holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Update manpages for column renaming

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2015-12-04 14:53:26 -08:00
parent 46434e45b6
commit 8e7f001f7e
30 changed files with 290 additions and 1899 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Shorewall-core/lib.cli
View File

@ -1052,11 +1052,12 @@ show_command() {
conntrack -f ipv6 -L $@ | show_connections_filter
else
[ $# -gt 1 ] && usage 1
local count=$(cat /proc/sys/net/netfilter/nf_conntrack_count)
local max=$(cat /proc/sys/net/netfilter/nf_conntrack_max)
echo "$g_product $SHOREWALL_VERSION Connections ($count of $max) at $g_hostname - $(date)"
echo
grep '^ipv6' /proc/net/nf_conntrack | sed -r 's/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | show_connections_filter
if [ -f /proc/sys/net/netfilter/nf_conntrack_count -a -f /proc/sys/net/nf_conntrack ]; then
local count=$(cat /proc/sys/net/netfilter/nf_conntrack_count)
local max=$(cat /proc/sys/net/netfilter/nf_conntrack_max)
echo "$g_product $SHOREWALL_VERSION Connections ($count of $max) at $g_hostname - $(date)"
echo
grep '^ipv6' /proc/net/nf_conntrack | sed -r 's/0000:/:/g; s/:::+/::/g; s/:0+/:/g' | show_connections_filter
fi
;;
nat)

30
Shorewall/manpages/shorewall-accounting.xml
View File

@ -403,13 +403,15 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DESTINATION</emphasis> (dest) - {<emphasis
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><emphasis
role="bold">:</emphasis><emphasis>address</emphasis>|<emphasis>address</emphasis>}</term>
<listitem>
<para>This column was formerly named DESTINATION.</para>
<para>Packet Destination.</para>
<para>Format same as <emphasis role="bold">SOURCE</emphasis>
@ -418,7 +420,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL (proto)</emphasis> - {<emphasis
<term><emphasis role="bold">PROTO</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">{any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis
@ -428,6 +430,8 @@
role="bold">all</emphasis>}]}[,...]}</term>
<listitem>
<para>This column was formerly named PROTOCOL</para>
<para>A <emphasis>protocol-name</emphasis> (from protocols(5)), a
<emphasis>protocol-number</emphasis>, <emphasis
role="bold">ipp2p</emphasis>, <emphasis
@ -440,8 +444,8 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> (dport) -
{<emphasis role="bold">-</emphasis>|<emphasis
<term><emphasis role="bold">DPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>ipp2p-option</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
@ -460,12 +464,14 @@
("iptables -m ipp2p --help") without the leading "--". If no option
is given in this column, <emphasis role="bold">ipp2p</emphasis> is
assumed.</para>
<para>This column was formerly named DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport)-
{<emphasis role="bold">-</emphasis>|<emphasis
<term><emphasis role="bold">SPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
@ -482,20 +488,22 @@
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
DPORT. Use of '=' requires multi-port match in your iptables and
kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (user) - [<emphasis
<term><emphasis role="bold">USER</emphasis> - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
<listitem>
<para>This column may only be non-empty if the <emphasis
role="bold">CHAIN</emphasis> is <emphasis
<para>This column was formerly named USER/GROUP and may only be
non-empty if the <emphasis role="bold">CHAIN</emphasis> is <emphasis
role="bold">OUTPUT</emphasis>.</para>
<para>When this column is non-empty, the rule applies only if the

2
Shorewall/manpages/shorewall-arprules.xml
View File

@ -273,7 +273,7 @@
</varlistentry>
<varlistentry>
<term>ARP OPCODE - [[!]<replaceable>opcode</replaceable>]</term>
<term>OPCODE - [[!]<replaceable>opcode</replaceable>]</term>
<listitem>
<para>Optional. Describes the type of frame. Possible

35
Shorewall/manpages/shorewall-conntrack.xml
View File

@ -424,7 +424,7 @@
</varlistentry>
<varlistentry>
<term>DEST PORT(S) (dport) - port-number/service-name-list</term>
<term>DPORT - port-number/service-name-list</term>
<listitem>
<para>A comma-separated list of port numbers and/or service names
@ -432,11 +432,13 @@
ranges of the form
<replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
if your kernel and iptables include port range support.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>SOURCE PORT(S) (sport) - port-number/service-name-list</term>
<term>SPORT - port-number/service-name-list</term>
<listitem>
<para>A comma-separated list of port numbers and/or service names
@ -446,22 +448,24 @@
if your kernel and iptables include port range support.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>USER/GROUP (user) ‒
<term>USER ‒
[<replaceable>user</replaceable>][:<replaceable>group</replaceable>]</term>
<listitem>
<para>May only be specified if the SOURCE
<replaceable>zone</replaceable> is $FW. Specifies the effective user
id and or group id of the process sending the traffic.</para>
<para>This column was formerly named USER/GROUP and may only be
specified if the SOURCE <replaceable>zone</replaceable> is $FW.
Specifies the effective user id and or group id of the process
sending the traffic.</para>
</listitem>
</varlistentry>
@ -520,8 +524,7 @@
<para>Example 1:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT USER
CT:helper:ftp(expevents=new) fw - tcp 21 </programlisting>
<para>Example 2 (Shorewall 4.5.10 or later):</para>
@ -529,14 +532,12 @@ CT:helper:ftp(expevents=new) fw - tcp
<para>Drop traffic to/from all zones to IP address 1.2.3.4</para>
<programlisting>FORMAT 2
#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER
DROP all-:1.2.3.4 -
DROP all 1.2.3.4</programlisting>
<para>or<programlisting>FORMAT 3
#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER
DROP:P 1.2.3.4 -
DROP:PO - 1.2.3.4
</programlisting></para>

3
Shorewall/manpages/shorewall-exclusion.xml
View File

@ -76,8 +76,7 @@ z2 net REJECT</programlisting>
<para>/etc/shorewall/rules:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting>#ACTION SOURCE DEST PROTO DPORT
ACCEPT all!z2 net tcp 22</programlisting>
<para>In this case, SSH connections from <emphasis

4
Shorewall/manpages/shorewall-ipsets.xml
View File

@ -57,7 +57,7 @@
<option>dst</option>. Example: myset[src,dst].</member>
</simplelist>
<para>In a SOURCE or SOURCE PORT(S) column, the following pairs are
<para>In a SOURCE or SPORT column, the following pairs are
equivalent:</para>
<itemizedlist>
@ -66,7 +66,7 @@
</listitem>
</itemizedlist>
<para>In a DEST or DEST PORT(S) column, the following pairs are
<para>In a DEST or DPORT column, the following pairs are
equivalent:</para>
<itemizedlist>

