diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml index 821cec93e..da47e9ad7 100644 --- a/docs/configuration_file_basics.xml +++ b/docs/configuration_file_basics.xml @@ -88,11 +88,6 @@ Translation (SNAT). - - /etc/shorewall/modules - directs the - firewall to load kernel modules. - - /etc/shorewall/rules - defines rules that are exceptions to the overall policies established in @@ -219,14 +214,20 @@ macros defined by Shorewall. + + /usr/share/shorewall/modules - directs + the firewall to load kernel modules. + + /usr/share/modules — Specifies the kernel - modules to be loaded during shorewall start/restart . If you need to change this file, copy it to - /etc/shorewall and modify the - copy. + modules to be loaded during shorewall start/restart . . + + If you need to change a file in + /usr/share/shorewall/, copy it to /etc/shorewall and + modify the copy
@@ -976,30 +977,18 @@ DNAT net loc:192.168.1.3 tcp 4000:4100 In most cases where a port or port range may appear, a comma-separated list of ports or port ranges may also be entered. - Shorewall will use the Netfilter multiport match capability if it is available (see - the output of "shorewall show - capabilities") and if its use is appropriate. - - Shorewall can use multiport match if: - - - - The list contains 15 or fewer port number; and - - - - There are no port ranges listed OR your iptables/kernel support - the Extended multiport match (again - see the output of "shorewall show capabilities"). - Where the Extended multiport match is - available, each port range counts as two ports toward the maximum of - 15. - - + Shorewall requires the Netfilter multiport match capability if ports lists are used + (see the output of "shorewall show + capabilities"). Also, unless otherwise documented, a port list can be preceded by '!' to specify "All ports except these" (e.g., "!80,443"). + + Port lists appearing in the /etc/shorewall/routestopped + file may specify no more than 15 ports; port ranges appearing in a list + count as two ports each.