    (Pure_ftpd),   DNS  server        (Bind 9).</li>
                         
 <p><a href="http://www.redhat.com"><img border="0"
  src="images/poweredby.png" width="88" height="31">
-                       </a><a href="http://www.compaq.com"><img
+                         </a><a href="http://www.compaq.com"><img
  border="0" src="images/poweredbycompaqlog0.gif" hspace="3" width="83"
  height="25">
-                       </a><a href="http://www.pureftpd.org"><img
+                         </a><a href="http://www.pureftpd.org"><img
  border="0" src="images/pure.jpg" width="88" height="31">
-                       </a><font size="4"><a
+                         </a><font size="4"><a
  href="http://www.apache.org"><img border="0"
  src="images/apache_pb1.gif" hspace="2" width="170" height="20">
-                </a><a href="http://www.mandrakelinux.com"><img
+                  </a><a href="http://www.mandrakelinux.com"><img
  src="images/medbutton.png" alt="Powered by Mandrake" width="90"
  height="32">
-               </a><img src="images/shorewall.jpg"
+                 </a><img src="images/shorewall.jpg"
  alt="Protected by Shorewall" width="125" height="40" hspace="4">
-      <a href="http://www.opera.com"><img src="images/opera.png"
+        <a href="http://www.opera.com"><img src="images/opera.png"
  alt="(Opera Logo)" width="102" height="39" border="0">
-      </a>  <a href="http://www.hp.com"><img
+        </a>  <a href="http://www.hp.com"><img
  src="images/penquin_in_blue_racer_sm2.gif" alt="" width="120"
  height="75" border="0">
-    </a><a href="http://www.opera.com"> </a>                 </font></p>
+      </a><a href="http://www.opera.com"> </a>                 </font></p>
                         
-<p><font size="2">Last updated 6/15/2003 - </font><font size="2">       <a
+<p><font size="2">Last updated 7/14/2003 - </font><font size="2">       <a
  href="support.htm">Tom Eastep</a></font>  </p>
-                          <font face="Trebuchet MS"><a
+                            <font face="Trebuchet MS"><a
  href="copyright.htm"><font size="2">Copyright</font>       © <font
  size="2">2001, 2002, 2003 Thomas      M. Eastep.</font></a></font><br>
+   <br>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/shorewall_extension_scripts.htm

@@ -14,113 +14,105 @@
 </head>
   <body>
        
-
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-
+                 <tbody>
-             <tbody>
+        <tr>
-     <tr>
+                   <td width="100%">                      
-
-               <td width="100%">
-
       <h1 align="center"><font color="#ffffff">Extension Scripts</font></h1>
-
+                   </td>
-               </td>
+                 </tr>
-
-             </tr>
-
              
   </tbody>   
 </table>
        
-
 <p>  Extension scripts are   user-provided  scripts that are invoked at various 
-points during firewall   start, restart,  stop and clear. The scripts are
+ points during firewall   start, restart,  stop and clear. The scripts are 
-placed in /etc/shorewall and   are processed  using the Bourne shell "source"
+ placed in /etc/shorewall and   are processed  using the Bourne shell "source" 
-mechanism. The   following scripts can be  supplied:</p>
+ mechanism.<br>
+ </p>
+ 
+<p><font color="#ff0000"><b>Caution: <br>
+  </b></font></p>
+   
+<ol>
+   <li><font color="#ff0000"><b>Be sure that you actually need to use an
+extension  script to do what you want. Shorewall has a wide range of features
+that cover  most requirements.</b></font></li>
+   <li><font color="#ff0000"><b>DO NOT SIMPLY COPY RULES THAT YOU FIND ON 
+THE NET INTO AN EXTENSION SCRIPT AND EXPECT THEM TO WORK AND TO NOT BREAK
+ SHOREWALL. TO USE SHOREWALL EXTENSION SCRIPTS YOU MUST KNOW WHAT YOU ARE
+DOING WITH RESPECT TO iptables/Netfilter</b></font></li>
+ 
+</ol>
+ 
+<p>The   following scripts can be  supplied:</p>
       
 <ul>
-     <li>init -- invoked early in "shorewall start" and       "shorewall
+        <li>init -- invoked early in "shorewall start" and       "shorewall 
-restart"</li>
+ restart"</li>
-     <li>start -- invoked after the firewall has been started or restarted.</li>
+        <li>start -- invoked after the firewall has been started or restarted.</li>
-     <li>stop -- invoked as a first step when the firewall is being stopped.</li>
+        <li>stop -- invoked as a first step when the firewall is being stopped.</li>
-     <li>stopped -- invoked after the firewall has been stopped.</li>
+        <li>stopped -- invoked after the firewall has been stopped.</li>
-     <li>clear -- invoked after the firewall has been cleared.</li>
+        <li>clear -- invoked after the firewall has been cleared.</li>
-     <li>refresh -- invoked while the firewall is being refreshed but before
+        <li>refresh -- invoked while the firewall is being refreshed but
-the     common and/or blacklst chains have been rebuilt.</li>
+before  the     common and/or blacklst chains have been rebuilt.</li>
-     <li>newnotsyn (added in version 1.3.6) -- invoked after the 'newnotsyn'
+        <li>newnotsyn (added in version 1.3.6) -- invoked after the 'newnotsyn' 
-chain     has been created but before any rules have been added to it.</li>
+ chain     has been created but before any rules have been added to it.</li>
       
 </ul>
          
-
-
-
 <p><u><b>If your version of Shorewall doesn't have the file that you want 
-to use from the above list, you can simply create the file yourself.</b></u></p>
+ to use from the above list, you can simply create the file yourself.</b></u></p>
       
 <p>   You can also supply a script with the same name as any of the filter 
-  chains  in the firewall and the script will be invoked after the   /etc/shorewall/rules
+   chains  in the firewall and the script will be invoked after the   /etc/shorewall/rules 
-  file has been processed but before the   /etc/shorewall/policy file has
+   file has been processed but before the   /etc/shorewall/policy file has 
-been  processed.</p>
+ been  processed.</p>
-
-
-
          
 <p>The /etc/shorewall/common file receives special treatment. If this file 
-is present, the rules that it       defines will totally replace the default
+ is present, the rules that it       defines will totally replace the default 
-rules in the common chain. These         default rules are contained in the
+ rules in the common chain. These         default rules are contained in the
-file /etc/shorewall/common.def which        may be used as a starting point
+ file /etc/shorewall/common.def which        may be used as a starting point
-for making your own customized file.</p>
+ for making your own customized file.</p>
-
-
-
          
 <p>   Rather than running iptables directly, you should run it using the 
- function  run_iptables. Similarly, rather than running "ip" directly,
+function  run_iptables. Similarly, rather than running "ip" directly, you
-you should use run_ip. These functions accept the same arguments as the
+ should use run_ip. These functions accept the same arguments as the  underlying
- underlying command but cause the firewall to be stopped if an error occurs
+ command but cause the firewall to be stopped if an error occurs   during
-  during processing of the command.</p>
+processing of the command.</p>
-
-
-
-
-<p>   If you decide to create /etc/shorewall/common it is a good idea to use
-the    following technique</p>
-
-
          
+<p>   If you decide to create /etc/shorewall/common it is a good idea to
+use the    following technique</p>
          
 <p>   /etc/shorewall/common:</p>
          
-
-
-
 <blockquote>          
-
   <pre>. /etc/shorewall/common.def<br>&lt;add your rules here&gt;</pre>
-   </blockquote>
+      </blockquote>
       
 <p>If you need to supercede a rule in the released common.def file, you can 
-add   the superceding rule before the '.' command. Using this technique allows
+ add   the superceding rule before the '.' command. Using this technique allows
-  you to add new rules while still getting the benefit of the latest common.def
+   you to add new rules while still getting the benefit of the latest common.def
-  file.</p>
+   file.</p>
-
-
         
 <p>Remember that /etc/shorewall/common defines rules   that are only applied 
-if the applicable policy is DROP or REJECT. These rules   are NOT applied
+ if the applicable policy is DROP or REJECT. These rules   are NOT applied 
-if the policy is ACCEPT or CONTINUE.</p>
+ if the policy is ACCEPT or CONTINUE<br>
+  </p>
    
+<p> </p>
         
-
+<p align="left"><font size="2">Last updated 6/30/2003 - <a
-<p align="left"><font size="2">Last updated 2/18/2003 - <a
  href="support.htm">Tom Eastep</a></font></p>
       
 <p align="left"><a href="copyright.htm"><font size="2">Copyright  2002, 2003 
-Thomas M. Eastep</font></a></p>
+ Thomas M. Eastep</font></a></p>
+      <br>
+    <br>
    <br>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/shorewall_features.htm

@@ -16,94 +16,94 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-      <tbody>
+       <tbody>
-       <tr>
+        <tr>
-        <td width="100%">
+         <td width="100%">       
       <h1 align="center"><font color="#ffffff">Shorewall Features</font></h1>
-        </td>
+         </td>
-      </tr>
+       </tr>
     
   </tbody> 
 </table>
   
 <ul>
-      <li>Uses Netfilter's connection tracking facilities for stateful packet
+       <li>Uses Netfilter's connection tracking facilities for stateful packet 
     filtering.</li>
-      <li>Can be used in a <b> wide range of router/firewall/gateway applications</b>.
+       <li>Can be used in a <b> wide range of router/firewall/gateway applications</b>. 
      
     <ul>
-        <li>Completely customizable using configuration files.</li>
+         <li>Completely customizable using configuration files.</li>
-        <li>No limit on the number of network interfaces.</li>
+         <li>No limit on the number of network interfaces.</li>
-        <li>Allows you to partitions the network into <i><a
+         <li>Allows you to partitions the network into <i><a
  href="Documentation.htm#Zones">zones</a></i>         and gives you complete 
  control over the connections permitted between         each pair of zones.</li>
-        <li>Multiple interfaces per zone and multiple zones per interface
+         <li>Multiple interfaces per zone and multiple zones per interface 
         permitted.</li>
-        <li>Supports nested and overlapping zones.</li>
+         <li>Supports nested and overlapping zones.</li>
       
     </ul>
-      </li>
+       </li>
-      <li> <a href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a>
+       <li> <a href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a> 
 to  help    get your first firewall up and running quickly</li>
-  <li>A <b>GUI</b> is available via Webmin 1.060 and later (<a
+   <li>A <b>GUI</b> is available via Webmin 1.060 and later (<a
  href="http://www.webmin.com">http://www.webmin.com</a>)<br>
-  </li>
+   </li>
-      <li>Extensive <b> <a
+       <li>Extensive <b> <a
  href="shorewall_quickstart_guide.htm#Documentation">documentation</a>  
-  </b>   included in the .tgz and .rpm downloads.</li>
+    </b>   included in the .tgz and .rpm downloads.</li>
-      <li><b>Flexible address management/routing support</b> (and you can
+       <li><b>Flexible address management/routing support</b> (and you can 
 use  all     types in the same firewall):     
     <ul>
-        <li><a href="Documentation.htm#Masq">Masquerading/SNAT</a></li>
+         <li><a href="Documentation.htm#Masq">Masquerading/SNAT</a></li>
-        <li><a href="Documentation.htm#PortForward">Port Forwarding (DNAT)</a>.</li>
+         <li><a href="Documentation.htm#PortForward">Port Forwarding (DNAT)</a>.</li>
-        <li><a href="Documentation.htm#NAT">     Static NAT</a>.</li>
+         <li><a href="Documentation.htm#NAT">     Static NAT</a>.</li>
-        <li><a href="Documentation.htm#ProxyArp">     Proxy ARP</a>.</li>
+         <li><a href="Documentation.htm#ProxyArp">     Proxy ARP</a>.</li>
-        <li>Simple host/subnet Routing</li>
+         <li>Simple host/subnet Routing</li>
       
     </ul>
-      </li>
+       </li>
-      <li><a href="blacklisting_support.htm"><b>Blacklisting</b></a> of individual
+       <li><a href="blacklisting_support.htm"><b>Blacklisting</b></a> of
-      IP addresses and subnetworks is supported.</li>
+individual       IP addresses and subnetworks is supported.</li>
-      <li><b><a href="starting_and_stopping_shorewall.htm">Operational support</a></b>:
+       <li><b><a href="starting_and_stopping_shorewall.htm">Operational support</a></b>: 
      
     <ul>
-        <li>Commands to start, stop and clear the firewall</li>
+         <li>Commands to start, stop and clear the firewall</li>
-        <li>Supports status             monitoring      with an audible alarm
+         <li>Supports status             monitoring      with an audible
- when an             "interesting" packet is detected.</li>
+alarm  when an             "interesting" packet is detected.</li>
-        <li>Wide variety of informational commands.</li>
+         <li>Wide variety of informational commands.</li>
       
     </ul>
-      </li>
+       </li>
-      <li><b>VPN Support</b>
+       <li><b>VPN Support</b>     
     <ul>
-        <li><a href="Documentation.htm#Tunnels">IPSEC, GRE,  IPIP     and
+         <li><a href="Documentation.htm#Tunnels">IPSEC, GRE,  IPIP     and 
 OpenVPN Tunnels</a>.</li>
-        <li><a href="PPTP.htm">PPTP </a> clients and Servers.</li>
+         <li><a href="PPTP.htm">PPTP </a> clients and Servers.</li>
       
     </ul>
-      </li>
+       </li>
-      <li>Support for <a href="traffic_shaping.htm"><b>Traffic Control/Shaping</b></a>
+       <li>Support for <a href="traffic_shaping.htm"><b>Traffic Control/Shaping</b></a> 
       integration.</li>
-      <li>Wide support for different <b>GNU/Linux Distributions</b>.
+       <li>Wide support for different <b>GNU/Linux Distributions</b>.   
   
     <ul>
-        <li><a href="Install.htm#Install_RPM"><b>RPM</b></a> and <a
+         <li><a href="Install.htm#Install_RPM"><b>RPM</b></a> and <a
  href="http://security.dsi.unimi.it/%7Elorenzo/debian.html"><b>Debian</b></a> 
           packages available.</li>
-        <li>Includes <a href="Install.htm"><b>automated install, upgrade,
+         <li>Includes <a href="Install.htm"><b>automated install, upgrade, 
 fallback          and uninstall facilities</b></a> for users who can't use 
 or choose  not         to use the RPM or Debian packages.</li>
-        <li>Included as a standard part of<b> <a
+         <li>Included as a standard part of<b> <a
  href="http://leaf.sourceforge.net/devel/jnilo">     LEAF/Bering</a> </b>(router/firewall 
  on a floppy, CD or compact flash).</li>
       
     </ul>
-     </li>
-     <li><a href="MAC_Validation.html">Media Access Control (<b>MAC</b>)
-Address      <b>Verification</b><br>
-       </a><br>
       </li>
+      <li><a href="MAC_Validation.html">Media Access Control (<b>MAC</b>) 
+Address      <b>Verification</b><br>
+        </a><br>
+       </li>
   
 </ul>
   
@@ -111,7 +111,8 @@ Address      <b>Verification</b><br>
   
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
  size="2">Copyright</font> © <font size="2">2001-2003 Thomas M. Eastep.</font></a></font><br>
-  </p>
+   </p>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/shorewall_firewall_structure.htm

@@ -16,31 +16,32 @@
                 
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-           <tbody>
+             <tbody>
-      <tr>
+        <tr>
-             <td width="100%">                         
+               <td width="100%">                                       
-      <h1 align="center"><font color="#ffffff">Firewall Structure</font></h1>
+      <h1 align="center"><font color="#ffffff">Firewall Structure (Under
-             </td>
+Construction)</font></h1>
-           </tr>
+               </td>
+             </tr>
                        
   </tbody>    
 </table>
                
 <p>  Shorewall views the network in which it is running as a set of     
  <i> zones. </i>Shorewall itself defines exactly   one zone called "fw" which
- refers to the firewall system itself . The   /etc/shorewall/zones file is
+  refers to the firewall system itself . The   /etc/shorewall/zones file
- used to define additional zones and the example file   provided with Shorewall 
+is   used to define additional zones and the example file   provided with
- defines the zones:</p>
+Shorewall   defines the zones:</p>
                
 <ol>
-           <li>  net -- the (untrusted) internet.</li>
+             <li>  net -- the (untrusted) internet.</li>
-           <li>  dmz - systems that must be accessible from       the internet
+             <li>  dmz - systems that must be accessible from       the internet
- and from the local network.  These systems cannot be trusted completely
+  and from the local network.  These systems cannot be trusted completely
 since  their servers may have been       compromised through a security exploit.</li>
-           <li>  loc - systems in your local network(s).       These systems
+             <li>  loc - systems in your local network(s).       These systems
- must be protected from the internet and from the DMZ and in       some cases,
+  must be protected from the internet and from the DMZ and in       some
- from each other.</li>
+cases,   from each other.</li>
                
 </ol>
           
@@ -49,147 +50,148 @@ zone</a>.  For ease of description in this documentation, it is assumed
 that the firewall zone is named "fw".</p>
           
 <p>It can't be stressed enough that  with the exception of the firewall zone,
- Shorewall itself attaches no meaning to  zone names. Zone names are simply
+  Shorewall itself attaches no meaning to  zone names. Zone names are simply
- labels used to refer to a collection of  network hosts.</p>
+  labels used to refer to a collection of  network hosts.</p>
           
 <p>While zones are normally disjoint (no two zones have a host in common), 
-  there are cases where nested or overlapping zone definitions are appropriate.</p>
+   there are cases where nested or overlapping zone definitions are appropriate.</p>
           
 <p>Netfilter has the concept of <i>tables</i> and <i>chains. </i>For the purpose
 of this document, we will consider Netfilter to have three tables:</p>
      
 <ol>
-   <li>Filter table -- this is the main table for packet filtering and can 
+     <li>Filter table -- this is the main table for packet filtering and
-be displayed with the command "shorewall show".</li>
+can  be displayed with the command "shorewall show".</li>
-   <li>Nat table -- used for all forms of Network Address Translation (NAT); 
+     <li>Nat table -- used for all forms of Network Address Translation (NAT); 
-SNAT, DNAT and MASQUERADE.</li>
+ SNAT, DNAT and MASQUERADE.</li>
-   <li>Mangle table -- used to modify fields in the packet header.<br>
+     <li>Mangle table -- used to modify fields in the packet header.<br>
-   </li>
+     </li>
      
 </ol>
      
 <p>Netfilter defines a number of inbuilt chains: PREROUTING, INPUT, OUTPUT, 
-FORWARD and POSTROUTING. Not all inbuilt chains are present in all tables 
+ FORWARD and POSTROUTING. Not all inbuilt chains are present in all tables 
-as shown in this table.<br>
+ as shown in this table.<br>
- </p>
+   </p>
      
 <div align="center">   
 <table cellpadding="2" cellspacing="2" border="1">
-   <tbody>
+     <tbody>
-     <tr>
+       <tr>
-       <td valign="top">CHAIN<br>
+         <td valign="top">CHAIN<br>
-       </td>
+         </td>
-       <td valign="top">Filter<br>
+         <td valign="top">Filter<br>
-       </td>
+         </td>
-       <td valign="top">Nat<br>
+         <td valign="top">Nat<br>
-       </td>
+         </td>
-       <td valign="top">Mangle<br>
+         <td valign="top">Mangle<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
-     <tr>
+       <tr>
-       <td valign="top">PREROUTING<br>
+         <td valign="top">PREROUTING<br>
-       </td>
+         </td>
-       <td valign="top"><br>
+         <td valign="top"><br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
-     <tr>
+       <tr>
-       <td valign="top">INPUT<br>
+         <td valign="top">INPUT<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top"><br>
+         <td valign="top"><br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
-     <tr>
+       <tr>
-       <td valign="top">OUTPUT<br>
+         <td valign="top">OUTPUT<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
-     <tr>
+       <tr>
-       <td valign="top">FORWARD<br>
+         <td valign="top">FORWARD<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top"><br>
+         <td valign="top"><br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
-     <tr>
+       <tr>
-       <td valign="top">POSTROUTING<br>
+         <td valign="top">POSTROUTING<br>
-       </td>
+         </td>
-       <td valign="top"><br>
+         <td valign="top"><br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-       <td valign="top">X<br>
+         <td valign="top">X<br>
-       </td>
+         </td>
-     </tr>
+       </tr>
            
   </tbody>   
 </table>
- </div>
+   </div>
      
 <p>Shorewall doesn't create rules in all of the builtin chains. In the large 
-diagram below are boxes such as  shown below.  This box represents in INPUT 
+ diagram below are boxes such as  shown below.  This box represents in INPUT 
-chain and shows that packets first flow through the INPUT chain in the Mangle 
+ chain and shows that packets first flow through the INPUT chain in the Mangle 
-table followed by the INPUT chain in the Filter table. The parentheses around 
+ table followed by the INPUT chain in the Filter table. The parentheses around 
-"Mangle" indicate that while the packets will flow through the INPUT chain 
+ "Mangle" indicate that while the packets will flow through the INPUT chain 
-in the Mangle table, Shorewall does not create any rules in that chain.<br>
+ in the Mangle table, Shorewall does not create any rules in that chain.<br>
- </p>
+   </p>
      
 <div align="center"><img src="images/Legend.png" alt="(Box Legend)"
  width="145" height="97" align="middle">
- <br>
+   <br>
- </div>
+   </div>
      
 <p></p>
      
 <p>Here is a picture of how packets traverse the various chains and tables
- in Netfilter. In that diagram, "Local Process" refers to a process running
+  in Netfilter. In that diagram, "Local Process" refers to a process running
- on the Firewall itself (in the 'fw' zone).</p>
+  on the Firewall itself (in the 'fw' zone).</p>
        
 <div align="center"><img src="images/Netfilter.png"
  alt="Netfilter Flow Diagram" width="541" height="767">
-     </div>
+       </div>
        
 <p><br>
- <br>
+   <br>
- In the text that follows, the paragraph numbers correspond to the box number 
+   In the text that follows, the paragraph numbers correspond to the box
-in the diagram above.<br>
+number  in the diagram above.<br>
- </p>
+   </p>
      
 <ol>
-   <li>Packets entering the firewall first pass through the <i>mangle </i>table's 
+     <li>Packets entering the firewall first pass through the <i>mangle </i>table's 
-  PREROUTING chain (you can see the mangle table by typing "shorewall show 
+   PREROUTING chain (you can see the mangle table by typing "shorewall show 
-  mangle"). If the packet entered through an interface that has the <b>norfc1918</b> 
+   mangle"). If the packet entered through an interface that has the <b>norfc1918</b> 
-  option, then the packet is sent down the <b>man1918</b> chain which will
+   option and if iptables/netfilter doesn't support the connection tracking 
- drop  the packet if its destination IP address is reserved (as specified
+match extension, then the packet is sent down the <b>man1918</b> chain which 
-in the  /etc/shorewall/rfc1918 file). Next the packet passes through the<b>
+will  drop  the packet if its destination IP address is reserved (as specified
-pretos</b>  chain to set its TOS field as specified in the /etc/shorewall/tos
+ in the  /etc/shorewall/rfc1918 file). Next the packet passes through the<b>
-file.  Finally, if traffic control/shaping is being used, the packet is sent
+ pretos</b>  chain to set its TOS field as specified in the /etc/shorewall/tos
-through  the<b> tcpre</b> chain to be marked for later use in policy routing
+ file.  Finally, if traffic control/shaping is being used, the packet is
-or traffic  control.<br>
+sent  through  the<b> tcpre</b> chain to be marked for later use in policy
-     <br>
+routing  or traffic  control.<br>
- Next, if the packet isn't part of an established connection, it passes 
+       <br>
- through the<i> nat</i> table's PREROUTING chain (you can see the nat table
+   Next, if the packet isn't part of an established connection, it passes 
- by  typing "shorewall show nat"). If you are doing both static nat and 
+  through the<i> nat</i> table's PREROUTING chain (you can see the nat table
-port  forwarding, the order in which chains are traversed is dependent on
+  by  typing "shorewall show nat"). If you are doing both static nat and
+ port  forwarding, the order in which chains are traversed is dependent on
 the  setting of NAT_BEFORE_RULES in shorewall.conf. If NAT_BEFORE_RULES is
 on then  packets will ender a chain called<b> <i>interface_</i>in</b> where
     <i>interface</i>  is  the name of the interface on which the packet entered.
-Here it's destination  IP  is compared to each of the <i>EXTERNAL</i> IP
+ Here it's destination  IP  is compared to each of the <i>EXTERNAL</i> IP
 addresses from /etc/shorewall/nat   that correspond to this interface; if
 there is a match, DNAT is applied  and the  packet header is modified to
 the IP in the <i>INTERNAL</i> column  of the nat  file record. If the destination
@@ -197,95 +199,89 @@ address doesn't match any of the rules in the  <b><i>interface_</i>in</b>
 chain then the packet enters a chain  called <b><i>sourcezone</i>_dnat</b>
  where <i>sourcezone</i> is the source zone of the packet. There it is compared
  for a match against each of the DNAT records in the rules file that specify
-    <i>  sourcezone </i>as the source  zone. If a match is found, the destination
+    <i>  sourcezone     </i>as the source  zone. If a match is found, the
-IP  address (and possibly the destination port) is modified based on the
+destination IP  address (and possibly the destination port) is modified based
-rule  matched. If NAT_BEFORE_RULES is off, then the order of traversal of
+on the rule  matched. If NAT_BEFORE_RULES is off, then the order of traversal
-the <b><i>  interface_</i>in</b> and <b><i>sourcezone</i>_dnat</b>  is reversed.<br>
+of the <b><i>  interface_</i>in</b> and <b><i>sourcezone</i>_dnat</b>  is
+reversed.<br>
+       <br>
+     </li>
+     <li>Depending on whether the packet is destined for the firewall itself 
+ or for another system, it follows either the left or the right path. Traffic 
+ going to the firewall goes through chain called INPUT in the mangle table. 
+ Shorewall doesn't add any rules to that chain.<br>
+     <br>
+   </li>
+   <li>Traffic that is to be forwarded to another host goes through the chains 
+called FORWARD in the mangle table. If MARK_IN_FORWARD=Yes in shorewall.conf, 
+all rules in /etc/shorewall/tcrules that do not specify Prerouting (:P) are 
+processed in a chain called <br>
      <br>
    </li>
-   <li>Depending on whether the packet is destined for the firewall itself 
-or for another system, it follows either the left or the right path. Traffic 
-going to the firewall goes through chains called INPUT in the mangle table. 
-Shorewall doesn't add any rules to that chain. Traffic next passes the the 
-INPUT chain in the filter table where it is broken out based on the interface 
-on which the packet arrived; packets from interface <i>interface</i> are routed
-to chain <b><i>interface</i>_in</b>. For example, packets arriving through
-eth0 are passed to the chain <b>eth0_in.</b></li>
    
   <ol>
-     <li>The first rule in  <b><i>interface</i>_in</b> jumps to the chain 
-named <b>dynamic</b> which matches the source IP in the packet against all 
-of the addresses that have been blacklisted using <a
- href="blacklisting_support.htm#Dynamic">dynamic blacklisting</a>.</li>
-     <li>If the the interface has the <b>norfc1918</b> option then the packet 
-is sent down the <b>rfc1918 </b>which checks the source address against those 
-listed in /etc/shorewall/rfc1918 and treats the packet according to the first 
-match in that file (if any).</li>
-     <li>If the interface has the  <b>dhcp </b>option, UDP packets to ports 
-67 and 68 are accepted.</li>
-     <li><br>
-     </li>
                  
   </ol>
-   <li>Traffic is next sent to an<i> input </i>chain in the mail Netfilter
+     <li>Traffic is next sent to an<i> interface </i>chain in the main Netfilter
- table  (called 'filter'). If the traffic is destined for the  firewall itself,
+  table  (called 'filter'). If the traffic is destined for the  firewall
- the name of the input chain is formed by appending "_in" to  the interface
+itself,   the name of the interface chain is formed by appending "_in" to
- name. So traffic on eth0 destined for the firewall will enter a  chain called
+ the interface   name. So traffic on eth0 destined for the firewall will
-     <i>eth0_in</i>. The input chain for traffic that will be routed to 
+enter a  chain called       <i>eth0_in</i>. The interface chain for traffic
-another  system is formed by appending "_fwd" to the interface name. So traffic
+that will be routed to  another  system is formed by appending "_fwd" to
- from  eth1 that is going to be forwarded enters a chain called<i> eth1_fwd</i>. 
+the interface name. So traffic  from  eth1 that is going to be forwarded
-  Interfaces described with the wild-card character ("+") in  /etc/shorewall/interfaces,
+enters a chain called<i> eth1_fwd</i>.    Interfaces described with the wild-card
- share input chains. if <i>ppp+ </i>appears in  /etc/shorewall/interfaces
+character ("+") in  /etc/shorewall/interfaces,  share input chains. if <i>ppp+
-then all PPP interfaces (ppp0, ppp1, ...) will share  the input chains <i>ppp_in</i>
+    </i>appears in  /etc/shorewall/interfaces then all PPP interfaces (ppp0,
- and <i>ppp_fwd</i>. In other words, "+" is  deleted from the name before
+ppp1, ...) will share  the interface chains <i>ppp_in</i>  and <i>ppp_fwd</i>.
-forming the input chain names.</li>
+In other words, "+" is  deleted from the name before forming the input chain
+names.<br>
+     <br>
+ While the use of interfacechains may seem wasteful in simple environments,
+  in  complex setups it substantially reduces the number of rules that each
+  packet  must traverse.  </li>
      
 </ol>
                                          
-<p>  While the use of input chains may seem wasteful in simple environments,
- in  complex setups it substantially reduces the number of rules that each
- packet  must traverse.  </p>
-           
 <p>  Traffic directed from a zone to the firewall itself is sent through
 a chain named &lt;<i>zone name&gt;</i>2fw. For example, traffic inbound from 
- the   internet and addressed to the firewall is sent through a chain named 
+  the   internet and addressed to the firewall is sent through a chain named 
- net2fw.   Similarly, traffic originating in the firewall and being sent to
+  net2fw.   Similarly, traffic originating in the firewall and being sent 
- a host in a   given zone is sent through a chain named fw2<i>&lt;zone name&gt;.
+to  a host in a   given zone is sent through a chain named fw2<i>&lt;zone 
-       </i>For   example, traffic originating in the firewall and destined
+name&gt;.        </i>For   example, traffic originating in the firewall and 
- for a host in the   local network is sent through a chain named <i>fw2loc.</i>
+destined  for a host in the   local network is sent through a chain named 
-       <font face="Century Gothic, Arial, Helvetica">   </font></p>
+<i>fw2loc.</i>        <font face="Century Gothic, Arial, Helvetica">   </font></p>
                
 <p>  Traffic being forwarded between two zones (or from one interface to
 a zone to another interface to that zone) is sent through a chain named <i> 
- &lt;source   zone&gt;</i>2<i> &lt;destination zone&gt;</i>. So for example, 
+  &lt;source   zone&gt;</i>2<i> &lt;destination zone&gt;</i>. So for example, 
- traffic   originating in a local system and destined for a remote web server 
+  traffic   originating in a local system and destined for a remote web server 
- is   sent through chain       <i>loc2net. </i>This chain is referred to as
+  is   sent through chain       <i>loc2net. </i>This chain is referred to 
-the <i>canonical</i>    chain from &lt;source zone&gt; to &lt;destination 
+as the <i>canonical</i>    chain from &lt;source zone&gt; to &lt;destination 
- zone&gt;. Any destination NAT will have occurred <u>before</u>   the packet 
+  zone&gt;. Any destination NAT will have occurred <u>before</u>   the packet 
- traverses one of these chains so rules in /etc/shorewall/rules   should be
+  traverses one of these chains so rules in /etc/shorewall/rules   should 
- expressed in terms of the destination system's real IP address as   opposed 
+be  expressed in terms of the destination system's real IP address as   opposed 
- to its apparent external address. Similarly, source NAT will occur <u>after</u> 
+  to its apparent external address. Similarly, source NAT will occur <u>after</u> 
-     the packet has traversed the appropriate forwarding chain so the rules 
+      the packet has traversed the appropriate forwarding chain so the rules 
- again   will be expressed using the source system's real IP address.</p>
+  again   will be expressed using the source system's real IP address.</p>
                
 <p>  For each record in the /etc/shorewall/policy file, a chain is   created.
- Policies in that file are expressed in terms of a source zone and   destination
+  Policies in that file are expressed in terms of a source zone and   destination
- zone where these zones may be a zone defined in   /etc/shorewall/zones,
+  zone where these zones may be a zone defined in   /etc/shorewall/zones,
 "fw"  or "all". Policies specifying   the pseudo-zone "all" matches all defined
- zones and "fw".   These chains are referred to as <i>Policy Chains.</i> Notice
+  zones and "fw".   These chains are referred to as <i>Policy Chains.</i> Notice
- that for an   ordered pair of zones (za,zb), the canonical chain (za2zb)
+  that for an   ordered pair of zones (za,zb), the canonical chain (za2zb)
-may also be the    policy chain for the pair or the policy chain may be a
+ may also be the    policy chain for the pair or the policy chain may be
-different chain   (za2all, for example). Packets from one zone to another
+a  different chain   (za2all, for example). Packets from one zone to another
-will traverse chains    as follows:</p>
+ will traverse chains    as follows:</p>
                
 <ol>
-           <li>  If the canonical chain exists, packets first traverse that
+             <li>  If the canonical chain exists, packets first traverse
- chain.</li>
+that   chain.</li>
-           <li>  If the canonical chain and policy chain are different and
+             <li>  If the canonical chain and policy chain are different
- the packet    does not match a rule in the canonical chain, it then is sent
+and   the packet    does not match a rule in the canonical chain, it then
- to the      policy chain.</li>
+is sent   to the      policy chain.</li>
-           <li>  If the canonical chain does not exist, packets are sent
+             <li>  If the canonical chain does not exist, packets are sent
-immediately    to the policy chain.</li>
+ immediately    to the policy chain.</li>
                
 </ol>
                
@@ -294,40 +290,42 @@ there are   exception rules defined in /etc/shorewall/rules for packets going
 from za to   zb.</p>
                
 <p>  Shorewall is built on top of the Netfilter kernel facility. Netfilter 
- implements connection tracking function that allow what is often referred 
+  implements connection tracking function that allow what is often referred 
- to   as "statefull inspection" of packets. This statefull property allows 
+  to   as "statefull inspection" of packets. This statefull property allows 
-   firewall rules to be defined in terms of "connections" rather than   in 
+    firewall rules to be defined in terms of "connections" rather than   in
- terms of "packets". With Shorewall, you:</p>
+  terms of "packets". With Shorewall, you:</p>
                
 <ol>
-           <li>  Identify the client's zone.</li>
+             <li>  Identify the client's zone.</li>
-           <li>  Identify the server's zone.</li>
+             <li>  Identify the server's zone.</li>
-           <li>  If the POLICY from the client's zone to the server's zone
+             <li>  If the POLICY from the client's zone to the server's zone
- is what you     want for this client/server pair, you need do nothing further.</li>
+  is what you     want for this client/server pair, you need do nothing further.</li>
-           <li>  If the POLICY is not what you want, then you must add a
+             <li>  If the POLICY is not what you want, then you must add
-rule.  That rule       is expressed in terms of the client's zone and the
+a  rule.  That rule       is expressed in terms of the client's zone and
-server's  zone.</li>
+the  server's  zone.</li>
                
 </ol>
                
 <p>  Just because connections of a particular type are allowed between zone
- A   and the firewall and are also allowed between the firewall and zone
+  A   and the firewall and are also allowed between the firewall and zone
 B  <font color="#ff6633"><b><u>   DOES   NOT mean that these connections
 are  allowed between zone A and zone  B</u></b></font>.   It rather means
 that  you can have a proxy running on the firewall that accepts   a connection
-from zone A and then establishes its own separate connection from   the firewall
+ from zone A and then establishes its own separate connection from   the
- to zone B.</p>
+firewall   to zone B.</p>
                
 <p>  If you adopt the default policy of ACCEPT from the local zone to the
-   internet zone and you are having problems connecting from a local client
+    internet zone and you are having problems connecting from a local client
- to an   internet server, <font color="#ff6633"><b><u> adding a rule won't
+  to an   internet server, <font color="#ff6633"><b><u> adding a rule won't
- help</u></b></font>     (see point 3 above).</p>
+  help</u></b></font>     (see point 3 above).</p>
          
 <p><font size="2">Last modified 5/22/2003 - <a href="support.htm">Tom Eastep</a></font></p>
        
 <p><font face="Trebuchet MS"><a href="copyright.htm"> <font size="2">Copyright</font>
- © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+  © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
-  <br>
+    <br>
+    <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/shorewall_logging.html