33
Shorewall/manpages/shorewall-mangle.xml
View File

@ -570,8 +570,7 @@ INLINE eth0 - ; -p tcp -j MARK --set
that problem. SAME may be used in the PREROUTING and OUTPUT
chains. When used in PREROUTING, it causes matching
connections from an individual local system to all use the
same provider. For example: <programlisting>#ACTION SOURCE DEST PROTO DEST
# PORT(S)
same provider. For example: <programlisting>#ACTION SOURCE DEST PROTO DPORT
SAME:P 192.168.1.0/24 0.0.0.0/0 tcp 80,443</programlisting>
If a host in 192.168.1.0/24 attempts a connection on TCP port
80 or 443 and it has sent a packet on either of those ports in
@ -581,8 +580,7 @@ SAME:P 192.168.1.0/24 0.0.0.0/0 tcp 80,443</programlisting>
<para>When used in the OUTPUT chain, it causes all matching
connections to an individual remote system to all use the same
provider. For example:<programlisting>#ACTION SOURCE DEST PROTO DEST
# PORT(S)
provider. For example:<programlisting>#ACTION SOURCE DEST PROTO DPORT
SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>The
optional <replaceable>timeout</replaceable> parameter was
added in Shorewall 4.6.7 and specifies a number of seconds .
@ -835,7 +833,7 @@ Normal-Service =&gt; 0x00</programlisting>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (dport) - {<emphasis
<term><emphasis role="bold">DPORT</emphasis>- {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -863,12 +861,13 @@ Normal-Service =&gt; 0x00</programlisting>
<replaceable>ipset</replaceable> name can be specified in this
column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly named DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
{<emphasis
<term><emphasis role="bold">SPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -882,16 +881,17 @@ Normal-Service =&gt; 0x00</programlisting>
the following fields is supplied.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DEST PORTS(S). Use of
'=' requires multi-port match in your iptables and kernel.</para>
<para>Beginning with Shorewall 4.6.0, an
<replaceable>ipset</replaceable> name can be specified in this
column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
@ -1097,8 +1097,7 @@ Normal-Service =&gt; 0x00</programlisting>
by the named helper module.</para>
<para>Example: Mark all FTP data connections with mark
4:<programlisting>#ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST LENGTH TOS CONNBYTES HELPER
# PORT(S)
4:<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT USER TEST LENGTH TOS CONNBYTES HELPER
4:T 0.0.0.0/0 0.0.0.0/0 TCP - - - - - - - ftp</programlisting></para>
</listitem>
</varlistentry>
@ -1287,8 +1286,7 @@ Normal-Service =&gt; 0x00</programlisting>
<para>We assume packet/connection mark 0 means unclassified.</para>
<programlisting> #ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT USER TEST
MARK(1):T 0.0.0.0/0 0.0.0.0/0 icmp echo-request
MARK(1):T 0.0.0.0/0 0.0.0.0/0 icmp echo-reply
RESTORE:T 0.0.0.0/0 0.0.0.0/0 all - - - 0
@ -1313,8 +1311,7 @@ Normal-Service =&gt; 0x00</programlisting>
<programlisting>/etc/shorewall/tcrules:
#ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST
# PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER TEST
CONNMARK(1-3):F 192.168.1.0/24 eth0 ; state=NEW
/etc/shorewall/masq:

17
Shorewall/manpages/shorewall-masq.xml
View File

@ -249,7 +249,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (Optional) -
<term><emphasis role="bold">PORT</emphasis> (Optional) -
{-|[!]<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
<listitem>
@ -429,13 +429,14 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (Optional) -
[<emphasis
<term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
<listitem>
<para>This column was formerly labelled USER/GROUP.</para>
<para>Only locally-generated connections will match if this column
is non-empty.</para>
@ -538,8 +539,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
[<emphasis
<term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
<listitem>
@ -550,6 +550,8 @@
original destination address matches one of the listed addresses. It
is useful for specifying that SNAT should occur only for connections
that were acted on by a DNAT when they entered the firewall.</para>
<para>This column was formerly labelled ORIGINAL DEST.</para>
</listitem>
</varlistentry>
@ -639,7 +641,7 @@
172.20.1.0/29 to be sent from eth0 with source IP address
206.124.146.176.</para>
<programlisting> #INTERFACE SOURCE ADDRESS PROTO PORT(S)
<programlisting> #INTERFACE SOURCE ADDRESS PROTO DPORT
eth0 172.20.1.0/29 206.124.146.177 tcp smtp
eth0 172.20.1.0/29 206.124.146.176</programlisting>
@ -672,8 +674,7 @@
<programlisting>/etc/shorewall/tcrules:
#ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST
# PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER TEST
1-3:CF 192.168.1.0/24 eth0 ; state=NEW
/etc/shorewall/masq:

13
Shorewall/manpages/shorewall-nat.xml
View File

@ -106,15 +106,16 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ALL INTERFACES</emphasis> (allints) -
[<emphasis role="bold">Yes</emphasis>|<emphasis
role="bold">No</emphasis>]</term>
<term><emphasis role="bold">ALLINTS</emphasis> - [<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If Yes or yes, NAT will be effective from all hosts. If No or
no (or left empty) then NAT will be effective only through the
interface named in the <emphasis role="bold">INTERFACE</emphasis>
column.</para>
<para>This column was formerly labelled ALL INTERFACES.</para>
</listitem>
</varlistentry>
@ -160,8 +161,7 @@ smc eth0:10.1.10.0/24</programlisting>
<para><filename>/etc/shorewall/nat</filename>:</para>
<programlisting>#EXTERNAL INTERFACE INTERNAL ALL LOCAL
# INTERFACES
<programlisting>#EXTERNAL INTERFACE INTERNAL ALLINTS LOCAL
10.1.10.100 eth0 172.20.1.100
</programlisting>
@ -170,8 +170,7 @@ smc eth0:10.1.10.0/24</programlisting>
<para><filename>/etc/shorewall/rules</filename>:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH HELPER
?SECTION ALL
?SECTION ESTABLISHED
?SECTION RELATED

10
Shorewall/manpages/shorewall-nesting.xml
View File

@ -82,7 +82,7 @@
<para>Partial <filename>/etc/shorewall/rules</filename>:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
...
DNAT sam loc:192.168.1.3 tcp ssh
DNAT net loc:192.168.1.5 tcp www
@ -100,7 +100,7 @@
Because of the way that Netfilter is constructed, this requires two rules
as follows:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
...
ACCEPT+ sam $FW tcp ssh
DNAT net loc:192.168.1.3 tcp ssh
@ -143,8 +143,7 @@
</itemizedlist>
<para>As a consequence, the following rules will have unexpected
behavior:<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
behavior:<programlisting> #ACTION SOURCE DEST PROTO DPORT
ACCEPT net dmz tcp 80
REDIRECT loc 3128 tcp 80</programlisting></para>
@ -173,8 +172,7 @@
<para>When using other Shorewall versions, another way is to rewrite the
DNAT rule (assume that the local zone is entirely within
192.168.2.0/23):<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
192.168.2.0/23):<programlisting> #ACTION SOURCE DEST PROTO DPORT
ACCEPT net dmz tcp 80
REDIRECT loc:192.168.2.0/23 3128 tcp 80</programlisting></para>

