forked from extern/shorewall_code
Shorewall 1.4.6 RC1
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@660 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
defe814ca5
commit
88e1eb7e4d
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
50
Shorewall-docs/Shorewall_Doesnt.html
Normal file
50
Shorewall-docs/Shorewall_Doesnt.html
Normal file
@ -0,0 +1,50 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
<title>What Shorewall Cannot Do</title>
|
||||
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
<small> </small><small>
|
||||
</small><small>
|
||||
</small><small>
|
||||
</small><small>
|
||||
</small> <small> </small>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"><small> </small>
|
||||
<h1 align="center"><small><font color="#ffffff">Some things that Shorewall
|
||||
<b>Cannot</b> Do</font></small></h1>
|
||||
<small> </small></td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<small><br>
|
||||
</small>Shorewall cannot:<br>
|
||||
|
||||
<ul>
|
||||
<li>Be used on a Linux System that is functioning as a Layer 2 Bridge</li>
|
||||
<li>Act as a "Personal Firewall" that allows internet access by application.</li>
|
||||
<li>Do content filtering -- better to use <a
|
||||
href="Shorewall_Squid_Usage.html">Squid</a> for that.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<br>
|
||||
<font size="2">Last updated 7/9/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
@ -1,141 +1,145 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Index</title>
|
||||
|
||||
<base target="main">
|
||||
|
||||
<base
|
||||
target="main">
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#4b017c" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm">Home</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_features.htm">Features</a></li>
|
||||
<li> <a
|
||||
<li><a href="Shorewall_Doesnt.html">What it Cannot Do</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
<li>
|
||||
<b><a href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
|
||||
<li> <a
|
||||
href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
<li> <b><a
|
||||
href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
|
||||
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
href="useful_links.html">Useful Links</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
</li>
|
||||
<li> <a
|
||||
href="troubleshoot.htm">Things to try if it doesn't work</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="support.htm">Getting help or Answers to Questions</a></li>
|
||||
<li><a href="http://lists.shorewall.net">Mailing Lists</a><a
|
||||
<li><a href="http://lists.shorewall.net">Mailing Lists</a><a
|
||||
href="http://lists.shorewall.net"> </a><br>
|
||||
</li>
|
||||
<li><a href="1.3"
|
||||
</li>
|
||||
<li><a href="1.3"
|
||||
target="_top">Shorewall 1.3 Site</a></li>
|
||||
<li><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall
|
||||
1.2 Site</a></li>
|
||||
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
<li><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall 1.2
|
||||
Site</a></li>
|
||||
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://germany.shorewall.net">Germany</a></li>
|
||||
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://france.shorewall.net">France</a></li>
|
||||
<li><a href="http://shorewall.syachile.cl"
|
||||
<li><a href="http://shorewall.syachile.cl"
|
||||
target="_top">Chile</a></li>
|
||||
<li><a href="http://shorewall.greshko.com"
|
||||
<li><a href="http://shorewall.greshko.com"
|
||||
target="_top">Taiwan</a></li>
|
||||
<li><a href="http://argentina.shorewall.net" target="_top">Argentina</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
<li><a href="http://argentina.shorewall.net" target="_top">Argentina</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
href="http://www.shorewall.net" target="_top">Washington State, USA</a><br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="News.htm">News Archive</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="quotes.htm">Quotes from Users</a></li>
|
||||
<li>GSLUG Presentation</li>
|
||||
|
||||
<li>GSLUG Presentation</li>
|
||||
|
||||
<ul>
|
||||
<li><a href="GSLUG.htm">HTML</a></li>
|
||||
<li><a href="GSLUG.ppt">PowerPoint</a><br>
|
||||
</li>
|
||||
|
||||
<li><a href="GSLUG.htm">HTML</a></li>
|
||||
<li><a href="GSLUG.ppt">PowerPoint</a><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shoreline.htm">About the Author</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001-2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,140 +1,144 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Index</title>
|
||||
|
||||
<base target="main">
|
||||
|
||||
<base target="main">
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#4b017c" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
height="90">
|
||||
|
||||
<h3 align="center"><font color="#ffffff">Shorewall</font></h3>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="100%"
|
||||
bgcolor="#ffffff">
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm">Home</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shorewall_features.htm">Features</a></li>
|
||||
<li> <a
|
||||
<li><a href="Shorewall_Doesnt.html">What it Cannot Do</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_prerequisites.htm">Requirements</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="download.htm">Download</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
<li>
|
||||
<b><a href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
|
||||
<li> <a
|
||||
href="Install.htm">Installation/Upgrade/</a><br>
|
||||
<a href="Install.htm">Configuration</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guides (HOWTOs)</a><br>
|
||||
</li>
|
||||
<li>
|
||||
<b><a href="shorewall_quickstart_guide.htm#Documentation">Documentation</a></b></li>
|
||||
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
<li> <a href="FAQ.htm">FAQs</a></li>
|
||||
<li><a
|
||||
href="useful_links.html">Useful Links</a><br>
|
||||
</li>
|
||||
<li> <a
|
||||
</li>
|
||||
<li> <a
|
||||
href="troubleshoot.htm">Things to try if it doesn't work</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="errata.htm">Errata</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="upgrade_issues.htm">Upgrade Issues</a></li>
|
||||
<li> <a
|
||||
href="support.htm">Getting help or Answers to Questions</a>
|
||||
</li>
|
||||
<li><a
|
||||
<li> <a
|
||||
href="support.htm">Getting help or Answers to Questions</a>
|
||||
</li>
|
||||
<li><a
|
||||
href="http://lists.shorewall.net">Mailing Lists</a> <br>
|
||||
</li>
|
||||
<li><a href="1.3" target="_top">Shorewall 1.3 Site</a></li>
|
||||
<li><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall 1.2
|
||||
Site</a></li>
|
||||
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
</li>
|
||||
<li><a href="1.3" target="_top">Shorewall 1.3 Site</a></li>
|
||||
<li><a
|
||||
href="http://www1.shorewall.net/1.2/index.htm" target="_top">Shorewall
|
||||
1.2 Site</a></li>
|
||||
<li><a href="shorewall_mirrors.htm">Mirrors</a>
|
||||
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://slovakia.shorewall.net">Slovak Republic</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://shorewall.infohiiway.com">Texas, USA</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
target="_top" href="http://germany.shorewall.net">Germany</a></li>
|
||||
|
||||
<li><a target="_top"
|
||||
<li><a target="_top"
|
||||
href="http://france.shorewall.net">France</a></li>
|
||||
<li><a href="http://shorewall.syachile.cl"
|
||||
<li><a href="http://shorewall.syachile.cl"
|
||||
target="_top">Chile</a></li>
|
||||
<li><a href="http://shorewall.greshko.com"
|
||||
<li><a href="http://shorewall.greshko.com"
|
||||
target="_top">Taiwan</a></li>
|
||||
<li><a href="http://argentina.shorewall.net" target="_top">Argentina</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
<li><a href="http://argentina.shorewall.net" target="_top">Argentina</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
href="http://www.shorewall.net" target="_top">Washington State, USA</a><br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
|
||||
<ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="News.htm">News Archive</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="Shorewall_CVS_Access.html">CVS Repository</a></li>
|
||||
<li>GSLUG Presentation</li>
|
||||
|
||||
<li>GSLUG Presentation</li>
|
||||
|
||||
<ul>
|
||||
<li><a href="GSLUG.htm">HTML</a></li>
|
||||
<li><a href="GSLUG.ppt">PowerPoint</a><br>
|
||||
</li>
|
||||
|
||||
<li><a href="GSLUG.htm">HTML</a></li>
|
||||
<li><a href="GSLUG.ppt">PowerPoint</a><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="quotes.htm">Quotes from Users</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="shoreline.htm">About the Author</a></li>
|
||||
<li> <a
|
||||
<li> <a
|
||||
href="seattlefirewall_index.htm#Donations">Donations</a></li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001-2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,153 +1,146 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle"
|
||||
align="left">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle"
|
||||
align="left">
|
||||
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a></h1>
|
||||
<a
|
||||
</a></h1>
|
||||
<a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35" alt="">
|
||||
</a>
|
||||
|
||||
</a>
|
||||
|
||||
<p align="right"><font color="#ffffff"><b> </b></font><a
|
||||
href="http://razor.sourceforge.net/"><img src="images/razor.gif"
|
||||
alt="(Razor Logo)" width="100" height="22" align="left" border="0">
|
||||
</a> </p>
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
</a> </p>
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
||||
</td>
|
||||
<td valign="middle" width="33%">
|
||||
<a href="http://www.postfix.org/"> <img
|
||||
</td>
|
||||
<td valign="middle" width="33%">
|
||||
<a href="http://www.postfix.org/"> <img
|
||||
src="images/postfix-white.gif" align="right" border="0" width="158"
|
||||
height="84" alt="(Postfix Logo)">
|
||||
</a><br>
|
||||
|
||||
</a><br>
|
||||
|
||||
<div align="left"><a href="http://www.spamassassin.org"><img
|
||||
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
||||
border="0">
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
<div align="right"><b><font color="#ffffff"><br>
|
||||
</font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
Guide</a>.<br>
|
||||
</h1>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
</h1>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
|
||||
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tmeastep at
|
||||
hotmail dot com.</p>
|
||||
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tmeastep
|
||||
at hotmail dot com.</p>
|
||||
|
||||
<h2>A Word about the SPAM Filters at Shorewall.net <a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
<p>Please note that the mail server at shorewall.net checks
|
||||
incoming mail:<br>
|
||||
</p>
|
||||
|
||||
|
||||
<p>Please note that the mail server at shorewall.net
|
||||
checks incoming mail:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against <a
|
||||
<li>against <a
|
||||
href="http://spamassassin.org">Spamassassin</a> (including <a
|
||||
href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully
|
||||
qualified.</li>
|
||||
<li>to verify that the sender's domain has an
|
||||
A or MX record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO
|
||||
command is a valid fully-qualified DNS name that resolves.</li>
|
||||
<li>to ensure that the sending system has a valid PTR record in DNS.</li>
|
||||
|
||||
<li>to verify that the sender's domain has an
|
||||
A or MX record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO
|
||||
command is a valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
</ol>
|
||||
<big><font color="#cc0000"><b>This last point is important. If you run your
|
||||
own outgoing mail server and it doesn't have a valid DNS PTR record, your
|
||||
email won't reach the lists unless/until the postmaster notices that your
|
||||
posts are being rejected. To avoid this problem, you should configure your
|
||||
MTA to forward posts to shorewall.net through an MTA that <u>does</u> have
|
||||
a valid PTR record (such as the one at your ISP). </b></font></big><br>
|
||||
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
A growing number of MTAs serving list subscribers are
|
||||
rejecting all HTML traffic. At least one MTA has gone so far as to
|
||||
blacklist shorewall.net "for continuous abuse" because it has been my
|
||||
policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to
|
||||
control spam and that the ultimate losers here are not the spammers
|
||||
but the list subscribers whose MTAs are bouncing all shorewall.net
|
||||
mail. As one list subscriber wrote to me privately "These e-mail admin's
|
||||
need to get a <i>(explitive deleted)</i> life instead of trying to rid
|
||||
the planet of HTML based e-mail". Nevertheless, to allow subscribers
|
||||
to receive list posts as must as possible, I have now configured the
|
||||
list server at shorewall.net to strip all HTML from outgoing posts.