@@ -12,145 +12,141 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-                   <tbody>
+                    <tbody>
-                    <tr>
+                     <tr>
-                     <td width="100%">
+                      <td width="100%">         
-
-
       <h1 align="center"><font color="#ffffff">Logging</font></h1>
-                     </td>
+                      </td>
-                   </tr>
+                    </tr>
     
   </tbody> 
 </table>
-  <br>
+   <br>
-  By default, Shorewall directs NetFilter to log using syslog (8). Syslog
+   By default, Shorewall directs NetFilter to log using syslog (8). Syslog 
   classifies log messages by a <i>facility</i> and a <i>priority</i> (using 
    the notation <i>facility.priority</i>). <br>
-      <br>
+       <br>
-      The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
+       The facilities defined by syslog are <i>auth, authpriv, cron, daemon, 
  kern,  lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through 
   <i>local7</i>.<br>
-      <br>
+       <br>
-      Throughout the Shorewall documentation, I will use the term <i>level</i>
+       Throughout the Shorewall documentation, I will use the term <i>level</i> 
    rather than <i>priority</i> since <i>level</i> is the term used by NetFilter. 
    The syslog documentation uses the term <i>priority</i>.<br>
   
 <h3>Syslog Levels<br>
-        </h3>
+         </h3>
-        Syslog levels are a method of describing to syslog (8) the importance
+         Syslog levels are a method of describing to syslog (8) the importance 
    of  a message and a number of Shorewall parameters have a syslog level 
 as   their  value.<br>
-          <br>
+           <br>
-          Valid levels are:<br>
+           Valid levels are:<br>
-          <br>
+           <br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  debug<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  info<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  notice<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  warning<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  err<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  crit<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  alert<br>
-          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+           &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
  emerg<br>
-          <br>
+           <br>
-          For most Shorewall logging, a level of 6 (info) is appropriate.
+           For most Shorewall logging, a level of 6 (info) is appropriate. 
 Shorewall     log messages are generated by NetFilter and are logged using 
 the <i>kern</i>    facility  and the level that you specify. If you are unsure 
 of the level    to choose,  6 (info) is a safe bet. You may specify levels 
 by name or by   number.<br>
-        <br>
+         <br>
-        Syslogd writes log messages to files (typically in /var/log/*) based
+         Syslogd writes log messages to files (typically in /var/log/*) based 
   on  their facility and level. The mapping of these facility/level pairs 
 to  log  files is done in /etc/syslog.conf (5). If you make changes to this 
 file,  you must restart syslogd before the changes can take effect.<br>
   
 <h3>Configuring a Separate Log for Shorewall Messages</h3>
-        There are a couple of limitations to syslogd-based logging:<br>
+         There are a couple of limitations to syslogd-based logging:<br>
   
 <ol>
-    <li>If you give, for example, kern.info it's own log destination then
+     <li>If you give, for example, kern.info it's own log destination then 
    that destination will also receive all kernel messages of levels 5 (notice) 
     through 0 (emerg).</li>
-    <li>All kernel.info messages will go to that destination and not just
+     <li>All kernel.info messages will go to that destination and not just 
   those from NetFilter.<br>
-          </li>
+           </li>
   
 </ol>
-        Beginning with Shorewall version 1.3.12, if your kernel has ULOG
+         Beginning with Shorewall version 1.3.12, if your kernel has ULOG 
 target    support (and most vendor-supplied kernels do), you may also specify 
 a log  level of ULOG (must be all caps). When  ULOG is used, Shorewall will 
-direct  netfilter to log the related messages  via the ULOG target which will
+direct  netfilter to log the related messages  via the ULOG target which
-send  them to a process called 'ulogd'. The  ulogd program is available from
+will send  them to a process called 'ulogd'. The  ulogd program is available
-http://www.gnumonks.org/projects/ulogd  and  can be configured to log all
+from http://www.gnumonks.org/projects/ulogd  and  can be configured to log
-Shorewall message to their own log file.<br>
+all Shorewall message to their own log file.<br>
- <br>
+  <br>
- <b>Note: </b>The ULOG logging mechanism is <u>completely separate</u> from
+  <b>Note: </b>The ULOG logging mechanism is <u>completely separate</u> from 
 syslog. Once you switch to ULOG, the settings in /etc/syslog.conf have absolutely 
 no effect on your Shorewall logging (except for Shorewall status messages 
 which still go to syslog).<br>
-    <br>
+     <br>
-You will need to have the kernel source available to compile ulogd.<br>
+ You will need to have the kernel source available to compile ulogd.<br>
-<br>
-Download the ulod tar file and:<br>
-
-<ol>
-    <li>Be sure that /usr/src/linux is linked to your kernel source tree<br>
-  </li>
-  <li>cd /usr/local/src (or wherever you do your builds)</li>
-    <li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
-    <li>cd ulogd-<i>version</i><br>
-      </li>
-    <li>./configure</li>
-    <li>make</li>
-    <li>make install<br>
-      </li>
-
-</ol>
-    If you are like me and don't have a development environment on your firewall,
-  you can do the first six steps on another system then either NFS mount
-your  /usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
-  directory and move it to your firewall system.<br>
-    <br>
-    Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
-
-<ol>
-    <li>syslogfile <i>&lt;file that you wish to log to&gt;</i></li>
-    <li>syslogsync 1</li>
-
-</ol>
-    I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init
-to  /etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
-  to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple
-"chkconfig   --level 3 ulogd on" starts ulogd during boot up. Your init system
-may need   something else done to activate the script.<br>
  <br>
- You will need to change all instances of log levels (usually 'info') in
+ Download the ulod tar file and:<br>
+  
+<ol>
+     <li>Be sure that /usr/src/linux is linked to your kernel source tree<br>
+   </li>
+   <li>cd /usr/local/src (or wherever you do your builds)</li>
+     <li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
+     <li>cd ulogd-<i>version</i><br>
+       </li>
+     <li>./configure</li>
+     <li>make</li>
+     <li>make install<br>
+       </li>
+  
+</ol>
+     If you are like me and don't have a development environment on your
+firewall,   you can do the first six steps on another system then either
+NFS mount your  /usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i> 
+  directory and move it to your firewall system.<br>
+     <br>
+     Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
+  
+<ol>
+     <li>syslogfile <i>&lt;file that you wish to log to&gt;</i></li>
+     <li>syslogsync 1</li>
+  
+</ol>
+     I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init 
+to  /etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd" 
+  to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
+  --level 3 ulogd on" starts ulogd during boot up. Your init system may need
+  something else done to activate the script.<br>
+  <br>
+  You will need to change all instances of log levels (usually 'info') in 
 your configuration files to 'ULOG' - this includes entries in the policy, 
 rules and shorewall.conf files. Here's what I have:<br>
   
 <pre>	[root@gateway shorewall]# grep ULOG *<br>	policy:loc&nbsp; fw&nbsp;&nbsp; REJECT&nbsp; ULOG<br>	policy:net&nbsp; all&nbsp; DROP&nbsp;&nbsp;&nbsp; ULOG&nbsp;&nbsp;&nbsp;10/sec:40<br>	policy:all&nbsp; all&nbsp; REJECT&nbsp; ULOG<br>	rules:REJECT:ULOG loc net tcp 6667<br>	shorewall.conf:TCP_FLAGS_LOG_LEVEL=ULOG<br>	shorewall.conf:RFC1918_LOG_LEVEL=ULOG<br>	[root@gateway shorewall]#<br></pre>
-    Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i>&lt;file
+     Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i>&lt;file 
  that  you wish to log to&gt;</i>. This tells the /sbin/shorewall program 
-where to look for the log when processing its "show log", "logwatch" and
+where to look for the log when processing its "show log", "logwatch" and "monitor"
-"monitor"  commands.<br>
+ commands.<br>
   
 <p><font size="2">   Updated 1/11/2003 - <a href="support.htm">Tom  Eastep</a> 
           </font></p>
     
-
-
 <p><a href="copyright.htm"><font size="2">Copyright</font>           &copy; 
 <font size="2">2001, 2002, 2003 Thomas M. Eastep</font></a><br>
-     </p>
+      </p>
-
+  <br>
 </body>
 </html>

STABLE/documentation/shorewall_mirrors.htm

@@ -16,78 +16,86 @@
               
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-          <tbody>
+             <tbody>
-           <tr>
+              <tr>
-            <td width="100%">                            
+               <td width="100%">                                        
+       
       <h1 align="center"><font color="#ffffff">Shorewall Mirrors</font></h1>
-            </td>
+               </td>
-          </tr>
+             </tr>
                             
   </tbody>       
 </table>
               
 <p align="left"><b>Remember that updates to the mirrors are often delayed 
-   for  6-12 hours after an update to the primary rsync site. For HTML content,
+    for  6-12 hours after an update to the primary rsync site. For HTML content, 
-  the main web site (<a href="http://shorewall.sf.net">http://shorewall.sf.net</a>)
+   the main web site (<a href="http://shorewall.sf.net">http://shorewall.sf.net</a>) 
-  is updated at the same time as the rsync site.</b></p>
+   is updated at the same time as the rsync site.</b></p>
               
 <p align="left">The main Shorewall Web Site is <a
  href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a> 
-   and is located in California, USA. It is mirrored at:</p>
+    and is located in California, USA. It is mirrored at:</p>
               
 <ul>
-          <li><a target="_top" href="http://slovakia.shorewall.net">   http://slovakia.shorewall.net</a>
+             <li><a target="_top" href="http://slovakia.shorewall.net"> 
-        (Slovak Republic).</li>
+ http://slovakia.shorewall.net</a>          (Slovak Republic).</li>
-          <li>     <a href="http://www.infohiiway.com/shorewall"
+             <li>     <a href="http://www.infohiiway.com/shorewall"
  target="_top">   http://shorewall.infohiiway.com</a>     (Texas, USA).</li>
-          <li><a target="_top" href="http://germany.shorewall.net">   http://germany.shorewall.net</a>
+             <li><a target="_top" href="http://germany.shorewall.net">  
-   (Hamburg, Germany)</li>
+http://germany.shorewall.net</a>     (Hamburg, Germany)</li>
-                  <li><a target="_top"
+                     <li><a target="_top"
  href="http://france.shorewall.net">http://france.shorewall.net</a>      
- (Paris, France)</li>
+(Paris, France)</li>
-     <li><a href="http://shorewall.syachile.cl" target="_top">http://shorewall.syachile.cl 
+        <li><a href="http://shorewall.syachile.cl" target="_top">http://shorewall.syachile.cl
-     </a>(Santiago Chile)</li>
+       </a>(Santiago Chile)</li>
-   <li><a href="http://shorewall.greshko.com" target="_top">http://shorewall.greshko.com</a> 
+      <li><a href="http://shorewall.greshko.com" target="_top">http://shorewall.greshko.com</a>
-(Taipei, Taiwan)<br>
+  (Taipei, Taiwan)</li>
+    <li><a href="http://argentina.shorewall.net" target="_top">http://argentina.shorewall.net</a>
+ (Argentina)</li>
+   <li><a href="http://shorewall.securityopensource.org.br"
+ target="_top">http://shorewall.securityopensource.org.br</a> (Brazil)<br>
    </li>
-         <li><a href="http://www.shorewall.net" target="_top">http://www.shorewall.net</a>
+            <li><a href="http://www.shorewall.net" target="_top">http://www.shorewall.net</a> 
-   (Washington State, USA)<br>
+    (Washington State, USA)<br>
-         </li>
+            </li>
               
 </ul>
               
 <p align="left">The rsync site is mirrored via FTP at:</p>
               
 <ul>
-          <li><a target="_blank"
+             <li><a target="_blank"
  href="ftp://slovakia.shorewall.net/mirror/shorewall/">ftp://slovakia.shorewall.net/mirror/shorewall</a> 
-        (Slovak Republic).</li>
+         (Slovak Republic).</li>
-          <li>     <a
+             <li>     <a
  href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall/" target="_blank">ftp://ftp.infohiiway.com/pub/shorewall</a>
-     (Texas, USA).</li>
+       (Texas, USA).</li>
-          <li><a target="_blank"
+             <li><a target="_blank"
  href="ftp://germany.shorewall.net/pub/shorewall">   ftp://germany.shorewall.net/pub/shorewall</a> 
-   (Hamburg, Germany)</li>
+    (Hamburg, Germany)</li>
-                  <li>   <a target="_blank"
+                     <li>   <a target="_blank"
  href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a> 
-      (Paris, France)</li>
+       (Paris, France)</li>
-   <li><a href="ftp://shorewall.greshko.com/pub/shorewall" target="_top">ftp://shorewall.greshko.com</a> 
+      <li><a href="ftp://shorewall.greshko.com/pub/shorewall"
-(Taipei, Taiwan)</li>
+ target="_top">ftp://shorewall.greshko.com</a>  (Taipei, Taiwan)</li>
-   <li><a href="ftp://ftp.shorewall.net/pub/shorewall" target="_blank">ftp://ftp.shorewall.net 
+      <li><a href="ftp://ftp.shorewall.net/pub/shorewall"
-    </a>(Washington State, USA)<br>
+ target="_blank">ftp://ftp.shorewall.net       </a>(Washington State, USA)<br>
-   </li>
+      </li>
               
 </ul>
-     Search results and the mailing list archives are always fetched from 
+        Search results and the mailing list archives are always fetched from
-the  site in Washington State.<br>
+  the  site in Washington State.<br>
               
-<p align="left"><font size="2">Last Updated 6/5/2003 - <a
+<p align="left"><font size="2">Last Updated 7/15/2003 - <a
  href="support.htm">Tom Eastep</a></font></p>
               
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
  size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+            <br>
+          <br>
          <br>
+        <br>
        <br>
       <br>
      <br>

STABLE/documentation/shorewall_prerequisites.htm

@@ -16,53 +16,68 @@
         
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-       <tbody>
+           <tbody>
-        <tr>
+            <tr>
-         <td width="100%">
+             <td width="100%">                            
       <h1 align="center"><font color="#ffffff">Shorewall Requirements</font></h1>
-         </td>
+             </td>
-       </tr>
+           </tr>
                 
   </tbody>    
 </table>
-      <br>
+          <br>
-  Shorewall Requires:<br>
+      Shorewall Requires:<br>
         
 <ul>
-       <li>A kernel that supports netfilter. I've tested with 2.4.2 - 2.4.20.
+           <li>A kernel that supports netfilter. I've tested with 2.4.2 - 
-With current releases of Shorewall, Traffic Shaping/Control requires at least
+2.4.20.  With current releases of Shorewall, Traffic Shaping/Control requires 
-2.4.18.        <a href="kernel.htm">     Check here for kernel configuration
+at least  2.4.18.        <a href="kernel.htm">     Check here for kernel configuration
-      information.</a>       If you are looking for a firewall for use with
+       information.</a>       If you are looking for a firewall for use with
-2.2 kernels, <a href="http://seawall.sf.net">     see       the Seattle Firewall
+ 2.2 kernels, <a href="http://seawall.sf.net">     see       the Seattle
- site</a>     .</li>
+Firewall   site</a>     .</li>
-       <li>iptables 1.2 or later  but beware version 1.2.3 -- see the <a
+           <li>iptables 1.2 or later  but beware version 1.2.3 -- see the 
- href="errata.htm">Errata</a>.   <font color="#ff0000"><b>WARNING: </b></font>The
+    <a href="errata.htm">Errata</a>.   <font color="#ff0000"><b>WARNING: 
-  buggy iptables version 1.2.3    is included in RedHat 7.2 and you should
+   </b></font>The    buggy iptables version 1.2.3    is included in RedHat 
- upgrade to iptables 1.2.4 prior to    installing Shorewall. Version 1.2.4
+7.2 and you should   upgrade to iptables 1.2.4 prior to    installing Shorewall. 
- is available   <a
+Version 1.2.4   is available   <a
  href="http://www.redhat.com/support/errata/RHSA-2001-144.html">from RedHat</a>
-    and in the <a href="errata.htm">Shorewall Errata</a>.   </li>
+      and in the <a href="errata.htm">Shorewall Errata</a>.   </li>
-       <li>Iproute ("ip" utility). The iproute package  is     included with
+           <li>Iproute ("ip" utility). The iproute package  is     included 
-most distributions but may not be installed by default.  The     official
+ with most distributions but may not be installed by default.  The     official
-download site is <a href="ftp://ftp.inr.ac.ru/ip-routing"
+  download site is <a href="ftp://ftp.inr.ac.ru/ip-routing"
  target="_blank">   <font face="Century Gothic, Arial, Helvetica">f</font>tp://ftp.inr.ac.ru/ip-routing</a>.
-    </li>
+      </li>
-       <li>A Bourne shell or derivative such as bash or ash. This shell must
+           <li>A Bourne shell or derivative such as bash or ash. This shell 
- have correct       support for variable expansion formats ${<i>variable</i>%<i>pattern</i>
+ must  have correct       support for variable expansion formats ${<i>variable</i>%<i>pattern</i>
-     },        ${<i>variable</i>%%<i>pattern</i>}, ${<i>variable</i>#<i>pattern</i>
+       },        ${<i>variable</i>%%<i>pattern</i>}, ${<i>variable</i>#<i>pattern</i>
-      } and       ${<i>variable</i>##<i>pattern</i>}.</li>
+        } and       ${<i>variable</i>##<i>pattern</i>}.</li>
-       <li>The firewall monitoring display is greatly improved if you have
+    <li>Your shell must produce a sensible result when a number n (128 &lt;= 
- awk        (gawk) installed.</li>
+n &lt;= 255)  is left shifted by 24 bits. You can check this at a shell prompt 
+by:</li>
+           
+  <ul>
+       <li>echo $((128 &lt;&lt; 24))<br>
+      </li>
+       <li>The result must be either 2147483648 or -2147483648.<br>
+      </li>
+                     
+  </ul>
+           <li>The firewall monitoring display is greatly improved if you 
+have   awk        (gawk) installed.</li>
         
 </ul>
         
-<p align="left"><font size="2">Last updated 3/19/2003 - <a
+<p align="left"><font size="2">Last updated 7/8/2003 - <a
  href="support.htm">Tom Eastep</a></font></p>
         
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
  size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
+          <br>
+        <br>
+       <br>
       <br>
+     <br>
     <br>
    <br>
   <br>

STABLE/documentation/shorewall_quickstart_guide.htm

@@ -12,281 +12,334 @@
  content="text/html; charset=windows-1252">
   <title>Shorewall QuickStart Guide</title>
                                                                         
+             
   <meta name="Microsoft Theme" content="none">
 </head>
   <body>
                         
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                                <tbody>
+                                     <tbody>
-                                 <tr>
+                                      <tr>
-                                  <td width="100%">                     
+                                       <td width="100%">                
                                                                      
       <h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
-       (HOWTO's)<br>
+          (HOWTO's)<br>
-                              Version 4.0</font></h1>
+                                   </font></h1>
-                                  </td>
+                                       </td>
-                                </tr>
+                                     </tr>
                                                  
   </tbody>            
 </table>
                         
-<p align="center">With thanks to Richard who reminded me once again that we
+<p align="center">With thanks to Richard who reminded me once again that
-must  all first walk before we can run.<br>
+we must  all first walk before we can run.<br>
-             The French Translations are courtesy of Patrice Vetsel<br>
+                  The French Translations are courtesy of Patrice Vetsel<br>
-             </p>
+                  </p>
                         
 <h2>The Guides</h2>
                         
 <p>These guides provide step-by-step instructions for configuring Shorewall
-              in  common firewall setups.</p>
+                 in  common firewall setups.</p>
                         
-<p>The following guides are for <b>users who have a single public IP address</b>:</p>
+<p>If you have a <font color="#ff0000"><big><big><b>single public IP address</b></big></big></font>:</p>
                         
-<ul>
+<blockquote>
-                                <li><a href="standalone.htm">Standalone</a> 
+  <ul>
- Linux    System   (<a href="standalone_fr.html">Version Française</a>)</li>
+                                     <li><a href="standalone.htm">Standalone</a>
-                                <li><a href="two-interface.htm">Two-interface</a> 
+    Linux    System   (<a href="standalone_fr.html">Version Française</a>)</li>
-    Linux    System    acting    as a    firewall/router for a small local 
+                                     <li><a href="two-interface.htm">Two-interface</a>
- network   (<a href="two-interface_fr.html">Version Française</a>)</li>
+       Linux    System    acting    as a    firewall/router for a small local
-                                <li><a href="three-interface.htm">Three-interface</a> 
+    network   (<a href="two-interface_fr.html">Version Française</a>)</li>
-      Linux    System    acting  as a    firewall/router for a small local 
+                                     <li><a href="three-interface.htm">Three-interface</a>
- network     and  a  DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
+         Linux    System    acting  as a    firewall/router for a small local
+    network     and  a  DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
                         
-</ul>
+  </ul>
+  <p>The above guides are designed to get your first firewall up and running
+                  quickly in the three most common Shorewall configurations.
+If you want to learn more about Shorewall than is explained in the above
+simple guides,  the <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a>
+(See      Index Below) is for you.</p>
+</blockquote>
                                                 
-<p>The above guides are designed to get your first firewall up and running 
+<p>If you have <font color="#ff0000"><big><big><b>more than one public IP
-               quickly in the three most common Shorewall configurations.</p>
+address</b></big></big></font>:<br>
-              
+</p>
-<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> (See 
+<blockquote>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a>
-  Index Below) outlines              the steps necessary to set up a firewall 
+(See      Index Below) outlines              the steps necessary to set up
-  where <b>there are multiple         public    IP  addresses involved or 
+a firewall      where there are <small><small><big><big>multiple        
-if  you want to learn more about   Shorewall      than   is  explained in 
+public    IP  addresses</big></big></small></small> involved or   if  you
-the  single-address guides above.</b></p>
+want to learn more about   Shorewall      than   is  explained in   the 
+single-address guides above.</blockquote>
                         
 <ul>
                                                    
 </ul>
                         
-<h2><a name="Documentation"></a>Documentation Index</h2>
+<h2><b><a name="Documentation"></a></b>Documentation Index</h2>
                         
 <p>The following documentation covers a variety of topics and <b>supplements
-              the  <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a> 
+                 the  <a href="shorewall_quickstart_guide.htm">QuickStart
-        described      above</b>. Please review the appropriate guide before 
+Guides</a>           described      above</b>. Please review the appropriate
-   trying     to use this    documentation directly.</p>
+guide before      trying     to use this    documentation directly.</p>
                         
 <ul>
-                                <li><a
+                                     <li><a
  href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
-   (e.g., eth0:0)</a><br>
+      (e.g., eth0:0)</a><br>
-          </li>
+               </li>
-          <li><a href="blacklisting_support.htm">Blacklisting</a>       
+               <li><a href="blacklisting_support.htm">Blacklisting</a>  
                                                            
     <ul>
-                                  <li>Static Blacklisting using /etc/shorewall/blacklist</li>
+                                       <li>Static Blacklisting using /etc/shorewall/blacklist</li>
-                                  <li>Dynamic Blacklisting using /sbin/shorewall</li>
+                                       <li>Dynamic Blacklisting using /sbin/shorewall</li>
                                                                         
     </ul>
-                                </li>
+                                     </li>
-                                <li><a
+                                     <li><a
  href="configuration_file_basics.htm">Common    configuration        file 
-   features</a>                                     
+     features</a>                                                        
+     
     <ul>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#Comments">Comments  in configuration
-      files</a></li>
+         files</a></li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
-        <li><a href="configuration_file_basics.htm#INCLUDE">INCLUDE Directive</a><br>
+             <li><a href="configuration_file_basics.htm#INCLUDE">INCLUDE
-        </li>
+Directive</a><br>
-                                  <li><a
+             </li>
+                                       <li><a
  href="configuration_file_basics.htm#Ports">Port    Numbers/Service Names</a></li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#Ranges">Port   Ranges</a></li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#Variables">Using  Shell Variables</a></li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#dnsnames">Using  DNS Names</a><br>
-                             </li>
+                                  </li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#Compliment">Complementing an IP address
-       or Subnet</a></li>
+          or Subnet</a></li>
-                                  <li><a
+                                       <li><a
- href="configuration_file_basics.htm#Configs">Shorewall   Configurations
+ href="configuration_file_basics.htm#Configs">Shorewall   Configurations (making
-(making a test configuration)</a></li>
+a test configuration)</a></li>
-                                  <li><a
+                                       <li><a
  href="configuration_file_basics.htm#MAC">Using    MAC Addresses in Shorewall</a></li>
                                                                         
+        
     </ul>
-                                </li>
+                                     </li>
-                                <li><a href="Documentation.htm">Configuration 
+                                     <li><a href="Documentation.htm">Configuration
-  File   Reference      Manual</a>                                    
+     File   Reference      Manual</a>                                   
+                         
     <ul>
-                                  <li>   <a
+                                       <li>   <a
  href="Documentation.htm#Variables">params</a></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Zones">zones</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Interfaces">interfaces</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Hosts">hosts</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Policy">policy</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Rules">rules</a></font></li>
-                                  <li><a href="Documentation.htm#Common">common</a></li>
+                                       <li><a
-                                  <li><font color="#000099"><a
+ href="Documentation.htm#Common">common</a></li>
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Masq">masq</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#NAT">nat</a></font></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Tunnels">tunnels</a></font></li>
-                                  <li><a
+                                       <li><a
  href="traffic_shaping.htm#tcrules">tcrules</a></li>
-                                  <li><font color="#000099"><a
+                                       <li><font color="#000099"><a
  href="Documentation.htm#Conf">shorewall.conf</a></font></li>
-                                  <li><a
+                                       <li><a
  href="Documentation.htm#modules">modules</a></li>
-                                  <li><a href="Documentation.htm#TOS">tos</a> 
+                                       <li><a
-        </li>
+ href="Documentation.htm#TOS">tos</a>           </li>
-                                  <li><a
+                                       <li><a
  href="Documentation.htm#Blacklist">blacklist</a></li>
-                                  <li><a
+                                       <li><a
  href="Documentation.htm#rfc1918">rfc1918</a></li>
-                                  <li><a
+                                       <li><a
  href="Documentation.htm#Routestopped">routestopped</a></li>
                                                                         
     </ul>
-                                </li>
+                                     </li>
-                                <li><a href="dhcp.htm">DHCP</a></li>
+                                     <li><a href="CorpNetwork.htm">Corporate
-                                <li><a href="ECN.html">ECN Disabling by host
+ Network Example</a> (Contributed by a Graeme Boyle)<br>
-  or  subnet</a><br>
+    </li>
-        </li>
+    <li><a href="dhcp.htm">DHCP</a></li>
-        <li><font color="#000099"><a
+                                     <li><a href="ECN.html">ECN Disabling 
+by  host   or  subnet</a></li>
+      <li><a href="errata.htm">Errata</a><br>
+      </li>
+             <li><font color="#000099"><a
  href="shorewall_extension_scripts.htm">Extension    Scripts</a></font>  
-  (How to extend Shorewall without modifying Shorewall    code through the
+ (How to extend Shorewall without modifying Shorewall    code through the 
- use of files in /etc/shorewall -- /etc/shorewall/start,   /etc/shorewall/stopped,
+   use of files in /etc/shorewall -- /etc/shorewall/start,   /etc/shorewall/stopped, 
- etc.)</li>
+   etc.)</li>
-                                <li><a href="fallback.htm">Fallback/Uninstall</a></li>
+                                     <li><a href="fallback.htm">Fallback/Uninstall</a></li>
-                                <li><a
+      <li><a href="FAQ.htm">FAQs</a><br>
+      </li>
+      <li><a href="shorewall_features.htm">Features</a><br>
+      </li>
+                                     <li><a
  href="shorewall_firewall_structure.htm">Firewall      Structure</a></li>
-                                <li><font color="#000099"><a
+      <li><a href="support.htm">Getting help or answers to questions</a></li>
- href="kernel.htm">Kernel     Configuration</a></font></li>
+      <li>Greater Seattle Linux Users Group Presentation</li>
-                   <li><a href="shorewall_logging.html">Logging</a><br>
-                   </li>
-                                <li><a href="MAC_Validation.html">MAC Verification</a><br>
-                  </li>
-                                       <li><a href="myfiles.htm">My Shorewall 
-  Configuration   (How I personally use Shorewall)</a><br>
-            </li>
-            <li><a href="ping.html">'Ping' Management</a><br>
-                    </li>
-                    <li><a href="ports.htm">Port Information</a>        
-                            
-    <ul>
-                                  <li>Which applications use which ports</li>
-                                  <li>Ports used by Trojans</li>
-                                           
-    </ul>
-                                </li>
-                                <li><a href="ProxyARP.htm">Proxy ARP</a></li>
-                                <li><a href="samba.htm">Samba</a></li>
-       <li><a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a><br>
-       </li>
    
   <ul>
-         <li><a href="shorewall_setup_guide.htm#Introduction">1.0   Introduction</a></li>
+     <li><a href="GSLUG.htm">HTML</a></li>
-         <li><a href="shorewall_setup_guide.htm#Concepts">2.0   Shorewall 
+     <li><a href="GSLUG.ppt">PowerPoint</a></li>
-     Concepts</a></li>
+   
-         <li><a href="shorewall_setup_guide.htm#Interfaces">3.0   Network 
+  </ul>
-    Interfaces</a></li>
+   <li><a href="Install.htm">Installation/Upgrade</a><br>
-         <li><a href="shorewall_setup_guide.htm#Addressing">4.0   Addressing,
+      </li>
-        Subnets    and Routing</a>                                      
+                                     <li><font color="#000099"><a
+ href="kernel.htm">Kernel     Configuration</a></font></li>
+                        <li><a href="shorewall_logging.html">Logging</a><br>
+                        </li>
+                                     <li><a href="MAC_Validation.html">MAC
+ Verification</a></li>
+      <li><a href="http://lists.shorewall.net">Mailing Lists</a><br>
+      </li>
+                                            <li><a href="myfiles.htm">My
+Shorewall      Configuration   (How I personally use Shorewall)</a><br>
+                 </li>
+                 <li><a href="ping.html">'Ping' Management</a><br>
+                         </li>
+                         <li><a href="ports.htm">Port Information</a>   
+                                                          
+    <ul>
+                                       <li>Which applications use which ports</li>
+                                       <li>Ports used by Trojans</li>
+                                                                        
+    </ul>
+                                     </li>
+                                     <li><a href="ProxyARP.htm">Proxy ARP</a></li>
+      <li><a href="shorewall_prerequisites.htm">Requirements</a><br>
+      </li>
+                                     <li><a href="samba.htm">Samba</a></li>
+            <li><a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a><br>
+            </li>
+                                       
+  <ul>
+              <li><a href="shorewall_setup_guide.htm#Introduction">1.0  
+Introduction</a></li>
+              <li><a href="shorewall_setup_guide.htm#Concepts">2.0   Shorewall
+        Concepts</a></li>
+              <li><a href="shorewall_setup_guide.htm#Interfaces">3.0   Network
+       Interfaces</a></li>
+              <li><a href="shorewall_setup_guide.htm#Addressing">4.0   Addressing, 
+          Subnets    and Routing</a>                                     
                                            
       <ul>
-             <li><a href="shorewall_setup_guide.htm#Addresses">4.1   IP 
+                  <li><a href="shorewall_setup_guide.htm#Addresses">4.1 
-Addresses</a></li>
+ IP   Addresses</a></li>
-             <li><a href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
+                  <li><a href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
-             <li><a href="shorewall_setup_guide.htm#Routing">4.3   Routing</a></li>
+                  <li><a href="shorewall_setup_guide.htm#Routing">4.3   Routing</a></li>
-             <li><a href="shorewall_setup_guide.htm#ARP">4.4   Address  
+                  <li><a href="shorewall_setup_guide.htm#ARP">4.4   Address 
-  Resolution       Protocol (ARP)</a></li>
+     Resolution       Protocol (ARP)</a></li>
+                                                                         
      
       </ul>
                                                                         
+                    
       <ul>
-             <li><a href="shorewall_setup_guide.htm#RFC1918">4.5   RFC  
+                  <li><a href="shorewall_setup_guide.htm#RFC1918">4.5   RFC 
-1918</a></li>
+   1918</a></li>
+                                                                         
      
       </ul>
-                                </li>
+                                     </li>
-         <li><a href="shorewall_setup_guide.htm#Options">5.0   Setting  
+              <li><a href="shorewall_setup_guide.htm#Options">5.0   Setting 
-  up   your   Network</a>                                               
+     up   your   Network</a>                                             
+                                    
       <ul>
-             <li><a href="shorewall_setup_guide.htm#Routed">5.1   Routed</a></li>
+                  <li><a href="shorewall_setup_guide.htm#Routed">5.1   Routed</a></li>
+                                                                         
      
       </ul>
                                                                         
+                    
       <ul>
-             <li><a href="shorewall_setup_guide.htm#NonRouted">5.2   Non-routed</a>
+                  <li><a href="shorewall_setup_guide.htm#NonRouted">5.2 
+ Non-routed</a>                                                         
                                                                         
     
           <ul>
-                 <li><a href="shorewall_setup_guide.htm#SNAT">5.2.1    SNAT</a></li>
+                      <li><a href="shorewall_setup_guide.htm#SNAT">5.2.1
-                 <li><a href="shorewall_setup_guide.htm#DNAT">5.2.2    DNAT</a></li>
+   SNAT</a></li>
-                 <li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3 
+                      <li><a href="shorewall_setup_guide.htm#DNAT">5.2.2
-  Proxy     ARP</a></li>
+   DNAT</a></li>
-                 <li><a href="shorewall_setup_guide.htm#NAT">5.2.4    Static
+                      <li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
-     NAT</a></li>
+     Proxy     ARP</a></li>
+                      <li><a href="shorewall_setup_guide.htm#NAT">5.2.4 
+  Static       NAT</a></li>
+                                                                        
                                               
           </ul>
-                                  </li>
+                                       </li>
-             <li><a href="shorewall_setup_guide.htm#Rules">5.3   Rules</a></li>
+                  <li><a href="shorewall_setup_guide.htm#Rules">5.3   Rules</a></li>
-             <li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4   Odds 
+                  <li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4 
-   and   Ends</a></li>
+  Odds     and   Ends</a></li>
+                                                                         
      
       </ul>
-                                </li>
+                                     </li>
-         <li><a href="shorewall_setup_guide.htm#DNS">6.0  DNS</a></li>
+              <li><a href="shorewall_setup_guide.htm#DNS">6.0  DNS</a></li>
-         <li><a href="shorewall_setup_guide.htm#StartingAndStopping">7.0
+              <li><a
-  Starting     and          Stopping the Firewall</a></li>
+ href="shorewall_setup_guide.htm#StartingAndStopping">7.0     Starting  
+  and          Stopping the Firewall</a></li>
                                        
   </ul>
-       <li><font color="#000099"><a
+            <li><font color="#000099"><a
  href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
                                                 
   <ul>
-                          <li>Description of all /sbin/shorewall commands</li>
+                               <li>Description of all /sbin/shorewall commands</li>
-                          <li>How to safely test a Shorewall configuration
+                               <li>How to safely test a Shorewall configuration 
- change<br>
+   change<br>
-                          </li>
+                               </li>
                                                 
   </ul>
-                                <li><font color="#000099"><a
+                                     <li><font color="#000099"><a
  href="NAT.htm">Static    NAT</a></font></li>
-                <li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent 
+                     <li><a href="Shorewall_Squid_Usage.html">Squid as a
-   Proxy    with Shorewall</a><br>
+Transparent       Proxy    with Shorewall</a></li>
-                </li>
+                                     <li><a href="traffic_shaping.htm">Traffic
-                                <li><a href="traffic_shaping.htm">Traffic 
+   Shaping/QOS</a></li>
-Shaping/QOS</a></li>
+      <li><a href="troubleshoot.htm">Troubleshooting (Things to try if it 
-                                <li>VPN                                 
+doesn't  work)</a><br>
+     </li>
+      <li><a href="upgrade_issues.htm">Upgrade Issues</a><br>
+      </li>
+                                     <li>VPN                            
                                 
     <ul>
-                                  <li><a href="IPSEC.htm">IPSEC</a></li>
+                                       <li><a href="IPSEC.htm">IPSEC</a></li>
-                                  <li><a href="IPIP.htm">GRE and IPIP</a></li>
+                                       <li><a href="IPIP.htm">GRE and IPIP</a></li>
-                  <li><a href="OPENVPN.html">OpenVPN</a><br>
+                       <li><a href="OPENVPN.html">OpenVPN</a><br>
-                  </li>
+                       </li>
-                                  <li><a href="PPTP.htm">PPTP</a></li>
+                                       <li><a href="PPTP.htm">PPTP</a></li>
-      <li><a href="6to4.htm">6t04</a><br>
+           <li><a href="6to4.htm">6t04</a><br>
-      </li>
+           </li>
-                                  <li><a href="VPN.htm">IPSEC/PPTP</a> from 
+                                       <li><a href="VPN.htm">IPSEC/PPTP</a> 
- a  system    behind    your   firewall   to a      remote network.</li>
+ from   a  system    behind    your   firewall   to a      remote network.</li>
                                                                         
