diff --git a/Shorewall/compiler b/Shorewall/compiler index 1ae946c4d..e97055370 100755 --- a/Shorewall/compiler +++ b/Shorewall/compiler @@ -395,7 +395,7 @@ ensurenatchain() # $1 = chain name } # -# Add a rule to a nat chain creating the chain if necessary%attr(0444,root,root) /usr/share/shorewall/lib.accounting +# Add a rule to a nat chain creating the chain if necessary # addnatrule() # $1 = chain name, remainder of arguments specify the rule @@ -4656,6 +4656,11 @@ __EOF__ setpolicy() { \$IPTABLES -P \$1 \$2 } +__EOF__ + + compile_stop_firewall + + cat >&3 << __EOF__ # # Remove all Shorewall-added rules diff --git a/Shorewall/lib.config b/Shorewall/lib.config index ce6073817..cab5147b6 100644 --- a/Shorewall/lib.config +++ b/Shorewall/lib.config @@ -21,8 +21,8 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA # -# This library contains the code common to /usr/share/shorewall/compiler and -# /usr/share/shorewall/firewall +# This library contains the configuration file parsing code common to +# /usr/share/shorewall/compiler and /usr/share/shorewall/firewall # # diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index 4bdfa8e91..8b4a3f6ad 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -80,7 +80,7 @@ Migration Considerations: b) Now that we have modularized action processing (see the New Features section below), we need a way to define default rules - for a policy. + for a policy that does not involve actions. If you have not overridden the defaults using entries in /etc/shorewall/actions then you need make no changes to migrate to @@ -166,8 +166,9 @@ New Features: a) All DROP policies must use the same default action and all REJECT policies must use the same default action. - b) Now that we have modularized action processing, we need a way to - define default rules for a policy. + b) Now that we have modularized action processing (see the New + Features section below), we need a way to define default rules + for a policy that does not involve actions. The solution is two-fold: @@ -212,9 +213,8 @@ New Features: of the following: a) The word "None" or "none". This causes any default - action define in /etc/shorewall/actions.std or - /etc/shorewall/actions to be omitted for this - policy. + action defined in /etc/shorewall/shorewall.conf + to be omitted for this policy. b) The name of an action (requires that USE_ACTIONS=Yes in shorewall.conf). That action will be invoked before the policy is enforced. @@ -227,8 +227,8 @@ New Features: #SOURCE DEST POLICY LOG # LEVEL loc net ACCEPT - net all DROP:Drop info + net all DROP:MyDrop info # # THE FOLLOWING POLICY MUST BE LAST # - all all REJECT:Reject info + all all REJECT:MyReject info