|
||||
This means that HTML-only posts will be bounced by the list server.<br>
|
||||
|
||||
A growing number of MTAs serving list subscribers are
|
||||
rejecting all HTML traffic. At least one MTA has gone so far as
|
||||
to blacklist shorewall.net "for continuous abuse" because it has been
|
||||
my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to
|
||||
control spam and that the ultimate losers here are not the spammers
|
||||
but the list subscribers whose MTAs are bouncing all shorewall.net
|
||||
mail. As one list subscriber wrote to me privately "These e-mail admin's
|
||||
need to get a <i>(explitive deleted)</i> life instead of trying to rid
|
||||
the planet of HTML based e-mail". Nevertheless, to allow subscribers to
|
||||
receive list posts as must as possible, I have now configured the list
|
||||
server at shorewall.net to strip all HTML from outgoing posts. This
|
||||
means that HTML-only posts will be bounced by the list server.<br>
|
||||
|
||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post,
|
||||
your e-mail admin may be blocking mail whose <i>Received:</i> headers
|
||||
contain the names of certain ISPs. Again, I believe that such policies
|
||||
hurt more than they help but I'm not prepared to go so far as to start
|
||||
stripping <i>Received:</i> headers to circumvent those policies.<br>
|
||||
|
||||
If you find that you are missing an occasional list post,
|
||||
your e-mail admin may be blocking mail whose <i>Received:</i> headers
|
||||
contain the names of certain ISPs. Again, I believe that such policies
|
||||
hurt more than they help but I'm not prepared to go so far as to start
|
||||
stripping <i>Received:</i> headers to circumvent those policies.<br>
|
||||
|
||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -156,149 +149,150 @@ This means that HTML-only posts will be bounced by the list server.<br>
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
</font> <input type="hidden"
|
||||
name="config" value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30"
|
||||
Search: <input type="text" size="30"
|
||||
name="words" value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
||||
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
||||
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued
|
||||
by Shoreline Firewall (such as the one used on my web site),
|
||||
you may <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates
|
||||
then you can either use unencrypted access when subscribing to
|
||||
Shorewall mailing lists or you can use secure access (SSL) and
|
||||
accept the server's certificate when prompted by your browser.<br>
|
||||
|
||||
If you want to trust X.509 certificates issued
|
||||
by Shoreline Firewall (such as the one used on my web site), you
|
||||
may <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates
|
||||
then you can either use unencrypted access when subscribing to Shorewall
|
||||
mailing lists or you can use secure access (SSL) and accept the
|
||||
server's certificate when prompted by your browser.<br>
|
||||
|
||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information
|
||||
of general interest to the Shorewall user community is also
|
||||
posted to this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="http://www.shorewall.net/support.htm">problem
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information
|
||||
of general interest to the Shorewall user community is also posted
|
||||
to this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="http://www.shorewall.net/support.htm">problem
|
||||
reporting guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
list may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for
|
||||
coordinating ongoing Shorewall Development.</p>
|
||||
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
||||
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
||||
may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for
|
||||
coordinating ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p align="left"> To post to the list, post to <a
|
||||
href="mailto:shorewall-devel@lists.shorewall.net">shorewall-devel@lists.shorewall.net</a>. </p>
|
||||
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-devel">http://lists.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
the Mailing Lists</h2>
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted
|
||||
to make this less confusing. To unsubscribe:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
<li>
|
||||
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get
|
||||
a password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options"
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get
|
||||
a password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options"
|
||||
button.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be
|
||||
emailed to you.</p>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
|
||||
<hr>
|
||||
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
||||
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 6/14/2003 - <a
|
||||
|
||||
<p align="left"><font size="2">Last updated 7/7/2003 - <a
|
||||
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -2,191 +2,189 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>ICMP Echo-request (Ping)</title>
|
||||
|
||||
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
Shorewall 'Ping' management has evolved over time with the latest change
|
||||
coming in Shorewall version 1.4.0. <br>
|
||||
|
||||
<h2>Shorewall Versions >= 1.4.0</h2>
|
||||
In Shoreall 1.4.0 and later version, ICMP echo-request's are treated just
|
||||
like any other connection request.<br>
|
||||
<br>
|
||||
In order to accept ping requests from zone z1 to zone z2 where the policy
|
||||
for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the
|
||||
form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
already exist and in that file place the following command:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||
you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
<h2>Shorewall Versions >= 1.3.14 and < 1.4.0 with OLD_PING_HANDLING=No
|
||||
in /etc/shorewall/shorewall.conf</h2>
|
||||
In 1.3.14, Ping handling was put under control of the rules and policies
|
||||
just like any other connection request. In order to accept ping requests
|
||||
from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you
|
||||
need a rule in /etc/shoreall/rules of the form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
already exist and in that file place the following command:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2 then
|
||||
you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
|
||||
</h2>
|
||||
There are several aspects to the old Shorewall Ping management:<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
||||
<li>The <b>FORWARDPING</b> option in<a
|
||||
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
||||
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ol>
|
||||
There are two cases to consider:<br>
|
||||
|
||||
<ol>
|
||||
<li>Ping requests addressed to the firewall itself; and</li>
|
||||
<li>Ping requests being forwarded to another system. Included here
|
||||
are all cases of packet forwarding including NAT, DNAT rule, Proxy ARP and
|
||||
simple routing.</li>
|
||||
|
||||
</ol>
|
||||
These cases will be covered separately.<br>
|
||||
|
||||
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
||||
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
||||
|
||||
<ol>
|
||||
<li>If neither <b>noping</b> nor <b>filterping </b>are specified for
|
||||
the interface that receives the ping request then the request will be responded
|
||||
to with an ICMP echo-reply.</li>
|
||||
<li>If <b>noping</b> is specified for the interface that receives
|
||||
the ping request then the request is ignored.</li>
|
||||
<li>If <b>filterping </b>is specified for the interface then the request
|
||||
is passed to the rules/policy evaluation.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3>Ping Requests Forwarded by the Firewall</h3>
|
||||
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
||||
|
||||
<h3>Rules Evaluation</h3>
|
||||
Ping requests are ICMP type 8. So the general rule format is:<br>
|
||||
<br>
|
||||
<i>Target Source
|
||||
Destination </i>icmp 8<br>
|
||||
<br>
|
||||
Example 1. Accept pings from the net to the dmz (pings are responded
|
||||
to with an ICMP echo-reply):<br>
|
||||
<br>
|
||||
ACCEPT net dmz
|
||||
icmp 8<br>
|
||||
<br>
|
||||
Example 2. Drop pings from the net to the firewall<br>
|
||||
<br>
|
||||
DROP net fw
|
||||
icmp 8<br>
|
||||
|
||||
<h3>Policy Evaluation</h3>
|
||||
If no applicable rule is found, then the policy for the source to the
|
||||
destination is applied.<br>
|
||||
|
||||
<ol>
|
||||
<li>If the relevant policy is ACCEPT then the request is responded
|
||||
to with an ICMP echo-reply.</li>
|
||||
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
||||
then the request is responded to with an ICMP echo-reply.</li>
|
||||
<li>Otherwise, the relevant REJECT or DROP policy is used and the
|
||||
request is either rejected or simply ignored.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><font size="2">Updated 5/4/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
Shorewall 'Ping' management has evolved over time with the latest change
|
||||
coming in Shorewall version 1.4.0. To find out which version of Shorewall
|
||||
you are running, at a shell prompt type "<font color="#009900"><b>/sbin/shorewall
|
||||
version</b></font>". If that command gives you an error, it's time to upgrade
|
||||
since you have a very old version of Shorewall installed (1.2.4 or earlier).<br>
|
||||
|
||||
<h2>Shorewall Versions >= 1.4.0</h2>
|
||||
In Shoreall 1.4.0 and later version, ICMP echo-request's are treated just
|
||||
like any other connection request.<br>
|
||||
<br>
|
||||
In order to accept ping requests from zone z1 to zone z2 where the policy
|
||||
for z1 to z2 is not ACCEPT, you need a rule in /etc/shoreall/rules of the
|
||||
form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
already exist and in that file place the following command:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2
|
||||
then you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
<h2>Shorewall Versions >= 1.3.14 and < 1.4.0 with OLD_PING_HANDLING=No
|
||||
in /etc/shorewall/shorewall.conf</h2>
|
||||
In 1.3.14, Ping handling was put under control of the rules and policies
|
||||
just like any other connection request. In order to accept ping requests
|
||||
from zone z1 to zone z2 where the policy for z1 to z2 is not ACCEPT, you
|
||||
need a rule in /etc/shoreall/rules of the form:<br>
|
||||
|
||||
<blockquote>ACCEPT <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example: <br>
|
||||
<br>
|
||||
To permit ping from the local zone to the firewall:<br>
|
||||
|
||||
<blockquote>ACCEPT loc fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
If you would like to accept 'ping' by default even when the relevant
|
||||
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it doesn't
|
||||
already exist and in that file place the following command:<br>
|
||||
|
||||
<blockquote>
|
||||
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
||||
</blockquote>
|
||||
With that rule in place, if you want to ignore 'ping' from z1 to z2
|
||||
then you need a rule of the form:<br>
|
||||
|
||||
<blockquote>DROP <i>z1 z2
|
||||
</i>icmp 8<br>
|
||||
</blockquote>
|
||||
Example:<br>
|
||||
<br>
|
||||
To drop ping from the internet, you would need this rule in /etc/shorewall/rules:<br>
|
||||
|
||||
<blockquote>DROP net fw
|
||||
icmp 8<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> </blockquote>
|
||||
|
||||
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf<br>
|
||||
</h2>
|
||||
There are several aspects to the old Shorewall Ping management:<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>noping</b> and <b>filterping </b>interface options in
|
||||
