diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm index 515532bb8..6567fc80c 100644 --- a/Shorewall/Perl/Shorewall/Rules.pm +++ b/Shorewall/Perl/Shorewall/Rules.pm @@ -379,24 +379,24 @@ sub process_routestopped() { my $desti = match_dest_dev $interface; my $rule = shift @rule; - add_rule $filter_table->{INPUT}, "$sourcei $source $rule -j ACCEPT"; - add_rule $filter_table->{OUTPUT}, "$desti $dest $rule -j ACCEPT" unless $config{ADMINISABSENTMINDED}; + add_rule $filter_table->{INPUT}, "$sourcei $source $rule -j ACCEPT", 1; + add_rule $filter_table->{OUTPUT}, "$desti $dest $rule -j ACCEPT", 1 unless $config{ADMINISABSENTMINDED}; my $matched = 0; if ( $source{$host} ) { - add_rule $filter_table->{FORWARD}, "$sourcei $source $rule -j ACCEPT"; + add_rule $filter_table->{FORWARD}, "$sourcei $source $rule -j ACCEPT", 1; $matched = 1; } if ( $dest{$host} ) { - add_rule $filter_table->{FORWARD}, "$desti $dest $rule -j ACCEPT"; + add_rule $filter_table->{FORWARD}, "$desti $dest $rule -j ACCEPT", 1; $matched = 1; } if ( $notrack{$host} ) { - add_rule $raw_table->{PREROUTING}, "$sourcei $source $rule -j NOTRACK"; - add_rule $raw_table->{OUTPUT}, "$desti $dest $rule -j NOTRACK"; + add_rule $raw_table->{PREROUTING}, "$sourcei $source $rule -j NOTRACK", 1; + add_rule $raw_table->{OUTPUT}, "$desti $dest $rule -j NOTRACK", 1; } unless ( $matched ) { @@ -405,7 +405,7 @@ sub process_routestopped() { my ( $interface1, $h1 , $seq1 ) = split /\|/, $host1; my $dest1 = match_dest_net $h1; my $desti1 = match_dest_dev $interface1; - add_rule $filter_table->{FORWARD}, "$sourcei $desti1 $source $dest1 $rule -j ACCEPT"; + add_rule $filter_table->{FORWARD}, "$sourcei $desti1 $source $dest1 $rule -j ACCEPT", 1; clearrule; } } diff --git a/Shorewall/changelog.txt b/Shorewall/changelog.txt index b036c5883..6a70a1a91 100644 --- a/Shorewall/changelog.txt +++ b/Shorewall/changelog.txt @@ -6,6 +6,8 @@ Changes in Shorewall 4.4.4 3) Add logrotate scripts. +4) Allow long port lists in /etc/shorewall/routestopped. + Changes in Shorewall 4.4.3 1) Move Debian INITLOG initialization to /etc/default/shorewall diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index 5f2680239..b165d0e35 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -204,6 +204,9 @@ None. while the RPMs do not depend on the logrotate package, RPM installation will produce an error message if that package is not installed. +2) The limit of 15 entries in a port list has been relaxed in + /etc/shorewall/routestopped. + ---------------------------------------------------------------------------- N E W F E A T U R E S I N 4 . 4 . 0 ---------------------------------------------------------------------------- diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml index 06c555a1c..2f94827b3 100644 --- a/docs/configuration_file_basics.xml +++ b/docs/configuration_file_basics.xml @@ -1060,7 +1060,7 @@ DNAT net loc:192.168.1.3 tcp 4000:4100 Also, unless otherwise documented, a port list can be preceded by '!' to specify "All ports except these" (e.g., "!80,443"). - Port lists appearing in the Prior to Shorewall 4.4.4, port lists appearing in the /etc/shorewall/routestopped file may specify no more than 15 ports; port ranges appearing in a list count as two ports each.