     </ul>
-                                </li>
+                                     </li>
-                                <li><a
+                                     <li><a
  href="whitelisting_under_shorewall.htm">White    List   Creation</a></li>
                         
 </ul>
@@ -294,15 +347,11 @@ Shaping/QOS</a></li>
 <p>If you use one of these guides and have a suggestion for improvement <a
  href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
                         
-<p><font size="2">Last modified 5/18/2003 - <a href="support.htm">Tom Eastep</a></font></p>
+<p><font size="2">Last modified 7/18/2003 - <a href="support.htm">Tom Eastep</a></font></p>
                         
 <p><a href="copyright.htm"><font size="2">Copyright  2002, 2003 Thomas M.
-      Eastep</font></a><br>
+         Eastep</font></a><br>
-     </p>
+ </p>
-     <br>
-    <br>
-   <br>
-  <br>
  <br>
 </body>
 </html>

STABLE/documentation/sourceforge_index.htm

@@ -3,57 +3,58 @@
 <head>
                                                                         
                                                                         
+                                             
   <meta http-equiv="Content-Type"
  content="text/html; charset=windows-1252">
-  <title>Shoreline Firewall (Shorewall) 1.3</title>
+  <title>Shoreline Firewall (Shorewall) 1.4</title>
                                                                         
                                                                         
-                  <base target="_self">
+                                                                        
+ <base target="_self">
 </head>
   <body>
                                                                         
+                       
 <table border="0" cellpadding="0" cellspacing="4"
  style="border-collapse: collapse;" width="100%" id="AutoNumber3"
- bgcolor="#4b017c">
+ bgcolor="#3366ff">
                                                                         
-          <tbody>
+                        <tbody>
                                                                         
-         <tr>
+                       <tr>
                                                                         
-                    <td width="33%" height="90" valign="middle"
+                                  <td width="33%" height="90"
- align="left"><a href="http://www.cityofshoreline.com"><img
+ valign="middle" align="left"><a href="http://www.cityofshoreline.com"><img
  src="images/washington.jpg" alt="" width="97" height="80" hspace="4"
  border="0">
-          </a></td>
+                        </a></td>
-         <td valign="middle" width="34%" align="center">                
+                                           <td valign="middle"
-                                                                        
+ bgcolor="#3366ff" width="34%" align="center">                          
-                                                                        
+                                                                       <img
-                                                                    
+ src="images/Logo1.png" alt="(Shorewall Logo)" width="430" height="90">
-      <h1><font color="#ffffff">Shorewall 1.4</font><i><font
+                        </td>
- color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i></h1>
+          <td valign="top" width="33"><br>
           </td>
-          <td valign="middle">                            
+                                                 </tr>
-      <h1 align="center"><a href="http://www.shorewall.net"
+                                                                        
- target="_top"><br>
-                                                              </a></h1>
-          <br>
-          </td>
-                                   </tr>
                                                                         
                              
   </tbody>                                            
 </table>
                                                                         
+                          
 <div align="center">                                                 
 <center>                                                 
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber4">
                                                                         
-              <tbody>
+                            <tbody>
+                                                                        
+                         <tr>
+                                                                        
+                                      <td width="90%">                  
                                                                         
-           <tr>
                                                                         
-                        <td width="90%">                                
                                                                         
                                                                         
                           
@@ -62,38 +63,46 @@
                                                                         
                                                                         
                                                                         
+                                                                        
+                   
       <p>The Shoreline Firewall, more commonly known as  "Shorewall",  is
-                             a       <a href="http://www.netfilter.org">Netfilter</a>
+                                    a       <a
-            (iptables)           based      firewall        that can be used
+ href="http://www.netfilter.org">Netfilter</a>               (iptables) 
-   on   a  dedicated    firewall     system,      a multi-function      
+         based      firewall        that can be used     on   a  dedicated
-      gateway/router/server         or on a  standalone    GNU/Linux    system.</p>
+        firewall     system,      a multi-function             gateway/router/server
+             or on a  standalone    GNU/Linux    system.</p>
+                                                                        
+                                                                        
                                                                         
                                                                         
                                                                         
                  
       <p>This program is free software; you can redistribute it and/or modify
-                                                                        it
+                                                                        
-        under      the    terms      of         <a
+      it          under      the    terms      of         <a
  href="http://www.gnu.org/licenses/gpl.html">Version           2 of  the
 GNU General Public License</a> as published by the Free   Software      
      Foundation.<br>
                                                                         
-                     <br>
+                                   <br>
                                                                         
-          This     program         is   distributed            in   the 
+                        This     program         is   distributed       
-   hope       that      it   will        be  useful,    but          WITHOUT 
+    in    the       hope       that      it   will        be  useful,   
-    ANY         WARRANTY;         without           even the   implied   
+but            WITHOUT        ANY         WARRANTY;         without     
-  warranty          of MERCHANTABILITY                   or  FITNESS    
+     even  the    implied      warranty          of MERCHANTABILITY     
-FOR   A  PARTICULAR          PURPOSE.        See the     GNU  General   
+             or  FITNESS     FOR   A  PARTICULAR          PURPOSE.      
- Public  License                for   more details.<br>
+ See the     GNU  General     Public  License                for   more details.<br>
+                                                                        
+                                   <br>
+                                                                        
+                        You     should       have     received        a 
+ copy       of    the       GNU     General          Public         License 
+                along       with    this   program;            if   not, 
+  write      to    the    Free   Software              Foundation,      
+            Inc.,    675     Mass   Ave,  Cambridge,      MA    02139,  
+    USA</p>
                                                                         
-                     <br>
                                                                         
-          You     should       have     received        a   copy     of 
- the       GNU     General          Public         License              
-  along       with    this   program;            if   not,    write  to 
-  the    Free   Software              Foundation,                   Inc., 
- 675     Mass   Ave,  Cambridge,      MA    02139,       USA</p>
                                                                         
                                                                         
                                                                         
@@ -104,256 +113,381 @@ FOR   A  PARTICULAR          PURPOSE.        See the     GNU  General
                                                                         
                                                                         
                                                                         
-      <h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
-             If so, almost <b>NOTHING </b>on this site will apply directly
- to  your   setup.  If you want to use the documentation that you find here, 
- it  is best   if you  uninstall what you have and install a setup that matches 
-  the documentation    on this site. See the <a href="two-interface.htm">Two-interface
-   QuickStart    Guide</a> for details.<br>
                                                          
+      <h2>This is the Shorewall 1.4 Web Site</h2>
+   The information on this site applies only to 1.4.x releases of Shorewall. 
+ For older versions:<br>
+                                               
+      <ul>
+              <li>The 1.3 site is <a href="http://www.shorewall.net/1.3"
+ target="_top">here.</a></li>
+              <li>The 1.2 site is <a href="http://shorewall.net/1.2/"
+ target="_top">here</a>.<br>
+              </li>
+                                               
+      </ul>
                                                
       <h2>Getting Started with Shorewall</h2>
-                   New to Shorewall? Start by selecting the <a
+                                      New to Shorewall? Start by selecting
- href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely 
+ the         <a
-         match your environment and follow the step by step instructions.<br>
+ href="file:///vfat/Shorewall-docs/shorewall_quickstart_guide.htm">QuickStart
+     Guide</a> that most closely              match your environment and
+follow     the step by  step instructions.<br>
+                                                                 
+      <h2>Looking for Information?</h2>
+         The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
+    Index</a> is a good place to start as is the Quick Search to your right. 
+                                                           
+      <h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
+                             If so, the documentation<b> </b>on this site 
+will   not  apply   directly   to  your   setup.  If you want to use the documentation
+    that you  find here, you will want to consider uninstalling what you
+have     and installing  a setup that matches    the documentation    on
+this site.     See the <a href="two-interface.htm">Two-interface    QuickStart
+   Guide</a>     for details.                                           
+            
+      <h2></h2>
+                                                                        
                                                                         
                                                                         
                                             
       <h2><b>News</b></h2>
-                                   <b>      </b>                        
                                                                         
                
-                                                            
+      <p><b>7/20/2003 - Shorewall-1.4.6</b><b> <img border="0"
-      <p><b>6/17/2003 - Shorewall-1.4.5</b><b>       </b><b><img
- border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
-                       </b></p>
-  
-      <p>Problems Corrected:<br>
- </p>
-  
-      <ol>
-        <li>The command "shorewall debug try &lt;directory&gt;" now correctly
-traces the attempt.</li>
-        <li>The INCLUDE directive now works properly in the zones file; previously,
-INCLUDE in that file was ignored.</li>
-        <li>/etc/shorewall/routestopped records with an empty second column
-are no longer ignored.<br>
-   </li>
-      </ol>
-  
-      <p>New Features:<br>
- </p>
-  
-      <ol>
-        <li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may
-now contain a list of addresses. If the list begins with "!' then the rule
-will take effect only if the original destination address in the connection
-request does not match any of the addresses listed.</li>
-      </ol>
-      <p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b> 
-      </b><b><img border="0" src="images/new10.gif" width="28"
- height="12" alt="(New)">
-                       </b></p>
-   The firewall at shorewall.net has been upgraded to the 2.4.21 kernel and
- iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems
- have been encountered with this set of software. The Shorewall version is
- 1.4.4b plus the accumulated changes for 1.4.5.       
-      <p><b>6/8/2003 - Updated Samples</b><b> </b><b><img border="0"
  src="images/new10.gif" width="28" height="12" alt="(New)">
-                       </b></p>
+            <br>
+            </b>   </p>
                                                                         
-      <p>Thanks to Francesca Smith, the samples have been updated to Shorewall
- version 1.4.4.</p>
                                
-      <p><b>5/29/2003 - Shorewall-1.4.4b</b><b>                     </b></p>
+      <p><b>Problems Corrected:</b><br>
+         </p>
                                                              
-      <p>Groan -- This version corrects a problem whereby the --log-level
-  was not being set when logging via syslog. The most commonly reported symptom
-  was that Shorewall messages were being written to the console even though
-  console logging was correctly configured per <a href="FAQ.htm#faq16">FAQ
- 16</a>.<br>
-     </p>
-                                  
-      <p><b>5/27/2003 - Shorewall-1.4.4a</b><b>                     </b></p>
-        The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed
-  out  that the code in 1.4.4 restricts the length of short zone names to
-4  characters.  I've produced version 1.4.4a that restores the previous 5-character
-  limit  by conditionally omitting the log rule number when the LOGFORMAT
-doesn't  contain '%d'.                                                 
-      <p><b>5/23/2003 - Shorewall-1.4.4</b><b>                     </b><b> 
-           </b></p>
-         I apologize for the rapid-fire releases but since there is a potential 
-   configuration change required to go from 1.4.3a to 1.4.4, I decided to 
-make   it a full release rather than just a bug-fix release. <br>
-          <br>
-          <b>    Problems corrected:</b><br>
-                                                                  
-      <blockquote>None.<br>
-         </blockquote>
-          <b>    New Features:<br>
-         </b>                                                         
       <ol>
-                <li>A REDIRECT- rule target has been added. This target behaves 
+        <li>A problem seen on RH7.3 systems where Shorewall encountered  
-   for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter 
+ start  errors when started using the "service" mechanism has been worked
-   nat table REDIRECT rule is added but not the companion filter table ACCEPT 
+  around.<br>
-   rule.<br>
+          <br>
-             <br>
+        </li>
-           </li>
+        <li>Where a list of IP addresses appears in the DEST column  of 
-                <li>The LOGMARKER variable has been renamed LOGFORMAT and 
+a  DNAT[-]  rule, Shorewall incorrectly created multiple DNAT rules in  the
-has   been  changed to a 'printf' formatting template which accepts three 
+ nat  table (one for each element in the list). Shorewall now correctly  creates
-arguments   (the  chain name, logging rule number and the disposition). To 
+  a single DNAT rule with multiple "--to-destination" clauses.<br>
-use LOGFORMAT   with  fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>),
+          <br>
-    set it as:<br>
+        </li>
-          <br>
+        <li>Corrected a problem in Beta 1 where DNS names containing  a 
-                LOGFORMAT="fp=%s:%d a=%s "<br>
+"-"  were mis-handled when they appeared in the DEST column of a rule.<br>
-          <br>
+          <br>
-             <b>CAUTION: </b>/sbin/shorewall uses the leading part of the 
+        </li>
-LOGFORMAT     string (up to but not including the first '%') to find log messages
+        <li>A number of problems with rule parsing have been   corrected.
-in  the   'show log', 'status' and 'hits' commands. This part should not
+ Corrections involve the handling of "z1!z2" in the SOURCE column   as well
-be omitted     (the LOGFORMAT should not begin with "%") and the leading part
+as lists in the ORIGINAL DESTINATION column.<br>
-should be   sufficiently unique for /sbin/shorewall to identify Shorewall 
+          <br>
-messages.<br>
+        </li>
-             <br>
+        <li>The message "Adding rules for DHCP" is now suppressed if there
-           </li>
+are no DHCP rules to add.</li>
-                <li>When logging is specified on a DNAT[-] or REDIRECT[-] 
+      </ol>
-rule,    the logging now takes place in the nat table rather than in the filter
+                                                                        
-table.   This way, only those connections that actually undergo DNAT or redirection
+      <p><b>Migration Issues:</b><br>
-   will be logged.</li>
+        </p>
+                                                          
+      <ol>
+               <li>In earlier versions, an undocumented feature allowed entries 
+   in the host file as follows:<br>
+            <br>
+            z    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
+            <br>
+        This capability was never documented and has been removed in 1.4.6
+ to  allow  entries of the following format:<br>
+            <br>
+            z   eth1:192.168.1.0/24,192.168.2.0/24<br>
+            <br>
+          </li>
+               <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options
+have   been  removed from /etc/shorewall/shorewall.conf. These capabilities
+are  now automatically  detected by Shorewall (see below).<br>
+          </li>
                                                        
       </ol>
                                                           
-      <p><b>5/20/2003 - Shorewall-1.4.3a</b><b>              </b><b>    
+      <p><b>New Features:</b><br>
-       </b><br>
+         </p>
-           </p>
-          This version primarily corrects the documentation included in the 
- .tgz   and  in the .rpm. In addition: <br>
-                                                                        
                                                              
       <ol>
-                  <li>(This change is in 1.4.3 but is not documented) If
+               <li>A 'newnotsyn' interface option has been added. This option 
-you   are   running  iptables 1.2.7a and kernel 2.4.20, then Shorewall will
+  may  be specified in /etc/shorewall/interfaces and overrides the setting 
-return   reject   replies  as follows:<br>
+ NEWNOTSYN=No  for packets arriving on the associated interface.<br>
-              a) tcp - RST<br>
+             <br>
-              b) udp - ICMP port unreachable<br>
+           </li>
-              c) icmp - ICMP host unreachable<br>
+               <li>The means for specifying a range of IP addresses in /etc/shorewall/masq 
-              d) Otherwise - ICMP host prohibited<br>
+    to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for 
-           If you are running earlier software, Shorewall will follow it's
+ address   ranges.<br>
- traditional     convention:<br>
+             <br>
-              a) tcp - RST<br>
+           </li>
-              b) Otherwise - ICMP port unreachable</li>
+               <li>Shorewall can now add IP addresses to subnets other than 
-                  <li>UDP port 135 is now silently dropped in the common.def
+ the   first  one on an interface.<br>
-  chain.    Remember that this chain is traversed just before a DROP or REJECT
+             <br>
-  policy    is enforced.<br>
+           </li>
+               <li>DNAT[-] rules may now be used to load balance (round-robin)
+   over a  set of servers. Servers may be specified in a range of addresses
+   given as &lt;first address&gt;-&lt;last address&gt;.<br>
+             <br>
+         Example:<br>
+             <br>
+             DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
+             <br>
+           </li>
+               <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
+   options  have been removed and have been replaced by code that detects
+whether   these  capabilities are present in the current kernel. The output
+of the  start, restart and check commands have been enhanced to report the
+outcome:<br>
+             <br>
+         Shorewall has detected the following iptables/netfilter capabilities:<br>
+            NAT: Available<br>
+            Packet Mangling: Available<br>
+            Multi-port Match: Available<br>
+         Verifying Configuration...<br>
+             <br>
+           </li>
+               <li>Support for the Connection Tracking Match Extension has
+ been   added.  This extension is available in recent kernel/iptables releases 
+ and   allows  for rules which match against elements in netfilter's connection 
+  tracking  table. Shorewall automatically detects the availability of this 
+  extension  and reports its availability in the output of the start, restart 
+  and check  commands.<br>
+             <br>
+         Shorewall has detected the following iptables/netfilter capabilities:<br>
+            NAT: Available<br>
+            Packet Mangling: Available<br>
+            Multi-port Match: Available<br>
+            Connection Tracking Match: Available<br>
+         Verifying Configuration...<br>
+             <br>
+         If this extension is available, the ruleset generated by Shorewall 
+ is  changed  in the following ways:</li>
+                                                                     
+        <ul>
+                 <li>To handle 'norfc1918' filtering, Shorewall will not
+create    chains  in the mangle table but will rather do all 'norfc1918'
+filtering   in the filter  table (rfc1918 chain).</li>
+                 <li>Recall that Shorewall DNAT rules generate two netfilter
+  rules;  one  in the nat table and one in the filter table. If the Connection
+  Tracking  Match Extension is available, the rule in the filter table is
+extended  to  check that the original destination address was the same as
+specified  (or  defaulted to) in the DNAT rule.<br>
+               <br>
              </li>
                                                                      
+        </ul>
+               <li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall) 
+    may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
+            <br>
+        </li>
+               <li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
+            <br>
+              ipcalc [ &lt;address&gt; &lt;netmask&gt; | &lt;address&gt;/&lt;vlsm&gt; 
+   ]<br>
+            <br>
+        Examples:<br>
+            <br>
+              [root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
+                 CIDR=192.168.1.0/24<br>
+                 NETMASK=255.255.255.0<br>
+                 NETWORK=192.168.1.0<br>
+                 BROADCAST=192.168.1.255<br>
+              [root@wookie root]#<br>
+            <br>
+              [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
+                 CIDR=192.168.1.0/24<br>
+                 NETMASK=255.255.255.0<br>
+                 NETWORK=192.168.1.0<br>
+                 BROADCAST=192.168.1.255<br>
+              [root@wookie root]#<br>
+            <br>
+        Warning:<br>
+            <br>
+        If your shell only supports 32-bit signed arithmatic (ash or dash), 
+ then   the ipcalc command produces incorrect information for IP addresses 
+ 128.0.0.0-1   and for /1 networks. Bash should produce correct information 
+ for all valid   IP addresses.<br>
+            <br>
+          </li>
+               <li>An 'iprange' command has been added to /sbin/shorewall.
+           <br>
+            <br>
+              iprange &lt;address&gt;-&lt;address&gt;<br>
+            <br>
+        This command decomposes a range of IP addressses into a list of network 
+   and host addresses. The command can be useful if you need to construct 
+an   efficient set of rules that accept connections from a range of network 
+addresses.<br>
+            <br>
+        Note: If your shell only supports 32-bit signed arithmetic (ash or
+ dash)   then the range may not span 128.0.0.0.<br>
+            <br>
+        Example:<br>
+            <br>
+              [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
+              192.168.1.4/30<br>
+              192.168.1.8/29<br>
+              192.168.1.16/28<br>
+              192.168.1.32/27<br>
+              192.168.1.64/26<br>
+              192.168.1.128/25<br>
+              192.168.2.0/23<br>
+              192.168.4.0/22<br>
+              192.168.8.0/22<br>
+              192.168.12.0/29<br>
+              192.168.12.8/31<br>
+              [root@gateway root]#<br>
+            <br>
+          </li>
+               <li>A list of host/net addresses is now allowed in an entry
+ in  /etc/shorewall/hosts.<br>
+            <br>
+        Example:<br>
+            <br>
+            foo    eth1:192.168.1.0/24,192.168.2.0/24<br>
+          <br>
+        </li>
+        <li value="11">The "shorewall check" command now includes the chain
+name when printing the applicable policy for each pair of zones.<br>
+  <br>
+     Example:<br>
+  <br>
+         Policy for dmz to net is REJECT using chain all2all<br>
+  <br>
+ This means that the policy for connections from the dmz to the internet
+is REJECT and the applicable entry in the /etc/shorewall/policy was the all-&gt;all 
+policy.<br>
+     <br>
+   </li>
+        <li>Support for the 2.6 Kernel series has been added.<br>
+   </li>
                                                        
       </ol>
-                                                                         
+             <b>     </b>                                               
-     
-      <p><b>5/18/2003 - Shorewall 1.4.3</b><br>
-                   </p>
-                  <b>Problems Corrected:<br>
-              </b>                                                      
  
       <ol>
-                    <li>There were several cases where Shorewall would fail 
- to  remove    a temporary directory from /tmp. These cases have been corrected.</li>
-                    <li>The rules for allowing all traffic via the loopback 
- interface      have been moved to before the rule that drops status=INVALID 
- packets.  This    insures that all loopback traffic is allowed even if Netfilter 
- connection      tracking is confused.</li>
                                                                         
                       
       </ol>
-                   <b>New Features:<br>
+                                                                        
-              </b>                                                      
+                      
+      <p><b>7/15/2003 - New Mirror in Brazil</b><b> <img border="0"
+ src="images/new10.gif" width="28" height="12" alt="(New)">
+           <br>
+      </b></p>
+     Thanks to the folks at securityopensource.org.br, there is now a <a
+ href="http://shorewall.securityopensource.org.br" target="_top">Shorewall 
+  mirror in Brazil</a>
+      <p><b>6/17/2003 - Shorewall-1.4.5</b><b>                         </b></p>
+                                                                        
+                                         
+      <p>Problems Corrected:<br>
+               </p>
+                                                                        
                                          
       <ol>
-                    <li><a href="6to4.htm"> </a><a href="6to4.htm">IPV6-IPV4
+                      <li>The command "shorewall debug try &lt;directory&gt;" 
-  (6to4)    tunnels </a>are now supported in the /etc/shorewall/tunnels 
+  now   correctly   traces the attempt.</li>
-file.</li>
+                      <li>The INCLUDE directive now works properly in the 
-                    <li value="2">You may now change the leading portion
+zones    file;    previously, INCLUDE in that file was ignored.</li>
-of  the   --log-prefix  used by Shorewall using the LOGMARKER variable in
+                      <li>/etc/shorewall/routestopped records with an empty 
-shorewall.conf.    By default,  "Shorewall:" is used.<br>
+ second    column   are no longer ignored.<br>
-            </li>
+                 </li>
                                                                         
                                       
       </ol>
                                                                         
                                          
-      <p><b>5/10/2003 - Shorewall Mirror in Asia</b><b>          </b><br>
+      <p>New Features:<br>
-                 </p>
+               </p>
-                  Ed Greshko has established a mirror in Taiwan -- Thanks 
-Ed!                                                                      
-                                           
-      <p><b>5/8/2003 - Shorewall Mirror in Chile</b><b>      </b></p>
                                                                         
                                          
-      <p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
+      <ol>
-                  </p>
+                      <li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-]
+   rule   may  now contain a list of addresses. If the list begins with "!'
+  then the   rule  will take effect only if the original destination address
+  in the connection    request does not match any of the addresses listed.</li>
                                                                         
                                       
-      <p><b>4/26/2003 - lists.shorewall.net Downtime</b><b>         </b></p>
+      </ol>
+                                                                        
+                                      
+      <p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b> 
+                              </b></p>
+                 The firewall at shorewall.net has been upgraded to the 2.4.21
+   kernel    and  iptables 1.2.8 (using the "official" RPM from netfilter.org).
+   No problems     have been encountered with this set of software. The Shorewall 
+   version  is   1.4.4b plus the accumulated changes for 1.4.5.          
+                                                                        
+                    
+      <p><b>6/8/2003 - Updated Samples</b><b>                         </b></p>
+                                                                        
+                                                         
+      <p>Thanks to Francesca Smith, the samples have been updated to Shorewall
+        version 1.4.4.</p>
+                                                                        
+                                                      
+      <p><b></b></p>
+                                                                        
+                      
+      <ol>
                                                                         
                                                                         
                              
-      <p>The list server will be down this morning for upgrade to RH9.0.<br>
+      </ol>
-                          </p>
-                                                                        
-                                                                        
-             
-      <p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b> 
-                                        </b></p>
-                                                                        
-                                                                        
-                               
-      <p>Thanks to Francesca Smith, the sample configurations are now upgraded
-           to Shorewall version 1.4.2.</p>
-                                                                        
-                                                                        
-                             
-      <p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b> 
-                                         </b></p>
-                                                                        
-                                                                        
-                                                             
-      <blockquote> This morning, I gave <a href="GSLUG.htm"
- target="_top">a Shorewall presentation to GSLUG</a>.         The presentation
-            is in HTML format but was generated from Microsoft PowerPoint
-and    is   best     viewed using Internet Explorer (although Konqueror also
-seems    to   work reasonably    well as does Opera 7.1.0). Neither Opera
-6 nor Netscape      work well to view  the presentation.</blockquote>
                                                                         
                                                                         
                              
       <p><b></b></p>
                                                                         
                                                                         
+                                                                        
+                                                                        
+                           
+      <p><b></b></p>
+                                                                        
+                                                                        
+                                                             
       <blockquote>                                                      
                                                                         
+                                                                        
+                                 
         <ol>
                                                                         
                                                                         
                                                                         
                                                                         
+                                                                        
+                                                     
         </ol>
-                             </blockquote>
+                                           </blockquote>
+                                                                        
                                                                         
                                                                         
                                                                         
                                                                      
       <p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
-                                  <b>       </b>                        
+                                                <b>       </b>          
+                                                                        
+                                                                        
                                                                         
                                                                         
                          
       <p><b><a href="News.htm">More News</a></b></p>
-                                               <b>      </b>            
+                                                             <b>      </b>
+                                                                        
+                                                                        
                                                                         
                                                                         
                                     
       <h2><b> </b></h2>
-                                         <b>      </b>                  
+                                                       <b>      </b>    
+                                                                        
+                                                                        
                                                                         
                                                                         
                                
@@ -361,99 +495,119 @@ seems    to   work reasonably    well as does Opera 7.1.0). Neither Opera
  border="0" src="images/leaflogo.gif" width="49" height="36"
  alt="(Leaf Logo)">
                                                                         
-                 </a>Jacques        Nilo       and     Eric     Wolzak  
+                               </a>Jacques        Nilo       and     Eric 
-    have       a   LEAF  (router/firewall/gateway                       
+    Wolzak          have       a   LEAF  (router/firewall/gateway        
-on   a  floppy,       CD    or compact     flash)  distribution         
+               on   a  floppy,       CD    or compact     flash)  distribution 
-      called                 <i>Bering</i>          that          features
+                 called                 <i>Bering</i>          that      
-              Shorewall-1.3.14         and    Kernel-2.4.20.          You 
+   features                   Shorewall-1.4.2         and    Kernel-2.4.20. 
-   can     find         their    work at:                <a
+           You        can     find         their    work at:             
- href="http://leaf.sourceforge.net/devel/jnilo">       http://leaf.sourceforge.net/devel/jnilo</a></p>
+        <a href="http://leaf.sourceforge.net/devel/jnilo">       http://leaf.sourceforge.net/devel/jnilo</a></p>
+                                                                        
+                                      <b>Congratulations          to  Jacques 
+      and     Eric     on   the     recent    release     of  Bering     
+ 1.2!!!          </b><br>
+                                                                        
                                                                         
-                        <b>Congratulations          to  Jacques     and 
- Eric     on   the     recent    release     of  Bering       1.2!!!    
-   </b><br>
                                                                         
     
       <h1 align="center"><b><a href="http://www.sf.net"><img
  align="left" alt="SourceForge Logo"
  src="http://sourceforge.net/sflogo.php?group_id=22587&amp;type=3">
                                                                         
-                                      </a></b></h1>
+                                                    </a></b></h1>
-                                         <b>      </b>                  
+                                                       <b>      </b>    
+                                                                        
+                                                                        
                                                                         
                                                                         
                                
       <h4><b>       </b></h4>
-                                         <b>      </b>                  
+                                                       <b>      </b>    
+                                                                        
+                                                                        
                                                                         
                                                                         
                                
       <h2><b>This site is hosted by the generous folks at <a
  href="http://www.sf.net">SourceForge.net</a>         </b></h2>
-                                         <b>      </b>                  
+                                                       <b>      </b>    
+                                                                        
+                                                                        
                                                                         
                                                                         
                                
       <h2><b><a name="Donations"></a>Donations</b></h2>
-                                    <b>                        </b></td>
+                                                  <b>                   
+          </b></td>
+                                                                        
+                                      <td width="88" bgcolor="#3366ff"
+ valign="top" align="center">                                           
                                                                         
-                        <td width="88" bgcolor="#4b017c" valign="top"
- align="center">                                                         
                                                                         
                                          
       <form method="post"
  action="http://lists.shorewall.net/cgi-bin/htsearch">                  
                                                                         
                                                                         
+                                                                        
+                                                   
         <p><strong><br>
-                            <font color="#ffffff"><b>Note: </b></font></strong> 
+                                          <font color="#ffffff"><b>Note:
-                     <font color="#ffffff">Search is unavailable Daily 0200-0330
+        </b></font></strong>                             <font
-      GMT.</font><br>
+ color="#ffffff">Search is unavailable Daily     0200-0330        GMT.</font><br>
-                   </p>
+                                 </p>
+                                                                        
+                                                                        
                                                                         
                                                                         
                              
         <p><font color="#ffffff"><strong>Quick Search</strong></font><br>
-                            <font face="Arial" size="-1">           <input
+                                          <font face="Arial" size="-1"> 
- type="text" name="words" size="15"></font><font size="-1">           </font><font
+                 <input type="text" name="words" size="15"></font><font
- face="Arial" size="-1">           <input type="hidden" name="format"
+ size="-1">           </font><font face="Arial" size="-1">           <input
- value="long">           <input type="hidden" name="method" value="and">
+ type="hidden" name="format" value="long">           <input
-          <input type="hidden" name="config" value="htdig">           <input
+ type="hidden" name="method" value="and">           <input type="hidden"
- type="submit" value="Search"></font> </p>
+ name="config" value="htdig">           <input type="submit"
-                            <font face="Arial">           <input
+ value="Search"></font> </p>
+                                          <font face="Arial">           <input
  type="hidden" name="exclude"
  value="[http://lists.shorewall.net/pipermail/*]">           </font>     
    </form>
                                                                         
                                                                         
+                                                                        
+                                     
       <p><font color="#ffffff"><b>         <a
  href="http://lists.shorewall.net/htdig/search.html">         <font
  color="#ffffff">Extended Search</font></a></b></font></p>
-                          <a target="_top"
+                                        <a target="_top"
  href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
-                  </font></a><a target="_top"
+                         </font></a><a target="_top"
  href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
-                                         </td>
+                                                       </td>
+                                                                        
+                                </tr>
                                                                         
-                  </tr>
                                                                         
                                                    
   </tbody>                                                 
 </table>
                                                                         
-        </center>
+                      </center>
+                                                                        
+                    </div>
                                                                         
-      </div>
                           
 <table border="0" cellpadding="5" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber2"
- bgcolor="#4b017c">
+ bgcolor="#3366ff">
                                                                         
-       <tbody>
+                     <tbody>
                                                                         
-           <tr>
+                         <tr>
+                                                                        
+                               <td width="100%" style="margin-top: 1px;"> 
                                                                          
-                 <td width="100%" style="margin-top: 1px;">             
                                                                         
                                                                         
                                                                         
@@ -462,28 +616,32 @@ on   a  floppy,       CD    or compact     flash)  distribution
  border="4" src="images/newlog.gif" width="57" height="100" align="left"
  hspace="10">
                                                                         
-                  </a></p>
+                                </a></p>
+                                                                        
+                                                                        
                                                                         
                                                                         
                                                                         
                               
       <p align="center"><font size="4" color="#ffffff"><br>
-         <font size="+2">Shorewall is free but if       you try it and find 
+                       <font size="+2">Shorewall is free but if       you 
- it useful, please consider making a donation                            
+try   it  and   find   it useful, please consider making a donation      
-                                          to             <a
+                                                                to      
- href="http://www.starlight.org"><font color="#ffffff">Starlight     Children's 
+            <a href="http://www.starlight.org"><font color="#ffffff">Starlight
-         Foundation.</font></a> Thanks!</font></font></p>
+      Children's               Foundation.</font></a> Thanks!</font></font></p>
                                                                         
-                 </td>
+                               </td>
+                                                                        
+                         </tr>
                                                                         
-           </tr>
                                                                         
                                                    
   </tbody>                                                 
 </table>
                                                                         
-<p><font size="2">Updated 6/17/2003 - <a href="support.htm">Tom Eastep</a></font>
+                          
-                                                                 <br>
+<p><font size="2">Updated 7/19/2003 - <a href="support.htm">Tom Eastep</a></font>
+                                                                        <br>
 </p>
 </body>
 </html>

STABLE/documentation/standalone.htm

@@ -16,13 +16,13 @@
       
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber6" bgcolor="#400169" height="90">
+ id="AutoNumber6" bgcolor="#3366ff" height="90">
-           <tbody>
+            <tbody>
-            <tr>
+             <tr>
-             <td width="100%">              
+              <td width="100%">                     
       <h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
-              </td>
+               </td>
-           </tr>
+            </tr>
             
   </tbody>   
 </table>
@@ -37,39 +37,40 @@
    in one  of its  most common configurations:</p>
       
 <ul>
-           <li>Linux system</li>
+            <li>Linux system</li>
-           <li>Single external IP address</li>
+            <li>Single external IP address</li>
-           <li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
+            <li>Connection through Cable Modem, DSL, ISDN, Frame Relay, dial-up...</li>
       
 </ul>
       
 <p>Shorewall requires that you have the iproute/iproute2 package installed 
     (on  RedHat, the package is called <i>iproute</i>)<i>. </i>You can tell 
-  if  this  package is installed by the presence of an <b>ip</b> program
+  if  this  package is installed by the presence of an <b>ip</b> program on
-on   your  firewall  system. As root, you can use the 'which' command to
+  your  firewall  system. As root, you can use the 'which' command to check
-check   for this  program:</p>
+  for this  program:</p>
       
 <pre>     [root@gateway root]# which ip<br>     /sbin/ip<br>     [root@gateway root]#</pre>
       
 <p>I recommend that you read through the guide  first to familiarize yourself 
     with what's involved then go back through it again  making your configuration 
-    changes.  Points at which configuration changes  are recommended are
+    changes.  Points at which configuration changes  are recommended are flagged
-flagged     with <img border="0" src="images/BD21298_.gif" width="13"
+    with <img border="0" src="images/BD21298_.gif" width="13"
  height="13">
-        .</p>
+         .</p>
       
 <p><img border="0" src="images/j0213519.gif" width="60" height="60">
-             If you edit your configuration files on a Windows system, you
+              If you edit your configuration files on a Windows system, you 
  must   save them as  Unix files if your editor supports that option or you 
  must  run them through  dos2unix before trying to use them. Similarly, if 
  you copy  a configuration file  from your Windows hard drive to a floppy 
 disk, you must run dos2unix against the  copy before using it with Shorewall.</p>
       
 <ul>
-           <li><a href="http://www.simtel.net/pub/pd/51438.html">Windows
+            <li><a href="http://www.simtel.net/pub/pd/51438.html">Windows 
 Version     of    dos2unix</a></li>
-           <li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
+            <li><a
-   Version  of    dos2unix</a></li>
+ href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux    Version
+ of    dos2unix</a></li>
       
 </ul>
       
@@ -77,7 +78,7 @@ Version     of    dos2unix</a></li>
       
 <p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
  alt="">
-        The configuration files for Shorewall are contained in the directory
+         The configuration files for Shorewall are contained in the directory 
    /etc/shorewall -- for simple setups, you  only need to deal with a few 
 of   these as described in this guide.  After you have <a
  href="Install.htm">installed  Shorewall</a>,  <b>download the <a
@@ -96,15 +97,15 @@ one    zone is  defined:</p>
       
 <table border="0" style="border-collapse: collapse;" cellpadding="3"
  cellspacing="0" id="AutoNumber2">
-           <tbody>
+            <tbody>
+             <tr>
+              <td><u><b>Name</b></u></td>
+              <td><u><b>Description</b></u></td>
+            </tr>
             <tr>
-             <td><u><b>Name</b></u></td>
+              <td><b>net</b></td>
-             <td><u><b>Description</b></u></td>
+              <td><b>The Internet</b></td>
-           </tr>
+            </tr>
-           <tr>
-             <td><b>net</b></td>
-             <td><b>The Internet</b></td>
-           </tr>
             