<a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
||||
<li>The <b>FORWARDPING</b> option in<a
|
||||
href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
||||
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
||||
|
||||
</ol>
|
||||
There are two cases to consider:<br>
|
||||
|
||||
<ol>
|
||||
<li>Ping requests addressed to the firewall itself; and</li>
|
||||
<li>Ping requests being forwarded to another system. Included here
|
||||
are all cases of packet forwarding including NAT, DNAT rule, Proxy ARP
|
||||
and simple routing.</li>
|
||||
|
||||
</ol>
|
||||
These cases will be covered separately.<br>
|
||||
|
||||
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
||||
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
||||
|
||||
<ol>
|
||||
<li>If neither <b>noping</b> nor <b>filterping </b>are specified
|
||||
for the interface that receives the ping request then the request will
|
||||
be responded to with an ICMP echo-reply.</li>
|
||||
<li>If <b>noping</b> is specified for the interface that receives
|
||||
the ping request then the request is ignored.</li>
|
||||
<li>If <b>filterping </b>is specified for the interface then the
|
||||
request is passed to the rules/policy evaluation.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<h3>Ping Requests Forwarded by the Firewall</h3>
|
||||
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
||||
|
||||
<h3>Rules Evaluation</h3>
|
||||
Ping requests are ICMP type 8. So the general rule format is:<br>
|
||||
<br>
|
||||
<i>Target Source
|
||||
Destination </i>icmp 8<br>
|
||||
<br>
|
||||
Example 1. Accept pings from the net to the dmz (pings are responded
|
||||
to with an ICMP echo-reply):<br>
|
||||
<br>
|
||||
ACCEPT net dmz
|
||||
icmp 8<br>
|
||||
<br>
|
||||
Example 2. Drop pings from the net to the firewall<br>
|
||||
<br>
|
||||
DROP net fw
|
||||
icmp 8<br>
|
||||
|
||||
<h3>Policy Evaluation</h3>
|
||||
If no applicable rule is found, then the policy for the source to the
|
||||
destination is applied.<br>
|
||||
|
||||
<ol>
|
||||
<li>If the relevant policy is ACCEPT then the request is responded
|
||||
to with an ICMP echo-reply.</li>
|
||||
<li>If <b>FORWARDPING</b> is set to Yes in /etc/shorewall/shorewall.conf
|
||||
then the request is responded to with an ICMP echo-reply.</li>
|
||||
<li>Otherwise, the relevant REJECT or DROP policy is used and the
|
||||
request is either rejected or simply ignored.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><font size="2">Updated 7/7/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -3,111 +3,111 @@
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="33%" height="90" valign="middle"
|
||||
<td width="33%" height="90" valign="middle"
|
||||
align="left"><a href="http://www.cityofshoreline.com"><img
|
||||
src="images/washington.jpg" alt="" width="97" height="80" hspace="4"
|
||||
border="0">
|
||||
</a></td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
</a></td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff">Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i></h1>
|
||||
</td>
|
||||
<td valign="middle">
|
||||
|
||||
</td>
|
||||
<td valign="middle">
|
||||
|
||||
<h1 align="center"><a href="http://www.shorewall.net"
|
||||
target="_top"><img border="0" src="images/shorewall.jpg" width="119"
|
||||
height="38" hspace="4" alt="(Shorewall Logo)" align="right" vspace="4">
|
||||
</a></h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
</a></h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is a
|
||||
<a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
|
||||
that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
|
||||
it under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
it under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
This program is distributed in
|
||||
the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even
|
||||
the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
|
||||
This program is distributed in
|
||||
the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the
|
||||
implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
General Public License for more details.<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
|
||||
You should have received a copy
|
||||
of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
You should have received a copy
|
||||
of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
@ -117,384 +117,409 @@ General Public License for more details.<br>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
New to Shorewall? Start by selecting the
|
||||
<a href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that
|
||||
most closely match your environment and follow the step by
|
||||
step instructions.<br>
|
||||
|
||||
<h2>Looking for Information?</h2>
|
||||
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a> is a good place to start as is the Quick Search to your right.
|
||||
|
||||
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a> is a good place to start as is the Quick Search to your right.
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, the documentation<b> </b>on this site will not
|
||||
apply directly to your setup. If you want to use the documentation
|
||||
that you find here, you will want to consider uninstalling what you have
|
||||
and installing a setup that matches the documentation on this site.
|
||||
See the <a href="two-interface.htm">Two-interface QuickStart Guide</a>
|
||||
If so, the documentation<b> </b>on this site will not
|
||||
apply directly to your setup. If you want to use the documentation
|
||||
that you find here, you will want to consider uninstalling what you have
|
||||
and installing a setup that matches the documentation on this site.
|
||||
See the <a href="two-interface.htm">Two-interface QuickStart Guide</a>
|
||||
for details.<br>
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>7/7/2003 - Shorewall-1.4.6 Beta 2</b><b> <img border="0"
|
||||
|
||||
<p><b>7/15/2003 - Shorewall-1.4.6 RC 1</b><b> <img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
<br>
|
||||
</b></p>
|
||||
</b></p>
|
||||
<blockquote>
|
||||
<p><b><a href="http://shorewall.net/pub/shorewall/testing">http://shorewall.net/pub/shorewall/testing</a><br>
|
||||
<a href="ftp://shorewall.net/pub/shorewall/testing"
|
||||
target="_top">ftp://shorewall.net/pub/shorewall/testing</a><br>
|
||||
</b></p>
|
||||
</blockquote>
|
||||
|
||||
<p><b>Problems Corrected:</b><br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>A problem seen on RH7.3 systems where Shorewall encountered start
|
||||
errors when started using the "service" mechanism has been worked around.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Where a list of IP addresses appears in the DEST column of a
|
||||
DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the nat
|
||||
table (one for each element in the list). Shorewall now correctly creates
|
||||
<li>A problem seen on RH7.3 systems where Shorewall encountered
|
||||
start errors when started using the "service" mechanism has been worked
|
||||
around.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Where a list of IP addresses appears in the DEST column of a
|
||||
DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the nat
|
||||
table (one for each element in the list). Shorewall now correctly creates
|
||||
a single DNAT rule with multiple "--to-destination" clauses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Corrected a problem in Beta 1 where DNS names containing a "-"
|
||||
<br>
|
||||
</li>
|
||||
<li>Corrected a problem in Beta 1 where DNS names containing a "-"
|
||||
were mis-handled when they appeared in the DEST column of a rule.<br>
|
||||
</li>
|
||||
<br>
|
||||
</li>
|
||||
<li>A number of problems with rule parsing have been corrected. Corrections
|
||||
involve the handling of "z1!z2" in the SOURCE column as well as lists in
|
||||
the ORIGINAL DESTINATION column.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>Migration Issues:</b><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>In earlier versions, an undocumented feature allowed entries
|
||||
in the host file as follows:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
|
||||
<br>
|
||||
This capability was never documented and has been removed in 1.4.6 to allow
|
||||
entries of the following format:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been
|
||||
removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically
|
||||
detected by Shorewall (see below).<br>
|
||||
</li>
|
||||
</ol>
|
||||
|
||||
<p><b>New Features:</b><br>
|
||||
</p>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>A 'newnotsyn' interface option has been added. This option may
|
||||
be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No
|
||||
for packets arriving on the associated interface.<br>
|
||||
<li>In earlier versions, an undocumented feature allowed entries
|
||||
in the host file as follows:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
|
||||
<br>
|
||||
This capability was never documented and has been removed in 1.4.6 to allow
|
||||
entries of the following format:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The means for specifying a range of IP addresses in /etc/shorewall/masq
|
||||
to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been
|
||||
removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically
|
||||
detected by Shorewall (see below).<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>New Features:</b><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>A 'newnotsyn' interface option has been added. This option may
|
||||
be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No
|
||||
for packets arriving on the associated interface.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The means for specifying a range of IP addresses in /etc/shorewall/masq
|
||||
to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address
|
||||
ranges.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Shorewall can now add IP addresses to subnets other than the
|
||||
<br>
|
||||
</li>
|
||||
<li>Shorewall can now add IP addresses to subnets other than the
|
||||
first one on an interface.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>DNAT[-] rules may now be used to load balance (round-robin)
|
||||
over a set of servers. Servers may be specified in a range of addresses
|
||||
given as <first address>-<last address>.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
|
||||
options have been removed and have been replaced by code that detects whether
|
||||
these capabilities are present in the current kernel. The output of the
|
||||
start, restart and check commands have been enhanced to report the outcome:<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for the Connection Tracking Match Extension has been
|
||||
added. This extension is available in recent kernel/iptables releases and
|
||||
allows for rules which match against elements in netfilter's connection tracking
|
||||
table. Shorewall automatically detects the availability of this extension
|
||||
and reports its availability in the output of the start, restart and check
|
||||
commands.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Connection Tracking Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
If this extension is available, the ruleset generated by Shorewall is
|
||||
changed in the following ways:</li>
|
||||
|
||||
<ul>
|
||||
<li>To handle 'norfc1918' filtering, Shorewall will not create
|
||||
chains in the mangle table but will rather do all 'norfc1918' filtering in
|
||||
the filter table (rfc1918 chain).</li>
|
||||
<li>Recall that Shorewall DNAT rules generate two netfilter rules;
|
||||
one in the nat table and one in the filter table. If the Connection Tracking
|
||||
Match Extension is available, the rule in the filter table is extended to
|
||||
check that the original destination address was the same as specified (or
|
||||
defaulted to) in the DNAT rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall)