8
Shorewall/manpages/shorewall-netmap.xml
View File

@ -137,7 +137,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S) (dport)</emphasis> -
<term><emphasis role="bold">DPORT</emphasis> -
<emphasis>port-number-or-name-list</emphasis></term>
<listitem>
@ -160,11 +160,13 @@
<para>An entry in this field requires that the PROTO column specify
icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if
any of the following field is supplied.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S) (sport)</emphasis> -
<term><emphasis role="bold">SPORT</emphasis> -
<emphasis>port-number-or-name-list</emphasis></term>
<listitem>
@ -176,6 +178,8 @@
<para>An entry in this field requires that the PROTO column specify
tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of
the following fields is supplied.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
</variablelist>

98
Shorewall/manpages/shorewall-rules.xml
View File

@ -173,9 +173,9 @@
<listitem>
<para>The remaining columns specify characteristics of the packet
before rewriting. In particular, the ORIGINAL DEST column gives the
original destination IP address of the packet and the DEST PORT(S)
column give the original destination port(s).</para>
before rewriting. In particular, the ORIGDEST column gives the
original destination IP address of the packet and the DPORT column
give the original destination port(s).</para>
</listitem>
</itemizedlist>
@ -1201,8 +1201,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S) (dport)</emphasis> -
{<emphasis
<term><emphasis role="bold">DPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -1234,7 +1233,7 @@
<para>If your kernel contains multi-port match support, then only a
single Netfilter rule will be generated if in this list and the
<emphasis role="bold">CLIENT PORT(S)</emphasis> list below:</para>
<emphasis role="bold">SPORT</emphasis> list below:</para>
<para>1. There are 15 or less ports listed.</para>
@ -1245,12 +1244,13 @@
<replaceable>ipset</replaceable> name can be specified in this
column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
{<emphasis
<term><emphasis role="bold">SPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -1260,11 +1260,10 @@
names, port numbers or port ranges.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DEST PORTS(S). Use of
'=' requires multi-port match in your iptables and kernel.</para>
<warning>
<para>Unless you really understand IP, you should leave this
@ -1274,12 +1273,12 @@
</warning>
<para>If you don't want to restrict client ports but need to specify
an <emphasis role="bold">ORIGINAL DEST</emphasis> in the next
column, then place "-" in this column.</para>
an <emphasis role="bold">ORIGDEST</emphasis> in the next column,
then place "-" in this column.</para>
<para>If your kernel contains multi-port match support, then only a
single Netfilter rule will be generated if in this list and the
<emphasis role="bold">DEST PORT(S)</emphasis> list above:</para>
<emphasis role="bold">DPORT</emphasis> list above:</para>
<para>1. There are 15 or less ports listed.</para>
@ -1290,12 +1289,13 @@
<replaceable>ipset</replaceable> name can be specified in this
column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
[<emphasis
<term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
<listitem>
@ -1344,11 +1344,13 @@
url="/PortKnocking.html">http://www.shorewall.net/PortKnocking.html</ulink>
for an example of using an entry in this column with a user-defined
action rule.</para>
<para>This column was formerly labelled ORIGINAL DEST.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">RATE LIMIT</emphasis> (rate) -
<term><emphasis role="bold">RATE</emphasis> -
<replaceable>limit</replaceable></term>
<listitem>
@ -1413,11 +1415,13 @@
enforce the per-source limit and the compiler will pick a unique
name for the hash table that tracks the per-destination
limit.</para>
<para>This column was formerly labelled RATE LIMIT.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (user) - [<emphasis
<term><emphasis role="bold">USER</emphasis> - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][,...]</term>
@ -1471,6 +1475,8 @@
</listitem>
</varlistentry>
</variablelist>
<para>This column was formerly labelled USER/GROUP.</para>
</listitem>
</varlistentry>
@ -1626,6 +1632,8 @@
<listitem>
<para>where <replaceable>dd</replaceable> is an ordinal day of
the month</para>
<para/>
</listitem>
</varlistentry>
@ -1767,9 +1775,8 @@
<listitem>
<para>Accept SMTP requests from the DMZ to the internet</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
ACCEPT dmz net tcp smtp</programlisting>
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
ACCEPT dmz net tcp smtp</programlisting>
</listitem>
</varlistentry>
@ -1780,8 +1787,7 @@
<para>Forward all ssh and http connection requests from the internet
to local system 192.168.1.3</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
DNAT net loc:192.168.1.3 tcp ssh,http</programlisting>
</listitem>
</varlistentry>
@ -1792,9 +1798,8 @@
<listitem>
<para>Forward all http connection requests from the internet to
local system 192.168.1.3 with a limit of 3 per second and a maximum
burst of 10<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE
# PORT PORT(S) DEST LIMIT
DNAT net loc:192.168.1.3 tcp http - - 3/sec:10</programlisting></para>
burst of 10<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE
DNAT net loc:192.168.1.3 tcp http - - 3/sec:10</programlisting></para>
</listitem>
</varlistentry>
@ -1806,8 +1811,7 @@
port 3128 on the firewall (Squid running on the firewall system)
except when the destination address is 192.168.2.2</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
REDIRECT loc 3128 tcp www - !192.168.2.2</programlisting>
</listitem>
</varlistentry>
@ -1819,8 +1823,7 @@
<para>All http requests from the internet to address 130.252.100.69
are to be forwarded to 192.168.1.3</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
DNAT net loc:192.168.1.3 tcp 80 - 130.252.100.69</programlisting>
</listitem>
</varlistentry>
@ -1832,10 +1835,9 @@
<para>You want to accept SSH connections to your firewall only from
internet IP addresses 130.252.100.69 and 130.252.100.70</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
ACCEPT net:130.252.100.69,130.252.100.70 $FW \
tcp 22</programlisting>
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
ACCEPT net:130.252.100.69,130.252.100.70 \
$FW tcp 22</programlisting>
</listitem>
</varlistentry>
@ -1847,8 +1849,7 @@
firewall on port 2222 and you want to forward them to local system
192.168.1.3, port 22</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
DNAT net loc:192.168.1.3:22 tcp 2222</programlisting>
</listitem>
</varlistentry>
@ -1860,8 +1861,7 @@
<para>You want to redirect connection requests to port 80 randomly
to the port range 81-90.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
REDIRECT net $FW::81-90:random tcp www</programlisting>
</listitem>
</varlistentry>
@ -1897,8 +1897,7 @@
<para>rules:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
REDIRECT loc 3128 tcp 80 </programlisting>
<simpara>Note that it would have been tempting to simply define the
@ -1926,8 +1925,7 @@
<para>Add the tuple (source IP, dest port, dest IP) of an incoming
SSH connection to the ipset S:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
ADD(+S:dst,src,dst) net fw tcp 22</programlisting>
</listitem>
</varlistentry>
@ -1939,8 +1937,7 @@
<para>You wish to limit SSH connections from remote systems to 1/min
with a burst of three (to allow for limited retry):</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE
# PORT(S) PORT(S) DEST LIMIT
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE
SSH(ACCEPT) net all - - - - s:1/min:3</programlisting>
</listitem>
</varlistentry>
@ -1952,8 +1949,7 @@
<para>Forward port 80 to dmz host $BACKUP if switch 'primary_down'
is on.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH
# PORT(S) PORT(S) DEST LIMIT GROUP
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH
DNAT net dmz:$BACKUP tcp 80 - - - - - - - - primary_down</programlisting>
</listitem>
</varlistentry>
@ -1965,8 +1961,7 @@
<para>Drop all email from the <emphasis>Anonymous Proxy</emphasis>
and <emphasis>Satellite Provider</emphasis> address ranges:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
DROP net:^A1,A2 fw tcp 25</programlisting>
</listitem>
</varlistentry>
@ -1978,8 +1973,7 @@
<para>You want to generate your own rule involving iptables targets
and matches not supported by Shorewall.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
INLINE $FW net ; -p 6 -m mickey-mouse --name test -m set --match-set set1 src -m mickey-mouse --name test2 -j SECCTX --name test3</programlisting>
<para>The above will generate the following iptables-restore