   </tbody>   
 </table>
@@ -118,11 +119,11 @@ one    zone is  defined:</p>
     in  terms of zones.</p>
       
 <ul>
-           <li>You express your default policy for connections from one zone
+            <li>You express your default policy for connections from one
-  to  another    zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy
+zone   to  another    zone in the<a href="Documentation.htm#Policy"> /etc/shorewall/policy 
        </a>file.</li>
-           <li>You define exceptions to those default policies in the   <a
+            <li>You define exceptions to those default policies in the  
- href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
+    <a href="Documentation.htm#Rules">/etc/shorewall/rules </a>file.</li>
       
 </ul>
       
@@ -133,55 +134,55 @@ one    zone is  defined:</p>
   the request is first  checked against the rules in /etc/shorewall/common 
  (the samples provide that  file for you).</p>
       
-<p>The /etc/shorewall/policy file included with the one-interface sample
+<p>The /etc/shorewall/policy file included with the one-interface sample has
-has the  following policies:</p>
+the  following policies:</p>
       
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber3">
-             <tbody>
+              <tbody>
+               <tr>
+                <td><u><b>SOURCE ZONE</b></u></td>
+                <td><u><b>DESTINATION ZONE</b></u></td>
+                <td><u><b>POLICY</b></u></td>
+                <td><u><b>LOG LEVEL</b></u></td>
+                <td><u><b>LIMIT:BURST</b></u></td>
+              </tr>
               <tr>
-               <td><u><b>SOURCE ZONE</b></u></td>
+                <td>fw</td>
-               <td><u><b>DESTINATION ZONE</b></u></td>
+                <td>net</td>
-               <td><u><b>POLICY</b></u></td>
+                <td>ACCEPT</td>
-               <td><u><b>LOG LEVEL</b></u></td>
+                <td> </td>
-               <td><u><b>LIMIT:BURST</b></u></td>
+                <td> </td>
-             </tr>
+              </tr>
-             <tr>
+              <tr>
-               <td>fw</td>
+                <td>net</td>
-               <td>net</td>
+                <td>all<br>
-               <td>ACCEPT</td>
+            </td>
-               <td> </td>
+                <td>DROP</td>
-               <td> </td>
+                <td>info</td>
-             </tr>
+                <td> </td>
-             <tr>
+              </tr>
-               <td>net</td>
+              <tr>
-               <td>all<br>
+                <td>all</td>
-           </td>
+                <td>all</td>
-               <td>DROP</td>
+                <td>REJECT</td>
-               <td>info</td>
+                <td>info</td>
-               <td> </td>
+                <td> </td>
-             </tr>
+              </tr>
-             <tr>
-               <td>all</td>
-               <td>all</td>
-               <td>REJECT</td>
-               <td>info</td>
-               <td> </td>
-             </tr>
                   
     </tbody>         
   </table>
-         </blockquote>
+          </blockquote>
       
 <p>The above policy will:</p>
       
 <ol>
-           <li>allow all connection requests from the firewall to the internet</li>
+            <li>allow all connection requests from the firewall to the internet</li>
-           <li>drop (ignore) all connection requests from the internet to 
+            <li>drop (ignore) all connection requests from the internet to
-your   firewall</li>
+ your   firewall</li>
-           <li>reject all other connection requests (Shorewall requires this
+            <li>reject all other connection requests (Shorewall requires
-  catchall      policy).</li>
+this   catchall      policy).</li>
       
 </ol>
       
@@ -202,28 +203,28 @@ your external  interface    will be<b> ippp0.</b></p>
       
 <p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
  height="13">
-            The Shorewall one-interface sample configuration assumes that
+             The Shorewall one-interface sample configuration assumes that 
 the   external  interface is <b>eth0</b>.  If your configuration is different, 
   you will have  to modify the sample  /etc/shorewall/interfaces file accordingly. 
    While you  are there, you may wish to  review the list of options that 
 are   specified  for the interface. Some hints:</p>
       
 <ul>
-           <li>          
+            <li>               
     <p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b>, 
     you can replace the    "detect" in the second column with "-".   </p>
-          </li>
+           </li>
-          <li>          
+           <li>               
     <p align="left">If your external interface is <b>ppp0</b> or <b>ippp0</b> 
     or if you have a static IP    address, you can remove "dhcp" from the 
 option    list. </p>
-          </li>
+           </li>
       
 </ul>
       
 <div align="left">   
 <h2 align="left">IP Addresses</h2>
-         </div>
+          </div>
       
 <div align="left">   
 <p align="left">RFC 1918 reserves several <i>Private </i>IP address ranges 
@@ -231,196 +232,197 @@ option    list. </p>
       
 <div align="left">   
 <pre>     10.0.0.0    - 10.255.255.255<br>     172.16.0.0  - 172.31.255.255<br>     192.168.0.0 - 192.168.255.255</pre>
-         </div>
+          </div>
       
 <p align="left">These addresses are sometimes referred to as <i>non-routable</i> 
        because the Internet backbone routers will not forward a packet whose 
-      destination address is reserved by RFC 1918. In some cases though,
+      destination address is reserved by RFC 1918. In some cases though, ISPs
-ISPs     are    assigning these addresses then using <i>Network Address Translation
+    are    assigning these addresses then using <i>Network Address Translation 
     </i>to    rewrite packet headers when forwarding to/from the internet.</p>
       
 <p align="left"><img border="0" src="images/BD21298_.gif" align="left"
  width="13" height="13">
-                Before starting Shorewall, you should look at the IP address
+                 Before starting Shorewall, you should look at the IP address 
   of  your external    interface and if it is one of the above ranges, you 
  should  remove the    'norfc1918' option from the entry in /etc/shorewall/interfaces.</p>
-        </div>
+         </div>
       
 <div align="left">   
 <h2 align="left">Enabling other Connections</h2>
-         </div>
+          </div>
       
 <div align="left">   
 <p align="left">If you wish to enable connections from the internet to your 
     firewall, the general format is:</p>
-        </div>
+         </div>
       
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber4">
-               <tbody>
+                <tbody>
-              <tr>
-                 <td><u><b>ACTION</b></u></td>
-                 <td><u><b>SOURCE</b></u></td>
-                 <td><u><b>DESTINATION</b></u></td>
-                 <td><u><b>PROTOCOL</b></u></td>
-                 <td><u><b>PORT</b></u></td>
-                 <td><u><b>SOURCE PORT</b></u></td>
-                 <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
                <tr>
-                 <td>ACCEPT</td>
+                  <td><u><b>ACTION</b></u></td>
-                 <td>net</td>
+                  <td><u><b>SOURCE</b></u></td>
-                 <td>fw</td>
+                  <td><u><b>DESTINATION</b></u></td>
-                 <td><i>&lt;protocol&gt;</i></td>
+                  <td><u><b>PROTOCOL</b></u></td>
-                 <td><i>&lt;port&gt;</i></td>
+                  <td><u><b>PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>SOURCE PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
+                </tr>
+                <tr>
+                  <td>ACCEPT</td>
+                  <td>net</td>
+                  <td>fw</td>
+                  <td><i>&lt;protocol&gt;</i></td>
+                  <td><i>&lt;port&gt;</i></td>
+                  <td> </td>
+                  <td> </td>
+                </tr>
                   
     </tbody>         
   </table>
-           </blockquote>
+            </blockquote>
-         </div>
+          </div>
       
 <div align="left">   
-<p align="left">Example - You want to run a Web Server and a POP3 Server
+<p align="left">Example - You want to run a Web Server and a POP3 Server on
-on your firewall    system:</p>
+your firewall    system:</p>
-        </div>
+         </div>
       
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber5">
-               <tbody>
+                <tbody>
-              <tr>
-                 <td><u><b>ACTION</b></u></td>
-                 <td><u><b>SOURCE</b></u></td>
-                 <td><u><b>DESTINATION</b></u></td>
-                 <td><u><b>PROTOCOL</b></u></td>
-                 <td><u><b>PORT</b></u></td>
-                 <td><u><b>SOURCE PORT</b></u></td>
-                 <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
                <tr>
-                 <td>ACCEPT</td>
+                  <td><u><b>ACTION</b></u></td>
-                 <td>net</td>
+                  <td><u><b>SOURCE</b></u></td>
-                 <td>fw</td>
+                  <td><u><b>DESTINATION</b></u></td>
-                 <td>tcp</td>
+                  <td><u><b>PROTOCOL</b></u></td>
-                 <td>80</td>
+                  <td><u><b>PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>SOURCE PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
+                </tr>
-               <tr>
+                <tr>
-                 <td>ACCEPT</td>
+                  <td>ACCEPT</td>
-                 <td>net</td>
+                  <td>net</td>
-                 <td>fw</td>
+                  <td>fw</td>
-                 <td>tcp</td>
+                  <td>tcp</td>
-                 <td>110</td>
+                  <td>80</td>
-                 <td> </td>
+                  <td> </td>
-                 <td> </td>
+                  <td> </td>
-               </tr>
+                </tr>
+                <tr>
+                  <td>ACCEPT</td>
+                  <td>net</td>
+                  <td>fw</td>
+                  <td>tcp</td>
+                  <td>110</td>
+                  <td> </td>
+                  <td> </td>
+                </tr>
                   
     </tbody>         
   </table>
-           </blockquote>
+            </blockquote>
-         </div>
+          </div>
       
 <div align="left">   
 <p align="left">If you don't know what port and protocol a particular application
-uses, see <a href="ports.htm">here</a>.</p>
+ uses, see <a href="ports.htm">here</a>.</p>
-        </div>
+         </div>
       
 <div align="left">   
 <p align="left"><b>Important: </b>I don't recommend enabling telnet to/from 
-       the internet because it uses clear text (even for login!). If you
+       the internet because it uses clear text (even for login!). If you want
-want     shell    access to your firewall from the internet, use SSH:</p>
+    shell    access to your firewall from the internet, use SSH:</p>
-        </div>
+         </div>
       
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber4">
-               <tbody>
+                <tbody>
-              <tr>
-                 <td><u><b>ACTION</b></u></td>
-                 <td><u><b>SOURCE</b></u></td>
-                 <td><u><b>DESTINATION</b></u></td>
-                 <td><u><b>PROTOCOL</b></u></td>
-                 <td><u><b>PORT</b></u></td>
-                 <td><u><b>SOURCE PORT</b></u></td>
-                 <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
                <tr>
-                 <td>ACCEPT</td>
+                  <td><u><b>ACTION</b></u></td>
-                 <td>net</td>
+                  <td><u><b>SOURCE</b></u></td>
-                 <td>fw</td>
+                  <td><u><b>DESTINATION</b></u></td>
-                 <td>tcp</td>
+                  <td><u><b>PROTOCOL</b></u></td>
-                 <td>22</td>
+                  <td><u><b>PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>SOURCE PORT</b></u></td>
-                 <td> </td>
+                  <td><u><b>ORIGINAL ADDRESS</b></u></td>
-               </tr>
+                </tr>
+                <tr>
+                  <td>ACCEPT</td>
+                  <td>net</td>
+                  <td>fw</td>
+                  <td>tcp</td>
+                  <td>22</td>
+                  <td> </td>
+                  <td> </td>
+                </tr>
                   
     </tbody>         
   </table>
-           </blockquote>
+            </blockquote>
-         </div>
+          </div>
       
 <div align="left">   
 <p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
  height="13">
-            At this point, edit    /etc/shorewall/rules to add other connections
+             At this point, edit    /etc/shorewall/rules to add other connections 
     as desired.</p>
-        </div>
+         </div>
       
 <div align="left">   
 <h2 align="left">Starting and Stopping Your Firewall</h2>
-         </div>
+          </div>
       
 <div align="left">   
 <p align="left">          <img border="0" src="images/BD21298_2.gif"
  width="13" height="13" alt="Arrow">
-             The <a href="Install.htm">installation procedure </a>   configures
+              The <a href="Install.htm">installation procedure </a>   configures 
    your system to start Shorewall at system boot but beginning with Shorewall 
    version 1.3.9 startup is disabled so that your system won't try to start 
   Shorewall before configuration is complete. Once you have completed configuration 
   of your firewall, you can enable Shorewall startup by removing the file
-/etc/shorewall/startup_disabled.<br>
+ /etc/shorewall/startup_disabled.<br>
-        </p>
+         </p>
       
 <p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Users of the .deb 
     package must edit /etc/default/shorewall and set 'startup=1'.</font><br>
-        </p>
+         </p>
-        </div>
+         </div>
       
 <div align="left">   
 <p align="left">The firewall is started using the "shorewall start" command 
-       and stopped using "shorewall stop". When the firewall is stopped,
+       and stopped using "shorewall stop". When the firewall is stopped, routing
-routing     is    enabled on those hosts that have an entry in   <a
+    is    enabled on those hosts that have an entry in   <a
  href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. A 
        running firewall may be restarted using the "shorewall restart" command. 
     If    you want to totally remove any trace of Shorewall from your Netfilter 
        configuration, use "shorewall clear".</p>
-        </div>
+         </div>
       
 <div align="left">   
 <p align="left"><b>WARNING: </b>If you are connected to your firewall from 
     the    internet, do not issue a "shorewall stop" command unless you have 
-   added an    entry for the IP address that you are connected from to  
+   added an    entry for the IP address that you are connected from to   <a
-<a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
+ href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. 
- Also, I don't recommend using "shorewall restart"; it is better to create
+Also, I don't recommend using "shorewall restart"; it is better to create 
     an   <i><a href="configuration_file_basics.htm#Configs">alternate configuration</a></i> 
     and    test it using the <a
  href="starting_and_stopping_shorewall.htm">"shorewall   try" command</a>.</p>
-        </div>
+         </div>
       
 <p align="left"><font size="2">Last updated 2/21/2003 - <a
  href="support.htm">Tom Eastep</a></font></p>
       
 <p align="left"><a href="copyright.htm"><font size="2">Copyright  2002, 2003 
  Thomas   M. Eastep</font></a></p>
-          <br>
+           <br>
+         <br>
         <br>
        <br>
       <br>

STABLE/documentation/standalone_fr.html

@@ -16,13 +16,13 @@
      
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber6" bgcolor="#400169" height="90">
+ id="AutoNumber6" bgcolor="#3366ff" height="90">
-    <tbody>
+     <tbody>
-      <tr>
+       <tr>
-        <td width="100%">              
+         <td width="100%">                     
       <h1 align="center"><font color="#ffffff">Standalone Firewall</font></h1>
-        </td>
+         </td>
-      </tr>
+       </tr>
            
   </tbody>   
 </table>
@@ -30,60 +30,60 @@
 <h2 align="center">Version 2.0.1 Française</h2>
      
 <p align="left"><small><i><u>Notes du traducteur</u> :<br>
-  Je ne prétends pas être un vrai traducteur dans le sens ou mon travail
+   Je ne prétends pas être un vrai traducteur dans le sens ou mon travail 
 n'est pas des plus précis (loin de là...). Je ne me suis pas attaché à une 
-traduction exacte du texte, mais plutôt à en faire une version française
+traduction exacte du texte, mais plutôt à en faire une version française intelligible
-intelligible par tous (et par moi). Les termes techniques sont la plupart
+par tous (et par moi). Les termes techniques sont la plupart du temps conservés
-du temps conservés sous leur forme originale et mis entre parenthèses car
+sous leur forme originale et mis entre parenthèses car vous pouvez les retrouver
-vous pouvez les retrouver dans le reste des documentations ainsi que dans
+dans le reste des documentations ainsi que dans les fichiers de configuration.
-les fichiers de configuration. N?hésitez pas à me contacter afin d?améliorer
+N?hésitez pas à me contacter afin d?améliorer ce document <a
-ce document <a href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a>
+ href="mailto:vetsel.patrice@wanadoo.fr">VETSEL Patrice</a> (merci à JMM
-(merci à JMM pour sa relecture et ses commentaires pertinents, ainsi qu'à
+pour sa relecture et ses commentaires pertinents, ainsi qu'à Tom EASTEP pour
-Tom EASTEP pour son formidable outil et sa disponibilité)</i><i>.</i></small></p>
+son formidable outil et sa disponibilité)</i><i>.</i></small></p>
      
 <p align="left">Mettre en place un système Linux en tant que firewall (écluse)
-pour un petit réseau est une chose assez simple, si vous comprenez les bases 
+ pour un petit réseau est une chose assez simple, si vous comprenez les bases
-et suivez la documentation.</p>
+ et suivez la documentation.</p>
      
-<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il se
+<p>Ce guide ne veut pas vous apprendre tous les rouages de Shorewall. Il
-focalise sur ce qui est nécessaire pour configurer Shorewall, dans son utilisation
+se focalise sur ce qui est nécessaire pour configurer Shorewall, dans son
-la plus courante :</p>
+utilisation la plus courante :</p>
      
 <ul>
-    <li>Un système Linux</li>
+     <li>Un système Linux</li>
-    <li>Une seule adresse IP externe</li>
+     <li>Une seule adresse IP externe</li>
-    <li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay, 
+     <li>Une connexion passant par un modem câble, ADSL, ISDN, Frame Relay,
-rtc...</li>
+ rtc...</li>
      
 </ul>
      
-<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé. Vous
+<p>Ce guide suppose que vous avez le paquet iproute/iproute2 d'installé.
-pouvez voir si le paquet est installé en vérifiant la présence du programme 
+Vous pouvez voir si le paquet est installé en vérifiant la présence du programme
-ip sur votre système de firewall. Sous root, utilisez la commande 'which' 
+ ip sur votre système de firewall. Sous root, utilisez la commande 'which'
-pour rechercher le programme :</p>
+ pour rechercher le programme :</p>
      
 <pre>     [root@gateway root]# which ip<br>     /sbin/ip<br>     [root@gateway root]#</pre>
      
 <p>Je vous recommande dans un premier temps de parcourir tout le guide pour
-vous familiariser avec ce qu'il va se passer, et de revenir au début en effectuant 
+ vous familiariser avec ce qu'il va se passer, et de revenir au début en
-le changements dans votre configuration. Les points, où les changements dans 
+effectuant  le changements dans votre configuration. Les points, où les changements
-la configuration sont recommandées, sont signalés par une <img
+dans  la configuration sont recommandées, sont signalés par une <img
  border="0" src="images/BD21298_.gif" width="13" height="13">
-  .</p>
+   .</p>
      
 <p><img border="0" src="images/j0213519.gif" width="60" height="60">
-  Si vous éditez vos fichiers de configuration sur un système Windows, vous
+   Si vous éditez vos fichiers de configuration sur un système Windows, vous 
  devez les sauver comme des fichiers Unix si votre éditeur supporte cette 
-option sinon vous devez les faire passer par dos2unix avant d'essayer de
+option sinon vous devez les faire passer par dos2unix avant d'essayer de les
-les utiliser. De la même manière, si vous copiez un fichier de configuration
+utiliser. De la même manière, si vous copiez un fichier de configuration depuis
-depuis votre disque dur Windows vers une disquette, vous devez lancer dos2unix
+votre disque dur Windows vers une disquette, vous devez lancer dos2unix sur
-sur la copie avant de l'utiliser avec Shorewall.</p>
+la copie avant de l'utiliser avec Shorewall.</p>
      
 <ul>
-    <li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version
+     <li><a href="http://www.simtel.net/pub/pd/51438.html">Windows Version 
  of    dos2unix</a></li>
-    <li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux Version 
+     <li><a href="http://www.megaloman.com/%7Ehany/software/hd2u/">Linux
-of    dos2unix</a></li>
+Version  of    dos2unix</a></li>
      
 </ul>
      
@@ -91,9 +91,9 @@ of    dos2unix</a></li>
      
 <p> <img border="0" src="images/BD21298_.gif" width="13" height="13"
  alt="">
-  Les fichiers de configuration pour Shorewall sont situés dans le répertoire 
+   Les fichiers de configuration pour Shorewall sont situés dans le répertoire
- /etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec 
+  /etc/shorewall -- pour de simples paramétrages, vous n'avez à faire qu'avec
-quelques un d'entre eux comme décris dans ce guide. Après avoir <a
+ quelques un d'entre eux comme décris dans ce guide. Après avoir <a
  href="Install.htm">installé Shorewall</a>, <b>téléchargez le <a
  href="http://www1.shorewall.net/pub/shorewall/Samples/">one-interface  sample</a>, 
 un-tarez le  (tar -zxvf one-interface.tgz) et copiez les fichiers vers /etc/shorewall 
@@ -101,24 +101,24 @@ un-tarez le  (tar -zxvf one-interface.tgz) et copiez les fichiers vers /etc/shor
 installés lors de l'installation de Shorewall)</b>.</p>
      
 <p>Parallèlement à la description, je vous suggère de jeter un oeil à ceux
-physiquement présents sur votre système -- chacun des fichiers contient des 
+ physiquement présents sur votre système -- chacun des fichiers contient
-instructions de configuration détaillées et des entrées par défaut.</p>
+des  instructions de configuration détaillées et des entrées par défaut.</p>
      
 <p>Shorewall voit le réseau où il tourne comme composé par un ensemble de
-<i>zones.</i> Dans les fichiers de configuration fournis pour une unique interface,
+ <i>zones.</i> Dans les fichiers de configuration fournis pour une unique
-une seule zone est définie :</p>
+interface, une seule zone est définie :</p>
      
 <table border="0" style="border-collapse: collapse;" cellpadding="3"
  cellspacing="0" id="AutoNumber2">
-    <tbody>
+     <tbody>
-      <tr>
+       <tr>
-        <td><u><b>Name</b></u></td>
+         <td><u><b>Name</b></u></td>
-        <td><u><b>Description</b></u></td>
+         <td><u><b>Description</b></u></td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-        <td><b>net</b></td>
+         <td><b>net</b></td>
-        <td><b>The Internet</b></td>
+         <td><b>The Internet</b></td>
-      </tr>
+       </tr>
            
   </tbody>   
 </table>
@@ -126,343 +126,345 @@ une seule zone est d
 <p>Les zones de Shorewall sont définies dans <a
  href="Documentation.htm#Zones"> /etc/shorewall/zones</a>.</p>
      
-<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone -
+<p>Shorewall reconnaît aussi le système de firewall comme sa propre zone
-par défaut,    le firewall lui-même est connu en tant que <b>fw</b>.</p>
+- par défaut,    le firewall lui-même est connu en tant que <b>fw</b>.</p>
      
 <p>Les règles concernant le trafic à autoriser ou à interdire sont exprimées
-en utilisant les termes de zones.</p>
+ en utilisant les termes de zones.</p>
      
 <ul>
-    <li>Vous exprimez les politiques par défaut pour les connexions d'une
+     <li>Vous exprimez les politiques par défaut pour les connexions d'une 
 zone à une autre dans le fichier<a href="Documentation.htm#Policy"> /etc/shorewall/policy
-    </a>.</li>
+     </a>.</li>
-    <li>Vous définissez les exceptions à ces règles de politiques par défaut 
+     <li>Vous définissez les exceptions à ces règles de politiques par défaut
-dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
+ dans le fichier <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
      
 </ul>
      
 <p>Pour chacune des demandes de connexion entrantes dans le firewall, les
-demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules. 
+ demandes sont en premier lieu comparées par rapport au fichier /etc/shorewall/rules.
-Si aucune des règles dans ce fichier ne correspondent, alors la première politique
+ Si aucune des règles dans ce fichier ne correspondent, alors la première
-dans /etc/shorewall/policy qui y correspond est appliquée. Si cette politique
+politique dans /etc/shorewall/policy qui y correspond est appliquée. Si cette
-est REJECT ou DROP la requête est alors comparée par rapport aux règles contenues
+politique est REJECT ou DROP la requête est alors comparée par rapport aux
-dans /etc/shorewall/common (l'archive d'exemple vous fournit ce fichier).</p>
+règles contenues dans /etc/shorewall/common (l'archive d'exemple vous fournit
+ce fichier).</p>
      
 <p>Le fichier /etc/shorewall/policy d'exemple contenu dans l'archive one-interface
-a les politiques suivantes :</p>
+ a les politiques suivantes :</p>
      
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber3">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-          <td><u><b>SOURCE ZONE</b></u></td>
+           <td><u><b>SOURCE ZONE</b></u></td>
-          <td><u><b>DESTINATION ZONE</b></u></td>
+           <td><u><b>DESTINATION ZONE</b></u></td>
-          <td><u><b>POLICY</b></u></td>
+           <td><u><b>POLICY</b></u></td>
-          <td><u><b>LOG LEVEL</b></u></td>
+           <td><u><b>LOG LEVEL</b></u></td>
-          <td><u><b>LIMIT:BURST</b></u></td>
+           <td><u><b>LIMIT:BURST</b></u></td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>fw</td>
+           <td>fw</td>
-          <td>net</td>
+           <td>net</td>
-          <td>ACCEPT</td>
+           <td>ACCEPT</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>net</td>
+           <td>net</td>
-          <td>all<br>
+           <td>all<br>
-          </td>
+           </td>
-          <td>DROP</td>
+           <td>DROP</td>
-          <td>info</td>
+           <td>info</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>all</td>
+           <td>all</td>
-          <td>all</td>
+           <td>all</td>
-          <td>REJECT</td>
+           <td>REJECT</td>
-          <td>info</td>
+           <td>info</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
                  
     </tbody>         
   </table>
-  </blockquote>
+   </blockquote>
      
 <pre>  </pre>
-  Ces politiques vont :  
+   Ces politiques vont :   
 <ol>
-    <li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
+     <li>permettre toutes demandes de connexion depuis le firewall vers l'Internet</li>
-    <li>drop (ignorer) toutes les demandes de connexion depuis l'Internet
+     <li>drop (ignorer) toutes les demandes de connexion depuis l'Internet 
 vers votre  firewall</li>
-    <li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin 
+     <li>rejeter toutes les autres requêtes de connexion (Shorewall à besoin
-de cette politique).</li>
+ de cette politique).</li>
      
 </ol>
      
 <p>A ce point, éditez votre /etc/shorewall/policy et faites y les changements
-que vous désirez.</p>
+ que vous désirez.</p>
      
 <h2 align="left">Interface Externe</h2>
      
 <p align="left">Le firewall possède une seule interface réseau. Lorsque la
-connexion Internet passe par un modem câble ou par un routeur ADSL (pas un 
+ connexion Internet passe par un modem câble ou par un routeur ADSL (pas
-simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur 
+un  simple modem), l'<i>External Interface</i> (interface externe) sera l'adaptateur
-ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez 
+ ethernet (<b>eth0</b>) qui y est connecté <u>à moins que</u> vous vous connectiez
-par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i> 
+ par <i><u>P</u>oint-to-<u>P</u>oint <u>P</u>rotocol over <u>E</u>thernet</i>
-(PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP)
+ (PPPoE) ou <i><u>P</u>oint-to-<u>P</u>oint <u>T</u>unneling<u>P</u>rotocol</i>(PPTP) 
  dans ce cas l'interface externe sera <b>ppp0</b>. Si vous vous connectez
-par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>.
+ par un simple modem (RTC), votre interface externe sera aussi <b>ppp0</b>. 
  Si vous vous connectez en utilisant l'ISDN (numéris), votre interface externe
-sera<b> ippp0.</b></p>
+ sera<b> ippp0.</b></p>
      
 <p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
  height="13">
-  L'exemple de configuration de Shorewall pour une interface suppose que
+   L'exemple de configuration de Shorewall pour une interface suppose que 
 votre interface externe est <b>eth0</b>.  Si votre configuration est différente,
-vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence. 
+ vous devrez modifier le fichier d'exemple /etc/shorewall/interfaces en conséquence.
- Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont 
+  Puisque vous y êtes, vous pourriez parcourir la liste d'options qui sont
-spécifiées pour l'interface. Quelques astuces :</p>
+ spécifiées pour l'interface. Quelques astuces :</p>
      
 <ul>
-    <li>          
+     <li>               
     <p align="left">Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b>, 
  vous pouvez remplacer le    "detect" dans la seconde colonne par un "-".
-    </p>
+     </p>
-    </li>
+     </li>
-    <li>          
+     <li>               
     <p align="left"> Si votre interface externe est <b>ppp0</b> ou <b>ippp0</b> 
  ou bien si vous avez une adresse IP statique, vous pouvez enlever le "dhcp"
-de la liste d'option. </p>
+ de la liste d'option. </p>
-    </li>
+     </li>
      
 </ul>
      
 <div align="left">   
 <h2 align="left">Adresse IP</h2>
-  </div>
+   </div>
      
 <div align="left">   
-<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée (<i>Private</i>IP)
+<p align="left">La RFC 1918 définie plusieurs plage d'adresses IP privée
-pour l'utilisation dans des réseaux privés :</p>
+(<i>Private</i>IP) pour l'utilisation dans des réseaux privés :</p>
      
 <div align="left">   
 <pre>     10.0.0.0    - 10.255.255.255<br>     172.16.0.0  - 172.31.255.255<br>     192.168.0.0 - 192.168.255.255</pre>
-  </div>
+   </div>
      
 <p align="left">Ces adresses sont parfois désignées comme étant <i>non-routables</i> 
  car les routeurs sur les backbones Internet ne font pas passer les paquets
-dont les adresses de destinations sont définies dans la RFC 1918. Dans certains 
+ dont les adresses de destinations sont définies dans la RFC 1918. Dans certains
-cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent 
+ cas, les fournisseurs (provider ou ISP) utilisent ces adresses et utilisent
-le <i>Network Address Translation </i>afin de récrire les entêtes des paquets 
+ le <i>Network Address Translation </i>afin de récrire les entêtes des paquets
-lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
+ lorsqu'ils les font circuler depuis ou vers l'Internet.</p>
      
 <p align="left"><img border="0" src="images/BD21298_.gif" align="left"
  width="13" height="13">
-  Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface 
+   Avant de lancer Shorewall, vous devriez regarder l'adresse de votre interface
-externe et si elle est comprise dans une des plages précédentes, vous devriez 
+ externe et si elle est comprise dans une des plages précédentes, vous devriez
-enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
+ enlever l'option 'norfc1918' dans le fichier /etc/shorewall/interfaces.</p>
-  </div>
+   </div>
      
 <div align="left">   
 <h2 align="left">Permettre d'autres connexions</h2>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left">Si vous désirez autoriser d'autres connexions depuis l'Internet
-vers votre   firewall, le format général est :</p>
+ vers votre   firewall, le format général est :</p>
-  </div>
+   </div>
      
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber4">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-          <td><u><b>ACTION</b></u></td>
+           <td><u><b>ACTION</b></u></td>
-          <td><u><b>SOURCE</b></u></td>
+           <td><u><b>SOURCE</b></u></td>
-          <td><u><b>DESTINATION</b></u></td>
+           <td><u><b>DESTINATION</b></u></td>
-          <td><u><b>PROTOCOL</b></u></td>
+           <td><u><b>PROTOCOL</b></u></td>
-          <td><u><b>PORT</b></u></td>
+           <td><u><b>PORT</b></u></td>
-          <td><u><b>SOURCE PORT</b></u></td>
+           <td><u><b>SOURCE PORT</b></u></td>
-          <td><u><b>ORIGINAL ADDRESS</b></u></td>
+           <td><u><b>ORIGINAL ADDRESS</b></u></td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>ACCEPT</td>
+           <td>ACCEPT</td>
-          <td>net</td>
+           <td>net</td>
-          <td>fw</td>
+           <td>fw</td>
-          <td><i>&lt;protocol&gt;</i></td>
+           <td><i>&lt;protocol&gt;</i></td>
-          <td><i>&lt;port&gt;</i></td>
+           <td><i>&lt;port&gt;</i></td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
                  
     </tbody>         
   </table>
-  </blockquote>
+   </blockquote>
-  </div>
+   </div>
      
 <div align="left">   
-<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un serveur
+<p align="left">Exemple - Vous voulez faire tourner un serveur Web et un
-POP3 sur votre système de firewall :</p>
+serveur POP3 sur votre système de firewall :</p>
-  </div>
+   </div>
      
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber5">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-          <td><u><b>ACTION</b></u></td>
+           <td><u><b>ACTION</b></u></td>
-          <td><u><b>SOURCE</b></u></td>
+           <td><u><b>SOURCE</b></u></td>
-          <td><u><b>DESTINATION</b></u></td>
+           <td><u><b>DESTINATION</b></u></td>
-          <td><u><b>PROTOCOL</b></u></td>
+           <td><u><b>PROTOCOL</b></u></td>
-          <td><u><b>PORT</b></u></td>
+           <td><u><b>PORT</b></u></td>
-          <td><u><b>SOURCE PORT</b></u></td>
+           <td><u><b>SOURCE PORT</b></u></td>
-          <td><u><b>ORIGINAL ADDRESS</b></u></td>
+           <td><u><b>ORIGINAL ADDRESS</b></u></td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>ACCEPT</td>
+           <td>ACCEPT</td>
-          <td>net</td>
+           <td>net</td>
-          <td>fw</td>
+           <td>fw</td>
-          <td>tcp</td>
+           <td>tcp</td>
-          <td>80</td>
+           <td>80</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>ACCEPT</td>
+           <td>ACCEPT</td>
-          <td>net</td>
+           <td>net</td>
-          <td>fw</td>
+           <td>fw</td>
-          <td>tcp</td>
+           <td>tcp</td>
-          <td>110</td>
+           <td>110</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
                  
     </tbody>         
   </table>
-  </blockquote>
+   </blockquote>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left">Si vous ne savez pas quel port ou protocole une application
-particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
+ particulière utilise, regardez <a href="ports.htm">ici</a>.</p>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left"><b>Important: </b>Je ne vous recommande pas d'autoriser le
-telnet depuis ou vers l'Internet car il utilise du texte en clair (même pour 
+ telnet depuis ou vers l'Internet car il utilise du texte en clair (même
-le login et le mot de passe !). Si vous voulez avoir un accès au shell de 
+pour  le login et le mot de passe !). Si vous voulez avoir un accès au shell
-votre firewall depuis Internet, utilisez SSH :</p>
+de  votre firewall depuis Internet, utilisez SSH :</p>
-  </div>
+   </div>
      
 <div align="left">   
 <blockquote>         
   <table border="1" cellpadding="2" style="border-collapse: collapse;"
  id="AutoNumber4">
-      <tbody>
+       <tbody>
-        <tr>
+         <tr>
-          <td><u><b>ACTION</b></u></td>
+           <td><u><b>ACTION</b></u></td>
-          <td><u><b>SOURCE</b></u></td>
+           <td><u><b>SOURCE</b></u></td>
-          <td><u><b>DESTINATION</b></u></td>
+           <td><u><b>DESTINATION</b></u></td>
-          <td><u><b>PROTOCOL</b></u></td>
+           <td><u><b>PROTOCOL</b></u></td>
-          <td><u><b>PORT</b></u></td>
+           <td><u><b>PORT</b></u></td>
-          <td><u><b>SOURCE PORT</b></u></td>
+           <td><u><b>SOURCE PORT</b></u></td>
-          <td><u><b>ORIGINAL ADDRESS</b></u></td>
+           <td><u><b>ORIGINAL ADDRESS</b></u></td>
-        </tr>
+         </tr>
-        <tr>
+         <tr>
-          <td>ACCEPT</td>
+           <td>ACCEPT</td>
-          <td>net</td>
+           <td>net</td>
-          <td>fw</td>
+           <td>fw</td>
-          <td>tcp</td>
+           <td>tcp</td>
-          <td>22</td>
+           <td>22</td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-          <td> <br>
+           <td> <br>
-          </td>
+           </td>
-        </tr>
+         </tr>
                  
     </tbody>         
   </table>
-  </blockquote>
+   </blockquote>
-  </div>
+   </div>
      
 <div align="left">   
 <pre>     ACCEPT	net	fw	tcp	22</pre>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left"><img border="0" src="images/BD21298_3.gif" width="13"
  height="13">
-  A ce point, éditez    /etc/shorewall/rules pour rajouter les autres connexions 
+   A ce point, éditez    /etc/shorewall/rules pour rajouter les autres connexions
-désirées.</p>
+ désirées.</p>
-  </div>
+   </div>
      