|
||||
may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
|
||||
<br>
|
||||
ipcalc [ <address> <netmask> | <address>/<vlsm>
|
||||
]<br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
Warning:<br>
|
||||
<br>
|
||||
If your shell only supports 32-bit signed arithmatic (ash or dash), then
|
||||
the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1
|
||||
and for /1 networks. Bash should produce correct information for all valid
|
||||
IP addresses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>DNAT[-] rules may now be used to load balance (round-robin) over
|
||||
a set of servers. Servers may be specified in a range of addresses given
|
||||
as <first address>-<last address>.<br>
|
||||
<li>An 'iprange' command has been added to /sbin/shorewall. <br>
|
||||
<br>
|
||||
iprange <address>-<address><br>
|
||||
<br>
|
||||
This command decomposes a range of IP addressses into a list of network
|
||||
and host addresses. The command can be useful if you need to construct an
|
||||
efficient set of rules that accept connections from a range of network addresses.<br>
|
||||
<br>
|
||||
Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
|
||||
then the range may not span 128.0.0.0.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
|
||||
[root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
|
||||
192.168.1.4/30<br>
|
||||
192.168.1.8/29<br>
|
||||
192.168.1.16/28<br>
|
||||
192.168.1.32/27<br>
|
||||
192.168.1.64/26<br>
|
||||
192.168.1.128/25<br>
|
||||
192.168.2.0/23<br>
|
||||
192.168.4.0/22<br>
|
||||
192.168.8.0/22<br>
|
||||
192.168.12.0/29<br>
|
||||
192.168.12.8/31<br>
|
||||
[root@gateway root]#<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
|
||||
have been removed and have been replaced by code that detects whether these
|
||||
capabilities are present in the current kernel. The output of the start,
|
||||
restart and check commands have been enhanced to report the outcome:<br>
|
||||
<li>A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
foo eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
</li>
|
||||
<li>Support for the Connection Tracking Match Extension has been
|
||||
added. This extension is available in recent kernel/iptables releases and
|
||||
allows for rules which match against elements in netfilter's connection
|
||||
tracking table. Shorewall automatically detects the availability of this
|
||||
extension and reports its availability in the output of the start, restart
|
||||
and check commands.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Connection Tracking Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
If this extension is available, the ruleset generated by Shorewall is changed
|
||||
in the following ways:</li>
|
||||
<ul>
|
||||
<li>To handle 'norfc1918' filtering, Shorewall will not create
|
||||
chains in the mangle table but will rather do all 'norfc1918' filtering
|
||||
in the filter table (rfc1918 chain).</li>
|
||||
<li>Recall that Shorewall DNAT rules generate two netfilter rules;
|
||||
one in the nat table and one in the filter table. If the Connection Tracking
|
||||
Match Extension is available, the rule in the filter table is extended to
|
||||
check that the original destination address was the same as specified (or
|
||||
defaulted to) in the DNAT rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
</ul>
|
||||
<li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall)
|
||||
may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
|
||||
<br>
|
||||
ipcalc [ <address> <netmask> | <address>/<vlsm>
|
||||
]<br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
Warning:<br>
|
||||
<br>
|
||||
If your shell only supports 32-bit signed arithmatic (ash or dash), then
|
||||
the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1
|
||||
and for /1 networks. Bash should produce correct information for all valid
|
||||
IP addresses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'iprange' command has been added to /sbin/shorewall. <br>
|
||||
<br>
|
||||
iprange <address>-<address><br>
|
||||
<br>
|
||||
This command decomposes a range of IP addressses into a list of network
|
||||
and host addresses. The command can be useful if you need to construct an
|
||||
efficient set of rules that accept connections from a range of network addresses.<br>
|
||||
<br>
|
||||
Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
|
||||
then the range may not span 128.0.0.0.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
[root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
|
||||
192.168.1.4/30<br>
|
||||
192.168.1.8/29<br>
|
||||
192.168.1.16/28<br>
|
||||
192.168.1.32/27<br>
|
||||
192.168.1.64/26<br>
|
||||
192.168.1.128/25<br>
|
||||
192.168.2.0/23<br>
|
||||
192.168.4.0/22<br>
|
||||
192.168.8.0/22<br>
|
||||
192.168.12.0/29<br>
|
||||
192.168.12.8/31<br>
|
||||
[root@gateway root]#<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
foo eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>6/17/2003 - Shorewall-1.4.5</b><b> </b></p>
|
||||
|
||||
<p>Problems Corrected:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The command "shorewall debug try <directory>" now
|
||||
correctly traces the attempt.</li>
|
||||
<li>The INCLUDE directive now works properly in the zones
|
||||
file; previously, INCLUDE in that file was ignored.</li>
|
||||
<li>/etc/shorewall/routestopped records with an empty second
|
||||
column are no longer ignored.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>New Features:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule
|
||||
may now contain a list of addresses. If the list begins with "!' then
|
||||
the rule will take effect only if the original destination address in
|
||||
the connection request does not match any of the addresses listed.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b>
|
||||
</b></p>
|
||||
|
||||
<p>The firewall at shorewall.net has been upgraded to the 2.4.21 kernel
|
||||
and iptables 1.2.8 (using the "official" RPM from netfilter.org). No
|
||||
problems have been encountered with this set of software. The Shorewall
|
||||
version is 1.4.4b plus the accumulated changes for 1.4.5.<br>
|
||||
<p>Problems Corrected:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The command "shorewall debug try <directory>" now
|
||||
correctly traces the attempt.</li>
|
||||
<li>The INCLUDE directive now works properly in the zones
|
||||
file; previously, INCLUDE in that file was ignored.</li>
|
||||
<li>/etc/shorewall/routestopped records with an empty second
|
||||
column are no longer ignored.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p>New Features:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-]
|
||||
rule may now contain a list of addresses. If the list begins with "!'
|
||||
then the rule will take effect only if the original destination address
|
||||
in the connection request does not match any of the addresses listed.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b>
|
||||
</b></p>
|
||||
|
||||
<p>The firewall at shorewall.net has been upgraded to the 2.4.21 kernel
|
||||
and iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems
|
||||
have been encountered with this set of software. The Shorewall version
|
||||
is 1.4.4b plus the accumulated changes for 1.4.5.<br>
|
||||
</p>
|
||||
|
||||
<p><b>6/8/2003 - Updated Samples</b><b> </b></p>
|
||||
|
||||
<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
|
||||
version 1.4.4.</p>
|
||||
|
||||
<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
|
||||
version 1.4.4.</p>
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.4.2 and Kernel-2.4.20. You
|
||||
can find their work at: <a
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.4.2 and Kernel-2.4.20. You
|
||||
can find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
<b>Congratulations to Jacques and Eric on the recent
|
||||
release of Bering 1.2!!! </b><br>
|
||||
<b>Congratulations to Jacques and Eric on the
|
||||
recent release of Bering 1.2!!! </b><br>
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
valign="top" align="center">
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
valign="top" align="center">
|
||||
|
||||
|
||||
|
||||
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font
|
||||
color="#ffffff"><b>Note: </b></font></strong><font
|
||||
color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
||||
<strong></strong>
|
||||
|
||||
<strong></strong>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font
|
||||
<font
|
||||
face="Arial" size="-1"> <input type="text" name="words"
|
||||
size="15"></font><font size="-1"> </font> <font face="Arial"
|
||||
size="-1"> <input type="hidden" name="format" value="long"> <input
|
||||
type="hidden" name="method" value="and"> <input type="hidden"
|
||||
name="config" value="htdig"> <input type="submit" value="Search"></font>
|
||||
</p>
|
||||
<font
|
||||
name="config" value="htdig"> <input type="submit" value="Search"></font>
|
||||
</p>
|
||||
<font
|
||||
face="Arial"> <input type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><b><a
|
||||
href="http://lists.shorewall.net/htdig/search.html"><font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<br>
|
||||
</td>
|
||||
<br>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</center>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;"
|
||||
valign="middle">
|
||||
<td width="100%" style="margin-top: 1px;"
|
||||
valign="middle">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10" alt="(Starlight Logo)">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff"><br>
|
||||
<font size="+2"> Shorewall is free but if you try it
|
||||
and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></font></p>
|
||||
<font size="+2"> Shorewall is free but if you try
|
||||
it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></font></p>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><font size="2">Updated 7/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
|
||||
<p><font size="2">Updated 7/15/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,135 +1,137 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>About the Shorewall Author</title>
|
||||
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Tom Eastep</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="center"> <img border="3" src="images/Tom.jpg"
|
||||
alt="Tom - June 2003" width="640" height="480">
|
||||
</p>
|
||||
|
||||
alt="Aging Geek - June 2003" width="320" height="240">
|
||||
</p>
|
||||
|
||||
<p align="center">Tom -- June 2003<br>
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>Born 1945 in <a
|
||||
<li>Born 1945 in <a
|
||||
href="http://www.experiencewashington.com">Washington State</a> .</li>
|
||||
<li>BA Mathematics from <a
|
||||
<li>BA Mathematics from <a
|
||||
href="http://www.wsu.edu">Washington State University</a> 1967</li>
|
||||
<li>MA Mathematics from <a
|
||||
<li>MA Mathematics from <a
|
||||
href="http://www.washington.edu">University of Washington</a> 1969</li>
|
||||
<li>Burroughs Corporation (now <a
|
||||
<li>Burroughs Corporation (now <a
|
||||
href="http://www.unisys.com">Unisys</a> ) 1969 - 1980</li>
|
||||
<li><a href="http://www.tandem.com">Tandem Computers,
|
||||
Incorporated</a> (now part of the <a
|
||||
<li><a href="http://www.tandem.com">Tandem Computers,
|
||||
Incorporated</a> (now part of the <a
|
||||
href="http://www.hp.com">The New HP</a>) 1980 - present</li>
|
||||
<li>Married 1969 - no children.</li>
|
||||
|
||||
<li>Married 1969 - no children.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p>I am currently a member of the design team for the next-generation operating
|
||||
system from the NonStop Enterprise Division of HP. </p>
|
||||
|
||||
<p>I became interested in Internet Security when I established a home office
|
||||
in 1999 and had DSL service installed in our home. I investigated
|
||||
ipchains and developed the scripts which are now collectively known
|
||||
as <a href="http://seawall.sourceforge.net"> Seattle Firewall</a>.