16
Shorewall/manpages/shorewall-secmarks.xml
View File

@ -93,7 +93,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CHAIN:STATE (chain) -
<term><emphasis role="bold">CHAIN -
{P|I|F|O|T}[:{N|I|U|IU|NI|NU|NIU|NUI:E|ER}]</emphasis></term>
<listitem>
@ -140,6 +140,8 @@
<member>:NIU - NEW, INVALID or UNTRACKED connection.</member>
</simplelist>
<para>This column was formerly labelled CHAIN:STATE.</para>
</listitem>
</varlistentry>
</variablelist>
@ -236,7 +238,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (dport) - [<emphasis
<term><emphasis role="bold">DPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -259,12 +261,13 @@
<para>This column is ignored if PROTOCOL = all but must be entered
if any of the following field is supplied. In that case, it is
suggested that this field contain "-"</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
[<emphasis
<term><emphasis role="bold">SPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -272,6 +275,8 @@
<para>Optional source port(s). If omitted, any source port is
acceptable. Specified as a comma-separated list of port names, port
numbers or port ranges.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
@ -388,8 +393,7 @@
<para><filename>/etc/shorewall/secmarks</filename>:</para>
<programlisting>#SECMARK CHAIN: SOURCE DEST PROTO DEST SOURCE USER/ MARK
# STATE PORT(S) PORT(S) GROUP
<programlisting>#SECMARK CHAIN SOURCE DEST PROTO DPORT SPORT USER MARK
system_u:object_r:mysqld_packet_t:s0 I:N lo 127.0.0.1 tcp 3306
SAVE I:N lo 127.0.0.1 tcp 3306
RESTORE I:ER</programlisting>

17
Shorewall/manpages/shorewall-stoppedrules.xml
View File

@ -112,7 +112,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S) (dport)</emphasis> ‒
<term><emphasis role="bold">DPORT</emphasis> ‒
<replaceable>service-name/port-number-list</replaceable></term>
<listitem>
@ -121,11 +121,13 @@
include port ranges of the form
<replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
if your kernel and iptables include port range support.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S) (sport)</emphasis> ‒
<term><emphasis role="bold">SPORT</emphasis> ‒
<replaceable>service-name/port-number-list</replaceable></term>
<listitem>
@ -136,11 +138,12 @@
if your kernel and iptables include port range support.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DEST PORTS(S). Use of
'=' requires multi-port match in your iptables and kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
</variablelist>

15
Shorewall/manpages/shorewall-tcfilters.xml
View File

@ -135,7 +135,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT</emphasis> (dport) - [<emphasis
<term><emphasis role="bold">DPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
@ -143,16 +143,19 @@
a <emphasis>port number</emphasis>; if the protocol is <emphasis
role="bold">icmp</emphasis>, this column is interpreted as the
destination icmp-type(s).</para>
<para>This column was previously labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT</emphasis> (sport) -
[<emphasis
<term><emphasis role="bold">SPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
<para>Optional source port.</para>
<para>This column was previously labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
@ -292,8 +295,7 @@
ALL cannot be used because IPv4 ICMP and IPv6 ICMP are two different
protocols.</para>
<programlisting> #CLASS SOURCE DEST PROTO DEST
# PORT
<programlisting> #CLASS SOURCE DEST PROTO DPORT
IPV4
@ -314,8 +316,7 @@
<para>Add two filters with priority 10 (Shorewall 4.5.8 or
later).</para>
<programlisting> #CLASS SOURCE DEST PROTO DEST PRIORITY
# PORT
<programlisting> #CLASS SOURCE DEST PROTO DPORT PRIORITY
IPV4

33
Shorewall6/manpages/shorewall6-accounting.xml
View File

@ -349,7 +349,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DESTINATION</emphasis> (dest) - {<emphasis
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><option>:[</option><emphasis>address</emphasis><option>]</option>|<emphasis>address</emphasis>}</term>
@ -359,11 +359,13 @@
<para>Format same as <emphasis role="bold">SOURCE</emphasis>
column.</para>
<para>This column was formerly labelled DESTINATION.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> (proto) - {<emphasis
<term><emphasis role="bold">PROTO</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis
@ -381,12 +383,14 @@
<para>Beginning with Shorewall 4.5.12, this column can accept a
comma-separated list of protocols.</para>
<para>This column was formerly labelled PROTOCOL.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> (dport) -
{<emphasis role="bold">-</emphasis>|<emphasis
<term><emphasis role="bold">DPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>ipp2p-option</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
@ -405,12 +409,14 @@
("ip6tables -m ipp2p --help") without the leading "--". If no option
is given in this column, <emphasis role="bold">ipp2p</emphasis> is
assumed.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
{<emphasis role="bold">-</emphasis>|<emphasis
<term><emphasis role="bold">SPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">any</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
@ -424,16 +430,17 @@
support.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (user) - [<emphasis
<term><emphasis role="bold">USER</emphasis> - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
@ -490,6 +497,8 @@
</listitem>
</varlistentry>
</variablelist>
<para>This column was formerly labelled USER/GROUP.</para>
</listitem>
</varlistentry>