 <div align="left">   
 <h2 align="left">Lancer et Arrêter son Firewall</h2>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left"> <img border="0" src="images/BD21298_2.gif" width="13"
  height="13" alt="Arrow">
-  La <a href="Install.htm">procédure d'installation </a> configure votre
+   La <a href="Install.htm">procédure d'installation </a> configure votre 
 système pour lancer Shorewall au boot du système, mais au début avec la version 
 1.3.9 de Shorewall le lancement est désactivé, n'essayer pas de lancer Shorewall
-avec que la configuration soit finie. Une fois que vous en aurez fini avec 
+ avec que la configuration soit finie. Une fois que vous en aurez fini avec
-la configuration du firewall, vous pouvez permettre le lancement de Shorewall 
+ la configuration du firewall, vous pouvez permettre le lancement de Shorewall
-en supprimant le fichier /etc/shorewall/startup_disabled.<br>
+ en supprimant le fichier /etc/shorewall/startup_disabled.<br>
-  </p>
+   </p>
      
-<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs des
+<p align="left"><font color="#ff0000"><b>IMPORTANT</b>: Les utilisateurs
-paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
+des paquets .deb doivent éditer /etc/default/shorewall et mettre 'startup=1'.</font><br>
-  </p>
+   </p>
-  </div>
+   </div>
      
 <div align="left">   
 <p align="left">Le firewall est activé en utilisant la commande "shorewall
-start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé, le 
+ start" et arrêté avec "shorewall stop". Lorsque le firewall est stoppé,
-routage est autorisé sur les hôtes qui possèdent une entrée dans <a
+le  routage est autorisé sur les hôtes qui possèdent une entrée dans <a
  href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. Un
-firewall qui tourne peut être relancé en utilisant la commande "shorewall 
+ firewall qui tourne peut être relancé en utilisant la commande "shorewall
-restart".   Si vous voulez enlever toutes traces de Shorewall sur votre configuration 
+ restart".   Si vous voulez enlever toutes traces de Shorewall sur votre
-de Netfilter, utilisez "shorewall clear".</p>
+configuration  de Netfilter, utilisez "shorewall clear".</p>
-  </div>
+   </div>
      
 <div align="left">   
-<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall depuis
+<p align="left"><b>ATTENTION: </b>Si vous êtes connecté à votre firewall
-Internet, n'essayez pas une commande "shorewall stop" tant que vous n'avez
+depuis Internet, n'essayez pas une commande "shorewall stop" tant que vous
-pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle vous
+n'avez pas ajouté une entrée pour votre adresse IP (celle à partir de laquelle
-êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>.
+vous êtes connectée) dans <a href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>. 
   De la même manière, je ne vous recommande pas d'utiliser "shorewall restart";
-il est plus intéressant de créer une <i><a
+ il est plus intéressant de créer une <i><a
  href="configuration_file_basics.htm#Configs">configuration alternative</a></i> 
  et de la tester en utilisant la commande <a
  href="starting_and_stopping_shorewall.htm">"shorewall  try"</a>.</p>
-  </div>
+   </div>
      
 <p align="left"><font size="2">Last updated 12/9/2002 - <a
  href="support.htm">Tom Eastep</a></font></p>
      
 <p align="left"><a href="copyright.htm"><font size="2">Copyright  2002 Thomas
-M. Eastep</font></a></p>
+ M. Eastep</font></a></p>
-  <br>
+   <br>
-  <br>
+   <br>
-  <br>
+   <br>
-  <br>
+   <br>
-  <br>
+   <br>
-  <br>
+   <br>
-  <br>
+   <br>
+   <br>
   <br>
  <br>
 </body>

STABLE/documentation/starting_and_stopping_shorewall.htm

@@ -14,328 +14,287 @@
 </head>
   <body>
       
-
-
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-
+                         <tbody>
-                      <tbody>
+                  <tr>
-                <tr>
+                           <td width="100%">                
-
-                        <td width="100%">
-
-
       <h1 align="center"><font color="#ffffff">Starting/Stopping and Monitoring
-      the Firewall</font></h1>
+       the Firewall</font></h1>
-
+                           </td>
-                        </td>
+                         </tr>
-
-                      </tr>
-
          
   </tbody>  
 </table>
        
-
-
-
 <p>   If you have a permanent internet connection such as DSL     or Cable,
-      I  recommend that you start the firewall     automatically at boot.
+       I  recommend that you start the firewall     automatically at boot.
-Once     you  have installed      "firewall" in your init.d directory, simply
+ Once     you  have installed      "firewall" in your init.d directory, simply
-type         "chkconfig --add firewall". This will start the     firewall
+ type         "chkconfig --add firewall". This will start the     firewall
-in run   levels   2-5 and stop it in run levels 1 and 6.     If you want
+ in run   levels   2-5 and stop it in run levels 1 and 6.     If you want
 to configure   your  firewall differently from this     default, you can
 use the "--level"   option  in     chkconfig (see "man chkconfig") or using
 your     favorite   graphical  run-level editor.</p>
            
-
-
-
-
-
-
-
 <p><strong><u>   <font color="#000099">   Important Notes:</font></u></strong><br>
-            </p>
+              </p>
     
 <ol>
-              <li>Shorewall startup is disabled by default. Once you have
+                <li>Shorewall startup is disabled by default. Once you have
-configured      your firewall, you can enable startup by removing the file
+ configured      your firewall, you can enable startup by removing the file
-/etc/shorewall/startup_disabled.      Note: Users of the .deb package must
+ /etc/shorewall/startup_disabled.      Note: Users of the .deb package must
-edit /etc/default/shorewall and set    'startup=1'.<br>
+ edit /etc/default/shorewall and set    'startup=1'.<br>
-              </li>
+                </li>
-              <li>If you use dialup, you may want to start the firewall
+                <li>If you use dialup, you may want to start the firewall
-   in  your   /etc/ppp/ip-up.local   script. I recommend just placing
+   in  your   /etc/ppp/ip-up.local   script. I recommend just placing  "shorewall 
- "shorewall    restart"   in that script.</li>
+   restart"   in that script.</li>
     
 </ol>
     
-<p>
+<p>            </p>
-           </p>
-
-
-
        
 <p>   You can manually start and stop Shoreline Firewall using     the "shorewall"
-       shell program: </p>
+        shell program: </p>
-
      
 <ul>
-                <li>shorewall start - starts the firewall</li>
+                  <li>shorewall start - starts the firewall</li>
-                <li>shorewall stop - stops the firewall</li>
+                  <li>shorewall stop - stops the firewall</li>
-                <li>shorewall restart - stops the firewall (if it's
+                  <li>shorewall restart - stops the firewall (if it's   
-       running)   and  then starts it again</li>
+    running)   and  then starts it again</li>
-                <li>shorewall reset - reset the packet and byte counters
+                  <li>shorewall reset - reset the packet and byte counters
-            in the  firewall</li>
+             in the  firewall</li>
-                <li>shorewall clear - remove all rules and chains
+                  <li>shorewall clear - remove all rules and chains     
-     installed    by Shoreline  Firewall</li>
+installed    by Shoreline  Firewall</li>
-                <li>shorewall refresh - refresh the rules involving the broadcast
+                  <li>shorewall refresh - refresh the rules involving the 
-            addresses  of firewall interfaces, <a
+broadcast             addresses  of firewall interfaces, <a
  href="blacklisting_support.htm">the black list</a>, <a
  href="traffic_shaping.htm">traffic control rules</a> and <a
  href="ECN.html">ECN control rules</a>.</li>
     
 </ul>
-        If you include the keyword <i>debug</i> as the first argument, then
+          If you include the keyword <i>debug</i> as the first argument,
- a  shell  trace of the command is produced as in:<br>
+then   a  shell  trace of the command is produced as in:<br>
     
 <pre>	<font color="#009900"><b>shorewall debug start 2&gt; /tmp/trace</b></font><br></pre>
        
-
-
-
 <p>The above command would trace the 'start' command and place the trace
 information in the file /tmp/trace<br>
-       </p>
+         </p>
     
 <p>The <a href="#StateDiagram">Shorewall State Diagram</a> is shown at the
-   bottom of this page.<br>
+    bottom of this page.<br>
-       </p>
+         </p>
     
 <p>The "shorewall" program may also be used to monitor the     firewall.</p>
      
-
 <ul>
-                <li>shorewall status - produce a verbose report about the
+                  <li>shorewall status - produce a verbose report about the
-firewall               (iptables -L -n -v)</li>
+ firewall               (iptables -L -n -v)</li>
-                <li>shorewall show <i>chain</i> - produce a verbose report
+                  <li>shorewall show <i>chain</i> - produce a verbose report
- about        <i>chain             </i>(iptables -L <i>chain</i> -n -v)</li>
+  about        <i>chain             </i>(iptables -L <i>chain</i> -n -v)</li>
-                <li>shorewall show nat - produce a verbose report about the
+                  <li>shorewall show nat - produce a verbose report about 
- nat   table             (iptables -t nat -L -n -v)</li>
+the  nat   table             (iptables -t nat -L -n -v)</li>
-                <li>shorewall show tos - produce a verbose report about the
+                  <li>shorewall show tos - produce a verbose report about 
- mangle    table          (iptables -t mangle -L -n -v)</li>
+the  mangle    table          (iptables -t mangle -L -n -v)</li>
-                <li>shorewall show log - display the last 20 packet log entries.</li>
+                  <li>shorewall show log - display the last 20 packet log 
-                <li>shorewall show connections - displays the IP connections
+entries.</li>
-  currently     being     tracked by the firewall.</li>
+                  <li>shorewall show connections - displays the IP connections
-                <li>shorewall
+   currently     being     tracked by the firewall.</li>
-                                         show
+                  <li>shorewall                                         
-                                                         tc     - displays
+show                                                           tc     - displays
- information      about the traffic control/shaping configuration.</li>
+  information      about the traffic control/shaping configuration.</li>
-                <li>shorewall monitor [ delay ] - Continuously display the
+                  <li>shorewall monitor [ delay ] - Continuously display
- firewall               status, last 20 log entries and nat. When the log
+the   firewall               status, last 20 log entries and nat. When the
-entry display                changes, an audible alarm is sounded.</li>
+log  entry display                changes, an audible alarm is sounded.</li>
-                <li>shorewall hits - Produces several reports about the Shorewall
+                  <li>shorewall hits - Produces several reports about the 
-    packet  log          messages in the current /var/log/messages file.</li>
+Shorewall     packet  log          messages in the current /var/log/messages 
-                <li>shorewall version -  Displays the installed     version
+file.</li>
- number.</li>
+                  <li>shorewall version -  Displays the installed     version
-   <li>shorewall check -  Performs a <u>cursory</u> validation     of  the
+  number.</li>
- zones, interfaces, hosts, rules and policy files.<br>
+     <li>shorewall check -  Performs a <u>cursory</u> validation     of 
-     <br>
+the   zones, interfaces, hosts, rules and policy files.<br>
-     <font size="4" color="#ff6666"><b>The "check" command is totally unsuppored
+       <br>
-and does not parse and     validate   the   generated iptables commands. Even
+       <font size="4" color="#ff6666"><b>The "check" command is totally unsuppored
-though the "check" command     completes   successfully, the configuration
+ and does not parse and     validate   the   generated iptables commands. 
-may fail to start. Problem reports that complain about errors that the 'check'
+Even though the "check" command     completes   successfully, the configuration
-command does not detect will not be accepted.<br>
+ may fail to start. Problem reports that complain about errors that the 'check'
-     <br>
+ command does not detect will not be accepted.<br>
- See the     recommended   way to make configuration changes described below.</b></font><br>
+       <br>
-    <br>
+   See the     recommended   way to make configuration changes described
-   </li>
+below.</b></font><br>
-                <li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
+      <br>
-    ]  -  Restart shorewall using the     specified configuration and if an
+     </li>
-  error   occurs or if the<i> timeout </i>    option is given and the new
+                  <li>shorewall try<i> configuration-directory</i> [<i> timeout</i>
+     ]  -  Restart shorewall using the     specified configuration and if 
+an   error   occurs or if the<i> timeout </i>    option is given and the new
 configuration     has been up for that many seconds     then shorewall is
 restarted using   the  standard configuration.</li>
-                <li>shorewall deny, shorewall reject, shorewall accept and
+                  <li>shorewall deny, shorewall reject, shorewall accept
- shorewall      save     implement <a href="blacklisting_support.htm">dynamic
+and   shorewall      save     implement <a
- blacklisting</a>.</li>
+ href="blacklisting_support.htm">dynamic   blacklisting</a>.</li>
-                <li>shorewall logwatch (added in version 1.3.2) - Monitors
+                  <li>shorewall logwatch (added in version 1.3.2) - Monitors
- the          <a href="#Conf">LOGFILE </a>and produces an audible alarm when
+  the          <a href="#Conf">LOGFILE </a>and produces an audible alarm
- new   Shorewall       messages are logged.</li>
+when   new   Shorewall       messages are logged.</li>
     
 </ul>
-          Finally, the "shorewall" program may be used to dynamically alter
+ Beginning with Shorewall 1.4.6, /sbin/shorewall supports a couple of commands 
- the   contents  of a zone.<br>
+for dealing with IP addresses and IP address ranges:<br>
  
 <ul>
-            <li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>-
+   <li>shorewall ipcalc [ <i>address mask </i>| <i>address/vlsm</i> ] - displays 
- Adds   the  specified interface (and host if included) to the specified
+the network address, broadcast address, network in CIDR notation and netmask 
+corresponding to the input[s].</li>
+   <li>shorewall iprange <i>address1-address2</i> - Decomposes the specified 
+range of IP addresses into the equivalent list of network/host addresses. 
+    <br>
+   </li>
+ 
+</ul>
+ Finally, the "shorewall" program may be used to dynamically alter  the 
+ contents  of a zone.<br>
+    
+<ul>
+              <li>shorewall add <i>interface</i>[:<i>host]</i> <i>zone </i>-
+  Adds   the  specified interface (and host if included) to the specified
 zone.</li>
-            <li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone </i>-
+              <li>shorewall delete <i>interface</i>[:<i>host]</i> <i>zone 
-  Deletes   the specified interface (and host if included) from the specified
+    </i>-   Deletes   the specified interface (and host if included) from 
-  zone.</li>
+the specified   zone.</li>
     
 </ul>
     
 <blockquote>Examples:<br>
         
   <blockquote><font color="#009900"><b>shorewall add ipsec0:192.0.2.24 vpn1</b></font>
-    -- adds the address 192.0.2.24  from interface ipsec0 to the zone vpn1<br>
+     -- adds the address 192.0.2.24  from interface ipsec0 to the zone vpn1<br>
-            <font color="#009900"><b>  shorewall delete ipsec0:192.0.2.24
+              <font color="#009900"><b>  shorewall delete ipsec0:192.0.2.24
-vpn1</b></font>    -- deletes the address 192.0.2.24  from interface ipsec0
+ vpn1</b></font>    -- deletes the address 192.0.2.24  from interface ipsec0
-from zone vpn1<br>
+ from zone vpn1<br>
+              </blockquote>
             </blockquote>
-          </blockquote>
-
      
 <p>  The <b>shorewall start</b>, <b>shorewall restart, shorewall check, </b>and
-      <b>shorewall try </b>commands allow you to specify which <a
+       <b>shorewall try </b>commands allow you to specify which <a
  href="configuration_file_basics.htm#Configs">   Shorewall configuration</a>
-       to use:</p>
+        to use:</p>
-
      
 <blockquote>        
-
-
   <p>  shorewall [ -c <i>configuration-directory</i> ] {start|restart|check}<br>
-              shorewall try <i>configuration-directory</i></p>
+                shorewall try <i>configuration-directory</i></p>
-              </blockquote>
+                </blockquote>
-
      
 <p>  If a <i>configuration-directory</i> is specified, each time that Shorewall
-       is going to use a file in /etc/shorewall it will first look in the
+        is going to use a file in /etc/shorewall it will first look in the
-<i>configuration-directory</i>        . If the file is present in the <i>configuration-directory</i>,
+ <i>configuration-directory</i>        . If the file is present in the <i>configuration-directory</i>,
-that   file    will be used; otherwise, the file in /etc/shorewall will be
+ that   file    will be used; otherwise, the file in /etc/shorewall will
-used.</p>
+be  used.</p>
-
-
-
        
 <p>  When changing the configuration of a production firewall, I recommend
-      the   following:</p>
+       the   following:</p>
-
-
-
        
 <ul>
-
+                           <li><font color="#009900"><b>mkdir /etc/test</b></font></li>
-                        <li><font color="#009900"><b>mkdir /etc/test</b></font></li>
+                           <li><font color="#009900"><b>cd /etc/test</b></font></li>
-
+                           <li>&lt;copy any files that you need to change 
-                        <li><font color="#009900"><b>cd /etc/test</b></font></li>
+from  /etc/shorewall     to . and change them here&gt;</li>
-
+     <li><font color="#009900"><b>shorewall -c . check</b></font></li>
-                        <li>&lt;copy any files that you need to change from
+     <li>&lt;correct any errors found by check and check again&gt;</li>
- /etc/shorewall     to . and change them here&gt;</li>
+                                                  <li><font
-   <li><font color="#009900"><b>shorewall -c . check</b></font></li>
+ color="#009900"><b>/sbin/shorewall  try .</b></font></li>
-   <li>&lt;correct any errors found by check and check again&gt;</li>
-
-
-                                              <li><font color="#009900"><b>/sbin/shorewall
- try .</b></font></li>
     
 </ul>
      
-
 <p>  If the configuration starts but doesn't work, just "shorewall restart"
-      to   restore the old configuration. If the new configuration fails
+       to   restore the old configuration. If the new configuration fails
 to   start,    the   "try" command will automatically start the old one for
 you.</p>
        
-
-
-
 <p>  When the new configuration works then just </p>
        
-
-
-
 <ul>
-
+                           <li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
-                        <li><font color="#009900"><b>cp * /etc/shorewall</b></font></li>
+                           <li><font color="#009900"><b>cd</b></font></li>
-
+                           <li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
-                        <li><font color="#009900"><b>cd</b></font></li>
-
-                        <li><font color="#009900"><b>rm -rf /etc/test</b></font></li>
     
 </ul>
        
-
-
-
 <p><a name="StateDiagram"></a>The Shorewall State Diargram is depicted below.<br>
-     </p>
+       </p>
     
 <div align="center"><img src="images/State_Diagram.png"
  alt="(State Diagram)" width="747" height="714" align="middle">
-     <br>
+       <br>
-     </div>
+       </div>
     
 <p>    <br>
-        </p>
+          </p>
-         You will note that the commands that result in state transitions
+           You will note that the commands that result in state transitions
-use   the  word "firewall" rather than "shorewall". That is because the actual
+ use   the  word "firewall" rather than "shorewall". That is because the
- transitions  are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
+actual   transitions  are done by /usr/lib/shorewall/firewall (/usr/share/shorewall/firewall
- on  Debian); /sbin/shorewall runs 'firewall" according to the following table:<br>
+  on  Debian); /sbin/shorewall runs 'firewall" according to the following 
-       <br>
+table:<br>
+         <br>
     
 <table cellpadding="2" cellspacing="2" border="1">
-          <tbody>
+            <tbody>
-            <tr>
+              <tr>
-              <td valign="top">shorewall start<br>
+                <td valign="top">shorewall start<br>
-              </td>
+                </td>
-              <td valign="top">firewall start<br>
+                <td valign="top">firewall start<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall stop<br>
+                <td valign="top">shorewall stop<br>
-              </td>
+                </td>
-              <td valign="top">firewall stop<br>
+                <td valign="top">firewall stop<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall restart<br>
+                <td valign="top">shorewall restart<br>
-              </td>
+                </td>
-              <td valign="top">firewall restart<br>
+                <td valign="top">firewall restart<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall add<br>
+                <td valign="top">shorewall add<br>
-              </td>
+                </td>
-              <td valign="top">firewall add<br>
+                <td valign="top">firewall add<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall delete<br>
+                <td valign="top">shorewall delete<br>
-              </td>
+                </td>
-              <td valign="top">firewall delete<br>
+                <td valign="top">firewall delete<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall refresh<br>
+                <td valign="top">shorewall refresh<br>
-              </td>
+                </td>
-              <td valign="top">firewall refresh<br>
+                <td valign="top">firewall refresh<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
-            <tr>
+              <tr>
-              <td valign="top">shorewall try<br>
+                <td valign="top">shorewall try<br>
-              </td>
+                </td>
-              <td valign="top">firewall -c &lt;new configuration&gt; restart<br>
+                <td valign="top">firewall -c &lt;new configuration&gt; restart<br>
-        If unsuccessful then firewall start (standard configuration)<br>
+          If unsuccessful then firewall start (standard configuration)<br>
-        If timeout then firewall restart (standard configuration)<br>
+          If timeout then firewall restart (standard configuration)<br>
-              </td>
+                </td>
-            </tr>
+              </tr>
         
   </tbody>  
 </table>
-       <br>
+         <br>
-
-<p><font size="2">   Updated 2/27/2003 - <a href="support.htm">Tom  Eastep</a>
-         </font></p>
-
     
+<p><font size="2">   Updated 7/6/2003 - <a href="support.htm">Tom  Eastep</a>
+          </font></p>
       
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
-         © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
+          © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
- </p>
+   </p>
+   <br>
+  <br>
  <br>
 </body>
 </html>

STABLE/documentation/support.htm

@@ -12,48 +12,52 @@
                                    
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                                                                   <tbody>
+                                                                       <tbody>
-                                                                    <tr>
+                                                                        <tr>
-                                                                     <td
+                                                                        
- width="100%">                                                           
+      <td width="100%">                                                 
+                                                                        
  
       <h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
  src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
-                                                      </font></h1>
+                                                          </font></h1>
-                                                                     </td>
+                                                                        
-                                                                   </tr>
+      </td>
+                                                                       </tr>
                                                                       
   </tbody>                 
 </table>
                                    
 <h2>Before Reporting a Problem or Asking a Question<br>
-                </h2>
+                    </h2>
-                                                                      There 
+                                                                        
- are   a  number    of  sources of Shorewall information. Please     try these
+ There    are   a  number    of  sources of Shorewall information. Please 
- before   you   post.               
+    try  these  before   you   post.                   
 <ul>
-                                                <li>Shorewall versions earlier
+                                                    <li>Shorewall versions
-  that 1.3.0 are no longer supported.<br>
+ earlier    that 1.3.0 are no longer supported.<br>
-      </li>
+          </li>
-      <li>More than half of the questions    posted    on  the   support
+          <li>More than half of the questions    posted    on  the   support
-    list   have answers directly accessible  from  the    <a
+      list   have answers directly accessible  from  the    <a
  href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation 
-     Index</a><br>
+       Index</a><br>
-                                        </li>
+                                            </li>
-                                        <li>                            
+                                            <li>                        
-      The       <a href="http://www.shorewall.net/FAQ.htm">FAQ</a>     has
+          The       <a href="http://www.shorewall.net/FAQ.htm">FAQ</a>  
-  solutions    to  more than 20 common      problems.                 </li>
+  has    solutions    to  more than 20 common      problems.            
-                                <li>                                   The
+    </li>
-         <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
+                                    <li>                                
-    Information           contains                a    number of tips to
+  The           <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
-help    you solve common  problems.        </li>
+      Information           contains                a    number of tips to
-                               <li>                                   The 
+ help    you solve common  problems.        </li>
-        <a href="http://www.shorewall.net/errata.htm">   Errata</a> has links 
+                                   <li>                                 
-   to  download        updated     components.         </li>
+ The           <a href="http://www.shorewall.net/errata.htm">   Errata</a> 
-                                <li>                                   The
+has links     to  download        updated     components.         </li>
- Site   and   Mailing        List   Archives     search facility can locate
+                                    <li>                                
- documents   and  posts    about         similar   problems:         </li>
+  The   Site   and   Mailing        List   Archives     search facility can
+ locate   documents   and  posts    about         similar   problems:   
+     </li>
                                   
 </ul>
                                    
@@ -63,18 +67,19 @@ help    you solve common  problems.        </li>
   <form method="post"
  action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match: 
                                                                          
+                   
     <select name="method">
     <option value="and">All </option>
     <option value="or">Any </option>
     <option value="boolean">Boolean </option>
     </select>
-                     Format:                                            
+                         Format:                                        
                                             
     <select name="format">
     <option value="builtin-long">Long </option>
     <option value="builtin-short">Short </option>
     </select>
-                     Sort by:                                           
+                         Sort by:                                       
                                              
     <select name="sort">
     <option value="score">Score </option>
@@ -84,7 +89,7 @@ help    you solve common  problems.        </li>
     <option value="revtime">Reverse Time </option>
     <option value="revtitle">Reverse Title </option>
     </select>
-                      </font><input type="hidden" name="config"
+                          </font><input type="hidden" name="config"
  value="htdig"><input type="hidden" name="restrict" value=""><font
  size="-1"> Include  Mailing        List Archives:                      
                                                               
@@ -92,99 +97,87 @@ help    you solve common  problems.        </li>
     <option value="">Yes</option>
     <option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
     </select>
-                      </font><br>
+                          </font><br>
-                     Search: <input type="text" size="30" name="words"
+                         Search: <input type="text" size="30"
- value="">      <input type="submit" value="Search"><br>
+ name="words" value="">      <input type="submit" value="Search"><br>
-                   </form>
+                       </form>
-                 </blockquote>
+                     </blockquote>
                                   
 <h2>Problem Reporting Guidelines<br>
-                     </h2>
+                         </h2>
                                    
 <ul>
-                                         <li>Please remember we only know 
+                                             <li>Please remember we only
-what   is  posted    in  your   message.      Do  not  leave out any information
+know   what   is  posted    in  your   message.      Do  not  leave out any
-   that  appears   to be  correct,    or was   mentioned    in  a previous
+information      that  appears   to be  correct,    or was   mentioned  
- post.  There  have  been countless   posts   by people   who were   sure
+ in  a previous    post.  There  have  been countless   posts   by people
- that some  part  of their     configuration  was correct  when  it actually
+  who were   sure    that some  part  of their     configuration  was correct
-   contained   a  small error.     We tend to be  skeptics where  detail
+ when  it actually      contained   a  small error.     We tend to be  skeptics
-  is lacking.<br>
+where  detail    is lacking.<br>
-                                           <br>
+                                               <br>
-                                         </li>
+                                             </li>
-                                         <li>Please keep in mind that you're
+                                             <li>Please keep in mind that 
-  asking    for       <strong>free</strong>            technical  support.
+you're    asking    for       <strong>free</strong>            technical 
- Any help  we  offer   is an act of generosity, not    an   obligation. 
+support.   Any help  we  offer   is an act of generosity, not    an   obligation.
-  Try  to make   it easy  for us to help you. Follow good,    courteous 
+    Try  to make   it easy  for us to help you. Follow good,    courteous
- practices    in  writing and formatting your e-mail. Provide   details that
+  practices    in  writing and formatting your e-mail. Provide   details
-  we need if  you  expect good  answers. <em>Exact quoting     </em>  of
+that    we need if  you  expect good  answers. <em>Exact quoting     </em>
-error messages,  log  entries,  command output, and other output  is better
+ of error messages,  log  entries,  command output, and other output  is
-  than a paraphrase   or  summary.<br>
+better   than a paraphrase   or  summary.<br>
-                                           <br>
+                                               <br>
-                                         </li>
+                                             </li>
-                                         <li>                           
+                                             <li>                       
-       Please    don't    describe     your   environment   and then  ask 
+           Please    don't    describe     your   environment   and then
- us   to  send   you             custom     configuration   files.   We're
+ ask    us   to  send   you             custom     configuration   files. 
- here    to answer     your  questions     but    we           can't   do
+  We're   here    to answer     your  questions     but    we           can't 
-your   job for you.<br>
+  do  your   job for you.<br>
-                                           <br>
+                                               <br>
-                                                </li>
+                                                    </li>
-                                         <li>When reporting a problem, <strong>ALWAYS</strong> 
+                                             <li>When reporting a problem,
-          include     this   information:</li>
+     <strong>ALWAYS</strong>            include     this   information:</li>
                                   
 </ul>
                                   
 <ul>
                                                                      
   <ul>
-                                           <li>the exact version of Shorewall 
+                                               <li>the exact version of Shorewall 
-  you   are   running.<br>
+    you   are   running.<br>
-                                             <br>
+                                                 <br>
-                                             <b><font color="#009900">shorewall 
+                                                 <b><font
-   version</font><br>
+ color="#009900">shorewall      version</font><br>
-                                        </b>    <br>
+                                            </b>    <br>
-                                           </li>
+                                               </li>
                                                                      
   </ul>
                                                                      
   <ul>
-                                           <li>the exact kernel version you 
+                                                                        
- are   running<br>
-                                             <br>
-                                             <font color="#009900"><b>uname 
- -a<br>
-                                             <br>
-                                             </b></font></li>
                                          
   </ul>
                                                                      
   <ul>
-                                           <li>the complete, exact output 
+                                               <li>the complete, exact output 
-of<br>
+  of<br>
-                                             <br>
+                                                 <br>
-                                             <font color="#009900"><b>ip
+                                                 <font color="#009900"><b>ip
-addr   show<br>
+  addr   show<br>
-                                             <br>
+                                                 <br>
-                                             </b></font></li>
+                                                 </b></font></li>
                                                                      
   </ul>
                                                                      
   <ul>
-                                           <li>the complete, exact output 
+                                               <li>the complete, exact output 
-of<br>
+  of<br>
-                                             <br>
+                                                 <br>
-                                             <font color="#009900"><b>ip
+                                                 <font color="#009900"><b>ip
-route    show<br>
+  route    show<br>
-                                             <br>
+                                                 </b></font></li>
-                                             </b></font></li>
                                                                      
   </ul>
                                                                      
   <ul>
-                                           <li>If your kernel is modularized, 
-  the   exact    output    from<br>
-                                             <br>
-                                             <font color="#009900"><b>lsmod</b></font><br>
-                                           </li>
                                                                         
                                                                         
   </ul>
@@ -194,74 +187,79 @@ route    show<br>
 <ul>
                                                                     
   <ul>
-                 <li><font color="#ff0000"><u><i><big><b>If you are having
+                     <li><big><font color="#ff0000"><u><i><big><b>THIS IS 
- connection       problems of        any kind then:</b></big></i></u></font><br>
+IMPORTANT!</b></big></i></u></font><big><big><big> </big>If your problem is
-                                <br>
+that some type of connection to/from or through your firewall isn't working 
-                            1. <b><font color="#009900">/sbin/shorewall reset</font></b><br>
+then please perform the following four steps:</big></big></big><br>
-                                <br>
+        <br>
-                            2. Try the connection that is failing.<br>
+  1. <b><font color="#009900">/sbin/shorewall reset</font></b><br>
-                                <br>
+                                    <br>
-                            3.<b><font color="#009900"> /sbin/shorewall status
+                                2. Try making the connection that is failing.<br>
-   &gt;   /tmp/status.txt</font></b><br>
+                                    <br>
-                                <br>
+                                3.<b><font color="#009900"> /sbin/shorewall 
-                            4. Post the /tmp/status.txt file as an attachment.<br>
+ status    &gt;   /tmp/status.txt</font></b><br>
-                  <br>
+                                    <br>
-                </li>
+                                4. Post the /tmp/status.txt file as an attachment 
-                <li>the exact wording of any <code
+(you may compress it if you like).<br>
+                      <br>
+                    </li>
+                    <li>the exact wording of any <code
  style="color: green; font-weight: bold;">ping</code> failure responses<br>
-                                     <br>
+                                         <br>
-                                   </li>
+                                       </li>
-                <li>If you installed Shorewall using one of the QuickStart
+                    <li>If you installed Shorewall using one of the QuickStart
-     Guides,        please  indicate which one. <br>
+       Guides,        please  indicate which one. <br>
-                                     <br>
+                                         <br>
-                                   </li>
+                                       </li>
-                <li><b>If you are running Shorewall under Mandrake using
+                    <li><b>If you are running Shorewall under Mandrake using
-   the     Mandrake      installation of Shorewall, please say so.<br>
+     the     Mandrake      installation of Shorewall, please say so.<br>
-                  <br>
+                      <br>
-                  </b></li>
+                      </b></li>
                                                                    
   </ul>
                                                                         
-   <li>As    a  general    matter,   please <strong>do not edit the  diagnostic 
+       <li>As    a  general    matter,   please <strong>do not edit the 
-     information</strong>        in   an attempt to conceal your IP address,
+diagnostic        information</strong>        in   an attempt to conceal
-  netmask,      nameserver    addresses,     domain name, etc. These aren't
+your IP address,     netmask,      nameserver    addresses,     domain name,
-  secrets,  and concealing   them often   misleads  us (and 80% of the time,
+etc. These aren't     secrets,  and concealing   them often   misleads  us
-  a hacker  could derive them       anyway   from information  contained
+(and 80% of the time,     a hacker  could derive them       anyway   from
-in   the SMTP headers  of your post).<br>
+information  contained  in   the SMTP headers  of your post).<br>
-                          <br>
+                              <br>
-                          <strong></strong></li>
+                              <strong></strong></li>
-                        <li>Do you see  any   "Shorewall"      messages ("<b><font
+                            <li>Do you see  any   "Shorewall"      messages 
- color="#009900">/sbin/shorewall  show   log</font></b>")            when 
+ ("<b><font color="#009900">/sbin/shorewall  show   log</font></b>")     
-            you exercise the function that is giving   you problems? If  
+      when              you exercise the function that is giving   you problems? 
-so,    include    the message(s) in your post along with a  copy of your /etc/shorewall/interfaces
+ If   so,    include    the message(s) in your post along with a  copy of 
-              file.<br>
+your /etc/shorewall/interfaces               file.<br>
-                          <br>
+                              <br>
-                        </li>
+                            </li>
-                        <li>Please include any of the Shorewall configuration 
+                            <li>Please include any of the Shorewall configuration 
-   files        (especially               the    /etc/shorewall/hosts file 
+     files        (especially               the    /etc/shorewall/hosts file 
- if you have      modified    that     file)      that  you    think are 
+   if you have      modified    that     file)      that  you    think are 
-  relevant.  If   you  include /etc/shorewall/rules,         please include 
+    relevant.  If   you  include /etc/shorewall/rules,         please include 
- /etc/shorewall/policy       as well (rules are meaningless   unless     
+   /etc/shorewall/policy       as well (rules are meaningless   unless   
-one also knows the policies).<br>
+  one also knows the policies).<br>
-                          <br>
+                              <br>
-                        </li>
+                            </li>
-                        <li>If an error occurs    when   you   try   to "<font
+                            <li>If an error occurs    when   you   try  
- color="#009900"><b>shorewall  start</b></font>",        include     a  trace
+to  "<font color="#009900"><b>shorewall  start</b></font>",        include
-      (See the <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a> 
+    a  trace       (See the <a
-     section  for    instructions).<br>
+ href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>    
-                          <br>
+  section  for    instructions).<br>
-                        </li>
+                              <br>
-                        <li><b>The list server limits posts to 120kb so don't 
+                            </li>
-   post    GIFs     of               your             network layout, etc. 
+                            <li><b>The list server limits posts to 120kb
- to the Mailing   List    --   your      post      will  be rejected.</b></li>
+so  don't     post    GIFs     of               your             network
+layout,  etc.   to the Mailing   List    --   your      post      will  be
+rejected.</b></li>
                                   
 </ul>
                                   
 <blockquote>    The author gratefully   acknowleges that the above list was
-       heavily plagiarized    from the  excellent LEAF document by <i>Ray</i>
+         heavily plagiarized    from the  excellent LEAF document by <i>Ray</i>
-       <em>Olszewski</em>      found  at  <a
+         <em>Olszewski</em>      found  at  <a
  href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
-                </blockquote>
+                    </blockquote>
                                   
 <h2>When using the mailing list, please post in plain text</h2>
                                   
@@ -269,63 +267,60 @@ one also knows the policies).<br>
 rejecting   all    HTML  traffic.  At least one MTA has gone so far as to
 blacklist   shorewall.net      "for  continuous abuse" because it has been
 my policy   to  allow HTML in  list    posts!!<br>
-                   <br>
+                       <br>
-                                            I think that blocking all HTML
+                                                I think that blocking all 
- is  a  Draconian      way   to  control     spam    and  that the ultimate
+HTML   is  a  Draconian      way   to  control     spam    and  that the ultimate
- losers   here are not    the spammers    but the   list  subscribers   
+  losers   here are not    the spammers    but the   list  subscribers  
-  whose MTAs   are bouncing    all shorewall.net    mail. As   one list 
+   whose MTAs   are bouncing    all shorewall.net    mail. As   one list
-subscriber    wrote    to me privately      "These e-mail admin's   need
+  subscriber    wrote    to me privately      "These e-mail admin's   need
- to get a <i>(expletive      deleted)</i>  life     instead of trying to
+  to get a <i>(expletive      deleted)</i>  life     instead of trying to
 rid   the planet of HTML based   e-mail".   Nevertheless,       to allow
 subscribers  to  receive list posts   as must as possible,   I  have   now
   configured the  list  server at shorewall.net   to strip all HTML    from
  outgoing  posts.<br>
-  <br>
+      <br>
-  <big><font color="#cc0000"><b>If you run your own outgoing mail server
+      <big><font color="#cc0000"><b>If you run your own outgoing mail server
-and it doesn't have a valid DNS PTR record, your email won't reach the lists 
+  and it doesn't have a valid DNS PTR record, your email won't reach the
-unless/until the postmaster notices that your posts are being rejected. To 
+lists   unless/until the postmaster notices that your posts are being rejected. 
-avoid this problem, you should configure your MTA to forward posts to shorewall.net 
+To  avoid this problem, you should configure your MTA to forward posts to 
-through an MTA that <u>does</u> have a valid PTR record (such as the one
+shorewall.net  through an MTA that <u>does</u> have a valid PTR record (such 
-at your ISP). </b></font></big><br>
+as the one at your ISP). </b></font></big><br>
-</blockquote>
+    </blockquote>
+       
 <h2>Where to Send your Problem Report or to Ask for Help</h2>
                                    