|
||||
Expanding on what I learned from Seattle Firewall, I then
|
||||
designed and wrote Shorewall. </p>
|
||||
|
||||
|
||||
<p>I am currently a member of the design team for the next-generation operating
|
||||
system from the NonStop Enterprise Division of HP. </p>
|
||||
|
||||
<p>I became interested in Internet Security when I established a home office
|
||||
in 1999 and had DSL service installed in our home. I investigated
|
||||
ipchains and developed the scripts which are now collectively known
|
||||
as <a href="http://seawall.sourceforge.net"> Seattle Firewall</a>.
|
||||
Expanding on what I learned from Seattle Firewall, I then
|
||||
designed and wrote Shorewall. </p>
|
||||
|
||||
<p>I telework from our <a
|
||||
href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a> in <a
|
||||
href="http://www.cityofshoreline.com">Shoreline, Washington</a> where
|
||||
I live with my wife Tarry. </p>
|
||||
|
||||
href="http://www.cityofshoreline.com">Shoreline, Washington</a>
|
||||
where I live with my wife Tarry. </p>
|
||||
|
||||
<p>Our current home network consists of: </p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM,
|
||||
40GB & 20GB IDE HDs and LNE100TX (Tulip) NIC - My personal
|
||||
Windows system. Serves as a PPTP server for Road Warrior access. Dual
|
||||
boots <a href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
|
||||
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD,
|
||||
LNE100TX(Tulip) NIC - My personal Linux System which runs Samba.
|
||||
This system also has <a href="http://www.vmware.com/">VMware</a>
|
||||
installed and can run both <a href="http://www.debian.org">Debian
|
||||
Woody</a> and <a href="http://www.suse.com">SuSE 8.1</a> in virtual
|
||||
machines.</li>
|
||||
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100
|
||||
NIC - Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache),
|
||||
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM,
|
||||
40GB & 20GB IDE HDs and LNE100TX (Tulip) NIC - My personal
|
||||
Windows system. Serves as a PPTP server for Road Warrior access. Dual
|
||||
boots <a href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
|
||||
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD,
|
||||
LNE100TX(Tulip) NIC - My personal Linux System which runs
|
||||
Samba. This system also has <a href="http://www.vmware.com/">VMware</a>
|
||||
installed and can run both <a href="http://www.debian.org">Debian
|
||||
Woody</a> and <a href="http://www.suse.com">SuSE 8.1</a> in virtual
|
||||
machines.</li>
|
||||
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD,
|
||||
EEPRO100 NIC - Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache),
|
||||
FTP (Pure_ftpd), DNS server (Bind 9).</li>
|
||||
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD
|
||||
- 3 LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall
|
||||
1.4.4c, a DHCP server and Samba configured as a WINS server..</li>
|
||||
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
|
||||
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI
|
||||
HD - 3 LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall
|
||||
1.4.6Beta1, a DHCP server and Samba configured as a WINS server..</li>
|
||||
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
|
||||
NIC - My wife's personal system.</li>
|
||||
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB
|
||||
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB
|
||||
HD, built-in EEPRO100, EEPRO100 in expansion base - My work system.</li>
|
||||
<li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and
|
||||
<li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and
|
||||
LinkSys WET11 - Our Laptop.<br>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p>For more about our network see <a href="myfiles.htm">my Shorewall Configuration</a>.</p>
|
||||
|
||||
|
||||
<p>All of our other systems are made by <a
|
||||
href="http://www.compaq.com">Compaq</a> (part of the new <a
|
||||
href="http://www.hp.com/">HP</a>).. All of our Tulip NICs are <a
|
||||
href="http://www.netgear.com">Netgear</a> FA310TXs.</p>
|
||||
|
||||
|
||||
<p><a href="http://www.redhat.com"><img border="0"
|
||||
src="images/poweredby.png" width="88" height="31">
|
||||
</a><a href="http://www.compaq.com"><img
|
||||
</a><a href="http://www.compaq.com"><img
|
||||
border="0" src="images/poweredbycompaqlog0.gif" hspace="3" width="83"
|
||||
height="25">
|
||||
</a><a href="http://www.pureftpd.org"><img
|
||||
</a><a href="http://www.pureftpd.org"><img
|
||||
border="0" src="images/pure.jpg" width="88" height="31">
|
||||
</a><font size="4"><a
|
||||
</a><font size="4"><a
|
||||
href="http://www.apache.org"><img border="0"
|
||||
src="images/apache_pb1.gif" hspace="2" width="170" height="20">
|
||||
</a><a href="http://www.mandrakelinux.com"><img
|
||||
</a><a href="http://www.mandrakelinux.com"><img
|
||||
src="images/medbutton.png" alt="Powered by Mandrake" width="90"
|
||||
height="32">
|
||||
</a><img src="images/shorewall.jpg"
|
||||
</a><img src="images/shorewall.jpg"
|
||||
alt="Protected by Shorewall" width="125" height="40" hspace="4">
|
||||
<a href="http://www.opera.com"><img src="images/opera.png"
|
||||
<a href="http://www.opera.com"><img src="images/opera.png"
|
||||
alt="(Opera Logo)" width="102" height="39" border="0">
|
||||
</a> <a href="http://www.hp.com"><img
|
||||
</a> <a href="http://www.hp.com"><img
|
||||
src="images/penquin_in_blue_racer_sm2.gif" alt="" width="120"
|
||||
height="75" border="0">
|
||||
</a><a href="http://www.opera.com"> </a> </font></p>
|
||||
|
||||
<p><font size="2">Last updated 6/15/2003 - </font><font size="2"> <a
|
||||
</a><a href="http://www.opera.com"> </a> </font></p>
|
||||
|
||||
<p><font size="2">Last updated 7/14/2003 - </font><font size="2"> <a
|
||||
href="support.htm">Tom Eastep</a></font> </p>
|
||||
<font face="Trebuchet MS"><a
|
||||
<font face="Trebuchet MS"><a
|
||||
href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,78 +1,80 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Prerequisites</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Requirements</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
Shorewall Requires:<br>
|
||||
|
||||
<br>
|
||||
Shorewall Requires:<br>
|
||||
|
||||
<ul>
|
||||
<li>A kernel that supports netfilter. I've tested with 2.4.2 - 2.4.20.
|
||||
With current releases of Shorewall, Traffic Shaping/Control requires at
|
||||
least 2.4.18. <a href="kernel.htm"> Check here for kernel configuration
|
||||
information.</a> If you are looking for a firewall for use with
|
||||
2.2 kernels, <a href="http://seawall.sf.net"> see the Seattle
|
||||
Firewall site</a> .</li>
|
||||
<li>iptables 1.2 or later but beware version 1.2.3 -- see the <a
|
||||
href="errata.htm">Errata</a>. <font color="#ff0000"><b>WARNING: </b></font>The
|
||||
buggy iptables version 1.2.3 is included in RedHat 7.2 and you should
|
||||
upgrade to iptables 1.2.4 prior to installing Shorewall. Version 1.2.4
|
||||
is available <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">from RedHat</a>
|
||||
<li>A kernel that supports netfilter. I've tested with 2.4.2 -
|
||||
2.4.20. With current releases of Shorewall, Traffic Shaping/Control requires
|
||||
at least 2.4.18. <a href="kernel.htm"> Check here for kernel
|
||||
configuration information.</a> If you are looking for a firewall
|
||||
for use with 2.2 kernels, <a href="http://seawall.sf.net"> see
|
||||
the Seattle Firewall site</a> .</li>
|
||||
<li>iptables 1.2 or later but beware version 1.2.3 -- see the
|
||||
<a href="errata.htm">Errata</a>. <font color="#ff0000"><b>WARNING:
|
||||
</b></font>The buggy iptables version 1.2.3 is included in RedHat
|
||||
7.2 and you should upgrade to iptables 1.2.4 prior to installing Shorewall.
|
||||
Version 1.2.4 is available <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">from RedHat</a>
|
||||
and in the <a href="errata.htm">Shorewall Errata</a>. </li>
|
||||
<li>Iproute ("ip" utility). The iproute package is included
|
||||
with most distributions but may not be installed by default. The official
|
||||
<li>Iproute ("ip" utility). The iproute package is included
|
||||
with most distributions but may not be installed by default. The official
|
||||
download site is <a href="ftp://ftp.inr.ac.ru/ip-routing"
|
||||
target="_blank"> <font face="Century Gothic, Arial, Helvetica">f</font>tp://ftp.inr.ac.ru/ip-routing</a>.
|
||||
target="_blank"> <font face="Century Gothic, Arial, Helvetica">f</font>tp://ftp.inr.ac.ru/ip-routing</a>.