217
Shorewall6/manpages/shorewall6-blacklist.xml
View File

@ -1,217 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall6-blacklist</refentrytitle>
<manvolnum>5</manvolnum>
<refmiscinfo>Configuration Files</refmiscinfo>
</refmeta>
<refnamediv>
<refname>blacklist</refname>
<refpurpose>shorewall6 Blacklist file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall6/blacklist</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>The blacklist file is used to perform static blacklisting by source
address (IP or MAC), or by application. The use of this file is deprecated
in favor of <ulink
url="/manpages6/shorewall6-blrules.html">shorewall6-blrules</ulink>(5),
and beginning with Shorewall 4.5.7, the blacklist file is no longer
installed. Existing blacklist files can be converted to a corresponding
blrules file using the <command>shorewall6 update -b</command>
command.</para>
<para>The columns in the file are as follows (where the column name is
followed by a different name in parentheses, the different name is used in
the alternate specification syntax).</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">ADDRESS/SUBNET</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">~</emphasis><emphasis>mac-address</emphasis>|<emphasis>ip-address</emphasis>|<emphasis>address-range</emphasis>|<emphasis
role="bold">+</emphasis><emphasis>ipset</emphasis>}</term>
<listitem>
<para>Host address, network address, MAC address, IP address range
(if your kernel and ip6tables contain iprange match support) or
ipset name prefaced by "+" (if your kernel supports ipset match).
Exclusion (<ulink
url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5))
is supported.</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
<para>A dash ("-") in this column means that any source address will
match. This is useful if you want to blacklist a particular
application using entries in the PROTOCOL and PORTS columns.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> (proto) - {<emphasis
role="bold">-</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis>protocol-name</emphasis>}</term>
<listitem>
<para>Optional - if specified, must be a protocol number or a
protocol name from protocols(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORTS</emphasis> (port) - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
<listitem>
<para>May only be specified if the protocol is TCP (6), UDP (17),
DCCP (33), SCTP (132) or UDPLITE (136). A comma-separated list of
destination port numbers or service names from services(5).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>OPTIONS - {-|{dst|src|whitelist|audit}[,...]}</term>
<listitem>
<para>Optional - added in 4.4.12. If specified, indicates whether
traffic <emphasis>from</emphasis> ADDRESS/SUBNET (<emphasis
role="bold">src</emphasis>) or traffic <emphasis>to</emphasis>
ADDRESS/SUBNET (<emphasis role="bold">dst</emphasis>) should be
blacklisted. The default is <emphasis role="bold">src</emphasis>. If
the ADDRESS/SUBNET column is empty, then this column has no effect
on the generated rule.</para>
<note>
<para>In Shorewall 4.4.12, the keywords from and to were used in
place of src and dst respectively. Blacklisting was still
restricted to traffic <emphasis>arriving</emphasis> on an
interface that has the 'blacklist' option set. So to block traffic
from your local network to an internet host, you had to specify
<option>blacklist</option> on your internal interface in <ulink
url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
(5).</para>
</note>
<note>
<para>Beginning with Shorewall 4.4.13, entries are applied based
on the <emphasis role="bold">blacklist</emphasis> setting in
<ulink
url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5):</para>
<orderedlist>
<listitem>
<para>'blacklist' in the OPTIONS or IN_OPTIONS column. Traffic
from this zone is passed against the entries in this file that
have the <emphasis role="bold">src</emphasis> option
(specified or defaulted).</para>
</listitem>
<listitem>
<para>'blacklist' in the OPTIONS or OUT_OPTIONS column.
Traffic to this zone is passed against the entries in this
file that have the <emphasis role="bold">dst</emphasis>
option.</para>
</listitem>
</orderedlist>
</note>
<para>In Shorewall 4.4.20, the <emphasis
role="bold">whitelist</emphasis> option was added. When <emphasis
role="bold">whitelist</emphasis> is specified, packets/connections
that match the entry are not matched against the remaining entries
in the file.</para>
<para>The <emphasis role="bold">audit</emphasis> option was also
added in 4.4.20 and causes packets matching the entry to be audited.
The <emphasis role="bold">audit</emphasis> option may not be
specified in whitelist entries and require AUDIT_TARGET support in
the kernel and ip6tables.</para>
</listitem>
</varlistentry>
</variablelist>
<para>When a packet arrives on an interface that has the <emphasis
role="bold">blacklist</emphasis> option specified in <ulink
url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5),
its source IP address and MAC address is checked against this file and
disposed of according to the <emphasis
role="bold">BLACKLIST_DISPOSITION</emphasis> and <emphasis
role="bold">BLACKLIST_LOGLEVEL</emphasis> variables in <ulink
url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5). If
<emphasis role="bold">PROTOCOL</emphasis> or <emphasis
role="bold">PROTOCOL</emphasis> and <emphasis role="bold">PORTS</emphasis>
are supplied, only packets matching the protocol (and one of the ports if
<emphasis role="bold">PORTS</emphasis> supplied) are blocked.</para>
</refsect1>
<refsect1>
<title>Example</title>
<variablelist>
<varlistentry>
<term>Example 1:</term>
<listitem>
<para>To block DNS queries from address
fe80::2a0:ccff:fedb:31c4:</para>
<programlisting> #ADDRESS/SUBNET PROTOCOL PORT
fe80::2a0:ccff:fedb:31c4/ udp 53</programlisting>
</listitem>
</varlistentry>
<varlistentry>
<term>Example 2:</term>
<listitem>
<para>To block some of the nuisance applications:</para>
<programlisting> #ADDRESS/SUBNET PROTOCOL PORT
- udp 1024:1033,1434
- tcp 57,1433,1434,2401,2745,3127,3306,3410,4899,5554,6101,8081,9898</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall6/blacklist</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="/blacklisting_support.htm">http://www.shorewall.net/blacklisting_support.htm</ulink></para>
<para><ulink
url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
shorewall6-providers(5), shorewall6-rtrules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
shorewall6-zones(5)</para>
</refsect1>
</refentry>

28
Shorewall6/manpages/shorewall6-conntrack.xml
View File

@ -414,7 +414,7 @@
</varlistentry>
<varlistentry>
<term>DEST PORT(S) (dport) -
<term>DPORT -
{-|<replaceable>port-number/service-name-list</replaceable>|+<replaceable>ipset</replaceable>}</term>
<listitem>
@ -427,11 +427,13 @@
<para>Beginning with Shorewall 4.6.0, an ipset name can be specified
in this column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>SOURCE PORT(S) (sport) -
<term>SPORT -
{-|<replaceable>port-number/service-name-list</replaceable>|+<replaceable>ipset</replaceable>}</term>
<listitem>
@ -442,25 +444,28 @@
if your kernel and iptables include port range support.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S).</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT.</para>
<para>Beginning with Shorewall 4.6.0, an ipset name can be specified
in this column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>USER/GROUP (user) ‒
<term>USER ‒
[<replaceable>user</replaceable>][:<replaceable>group</replaceable>]</term>
<listitem>
<para>May only be specified if the SOURCE
<replaceable>zone</replaceable> is $FW. Specifies the effective user
id and or group id of the process sending the traffic.</para>
<para>This column was formerly labelled USER/GROUP.</para>
</listitem>
</varlistentry>
@ -523,8 +528,7 @@
itself.</para>
<programlisting>FORMAT 2
#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER
CT:helper:ftp(expevents=new) fw - tcp 21 </programlisting>
<para>Example 2 (Shorewall 4.5.10 or later):</para>
@ -532,15 +536,13 @@ CT:helper:ftp(expevents=new) fw - tcp
<para>Drop traffic to/from all zones to IP address 2001:1.2.3::4</para>
<programlisting>FORMAT 2
#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER
DROP all-:2001:1.2.3::4 -
DROP all 2001:1.2.3::4
</programlisting>
<para>or<programlisting>FORMAT 3
#ACTION SOURCE DEST PROTO DEST SOURCE USER/GROUP
# PORT(S) PORT(S)
#ACTION SOURCE DEST PROTO DPORT SPORT USER
DROP:P 2001:1.2.3::4 -
DROP:PO - 2001:1.2.3::4
</programlisting></para>

4
Shorewall6/manpages/shorewall6-ipsets.xml
View File

@ -56,7 +56,7 @@
<option>dst</option>. Example: myset[src,dst].</member>
</simplelist>
<para>In a SOURCE or SOURCE PORT(S) column, the following pairs are
<para>In a SOURCE or SPORT column, the following pairs are
equivalent:</para>
<itemizedlist>
@ -65,7 +65,7 @@
</listitem>
</itemizedlist>
<para>In a DEST or DEST PORT(S) column, the following pairs are
<para>In a DEST or DPORT column, the following pairs are
equivalent:</para>
<itemizedlist>

30
Shorewall6/manpages/shorewall6-mangle.xml
View File

@ -593,8 +593,7 @@ INLINE eth0 - ; -p tcp -j MARK --set
that problem. SAME may be used in the PREROUTING and OUTPUT
chains. When used in PREROUTING, it causes matching
connections from an individual local system to all use the
same provider. For example: <programlisting>#ACTION SOURCE DEST PROTO DEST
# PORT(S)
same provider. For example: <programlisting>#ACTION SOURCE DEST PROTO DPORT
SAME:P 192.168.1.0/24 0.0.0.0/0 tcp 80,443</programlisting>
If a host in 192.168.1.0/24 attempts a connection on TCP port
80 or 443 and it has sent a packet on either of those ports in
@ -604,8 +603,7 @@ SAME:P 192.168.1.0/24 0.0.0.0/0 tcp 80,443</programlisting>
<para>When used in the OUTPUT chain, it causes all matching
connections to an individual remote system to all use the same
provider. For example:<programlisting>#ACTION SOURCE DEST PROTO DEST
# PORT(S)
provider. For example:<programlisting>#ACTION SOURCE DEST PROTO DPORT
SAME $FW 0.0.0.0/0 tcp 80,443</programlisting>The
optional <replaceable>timeout</replaceable> parameter was
added in Shorewall 4.6.7 and specifies a number of seconds .
@ -812,7 +810,7 @@ Normal-Service =&gt; 0x00</programlisting>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (dport) - [<emphasis
<term><emphasis role="bold">DPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -835,12 +833,13 @@ Normal-Service =&gt; 0x00</programlisting>
<para>An entry in this field requires that the PROTO column specify
icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if
any of the following field is supplied.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
[<emphasis
<term><emphasis role="bold">SPORT </emphasis>- [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -854,11 +853,12 @@ Normal-Service =&gt; 0x00</programlisting>
the following fields is supplied.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
@ -1064,8 +1064,7 @@ Normal-Service =&gt; 0x00</programlisting>
by the named helper module.</para>
<para>Example: Mark all FTP data connections with mark
4:<programlisting>#ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST LENGTH TOS CONNBYTES HELPER
# PORT(S)
4:<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT USER TEST LENGTH TOS CONNBYTES HELPER
4:T 0.0.0.0/0 0.0.0.0/0 TCP - - - - - - - ftp</programlisting></para>
</listitem>
</varlistentry>
@ -1348,8 +1347,7 @@ Normal-Service =&gt; 0x00</programlisting>
<para>We assume packet/connection mark 0 means unclassified.</para>
<programlisting> #ACTION SOURCE DEST PROTO PORT(S) SOURCE USER TEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT USER TEST
MARK(1):T ::/0 ::/0 icmp echo-request
MARK(1):T ::/0 ::/0 icmp echo-reply
RESTORE:T ::/0 ::/0 all - - - 0

10
Shorewall6/manpages/shorewall6-masq.xml
View File

@ -199,7 +199,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (Optional) -
<term><emphasis role="bold">DPORT</emphasis> (Optional) -
{-|[!]<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
<listitem>
@ -379,8 +379,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (Optional) -
[<emphasis
<term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
@ -488,8 +487,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
[<emphasis
<term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
<listitem>
@ -500,6 +498,8 @@
the listed addresses. It is useful for specifying that SNAT should
occur only for connections that were acted on by a DNAT when they
entered the firewall.</para>
<para>This column was formerly labelled ORIGINAL DEST.</para>
</listitem>
</varlistentry>

7
Shorewall6/manpages/shorewall6-nat.xml
View File

@ -103,15 +103,16 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ALL INTERFACES</emphasis> (allints) -
[<emphasis role="bold">Yes</emphasis>|<emphasis
role="bold">No</emphasis>]</term>
<term><emphasis role="bold">ALLINTS</emphasis> - [<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>If Yes or yes, NAT will be effective from all hosts. If No or
no (or left empty) then NAT will be effective only through the
interface named in the <emphasis role="bold">INTERFACE</emphasis>
column.</para>
<para>This column was formerly labelled ALL INTERFACES.</para>
</listitem>
</varlistentry>

2
Shorewall6/manpages/shorewall6-nesting.xml
View File

@ -82,7 +82,7 @@
<para>Partial <filename>/etc/shorewall6/rules</filename>:</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
...
ACCEPT sam loc:2001:19f0:feee::3 tcp ssh
ACCEPT net loc:2001:19f0:feee::5 tcp www

8
Shorewall6/manpages/shorewall6-netmap.xml
View File

@ -137,7 +137,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> (dport) -
<term><emphasis role="bold">DPORT</emphasis> -
<emphasis>port-number-or-name-list</emphasis></term>
<listitem>
@ -159,11 +159,13 @@
<para>An entry in this field requires that the PROTO column specify
icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if
any of the following field is supplied.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
<term><emphasis role="bold">SPORT</emphasis> -
<emphasis>port-number-or-name-list</emphasis></term>
<listitem>
@ -174,6 +176,8 @@
<para>An entry in this field requires that the PROTO column specify
tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if any of
the following fields is supplied.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
</variablelist>

