holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

fixed quotes, add CVS Id

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1005 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes 2003-12-28 18:41:13 +00:00
parent ce8e0a9771
commit 220f2c405b
1 changed files with 69 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
Shorewall-docs/starting_and_stopping_shorewall.xml
View File

@ -2,7 +2,7 @@
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article>
<!---->
<!--$Id$-->
<articleinfo>
<title>Starting/Stopping and Monitoring the Firewall</title>
@ -38,12 +38,12 @@
<para>If you have a permanent internet connection such as DSL or Cable, I
recommend that you start the firewall automatically at boot. Once you have
installed &#34;firewall&#34; in your init.d directory, simply type
&#34;chkconfig --add firewall&#34;. This will start the firewall in run
levels 2-5 and stop it in run levels 1 and 6. If you want to configure
installed <quote>firewall</quote> in your init.d directory, simply type
<quote>chkconfig --add firewall</quote>. This will start the firewall in
run levels 2-5 and stop it in run levels 1 and 6. If you want to configure
your firewall differently from this default, you can use the
&#34;--level&#34; option in chkconfig (see &#34;man chkconfig&#34;) or
using your favorite graphical run-level editor.</para>
<quote>--level</quote> option in chkconfig (see <quote>man chkconfig</quote>)
or using your favorite graphical run-level editor.</para>
<caution>
<itemizedlist>
@ -51,21 +51,20 @@
<para>Shorewall startup is disabled by default. Once you have
configured your firewall, you can enable startup by removing the
file /etc/shorewall/startup_disabled. Note: Users of the .deb
package must edit /etc/default/shorewall and set
&#39;startup=1&#39;.</para>
package must edit /etc/default/shorewall and set <quote>startup=1</quote>.</para>
</listitem>
<listitem>
<para>If you use dialup, you may want to start the firewall in your
/etc/ppp/ip-up.local script. I recommend just placing &#34;shorewall
restart&#34; in that script. </para>
/etc/ppp/ip-up.local script. I recommend just placing
<quote>shorewall restart</quote> in that script.</para>
</listitem>
</itemizedlist>
</caution>
<para>You can manually start and stop Shoreline Firewall using the
&#34;shorewall&#34; shell program. Please refer to the Shorewall State
Diagram as shown at the bottom of this page.</para>
<quote>shorewall</quote> shell program. Please refer to the Shorewall
State Diagram as shown at the bottom of this page.</para>
<itemizedlist>
<listitem>
@ -93,7 +92,7 @@
<listitem>
<para>shorewall clear - remove all rules and chains installed by
Shoreline Firewall. The firewall is &#34;wide open&#34; </para>
Shoreline Firewall. The firewall is <quote>wide open</quote></para>
</listitem>
<listitem>
@ -107,12 +106,12 @@
trace of the command is produced as in:</para>
<para><programlisting> shorewall debug start 2&#62; /tmp/trace</programlisting>The
above command would trace the &#39;start&#39; command and place the trace
information in the file /tmp/trace</para>
above command would trace the <quote>start</quote> command and place the
trace information in the file /tmp/trace</para>
<para>Beginning with version 1.4.7, shorewall can give detailed help about
each of its commands: <programlisting> shorewall help [ command | host | address ]</programlisting>The
&#34;shorewall&#34; program may also be used to monitor the firewall.</para>
<quote>shorewall</quote> program may also be used to monitor the firewall.</para>
<itemizedlist>
<listitem>
@ -139,8 +138,7 @@
</listitem>
<listitem>
<para>shorewall show log - display the last 20 packet log entries.
</para>
<para>shorewall show log - display the last 20 packet log entries.</para>
</listitem>
<listitem>
@ -165,18 +163,17 @@
</listitem>
<listitem>
<para>shorewall version - Displays the installed version number.
</para>
<para>shorewall version - Displays the installed version number.</para>
</listitem>
<listitem>
<para>shorewall check - Performs a cursory validation of the zones,
interfaces, hosts, rules and policy files.<caution><para>The
&#34;check&#34; command is totally unsuppored and does not parse and
validate the generated iptables commands. Even though the
&#34;check&#34; command completes successfully, the configuration may
fail to start. Problem reports that complain about errors that the
&#39;check&#39; command does not detect will not be accepted.</para><para>See
<quote>check</quote> command is totally unsuppored and does not parse
and validate the generated iptables commands. Even though the
<quote>check</quote> command completes successfully, the configuration
may fail to start. Problem reports that complain about errors that the
<quote>check</quote> command does not detect will not be accepted.</para><para>See
the recommended way to make configuration changes described below.</para></caution></para>
</listitem>
@ -218,8 +215,7 @@
<itemizedlist>
<listitem>
<para>shorewall drop &#60;ip address list&#62; - causes packets from
the listed IP addresses to be silently dropped by the firewall.
</para>
the listed IP addresses to be silently dropped by the firewall.</para>
</listitem>
<listitem>
@ -244,8 +240,8 @@
</listitem>
</itemizedlist>
<para>Finally, the &#34;shorewall&#34; program may be used to dynamically
alter the contents of a zone.</para>
<para>Finally, the <quote>shorewall</quote> program may be used to
dynamically alter the contents of a zone.</para>
<itemizedlist>
<listitem>
@ -296,8 +292,7 @@
</listitem>
<listitem>
<para>&#60;correct any errors found by check and check again&#62;
</para>
<para>&#60;correct any errors found by check and check again&#62;</para>
</listitem>
<listitem>
@ -306,9 +301,9 @@
</itemizedlist>
<para>If the configuration starts but doesn&#39;t work, just
&#34;shorewall restart&#34; to restore the old configuration. If the new
configuration fails to start, the &#34;try&#34; command will automatically
start the old one for you.</para>
<quote>shorewall restart</quote> to restore the old configuration. If the
new configuration fails to start, the <quote>try</quote> command will
automatically start the old one for you.</para>
<para>When the new configuration works then just:</para>
@ -330,9 +325,10 @@
align="center" fileref="images/State_Diagram.png" /></para>
<para>You will note that the commands that result in state transitions use
the word &#34;firewall&#34; rather than &#34;shorewall&#34;. That is
because the actual transitions are done by /usr/share/shorewall/firewall;
/sbin/shorewall runs &#39;firewall&#34; according to the following table:</para>
the word <quote>firewall</quote> rather than <quote>shorewall</quote>.
That is because the actual transitions are done by
/usr/share/shorewall/firewall; /sbin/shorewall runs <quote>firewall</quote>
according to the following table:</para>
<informaltable>
<tgroup cols="3">
@ -375,8 +371,7 @@
<entry>firewall restart</entry>
<entry>Logically equivalent to &#34;firewall stop;firewall
start&#34;</entry>
<entry>Logically equivalent to <quote>firewall stop;firewall start</quote></entry>
</row>
<row>