 <blockquote>                                        
   <h4>If you run Shorewall under Bering -- <span
  style="font-weight: 400;">please           post your question or problem 
-                      to the <a
+                        to the <a
  href="mailto:leaf-user@lists.sourceforge.net">LEAF      Users      mailing 
-          list</a>.</span></h4>
+            list</a>.</span></h4>
-                                            <b>If you run Shorewall under 
+                                                <b>If you run Shorewall under 
-MandrakeSoft       Multi    Network     Firewall     (MNF)   and you have 
+  MandrakeSoft       Multi    Network     Firewall     (MNF)   and you have 
-not purchased  an   MNF  license    from MandrakeSoft     then    you can 
+  not purchased  an   MNF  license    from MandrakeSoft     then    you can 
- post non MNF-specific     Shorewall  questions   to the </b><a
+   post non MNF-specific     Shorewall  questions   to the </b><a
  href="mailto:shorewall-users@lists.shorewall.net">Shorewall   users mailing 
-            list</a>. <b>Do not expect to get free MNF support on the list.</b><br>
+              list</a>. <b>Do not expect to get free MNF support on the list</b>
                                                                    
-  <p>If you have a question, you may post it on the <a
+  <p>Otherwise, please post your question or problem to the <a
- href="http://www.developercube.com/forum/index.php?c=8">Shorewall Forum</a>: 
-  <font color="#ff6666"><b>DO NOT USE THE FORUM FOR REPORTING PROBLEMS OR 
-ASKING FOR HELP WITH PROBLEMS.<br>
-   </b></font><br>
- Otherwise, please post your question or problem to the <a
  href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing 
-               list</a> .</p>
+                 list</a> .</p>
                                    
   <p>         To Subscribe to the  mailing list go to <a
  href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a> 
-                                    .<br>
+                                      .<br>
-                        </p>
+                            </p>
-                                              </blockquote>
+                                                  </blockquote>
                                       
 <p>For information on other Shorewall mailing lists, go to <a
  href="http://lists.shorewall.net">http://lists.shorewall.net</a><br>
-                        </p>
+                            </p>
                                    
-<p align="left"><font size="2">Last Updated 6/14/2003 - Tom Eastep</font></p>
+<p align="left"><font size="2">Last Updated 7/9/2003 - Tom Eastep</font></p>
                                    
 <p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
  size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
-</p>
+ </p>
+ <br>
 </body>
 </html>

STABLE/documentation/traffic_shaping.htm

@@ -16,15 +16,13 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-                   <tbody>
+                    <tbody>
-                    <tr>
+                     <tr>
-                     <td width="100%">
+                      <td width="100%">         
-
-
       <h1 align="center"><font color="#ffffff">Traffic Shaping/Control</font></h1>
-                     </td>
+                      </td>
-                   </tr>
+                    </tr>
     
   </tbody> 
 </table>
@@ -38,78 +36,78 @@ to be running Linux Kernel 2.4.18 or later.</p>
 <p align="left">Shorewall traffic shaping support consists of the following:</p>
   
 <ul>
-                   <li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf.
+                    <li>A new <b>TC_ENABLED</b> parameter in /etc/shorewall.conf. 
     Traffic     Shaping  also requires that you enable packet mangling.</li>
-         <li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added
+          <li>A new <b>CLEAR_TC </b>parameter in /etc/shorewall.conf (Added 
  in  Shorewall  1.3.13). When Traffic Shaping is enabled (TC_ENABLED=Yes), 
  the  setting of  this variable determines whether Shorewall clears the traffic 
   shaping configuration  during Shorewall [re]start and Shorewall stop. <br>
-         </li>
+          </li>
-                   <li><b>/etc/shorewall/tcrules</b> - A file where you can
+                    <li><b>/etc/shorewall/tcrules</b> - A file where you
- specify       firewall     marking of packets. The firewall mark value may
+can  specify       firewall     marking of packets. The firewall mark value
- be used  to classify     packets  for traffic shaping/control.<br>
+may  be used  to classify     packets  for traffic shaping/control.<br>
-                   </li>
+                    </li>
-                   <li><b>/etc/shorewall/tcstart </b>- A user-supplied file
+                    <li><b>/etc/shorewall/tcstart </b>- A user-supplied file 
  that   is     sourced     by Shorewall during "shorewall start" and which 
  you can       use to define     your traffic shaping disciplines and classes. 
   I have   provided     a <a
  href="ftp://ftp.shorewall.net/pub/shorewall/cbq">sample</a>   that does 
-    table-driven CBQ shaping but if you read the traffic shaping   sections
+   table-driven CBQ shaping but if you read the traffic shaping   sections 
-  of     the     HOWTO mentioned above, you can probably code your   own
+  of     the     HOWTO mentioned above, you can probably code your   own faster
-faster   than     you can     learn how to use my sample. I personally  use
+  than     you can     learn how to use my sample. I personally  use    
     <a href="http://luxik.cdi.cz/%7Edevik/qos/htb/">HTB</a>      (see  below). 
  HTB         support may eventually become an integral part of Shorewall 
- since  HTB   is a     lot simpler and better-documented than CBQ. As of
+since  HTB   is a     lot simpler and better-documented than CBQ. As of 2.4.20,
-2.4.20,  HTB is a standard     part of the kernel but iproute2 must be patched
+ HTB is a standard     part of the kernel but iproute2 must be patched  in
- in  order  to     use it.<br>
+ order  to     use it.<br>
-                     <br>
+                      <br>
-                     In tcstart, when you want to run the 'tc' utility, use
+                      In tcstart, when you want to run the 'tc' utility,
- the   run_tc    function      supplied by shorewall if you want tc errors
+use  the   run_tc    function      supplied by shorewall if you want tc errors 
  to stop   the firewall.<br>
-               <br>
+                <br>
-           You can generally use off-the-shelf traffic shaping scripts by
+            You can generally use off-the-shelf traffic shaping scripts by 
 simply    copying  them to /etc/shorewall/tcstart. I use <a
  href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (HTB version) 
-    that  way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart and
+    that  way (i.e., I just copied wshaper.htb to /etc/shorewall/tcstart
-   modified  it according to the Wonder Shaper README). <b>WARNING: </b>If
+and    modified  it according to the Wonder Shaper README). <b>WARNING: </b>If 
  you  use use Masquerading or SNAT (i.e., you only have one external IP address) 
    then listing internal hosts in the NOPRIOHOSTSRC variable in the wshaper[.htb] 
-   script won't work. Traffic shaping occurs after SNAT has already been applied
+   script won't work. Traffic shaping occurs after SNAT has already been
-   so when traffic shaping happens, all outbound traffic will have as a source
+applied    so when traffic shaping happens, all outbound traffic will have
-    address the IP addresss of your firewall's external interface.<br>
+as a source     address the IP addresss of your firewall's external interface.<br>
-             </li>
+              </li>
-                   <li><b>/etc/shorewall/tcclear</b> - A user-supplied file
+                    <li><b>/etc/shorewall/tcclear</b> - A user-supplied file 
  that   is     sourced     by Shorewall when it is clearing traffic shaping. 
  This   file is     normally     not required as Shorewall's method of clearing 
   qdisc  and filter     definitions     is pretty general.</li>
   
 </ul>
-       Shorewall allows you to start traffic shaping when Shorewall itself
+        Shorewall allows you to start traffic shaping when Shorewall itself 
- starts   or it allows you to bring up traffic shaping when you bring up
+ starts   or it allows you to bring up traffic shaping when you bring up your
-your  interfaces.<br>
+ interfaces.<br>
-       <br>
+        <br>
-       To start traffic shaping when Shorewall starts:<br>
+        To start traffic shaping when Shorewall starts:<br>
   
 <ol>
-         <li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
+          <li>Set TC_ENABLED=Yes and CLEAR_TC=Yes</li>
-         <li>Supply an /etc/shorewall/tcstart script to configure your traffic
+          <li>Supply an /etc/shorewall/tcstart script to configure your traffic 
    shaping rules.</li>
-         <li>Optionally supply an /etc/shorewall/tcclear script to stop traffic
+          <li>Optionally supply an /etc/shorewall/tcclear script to stop
-   shaping. That is usually unnecessary.</li>
+traffic    shaping. That is usually unnecessary.</li>
-         <li>If your tcstart script uses the 'fwmark' classifier, you can
+          <li>If your tcstart script uses the 'fwmark' classifier, you can 
 mark   packets using entries in /etc/shorewall/tcrules.</li>
   
 </ol>
-       To start traffic shaping when you bring up your network interfaces,
+        To start traffic shaping when you bring up your network interfaces, 
  you   will have to arrange for your traffic shaping configuration script 
 to be  run at that time. How you do that is distribution dependent and will 
 not be covered here. You then should:<br>
   
 <ol>
-         <li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
+          <li>Set TC_ENABLED=Yes and CLEAR_TC=No</li>
-         <li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear
+          <li>Do not supply /etc/shorewall/tcstart or /etc/shorewall/tcclear 
  scripts.</li>
-         <li value="4">If your tcstart script uses the 'fwmark' classifier,
+          <li value="4">If your tcstart script uses the 'fwmark' classifier, 
  you   can mark packets using entries in /etc/shorewall/tcrules.</li>
   
 </ol>
@@ -120,57 +118,58 @@ not be covered here. You then should:<br>
   
 <p align="center"><img border="0" src="images/QoS.png" width="590"
  height="764">
-                </p>
+                 </p>
   
 <h3 align="left"><a name="tcrules"></a>/etc/shorewall/tcrules</h3>
   
 <p align="left">The fwmark classifier provides a convenient way to classify 
         packets for traffic shaping. The /etc/shorewall/tcrules file provides 
     a  means  for specifying these marks in a tabular fashion.<br>
-         </p>
+          </p>
   
 <p align="left">Normally, packet marking occurs in the PREROUTING chain before 
     any address rewriting takes place. This makes it impossible to mark inbound 
-    packets based on their destination address when SNAT or Masquerading are
+    packets based on their destination address when SNAT or Masquerading
-   being used. Beginning with Shorewall 1.3.12, you can cause packet marking
+are    being used. Beginning with Shorewall 1.3.12, you can cause packet
-   to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN option
+marking    to occur in the FORWARD chain by using the MARK_IN_FORWARD_CHAIN
- in  <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
+option  in  <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
-         </p>
+          </p>
   
 <p align="left">Columns in the file are as follows:</p>
   
 <ul>
-                   <li>MARK - Specifies the mark value is to be assigned
+                    <li>MARK - Specifies the mark value is to be assigned 
 in  case   of      a match. This is an integer in the range 1-255. Beginning 
-with Shorewall  version 1.3.14, this value may be optionally followed by ":"
+with Shorewall  version 1.3.14, this value may be optionally followed by
-and either 'F'  or 'P' to designate that the marking will occur in the FORWARD
+":" and either 'F'  or 'P' to designate that the marking will occur in the
-or PREROUTING  chains respectively. If this additional specification is omitted,
+FORWARD or PREROUTING  chains respectively. If this additional specification
-the chain  used to mark packets will be determined by the setting of the
+is omitted, the chain  used to mark packets will be determined by the setting
-MARK_IN_FORWARD_CHAIN  option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
+of the MARK_IN_FORWARD_CHAIN  option in <a href="Documentation.htm#Conf">shorewall.conf</a>.<br>
-                     <br>
+                      <br>
-                     Example - 5<br>
+                      Example - 5<br>
-                   </li>
+                    </li>
-                   <li>SOURCE - The source of the packet. If the packet originates
+                    <li>SOURCE - The source of the packet. If the packet
-         on  the firewall, place "fw" in this column. Otherwise, this is
+originates          on  the firewall, place "fw" in this column. Otherwise,
-a      comma-separated   list of interface names, IP addresses, MAC addresses
+this is a      comma-separated   list of interface names, IP addresses, MAC
-  in    <a href="Documentation.htm#MAC">Shorewall Format</a> and/or Subnets.<br>
+addresses   in    <a href="Documentation.htm#MAC">Shorewall Format</a> and/or
-                     <br>
+Subnets.<br>
-                     Examples<br>
+                      <br>
-                         eth0<br>
+                      Examples<br>
-                         192.168.2.4,192.168.1.0/24<br>
+                          eth0<br>
-                   </li>
+                          192.168.2.4,192.168.1.0/24<br>
-                   <li>DEST -- Destination of the packet. Comma-separated
+                    </li>
+                    <li>DEST -- Destination of the packet. Comma-separated 
 list   of      IP  addresses and/or subnets.<br>
-                   </li>
+                    </li>
-                   <li>PROTO - Protocol - Must be the name of a protocol
+                    <li>PROTO - Protocol - Must be the name of a protocol 
 from       /etc/protocol,    a number or "all"<br>
-                   </li>
+                    </li>
-                   <li>PORT(S) - Destination Ports. A comma-separated list
+                    <li>PORT(S) - Destination Ports. A comma-separated list 
- of  Port       names  (from /etc/services), port numbers or port ranges
+ of  Port       names  (from /etc/services), port numbers or port ranges (e.g.,
-(e.g.,   21:22);     if     the  protocol is "icmp", this column is interpreted
+  21:22);     if     the  protocol is "icmp", this column is interpreted as
-as   the     destination    icmp  type(s).<br>
+  the     destination    icmp  type(s).<br>
-                   </li>
+                    </li>
-                   <li>CLIENT PORT(S) - (Optional) Port(s) used by the client.
+                    <li>CLIENT PORT(S) - (Optional) Port(s) used by the client. 
    If      omitted,  any source port is acceptable. Specified as a comma-separate 
      list      of port names, port numbers or port ranges.</li>
   
@@ -178,57 +177,57 @@ as   the     destination    icmp  type(s).<br>
   
 <p align="left">Example 1 - All packets arriving on eth1 should be marked 
         with 1. All packets arriving on eth2 and eth3 should be marked with 
-  2.   All packets   originating on the firewall itself should be marked
+  2.   All packets   originating on the firewall itself should be marked with
-with   3.</p>
+  3.</p>
   
 <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                   <tbody>
+                    <tbody>
+                     <tr>
+                      <td><b>MARK</b></td>
+                      <td><b>SOURCE</b></td>
+                      <td><b>DEST</b></td>
+                      <td><b>PROTO</b></td>
+                      <td><b>PORT(S)</b></td>
+                      <td><b>CLIENT PORT(S)</b></td>
+                    </tr>
                     <tr>
-                     <td><b>MARK</b></td>
+                      <td>1</td>
-                     <td><b>SOURCE</b></td>
+                      <td>eth1</td>
-                     <td><b>DEST</b></td>
+                      <td>0.0.0.0/0</td>
-                     <td><b>PROTO</b></td>
+                      <td>all</td>
-                     <td><b>PORT(S)</b></td>
+                      <td> </td>
-                     <td><b>CLIENT PORT(S)</b></td>
+                      <td> </td>
-                   </tr>
+                    </tr>
-                   <tr>
+                    <tr>
-                     <td>1</td>
+                      <td>2</td>
-                     <td>eth1</td>
+                      <td>eth2</td>
-                     <td>0.0.0.0/0</td>
+                      <td>0.0.0.0/0</td>
-                     <td>all</td>
+                      <td>all</td>
-                     <td> </td>
+                      <td> </td>
-                     <td> </td>
+                      <td> </td>
-                   </tr>
+                    </tr>
-                   <tr>
+                    <tr>
-                     <td>2</td>
+                   <td valign="top">2<br>
-                     <td>eth2</td>
+                   </td>
-                     <td>0.0.0.0/0</td>
+                   <td valign="top">eth3<br>
-                     <td>all</td>
+                   </td>
-                     <td> </td>
+                   <td valign="top">0.0.0.0/0<br>
-                     <td> </td>
+                   </td>
-                   </tr>
+                   <td valign="top">all<br>
-                   <tr>
+                   </td>
-                  <td valign="top">2<br>
+                   <td valign="top"><br>
-                  </td>
+                   </td>
-                  <td valign="top">eth3<br>
+                   <td valign="top"><br>
-                  </td>
+                   </td>
-                  <td valign="top">0.0.0.0/0<br>
+                 </tr>
-                  </td>
+                 <tr>
-                  <td valign="top">all<br>
+                      <td>3</td>
-                  </td>
+                      <td>fw</td>
-                  <td valign="top"><br>
+                      <td>0.0.0.0/0</td>
-                  </td>
+                      <td>all</td>
-                  <td valign="top"><br>
+                      <td> </td>
-                  </td>
+                      <td> </td>
-                </tr>
+                    </tr>
-                <tr>
-                     <td>3</td>
-                     <td>fw</td>
-                     <td>0.0.0.0/0</td>
-                     <td>all</td>
-                     <td> </td>
-                     <td> </td>
-                   </tr>
     
   </tbody> 
 </table>
@@ -238,23 +237,23 @@ with   3.</p>
 with     12.</p>
   
 <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                   <tbody>
+                    <tbody>
+                     <tr>
+                      <td><b>MARK</b></td>
+                      <td><b>SOURCE</b></td>
+                      <td><b>DEST</b></td>
+                      <td><b>PROTO</b></td>
+                      <td><b>PORT(S)</b></td>
+                      <td><b>CLIENT PORT(S)</b></td>
+                    </tr>
                     <tr>
-                     <td><b>MARK</b></td>
+                      <td>12</td>
-                     <td><b>SOURCE</b></td>
+                      <td>0.0.0.0/0</td>
-                     <td><b>DEST</b></td>
+                      <td>155.186.235.151</td>
-                     <td><b>PROTO</b></td>
+                      <td>47</td>
-                     <td><b>PORT(S)</b></td>
+                      <td> </td>
-                     <td><b>CLIENT PORT(S)</b></td>
+                      <td> </td>
-                   </tr>
+                    </tr>
-                   <tr>
-                     <td>12</td>
-                     <td>0.0.0.0/0</td>
-                     <td>155.186.235.151</td>
-                     <td>47</td>
-                     <td> </td>
-                     <td> </td>
-                   </tr>
     
   </tbody> 
 </table>
@@ -263,36 +262,36 @@ with     12.</p>
         and destined for 155.186.235.151 should be marked with 22.</p>
   
 <table border="2" cellpadding="2" style="border-collapse: collapse;">
-                   <tbody>
+                    <tbody>
+                     <tr>
+                      <td><b>MARK</b></td>
+                      <td><b>SOURCE</b></td>
+                      <td><b>DEST</b></td>
+                      <td><b>PROTO</b></td>
+                      <td><b>PORT(S)</b></td>
+                      <td><b>CLIENT PORT(S)</b></td>
+                    </tr>
                     <tr>
-                     <td><b>MARK</b></td>
+                      <td>22</td>
-                     <td><b>SOURCE</b></td>
+                      <td>192.168.1.0/24</td>
-                     <td><b>DEST</b></td>
+                      <td>155.186.235.151</td>
-                     <td><b>PROTO</b></td>
+                      <td>tcp</td>
-                     <td><b>PORT(S)</b></td>
+                      <td>22</td>
-                     <td><b>CLIENT PORT(S)</b></td>
+                      <td> </td>
-                   </tr>
+                    </tr>
-                   <tr>
-                     <td>22</td>
-                     <td>192.168.1.0/24</td>
-                     <td>155.186.235.151</td>
-                     <td>tcp</td>
-                     <td>22</td>
-                     <td> </td>
-                   </tr>
     
   </tbody> 
 </table>
   
 <h3>My Setup<br>
-           </h3>
+            </h3>
   
 <p>While I am currently using the HTB version of <a
  href="http://lartc.org/wondershaper/">The Wonder Shaper</a> (I just copied 
     wshaper.htb  to <b>/etc/shorewall/tcstart</b> and modified it as shown 
  in  the Wondershaper README),  I have also run with the following set of 
 hand-crafted  rules in my <b>/etc/shorewall/tcstart</b>  file:<br>
-           </p>
+            </p>
   
 <blockquote>   
   <pre>run_tc qdisc add dev eth0 root handle 1: htb default 30<br><br>run_tc class add dev eth0 parent 1: classid 1:1 htb rate 384kbit burst 15k<br><br>echo "   Added Top Level Class -- rate 384kbit"</pre>
@@ -308,30 +307,31 @@ hand-crafted  rules in my <b>/etc/shorewall/tcstart</b>  file:<br>
   <pre>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:10<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 0 handle 2 fw classid 1:20<br>run_tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 3 fw classid 1:30</pre>
     
   <pre>echo "   Defined fwmark filters"<br></pre>
-                           </blockquote>
+                            </blockquote>
   
 <p>My tcrules file that went with this tcstart file is shown in Example 1 
      above. You can look at <a href="myfiles.htm">my configuration</a> to 
 see why I wanted shaping of this type.<br>
-            </p>
+             </p>
   
 <ol>
-              <li>I wanted to allow up to 140kbits/second for traffic outbound
+               <li>I wanted to allow up to 140kbits/second for traffic outbound 
    from   my DMZ (note that the ceiling is set to 384kbit so outbound DMZ 
 traffic   can  use all available bandwidth if there is no traffic from the 
 local systems     or from my laptop or firewall).</li>
-              <li>My laptop and local systems could use up to 224kbits/second.</li>
+               <li>My laptop and local systems could use up to 224kbits/second.</li>
-              <li>My firewall could use up to 20kbits/second.</li>
+               <li>My firewall could use up to 20kbits/second.</li>
   
 </ol>
-  You see <a href="myfiles.htm">the rest of my Shorewall configuration</a>
+   You see <a href="myfiles.htm">the rest of my Shorewall configuration</a> 
  to see how this fit in. <br>
   
 <p><font size="2">Last Updated 3/19/2003 - <a href="support.htm">Tom Eastep</a></font></p>
   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
          © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
-     </p>
+      </p>
+      <br>
      <br>
     <br>
    <br>

STABLE/documentation/troubleshoot.htm

@@ -14,16 +14,16 @@
     
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-                   <tbody>
+                    <tbody>
-              <tr>
+               <tr>
-                     <td width="100%">        
+                      <td width="100%">               
       <h1 align="center"><font color="#ffffff">Shorewall Troubleshooting<img
  src="images/obrasinf.gif" alt="Beating head on table" width="90"
  height="90" align="middle">
-            </font></h1>
+             </font></h1>
-                     </td>
+                      </td>
-                   </tr>
+                    </tr>
         
   </tbody>  
 </table>
@@ -31,43 +31,43 @@
 <h3 align="left">Check the Errata</h3>
     
 <p align="left">Check the <a href="errata.htm">Shorewall Errata</a>  to be
-    sure   that there isn't an update that you are missing for your version 
+     sure   that there isn't an update that you are missing for your version
-  of  the   firewall.</p>
+   of  the   firewall.</p>
     
 <h3 align="left">Check the FAQs</h3>
     
 <p align="left">Check the <a href="FAQ.htm">FAQs</a> for solutions to common
-    problems.</p>
+     problems.</p>
     
 <h3 align="left">If the firewall fails to start</h3>
-                If you receive an error message when starting or restarting 
+                 If you receive an error message when starting or restarting
- the   firewall  and you can't determine the cause, then do the following: 
+  the   firewall  and you can't determine the cause, then do the following:
    
 <ul>
-               <li>Make a note of the error message that you see.<br>
+                <li>Make a note of the error message that you see.<br>
-      </li>
+       </li>
-      <li>shorewall debug start 2&gt; /tmp/trace</li>
+       <li>shorewall debug start 2&gt; /tmp/trace</li>
-               <li>Look at the /tmp/trace file and see if that helps you 
+                <li>Look at the /tmp/trace file and see if that helps you
-  determine    what the problem is. Be sure you find the place in the log 
+   determine    what the problem is. Be sure you find the place in the log
- where the error message you saw is generated -- If you are using Shorewall
+  where the error message you saw is generated -- If you are using Shorewall 
 1.4.0 or later, you should find the message near the end of the log.</li>
-               <li>If you still can't determine what's wrong then see the 
+                <li>If you still can't determine what's wrong then see the
-        <a href="support.htm">support page</a>.</li>
+         <a href="support.htm">support page</a>.</li>
     
 </ul>
-    Here's an example. During startup, a user sees the following:<br>
+     Here's an example. During startup, a user sees the following:<br>
     
 <blockquote>      
   <pre>Adding Common Rules<br>iptables: No chain/target/match by that name<br>Terminated<br></pre>
-    </blockquote>
+     </blockquote>
-    A search through the trace for "No chain/target/match by that name" turned 
+     A search through the trace for "No chain/target/match by that name"
- up the following:  
+turned   up the following:   
 <blockquote>      
   <pre>+ echo 'Adding Common Rules'<br>+ add_common_rules<br>+ run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ echo -A reject -p tcp -j REJECT --reject-with tcp-reset<br>++ sed 's/!/! /g'<br>+ iptables -A reject -p tcp -j REJECT --reject-with tcp-reset<br>iptables: No chain/target/match by that name<br></pre>
-    </blockquote>
+     </blockquote>
-    The command that failed was: "iptables -A reject -p tcp -j REJECT --reject-with 
+     The command that failed was: "iptables -A reject -p tcp -j REJECT --reject-with
- tcp-reset". In this case, the user had compiled his own kernel and had forgotten 
+  tcp-reset". In this case, the user had compiled his own kernel and had
- to include REJECT target support (see <a href="kernel.htm">kernel.htm</a>) 
+forgotten   to include REJECT target support (see <a href="kernel.htm">kernel.htm</a>)
    
 <h3>Your network environment</h3>
     
@@ -75,150 +75,152 @@
 an ill-conceived network setup. Here are several popular snafus:    </p>
     
 <ul>
-               <li>Port           Forwarding where client and server are
+                <li>Port           Forwarding where client and server are 
 in  the   same  subnet. See <a href="FAQ.htm">FAQ           2.</a></li>
-               <li>Changing the IP address of a local system to be in the 
+                <li>Changing the IP address of a local system to be in the
-external     subnet,      thinking that Shorewall will suddenly believe that 
+ external     subnet,      thinking that Shorewall will suddenly believe
-the system     is in the      'net' zone.</li>
+that  the system     is in the      'net' zone.</li>
-               <li>Multiple interfaces connected to the same HUB or Switch. 
+                <li>Multiple interfaces connected to the same HUB or Switch.
- Given    the way      that the Linux kernel respond to ARP "who-has" requests, 
+  Given    the way      that the Linux kernel respond to ARP "who-has" requests,
- this    type of setup      does NOT work the way that you expect it to.</li>
+  this    type of setup      does NOT work the way that you expect it to.</li>
     
 </ul>
     
 <h3 align="left">If you are having connection problems:</h3>
     
 <p align="left">If the appropriate policy for the connection that you are
-    trying to make is ACCEPT, please DO NOT ADD ADDITIONAL ACCEPT RULES TRYING 
+     trying to make is ACCEPT, please DO NOT ADD ADDITIONAL ACCEPT RULES
-     TO MAKE IT WORK. Such additional rules will NEVER make it work, they 
+TRYING       TO MAKE IT WORK. Such additional rules will NEVER make it work,
-add    clutter to your rule set and they represent a big security hole in 
+they  add    clutter to your rule set and they represent a big security hole
-the event   that you forget to remove them later.</p>
+in  the event   that you forget to remove them later.</p>
     
 <p align="left">I also recommend against setting all of your policies to
-     ACCEPT in an effort to make something work. That robs you of one of 
+      ACCEPT in an effort to make something work. That robs you of one of
-   your        best diagnostic tools - the "Shorewall" messages that Netfilter 
+    your        best diagnostic tools - the "Shorewall" messages that Netfilter
-    will        generate when you try to connect in a way that isn't permitted 
+     will        generate when you try to connect in a way that isn't permitted
-    by your        rule set.</p>
+     by your        rule set.</p>
     
 <p align="left">Check your log ("/sbin/shorewall show log"). If you don't
-   see Shorewall  messages, then  your problem is probably NOT a Shorewall 
+    see Shorewall  messages, then  your problem is probably NOT a Shorewall
- problem.  If you DO see packet messages,  it may be an indication that you 
+  problem.  If you DO see packet messages,  it may be an indication that
- are missing  one or more rules -- see <a href="FAQ.htm#faq17">FAQ 17</a>.</p>
+you   are missing  one or more rules -- see <a href="FAQ.htm#faq17">FAQ 17</a>.</p>
     
 <p align="left">While you are troubleshooting, it is a good idea to clear
-           two variables in /etc/shorewall/shorewall.conf:</p>
+            two variables in /etc/shorewall/shorewall.conf:</p>
     
 <p align="left">LOGRATE=""<br>
-                 LOGBURST=""</p>
+                  LOGBURST=""</p>
     
 <p align="left">This way, you will see all of the log messages being  generated 
 (be sure to restart shorewall after clearing these variables).</p>
     
 <p align="left">Example:</p>
-                <font face="Century Gothic, Arial, Helvetica">  
+                 <font face="Century Gothic, Arial, Helvetica">   
 <p align="left"><font face="Courier">Jun 27 15:37:56 gateway kernel:   Shorewall:all2all:REJECT:IN=eth2 
  OUT=eth1 SRC=192.168.2.2 DST=192.168.1.3     LEN=67 TOS=0x00 PREC=0x00 TTL=63 
  ID=5805 DF PROTO=UDP SPT=1803 DPT=53  LEN=47</font></p>
-                   </font> 
+                    </font>  
 <p align="left">Let's look at the important parts of this message:</p>
     
 <ul>
-               <li>all2all:REJECT - This packet was REJECTed out of the all2all 
+                <li>all2all:REJECT - This packet was REJECTed out of the
-   chain  -- the packet was rejected under the     "all"-&gt;"all" REJECT 
+all2all     chain  -- the packet was rejected under the     "all"-&gt;"all"
-policy   (see      <a href="FAQ.htm#faq17">FAQ 17).</a></li>
+REJECT  policy   (see      <a href="FAQ.htm#faq17">FAQ 17).</a></li>
-               <li>IN=eth2 - the packet entered the firewall via eth2</li>
+                <li>IN=eth2 - the packet entered the firewall via eth2</li>
-               <li>OUT=eth1 - if accepted, the packet would be sent on eth1</li>
+                <li>OUT=eth1 - if accepted, the packet would be sent on eth1</li>
-               <li>SRC=192.168.2.2 - the packet was sent by 192.168.2.2</li>
+                <li>SRC=192.168.2.2 - the packet was sent by 192.168.2.2</li>
-               <li>DST=192.168.1.3 - the packet is destined for 192.168.1.3</li>
+                <li>DST=192.168.1.3 - the packet is destined for 192.168.1.3</li>
-               <li>PROTO=UDP - UDP Protocol</li>
+                <li>PROTO=UDP - UDP Protocol</li>
-               <li>DPT=53 - DNS</li>
+                <li>DPT=53 - DNS</li>
     
 </ul>
     
 <p align="left">In this case, 192.168.2.2 was in the "dmz" zone and  192.168.1.3
-    is in the "loc" zone. I was missing the rule:</p>
+     is in the "loc" zone. I was missing the rule:</p>
     
 <p align="left">ACCEPT    dmz    loc    udp    53<br>
-         </p>
+          </p>
     
 <p align="left">See <a href="FAQ.htm#faq17">FAQ 17</a> for additional information
-    about how to interpret the chain name appearing in a Shorewall log message.<br>
+     about how to interpret the chain name appearing in a Shorewall log message.<br>
-         </p>
+          </p>
     
 <h3 align="left">'Ping' Problems?</h3>
-   Either can't ping when you think you should be able to or are able to
+    Either can't ping when you think you should be able to or are able to 
 ping  when you think that you shouldn't be allowed? Shorewall's 'Ping' Management<a
  href="ping.html"> is described here</a>.<br>
     
 <h3 align="left">Other Gotchas</h3>
     
 <ul>
-               <li>Seeing rejected/dropped packets logged out of the INPUT 
+                <li>Seeing rejected/dropped packets logged out of the INPUT
-or  FORWARD        chains? This means that:      
+ or  FORWARD        chains? This means that:           
     <ol>
-                 <li>your zone definitions are screwed up and the host that 
+                  <li>your zone definitions are screwed up and the host that
- is  sending   the        packets or the destination host isn't in any zone 
+  is  sending   the        packets or the destination host isn't in any zone
- (using  an       <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a> 
+  (using  an       <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>
- file are you?);         or</li>
+  file are you?);         or</li>
-                 <li>the source and destination hosts are both connected
+                  <li>the source and destination hosts are both connected 
-to  the   same         interface and you don't have a policy or rule for
+to  the   same         interface and you don't have a policy or rule for the
-the source zone to or from the destination zone.</li>
+source zone to or from the destination zone.</li>
             
     </ol>
-               </li>
+                </li>
-               <li>Remember that Shorewall doesn't automatically allow ICMP 
+                <li>Remember that Shorewall doesn't automatically allow ICMP
-     type  8 ("ping") requests to be sent between zones. If you want pings
+      type  8 ("ping") requests to be sent between zones. If you want pings 
    to be  allowed between zones, you need a rule of the form:<br>
-                <br>
+                 <br>
-                    ACCEPT    &lt;source     zone&gt;    &lt;destination
+                     ACCEPT    &lt;source     zone&gt;    &lt;destination 
 zone&gt;         icmp        echo-request<br>
-                <br>
+                 <br>
-                The ramifications of this can be subtle. For example, if
+                 The ramifications of this can be subtle. For example, if 
 you  have   the      following in /etc/shorewall/nat:<br>
-                <br>
+                 <br>
-                    10.1.1.2    eth0        130.252.100.18<br>
+                     10.1.1.2    eth0        130.252.100.18<br>
-                <br>
+                 <br>
-                and you ping 130.252.100.18, unless you have allowed icmp 
+                 and you ping 130.252.100.18, unless you have allowed icmp
-type   8  between  the     zone containing the system you are pinging from 
+ type   8  between  the     zone containing the system you are pinging from
-and the  zone containing       10.1.1.2, the ping requests will be dropped. </li>
+ and the  zone containing       10.1.1.2, the ping requests will be dropped. </li>
-               <li>If you specify "routefilter" for an interface,     that 
+                <li>If you specify "routefilter" for an interface,     that
-interface     must be up prior to starting the firewall.</li>
+ interface     must be up prior to starting the firewall.</li>
-               <li>Is your routing correct? For example, internal systems 
+                <li>Is your routing correct? For example, internal systems
-usually     need to      be configured with their default gateway set to the
+ usually     need to      be configured with their default gateway set to
-IP address     of their      nearest firewall interface. One often overlooked 
+the IP address     of their      nearest firewall interface. One often overlooked
-aspect of   routing is that      in order for two hosts to communicate, the 
+ aspect of   routing is that      in order for two hosts to communicate,
-routing  between  them must be set      up <u>in both directions.</u> So when
+the  routing  between  them must be set      up <u>in both directions.</u>
-setting  up routing   between <b>A</b>      and<b> B</b>, be sure to verify
+So when setting  up routing   between <b>A</b>      and<b> B</b>, be sure
-that the  route from       <b>B</b> back to <b>A</b>      is defined.</li>
+to verify that the  route from       <b>B</b> back to <b>A</b>      is defined.</li>
-               <li>Some versions of LRP (EigerStein2Beta for example) have 
+                <li>Some versions of LRP (EigerStein2Beta for example) have
-a      shell  with broken variable expansion. <a
+ a      shell  with broken variable expansion. <a
  href="ftp://ftp.shorewall.net/pub/shorewall/ash.gz"> You     can get a corrected
-    shell from the Shorewall Errata download site.</a>     </li>
+     shell from the Shorewall Errata download site.</a>     </li>
-               <li>Do you have your kernel properly configured? <a
+                <li>Do you have your kernel properly configured? <a
  href="kernel.htm">Click     here to see my kernel configuration.</a> </li>
-               <li>Shorewall requires the "ip" program. That     program
+                <li>Shorewall requires the "ip" program. That     program 
  is  generally   included in the "iproute" package which should     be included
-  with your  distribution (though many distributions don't install     iproute 
+   with your  distribution (though many distributions don't install     iproute
-  by     default). You may also download the latest source tarball from <a
+   by     default). You may also download the latest source tarball from
- href="ftp://ftp.inr.ac.ru/ip-routing" target="_blank"> ftp://ftp.inr.ac.ru/ip-routing</a> 
+    <a href="ftp://ftp.inr.ac.ru/ip-routing" target="_blank"> ftp://ftp.inr.ac.ru/ip-routing</a>
-     .</li>
+      .</li>
-                            <li>Problems with NAT? Be sure that you let Shorewall 
+                             <li>Problems with NAT? Be sure that you let
-add all      external  addresses to be use with NAT unless you have set <a
+Shorewall  add all      external  addresses to be use with NAT unless you
- href="Documentation.htm#Aliases"> ADD_IP_ALIASES</a> =No     in /etc/shorewall/shorewall.conf.</li>
+have set <a href="Documentation.htm#Aliases"> ADD_IP_ALIASES</a> =No    
+in /etc/shorewall/shorewall.conf.</li>
     
 </ul>
     
 <h3>Still Having Problems?</h3>
     
 <p>See the<a href="support.htm"> support page.<br>
-   </a></p>
+    </a></p>
-                  <font face="Century Gothic, Arial, Helvetica">  
+                   <font face="Century Gothic, Arial, Helvetica">   
 <blockquote> </blockquote>
-                   </font> 
+                    </font>  
 <p><font size="2">Last updated 4/29/2003 - Tom Eastep</font>  </p>
     
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
-       © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
+        © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
-</p>
+ </p>
+ <br>
 </body>
 </html>

STABLE/documentation/upgrade_issues.htm

@@ -16,106 +16,127 @@
                   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber1"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-                          <tbody>
+                             <tbody>
-                          <tr>
+                             <tr>
-                            <td width="100%">                           
+                               <td width="100%">                        
                                        
       <h1 align="center"><font color="#ffffff">Upgrade Issues</font></h1>
-                            </td>
+                               </td>
-                          </tr>
+                             </tr>
                                     
   </tbody>         
 </table>
                    
 <p>For upgrade instructions see the                               <a
  href="Install.htm">Install/Upgrade page</a>.<br>
-          </p>
+             </p>
                   
 <p>It is important that you read all of the sections on this page where the 
-     version number mentioned in the section title is later than what you
+      version number mentioned in the section title is later than what you 
-are    currently running.<br>
+ are    currently running.<br>
-    </p>
+       </p>
              
 <p>  In the descriptions that follows, the term <b><i>group </i></b>refers 
-  to a particular  network or subnetwork (which may be 0.0.0.0/0 or it may
+   to a particular  network or subnetwork (which may be 0.0.0.0/0 or it may 
- be a host address)  accessed through a particular interface.<br>
+  be a host address)  accessed through a particular interface.<br>
-    </p>
+       </p>
              
 <p>Examples:<br>
-            <br>
+               <br>
-        eth0:0.0.0.0/0<br>
+           eth0:0.0.0.0/0<br>
-           eth2:192.168.1.0/24<br>
+              eth2:192.168.1.0/24<br>
-           eth3:192.0.2.123<br>
+              eth3:192.0.2.123<br>
-   </p>
+      </p>
            
 <p> You can use the "shorewall check" command to see the groups associated
- with each of your zones.<br>
+   with each of your zones.<br>
-          </p>
+             </p>
                   
 <h3> </h3>
                   
+<h3>Version &gt;= 1.4.6</h3>
+ 
+<ul>
+   <li> The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed 
+from shorewall.conf. These capabilities are now automatically detected by 
+Shorewall.</li>
+   <li>An undocumented <i>feature</i> previously allowed entries in the host 
+file as follows:<br>
+     <br>
+     <i>zone</i>    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
+     <br>
+ This capability was never documented and has been removed in 1.4.6 to allow 
+entries of the following format:<br>
+     <br>
+     <i>zone</i>   eth1:192.168.1.0/24,192.168.2.0/24<br>
+   </li>
+ 
+</ul>
+   
 <h3>Version &gt;= 1.4.4</h3>
-  If you are upgrading from 1.4.3 and have set the LOGMARKER variable in
+     If you are upgrading from 1.4.3 and have set the LOGMARKER variable
-<a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>, then
+in  <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>, then 
 you  must set the new LOGFORMAT variable appropriately and remove your setting 
- of LOGMARKER<br>
+  of LOGMARKER<br>
- <br>
+    <br>
+     
 <h3>Version 1.4.4<br>
-</h3>
+   </h3>
-If you have zone names that are 5 characters long, you may experience problems 
+   If you have zone names that are 5 characters long, you may experience
-starting Shorewall because the --log-prefix in a logging rule is too long.
+problems   starting Shorewall because the --log-prefix in a logging rule
-Upgrade to Version 1.4.4a to fix this problem..<br>
+is too long.  Upgrade to Version 1.4.4a to fix this problem..<br>
          
 <h3>Version &gt;= 1.4.2</h3>
-    There are some cases where you may want to handle traffic from a particular
+       There are some cases where you may want to handle traffic from a particular 
-  group to itself. While I personally think that such a setups are ridiculous,
+   group to itself. While I personally think that such a setups are ridiculous, 
-  there are two cases covered in this documentation where it can occur:<br>
+   there are two cases covered in this documentation where it can occur:<br>
              
 <ol>
-      <li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
+         <li><a href="FAQ.htm#faq2">In FAQ #2</a>.</li>
-      <li><a href="Shorewall_Squid_Usage.html">When running Squid as a transparent
+         <li><a href="Shorewall_Squid_Usage.html">When running Squid as a 
-  proxy in your local zone.</a></li>
+transparent    proxy in your local zone.</a></li>
              
 </ol>
-    If you have either of these cases, you will want to review the current
+       If you have either of these cases, you will want to review the current 
- documentation  and change your configuration accordingly.<br>
+  documentation  and change your configuration accordingly.<br>
              
 <h3>Version &gt;= 1.4.1</h3>
                   
 <ul>
-          <li>Beginning with Version 1.4.1, traffic between groups in the 
+             <li>Beginning with Version 1.4.1, traffic between groups in
-same   zone is accepted by default.  Previously, traffic from a zone to itself
+the   same   zone is accepted by default.  Previously, traffic from a zone
- was  treated just like any other  traffic; any matching rules were applied
+to itself  was  treated just like any other  traffic; any matching rules
- followed  by enforcement of the appropriate  policy. With 1.4.1 and later
+were applied  followed  by enforcement of the appropriate  policy. With 1.4.1
- versions,  unless you have explicit rules for  traffic from Z to Z or you
+and later  versions,  unless you have explicit rules for  traffic from Z
- have an explicit  Z to Z policy (where "Z" is some  zone) then traffic between
+to Z or you  have an explicit  Z to Z policy (where "Z" is some  zone) then
- the groups in  zone Z will be accepted. If you do have one or more explicit
+traffic between  the groups in  zone Z will be accepted. If you do have one
- rules for Z to Z or if you have an explicit Z to Z policy then the behavior
+or more explicit  rules for Z to Z or if you have an explicit Z to Z policy
- is as it was in prior versions.</li>
+then the behavior  is as it was in prior versions.</li>
                   
 </ul>
                   
 <blockquote>                           
   <ol>
-            <li>If you have a Z Z ACCEPT policy for a zone to allow traffic 
+               <li>If you have a Z Z ACCEPT policy for a zone to allow traffic
- between   two interfaces to the same zone, that policy can be removed and 
+   between   two interfaces to the same zone, that policy can be removed
- traffic between  the interfaces will traverse fewer rules than previously.</li>
+and    traffic between  the interfaces will traverse fewer rules than previously.</li>
-            <li>If you have a Z Z DROP or Z Z REJECT policy or you have Z-&gt;Z
+               <li>If you have a Z Z DROP or Z Z REJECT policy or you have
-   rules then your configuration should not require any change.</li>
+ Z-&gt;Z    rules then your configuration should not require any change.</li>
-           <li>If you are currently relying on a implicit policy (one that
+              <li>If you are currently relying on a implicit policy (one
- has   "all" in either the SOURCE or DESTINATION column) to prevent traffic
+that   has   "all" in either the SOURCE or DESTINATION column) to prevent
- between   two interfaces to a zone Z and you have no rules for Z-&gt;Z then
+traffic   between   two interfaces to a zone Z and you have no rules for
- you should   add an explicit DROP or REJECT policy for Z to Z.<br>
+Z-&gt;Z then   you should   add an explicit DROP or REJECT policy for Z to
-           </li>
+Z.<br>
+              </li>
                                     
   </ol>
-        </blockquote>
+           </blockquote>
                   
 <ul>
-     <li>    Sometimes, you want two separate zones on one interface but
+        <li>    Sometimes, you want two separate zones on one interface but 
-you  don't want  Shorewall to set up any infrastructure to handle traffic
+ you  don't want  Shorewall to set up any infrastructure to handle traffic 
-between  them. </li>
+ between  them. </li>
            
 </ul>
            
@@ -123,81 +144,82 @@ between  them. </li>
                        
   <blockquote>                                       
     <pre>/etc/shorewall/zones<br><br>z1	Zone1	The first Zone<br>z2	Zone2	The secont Zone<br><br>/etc/shorewall/interfaces<br><br>z2	eth1	192.168.1.255<br><br>/etc/shorewall/hosts<br><br>z1	eth1:192.168.1.3<br></pre>
-        </blockquote>
+           </blockquote>
-       Here, zone z1 is nested in zone z2 and the firewall is not going to
+          Here, zone z1 is nested in zone z2 and the firewall is not going
- be  involved in any traffic between these two zones. Beginning with Shorewall 
+ to  be  involved in any traffic between these two zones. Beginning with
-  1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
+Shorewall     1.4.1, you can prevent Shorewall from setting up any infrastructure
-  traffic between z1 and z2 by using the new NONE policy:<br>
+to  handle   traffic between z1 and z2 by using the new NONE policy:<br>
                        
   <blockquote>                                       
     <pre>/etc/shorewall/policy<br><pre>z1	z2	NONE<br>z2	z1	NONE</pre></pre>
-       </blockquote>
+          </blockquote>
-       Note that NONE policies are generally used in pairs unless there is
+          Note that NONE policies are generally used in pairs unless there
- asymetric   routing where only the traffic on one direction flows through
+ is  asymetric   routing where only the traffic on one direction flows through 
- the firewall   and you are using a NONE polciy in the other direction. </blockquote>
+  the firewall   and you are using a NONE polciy in the other direction. </blockquote>
                         
 <h3>Version 1.4.1<br>
-   </h3>
+      </h3>
            
 <ul>
-          <li>In Version 1.4.1, Shorewall will never create rules  to  deal 
+             <li>In Version 1.4.1, Shorewall will never create rules  to
- with traffic from a given group back to itself.  The <i>multi</i>  interface 
+ deal   with traffic from a given group back to itself.  The <i>multi</i> 
- option is no longer available so if you want to route traffic between  two 
+ interface   option is no longer available so if you want to route traffic 
- subnetworks on the same interface then I recommend that you upgrade to Version 
+between  two   subnetworks on the same interface then I recommend that you 
- 1.4.2 and use the 'routeback' interface or host option. </li>
+upgrade to Version   1.4.2 and use the 'routeback' interface or host option. </li>
                   
 </ul>
                   
 <h3>Version &gt;= 1.4.0</h3>
-            <b>IMPORTANT: Shorewall &gt;=1.4.0 </b><b>requires</b> <b>the 
+               <b>IMPORTANT: Shorewall &gt;=1.4.0 </b><b>requires</b> <b>the
-iproute    package  ('ip' utility).</b><br>
+  iproute    package  ('ip' utility).</b><br>
+            <br>
+            <b>Note: </b>Unfortunately, some distributions call this package
+  iproute2    which will cause the upgrade of Shorewall to fail with the
+diagnostic:<br>
+               <br>
+                  error: failed dependencies:iproute is needed by  shorewall-1.4.0-1 
          <br>
-         <b>Note: </b>Unfortunately, some distributions call this package 
+               <br>
-iproute2    which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
+             This may be worked around by using the --nodeps option of rpm
-            <br>
+ (rpm   -Uvh   --nodeps &lt;shorewall rpm&gt;).<br>
-               error: failed dependencies:iproute is needed by  shorewall-1.4.0-1
+               <br>
-        <br>
+               If you are upgrading from a version &lt; 1.4.0, then:<br>
-            <br>
-          This may be worked around by using the --nodeps option of rpm (rpm
-  -Uvh   --nodeps &lt;shorewall rpm&gt;).<br>
-            <br>
-            If you are upgrading from a version &lt; 1.4.0, then:<br>
                   
 <ul>
-                 <li>The <b>noping </b>and <b>forwardping</b> interface options
+                    <li>The <b>noping </b>and <b>forwardping</b> interface
-   are   no  longer supported nor is the <b>FORWARDPING </b>option in shorewall.conf.
+ options    are   no  longer supported nor is the <b>FORWARDPING </b>option
-      ICMP echo-request (ping) packets are treated just like any other connection
+ in shorewall.conf.       ICMP echo-request (ping) packets are treated just
-      request and are subject to rules and policies.</li>
+ like any other connection       request and are subject to rules and policies.</li>
-                 <li>Interface names of the form &lt;device&gt;:&lt;integer&gt;
+                    <li>Interface names of the form &lt;device&gt;:&lt;integer&gt; 
-   in   /etc/shorewall/interfaces   now generate a Shorewall error at startup
+    in   /etc/shorewall/interfaces   now generate a Shorewall error at startup 
-   (they   always have produced warnings   in iptables).</li>
+    (they   always have produced warnings   in iptables).</li>
-                 <li>The MERGE_HOSTS variable has been removed from shorewall.conf.
+                    <li>The MERGE_HOSTS variable has been removed from shorewall.conf. 
-     Shorewall  1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone 
+      Shorewall  1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
-  contents   are  determined by BOTH the interfaces and hosts files when there
+    contents   are  determined by BOTH the interfaces and hosts files when
-  are entries   for the zone in both files.</li>
+ there   are entries   for the zone in both files.</li>
-                 <li>The <b>routestopped</b> option in the interfaces and 
+                    <li>The <b>routestopped</b> option in the interfaces
-hosts   file   has  been eliminated; use entries in the routestopped file 
+and   hosts   file   has  been eliminated; use entries in the routestopped
-instead.</li>
+file   instead.</li>
-                 <li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules 
+                    <li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules
-is  no  longer     accepted; you must convert to using the new syntax.</li>
+  is  no  longer     accepted; you must convert to using the new syntax.</li>
-                 <li value="6">The ALLOWRELATED variable in shorewall.conf
+                    <li value="6">The ALLOWRELATED variable in shorewall.conf 
- is  no  longer    supported.  Shorewall 1.4 behavior is the same as 1.3
+  is  no  longer    supported.  Shorewall 1.4 behavior is the same as 1.3 
 with  ALLOWRELATED=Yes.</li>
-                 <li value="6">Late-arriving DNS replies are now dropped
+                    <li value="6">Late-arriving DNS replies are now dropped 
-by  default;     there  is no need for your own /etc/shorewall/common file
+ by  default;     there  is no need for your own /etc/shorewall/common file 
-simply  to avoid     logging  these packets.</li>
+ simply  to avoid     logging  these packets.</li>
-                 <li value="6">The 'firewall', 'functions' and 'version'
+                    <li value="6">The 'firewall', 'functions' and 'version' 
-file   have   been   moved to /usr/share/shorewall.</li>
+ file   have   been   moved to /usr/share/shorewall.</li>
-                <li value="6">The icmp.def file has been removed. If you
+                   <li value="6">The icmp.def file has been removed. If you 
-include     it  from  /etc/shorewall/icmpdef, you will need to modify that
+ include     it  from  /etc/shorewall/icmpdef, you will need to modify that 
-file.</li>
+ file.</li>
                                     
   <ul>
                                     
   </ul>
-             <li>If you followed the advice in FAQ #2 and call find_interface_address
+                <li>If you followed the advice in FAQ #2 and call find_interface_address 
-     in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
+      in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.<br>
-             </li>
+                </li>
                   
 </ul>
                   
@@ -208,234 +230,242 @@ file.</li>
 <h3>Version 1.4.0</h3>
                   
 <ul>
-          <li value="8">The 'multi' interface option is no longer supported.
+             <li value="8">The 'multi' interface option is no longer supported. 
-   Shorewall     will generate rules for sending packets back out the same
+    Shorewall     will generate rules for sending packets back out the same 
- interface that    they arrived on in two cases:</li>
+  interface that    they arrived on in two cases:</li>
                   
 </ul>
                   
 <blockquote>                           
   <ul>
-            <li>There is an <u>explicit</u> policy for the source zone to 
+               <li>There is an <u>explicit</u> policy for the source zone 
-or  from     the destination zone. An explicit policy names both zones and 
+to  or  from     the destination zone. An explicit policy names both zones 
-does  not  use   the 'all' reserved word.</li>
+and  does  not  use   the 'all' reserved word.</li>
                                     
   </ul>
                                     
   <ul>
-            <li>There are one or more rules for traffic for the source zone 
+               <li>There are one or more rules for traffic for the source 
- to   or  from the destination zone including rules that use the 'all' reserved
+zone   to   or  from the destination zone including rules that use the 'all' 
-    word.  Exception: if the source zone and destination zone are the same
+reserved      word.  Exception: if the source zone and destination zone are 
- then   the rule must be explicit - it must name the zone in both the SOURCE
+the same   then   the rule must be explicit - it must name the zone in both 
- and  DESTINATION  columns.</li>
+the SOURCE   and  DESTINATION  columns.</li>
                                     
   </ul>
-        </blockquote>
+           </blockquote>
                   
 <h3>Version &gt;= 1.3.14</h3>
-                <img src="images/BD21298_3.gif" alt="" width="13"
+                   <img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-                     Beginning in version 1.3.14, Shorewall treats entries
+                        Beginning in version 1.3.14, Shorewall treats entries 
- in  <a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently.
+  in  <a href="Documentation.htm#Masq">/etc/shorewall/masq </a>differently. 
- The  change      involves entries with an <b>interface name</b> in the <b>SUBNET</b> 
+  The  change      involves entries with an <b>interface name</b> in the <b>SUBNET</b>
-  (second)      <b>column</b>:<br>
+   (second)      <b>column</b>:<br>
                   
 <ul>
-                   <li>Prior to 1.3.14, Shorewall would detect the FIRST
+                      <li>Prior to 1.3.14, Shorewall would detect the FIRST 
-subnet    on  the   interface  (as shown by "ip addr show <i>interface</i>")
+ subnet    on  the   interface  (as shown by "ip addr show <i>interface</i>") 
-and would    masquerade   traffic  from that subnet. Any other subnets that
+ and would    masquerade   traffic  from that subnet. Any other subnets that 
-routed through    eth1 needed   their  own entry in /etc/shorewall/masq to
+ routed through    eth1 needed   their  own entry in /etc/shorewall/masq to
-be masqueraded   or  to have SNAT   applied.</li>
+ be masqueraded   or  to have SNAT   applied.</li>
-                   <li>Beginning with Shorewall 1.3.14, Shorewall uses the
+                      <li>Beginning with Shorewall 1.3.14, Shorewall uses 
- firewall's      routing   table to determine ALL subnets routed through
+the   firewall's      routing   table to determine ALL subnets routed through 
-the  named interface.      Traffic   originating in ANY of those subnets
+the  named interface.      Traffic   originating in ANY of those subnets is
-is masqueraded  or has SNAT     applied.</li>
+masqueraded  or has SNAT     applied.</li>
                   
 </ul>
-                 You will need to make a change to your configuration if:<br>
+                    You will need to make a change to your configuration
+if:<br>
                   
 <ol>
-                   <li>You have one or more entries in /etc/shorewall/masq
+                      <li>You have one or more entries in /etc/shorewall/masq 
- with   an  interface    name in the SUBNET (second) column; and</li>
+  with   an  interface    name in the SUBNET (second) column; and</li>
-                   <li>That interface connects to more than one subnetwork.</li>
+                      <li>That interface connects to more than one subnetwork.</li>
                   
 </ol>
-                 Two examples:<br>
+                    Two examples:<br>
-                 <br>
+                    <br>
-                  <b>Example 1</b> -- Suppose that your current config is 
+                     <b>Example 1</b> -- Suppose that your current config 
-as  follows:<br>
+is  as  follows:<br>
-                    <br>
+                       <br>
                   
 <pre>	[root@gateway test]# cat /etc/shorewall/masq<br>	#INTERFACE              SUBNET                  ADDRESS<br>	eth0                    eth2                    206.124.146.176<br>	eth0                    192.168.10.0/24         206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE<br>	[root@gateway test]# ip route show dev eth2<br>	192.168.1.0/24  scope link<br>	192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>	[root@gateway test]#</pre>
                   
 <blockquote>In this case, the second entry in /etc/shorewall/masq is no longer 
-        required.<br>
+         required.<br>
-                 </blockquote>
+                    </blockquote>
-                 <b>Example 2</b>-- What if your current configuration is 
+                    <b>Example 2</b>-- What if your current configuration 
-like   this?<br>
+is  like   this?<br>
                   
 <pre>	[root@gateway test]# cat /etc/shorewall/masq	<br>	#INTERFACE              SUBNET                  ADDRESS	<br>	eth0                    eth2                    206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE	<br>	[root@gateway test]# ip route show dev eth2	<br>	192.168.1.0/24  scope link<br>	192.168.10.0/24  proto kernel  scope link  src 192.168.10.254	<br>	[root@gateway test]#</pre>
                   
 <blockquote>In this case, you would want to change the entry in /etc/shorewall/masq 
-        to:<br>
+         to:<br>
-                 </blockquote>
+                    </blockquote>
                   
 <pre>	#INTERFACE              SUBNET                  ADDRESS	<br>	eth0                    192.168.1.0/24          206.124.146.176<br>	#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-                 <img src="images/BD21298_3.gif" alt="" width="13"
+                    <img src="images/BD21298_3.gif" alt="" width="13"
  height="13">
-                    Version 1.3.14 also introduced simplified ICMP echo-request
+                       Version 1.3.14 also introduced simplified ICMP echo-request 
-   (ping)    handling.  The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
+    (ping)    handling.  The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf 
-       is used  to specify that the old (pre-1.3.14) ping handling is to
+        is used  to specify that the old (pre-1.3.14) ping handling is to 
 be   used     (If the option is not set in your /etc/shorewall/shorewall.conf 
- then OLD_PING_HANDLING=Yes      is assumed). I don't plan on supporting
+  then OLD_PING_HANDLING=Yes      is assumed). I don't plan on supporting 
 the  old handling indefinitely  so   I urge current users to migrate to using 
-the new handling as soon as  possible.    See the <a href="ping.html">'Ping'
+ the new handling as soon as  possible.    See the <a href="ping.html">'Ping' 
-handling documentation</a>  for details.<br>
+ handling documentation</a>  for details.<br>
                   
 <h3>Version 1.3.10</h3>
-                  If you have installed the 1.3.10 Beta 1 RPM and are now 
+                     If you have installed the 1.3.10 Beta 1 RPM and are
-upgrading     to  version   1.3.10, you will need to use the '--force' option:<br>
+now   upgrading     to  version   1.3.10, you will need to use the '--force'
-                  <br>
+option:<br>
+                     <br>
                   
 <blockquote>                           
   <pre>rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm </pre>
-                  </blockquote>
+                     </blockquote>
                   
 <h3>Version &gt;= 1.3.9</h3>
-                    The 'functions' file has moved to /usr/lib/shorewall/functions.
+                       The 'functions' file has moved to /usr/lib/shorewall/functions. 
-     If  you   have  an application that uses functions from that file, your
+      If  you   have  an application that uses functions from that file, your
-   application     will need to be changed to reflect this change of location.<br>
+    application     will need to be changed to reflect this change of location.<br>
                   
 <h3>Version &gt;= 1.3.8</h3>
                   
 <p>If you have a pair of firewall systems configured for            failover 
-           or if you have asymmetric routing, you will need to modify   
+            or if you have asymmetric routing, you will need to modify   
                       your firewall setup slightly under Shorewall      
                       versions &gt;= 1.3.8. Beginning with version 1.3.8, 
                                     you must set NEWNOTSYN=Yes in your   
-                             /etc/shorewall/shorewall.conf file.</p>
+                            /etc/shorewall/shorewall.conf file.</p>
                   
 <h3>Version &gt;= 1.3.7</h3>
                   
 <p>Users specifying ALLOWRELATED=No in                                /etc/shorewall.conf 
-           will need to include the                                following
+            will need to include the                                following 
-   rules      in  their /etc/shorewall/icmpdef   file (creating       this
+    rules      in  their /etc/shorewall/icmpdef   file (creating       this 
- file if necessary):</p>
+  file if necessary):</p>
                   
 <pre>	run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT<br>	run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT</pre>
                   
 <p>Users having an /etc/shorewall/icmpdef file may remove the ".   /etc/shorewall/icmp.def" 
-           command from that file since the icmp.def file is now   empty.</p>
+            command from that file since the icmp.def file is now   empty.</p>
                   
 <h3><b><a name="Bering">Upgrading </a>Bering to       Shorewall &gt;= 1.3.3</b></h3>
                   
 <p>To properly upgrade with Shorewall version     1.3.3 and later:</p>
                   
 <ol>
-                                                       <li>Be sure you have 
+                                                          <li>Be sure you 
- a  backup    --  you   will  need                                  to transcribe 
+have   a  backup    --  you   will  need                                 
-  any  Shorewall   configuration                                    changes 
+to transcribe    any  Shorewall   configuration                         
-  that  you have made   to the new                                  configuration.</li>
+          changes    that  you have made   to the new                   
-                                                       <li>Replace the shorwall.lrp
+              configuration.</li>
-     package     provided  on                                  the Bering
+                                                          <li>Replace the 
-floppy     with the    later one.  If you did                           
+shorwall.lrp       package     provided  on                              
-      not   obtain  the later   version from Jacques's   site,  see additional
+   the Bering  floppy     with the    later one.  If you did            
-  instructions   below.</li>
+                     not   obtain  the later   version from Jacques's   site,
-                                                       <li>Edit the /var/lib/lrpkg/root.exclude.list
+ see additional    instructions   below.</li>
-                                            file and remove the /var/lib/shorewall
+                                                          <li>Edit the /var/lib/lrpkg/root.exclude.list 
-         entry  if                                  present. Then do not
+                                             file and remove the /var/lib/shorewall 
+          entry  if                                  present. Then do not 
 forget       to   backup  root.lrp !</li>
                   
 </ol>
                   
 <p>The .lrp that I release isn't set up for a two-interface firewall like 
-             Jacques's. You need to follow the <a
+              Jacques's. You need to follow the <a
  href="two-interface.htm">instructions           for   setting up a two-interface 
- firewall</a> plus you also need  to   add    the  following   two Bering-specific
+  firewall</a> plus you also need  to   add    the  following   two Bering-specific 
- rules to /etc/shorewall/rules:</p>
+  rules to /etc/shorewall/rules:</p>
                   
 <blockquote>                           
   <pre># Bering specific rules:<br># allow loc to fw udp/53 for dnscache to work<br># allow loc to fw tcp/80 for weblet to work<br>#<br>ACCEPT loc fw udp 53<br>ACCEPT loc fw tcp 80</pre>
-                        </blockquote>
+                           </blockquote>
                   
 <h3 align="left">Version  1.3.6 and 1.3.7</h3>
                   
 <p align="left">If you have a pair of firewall systems configured for   
-    failover or if you have asymmetric routing, you will need to modify 
+     failover or if you have asymmetric routing, you will need to modify
-                  your firewall setup slightly under Shorewall versions 1.3.6
+                   your firewall setup slightly under Shorewall versions
-      and   1.3.7</p>
+1.3.6       and   1.3.7</p>
                   
 <ol>
-                                   <li>                               
+                                      <li>                              
+               
     <p align="left">Create the file /etc/shorewall/newnotsyn and in it add 
-                      the following rule<br>
+                       the following rule<br>
-                                 <br>
+                                    <br>
-                                 <font face="Courier">run_iptables -A newnotsyn
+                                    <font face="Courier">run_iptables -A
-   -j  RETURN    #  So  that the            connection tracking table can
+newnotsyn     -j  RETURN    #  So  that the            connection tracking
-be   rebuilt<br>
+table can  be   rebuilt<br>
-                                                                      # from
+                                                                        
-  non-SYN     packets     after  takeover.<br>
+#  from   non-SYN     packets     after  takeover.<br>
-                        </font>  </p>
+                           </font>  </p>
-                        </li>
+                           </li>
-                        <li>                               
+                           <li>                                          
+   
     <p align="left">Create /etc/shorewall/common (if you don't already  
-      have that file) and include the following:<br>
+       have that file) and include the following:<br>
-                                 <br>
+                                    <br>
-                                 <font face="Courier">run_iptables -A common
+                                    <font face="Courier">run_iptables -A
-  -p  tcp   --tcp-flags                 ACK,FIN,RST ACK -j ACCEPT #Accept
+common    -p  tcp   --tcp-flags                 ACK,FIN,RST ACK -j ACCEPT
-Acks  to rebuild   connection<br>
+#Accept  Acks  to rebuild   connection<br>
-                                                                                          
+                                                                                              
-                    #tracking table. <br>
+                     #tracking table. <br>
-                                 . /etc/shorewall/common.def</font> </p>
+                                    . /etc/shorewall/common.def</font> </p>
-                        </li>
+                           </li>
                   
 </ol>
                   
 <h3 align="left">Versions &gt;= 1.3.5</h3>
                   
 <p align="left">Some forms of pre-1.3.0 rules file syntax are no    longer
-  supported. </p>
+    supported. </p>
                   
 <p align="left">Example 1:</p>
                   
 <div align="left">         
 <pre>	ACCEPT    net    loc:192.168.1.12:22    tcp    11111    -    all</pre>
-                        </div>
+                           </div>
                   
 <p align="left">Must be replaced with:</p>
                   
 <div align="left">         
 <pre>	DNAT	net	loc:192.168.1.12:22	tcp	11111</pre>
-                        </div>
+                           </div>
                   
 <div align="left">         
 <p align="left">Example 2:</p>
-                      </div>
+                         </div>
                   
 <div align="left">         
 <pre>	ACCEPT	loc	fw::3128	tcp	80	-	all</pre>
-                        </div>
+                           </div>
                   
 <div align="left">         
 <p align="left">Must be replaced with:</p>
-                      </div>
+                         </div>
                   
 <div align="left">         
 <pre>	REDIRECT	loc	3128	tcp	80</pre>
-                        </div>
+                           </div>
                   
 <h3 align="left">Version &gt;= 1.3.2</h3>
                   
 <p align="left">The functions and versions files together with the      'firewall'
-  symbolic link have moved from /etc/shorewall to /var/lib/shorewall.    
+    symbolic link have moved from /etc/shorewall to /var/lib/shorewall. 
-               If you have applications that access these files, those  applications
+                  If you have applications that access these files, those
-                   should be modified accordingly.</p>
+ applications                    should be modified accordingly.</p>
                   
-<p><font size="2">  Last updated 5/27/2003 -   <a href="support.htm">Tom Eastep</a></font>
+<p><font size="2">  Last updated 6/29/2003 -   <a href="support.htm">Tom
-</p>
+Eastep</a></font> </p>
                   
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
-             © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
+              © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
-</p>
+   </p>
+   <br>
+  <br>
+ <br>
 </body>
 </html>

STABLE/documentation/useful_links.html

@@ -12,24 +12,24 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" width="100%" id="AutoNumber4"
- bgcolor="#400169" height="90">
+ bgcolor="#3366ff" height="90">
-     <tbody>
+      <tbody>
-       <tr>
+        <tr>
-         <td width="100%">
+          <td width="100%">       
       <h1 align="center"><font color="#ffffff">Useful Links</font><br>
-         </h1>
+          </h1>
-        <br>
+         <br>
-         </td>
+          </td>
-      </tr>
+       </tr>
     
   </tbody> 
 </table>
-   &nbsp;&nbsp; &nbsp;<br>
+    &nbsp;&nbsp; &nbsp;<br>
   
 <h3>NetFilter Site: <a href="http://www.netfilter.org">http://www.netfilter.org<img
  src="images/netfilterlogo.png" alt="Netfilter Logo" width="94"
  height="33" hspace="4" align="middle" border="0">
-  </a></h3>
+   </a></h3>
   
 <h3>Linux Advanced Routing and Traffic Control Howto: <a
  href="http://ds9a.nl/lartc">http://ds9a.nl/lartc</a></h3>
@@ -39,7 +39,7 @@
 <h3>LEAF Site: <a href="http://leaf-project.org">http://leaf-project.org<img
  src="images/leaflogo.jpg" alt="Leaf Logo" width="64" height="48"
  align="middle" hspace="4" border="0">
-  </a></h3>
+   </a></h3>
   
 <h3>Bering LEAF Distribution: <a
  href="http://leaf.sourceforge.net/devel/jnilo">       http://leaf.sourceforge.net/devel/jnilo</a></h3>
@@ -48,15 +48,16 @@
  href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html<img
  src="images/openlogo-nd-50.png" alt="Open Logo" width="25" height="30"
  align="middle" hspace="4" border="0">
- <img src="images/debian.jpg" alt="Debian Logo" width="88" height="30"
+  <img src="images/debian.jpg" alt="Debian Logo" width="88" height="30"
  align="middle" border="0">
-  </a><br>
+   </a><br>
-  </h3>
+   </h3>
-  <br>
+   <br>
-  <font size="2">Last updated 9/16/2002 - <a href="support.htm">Tom Eastep</a></font>
+   <font size="2">Last updated 9/16/2002 - <a href="support.htm">Tom Eastep</a></font> 
  
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
  &copy; <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
+     <br>
     <br>
    <br>
   <br>

STABLE/documentation/whitelisting_under_shorewall.htm

@@ -16,20 +16,20 @@
   
 <table border="0" cellpadding="0" cellspacing="0"
  style="border-collapse: collapse;" bordercolor="#111111" width="100%"
- id="AutoNumber1" bgcolor="#400169" height="90">
+ id="AutoNumber1" bgcolor="#3366ff" height="90">
-    <tbody>
+     <tbody>
-     <tr>
+      <tr>
-      <td width="100%">
+       <td width="100%">       
       <h1 align="center"><font color="#ffffff">Whitelisting under Shorewall</font></h1>
-      </td>
+       </td>
-    </tr>
+     </tr>
     
   </tbody> 
 </table>
   
-<p align="left">For a brief time, the 1.2 version of Shorewall supported an
+<p align="left">For a brief time, the 1.2 version of Shorewall supported
- /etc/shorewall/whitelist file. This file was intended to contain a list of
+an  /etc/shorewall/whitelist file. This file was intended to contain a list
-IP  addresses of hosts whose POLICY to all zones was ACCEPT. The whitelist
+of IP  addresses of hosts whose POLICY to all zones was ACCEPT. The whitelist 
 file was  implemented as a stop-gap measure until the facilities necessary 
 for  implementing white lists using zones was in place. As of Version 1.3 
 RC1, those  facilities were available.</p>
@@ -39,18 +39,19 @@ to a  set
  following environment:</p>
   
 <ul>
-    <li>A firewall with three interfaces -- one to the internet, one    to
+     <li>A firewall with three interfaces -- one to the internet, one   
-a local network and one to a DMZ.</li>
+to a local network and one to a DMZ.</li>
-    <li>The local network uses SNAT to the internet and is comprised    of
+     <li>The local network uses SNAT to the internet and is comprised   
-the class B network 10.10.0.0/16 (Note: While this example uses an RFC 1918
+of the class B network 10.10.0.0/16 (Note: While this example uses an RFC
-   local network, the technique described here in no way depends on that or
+1918    local network, the technique described here in no way depends on
-on    SNAT. It may be used with Proxy ARP, Subnet Routing, Static NAT, etc.).</li>
+that or on    SNAT. It may be used with Proxy ARP, Subnet Routing, Static
-    <li>The network operations staff have workstations with IP    addresses
+NAT, etc.).</li>
+     <li>The network operations staff have workstations with IP    addresses 
 in the class C network 10.10.10.0/24</li>
-    <li>We want the network operations staff to have full access to    all
+     <li>We want the network operations staff to have full access to    all 
 other hosts.</li>
-    <li>We want the network operations staff to bypass the transparent
+     <li>We want the network operations staff to bypass the transparent 
- HTTP proxy running on our firewall.</li>
+HTTP proxy running on our firewall.</li>
   
