diff --git a/manpages/shorewall-hosts.xml b/manpages/shorewall-hosts.xml index de090cad7..52593acc8 100644 --- a/manpages/shorewall-hosts.xml +++ b/manpages/shorewall-hosts.xml @@ -96,24 +96,6 @@ The name of an ipset. - - Examples: - - - eth1:192.168.1.3 - - eth2:192.168.2.0/24 - - eth3:192.168.2.0/24,192.168.3.1 - - br0:eth4 - - br0:eth0:192.168.1.16/28 - - eth4:192.168.1.44-192.168.1.49 - - eth2:+Admin - diff --git a/manpages/shorewall-policy.xml b/manpages/shorewall-policy.xml index 34fecdd85..92854a6ce 100644 --- a/manpages/shorewall-policy.xml +++ b/manpages/shorewall-policy.xml @@ -110,6 +110,29 @@ For TCP, send RST. For all other, send an "unreachable" ICMP. + + If the policy is DROP or REJECT then the policy may be + followed by ":" and one of the following: + + + + The word "None" or "none". This causes any default + action defined in /etc/shorewall/shorewall.conf to be + omitted for this policy. + + + + The name of an action (requires that USE_ACTIONS=Yes + in shorewall.conf). That action will be invoked before the + policy is enforced. + + + + The name of a macro. The rules in that macro will be + applied before the policy is enforced. This does not + require USE_ACTIONS=Yes. + + @@ -139,29 +162,6 @@ - - If the policy is DROP or REJECT then the policy may be - followed by ":" and one of the following: - - - - The word "None" or "none". This causes any default action - defined in /etc/shorewall/shorewall.conf to be omitted for this - policy. - - - - The name of an action (requires that USE_ACTIONS=Yes in - shorewall.conf). That action will be invoked before the policy - is enforced. - - - - The name of a macro. The rules in that macro will be - applied before the policy is enforced. This does not require - USE_ACTIONS=Yes. - - diff --git a/manpages/shorewall-route_rules.xml b/manpages/shorewall-route_rules.xml index aca2bc890..9a0d43dc0 100644 --- a/manpages/shorewall-route_rules.xml +++ b/manpages/shorewall-route_rules.xml @@ -77,7 +77,9 @@ The rule's numeric priority which - determines the order in which the rules are processed. + determines the order in which the rules are processed. Rules with + equal priority are applied in the order in which they appear in the + file. @@ -106,9 +108,6 @@ - - Rules with equal priority are applied in the order in which - they appear in the file. diff --git a/manpages/shorewall-rules.xml b/manpages/shorewall-rules.xml index a4932fd14..0a3b9413f 100644 --- a/manpages/shorewall-rules.xml +++ b/manpages/shorewall-rules.xml @@ -318,48 +318,52 @@ parameter. Example: FTP/ACCEPT. + + - The ACTION may optionally be - followed by ":" and a syslog log level (e.g, REJECT:info or - DNAT:debug). This causes the packet to be logged at the specified - level. +
+ The ACTION may optionally + be followed by ":" and a syslog log level (e.g, REJECT:info or + DNAT:debug). This causes the packet to be logged at the specified + level. - If the ACTION names an - action defined in shorewall-actions(5) or in - /usr/share/shorewall/actions.std then: + If the ACTION names an + action defined in shorewall-actions(5) or in + /usr/share/shorewall/actions.std then: - - - If the log level is followed by "!' then all rules in the - action are logged at the log level. - + + + If the log level is followed by "!' then all rules in + the action are logged at the log level. + - - If the log level is not followed by "!" then only those - rules in the action that do not specify logging are logged at - the specified level. - + + If the log level is not followed by "!" then only those + rules in the action that do not specify logging are logged at + the specified level. + - - The special log level 'none!' suppresses logging by the - action. - - + + The special log level 'none!' suppresses logging by the + action. + + - You may also specify ULOG (must be in upper case) as a log - level.This will log to the ULOG target for routing to a separate log - through use of ulogd - (http://www.gnumonks.org/projects/ulogd). + You may also specify ULOG (must be in upper case) as a log + level.This will log to the ULOG target for routing to a separate + log through use of ulogd + (http://www.gnumonks.org/projects/ulogd). - Actions specifying logging may be followed by a log tag (a - string of alphanumeric characters) are appended to the string - generated by the LOGPREFIX (in shorewall.conf(5)). + Actions specifying logging may be followed by a log tag (a + string of alphanumeric characters) are appended to the string + generated by the LOGPREFIX (in shorewall.conf(5)). - Example: ACCEPT:info:ftp would include 'ftp ' at the end of - the log prefix generated by the LOGPREFIX setting. + Example: ACCEPT:info:ftp would include 'ftp ' at the end of + the log prefix generated by the LOGPREFIX setting. +
@@ -458,12 +462,14 @@ - Alternatively, clients may be specified by interface by - appending ":" to the zone name followed by the interface name. For - example, loc:eth1 specifies a client that communicates with the - firewall system through eth1. This may be optionally followed by - another colon (":") and an IP/MAC/subnet address as described above - (e.g., loc:eth1:192.168.1.5). +
+ Alternatively, clients may be specified by interface by + appending ":" to the zone name followed by the interface name. For + example, loc:eth1 specifies a client that communicates with the + firewall system through eth1. This may be optionally followed by + another colon (":") and an IP/MAC/subnet address as described + above (e.g., loc:eth1:192.168.1.5). +
@@ -547,10 +553,12 @@ - if the ACTION is REDIRECT, this column needs only to contain - the port number on the firewall that the request should be - redirected to. +
+ if the ACTION is REDIRECT, this column needs only to contain + the port number on the firewall that the request should be + redirected to. +
@@ -631,21 +639,23 @@ wrong. - If you don't want to restrict client ports but need to specify - an ORIGINAL DEST in the next - column, then place "-" in this column. +
+ If you don't want to restrict client ports but need to + specify an ORIGINAL DEST in the + next column, then place "-" in this column. - If your kernel contains multi-port match support, then only a - single Netfilter rule will be generated if in this list and the - DEST PORT(S) list above: + If your kernel contains multi-port match support, then only + a single Netfilter rule will be generated if in this list and the + DEST PORT(S) list above: - 1. There are 15 or less ports listed. + 1. There are 15 or less ports listed. - 2. No port ranges are included or your kernel and iptables - contain extended multiport match support. + 2. No port ranges are included or your kernel and iptables + contain extended multiport match support. - Otherwise, a separate rule will be generated for each - port. + Otherwise, a separate rule will be generated for each + port. +