diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm
index c64369b1d..21ed51f2d 100644
--- a/Shorewall/Perl/Shorewall/Misc.pm
+++ b/Shorewall/Perl/Shorewall/Misc.pm
@@ -679,7 +679,13 @@ sub process_stoppedrules() {
my $result;
if ( my $fn = open_file 'stoppedrules' , 1, 1 ) {
- first_entry "$doing $fn...";
+ first_entry sub() {
+ progress_message2("$doing $fn...");
+ unless ( $config{ADMINISABSENTMINDED} ) {
+ warning_message("Entries in the routestopped file are processed as if ADMINISABSENTMINDED=Yes");
+ $config{ADMINISABSENTMINDED} = 'Yes';
+ }
+ };
while ( read_a_line( NORMAL_READ ) ) {
@@ -2512,9 +2518,9 @@ EOF
"restore_default_route $config{USE_DEFAULT_RT}"
);
- my @chains = $config{ADMINISABSENTMINDED} ? qw/INPUT FORWARD/ : qw/INPUT OUTPUT FORWARD/;
-
- add_ijump $filter_table ->{$_}, j => 'ACCEPT', state_imatch 'ESTABLISHED,RELATED' for @chains;
+ if ( $config{ADMINISABSENTMINDED} ) {
+ add_ijump $filter_table ->{$_}, j => 'ACCEPT', state_imatch 'ESTABLISHED,RELATED' for qw/INPUT FORWARD/;
+ }
if ( $family == F_IPV6 ) {
add_ijump $input, j => 'ACCEPT', s => IPv6_LINKLOCAL;
diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml
index 7ea1541a3..1ccaca148 100644
--- a/Shorewall/manpages/shorewall.conf.xml
+++ b/Shorewall/manpages/shorewall.conf.xml
@@ -281,15 +281,48 @@
The value of this variable affects Shorewall's stopped state.
- When ADMINISABSENTMINDED=No, only traffic to/from those addresses
- listed in shorewall-routestopped(5)
- is accepted when Shorewall is stopped. When ADMINISABSENTMINDED=Yes,
- in addition to traffic to/from addresses in shorewall-routestopped(5),
- connections that were active when Shorewall stopped continue to work
- and all new connections from the firewall system itself are allowed.
- If this variable is not set or is given the empty value then
+ or shorewall-stoppedrules(5)
+ is used:
+
+
+
+ routestopped
+
+
+ When ADMINISABSENTMINDED=No, only traffic to/from those
+ addresses listed in routestopped is
+ accepted when Shorewall is stopped. When
+ ADMINISABSENTMINDED=Yes, in addition to traffic to/from
+ addresses in routestopped, connections
+ that were active when Shorewall stopped continue to work and
+ all new connections from the firewall system itself are
+ allowed.
+
+
+
+
+ stoppedrules
+
+
+ If ADMINISABSENTMINDED=No, a warning message is issued
+ and the setting is ignored.
+
+ In addition to connections matching entries in
+ stoppedrules, existing connections
+ continue to work and all new connections from the firewall
+ system itself are allowed. To sever all existing connections
+ when the firewall is stopped, install the conntrack utility
+ and place the command conntrack -F in the
+ stopped user exit
+ (/etc/shorewall/stopped).
+
+
+
+
+ If this variable is not set or is given the empty value then
ADMINISABSENTMINDED=No is assumed.
diff --git a/Shorewall6/manpages/shorewall6.conf.xml b/Shorewall6/manpages/shorewall6.conf.xml
index f10ebf973..0515bcaa4 100644
--- a/Shorewall6/manpages/shorewall6.conf.xml
+++ b/Shorewall6/manpages/shorewall6.conf.xml
@@ -216,18 +216,50 @@
role="bold">Yes|No]
- The value of this variable affects Shorewall6's stopped state.
- When ADMINISABSENTMINDED=No, only traffic to/from those addresses
- listed in shorewall6-routestopped(5)
- is accepted when Shorewall6 is stopped. When
- ADMINISABSENTMINDED=Yes, in addition to traffic to/from addresses in
- shorewall6-routestopped(5),
- connections that were active when Shorewall6 stopped continue to
- work and all new connections from the firewall system itself are
- allowed. If this variable is not set or is given the empty value
- then ADMINISABSENTMINDED=No is assumed.
+ The value of this variable affects Shorewall's stopped state.
+ The behavior differs depending on whether shorewall6-routestopped(5)
+ or shorewall6-stoppedrules(5)
+ is used:
+
+
+
+ routestopped
+
+
+ When ADMINISABSENTMINDED=No, only traffic to/from those
+ addresses listed in routestopped is
+ accepted when Shorewall is stopped. When
+ ADMINISABSENTMINDED=Yes, in addition to traffic to/from
+ addresses in routestopped, connections
+ that were active when Shorewall stopped continue to work and
+ all new connections from the firewall system itself are
+ allowed.
+
+
+
+
+ stoppedrules
+
+
+ If ADMINISABSENTMINDED=No, a warning message is issued
+ and the setting is ignored.
+
+ In addition to connections matching entries in
+ stoppedrules, existing connections
+ continue to work and all new connections from the firewall
+ system itself are allowed. To sever all existing connections
+ when the firewall is stopped, install the conntrack utility
+ and place the command conntrack -F in the
+ stopped user exit
+ (/etc/shorewall6/stopped).
+
+
+
+
+ If this variable is not set or is given the empty value then
+ ADMINISABSENTMINDED=No is assumed.