|
||||
</li>
|
||||
<li>A Bourne shell or derivative such as bash or ash. This shell
|
||||
must have correct support for variable expansion formats ${<i>variable</i>%<i>pattern</i>
|
||||
}, ${<i>variable</i>%%<i>pattern</i>}, ${<i>variable</i>#<i>pattern</i>
|
||||
<li>A Bourne shell or derivative such as bash or ash. This shell
|
||||
must have correct support for variable expansion formats ${<i>variable</i>%<i>pattern</i>
|
||||
}, ${<i>variable</i>%%<i>pattern</i>}, ${<i>variable</i>#<i>pattern</i>
|
||||
} and ${<i>variable</i>##<i>pattern</i>}.</li>
|
||||
<li>Must produce a sensible result when a number n (128 <= n <= 255)
|
||||
is left shifted by 24 bits. You can check this at a shell prompt by:</li>
|
||||
|
||||
<li>Your shell must produce a sensible result when a number n (128 <=
|
||||
n <= 255) is left shifted by 24 bits. You can check this at a shell prompt
|
||||
by:</li>
|
||||
|
||||
<ul>
|
||||
<li>echo $((128 << 24))<br>
|
||||
</li>
|
||||
<li>The result must be either 2147483648 or -2147483648.<br>
|
||||
</li>
|
||||
|
||||
<li>echo $((128 << 24))<br>
|
||||
</li>
|
||||
<li>The result must be either 2147483648 or -2147483648.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li>The firewall monitoring display is greatly improved if you have
|
||||
awk (gawk) installed.</li>
|
||||
|
||||
<li>The firewall monitoring display is greatly improved if you
|
||||
have awk (gawk) installed.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><font size="2">Last updated 7/4/2003 - <a
|
||||
|
||||
<p align="left"><font size="2">Last updated 7/8/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -3,556 +3,575 @@
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="33%" height="90" valign="middle"
|
||||
<td width="33%" height="90" valign="middle"
|
||||
align="left"><a href="http://www.cityofshoreline.com"><img
|
||||
src="images/washington.jpg" alt="" width="97" height="80" hspace="4"
|
||||
border="0">
|
||||
</a></td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
</a></td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff">Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i></h1>
|
||||
</td>
|
||||
<td valign="middle">
|
||||
|
||||
<h1 align="center"><a href="http://www.shorewall.net"
|
||||
target="_top"><br>
|
||||
</a></h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff">Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i></h1>
|
||||
</td>
|
||||
<td valign="middle">
|
||||
|
||||
<h1 align="center"><a href="http://www.shorewall.net"
|
||||
target="_top"><br>
|
||||
</a></h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a
|
||||
href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated
|
||||
firewall system, a multi-function gateway/router/server
|
||||
or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a
|
||||
href="http://www.netfilter.org">Netfilter</a> (iptables)
|
||||
based firewall that can be used on a dedicated
|
||||
firewall system, a multi-function gateway/router/server
|
||||
or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
|
||||
it under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
|
||||
<br>
|
||||
it under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
This program is distributed in
|
||||
the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even
|
||||
the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.<br>
|
||||
<br>
|
||||
|
||||
<br>
|
||||
This program is distributed in
|
||||
the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the
|
||||
implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
General Public License for more details.<br>
|
||||
|
||||
You should have received a copy
|
||||
of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
<br>
|
||||
|
||||
You should have received a copy
|
||||
of the GNU General Public License
|
||||
along with this program; if not, write
|
||||
to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="file:///vfat/Shorewall-docs/shorewall_quickstart_guide.htm">QuickStart
|
||||
Guide</a> that most closely match your environment and follow
|
||||
the step by step instructions.<br>
|
||||
|
||||
<h2>Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the
|
||||
<a
|
||||
href="file:///vfat/Shorewall-docs/shorewall_quickstart_guide.htm">QuickStart
|
||||
Guide</a> that most closely match your environment and follow
|
||||
the step by step instructions.<br>
|
||||
|
||||
<h2>Looking for Information?</h2>
|
||||
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a> is a good place to start as is the Quick Search to your right.
|
||||
|
||||
The <a href="shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a> is a good place to start as is the Quick Search to your right.
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, the documentation<b> </b>on this site will not
|
||||
apply directly to your setup. If you want to use the documentation
|
||||
that you find here, you will want to consider uninstalling what you have
|
||||
and installing a setup that matches the documentation on this site.
|
||||
See the <a href="two-interface.htm">Two-interface QuickStart Guide</a>
|
||||
for details.
|
||||
If so, the documentation<b> </b>on this site will
|
||||
not apply directly to your setup. If you want to use the documentation
|
||||
that you find here, you will want to consider uninstalling what you have
|
||||
and installing a setup that matches the documentation on this site.
|
||||
See the <a href="two-interface.htm">Two-interface QuickStart Guide</a>
|
||||
for details.
|
||||
<h2></h2>
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b>News</b></h2>
|
||||
<p><b>7/7/2003 - Shorewall-1.4.6 Beta 2</b><b> <img border="0"
|
||||
|
||||
<p><b>7/15/2003 - Shorewall-1.4.6 RC 1</b><b> <img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
<br>
|
||||
</b></p>
|
||||
|
||||
</b> </p>
|
||||
<blockquote><b><a
|
||||
href="http://shorewall.net/pub/shorewall/testing">http://shorewall.net/pub/shorewall/testing</a></b><b><a
|
||||
href="ftp://shorewall.net/pub/shorewall/testing" target="_top"><br>
|
||||
ftp://shorewall.net/pub/shorewall/testing</a></b></blockquote>
|
||||
|
||||
<p><b>Problems Corrected:</b><br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>A problem seen on RH7.3 systems where Shorewall encountered start
|
||||
errors when started using the "service" mechanism has been worked around.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Where a list of IP addresses appears in the DEST column of a
|
||||
DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the nat
|
||||
table (one for each element in the list). Shorewall now correctly creates
|
||||
<li>A problem seen on RH7.3 systems where Shorewall encountered
|
||||
start errors when started using the "service" mechanism has been worked
|
||||
around.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Where a list of IP addresses appears in the DEST column of a
|
||||
DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the nat
|
||||
table (one for each element in the list). Shorewall now correctly creates
|
||||
a single DNAT rule with multiple "--to-destination" clauses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Corrected a problem in Beta 1 where DNS names containing a "-"
|
||||
<br>
|
||||
</li>
|
||||
<li>Corrected a problem in Beta 1 where DNS names containing a "-"
|
||||
were mis-handled when they appeared in the DEST column of a rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li value="4">A number of problems with rule parsing have been corrected.
|
||||
Corrections involve the handling of "z1!z2" in the SOURCE column as well
|
||||
as lists in the ORIGINAL DESTINATION column.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>Migration Issues:</b><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>In earlier versions, an undocumented feature allowed entries
|
||||
in the host file as follows:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
|
||||
<br>
|
||||
This capability was never documented and has been removed in 1.4.6 to allow
|
||||
entries of the following format:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been
|
||||
removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically
|
||||
detected by Shorewall (see below).<br>
|
||||
</li>
|
||||
</ol>
|
||||
|
||||
<p><b>New Features:</b><br>
|
||||
</p>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>A 'newnotsyn' interface option has been added. This option may
|
||||
be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No
|
||||
for packets arriving on the associated interface.<br>
|
||||
<li>In earlier versions, an undocumented feature allowed entries
|
||||
in the host file as follows:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
|
||||
<br>
|
||||
This capability was never documented and has been removed in 1.4.6 to allow
|
||||
entries of the following format:<br>
|
||||
<br>
|
||||
z eth1:192.168.1.0/24,192.168.2.0/24<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The means for specifying a range of IP addresses in /etc/shorewall/masq
|
||||
to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been
|
||||
removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically
|
||||
detected by Shorewall (see below).<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>New Features:</b><br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>A 'newnotsyn' interface option has been added. This option may
|
||||
be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No
|
||||
for packets arriving on the associated interface.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The means for specifying a range of IP addresses in /etc/shorewall/masq
|
||||
to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address
|
||||
ranges.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Shorewall can now add IP addresses to subnets other than the
|
||||
<br>
|
||||
</li>
|
||||
<li>Shorewall can now add IP addresses to subnets other than the
|
||||
first one on an interface.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>DNAT[-] rules may now be used to load balance (round-robin)
|
||||
over a set of servers. Servers may be specified in a range of addresses
|
||||
given as <first address>-<last address>.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration
|
||||
options have been removed and have been replaced by code that detects whether
|
||||
these capabilities are present in the current kernel. The output of the
|
||||
start, restart and check commands have been enhanced to report the outcome:<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for the Connection Tracking Match Extension has been
|
||||
added. This extension is available in recent kernel/iptables releases and
|
||||
allows for rules which match against elements in netfilter's connection tracking
|
||||
table. Shorewall automatically detects the availability of this extension
|
||||
and reports its availability in the output of the start, restart and check
|
||||
commands.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Connection Tracking Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
If this extension is available, the ruleset generated by Shorewall is
|
||||
changed in the following ways:</li>
|
||||
|
||||
<ul>
|
||||
<li>To handle 'norfc1918' filtering, Shorewall will not create
|
||||
chains in the mangle table but will rather do all 'norfc1918' filtering in
|
||||
the filter table (rfc1918 chain).</li>
|
||||
<li>Recall that Shorewall DNAT rules generate two netfilter rules;
|
||||
one in the nat table and one in the filter table. If the Connection Tracking
|
||||
Match Extension is available, the rule in the filter table is extended to
|
||||
check that the original destination address was the same as specified (or
|
||||
defaulted to) in the DNAT rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall)
|
||||
may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
|
||||
<br>
|
||||
ipcalc [ <address> <netmask> | <address>/<vlsm>
|
||||
]<br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
Warning:<br>
|
||||
<br>
|
||||
If your shell only supports 32-bit signed arithmatic (ash or dash), then
|
||||
the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1
|
||||
and for /1 networks. Bash should produce correct information for all valid
|
||||
IP addresses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>DNAT[-] rules may now be used to load balance (round-robin) over
|
||||
a set of servers. Servers may be specified in a range of addresses given
|
||||
as <first address>-<last address>.<br>
|
||||
<li>An 'iprange' command has been added to /sbin/shorewall. <br>
|
||||
<br>
|
||||
iprange <address>-<address><br>
|
||||
<br>
|
||||
This command decomposes a range of IP addressses into a list of network
|
||||
and host addresses. The command can be useful if you need to construct an
|
||||
efficient set of rules that accept connections from a range of network addresses.<br>
|
||||
<br>
|
||||
Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
|
||||
then the range may not span 128.0.0.0.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
|
||||
[root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
|
||||
192.168.1.4/30<br>
|
||||
192.168.1.8/29<br>
|
||||
192.168.1.16/28<br>
|
||||
192.168.1.32/27<br>
|
||||
192.168.1.64/26<br>
|
||||
192.168.1.128/25<br>
|
||||
192.168.2.0/23<br>
|
||||
192.168.4.0/22<br>
|
||||
192.168.8.0/22<br>
|
||||
192.168.12.0/29<br>
|
||||
192.168.12.8/31<br>
|
||||
[root@gateway root]#<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
|
||||
have been removed and have been replaced by code that detects whether these
|
||||
capabilities are present in the current kernel. The output of the start,
|
||||
restart and check commands have been enhanced to report the outcome:<br>
|
||||
<li>A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Support for the Connection Tracking Match Extension has been
|
||||
added. This extension is available in recent kernel/iptables releases and
|
||||
allows for rules which match against elements in netfilter's connection
|
||||
tracking table. Shorewall automatically detects the availability of this
|
||||
extension and reports its availability in the output of the start, restart
|
||||
and check commands.<br>
|
||||
<br>
|
||||
Shorewall has detected the following iptables/netfilter capabilities:<br>
|
||||
NAT: Available<br>
|
||||
Packet Mangling: Available<br>
|
||||
Multi-port Match: Available<br>
|
||||
Connection Tracking Match: Available<br>
|
||||
Verifying Configuration...<br>
|
||||
<br>
|
||||
If this extension is available, the ruleset generated by Shorewall is changed
|
||||
in the following ways:</li>
|
||||
<ul>
|
||||
<li>To handle 'norfc1918' filtering, Shorewall will not create
|
||||
chains in the mangle table but will rather do all 'norfc1918' filtering
|
||||
in the filter table (rfc1918 chain).</li>
|
||||
<li>Recall that Shorewall DNAT rules generate two netfilter rules;
|
||||
one in the nat table and one in the filter table. If the Connection Tracking
|
||||
Match Extension is available, the rule in the filter table is extended to
|
||||
check that the original destination address was the same as specified (or
|
||||
defaulted to) in the DNAT rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
</ul>
|
||||
<li>The shell used to interpret the firewall script (/usr/share/shorewall/firewall)
|
||||
may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
|
||||
<br>
|
||||
ipcalc [ <address> <netmask> | <address>/<vlsm>
|
||||
]<br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0/24<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
[root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0<br>
|
||||
CIDR=192.168.1.0/24<br>
|
||||
NETMASK=255.255.255.0<br>
|
||||
NETWORK=192.168.1.0<br>
|
||||
BROADCAST=192.168.1.255<br>
|
||||
[root@wookie root]#<br>
|
||||
<br>
|
||||
Warning:<br>
|
||||
<br>
|
||||
If your shell only supports 32-bit signed arithmatic (ash or dash), then
|
||||
the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1
|
||||
and for /1 networks. Bash should produce correct information for all valid
|
||||
IP addresses.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>An 'iprange' command has been added to /sbin/shorewall. <br>
|
||||
<br>
|
||||
iprange <address>-<address><br>
|
||||
<br>
|
||||
This command decomposes a range of IP addressses into a list of network
|
||||
and host addresses. The command can be useful if you need to construct an
|
||||
efficient set of rules that accept connections from a range of network addresses.<br>
|
||||
<br>
|
||||
Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
|
||||
then the range may not span 128.0.0.0.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
[root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9<br>
|
||||
192.168.1.4/30<br>
|
||||
192.168.1.8/29<br>
|
||||
192.168.1.16/28<br>
|
||||
192.168.1.32/27<br>
|
||||
192.168.1.64/26<br>
|
||||
192.168.1.128/25<br>
|
||||
192.168.2.0/23<br>
|
||||
192.168.4.0/22<br>
|
||||
192.168.8.0/22<br>
|
||||
192.168.12.0/29<br>
|
||||
192.168.12.8/31<br>
|
||||
[root@gateway root]#<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
Example:<br>
|
||||
<br>
|
||||
foo eth1:192.168.1.0/24,192.168.2.0/24</li>
|
||||
foo eth1:192.168.1.0/24,192.168.2.0/24</li>
|
||||
|
||||
</ol>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
<ol>
|
||||
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>6/17/2003 - Shorewall-1.4.5</b><b> </b></p>
|
||||
|
||||
|
||||
<p>Problems Corrected:<br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The command "shorewall debug try <directory>" now
|
||||
<li>The command "shorewall debug try <directory>" now
|
||||
correctly traces the attempt.</li>
|
||||
<li>The INCLUDE directive now works properly in the zones
|
||||
<li>The INCLUDE directive now works properly in the zones
|
||||
file; previously, INCLUDE in that file was ignored.</li>
|
||||
<li>/etc/shorewall/routestopped records with an empty second
|
||||
column are no longer ignored.<br>
|
||||
</li>
|
||||
|
||||
<li>/etc/shorewall/routestopped records with an empty second
|
||||
column are no longer ignored.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p>New Features:<br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule
|
||||
may now contain a list of addresses. If the list begins with "!' then
|
||||
the rule will take effect only if the original destination address in
|
||||
the connection request does not match any of the addresses listed.</li>
|
||||
|
||||
<li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-]
|
||||
rule may now contain a list of addresses. If the list begins with "!'
|
||||
then the rule will take effect only if the original destination address
|
||||
in the connection request does not match any of the addresses listed.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b>
|
||||
|
||||
<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b><b>
|
||||
</b></p>
|
||||
The firewall at shorewall.net has been upgraded to the 2.4.21 kernel
|
||||
and iptables 1.2.8 (using the "official" RPM from netfilter.org). No
|
||||
problems have been encountered with this set of software. The Shorewall
|
||||
version is 1.4.4b plus the accumulated changes for 1.4.5.
|
||||
|
||||
The firewall at shorewall.net has been upgraded to the 2.4.21
|
||||
kernel and iptables 1.2.8 (using the "official" RPM from netfilter.org).
|
||||
No problems have been encountered with this set of software. The Shorewall
|
||||
version is 1.4.4b plus the accumulated changes for 1.4.5.
|
||||
|
||||
<p><b>6/8/2003 - Updated Samples</b><b> </b></p>
|
||||
|
||||
|
||||
<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
|
||||
version 1.4.4.</p>
|
||||
|
||||
|
||||
<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
|
||||
version 1.4.4.</p>
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.4.2 and Kernel-2.4.20. You
|
||||
can find their work at: <a
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.4.2 and Kernel-2.4.20.
|
||||
You can find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
|
||||
<b>Congratulations to Jacques
|
||||
and Eric on the recent release of Bering 1.2!!!
|
||||
<b>Congratulations to Jacques
|
||||
and Eric on the recent release of Bering 1.2!!!
|
||||
</b><br>
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<b> </b></td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
valign="top" align="center">
|
||||
|
||||
<td width="88" bgcolor="#4b017c"
|
||||
valign="top" align="center">
|
||||
|
||||
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
|
||||
|
||||
|
||||
<p><strong><br>
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily
|
||||
0200-0330 GMT.</font><br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font face="Arial" size="-1">
|
||||
<input type="text" name="words" size="15"></font><font
|
||||
<font face="Arial" size="-1">
|
||||
<input type="text" name="words" size="15"></font><font
|
||||
size="-1"> </font><font face="Arial" size="-1"> <input
|
||||
type="hidden" name="format" value="long"> <input
|
||||
type="hidden" name="method" value="and"> <input type="hidden"
|
||||
name="config" value="htdig"> <input type="submit"
|
||||
value="Search"></font> </p>
|
||||
<font face="Arial"> <input
|
||||
<font face="Arial"> <input
|
||||
type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font>
|
||||
</form>
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font>
|
||||
</form>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><b> <a
|
||||
href="http://lists.shorewall.net/htdig/search.html"> <font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</center>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff"><br>
|
||||
<font size="+2">Shorewall is free but if you try it
|
||||
and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
<font size="+2">Shorewall is free but if you try it
|
||||
and find it useful, please consider making a donation
|
||||
to <a
|
||||
href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></font></p>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p><font size="2">Updated 7/7/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
|
||||
<p><font size="2">Updated 7/15/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,84 +1,84 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall Support Guide</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h2>Before Reporting a Problem or Asking a Question<br>
|
||||
</h2>
|
||||
There
|
||||
are a number of sources of Shorewall information. Please try
|
||||
these before you post.
|
||||
<ul>
|
||||
<li>Shorewall versions
|
||||
earlier that 1.3.0 are no longer supported.<br>
|
||||
</li>
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a><br>
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/FAQ.htm">FAQ</a>
|
||||
has solutions to more than 20 common problems.
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
Information contains a number of tips to
|
||||
help you solve common problems. </li>
|
||||
<li> The
|
||||
<a href="http://www.shorewall.net/errata.htm"> Errata</a> has links
|
||||
to download updated components. </li>
|
||||
<li>
|
||||
The Site and Mailing List Archives search facility can
|
||||
locate documents and posts about similar problems:
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Site and Mailing List Archive Search</h2>
|
||||
|
||||
<blockquote>
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
||||
</h2>
|
||||
|
||||
|
||||
There are a number of sources of Shorewall information. Please
|
||||
try these before you post.
|
||||
<ul>
|
||||
<li>Shorewall versions
|
||||
earlier that 1.3.0 are no longer supported.<br>
|
||||
</li>
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a><br>
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/FAQ.htm">FAQ</a>
|
||||
has solutions to more than 20 common problems.