56
Shorewall6/manpages/shorewall6-rules.xml
View File

@ -1111,8 +1111,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S) </emphasis>(dport) -
{<emphasis
<term><emphasis role="bold">DPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -1144,8 +1143,7 @@
<para>If your kernel contains multi-port match support, then only a
single Netfilter rule will be generated in this list and the
<emphasis role="bold">CLIENT PORT(S)</emphasis> list below
if:</para>
<emphasis role="bold">SPORT</emphasis> list below if:</para>
<para>1. There are 15 or less ports listed.</para>
@ -1156,12 +1154,13 @@
<replaceable>ipset</replaceable> name can be specified in this
column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
{<emphasis
<term><emphasis role="bold">SPORT</emphasis> - {<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
@ -1171,11 +1170,10 @@
numbers or port ranges.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
<warning>
<para>Unless you really understand IP, you should leave this
@ -1189,7 +1187,7 @@
<para>If your kernel contains multi-port match support, then only a
single Netfilter rule will be generated if in this list and the
<emphasis role="bold">DEST PORT(S)</emphasis> list above:</para>
<emphasis role="bold">DPORT</emphasis> list above:</para>
<para>1. There are 15 or less ports listed.</para>
@ -1199,21 +1197,25 @@
<para>Beginning with Shorewall 4.6.0, an ipset name can be specified
in this column. This is intended to be used with
<firstterm>bitmap:port</firstterm> ipsets.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
[<emphasis role="bold">-</emphasis>]</term>
<term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
role="bold">-</emphasis>]</term>
<listitem>
<para>Included for compatibility with Shorewall. Enter '-' in this
column if you need to specify one of the later columns.</para>
<para>This column was formerly labelled ORIGINAL DEST.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">RATE LIMIT</emphasis> (rate) -
<term><emphasis role="bold">RATE</emphasis> -
<replaceable>limit</replaceable></term>
<listitem>
@ -1278,11 +1280,13 @@
enforce the per-source limit and the compiler will pick a unique
name for the hash table that tracks the per-destination
limit.</para>
<para>This column was formerly labelled RATE LIMIT.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">USER/GROUP</emphasis> (user) - [<emphasis
<term><emphasis role="bold">USER</emphasis> - [<emphasis
role="bold">!</emphasis>][<emphasis>user-name-or-number-or-range</emphasis>][<emphasis
role="bold">:</emphasis><emphasis>group-name-or-number-or-range</emphasis>]</term>
@ -1336,6 +1340,8 @@
</listitem>
</varlistentry>
</variablelist>
<para>This column was formerly labelled USER/GROUP.</para>
</listitem>
</varlistentry>
@ -1716,8 +1722,7 @@
<listitem>
<para>Accept SMTP requests from the DMZ to the internet</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
ACCEPT dmz net tcp smtp</programlisting>
</listitem>
</varlistentry>
@ -1730,8 +1735,7 @@
internet IP addresses 2002:ce7c::92b4:1::2 and
2002:ce7c::92b4:1::22</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL
# PORT PORT(S) DEST
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
ACCEPT net:&lt;2002:ce7c::92b4:1::2,2002:ce7c::92b4:1::22&gt; \
$FW tcp 22</programlisting>
</listitem>
@ -1744,8 +1748,7 @@
<para>You wish to limit SSH connections from remote systems to 1/min
with a burst of three (to allow for limited retry):</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE
# PORT(S) PORT(S) DEST LIMIT
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE
SSH(ACCEPT) net all - - - - s:1/min:3</programlisting>
</listitem>
</varlistentry>
@ -1757,8 +1760,7 @@
<para>Forward port 80 to dmz host $BACKUP if switch 'primary_down'
is set.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH
# PORT(S) PORT(S) DEST LIMIT GROUP
<programlisting> #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH
DNAT net dmz:$BACKUP tcp 80 - - - - - - - - primary_down</programlisting>
</listitem>
</varlistentry>
@ -1770,8 +1772,7 @@
<para>Drop all email from IP addresses in the country whose ISO-3661
country code is ZZ.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
DROP net:^ZZ fw tcp 25</programlisting>
</listitem>
</varlistentry>
@ -1783,8 +1784,7 @@
<para>You want to generate your own rule involving ip6tables targets
and matches not supported by Shorewall.</para>
<programlisting> #ACTION SOURCE DEST PROTO DEST
# PORT(S)
<programlisting> #ACTION SOURCE DEST PROTO DPORT
INLINE $FW net ; -p 6 -m mickey-mouse --name test -m set --match-set set1 src -m mickey-mouse --name test2 -j SECCTX --name test3</programlisting>
<para>The above will generate the following ip6tables-restore

27
Shorewall6/manpages/shorewall6-secmarks.xml
View File

@ -92,7 +92,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CHAIN:STATE (chain) -
<term><emphasis role="bold">CHAIN -
{P|I|F|O|T}[:{N|I|U|IU|NI|NU|NIU|NUI:E|ER}]</emphasis></term>
<listitem>
@ -139,6 +139,8 @@
<member>:NIU - NEW, INVALID or UNTRACKED connection.</member>
</simplelist>
<para>This column was formerly labelled CHAIN:STATE.</para>
</listitem>
</varlistentry>
</variablelist>
@ -229,7 +231,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PORT(S)</emphasis> (dport) - [<emphasis
<term><emphasis role="bold">DPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -249,15 +251,14 @@
If no PORT is given, <emphasis role="bold">ipp2p</emphasis> is
assumed.</para>
<para>This column is ignored if PROTOCOL = all but must be entered
if any of the following field is supplied. In that case, it is
<para>This column is ignored if PROTO = all but must be entered if
any of the following field is supplied. In that case, it is
suggested that this field contain "-"</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> (sport) -
[<emphasis
<term><emphasis role="bold">SPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[<emphasis
role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>]...]</term>
@ -267,11 +268,10 @@
numbers or port ranges.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
</listitem>
</varlistentry>
@ -318,6 +318,8 @@
</listitem>
</varlistentry>
</variablelist>
<para>This column was formerly labelled USER/GROUP.</para>
</listitem>
</varlistentry>
@ -388,8 +390,7 @@
<para><filename>/etc/shorewall6/secmarks</filename>:</para>
<programlisting>#SECMARK CHAIN: SOURCE DEST PROTO DEST SOURCE USER/ MARK
# STATE PORT(S) PORT(S) GROUP
<programlisting>#SECMARK CHAIN SOURCE DEST PROTO DPORT SPORT USER MARK
system_u:object_r:mysqld_packet_t:s0 I:N lo ::1 tcp 3306
SAVE I:N
RESTORE I:ER</programlisting>

