diff --git a/docs/Macros.xml b/docs/Macros.xml index 37a8e722f..f32323fa8 100644 --- a/docs/Macros.xml +++ b/docs/Macros.xml @@ -465,6 +465,45 @@ ACCEPT fw loc tcp 135,139,445 action rule. + + ORIGINAL DEST (Shorewall-perl 4.2.0 and later) + + To use this column, you must include 'FORMAT 2' as the first + non-comment line in your macro file. + + If ACTION is DNAT[-] or REDIRECT[-] then if this column is + included and is different from the IP address given in the SERVER + column, then connections destined for that address will be forwarded + to the IP and port specified in the DEST column. + + A comma-separated list of addresses may also be used. This is + most useful with the REDIRECT target where you want to redirect + traffic destined for particular set of hosts. Finally, if the list of + addresses begins with "!" (exclusion) then the rule will be followed + only if the original destination address in the connection request + does not match any of the addresses listed. + + For other actions, this column may be included and may contain + one or more addresses (host or network) separated by commas. Address + ranges are not allowed. When this column is supplied, rules are + generated that require that the original destination address matches + one of the listed addresses. This feature is most useful when you want + to generate a filter rule that corresponds to a DNAT- or REDIRECT- + rule. In this usage, the list of addresses should not begin with + "!". + + It is also possible to specify a set of addresses then exclude + part of those addresses. For example, 192.168.1.0/24!192.168.1.16/28 + specifies the addresses 192.168.1.0-182.168.1.15 and + 192.168.1.32-192.168.1.255. See shorewall-exclusion(5). + + See http://shorewall.net/PortKnocking.html + for an example of using an entry in this column with a user-defined + action rule. + + RATE LIMIT - You may rate-limit the rule by placing a value in this column: