diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm index c64369b1d..21ed51f2d 100644 --- a/Shorewall/Perl/Shorewall/Misc.pm +++ b/Shorewall/Perl/Shorewall/Misc.pm @@ -679,7 +679,13 @@ sub process_stoppedrules() { my $result; if ( my $fn = open_file 'stoppedrules' , 1, 1 ) { - first_entry "$doing $fn..."; + first_entry sub() { + progress_message2("$doing $fn..."); + unless ( $config{ADMINISABSENTMINDED} ) { + warning_message("Entries in the routestopped file are processed as if ADMINISABSENTMINDED=Yes"); + $config{ADMINISABSENTMINDED} = 'Yes'; + } + }; while ( read_a_line( NORMAL_READ ) ) { @@ -2512,9 +2518,9 @@ EOF "restore_default_route $config{USE_DEFAULT_RT}" ); - my @chains = $config{ADMINISABSENTMINDED} ? qw/INPUT FORWARD/ : qw/INPUT OUTPUT FORWARD/; - - add_ijump $filter_table ->{$_}, j => 'ACCEPT', state_imatch 'ESTABLISHED,RELATED' for @chains; + if ( $config{ADMINISABSENTMINDED} ) { + add_ijump $filter_table ->{$_}, j => 'ACCEPT', state_imatch 'ESTABLISHED,RELATED' for qw/INPUT FORWARD/; + } if ( $family == F_IPV6 ) { add_ijump $input, j => 'ACCEPT', s => IPv6_LINKLOCAL; diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml index 7ea1541a3..1ccaca148 100644 --- a/Shorewall/manpages/shorewall.conf.xml +++ b/Shorewall/manpages/shorewall.conf.xml @@ -281,15 +281,48 @@ The value of this variable affects Shorewall's stopped state. - When ADMINISABSENTMINDED=No, only traffic to/from those addresses - listed in shorewall-routestopped(5) - is accepted when Shorewall is stopped. When ADMINISABSENTMINDED=Yes, - in addition to traffic to/from addresses in shorewall-routestopped(5), - connections that were active when Shorewall stopped continue to work - and all new connections from the firewall system itself are allowed. - If this variable is not set or is given the empty value then + or shorewall-stoppedrules(5) + is used: + + + + routestopped + + + When ADMINISABSENTMINDED=No, only traffic to/from those + addresses listed in routestopped is + accepted when Shorewall is stopped. When + ADMINISABSENTMINDED=Yes, in addition to traffic to/from + addresses in routestopped, connections + that were active when Shorewall stopped continue to work and + all new connections from the firewall system itself are + allowed. + + + + + stoppedrules + + + If ADMINISABSENTMINDED=No, a warning message is issued + and the setting is ignored. + + In addition to connections matching entries in + stoppedrules, existing connections + continue to work and all new connections from the firewall + system itself are allowed. To sever all existing connections + when the firewall is stopped, install the conntrack utility + and place the command conntrack -F in the + stopped user exit + (/etc/shorewall/stopped). + + + + + If this variable is not set or is given the empty value then ADMINISABSENTMINDED=No is assumed. diff --git a/Shorewall6/manpages/shorewall6.conf.xml b/Shorewall6/manpages/shorewall6.conf.xml index f10ebf973..0515bcaa4 100644 --- a/Shorewall6/manpages/shorewall6.conf.xml +++ b/Shorewall6/manpages/shorewall6.conf.xml @@ -216,18 +216,50 @@ role="bold">Yes|No] - The value of this variable affects Shorewall6's stopped state. - When ADMINISABSENTMINDED=No, only traffic to/from those addresses - listed in shorewall6-routestopped(5) - is accepted when Shorewall6 is stopped. When - ADMINISABSENTMINDED=Yes, in addition to traffic to/from addresses in - shorewall6-routestopped(5), - connections that were active when Shorewall6 stopped continue to - work and all new connections from the firewall system itself are - allowed. If this variable is not set or is given the empty value - then ADMINISABSENTMINDED=No is assumed. + The value of this variable affects Shorewall's stopped state. + The behavior differs depending on whether shorewall6-routestopped(5) + or shorewall6-stoppedrules(5) + is used: + + + + routestopped + + + When ADMINISABSENTMINDED=No, only traffic to/from those + addresses listed in routestopped is + accepted when Shorewall is stopped. When + ADMINISABSENTMINDED=Yes, in addition to traffic to/from + addresses in routestopped, connections + that were active when Shorewall stopped continue to work and + all new connections from the firewall system itself are + allowed. + + + + + stoppedrules + + + If ADMINISABSENTMINDED=No, a warning message is issued + and the setting is ignored. + + In addition to connections matching entries in + stoppedrules, existing connections + continue to work and all new connections from the firewall + system itself are allowed. To sever all existing connections + when the firewall is stopped, install the conntrack utility + and place the command conntrack -F in the + stopped user exit + (/etc/shorewall6/stopped). + + + + + If this variable is not set or is given the empty value then + ADMINISABSENTMINDED=No is assumed.