17
Shorewall6/manpages/shorewall6-stoppedrules.xml
View File

@ -112,7 +112,7 @@
</varlistentry>
<varlistentry>
<term>DEST PORT(S) (dport) ‒
<term>DPORT ‒
<replaceable>service-name/port-number-list</replaceable></term>
<listitem>
@ -121,11 +121,13 @@
include port ranges of the form
<replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
if your kernel and iptables include port range support.</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term>SOURCE PORT(S) (sport) ‒
<term>SPORT ‒
<replaceable>service-name/port-number-list</replaceable></term>
<listitem>
@ -136,11 +138,12 @@
if your kernel and iptables include port range support.</para>
<para>Beginning with Shorewall 4.5.15, you may place '=' in this
column, provided that the DEST PORT(S) column is non-empty. This
causes the rule to match when either the source port or the
destination port in a packet matches one of the ports specified in
DEST PORTS(S). Use of '=' requires multi-port match in your iptables
and kernel.</para>
column, provided that the DPORT column is non-empty. This causes the
rule to match when either the source port or the destination port in
a packet matches one of the ports specified in DPORT. Use of '='
requires multi-port match in your iptables and kernel.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
</variablelist>

17
Shorewall6/manpages/shorewall6-tcfilters.xml
View File

@ -131,7 +131,7 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT</emphasis> (dport) - [<emphasis
<term><emphasis role="bold">DPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
@ -139,16 +139,19 @@
a <emphasis>port number</emphasis>; if the protocol is <emphasis
role="bold">icmp</emphasis>, this column is interpreted as the
destination icmp-type(s).</para>
<para>This column was formerly labelled DEST PORT(S).</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT</emphasis> (sport) -
[<emphasis
<term><emphasis role="bold">SPORT</emphasis> - [<emphasis
role="bold">-</emphasis>|<emphasis>port-name-or-number</emphasis>]</term>
<listitem>
<para>Optional source port.</para>
<para>This column was formerly labelled SOURCE PORT(S).</para>
</listitem>
</varlistentry>
@ -286,8 +289,7 @@
ALL cannot be used because IPv4 ICMP and IPv6 ICMP are two different
protocols.</para>
<programlisting> #CLASS SOURCE DEST PROTO DEST
# PORT
<programlisting> #CLASS SOURCE DEST PROTO DPORT
IPV4
@ -308,8 +310,7 @@
<para>Add two filters with priority 10 (Shorewall 4.5.8 or
later).</para>
<programlisting> #CLASS SOURCE DEST PROTO DEST PRIORITY
# PORT
<programlisting> #CLASS SOURCE DEST PROTO DPORT PRIORITY
IPV6
@ -338,6 +339,6 @@
<para><ulink
url="/PacketMarking.html">http://www.shorewall.net/PacketMarking.html</ulink></para>
<para></para>
<para/>
</refsect1>
</refentry>

1240
Shorewall6/manpages/shorewall6-tcrules.xml
View File

File diff suppressed because it is too large Load Diff

181
Shorewall6/manpages/shorewall6-tos.xml
View File

@ -1,181 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<refentry>
<refmeta>
<refentrytitle>shorewall6-tos</refentrytitle>
<manvolnum>5</manvolnum>
<refmiscinfo>Configuration Files</refmiscinfo>
</refmeta>
<refnamediv>
<refname>tos</refname>
<refpurpose>Shorewall6 Type of Service rules file</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>/etc/shorewall6/tos</command>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>This file defines rules for setting Type Of Service (TOS). Its use
is deprecated, beginning in Shorewall 4.5.1, in favor of the TOS target in
<ulink url="/manpages6/shorewall6-mangle.html">shorewall6-mangle</ulink>
(5).</para>
<para>The columns in the file are as follows.</para>
<variablelist>
<varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
role="bold">all</emphasis>|<emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>:<emphasis>address</emphasis>|<emphasis
role="bold">$FW</emphasis>}</term>
<listitem>
<para>If <emphasis role="bold">all</emphasis>, may optionally be
followed by ":" and an IP address, a MAC address, a subnet
specification or the name of an interface.</para>
<para>Example: all:2002:ce7c::92b4:1::2</para>
<para>MAC addresses must be prefixed with "~" and use "-" as a
separator.</para>
<para>Example: ~00-A0-C9-15-39-78</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST</emphasis> - {<emphasis
role="bold">all</emphasis>|<emphasis>address</emphasis>]|<emphasis
role="bold">all</emphasis>:<emphasis>address</emphasis>}</term>
<listitem>
<para>Example: 2002:ce7c::92b4:1::2</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">PROTOCOL</emphasis> -
<emphasis>proto-name-or-number</emphasis></term>
<listitem>
<para>Protocol name or number.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> -
{-|<emphasis>port</emphasis>|<emphasis>lowport</emphasis><emphasis
role="bold">:</emphasis><emphasis>highport</emphasis>}</term>
<listitem>
<para>Source port or port range. If all ports, use "-".</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">DEST PORT(S)</emphasis> -
{-|<emphasis>port</emphasis>|<emphasis>lowport</emphasis><emphasis
role="bold">:</emphasis><emphasis>highport</emphasis>}</term>
<listitem>
<para>Destination port or port range. If all ports, use "-"</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">TOS</emphasis> -
<emphasis>tos</emphasis></term>
<listitem>
<para>Must be one of the following;</para>
<programlisting> <emphasis role="bold">tos-minimize-delay</emphasis> (16)
<emphasis role="bold">tos-maximize-throughput</emphasis> (8)
<emphasis role="bold">tos-maximize-reliability</emphasis> (4)
<emphasis role="bold">tos-minimize-cost</emphasis> (2)
<emphasis role="bold">tos-normal-service</emphasis> (0)</programlisting>
<para>To specify more than one flag, add their values together and
specify the numeric result.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">MARK</emphasis> - [<emphasis
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
role="bold">:C</emphasis>]</term>
<listitem>
<para>If you don't want to define a test but need to specify
anything in the following columns, place a "-" in this field.</para>
<variablelist>
<varlistentry>
<term>!</term>
<listitem>
<para>Inverts the test (not equal)</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>value</emphasis></term>
<listitem>
<para>Value of the packet or connection mark.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis>mask</emphasis></term>
<listitem>
<para>A mask to be applied to the mark before testing.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">:C</emphasis></term>
<listitem>
<para>Designates a connection mark. If omitted, the packet
mark's value is tested.</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>FILES</title>
<para>/etc/shorewall6/tos</para>
</refsect1>
<refsect1>
<title>See ALSO</title>
<para><ulink
url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5),
shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-mangle(5), shorewall6-tunnels(5), shorewall6-zones(5)</para>
</refsect1>
</refentry>