 </ul>
   
@@ -62,36 +63,36 @@ other hosts.</li>
   
 <blockquote>   
   <table border="2">
-                          <tbody>
+                           <tbody>
-       <tr>
+        <tr>
-           <td><b>   ZONE</b></td>
+            <td><b>   ZONE</b></td>
-           <td><b>   DISPLAY</b></td>
+            <td><b>   DISPLAY</b></td>
-           <td><b>   COMMENTS</b></td>
+            <td><b>   COMMENTS</b></td>
-         </tr>
+          </tr>
-                      <tr>
+                       <tr>
-           <td>net</td>
+            <td>net</td>
-           <td>Net</td>
+            <td>Net</td>
-           <td>Internet</td>
+            <td>Internet</td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>ops</td>
+            <td>ops</td>
-           <td>Operations</td>
+            <td>Operations</td>
-           <td>Operations Staff's Class C</td>
+            <td>Operations Staff's Class C</td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>loc</td>
+            <td>loc</td>
-           <td>Local</td>
+            <td>Local</td>
-           <td>Local Class B</td>
+            <td>Local Class B</td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>dmz</td>
+            <td>dmz</td>
-           <td>DMZ</td>
+            <td>DMZ</td>
-           <td>Demilitarized  zone</td>
+            <td>Demilitarized  zone</td>
-         </tr>
+          </tr>
       
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>The <b>ops </b>zone has been added to the standard 3-zone zones file -- 
 since <b>ops</b> is a sub-zone of <b>loc</b>, we list it <u>BEFORE</u> <b>loc</b>.</p>
@@ -100,37 +101,36 @@ since <b>ops</b> is a sub-zone of <b>loc</b>, we list it <u>BEFORE</u> <b>loc</b
   
 <blockquote>   
   <table border="2">
-                            <tbody>
+                             <tbody>
-       <tr>
+        <tr>
-           <td><b>   ZONE</b></td>
+            <td><b>   ZONE</b></td>
-           <td><b>   INTERFACE</b></td>
+            <td><b>   INTERFACE</b></td>
-           <td><b>   BROADCAST</b></td>
+            <td><b>   BROADCAST</b></td>
-           <td><b>   OPTIONS</b></td>
+            <td><b>   OPTIONS</b></td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>net</td>
+            <td>net</td>
-           <td>eth0</td>
+            <td>eth0</td>
-           <td>&lt;whatever&gt;</td>
+            <td>&lt;whatever&gt;</td>
-           <td>&lt;options&gt;</td>
+            <td>&lt;options&gt;</td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>dmz</td>
+            <td>dmz</td>
-           <td>eth1</td>
+            <td>eth1</td>
-           <td>&lt;whatever&gt;</td>
+            <td>&lt;whatever&gt;</td>
-           <td><br>
+            <td><br>
-         </td>
+          </td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>-</td>
+            <td>-</td>
-           <td>eth2</td>
+            <td>eth2</td>
-           <td>10.10.255.255</td>
+            <td>10.10.255.255</td>
-           <td> </td>
+            <td> </td>
-         </tr>
+          </tr>
-
        
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>Because <b>eth2</b> interfaces to two zones (<b>ops</b> and <b>loc)</b>, 
 we  don't specify a zone for it here.</p>
@@ -138,98 +138,89 @@ we  don't specify a zone for it here.</p>
 <h2>Hosts File</h2>
   
 <blockquote>   <font face="Century Gothic, Arial, Helvetica">           
-                                                                </font>
+                                                     </font>    
-
   <table border="2">
-                                      <tbody>
+                                       <tbody>
-       <tr>
+        <tr>
-           <td><b>   ZONE</b></td>
+            <td><b>   ZONE</b></td>
-           <td><b>   HOST(S)</b></td>
+            <td><b>   HOST(S)</b></td>
-           <td><b>   OPTIONS</b></td>
+            <td><b>   OPTIONS</b></td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>ops</td>
+            <td>ops</td>
-           <td>eth2:10.10.10.0/24</td>
+            <td>eth2:10.10.10.0/24</td>
-   <td><br>
+    <td><br>
-         </td>
+          </td>
-             </tr>
+              </tr>
-         <tr>
+          <tr>
-           <td>loc</td>
+            <td>loc</td>
-           <td>eth2:0.0.0.0/0</td>
+            <td>eth2:0.0.0.0/0</td>
-           <td> </td>
+            <td> </td>
-         </tr>
+          </tr>
-
        
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
-<p>Here we define the <b>ops</b> and <b>loc</b> zones. When Shorewall is
+<p>Here we define the <b>ops</b> and <b>loc</b> zones. When Shorewall is stopped,
-stopped, only the hosts in the <b>ops</b> zone will be allowed to access the
+only the hosts in the <b>ops</b> zone will be allowed to access the  firewall
- firewall and the DMZ. I use 0.0.0.0/0 to define the <b>loc</b> zone rather
+and the DMZ. I use 0.0.0.0/0 to define the <b>loc</b> zone rather than  10.10.0.0/16
-than  10.10.0.0/16 so that the limited broadcast address (255.255.255.255)
+so that the limited broadcast address (255.255.255.255) falls into  that
-falls into  that zone. If I used 10.10.0.0/16 then I would have to have a
+zone. If I used 10.10.0.0/16 then I would have to have a separate entry for
-separate entry for  that special address.</p>
+ that special address.</p>
   
 <h2>Policy File</h2>
   
 <blockquote>   <font face="Century Gothic, Arial, Helvetica">           
-                                                                    </font>
+                                                         </font>    
-
   <table border="2">
-                                        <tbody>
+                                         <tbody>
-       <tr>
+        <tr>
-           <td><b>SOURCE</b></td>
+            <td><b>SOURCE</b></td>
-           <td><b>DEST</b></td>
+            <td><b>DEST</b></td>
-           <td><b>   POLICY</b></td>
+            <td><b>   POLICY</b></td>
-           <td><b>   LOG LEVEL</b></td>
+            <td><b>   LOG LEVEL</b></td>
-           <td><b>LIMIT:BURST</b></td>
+            <td><b>LIMIT:BURST</b></td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td><font color="#0000ff">ops</font></td>
+            <td><font color="#0000ff">ops</font></td>
-           <td><font color="#0000ff">all</font></td>
+            <td><font color="#0000ff">all</font></td>
-           <td><font color="#0000ff">ACCEPT</font></td>
+            <td><font color="#0000ff">ACCEPT</font></td>
-
-         <td> </td>
-
-         <td> </td>
-         </tr>
-         <tr>
-           <td><font color="#0000ff">all</font></td>
-           <td><font color="#0000ff">ops</font></td>
-           <td><font color="#0000ff">CONTINUE</font></td>
-
-         <td> </td>
-
-         <td> </td>
-         </tr>
-         <tr>
-           <td>loc</td>
-           <td>net</td>
-           <td>ACCEPT</td>
-   <td> </td>
-
-         <td> </td>
-              </tr>
-         <tr>
-           <td>net</td>
-           <td>all</td>
-           <td>DROP</td>
-           <td>info</td>
            <td> </td>
-         </tr>
-         <tr>
-           <td>all</td>
-           <td>all</td>
-           <td>REJECT</td>
-           <td>info</td>
            <td> </td>
-         </tr>
+          </tr>
-
+          <tr>
+            <td><font color="#0000ff">all</font></td>
+            <td><font color="#0000ff">ops</font></td>
+            <td><font color="#0000ff">CONTINUE</font></td>
+           <td> </td>
+           <td> </td>
+          </tr>
+          <tr>
+            <td>loc</td>
+            <td>net</td>
+            <td>ACCEPT</td>
+    <td> </td>
+           <td> </td>
+               </tr>
+          <tr>
+            <td>net</td>
+            <td>all</td>
+            <td>DROP</td>
+            <td>info</td>
+            <td> </td>
+          </tr>
+          <tr>
+            <td>all</td>
+            <td>all</td>
+            <td>REJECT</td>
+            <td>info</td>
+            <td> </td>
+          </tr>
        
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>Two entries for <b>ops</b> have been added to the standard 3-zone policy 
 file.<font color="#ff0000"><b></b></font></p>
@@ -239,88 +230,80 @@ file.<font color="#ff0000"><b></b></font></p>
 <blockquote>   <font face="Century Gothic, Arial, Helvetica">          </font> 
    
   <table border="2">
-                                                    <tbody>
+                                                     <tbody>
-       <tr>
+        <tr>
-      <td><b>ACTION</b></td>
+       <td><b>ACTION</b></td>
-           <td><b>SOURCE</b></td>
+            <td><b>SOURCE</b></td>
-           <td><b>DEST</b></td>
+            <td><b>DEST</b></td>
-           <td><b>   PROTO</b></td>
+            <td><b>   PROTO</b></td>
-           <td><b>DEST<br>
+            <td><b>DEST<br>
-    PORT(S)</b></td>
+     PORT(S)</b></td>
-           <td><b>SOURCE<br>
+            <td><b>SOURCE<br>
-           PORT(S)</b></td>
+            PORT(S)</b></td>
-           <td><b>ORIGINAL<br>
+            <td><b>ORIGINAL<br>
-           DEST</b></td>
+            DEST</b></td>
-                                                         </tr>
+                                                          </tr>
-         <tr>
+          <tr>
-           <td>REDIRECT</td>
+            <td>REDIRECT</td>
-           <td>loc!ops</td>
+            <td>loc!ops</td>
-           <td>3128</td>
+            <td>3128</td>
-           <td>tcp</td>
+            <td>tcp</td>
-           <td>http</td>
+            <td>http</td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-         </tr>
+          </tr>
-         <tr>
+          <tr>
-           <td>...</td>
+            <td>...</td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-           <td> </td>
+            <td> </td>
-         </tr>
+          </tr>
-
-
         
     </tbody>   
   </table>
-  </blockquote>
+   </blockquote>
   
 <p>This is the rule that transparently redirects web traffic to the transparent 
  proxy running on the firewall. The SOURCE column explicitly excludes the 
 <b>ops</b>  zone from the rule.</p>
+ 
 <h2>Routestopped File</h2>
   
 <blockquote>   
   <table border="2">
-    <tbody>
+     <tbody>
-      <tr>
+       <tr>
-        <td><b>INTERFACE</b><br>
+         <td><b>INTERFACE</b><br>
-        </td>
+         </td>
-          <td><b>   HOST(S)</b></td>
+           <td><b>   HOST(S)</b></td>
-                  </tr>
+                   </tr>
-        <tr>
+         <tr>
-        <td valign="top">eth1<br>
+         <td valign="top">eth1<br>
-        </td>
+         </td>
-        <td valign="top"><br>
+         <td valign="top"><br>
-        </td>
+         </td>
-      </tr>
+       </tr>
-      <tr>
+       <tr>
-          <td>eth2<br>
+           <td>eth2<br>
-        </td>
+         </td>
-          <td>10.10.10.0/24</td>
+           <td>10.10.10.0/24</td>
-              </tr>
+               </tr>
-
        
     </tbody>   
   </table>
- <br>
+  <br>
-</blockquote>
+ </blockquote>
-
-
-
      
 <p><font size="2">   Updated 2/18/2003 - <a href="support.htm">Tom  Eastep</a> 
     </font></p>
     
-
-
 <p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font> 
    © <font size="2">2002, 2003Thomas M. Eastep.</font></a></font></p>
-
+                               <br>
-
+  <br>
-                            <br>
  <br>
 </body>
 </html>

STABLE/fallback.sh

@@ -28,7 +28,7 @@
 #       shown below. Simply run this script to revert to your prior version of
 #       Shoreline Firewall.
 
-VERSION=1.4.5
+VERSION=1.4.6
 
 usage() # $1 = exit status
 {

STABLE/firewall

@@ -1866,7 +1866,7 @@ add_nat_rule() {
 		    log_rule $loglevel $chain $logtarget -t nat
 		fi
 
-		addnatrule $chain -j $target1
+		addnatrule $chain $proto -j $target1
 	    else
 		for adr in `separate_list $addr`; do
 		    run_iptables2 -t nat -A OUTPUT $proto $sports -d $adr \
@@ -1899,7 +1899,7 @@ add_nat_rule() {
 			log_rule $loglevel $chain $logtarget -t nat -d `fix_bang $adr`
 		    fi
 
-		    addnatrule $chain -d $adr -j $target1
+		    addnatrule $chain $proto -d $adr -j $target1
 		done
 	    else
 		for adr in `separate_list $addr`; do
@@ -2218,11 +2218,11 @@ process_rule() # $1 = target
 	   fatal_error "Empty source zone or qualifier: rule \"$rule\""
     fi
 
-    if [ "$clientzone" = "${clientzone%\!*}" ]; then
+    if [ "$clientzone" = "${clientzone%!*}" ]; then
 	excludezones=
     else
-	excludezones="${clientzone#*\!}"
+	excludezones="${clientzone#*!}"
-	clientzone="${clientzone%\!*}"
+	clientzone="${clientzone%!*}"
 
 	[ "$logtarget" = DNAT ] || [ "$logtarget" = REDIRECT ] ||\
 	    fatal_error "Exclude list only allowed with DNAT or REDIRECT"

STABLE/functions

@@ -219,3 +219,164 @@ strip_file() # $1 = Base Name of the file, $2 = Full Name of File (optional)
 	> $TMP_DIR/$1
     fi
 }
+
+#
+#  Note: The following set of IP address manipulation functions have anomalous
+#        behavior when the shell only supports 32-bit signed arithmatic and
+#        the IP address is 128.0.0.0 or 128.0.0.1.
+#
+#
+# So that emacs doesn't get lost, we use $LEFTSHIFT rather than <<
+#
+LEFTSHIFT='<<'
+
+#
+# Convert an IP address in dot quad format to an integer
+#
+decodeaddr() {
+    local x
+    local temp=0
+    local ifs=$IFS
+    
+    IFS=.
+
+    for x in $1; do
+	temp=$(( $(( $temp $LEFTSHIFT 8 )) | $x ))
+    done
+
+    echo $temp
+
+    IFS=$ifs
+}
+
+#
+# convert an integer to dot quad format
+#
+encodeaddr() {
+    addr=$1
+    local x
+    local y=$(($addr & 255))
+
+    for x in 1 2 3 ; do
+	addr=$(($addr >> 8))
+	y=$(($addr & 255)).$y
+    done
+
+    echo $y
+}
+
+#
+# Enumerate the members of an IP range -- When using a shell supporting only
+# 32-bit signed arithmetic, the range cannot span 128.0.0.0.
+#
+ip_range() {
+    local first last l x y z vlsm
+
+    case $1 in 
+    [0-9]*.*.*.*-*.*.*.*)
+	;;
+    *)
+	echo $1
+	return
+	;;
+    esac
+
+    first=`decodeaddr ${1%-*}`
+    last=`decodeaddr ${1#*-}`
+
+    if [ $first -gt $last ]; then
+	fatal_error "Invalid IP address range: $1"
+    fi
+
+    l=$(( $last + 1 ))
+
+    while [ $first -le $last ]; do
+	vlsm=
+	x=31
+	y=2
+	z=1
+
+	while [ $(( $first % $y )) -eq 0 -a $(( $first + $y )) -le $l ]; do
+	    vlsm=/$x
+	    x=$(( $x - 1 ))
+	    z=$y
+	    y=$(( $y * 2 ))
+	done
+
+	echo `encodeaddr $first`$vlsm
+	first=$(($first + $z))
+    done
+}
+
+#
+# Netmask from CIDR
+#
+ip_netmask() {
+    local vlsm=${1#*/}
+
+    [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 $LEFTSHIFT $(( 32 - $vlsm )) ))
+}
+
+#
+# Network address from CIDR
+#
+ip_network() {
+    local decodedaddr=`decodeaddr ${1%/*}`
+    local netmask=`ip_netmask $1`
+
+    echo `encodeaddr $(($decodedaddr & $netmask))`
+}
+
+#
+# The following hack is supplied to compensate for the fact that many of
+# the popular light-weight Bourne shell derivatives don't support XOR ("^").
+#
+# Note: 2147483647 = 0x7fffffff
+
+ip_broadcast() {
+    local x=$(( ${1#*/} - 1 ))
+
+    [ $x -eq -1 ] && echo -1 || echo $(( 2147483647 >> $x ))
+}
+
+#
+# Calculate broadcast address from CIDR
+#
+broadcastaddress() {
+    local decodedaddr=`decodeaddr ${1%/*}`
+    local netmask=`ip_netmask $1`
+    local broadcast=`ip_broadcast $1`
+
+    echo `encodeaddr $(( $(($decodedaddr & $netmask)) | $broadcast ))`
+}
+
+#
+# Test for subnet membership
+#
+in_subnet() # $1 = IP address, $2 = CIDR network
+{
+    local netmask=`ip_netmask $2`
+
+    test $(( `decodeaddr $1` & $netmask)) -eq $(( `decodeaddr ${2%/*}` & $netmask ))
+}
+
+#
+# Netmask to VLSM
+#
+ip_vlsm() {
+    local mask=`decodeaddr $1`
+    local vlsm=0
+    local x=$(( 128 $LEFTSHIFT 24 ))
+
+    while [ $(( $x & $mask )) -ne 0 ]; do
+	[ $mask -eq $x ] && mask=0 || mask=$(( $mask $LEFTSHIFT 1 )) # Don't Ask...
+	vlsm=$(($vlsm + 1))
+    done
+
+    if [ $(( $mask & 2147483647)) -ne 0 ]; then
+	echo "Invalid net mask: $1" >&2
+    else
+	echo $vlsm
+    fi
+}
+

STABLE/hosts

@@ -20,7 +20,7 @@
 #	ZONE	- The name of a zone defined in /etc/shorewall/zones
 #
 #	HOST(S)	- The name of an interface followed by a colon (":") and
-#		  either:
+#		  a comma-separated list whose elements are either:
 #
 #			a) The IP address of a host
 #			b) A subnetwork in the form
@@ -33,6 +33,7 @@
 #
 #			eth1:192.168.1.3
 #			eth2:192.168.2.0/24
+#			eth3:192.168.2.0/24,192.168.3.1
 #
 #	OPTIONS - A comma-separated list of options. Currently-defined
 #		  options are:

STABLE/install.sh

@@ -54,7 +54,7 @@
 #        /etc/rc.d/rc.local file is modified to start the firewall.
 #
 
-VERSION=1.4.5
+VERSION=1.4.6
 
 usage() # $1 = exit status
 {

STABLE/interfaces

@@ -20,6 +20,10 @@
 #			an alias (e.g., eth0:0) here; see
 #			http://www.shorewall.net/FAQ.htm#faq18
 #
+#			You may specify wildcards here. For example, if you
+#			want to make an entry that applies to all PPP
+#			interfaces, use 'ppp+'.
+#
 #			DO NOT DEFINE THE LOOPBACK INTERFACE (lo) IN THIS FILE.
 #
 #	BROADCAST	The broadcast address for the subnetwork to which the
@@ -89,6 +93,16 @@
 #				sub-networking as described at:
 #				http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet
 #
+#			newnotsyn    - TCP packets that don't have the SYN 
+#				       flag set and which are not part of an
+#				       established connection will be accepted
+#				       from this interface, even if 
+#				       NEWNOTSYN=No has been specified in
+#				       /etc/shorewall/shorewall.conf.
+#
+#				       This option has no effect if 
+#				       NEWNOTSYN=Yes.
+#
 #			The order in which you list the options is not
 #			significant but the list should have no embedded white
 #			space.

STABLE/masq

@@ -42,12 +42,15 @@
 #				will automatically add this address to the
 #				INTERFACE named in the first column.
 #
-#				WARNING: Do NOT specify ADD_SNAT_ALIASES=Yes if
+#				You may also specify a range of up to 256
-#				the address given in this column is the primary
+#				IP addresses if you want the SNAT address to
-#				IP address for the interface in the INTERFACE
+#				be assigned from that range in a round-robin
-#				column.
+#				range by connection. The range is specified by
+#				<first ip in range>-<last ip in range>.
 #
-#				This column may not contain a DNS Name.
+#				Example: 206.124.146.177-206.124.146.180
+#				
+#				This column may not contain DNS Names.
 #
 #	Example 1:
 #

STABLE/releasenotes.txt

@@ -2,19 +2,180 @@ This is a minor release of Shorewall.
 
 Problems Corrected:
 
-1) The command "shorewall debug try <directory>" now correctly traces
+1) A problem seen on RH7.3 systems where Shorewall encountered start
-   the attempt.
+   errors when started using the "service" mechanism has been worked
+   around.
 
-2) The INCLUDE directive now works properly in the zones file;
+2) Where a list of IP addresses appears in the DEST column of a DNAT[-]
-   previously, INCLUDE in that file was ignored.
+   rule, Shorewall incorrectly created multiple DNAT rules in the nat
+   table (one for each element in the list). Shorewall now correctly
+   creates a single DNAT rule with multiple "--to-destination" clauses.
 
-3) /etc/shorewall/routestopped records with an empty second column are no
+3) Corrected a problem in Beta 1 where DNS names containing a "-" were
-   longer ignored.
+   mis-handled when they appeared in the DEST column of a rule.
+
+4) The handling of z1!z2 in the SOURCE column of DNAT and REDIRECT
+   rules has been corrected.
+
+5) The message "Adding rules for DHCP" is now suppressed if there are
+   no DHCP rules to add.
+
+Migration Issues:
+
+1) In earlier versions, an undocumented feature allowed entries in
+   the host file as follows:
+
+      z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
+
+   This capability was never documented and has been removed in 1.4.6
+   to allow entries of the following format:
+
+      z   eth1:192.168.1.0/24,192.168.2.0/24
+
+2) The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been
+   removed from /etc/shorewall/shorewall.conf. These capabilities are
+   now automatically detected by Shorewall (see below).
 
 New Features:
 
-1) The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may now
+1) A 'newnotsyn' interface option has been added. This option may be
-   contain a list of addresses. If the list begins with "!' then the
+   specified in /etc/shorewall/interfaces and overrides the setting
-   rule will take effect only if the original destination address in
+   NEWNOTSYN=No for packets arriving on the associated interface.
-   the connection request does not match any of the addresses listed.
+
+2) The means for specifying a range of IP addresses in
+   /etc/shorewall/masq to use for SNAT is now
+   documented. ADD_SNAT_ALIASES=Yes is enabled for address ranges.
+
+3) Shorewall can now add IP addresses to subnets other than the first
+   one on an interface.
+
+4) DNAT[-] rules may now be used to load balance (round-robin) over a
+   set of servers. Any number of servers may be specified in a range of
+   addresses given as <first address>-<last address> and multiple
+   ranges or individual servers may be specified in a comma-separated
+   list.
+
+   Example:
+
+	DNAT net loc:192.168.10.2-192.168.10.5,192.168.10.44 tcp 80
+
+5) The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
+   have been removed and have been replaced by code that detects
+   whether these capabilities are present in the current kernel. The
+   output of the start, restart and check commands have been enhanced
+   to report the outcome:
+
+   Shorewall has detected the following iptables/netfilter capabilities:
+      NAT: Available
+      Packet Mangling: Available
+      Multi-port Match: Available
+   Verifying Configuration...
+
+6) Support for the Connection Tracking Match Extension has been
+   added. This extension is available in recent kernel/iptables
+   releases and allows for rules which match against elements in
+   netfilter's connection tracking table.
+
+   Shorewall automatically detects the availability of this extension
+   and reports its availability in the output of the start, restart and
+   check commands.
+
+   Shorewall has detected the following iptables/netfilter capabilities:
+      NAT: Available
+      Packet Mangling: Available
+      Multi-port Match: Available
+      Connection Tracking Match: Available
+   Verifying Configuration...
+
+   If this extension is available, the ruleset generated by Shorewall
+   is changed in the following ways:
+
+   a) To handle 'norfc1918' filtering, Shorewall will not create chains
+      in the mangle table but will rather do all 'norfc1918' filtering in
+      the filter table (rfc1918 chain).
+
+   b) Recall that Shorewall DNAT rules generate two netfilter rules;
+      one in the nat table and one in the filter table. If the Connection
+      Tracking Match Extension is available, the rule in the filter table
+      is extended to check that the original destination address was the
+      same as specified (or defaulted to) in the DNAT rule.
+
+7) The shell used to interpret the firewall script
+   (/usr/share/shorewall/firewall) may now be specified using the
+   SHOREWALL_SHELL parameter in shorewall.conf.
+
+8) An 'ipcalc' command has been added to /sbin/shorewall.
+
+      ipcalc [ <address> <netmask> | <address>/<vlsm> ]
+
+   Examples:
+
+      [root@wookie root]# shorewall ipcalc 192.168.1.0/24
+         CIDR=192.168.1.0/24
+         NETMASK=255.255.255.0
+         NETWORK=192.168.1.0
+         BROADCAST=192.168.1.255
+      [root@wookie root]#
+
+      [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
+         CIDR=192.168.1.0/24
+         NETMASK=255.255.255.0
+         NETWORK=192.168.1.0
+         BROADCAST=192.168.1.255
+      [root@wookie root]#
+
+   Warning:
+
+      If your shell only supports 32-bit signed arithmatic (ash or
+      dash), then the ipcalc command produces incorrect information for
+      IP addresses 128.0.0.0-1 and for /1 networks. Bash should produce
+      correct information for all valid IP addresses.
+
+9) An 'iprange' command has been added to /sbin/shorewall. 
+
+      iprange <address>-<address>
+
+   This command decomposes a range of IP addressses into a list of
+   network and host addresses. The command can be useful if you need to
+   construct an efficient set of rules that accept connections from a
+   range of network addresses.
+
+   Note: If your shell only supports 32-bit signed arithmetic (ash or
+   dash) then the range may not span 128.0.0.0.
+
+   Example:
+
+      [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
+      192.168.1.4/30
+      192.168.1.8/29
+      192.168.1.16/28
+      192.168.1.32/27
+      192.168.1.64/26
+      192.168.1.128/25
+      192.168.2.0/23
+      192.168.4.0/22
+      192.168.8.0/22
+      192.168.12.0/29
+      192.168.12.8/31
+      [root@gateway root]#
+
+10) A list of host/net addresses is now allowed in an entry in
+    /etc/shorewall/hosts.
+
+    Example:
+
+	foo	eth1:192.168.1.0/24,192.168.2.0/24
+
+11) The "shorewall check" command now includes the chain name when
+    printing the applicable policy for each pair of zones. 
+
+    Example:
+
+	Policy for dmz to net is REJECT using chain all2all
+
+    This means that the policy for connections from the dmz to the
+    internet is REJECT and the applicable entry in the
+    /etc/shorewall/policy was the all->all policy.
+
+12) Support for the 2.6 Kernel series has been added.
 

STABLE/rules

@@ -107,6 +107,12 @@
 #				3. You may not specify both an interface and
 #				   an address.
 #
+#			Unlike in the SOURCE column, you may specify a range of
+#			up to 256 IP addresses using the syntax
+#			<first ip>-<last ip>. When the ACTION is DNAT or DNAT-,
+#			the connections will be assigned to addresses in the
+#			range in a round-robin fashion.
+#
 #			The port that the server is listening on may be
 #			included and separated from the server's IP address by
 #			":". If omitted, the firewall will not modifiy the
@@ -137,7 +143,7 @@
 #			In that case, it is suggested that this field contain
 #			 "-"
 #
-#			If MULTIPORT=Yes in /etc/shorewall/shorewall.conf, then
+#			If your kernel contains multi-port match support, then
 #			only a single Netfilter rule will be generated if in
 #			this list and the CLIENT PORT(S) list below:
 #			1. There are 15 or less ports listed.
@@ -154,7 +160,7 @@
 #			specify an ADDRESS in the next column, then place "-"
 #			in this column.
 #
-#			If MULTIPORT=Yes in /etc/shorewall/shorewall.conf, then
+#			If your kernel contains multi-port match support, then
 #			only a single Netfilter rule will be generated if in
 #			this list and the DEST PORT(S) list above:
 #			1. There are 15 or less ports listed.
@@ -214,6 +220,14 @@
 #	#ACTION  SOURCE	DEST      	PROTO	DEST    SOURCE	ORIGINAL
 #	#                               	PORT    PORT(S) DEST
 #	DNAT      net	loc:192.168.1.3 tcp     80      -       130.252.100.69
+#
+#       Example: You want to accept SSH connections to your firewall only 
+#		 from internet IP addresses 130.252.100.69 and 130.252.100.70
+#
+#	#ACTION  SOURCE	DEST      	PROTO	DEST    SOURCE	ORIGINAL
+#	#                               	PORT    PORT(S) DEST
+#	ACCEPT	 net:130.252.100.69,130.252.100.70 \
+#					tcp	22
 ##############################################################################
 #ACTION  SOURCE		DEST      	PROTO	DEST    SOURCE	   ORIGINAL
 #                       	        	PORT    PORT(S)    DEST

STABLE/shorewall

@@ -82,6 +82,22 @@
 #						   be automatically reinstated the
 #						   next time that Shorewall starts.
 #
+#          shorewall ipaddr [ <address>/<cidr> | <address> <netmask> ]
+#
+#                                                  Displays information about the network
+#                                                  defined by the argument[s]
+#
+#          shorewall iprange <address>-<address>   Decomposes a range of IP addresses into
+#                                                  a list of network/host addresses.
+#
+# Fatal Error
+#
+fatal_error() # $@ = Message
+{
+    echo "   $@" >&2
+    exit 2
+}
+
 # Display a chain if it exists
 #
 
@@ -138,6 +154,13 @@ get_config() {
     [ -n "LOGFORMAT" ] && LOGFORMAT="${LOGFORMAT%%%*}"
 
     [ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall:"
+
+    if [ -n "$SHOREWALL_SHELL" ]; then
+	if [ ! -e "$SHOREWALL_SHELL" ]; then
+	    echo "The program specified in SHOREWALL_SHELL does not exist or is not executable" >&2
+	    exit 2
+	fi
+    fi
 }
 
 #
@@ -521,6 +544,8 @@ usage() # $1 = exit status
     echo "   reject <address> ..."
     echo "   allow <address> ..."
     echo "   save"
+    echo "   ipcalc [ <address>/<vlsm> | <address> <netmask> ]"
+    echo "   iprange <address>-<address>"
     exit $1
 }
 
@@ -653,11 +678,13 @@ esac
 case "$1" in
     start|stop|restart|reset|clear|refresh|check)
 	[ $# -ne 1 ] && usage 1
-	exec $FIREWALL $debugging $nolock $1
+	get_config
+	exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $1
 	;;
     add|delete)
 	[ $# -ne 3 ] && usage 1
-	exec $FIREWALL $debugging $nolock $1 $2 $3
+	get_config
+	exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $1 $2 $3
 	;;
     show|list)
 	[ $# -gt 2 ] && usage 1
@@ -860,7 +887,48 @@ case "$1" in
 	fi
 	mutex_off
 	;;
+    ipcalc)
+	if [ $# -eq 2 ]; then
+	    address=${2%/*}
+	    vlsm=${2#*/}
+	elif [ $# -eq 3 ]; then
+	    address=$2
+	    vlsm=`ip_vlsm $3`
+	else
+	    usage 1
+	fi
+	
+	[ -z "$vlsm" ] && exit 2
+	[ "x$address" = "x$vlsm" ] && usage 2
+	[ $vlsm -gt 32 ] && echo "Invalid VLSM: /$vlsm" >&2 && exit 2
+
+	address=$address/$vlsm
+
+	                                  echo "   CIDR=$address"
+	temp=`ip_netmask $address`;       echo "   NETMASK=`encodeaddr $temp`"
+	temp=`ip_network $address`;       echo "   NETWORK=$temp"
+	temp=`broadcastaddress $address`; echo "   BROADCAST=$temp"
+	;;
+
+    iprange)
+	case $2 in
+	    *.*.*.*-*.*.*.*)
+		ip_range $2
+		;;
+	    *)
+		usage 1
+		;;
+	esac
+	;;
+    call) 
+	#
+	# Undocumented way to call functions in /usr/share/shorewall/functions directly
+	#
+	shift;
+	$@
+	;;
     *)
 	usage 1
 	;;
+
 esac

STABLE/shorewall.conf

@@ -144,7 +144,7 @@ BLACKLIST_LOGLEVEL=
 # Example: LOGNEWNOTSYN=debug
 
 
-LOGNEWNOTSYN=
+LOGNEWNOTSYN=info
 
 #
 # MAC List Log Level
@@ -191,6 +191,14 @@ RFC1918_LOG_LEVEL=info
 #
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
+#
+# SHELL
+#
+# The firewall script is normally interpreted by /bin/sh. If you wish to change
+# the shell used to interpret that script, specify the shell here.
+
+SHOREWALL_SHELL=/bin/sh
+
 # SUBSYSTEM LOCK FILE
 #
 # Set this to the name of the lock file expected by your init scripts. For
@@ -230,24 +238,6 @@ MODULESDIR=
 #
 FW=fw
 
-#
-# ENABLE NAT SUPPORT
-#
-# You probally want yes here. Only gateways not doing NAT in any form, like
-# SNAT,DNAT masquerading, port forwading etc. should say "no" here.
-#
-NAT_ENABLED=Yes
-
-#
-# ENABLE MANGLE SUPPORT
-#
-# If you say "no" here, Shorewall will ignore the /etc/shorewall/tos file
-# and will not initialize the mangle table when starting or stopping
-# your firewall. You must enable mangling if you want Traffic Shaping
-# (see TC_ENABLED below).
-#
-MANGLE_ENABLED=Yes
-
 #
 # ENABLE IP FORWARDING
 #
@@ -378,26 +368,6 @@ ROUTE_FILTER=No
 
 NAT_BEFORE_RULES=Yes
 
-# MULTIPORT support
-#
-# If your kernel includes the multiport match option
-# (CONFIG_IP_NF_MATCH_MULTIPORT), you may enable it's use here. When this
-# option is enabled by setting it's value to "Yes" or "yes":
-#
-#	1) If you list more that 15 ports in a comma-seperated list in
-#	   /etc/shorewall/rules, Shorewall will not use the multiport option
-#	   but will generate a separate rule for each element of each port
-#	   list.
-#	2) If you include a port range (<low port>:<high port>) in the
-#	   rule, Shorewall will not use the multiport option but will generate
-#	   a separate rule for each element of each port list.
-#
-# See the /etc/shorewall/rules file for additional information on this option.
-#
-# if this variable is not set or is set to the empty value, "No" is assumed.
-
-MULTIPORT=No
-
 # DNAT IP ADDRESS DETECTION
 #
 # Normally when Shorewall encounters the following rule:
@@ -447,7 +417,7 @@ MUTEX_TIMEOUT=60
 #
 # NEWNOTSYN
 #
-# If this variable is set to "No" or "no", then When a TCP packet that does
+# If this variable is set to "No" or "no", then when a TCP packet that does
 # not have the SYN flag set and the ACK and RST flags clear then unless the
 # packet is part of an established connection, it will be dropped by the
 # firewall
@@ -458,6 +428,9 @@ MUTEX_TIMEOUT=60
 # Users with a High-availability setup with two firewall's and one acting
 # as a backup should set NEWNOTSYN=Yes. Users with asymmetric routing may
 # also need to select NEWNOTSYN=Yes.
+#
+# The behavior of NEWNOTSYN=Yes may also be enabled on a per-interface basis 
+# using the 'newnotsyn' option in /etc/shorewall/interfaces.
 
 NEWNOTSYN=No
 

STABLE/shorewall.spec

@@ -1,5 +1,5 @@
 %define name shorewall
-%define version 1.4.5
+%define version 1.4.6
 %define release 1
 %define prefix /usr
 
@@ -105,6 +105,14 @@ fi
 %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
 
 %changelog
+* Sat Jul 19 2003 Tom Eastep <tom@shorewall.net>
+- Changed version to 1.4.6-1
+* Mon Jul 14 2003 Tom Eastep <tom@shorewall.net>
+- Changed version to 1.4.6-0RC1
+* Mon Jul 07 2003 Tom Eastep <tom@shorewall.net>
+- Changed version to 1.4.6-0Beta2
+* Fri Jul 04 2003 Tom Eastep <tom@shorewall.net>
+- Changed version to 1.4.6-0Beta1
 * Tue Jun 17 2003 Tom Eastep <tom@shorewall.net>
 - Changed version to 1.4.5-1
 * Thu May 29 2003 Tom Eastep <tom@shorewall.net>

STABLE/uninstall.sh

@@ -26,7 +26,7 @@
 #       You may only use this script to uninstall the version
 #       shown below. Simply run this script to remove Seattle Firewall
 
-VERSION=1.4.5
+VERSION=1.4.6
 
 usage() # $1 = exit status
 {