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
Information contains a number of tips to
|
||||
help you solve common problems. </li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/errata.htm"> Errata</a>
|
||||
has links to download updated components. </li>
|
||||
<li>
|
||||
The Site and Mailing List Archives search facility can
|
||||
locate documents and posts about similar problems:
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Site and Mailing List Archive Search</h2>
|
||||
|
||||
<blockquote>
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
||||
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -87,237 +87,236 @@ locate documents and posts about similar problems:
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font><input type="hidden" name="config"
|
||||
</font><input type="hidden" name="config"
|
||||
value="htdig"><input type="hidden" name="restrict" value=""><font
|
||||
size="-1"> Include Mailing List Archives:
|
||||
|
||||
size="-1"> Include Mailing List Archives:
|
||||
|
||||
<select size="1" name="exclude">
|
||||
<option value="">Yes</option>
|
||||
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
||||
</select>
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"><br>
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
</font><br>
|
||||
Search: <input type="text" size="30"
|
||||
name="words" value=""> <input type="submit" value="Search"><br>
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
<h2>Problem Reporting Guidelines<br>
|
||||
</h2>
|
||||
|
||||
<ul>
|
||||
<li>Please remember we only know
|
||||
what is posted in your message. Do not leave out any information
|
||||
that appears to be correct, or was mentioned in a previous
|
||||
post. There have been countless posts by people who were sure
|
||||
that some part of their configuration was correct when it actually
|
||||
contained a small error. We tend to be skeptics where detail
|
||||
is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're
|
||||
asking for <strong>free</strong> technical support.
|
||||
Any help we offer is an act of generosity, not an obligation.
|
||||
Try to make it easy for us to help you. Follow good, courteous
|
||||
practices in writing and formatting your e-mail. Provide details
|
||||
that we need if you expect good answers. <em>Exact quoting </em>
|
||||
of error messages, log entries, command output, and other output is
|
||||
better than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>
|
||||
Please don't describe your environment and then ask
|
||||
us to send you custom configuration files. We're
|
||||
here to answer your questions but we can't do
|
||||
your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem,
|
||||
<strong>ALWAYS</strong> include this information:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall
|
||||
you are running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall
|
||||
version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
</h2>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output
|
||||
of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip
|
||||
addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output
|
||||
of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip
|
||||
route show<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<li>Please remember we only know
|
||||
what is posted in your message. Do not leave out any information
|
||||
that appears to be correct, or was mentioned in a previous
|
||||
post. There have been countless posts by people who were sure
|
||||
that some part of their configuration was correct when it actually
|
||||
contained a small error. We tend to be skeptics where detail
|
||||
is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that
|
||||
you're asking for <strong>free</strong> technical
|
||||
support. Any help we offer is an act of generosity, not an obligation.
|
||||
Try to make it easy for us to help you. Follow good, courteous
|
||||
practices in writing and formatting your e-mail. Provide details that
|
||||
we need if you expect good answers. <em>Exact quoting </em> of
|
||||
error messages, log entries, command output, and other output is better
|
||||
than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>
|
||||
Please don't describe your environment and then
|
||||
ask us to send you custom configuration files.
|
||||
We're here to answer your questions but we can't
|
||||
do your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem,
|
||||
<strong>ALWAYS</strong> include this information:</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li><font color="#ff0000"><u><i><big><b>THIS IS IMPORTANT!<br>
|
||||
<br>
|
||||
</b></big></i></u></font>If your problem is that some type of connection
|
||||
to/from or through your firewall isn't working then please:<br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall reset</font></b><br>
|
||||
<br>
|
||||
2. Try making the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall
|
||||
status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
<li>the exact version of Shorewall
|
||||
you are running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall
|
||||
version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output
|
||||
of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip
|
||||
addr show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output
|
||||
of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip
|
||||
route show<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<ul>
|
||||
|
||||
<ul>
|
||||
<li><big><font color="#ff0000"><u><i><big><b>THIS IS
|
||||
IMPORTANT!</b></big></i></u></font><big><big><big> </big>If your problem
|
||||
is that some type of connection to/from or through your firewall isn't working
|
||||
then please perform the following four steps:</big></big></big><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall reset</font></b><br>
|
||||
<br>
|
||||
2. Try making the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall
|
||||
status > /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment
|
||||
(you may compress it if you like).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
Guides, please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using
|
||||
the Mandrake installation of Shorewall, please say so.<br>
|
||||
<br>
|
||||
</b></li>
|
||||
|
||||
<br>
|
||||
</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<li>As a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address,
|
||||
netmask, nameserver addresses, domain name, etc. These aren't
|
||||
secrets, and concealing them often misleads us (and 80% of the time,
|
||||
a hacker could derive them anyway from information contained
|
||||
<li>As a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address,
|
||||
netmask, nameserver addresses, domain name, etc. These aren't
|
||||
secrets, and concealing them often misleads us (and 80% of the time,
|
||||
a hacker could derive them anyway from information contained
|
||||
in the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages
|
||||
("<b><font color="#009900">/sbin/shorewall show log</font></b>")
|
||||
when you exercise the function that is giving you problems?
|
||||
If so, include the message(s) in your post along with a copy of your
|
||||
/etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration
|
||||
files (especially the /etc/shorewall/hosts file
|
||||
if you have modified that file) that you think are
|
||||
relevant. If you include /etc/shorewall/rules, please include
|
||||
/etc/shorewall/policy as well (rules are meaningless unless
|
||||
one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to
|
||||
"<font color="#009900"><b>shorewall start</b></font>", include
|
||||
a trace (See the <a
|
||||
href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so
|
||||
don't post GIFs of your network layout,
|
||||
etc. to the Mailing List -- your post will be rejected.</b></li>
|
||||
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages
|
||||
("<b><font color="#009900">/sbin/shorewall show log</font></b>")
|
||||
when you exercise the function that is giving you problems?
|
||||
If so, include the message(s) in your post along with a copy of
|
||||
your /etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration
|
||||
files (especially the /etc/shorewall/hosts file
|
||||
if you have modified that file) that you think are
|
||||
relevant. If you include /etc/shorewall/rules, please include
|
||||
/etc/shorewall/policy as well (rules are meaningless unless
|
||||
one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to
|
||||
"<font color="#009900"><b>shorewall start</b></font>", include
|
||||
a trace (See the <a
|
||||
href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so
|
||||
don't post GIFs of your network layout,
|
||||
etc. to the Mailing List -- your post will be rejected.</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> The author gratefully acknowleges that the above list was
|
||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||
|
||||
<blockquote> The author gratefully acknowleges that the above list was
|
||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||
<em>Olszewski</em> found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
</blockquote>
|
||||
|
||||
</blockquote>
|
||||
|
||||
<h2>When using the mailing list, please post in plain text</h2>
|
||||
|
||||
<blockquote> A growing number of MTAs serving list subscribers are
|
||||
rejecting all HTML traffic. At least one MTA has gone so far as to
|
||||
blacklist shorewall.net "for continuous abuse" because it has been
|
||||
my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML
|
||||
is a Draconian way to control spam and that the ultimate
|
||||
losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list
|
||||
subscriber wrote to me privately "These e-mail admin's need
|
||||
to get a <i>(expletive deleted)</i> life instead of trying to
|
||||
rid the planet of HTML based e-mail". Nevertheless, to allow
|
||||
subscribers to receive list posts as must as possible, I have now
|
||||
configured the list server at shorewall.net to strip all HTML from
|
||||
outgoing posts.<br>
|
||||
<br>
|
||||
<big><font color="#cc0000"><b>If you run your own outgoing mail server
|
||||
and it doesn't have a valid DNS PTR record, your email won't reach the lists
|
||||
unless/until the postmaster notices that your posts are being rejected. To
|
||||
avoid this problem, you should configure your MTA to forward posts to shorewall.net
|
||||
through an MTA that <u>does</u> have a valid PTR record (such as the one
|
||||
at your ISP). </b></font></big><br>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<blockquote> A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all
|
||||
HTML is a Draconian way to control spam and that the
|
||||
ultimate losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list
|
||||
subscriber wrote to me privately "These e-mail admin's need
|
||||
to get a <i>(expletive deleted)</i> life instead of trying to rid
|
||||
the planet of HTML based e-mail". Nevertheless, to allow subscribers
|
||||
to receive list posts as must as possible, I have now configured
|
||||
the list server at shorewall.net to strip all HTML from outgoing
|
||||
posts.<br>
|
||||
<br>
|
||||
<big><font color="#cc0000"><b>If you run your own outgoing mail server
|
||||
and it doesn't have a valid DNS PTR record, your email won't reach the lists
|
||||
unless/until the postmaster notices that your posts are being rejected.
|
||||
To avoid this problem, you should configure your MTA to forward posts to
|
||||
shorewall.net through an MTA that <u>does</u> have a valid PTR record (such
|
||||
as the one at your ISP). </b></font></big><br>
|
||||
</blockquote>
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a
|
||||
href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
<b>If you run Shorewall under
|
||||
MandrakeSoft Multi Network Firewall (MNF) and you have
|
||||
not purchased an MNF license from MandrakeSoft then you can
|
||||
post non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a>. <b>Do not expect to get free MNF support on the list</b>
|
||||
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a
|
||||
href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
<b>If you run Shorewall under
|
||||
MandrakeSoft Multi Network Firewall (MNF) and you have
|
||||
not purchased an MNF license from MandrakeSoft then you can
|
||||
post non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a>. <b>Do not expect to get free MNF support on the list</b>
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> .</p>
|
||||
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> .</p>
|
||||
|
||||
<p> To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
<p>For information on other Shorewall mailing lists, go to <a
|
||||
href="http://lists.shorewall.net">http://lists.shorewall.net</a><br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 7/6/2003 - Tom Eastep</font></p>
|
||||
|
||||
</p>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 7/9/2003 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=1.4.6Beta2
|
||||
VERSION=1.4.6RC1
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -54,7 +54,7 @@
|
||||
# /etc/rc.d/rc.local file is modified to start the firewall.
|
||||
#
|
||||
|
||||
VERSION=1.4.6Beta2
|
||||
VERSION=1.4.6RC1
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
%define name shorewall
|
||||
%define version 1.4.6
|
||||
%define release 0Beta2
|
||||
%define release 0RC1
|
||||
%define prefix /usr
|
||||
|
||||
Summary: Shoreline Firewall is an iptables-based firewall for Linux systems.
|
||||
@ -105,6 +105,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
|
||||
|
||||
%changelog
|
||||
* Mon Jul 14 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.6-0RC1
|
||||
* Mon Jul 07 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.6-0Beta2
|
||||
* Fri Jul 04 2003 Tom Eastep <tom@shorewall.net>
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Seattle Firewall
|
||||
|
||||
VERSION=1.4.6Beta2
|
||||
VERSION=1.4.6RC1
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
Loading…
Reference in New Issue
Block a user