diff --git a/Shorewall-docs/whitelisting_under_shorewall.xml b/Shorewall-docs/whitelisting_under_shorewall.xml
index 737718047..52099a9b7 100644
--- a/Shorewall-docs/whitelisting_under_shorewall.xml
+++ b/Shorewall-docs/whitelisting_under_shorewall.xml
@@ -63,335 +63,323 @@
The basic approach will be that we will place the operations staff's class C in its own zone called ops. Here are the appropriate configuration files:
-
- Zone File
-
-
-
-
- ZONE
- DISPLAY
- COMMENTS
-
-
-
-
-
- net
-
- Net
- Internet
-
-
-
- ops
-
- Operations
- Operations Staff's Class C
-
-
-
- loc
-
- Local
- Local Class B
-
-
-
- dmz
-
- DMZ
- Demilitarized zone
-
-
-
-
-
+ Zone File
+
+
+
+
+ ZONE
+ DISPLAY
+ COMMENTS
+
+
+
+
+
+ net
+
+ Net
+ Internet
+
+
+
+ ops
+
+ Operations
+ Operations Staff's Class C
+
+
+
+ loc
+
+ Local
+ Local Class B
+
+
+
+ dmz
+
+ DMZ
+ Demilitarized zone
+
+
+
+
+
The ops zone has been added to the standard 3-zone zones
file -- since ops is a sub-zone of loc, we list it BEFORE
loc.
-
-
- Interfaces File
-
-
-
-
- ZONE
- INTERFACE
- BROADCAST
- OPTIONS
-
-
-
-
-
- net
-
-
- eth0
-
- <whatever>
- <options>
-
-
-
- dmz
-
-
- eth1
-
- <whatever>
-
-
-
-
- -
-
-
- eth2
-
-
- 10.10.255.255
-
-
-
-
-
-
-
+ Interfaces File
+
+
+
+
+ ZONE
+ INTERFACE
+ BROADCAST
+ OPTIONS
+
+
+
+
+
+ net
+
+
+ eth0
+
+ <whatever>
+ <options>
+
+
+
+ dmz
+
+
+ eth1
+
+ <whatever>
+
+
+
+
+ -
+
+
+ eth2
+
+
+ 10.10.255.255
+
+
+
+
+
+
+
Because eth2 interfaces to two zones (ops and loc), we don't specify a zone for it here.
-
-
- Hosts File
-
-
-
-
- ZONE
- HOST(S)
- OPTIONS
-
-
-
-
-
- ops
-
-
- eth2:10.10.10.0/24
-
-
-
-
-
- loc
-
-
- eth2:0.0.0.0/0
-
-
-
-
-
-
-
+ Hosts File
+
+
+
+
+ ZONE
+ HOST(S)
+ OPTIONS
+
+
+
+
+
+ ops
+
+
+ eth2:10.10.10.0/24
+
+
+
+
+
+ loc
+
+
+ eth2:0.0.0.0/0
+
+
+
+
+
+
+
Here we define the ops and loc zones. When Shorewall is stopped, only the hosts in the ops zone will be allowed to access the firewall and the DMZ. I use 0.0.0.0/0 to define the loc zone rather than 10.10.0.0/16 so that the limited broadcast address (255.255.255.255) falls into that zone. If I used 10.10.0.0/16 then I would have to have a separate entry for that special address.
-
-
- Policy File
-
-
-
-
- SOURCE
- DEST
- POLICY
- LOG LEVEL
- LIMIT BURST
-
-
-
-
-
+ Policy File
+
+
+
+
+ SOURCE
+ DEST
+ POLICY
+ LOG LEVEL
+ LIMIT BURST
+
+
+
+
+
-
- ops
-
-
-
-
- all
-
-
-
-
- ACCEPT
-
-
-
-
-
-
-
-
- all
-
-
-
-
- ops
-
-
-
-
- CONTINUE
-
-
-
-
-
-
-
- loc
-
-
- net
-
-
+
+ ops
+
+
+
+
+ all
+
+
+
+
ACCEPT
-
-
-
-
-
-
- net
-
-
+
+
+
+
+
+
+
+
all
-
-
- DROP
-
-
- info
-
-
-
-
-
- all
-
-
- all
-
-
- REJECT
-
-
- info
-
-
-
-
-
-
-
+
+
+
+
+ ops
+
+
+
+
+ CONTINUE
+
+
+
+
+
+
+
+ loc
+
+
+ net
+
+
+ ACCEPT
+
+
+
+
+
+
+ net
+
+
+ all
+
+
+ DROP
+
+
+ info
+
+
+
+
+
+ all
+
+
+ all
+
+
+ REJECT
+
+
+ info
+
+
+
+
+
+
+
Two entries for ops (in bold) have been added to the standard 3-zone policy file.
-
-
- Rules File
-
-
-
-
- ACTION
- SOURCE
- DEST
- PROTO
- DEST PORT(S)
- SOURCE PORT(S)
- ORIGINAL DEST
-
-
-
-
-
- REDIRECT
-
-
- loc!ops
-
-
- 3128
-
-
- tcp
-
-
- http
-
-
-
-
-
-
- ...
-
-
-
-
-
-
-
-
-
-
-
-
+ Rules File
+
+
+
+
+ ACTION
+ SOURCE
+ DEST
+ PROTO
+ DEST PORT(S)
+ SOURCE PORT(S)
+ ORIGINAL DEST
+
+
+
+
+
+ REDIRECT
+
+
+ loc!ops
+
+
+ 3128
+
+
+ tcp
+
+
+ http
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
This is the rule that transparently redirects web traffic to the transparent proxy running on the firewall. The SOURCE column explicitly excludes the ops zone from the rule.
-
-
- Routestopped File
-
-
-
-
- INTERFACE
- HOST(S))
-
-
-
-
-
- eth1
-
-
-
-
-
- eth2
-
-
- 10.10.10.0/24
-
-
-
-
-
-
+ Routestopped File
+
+
+
+
+ INTERFACE
+ HOST(S))
+
+
+
+
+
+ eth1
+
+
+
+
+
+ eth2
+
+
+ 10.10.10.0/24
+
+
+
+
+